diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a0017c55..22d787e3 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -121,6 +121,53 @@ updates:
       - dependency-name: "@astrojs/cloudflare"
         update-types: ["version-update:semver-major"]
 
+  # Shared workspace packages under packages/. The glob matches nothing when the
+  # directory is absent, so products without packages/ get no entry in effect.
+  - package-ecosystem: bun
+    directories:
+      - /packages/*
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 4
+    labels: ["dependencies"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: scope
+    cooldown:
+      default-days: 7
+    groups:
+      production-dependencies:
+        dependency-type: "production"
+        patterns: ["*"]
+      development-dependencies:
+        dependency-type: "development"
+        patterns: ["*"]
+
+  - package-ecosystem: bun
+    directory: /apps/site
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 4
+    labels: ["dependencies"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: scope
+    cooldown:
+      default-days: 7
+    groups:
+      production-dependencies:
+        dependency-type: "production"
+        patterns: ["*"]
+      development-dependencies:
+        dependency-type: "development"
+        patterns: ["*"]
+
   - package-ecosystem: github-actions
     directory: /
     schedule:
@@ -185,6 +232,26 @@ updates:
       - dependency-name: "node"
         update-types: ["version-update:semver-major"]
 
+  - package-ecosystem: docker
+    directory: /apps/site
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 4
+    labels: ["dependencies", "docker"]
+    commit-message:
+      prefix: "chore(docker)"
+    groups:
+      docker-images:
+        patterns: ["*"]
+    ignore:
+      - dependency-name: "oven/bun"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "nginx"
+        update-types: ["version-update:semver-major"]
+
   - package-ecosystem: docker
     directory: /infra/compose/compose
     schedule:
diff --git a/.github/desired-repo-settings.json b/.github/desired-repo-settings.json
index fa8d2c52..62a6393d 100644
--- a/.github/desired-repo-settings.json
+++ b/.github/desired-repo-settings.json
@@ -9,7 +9,8 @@
     "delete_branch_on_merge": true,
     "allow_squash_merge": true,
     "allow_merge_commit": false,
-    "allow_rebase_merge": false
+    "allow_rebase_merge": false,
+    "squash_merge_commit_title": "PR_TITLE"
   },
   "branch_protection_main": {
     "required_status_check_contexts": [
@@ -23,7 +24,8 @@
       "typecheck + lint + test",
       "validate",
       "yamllint (compose + workflows)",
-      "agent verification contract"
+      "agent verification contract",
+      "pull request title (conventional commit)"
     ],
     "required_approving_review_count": 0,
     "dismiss_stale_reviews": true,
diff --git a/.github/workflows/agent-verification.yml b/.github/workflows/agent-verification.yml
index cf0c77bb..70d9e4d3 100644
--- a/.github/workflows/agent-verification.yml
+++ b/.github/workflows/agent-verification.yml
@@ -1,3 +1,7 @@
+# Known gap: this workflow does not run the API, UI or browser lanes, so it never
+# compares observed cases with tools/agent/inventories/*.json. agent:check only
+# validates that the committed baselines parse and are non-empty. See
+# tools/agent/README.md "CI enforcement".
 name: agent-verification
 on:
   pull_request:
@@ -24,7 +28,7 @@ permissions:
 jobs:
   verify:
     name: agent verification contract
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 40
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/apps-api-acl-drift.yml b/.github/workflows/apps-api-acl-drift.yml
index 8c0e3ffe..24e627b4 100644
--- a/.github/workflows/apps-api-acl-drift.yml
+++ b/.github/workflows/apps-api-acl-drift.yml
@@ -31,7 +31,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/api
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 5
 
     steps:
diff --git a/.github/workflows/apps-api-ci.yml b/.github/workflows/apps-api-ci.yml
index 8fa48377..a84da9d5 100644
--- a/.github/workflows/apps-api-ci.yml
+++ b/.github/workflows/apps-api-ci.yml
@@ -23,7 +23,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/api
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 10
 
     services:
diff --git a/.github/workflows/apps-api-openapi-drift.yml b/.github/workflows/apps-api-openapi-drift.yml
index 2016f2bf..748c617a 100644
--- a/.github/workflows/apps-api-openapi-drift.yml
+++ b/.github/workflows/apps-api-openapi-drift.yml
@@ -20,7 +20,7 @@ permissions:
 jobs:
   drift:
     name: apps/ui OpenAPI schema is fresh
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 8
 
     # The job always runs (so the required-status-check rule on `main` is
diff --git a/.github/workflows/apps-api-release.yml b/.github/workflows/apps-api-release.yml
index 675b280f..1b1df5d6 100644
--- a/.github/workflows/apps-api-release.yml
+++ b/.github/workflows/apps-api-release.yml
@@ -29,7 +29,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/api
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 20
     steps:
       - name: Checkout
diff --git a/.github/workflows/apps-api-security-deps.yml b/.github/workflows/apps-api-security-deps.yml
index bb1879bc..53b427e2 100644
--- a/.github/workflows/apps-api-security-deps.yml
+++ b/.github/workflows/apps-api-security-deps.yml
@@ -25,7 +25,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/api
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 10
 
     env:
@@ -38,6 +38,9 @@ jobs:
       - name: Detect relevant changes
         uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
+        # An app that was removed from the checkout has no lockfile: skip its scan
+        # (every later step gates on this filter's output).
+        if: hashFiles('apps/api/bun.lock') != ''
         with:
           filters: |
             code:
diff --git a/.github/workflows/apps-api-security-sast.yml b/.github/workflows/apps-api-security-sast.yml
index 63134db5..86c1ed96 100644
--- a/.github/workflows/apps-api-security-sast.yml
+++ b/.github/workflows/apps-api-security-sast.yml
@@ -26,7 +26,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/api
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 15
     container:
       image: semgrep/semgrep:1.142.0@sha256:03402a5040a88a570dec58375ef1a19fa777dd61575afdc7d5527ddf308dd765
diff --git a/.github/workflows/apps-api-security-secrets.yml b/.github/workflows/apps-api-security-secrets.yml
index c0e029a8..d10f3495 100644
--- a/.github/workflows/apps-api-security-secrets.yml
+++ b/.github/workflows/apps-api-security-secrets.yml
@@ -26,7 +26,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/api
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 10
 
     env:
diff --git a/.github/workflows/apps-api-security-spec.yml b/.github/workflows/apps-api-security-spec.yml
index 68ba0af1..da5413d3 100644
--- a/.github/workflows/apps-api-security-spec.yml
+++ b/.github/workflows/apps-api-security-spec.yml
@@ -39,7 +39,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/api
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 15
 
     services:
diff --git a/.github/workflows/apps-docs-linkcheck.yml b/.github/workflows/apps-docs-linkcheck.yml
index 0ab46fb5..d49caf2e 100644
--- a/.github/workflows/apps-docs-linkcheck.yml
+++ b/.github/workflows/apps-docs-linkcheck.yml
@@ -60,7 +60,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/docs
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/apps-docs-security-deps.yml b/.github/workflows/apps-docs-security-deps.yml
index ffab84e4..470facb8 100644
--- a/.github/workflows/apps-docs-security-deps.yml
+++ b/.github/workflows/apps-docs-security-deps.yml
@@ -25,7 +25,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/docs
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 10
 
     env:
@@ -38,6 +38,9 @@ jobs:
       - name: Detect relevant changes
         uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
+        # An app that was removed from the checkout has no lockfile: skip its scan
+        # (every later step gates on this filter's output).
+        if: hashFiles('apps/docs/bun.lock') != ''
         with:
           filters: |
             code:
diff --git a/.github/workflows/apps-docs-security-secrets.yml b/.github/workflows/apps-docs-security-secrets.yml
index cd550747..1a9527b5 100644
--- a/.github/workflows/apps-docs-security-secrets.yml
+++ b/.github/workflows/apps-docs-security-secrets.yml
@@ -26,7 +26,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/docs
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 10
 
     env:
diff --git a/.github/workflows/apps-site-release.yml b/.github/workflows/apps-site-release.yml
new file mode 100644
index 00000000..d129e4d7
--- /dev/null
+++ b/.github/workflows/apps-site-release.yml
@@ -0,0 +1,88 @@
+name: release
+
+# Builds and publishes the public site's serving image to GitHub Container
+# Registry on every push to main (tags: latest + sha-<7>), for the Compose/WUD
+# path. Kubernetes never uses these tags: production-release.yml builds the site
+# as a candidate and pins its digest together with the API, migrations and UI.
+# The build-time public configuration comes from
+# infra/k3s/overlays/prod/site-build.env, so a configuration change rebuilds the
+# image.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "apps/site/**"
+      - "infra/k3s/overlays/prod/site-build.env"
+      - ".github/workflows/apps-site-release.yml"
+
+concurrency:
+  group: apps-site-release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  release:
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Load production site configuration
+        id: config
+        run: |
+          set -a
+          . infra/k3s/overlays/prod/site-build.env
+          set +a
+          {
+            echo "site_url=$SITE_URL"
+            echo "app_url=$APP_URL"
+            echo "contact_email=$CONTACT_EMAIL"
+            echo "analytics_script_url=$ANALYTICS_SCRIPT_URL"
+            echo "analytics_website_id=$ANALYTICS_WEBSITE_ID"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
+      - name: Log in to GHCR
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute image metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}-site
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha,prefix=sha-,format=short
+          labels: |
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.title=BoringStack site
+            org.opencontainers.image.description=Static marketing site served by nginx
+
+      - name: Build and push
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: apps/site
+          file: apps/site/Dockerfile
+          target: production
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            SITE_URL=${{ steps.config.outputs.site_url }}
+            APP_URL=${{ steps.config.outputs.app_url }}
+            CONTACT_EMAIL=${{ steps.config.outputs.contact_email }}
+            ANALYTICS_SCRIPT_URL=${{ steps.config.outputs.analytics_script_url }}
+            ANALYTICS_WEBSITE_ID=${{ steps.config.outputs.analytics_website_id }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
diff --git a/.github/workflows/apps-site-security-deps.yml b/.github/workflows/apps-site-security-deps.yml
new file mode 100644
index 00000000..35360b46
--- /dev/null
+++ b/.github/workflows/apps-site-security-deps.yml
@@ -0,0 +1,97 @@
+name: security-deps
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "apps/site/**"
+      - ".github/workflows/apps-site-security-deps.yml"
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "29 6 * * 1"
+
+concurrency:
+  group: apps-site-security-deps-security-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  scan:
+    name: dep vuln scan (osv + audit)
+    defaults:
+      run:
+        working-directory: apps/site
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
+    timeout-minutes: 10
+
+    env:
+      OSV_SCANNER_VERSION: "2.3.8"
+      OSV_SCANNER_SHA256: "bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc"
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Detect relevant changes
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        id: filter
+        with:
+          filters: |
+            code:
+              - 'apps/site/**'
+              - '.github/workflows/apps-site-security-deps.yml'
+
+      - name: Install osv-scanner CLI
+        if: steps.filter.outputs.code == 'true'
+        run: |
+          set -euo pipefail
+          curl -sSL -o /tmp/osv-scanner \
+            "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64"
+          echo "${OSV_SCANNER_SHA256}  /tmp/osv-scanner" | sha256sum -c -
+          chmod +x /tmp/osv-scanner
+          sudo mv /tmp/osv-scanner /usr/local/bin/
+          osv-scanner --version
+
+      - name: Run osv-scanner
+        if: steps.filter.outputs.code == 'true'
+        run: |
+          set +e
+          osv-scanner \
+            --config=osv-scanner.toml \
+            --lockfile=bun.lock \
+            --format=sarif \
+            --output-file=osv-results.sarif
+          echo "OSV_EXIT=$?" >> "$GITHUB_ENV"
+          set -e
+
+      - name: Upload osv SARIF
+        if: always()
+        uses: github/codeql-action/upload-sarif@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4
+        with:
+          sarif_file: osv-results.sarif
+          category: osv-scanner-site
+        continue-on-error: true
+
+      - name: Fail on osv findings
+        if: steps.filter.outputs.code == 'true'
+        run: |
+          # The SARIF is the source of truth: only findings not documented in
+          # osv-scanner.toml fail the build.
+          if [ ! -f osv-results.sarif ]; then
+            echo "osv-results.sarif missing: osv-scanner failed to write output."
+            exit 1
+          fi
+
+          UNFILTERED=$(jq -r '[.runs[].results[]?] | length' osv-results.sarif)
+          echo "Unfiltered osv-scanner findings: ${UNFILTERED}"
+
+          if [ "${UNFILTERED}" != "0" ]; then
+            echo "osv-scanner reported ${UNFILTERED} unfiltered vulnerabilities. See SARIF in the Security tab."
+            exit 1
+          fi
+
+      # Dependency audit runs through osv-scanner above, with the same allowlist.
+      # The site is a static build with no runtime code, so osv alone is the gate.
diff --git a/.github/workflows/apps-site-security-secrets.yml b/.github/workflows/apps-site-security-secrets.yml
new file mode 100644
index 00000000..44800838
--- /dev/null
+++ b/.github/workflows/apps-site-security-secrets.yml
@@ -0,0 +1,81 @@
+name: security-secrets
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "apps/site/**"
+      - "infra/k3s/overlays/prod/site-build.env"
+      - ".github/workflows/apps-site-security-secrets.yml"
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "19 6 * * 1"
+
+concurrency:
+  group: apps-site-security-secrets-security-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: read
+
+jobs:
+  gitleaks:
+    name: gitleaks secret scan
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
+    timeout-minutes: 10
+
+    env:
+      GITLEAKS_VERSION: "8.30.1"
+      GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Full history so gitleaks can scan every commit.
+          fetch-depth: 0
+
+      - name: Detect relevant changes
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        id: filter
+        with:
+          filters: |
+            code:
+              - 'apps/site/**'
+              - 'infra/k3s/overlays/prod/site-build.env'
+              - '.github/workflows/apps-site-security-secrets.yml'
+
+      - name: Install gitleaks CLI
+        if: steps.filter.outputs.code == 'true'
+        run: |
+          set -euo pipefail
+          TARBALL="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl -sSL -o "/tmp/${TARBALL}" \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${TARBALL}"
+          echo "${GITLEAKS_SHA256}  /tmp/${TARBALL}" | sha256sum -c -
+          tar -xzf "/tmp/${TARBALL}" -C /tmp
+          sudo mv /tmp/gitleaks /usr/local/bin/
+          gitleaks version
+
+      - name: Scan
+        if: steps.filter.outputs.code == 'true'
+        run: |
+          gitleaks detect \
+            --source . \
+            --config .gitleaks.toml \
+            --no-banner \
+            --redact \
+            --verbose \
+            --report-format=sarif \
+            --report-path=gitleaks-results.sarif \
+            --exit-code=1
+
+      - name: Upload SARIF
+        if: always()
+        uses: github/codeql-action/upload-sarif@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4
+        with:
+          sarif_file: gitleaks-results.sarif
+          category: gitleaks-site
+        continue-on-error: true
diff --git a/.github/workflows/apps-site-validate.yml b/.github/workflows/apps-site-validate.yml
new file mode 100644
index 00000000..082e7866
--- /dev/null
+++ b/.github/workflows/apps-site-validate.yml
@@ -0,0 +1,96 @@
+name: validate
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+    paths:
+      - "apps/site/**"
+      - "infra/k3s/overlays/prod/site-build.env"
+      - ".github/workflows/apps-site-validate.yml"
+
+concurrency:
+  group: apps-site-validate-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    defaults:
+      run:
+        working-directory: apps/site
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Detect relevant changes
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        id: filter
+        with:
+          filters: |
+            code:
+              - 'apps/site/**'
+              - 'infra/k3s/overlays/prod/site-build.env'
+              - '.github/workflows/apps-site-validate.yml'
+
+      - name: Set up Bun
+        if: steps.filter.outputs.code == 'true'
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.4.2
+
+      - name: Cache bun install
+        if: steps.filter.outputs.code == 'true'
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('apps/site/bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
+
+      - name: Install
+        if: steps.filter.outputs.code == 'true'
+        run: bun install --frozen-lockfile
+
+      # Format, types, unit tests, production-config build, rendered nginx config,
+      # and the output checks (canonical URLs, sitemap, CSP compatibility).
+      - name: Validate
+        if: steps.filter.outputs.code == 'true'
+        run: bun run validate
+
+      - name: Set up Docker Buildx
+        if: steps.filter.outputs.code == 'true'
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
+      # Build the serving image with the same public configuration as release.
+      # Running it read-only proves the container needs no writable root filesystem.
+      - name: Build serving image and smoke-test it read-only
+        if: steps.filter.outputs.code == 'true'
+        working-directory: apps/site
+        run: |
+          set -euo pipefail
+          set -a
+          . ../../infra/k3s/overlays/prod/site-build.env
+          set +a
+          docker build \
+            --build-arg SITE_URL="$SITE_URL" \
+            --build-arg APP_URL="$APP_URL" \
+            --build-arg CONTACT_EMAIL="$CONTACT_EMAIL" \
+            --build-arg ANALYTICS_SCRIPT_URL="$ANALYTICS_SCRIPT_URL" \
+            --build-arg ANALYTICS_WEBSITE_ID="$ANALYTICS_WEBSITE_ID" \
+            -t boringstack-site:ci .
+          docker run -d --name site-smoke --read-only --tmpfs /tmp:rw,mode=1777 \
+            -p 8080:8080 boringstack-site:ci
+          for _attempt in $(seq 1 20); do
+            if curl --fail --silent http://127.0.0.1:8080/healthz > /dev/null; then break; fi
+            sleep 1
+          done
+          curl --fail --silent http://127.0.0.1:8080/ > /dev/null
+          curl --fail --silent http://127.0.0.1:8080/sitemap-index.xml > /dev/null
+          test "$(curl --silent --output /dev/null --write-out '%{http_code}' http://127.0.0.1:8080/does-not-exist)" = "404"
+          docker rm -f site-smoke > /dev/null
diff --git a/.github/workflows/apps-ui-bundle-diff.yml b/.github/workflows/apps-ui-bundle-diff.yml
index c581ea87..c03efd5a 100644
--- a/.github/workflows/apps-ui-bundle-diff.yml
+++ b/.github/workflows/apps-ui-bundle-diff.yml
@@ -32,7 +32,7 @@ jobs:
   # straight bun keeps the toolchain consistent with local dev.
   size-diff:
     if: github.actor != 'dependabot[bot]'
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 8
     steps:
       - name: Checkout
diff --git a/.github/workflows/apps-ui-release.yml b/.github/workflows/apps-ui-release.yml
index 34458039..369e6fb8 100644
--- a/.github/workflows/apps-ui-release.yml
+++ b/.github/workflows/apps-ui-release.yml
@@ -34,7 +34,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/ui
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 20
     steps:
       - name: Checkout
diff --git a/.github/workflows/apps-ui-security-deps.yml b/.github/workflows/apps-ui-security-deps.yml
index de786233..c02bbf7c 100644
--- a/.github/workflows/apps-ui-security-deps.yml
+++ b/.github/workflows/apps-ui-security-deps.yml
@@ -25,7 +25,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/ui
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 10
 
     env:
@@ -38,6 +38,9 @@ jobs:
       - name: Detect relevant changes
         uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
+        # An app that was removed from the checkout has no lockfile: skip its scan
+        # (every later step gates on this filter's output).
+        if: hashFiles('apps/ui/bun.lock') != ''
         with:
           filters: |
             code:
diff --git a/.github/workflows/apps-ui-security-sast.yml b/.github/workflows/apps-ui-security-sast.yml
index 1177b968..28e02512 100644
--- a/.github/workflows/apps-ui-security-sast.yml
+++ b/.github/workflows/apps-ui-security-sast.yml
@@ -26,7 +26,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/ui
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 15
     container:
       image: semgrep/semgrep:1.142.0@sha256:03402a5040a88a570dec58375ef1a19fa777dd61575afdc7d5527ddf308dd765
diff --git a/.github/workflows/apps-ui-security-secrets.yml b/.github/workflows/apps-ui-security-secrets.yml
index 2c4ad32d..ca122fff 100644
--- a/.github/workflows/apps-ui-security-secrets.yml
+++ b/.github/workflows/apps-ui-security-secrets.yml
@@ -26,7 +26,7 @@ jobs:
     defaults:
       run:
         working-directory: apps/ui
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 10
 
     env:
diff --git a/.github/workflows/apps-ui-validate.yml b/.github/workflows/apps-ui-validate.yml
index 6be8411f..98c888f5 100644
--- a/.github/workflows/apps-ui-validate.yml
+++ b/.github/workflows/apps-ui-validate.yml
@@ -7,6 +7,7 @@ on:
     branches: [main]
     paths:
       - "apps/ui/**"
+      - "packages/**"
       - ".github/workflows/apps-ui-validate.yml"
 
 concurrency:
@@ -21,11 +22,14 @@ jobs:
     defaults:
       run:
         working-directory: apps/ui
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Full history: the budget gate diffs .size-limit.json against the merge-base.
+          fetch-depth: 0
 
       - name: Detect relevant changes
         uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
@@ -34,6 +38,7 @@ jobs:
           filters: |
             code:
               - 'apps/ui/**'
+              - 'packages/**'
               - '.github/workflows/apps-ui-validate.yml'
 
       - name: Set up Bun
@@ -62,6 +67,10 @@ jobs:
         if: steps.filter.outputs.code == 'true'
         run: bun run check
 
+      - name: Shared packages validate
+        if: steps.filter.outputs.code == 'true'
+        run: bash -c 'source ../../scripts/stack-lib.sh && validate_packages'
+
       - name: Unit + integration tests
         if: steps.filter.outputs.code == 'true'
         run: bun run test:ci
@@ -86,6 +95,10 @@ jobs:
         if: steps.filter.outputs.code == 'true'
         run: bun run size:check
 
+      - name: Bundle budget reasons
+        if: steps.filter.outputs.code == 'true'
+        run: bun run check:size-budget
+
       - name: Modulepreload size coverage
         if: steps.filter.outputs.code == 'true'
         run: bun run size:check:modulepreload
diff --git a/.github/workflows/infra-bootstrap-security-deps.yml b/.github/workflows/infra-bootstrap-security-deps.yml
index d6809463..1c3baacb 100644
--- a/.github/workflows/infra-bootstrap-security-deps.yml
+++ b/.github/workflows/infra-bootstrap-security-deps.yml
@@ -27,7 +27,7 @@ jobs:
     defaults:
       run:
         working-directory: infra/bootstrap
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 10
 
     steps:
diff --git a/.github/workflows/infra-bootstrap-security-secrets.yml b/.github/workflows/infra-bootstrap-security-secrets.yml
index 0eeeb783..9ea976d6 100644
--- a/.github/workflows/infra-bootstrap-security-secrets.yml
+++ b/.github/workflows/infra-bootstrap-security-secrets.yml
@@ -28,7 +28,7 @@ jobs:
     defaults:
       run:
         working-directory: infra/bootstrap
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 10
 
     env:
diff --git a/.github/workflows/infra-bootstrap-validate.yml b/.github/workflows/infra-bootstrap-validate.yml
index b85a22ad..036055cd 100644
--- a/.github/workflows/infra-bootstrap-validate.yml
+++ b/.github/workflows/infra-bootstrap-validate.yml
@@ -19,7 +19,7 @@ jobs:
     defaults:
       run:
         working-directory: infra/bootstrap
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/infra-compose-full-stack-smoke.yml b/.github/workflows/infra-compose-full-stack-smoke.yml
index ad5ffc4b..0f8257d4 100644
--- a/.github/workflows/infra-compose-full-stack-smoke.yml
+++ b/.github/workflows/infra-compose-full-stack-smoke.yml
@@ -39,7 +39,7 @@ permissions:
 jobs:
   smoke:
     name: register → login → /me through the full stack
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     # 8 min upper bound: with Playwright moved out, the curl-only path
     # completes in ~3–4 min on a warm runner. A short ceiling means a
     # stuck step fails fast instead of running for 20 min like the old
diff --git a/.github/workflows/infra-compose-playwright-e2e.yml b/.github/workflows/infra-compose-playwright-e2e.yml
index 14b62d9d..6480a19d 100644
--- a/.github/workflows/infra-compose-playwright-e2e.yml
+++ b/.github/workflows/infra-compose-playwright-e2e.yml
@@ -39,7 +39,7 @@ permissions:
 jobs:
   playwright:
     name: UI Playwright E2E (browser-based smoke)
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     # 15 min upper bound: Playwright's own inner timeout is 12 min; the
     # buffer covers compose build + image pulls + browser install. A
     # genuine hang surfaces within minutes of the inner timeout rather
diff --git a/.github/workflows/infra-compose-security-secrets.yml b/.github/workflows/infra-compose-security-secrets.yml
index 41e3432d..956085aa 100644
--- a/.github/workflows/infra-compose-security-secrets.yml
+++ b/.github/workflows/infra-compose-security-secrets.yml
@@ -26,7 +26,7 @@ jobs:
     defaults:
       run:
         working-directory: infra/compose
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 10
 
     env:
diff --git a/.github/workflows/infra-compose-validate-compose.yml b/.github/workflows/infra-compose-validate-compose.yml
index 94d61c7a..587cb103 100644
--- a/.github/workflows/infra-compose-validate-compose.yml
+++ b/.github/workflows/infra-compose-validate-compose.yml
@@ -38,7 +38,7 @@ permissions:
 jobs:
   compose-config:
     name: docker compose config (all overlay combinations)
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 5
 
     # Build contexts point at monorepo apps (`../../../apps/api` and
@@ -141,6 +141,31 @@ jobs:
         # so CI and local guardrails cannot drift.
         run: ../scripts/validate-guardrails.sh prod-image-tags
         working-directory: infra/compose/compose
+      - name: Validate — dev + site
+        if: steps.filter.outputs.code == 'true'
+        working-directory: infra/compose/compose
+        run: |
+          docker compose \
+            -f docker-compose.yml \
+            -f docker-compose.development-labels.yml \
+            -f docker-compose.site.yml \
+            --profile dev config --quiet
+
+      - name: Validate — prod + site (+ prod labels)
+        if: steps.filter.outputs.code == 'true'
+        working-directory: infra/compose/compose
+        env:
+          PUBLIC_SITE_HOST: example.com
+          PUBLIC_UI_HOST: app.example.com
+          SITE_CONTACT_EMAIL: hello@example.com
+          SITE_IMAGE_TAG: v0.1.0
+        run: |
+          docker compose \
+            -f docker-compose.yml \
+            -f docker-compose.production-labels.yml \
+            -f docker-compose.site.yml \
+            --profile prod config --quiet
+
       - name: Validate — dev + observability
         if: steps.filter.outputs.code == 'true'
         working-directory: infra/compose/compose
@@ -203,6 +228,7 @@ jobs:
             -f docker-compose.glitchtip.yml \
             -f docker-compose.bullmq.yml \
             -f docker-compose.wud.yml \
+            -f docker-compose.site.yml \
             --profile dev \
             --profile observability \
             --profile glitchtip-dev \
@@ -212,7 +238,7 @@ jobs:
 
   shellcheck:
     name: shellcheck (scripts/)
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 2
     steps:
       - name: Checkout
@@ -433,7 +459,7 @@ jobs:
 
   prod-image-build:
     name: build prod images (sanity)
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 15
     # Cheaper than booting the prod profile end-to-end, but still
     # exercises the actual prod Dockerfiles. Catches broken
@@ -489,7 +515,7 @@ jobs:
 
   yamllint:
     name: yamllint (compose + workflows)
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 2
     env:
       # Single source for the yamllint pin: the local pre-push gate
diff --git a/.github/workflows/infra-k3s-validate.yml b/.github/workflows/infra-k3s-validate.yml
index dce1d3a0..9f40afe3 100644
--- a/.github/workflows/infra-k3s-validate.yml
+++ b/.github/workflows/infra-k3s-validate.yml
@@ -16,7 +16,7 @@ concurrency:
 jobs:
   validate:
     name: kustomize build
-    runs-on: ubuntu-24.04
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -28,12 +28,22 @@ jobs:
           filters: |
             code:
               - 'infra/k3s/**'
+              - 'scripts/release/**'
+              - 'apps/api/Dockerfile.prod'
+              - 'apps/api/drizzle/**'
               - '.github/workflows/infra-k3s-validate.yml'
+              - '.github/workflows/production-release.yml'
 
       - name: Install kubectl (bundles kustomize)
         if: steps.filter.outputs.code == 'true'
         uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
 
+      - name: Set up Bun
+        if: steps.filter.outputs.code == 'true'
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.4.2
+
       # `kubectl kustomize` renders base + prod overlay offline. Catches the
       # realistic breakage: bad resource refs, malformed YAML, broken patches,
       # and the swappable secrets component wiring. CRDs (CNPG, Traefik,
@@ -59,3 +69,10 @@ jobs:
           printf 'JWT_SECRET=x\nVALKEY_PASSWORD=x\n' > infra/k3s/overlays/prod/secrets/plain/secret.env
           trap 'rm -f infra/k3s/overlays/prod/secrets/plain/secret.env' EXIT
           kubectl kustomize infra/k3s/overlays/prod/secrets/plain > /dev/null
+
+      # Release invariants on the real render: digest-pinned images, no
+      # image-updater, a migrate-only Job, a read-only API, and the release
+      # script's pin contract. See infra/k3s/README.md.
+      - name: Test production release invariants
+        if: steps.filter.outputs.code == 'true'
+        run: bun test infra/k3s/tests scripts/release
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
new file mode 100644
index 00000000..b44a5521
--- /dev/null
+++ b/.github/workflows/pr-title.yml
@@ -0,0 +1,30 @@
+name: pr-title
+
+# Squash merges make the PR title the commit subject on main. The commit-msg
+# hook only sees local commits, so the title gets the same check here.
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+concurrency:
+  group: pr-title-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  title:
+    name: pull request title (conventional commit)
+    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
+    timeout-minutes: 2
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          sparse-checkout: scripts/ci
+      - name: Check the title
+        env:
+          TITLE: ${{ github.event.pull_request.title }}
+        run: bash scripts/ci/check-commit-title.sh "$TITLE"
diff --git a/.github/workflows/production-release.yml b/.github/workflows/production-release.yml
new file mode 100644
index 00000000..f3dd9738
--- /dev/null
+++ b/.github/workflows/production-release.yml
@@ -0,0 +1,163 @@
+name: Coordinated production release
+
+# The only workflow that publishes images for the Kubernetes (Argo) target.
+# It builds the API, migrations, UI and public site for one commit as
+# candidates. Only when every build succeeds does one commit pin all four digests in
+# infra/k3s/overlays/prod/kustomization.yaml. Argo then syncs that single set,
+# so the UI can never run ahead of the API it needs.
+# Compose/WUD keeps its own publishers (apps-api-release.yml, apps-ui-release.yml).
+# They push :latest and sha-* tags that Kubernetes never references.
+# See infra/k3s/README.md.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "apps/**"
+      - "packages/**"
+      - "scripts/release/**"
+      - ".github/workflows/**"
+      - "infra/k3s/**"
+      - "!infra/k3s/overlays/prod/kustomization.yaml"
+
+# Serialize releases. A stale source commit fails before promotion.
+concurrency:
+  group: production-release
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  release:
+    # Do not compete with PR checks for self-hosted runners.
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    permissions:
+      contents: write
+      actions: read
+      packages: write
+    steps:
+      - name: Require coordinated deployment activation
+        env:
+          RELEASE_MODE: ${{ vars.PRODUCTION_RELEASE_MODE }}
+        run: |
+          if [ "$RELEASE_MODE" != coordinated ]; then
+            echo '::error::Remove the argocd-image-updater annotations from the live Argo Application, then set PRODUCTION_RELEASE_MODE=coordinated. See infra/k3s/README.md.'
+            exit 1
+          fi
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.4.2
+      - name: Wait for this commit's applicable CI checks
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bun scripts/release/release.mjs gate
+      - name: Reject superseded release
+        run: |
+          git fetch origin main
+          test "$(git rev-parse origin/main)" = "$GITHUB_SHA"
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      # Candidate tags only. Nothing moves `latest` or `sha-*`, and nothing is
+      # promoted until all four builds below have succeeded.
+      - name: Build API candidate
+        id: api
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: apps/api
+          file: apps/api/Dockerfile.prod
+          push: true
+          tags: ghcr.io/${{ github.repository }}-api:candidate-${{ github.sha }}
+          labels: org.opencontainers.image.revision=${{ github.sha }}
+          cache-from: type=gha,scope=release-api
+          cache-to: type=gha,scope=release-api,mode=max
+      - name: Build migrations candidate
+        id: migrations
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: apps/api
+          file: apps/api/Dockerfile.prod
+          target: migrations
+          push: true
+          tags: ghcr.io/${{ github.repository }}-migrations:candidate-${{ github.sha }}
+          labels: org.opencontainers.image.revision=${{ github.sha }}
+          cache-from: type=gha,scope=release-migrations
+          cache-to: type=gha,scope=release-migrations,mode=max
+      - name: Build UI candidate
+        id: ui
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: apps/ui
+          file: apps/ui/Dockerfile.prod
+          push: true
+          tags: ghcr.io/${{ github.repository }}-ui:candidate-${{ github.sha }}
+          # Same-origin API by default. Public URL, Sentry and VAPID values come
+          # from repository variables, so no product domain is hard-coded here.
+          build-args: |
+            VITE_API_URL=
+            VITE_PUBLIC_URL=${{ vars.VITE_PUBLIC_URL }}
+            VITE_SENTRY_DSN=${{ vars.VITE_SENTRY_DSN }}
+            VITE_VAPID_PUBLIC_KEY=${{ vars.VITE_VAPID_PUBLIC_KEY }}
+          labels: org.opencontainers.image.revision=${{ github.sha }}
+          cache-from: type=gha,scope=release-ui
+          cache-to: type=gha,scope=release-ui,mode=max
+      # Public site configuration is build-time only (validated by the Astro
+      # build); the values live in git so a change rebuilds the image.
+      - name: Load production site configuration
+        id: site_config
+        run: |
+          set -a
+          . infra/k3s/overlays/prod/site-build.env
+          set +a
+          {
+            echo "site_url=$SITE_URL"
+            echo "app_url=$APP_URL"
+            echo "contact_email=$CONTACT_EMAIL"
+            echo "analytics_script_url=$ANALYTICS_SCRIPT_URL"
+            echo "analytics_website_id=$ANALYTICS_WEBSITE_ID"
+          } >> "$GITHUB_OUTPUT"
+      - name: Build site candidate
+        id: site
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: apps/site
+          file: apps/site/Dockerfile
+          target: production
+          push: true
+          tags: ghcr.io/${{ github.repository }}-site:candidate-${{ github.sha }}
+          build-args: |
+            SITE_URL=${{ steps.site_config.outputs.site_url }}
+            APP_URL=${{ steps.site_config.outputs.app_url }}
+            CONTACT_EMAIL=${{ steps.site_config.outputs.contact_email }}
+            ANALYTICS_SCRIPT_URL=${{ steps.site_config.outputs.analytics_script_url }}
+            ANALYTICS_WEBSITE_ID=${{ steps.site_config.outputs.analytics_website_id }}
+          labels: org.opencontainers.image.revision=${{ github.sha }}
+          cache-from: type=gha,scope=release-site
+          cache-to: type=gha,scope=release-site,mode=max
+      - name: Promote complete image set in one GitOps commit
+        env:
+          API_DIGEST: ${{ steps.api.outputs.digest }}
+          MIGRATIONS_DIGEST: ${{ steps.migrations.outputs.digest }}
+          UI_DIGEST: ${{ steps.ui.outputs.digest }}
+          SITE_DIGEST: ${{ steps.site.outputs.digest }}
+        run: |
+          set -euo pipefail
+          git fetch origin main
+          # No force pushes, rebases, partial promotions or stale release retries.
+          test "$(git rev-parse origin/main)" = "$GITHUB_SHA"
+          bun scripts/release/release.mjs pin
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add infra/k3s/overlays/prod/kustomization.yaml
+          git commit -m "deploy: promote complete release $GITHUB_SHA"
+          git push origin HEAD:main
+          echo "Promoted four images from $GITHUB_SHA. Argo rollout health must still be checked." >> "$GITHUB_STEP_SUMMARY"
diff --git a/.tsforge/scaffold-manifest.json b/.tsforge/scaffold-manifest.json
index 34f6e933..9489e860 100644
--- a/.tsforge/scaffold-manifest.json
+++ b/.tsforge/scaffold-manifest.json
@@ -68,6 +68,15 @@
       "devDefault": "1",
       "addsServices": { "1": ["bullmq-dashboard"] }
     },
+    {
+      "key": "WITH_SITE",
+      "kind": "toggle",
+      "group": "infra",
+      "label": "Public marketing site (apps/site). Dev: Astro dev server on 7333. Prod: static site on the apex host, app on app.<domain>",
+      "devDefault": "1",
+      "prodDefault": "0",
+      "addsServices": { "1": ["site-dev", "site"] }
+    },
     {
       "key": "WUD",
       "kind": "toggle",
diff --git a/AGENTS.md b/AGENTS.md
index 0b5cbea2..886eee1d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,6 +1,6 @@
 # BoringStack monorepo
 
-Single repository: `apps/api`, `apps/ui`, `apps/docs`, `infra/compose`, `infra/bootstrap`.
+Single repository: `apps/api`, `apps/ui`, `apps/docs`, `apps/site`, `infra/compose`, `infra/bootstrap`.
 
 <!-- template-onboarding:start -->
 ## Starting a new project from this template
@@ -53,12 +53,20 @@ checks types, lint and formatting and is also included in root `check`.
 | `apps/api`        | Bun + Elysia API       |
 | `apps/ui`         | Vite + React UI        |
 | `apps/docs`       | Astro docs site        |
+| `apps/site`       | Astro public marketing site (static, nginx) |
 | `infra/compose`   | Docker Compose runtime |
 | `infra/bootstrap` | OpenTofu bootstrap     |
+| `packages/*`      | Shared code used by more than one app ([guide](apps/ui/docs/agents/shared-packages.md)) |
 | `.tsforge`        | tsforge scaffold manifest (see below) |
 
 CI: `.github/workflows/` at repo root with path filters.
 
+Self-hosted runners: set the repository variable `CI_RUNNER` to a runner label
+and every job moves off GitHub-hosted minutes. Pull requests from forks always
+stay on `ubuntu-24.04`, so outside code never runs on your machines, and
+`production-release.yml` always runs GitHub-hosted. The lint-meta rule
+`github-actions-runner-pinned` rejects a `vars.CI_RUNNER` without that guard.
+
 Remote: https://github.com/boringstack-xyz/boringstack
 
 ## Scaffold manifest: keep it in sync
@@ -94,3 +102,26 @@ cross-checks this manifest against the real `.env.example` files and FAILS if a
 watched toggle is neither modelled here nor waived via `watchIgnore`. A drifted
 manifest is a red build, not a silent gap. The `_about` field at the top of the
 JSON restates this for anyone who opens the file directly.
+
+## Commits and pull requests
+
+Every commit subject and PR title is a Conventional Commit:
+`<type>(<scope>)!?: <summary>`, at most 100 characters, for example
+`fix(api): keep the session after refresh`. This is a gate, not a guideline.
+The `commit-msg` hook (installed by `bun install`) and the `pr-title` workflow
+both run `scripts/ci/check-commit-title.sh`. Main is squash-merged, so the PR
+title is the commit that lands.
+
+These instructions are harness-neutral. Codex, Claude Code and other agents all
+start here, and `CLAUDE.md` only points at this file. Put a convention a
+product depends on into a hook, a lint rule or CI, and keep this file in sync
+with it. Prose that only one harness reads stops being followed when the
+harness changes.
+
+## Generated content and data
+
+Large generated artifacts, such as content libraries, catalogue imports and
+rendered diagrams, do not belong in the same commit or PR as hand-written
+code. Commit the generator and its source data, then regenerate in a separate
+`chore(content): ...` change, or build the artifacts in CI. A 500k-line diff
+cannot be reviewed, and it hides the code change that travels with it.
diff --git a/apps/api/.env.example b/apps/api/.env.example
index 3aa3b68d..c1103c2d 100644
--- a/apps/api/.env.example
+++ b/apps/api/.env.example
@@ -58,8 +58,8 @@ AUTH_RATE_LIMIT_WINDOW_MS=60000
 # proxy in front).
 TRUST_PROXY=false
 
-# Optional first-boot superuser. When both are set, `bun run db:seed`
-# creates a user with admin role on the first run. Empty = no user
+# Optional superuser. When both are set, `bun run db:seed` creates a user
+# with admin role (an existing user is left alone). Empty = no user
 # created; sign up via the registration flow instead.
 #
 # Running under docker-compose? Setting these HERE has no effect — the
diff --git a/apps/api/Dockerfile.prod b/apps/api/Dockerfile.prod
index 2adbd5ad..c5ec5d4c 100644
--- a/apps/api/Dockerfile.prod
+++ b/apps/api/Dockerfile.prod
@@ -20,6 +20,45 @@ COPY . .
 # the API into /app/dist. Both are needed at runtime.
 RUN bun run build
 
+# Migration image (`--target migrations`): drizzle-kit is a devDependency, so it
+# is installed here and kept out of the lean runtime image. The Kubernetes
+# migration Job runs it. This stage must stay before `production`: a plain
+# `docker build` builds the last stage, and that must be the API.
+FROM oven/bun:1.4.2-alpine@sha256:d888c0ae6c86d7866ff10c5aafdd9077b36aee6455b33dd270fb93c0dd5cef6f AS migrations
+
+RUN apk add --no-cache dumb-init
+
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S app -u 1001 -G nodejs
+
+WORKDIR /app
+
+ENV HUSKY=0
+
+COPY package.json bun.lock* ./
+
+RUN bun install --frozen-lockfile
+
+# `db:migrate` reads the drizzle config and SQL history. The source is here for
+# an explicit one-off `bun run db:seed` (first admin only). The migration Job
+# never runs it. The runtime image has no source tree, so seeds cannot run there.
+COPY tsconfig.json ./
+COPY drizzle.config.ts ./
+COPY drizzle ./drizzle
+COPY scripts/db ./scripts/db
+COPY src ./src
+
+# Set after install so `bun install` above still sees devDependencies.
+ENV NODE_ENV=production
+
+RUN chown -R app:nodejs /app
+
+USER app
+
+ENTRYPOINT ["dumb-init", "--"]
+
+CMD ["bun", "run", "db:migrate"]
+
 # Production stage
 FROM oven/bun:1.4.2-alpine@sha256:d888c0ae6c86d7866ff10c5aafdd9077b36aee6455b33dd270fb93c0dd5cef6f AS production
 
@@ -53,4 +92,7 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
 
 ENTRYPOINT ["dumb-init", "--"]
 
-CMD ["bun", "run", "dist/index.js"]
+# --no-install: bun must never try to install packages at startup. Production
+# root filesystems are read-only (readOnlyRootFilesystem), so an install attempt
+# crashes with EROFS. Writable scratch space is /tmp, mounted by the manifests.
+CMD ["bun", "--no-install", "run", "dist/index.js"]
diff --git a/apps/api/bun.lock b/apps/api/bun.lock
index 2b8e0485..27644e81 100644
--- a/apps/api/bun.lock
+++ b/apps/api/bun.lock
@@ -28,7 +28,7 @@
         "fs-extra": "11.4.0",
         "handlebars": "4.7.9",
         "ioredis": "5.11.1",
-        "nodemailer": "10.0.0",
+        "nodemailer": "10.0.9",
         "openai": "7.10.0",
         "otpauth": "9.5.2",
         "pg": "8.23.0",
@@ -82,11 +82,14 @@
     },
   },
   "overrides": {
+    "@grpc/grpc-js": "1.14.5",
     "@typescript-eslint/utils": "8.61.1",
-    "axios": "1.18.0",
+    "axios": "1.20.0",
     "form-data": "4.0.6",
     "ioredis": "5.11.1",
     "protobufjs": "7.6.5",
+    "smol-toml": "1.9.0",
+    "source-map-js": "1.2.2",
   },
   "packages": {
     "@alloc/quick-lru": ["@alloc/quick-lru@5.2.0", "", {}, "sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw=="],
@@ -225,7 +228,7 @@
 
     "@eslint/plugin-kit": ["@eslint/plugin-kit@0.7.2", "", { "dependencies": { "@eslint/core": "^1.2.1", "levn": "^0.4.1" } }, "sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A=="],
 
-    "@grpc/grpc-js": ["@grpc/grpc-js@1.14.4", "", { "dependencies": { "@grpc/proto-loader": "^0.8.0", "@js-sdsl/ordered-map": "^4.4.2" } }, "sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ=="],
+    "@grpc/grpc-js": ["@grpc/grpc-js@1.14.5", "", { "dependencies": { "@grpc/proto-loader": "^0.8.0", "@js-sdsl/ordered-map": "^4.4.2" } }, "sha512-7VZM+SVdEcUUqSQeNI3zM8Qs/BhQKZndPo2h5VkYkAM8Iz0wJIa8mKV5ekQGqG8UUsnkQ0NMxIxwkIHYvj0qOw=="],
 
     "@grpc/proto-loader": ["@grpc/proto-loader@0.8.1", "", { "dependencies": { "lodash.camelcase": "^4.3.0", "long": "^5.0.0", "protobufjs": "^7.5.5", "yargs": "^17.7.2" }, "bin": { "proto-loader-gen-types": "build/bin/proto-loader-gen-types.js" } }, "sha512-wtF6h+DY6M3YaDBPAmvuuA6jV8Sif9MjtOI5euKFWRgCDl5PeDpPsHR9u2l6St5ceY8AZgoNDww5+HvEsXFsGg=="],
 
@@ -669,7 +672,7 @@
 
     "available-typed-arrays": ["available-typed-arrays@1.0.7", "", { "dependencies": { "possible-typed-array-names": "^1.0.0" } }, "sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ=="],
 
-    "axios": ["axios@1.18.0", "", { "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.5", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, "sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw=="],
+    "axios": ["axios@1.20.0", "", { "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.6", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg=="],
 
     "balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
 
@@ -681,7 +684,7 @@
 
     "bn.js": ["bn.js@4.12.5", "", {}, "sha512-3aRg6/JxfffFD+OlOjOFR3Vo79l39ooBTFucxx+MT3dhCtzn3EmiUPQo+6/OZuI2jbXi3YKgmiTFBgChQMwIRQ=="],
 
-    "brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
+    "brace-expansion": ["brace-expansion@5.0.12", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ=="],
 
     "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
 
@@ -1137,7 +1140,7 @@
 
     "node-releases": ["node-releases@2.0.53", "", {}, "sha512-D9UOmYG3UH1V+ENW56t5QXBwJw1YEY18ruVeus89Rw+SyIgjPkCO84bRzO3uNIYosJbNwiabWVn48o3uJLjxFQ=="],
 
-    "nodemailer": ["nodemailer@10.0.0", "", {}, "sha512-wdv+hXBg0iIPIOf108FaZyTxqjQpCvQeAJt9pHHTooPy/y3vQtI9eiImM9AIVKR3e/0FeMA1oueNfBjFJcaK+Q=="],
+    "nodemailer": ["nodemailer@10.0.9", "", {}, "sha512-BF0qcyplCwp+jMk6HCjFykBz/YhhZSsxrARhOldLwFWH+8kGjQsd2WIMIZhqEuyXRoGFi0ONbDeWDMDoL8MhLw=="],
 
     "object-inspect": ["object-inspect@1.13.4", "", {}, "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew=="],
 
@@ -1323,13 +1326,13 @@
 
     "signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
 
-    "smol-toml": ["smol-toml@1.8.0", "", {}, "sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ=="],
+    "smol-toml": ["smol-toml@1.9.0", "", {}, "sha512-hpd+HLON7HdZXqYchMM/+LaTTbdK0AU3NngIJ4KVyWbY9bfQqdL9cD+4yf6dUoU2Ap4VsU0JkQi6FxAI1B2mXQ=="],
 
     "sonic-boom": ["sonic-boom@4.2.1", "", { "dependencies": { "atomic-sleep": "^1.0.0" } }, "sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q=="],
 
     "source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
 
-    "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
+    "source-map-js": ["source-map-js@1.2.2", "", {}, "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw=="],
 
     "source-map-support": ["source-map-support@0.5.21", "", { "dependencies": { "buffer-from": "^1.0.0", "source-map": "^0.6.0" } }, "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w=="],
 
@@ -1651,9 +1654,9 @@
 
     "elysia-rate-limit/debug/ms": ["ms@2.1.2", "", {}, "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="],
 
-    "eslint-plugin-import/minimatch/brace-expansion": ["brace-expansion@1.1.18", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw=="],
+    "eslint-plugin-import/minimatch/brace-expansion": ["brace-expansion@1.1.21", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw=="],
 
-    "glob/minimatch/brace-expansion": ["brace-expansion@2.1.4", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg=="],
+    "glob/minimatch/brace-expansion": ["brace-expansion@2.1.7", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g=="],
 
     "tsx/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.1", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ=="],
 
diff --git a/apps/api/bunfig.toml b/apps/api/bunfig.toml
index ebb72912..4ad49013 100644
--- a/apps/api/bunfig.toml
+++ b/apps/api/bunfig.toml
@@ -50,10 +50,6 @@ minimumReleaseAgeExcludes = [
   # we override `form-data` directly to clear `bun audit`. The patched release
   # is <7 days old, so exempt it from the quarantine window.
   "form-data",
-  # nodemailer 9.0.1 patches GHSA-p6gq-j5cr-w38f (raw-option file-read/SSRF).
-  # Direct dep; the patched release is <7 days old, so exempt it from the
-  # quarantine window for this security upgrade.
-  "nodemailer",
 ]
 
 [test]
diff --git a/apps/api/drizzle.config.ts b/apps/api/drizzle.config.ts
index 9c92a120..bb103bc2 100644
--- a/apps/api/drizzle.config.ts
+++ b/apps/api/drizzle.config.ts
@@ -1,17 +1,35 @@
 import * as dotenv from "dotenv";
 import type { Config } from "drizzle-kit";
 
+import {
+  buildDrizzleCredentials,
+  buildPostgresSsl,
+} from "./src/lib/postgres/connection";
+import { toBoolWithDefault } from "./src/config/env/validate";
+
 dotenv.config({ path: process.env.DOTENV_CONFIG_PATH ?? ".env" });
 
+// Same TLS policy as the runtime client, so migrations verify the database
+// certificate with the same CA the API uses (see src/lib/postgres/connection.ts).
+const ssl = buildPostgresSsl({
+  isProduction: process.env.NODE_ENV === "production",
+  rejectUnauthorized: toBoolWithDefault(
+    process.env.DATABASE_SSL_REJECT_UNAUTHORIZED,
+    true,
+    "DATABASE_SSL_REJECT_UNAUTHORIZED"
+  ),
+  ca: process.env.DATABASE_SSL_CA ?? "",
+});
+
 export default {
   schema: "./src/clients/postgres/schema/*.ts",
   out: "./drizzle",
   dialect: "postgresql",
-  dbCredentials: {
-    url:
-      process.env.DATABASE_URL ??
+  dbCredentials: buildDrizzleCredentials(
+    process.env.DATABASE_URL ??
       "postgresql://app:app_dev_password@localhost:5432/app",
-  },
+    ssl
+  ),
   schemaFilter: ["auth", "billing", "audit", "app", "notifications"],
   verbose: true,
   strict: true,
diff --git a/apps/api/drizzle/0002_metrics_exporter_grants.sql b/apps/api/drizzle/0002_metrics_exporter_grants.sql
new file mode 100644
index 00000000..bcc7ccf7
--- /dev/null
+++ b/apps/api/drizzle/0002_metrics_exporter_grants.sql
@@ -0,0 +1,21 @@
+-- Business metrics for the cluster Grafana come from CloudNativePG's metrics
+-- exporter running aggregate queries (sign-ups per day, active users, paid
+-- accounts per plan, cancellations per day, Stripe event counts) defined in
+-- infra/k3s/overlays/prod/monitoring/cnpg-business-queries.yaml.
+-- The exporter is not a superuser: it runs as pg_monitor (CNPG <= 1.26) or as
+-- cnpg_metrics_exporter, which inherits pg_monitor. Granting to the built-in
+-- pg_monitor role covers both and exists in every environment.
+--
+-- Column-level on purpose: only what the counts need. No emails, names, IPs,
+-- user agents, audit metadata, password or MFA material, or Stripe identifiers.
+GRANT USAGE ON SCHEMA "audit", "auth", "billing" TO pg_monitor;
+--> statement-breakpoint
+GRANT SELECT ("created_at") ON "auth"."users" TO pg_monitor;
+--> statement-breakpoint
+GRANT SELECT ("user_id", "action", "created_at") ON "audit"."audit_log" TO pg_monitor;
+--> statement-breakpoint
+GRANT SELECT ("plan_id", "status", "source", "revoked_at", "updated_at") ON "billing"."account_plans" TO pg_monitor;
+--> statement-breakpoint
+GRANT SELECT ("id", "name") ON "billing"."plans" TO pg_monitor;
+--> statement-breakpoint
+GRANT SELECT ("type") ON "billing"."stripe_webhook_events" TO pg_monitor;
diff --git a/apps/api/drizzle/meta/0002_snapshot.json b/apps/api/drizzle/meta/0002_snapshot.json
new file mode 100644
index 00000000..469e068a
--- /dev/null
+++ b/apps/api/drizzle/meta/0002_snapshot.json
@@ -0,0 +1,2941 @@
+{
+  "id": "cdff6c76-4bae-42d4-918b-2642a11bd955",
+  "prevId": "30ade90b-c35f-497e-b429-398e0c51c47c",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "app.account_feature_overrides": {
+      "name": "account_feature_overrides",
+      "schema": "app",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "feature_key": {
+          "name": "feature_key",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "varchar(16)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'internal'"
+        },
+        "granted_by_user_id": {
+          "name": "granted_by_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "granted_by_membership_id": {
+          "name": "granted_by_membership_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_user_id": {
+          "name": "revoked_by_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_reason": {
+          "name": "revoked_reason",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "idx_account_feature_overrides_account_id": {
+          "name": "idx_account_feature_overrides_account_id",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_account_feature_overrides_feature_key": {
+          "name": "idx_account_feature_overrides_feature_key",
+          "columns": [
+            {
+              "expression": "feature_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "uniq_account_feature_overrides_active": {
+          "name": "uniq_account_feature_overrides_active",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "feature_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "where": "revoked_at IS NULL",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "account_feature_overrides_account_id_fkey": {
+          "name": "account_feature_overrides_account_id_fkey",
+          "tableFrom": "account_feature_overrides",
+          "columnsFrom": [
+            "account_id"
+          ],
+          "tableTo": "accounts",
+          "schemaTo": "app",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        },
+        "account_feature_overrides_granted_by_user_id_fkey": {
+          "name": "account_feature_overrides_granted_by_user_id_fkey",
+          "tableFrom": "account_feature_overrides",
+          "columnsFrom": [
+            "granted_by_user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "restrict"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "app.account_invitations": {
+      "name": "account_invitations",
+      "schema": "app",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(320)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role_to_assign": {
+          "name": "role_to_assign",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invited_by_membership_id": {
+          "name": "invited_by_membership_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_at": {
+          "name": "accepted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_account_invitations_account_id": {
+          "name": "idx_account_invitations_account_id",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_account_invitations_email": {
+          "name": "idx_account_invitations_email",
+          "columns": [
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_account_invitations_token_hash": {
+          "name": "idx_account_invitations_token_hash",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "uniq_account_invitations_active": {
+          "name": "uniq_account_invitations_active",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"email\")",
+              "isExpression": true,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "where": "accepted_at IS NULL AND revoked_at IS NULL",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "account_invitations_account_id_fkey": {
+          "name": "account_invitations_account_id_fkey",
+          "tableFrom": "account_invitations",
+          "columnsFrom": [
+            "account_id"
+          ],
+          "tableTo": "accounts",
+          "schemaTo": "app",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "account_invitations_token_hash_key": {
+          "name": "account_invitations_token_hash_key",
+          "columns": [
+            "token_hash"
+          ],
+          "nullsNotDistinct": false
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "app.account_join_requests": {
+      "name": "account_join_requests",
+      "schema": "app",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(320)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(16)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "idx_account_join_requests_account_id": {
+          "name": "idx_account_join_requests_account_id",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_account_join_requests_user_id": {
+          "name": "idx_account_join_requests_user_id",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "uniq_account_join_requests_pending": {
+          "name": "uniq_account_join_requests_pending",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "where": "status = 'pending'",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "account_join_requests_account_id_fkey": {
+          "name": "account_join_requests_account_id_fkey",
+          "tableFrom": "account_join_requests",
+          "columnsFrom": [
+            "account_id"
+          ],
+          "tableTo": "accounts",
+          "schemaTo": "app",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        },
+        "account_join_requests_user_id_fkey": {
+          "name": "account_join_requests_user_id_fkey",
+          "tableFrom": "account_join_requests",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "app.account_ownership_transfers": {
+      "name": "account_ownership_transfers",
+      "schema": "app",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_user_id": {
+          "name": "from_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "to_user_id": {
+          "name": "to_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_at": {
+          "name": "accepted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "declined_at": {
+          "name": "declined_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_account_ownership_transfers_account_id": {
+          "name": "idx_account_ownership_transfers_account_id",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_account_ownership_transfers_token_hash": {
+          "name": "idx_account_ownership_transfers_token_hash",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "uniq_account_ownership_transfers_pending": {
+          "name": "uniq_account_ownership_transfers_pending",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "where": "accepted_at IS NULL AND declined_at IS NULL AND cancelled_at IS NULL",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "account_ownership_transfers_account_id_fkey": {
+          "name": "account_ownership_transfers_account_id_fkey",
+          "tableFrom": "account_ownership_transfers",
+          "columnsFrom": [
+            "account_id"
+          ],
+          "tableTo": "accounts",
+          "schemaTo": "app",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        },
+        "account_ownership_transfers_from_user_id_fkey": {
+          "name": "account_ownership_transfers_from_user_id_fkey",
+          "tableFrom": "account_ownership_transfers",
+          "columnsFrom": [
+            "from_user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        },
+        "account_ownership_transfers_to_user_id_fkey": {
+          "name": "account_ownership_transfers_to_user_id_fkey",
+          "tableFrom": "account_ownership_transfers",
+          "columnsFrom": [
+            "to_user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "account_ownership_transfers_token_hash_key": {
+          "name": "account_ownership_transfers_token_hash_key",
+          "columns": [
+            "token_hash"
+          ],
+          "nullsNotDistinct": false
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "app.accounts": {
+      "name": "accounts",
+      "schema": "app",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(200)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stripe_customer_id": {
+          "name": "stripe_customer_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_domain": {
+          "name": "claimed_domain",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "idx_accounts_deleted_at": {
+          "name": "idx_accounts_deleted_at",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_accounts_claimed_domain": {
+          "name": "idx_accounts_claimed_domain",
+          "columns": [
+            {
+              "expression": "claimed_domain",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "uniq_accounts_claimed_domain_active": {
+          "name": "uniq_accounts_claimed_domain_active",
+          "columns": [
+            {
+              "expression": "claimed_domain",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "where": "claimed_domain IS NOT NULL AND deleted_at IS NULL",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "accounts_stripe_customer_id_key": {
+          "name": "accounts_stripe_customer_id_key",
+          "columns": [
+            "stripe_customer_id"
+          ],
+          "nullsNotDistinct": false
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "audit.audit_log": {
+      "name": "audit_log",
+      "schema": "audit",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_membership_id": {
+          "name": "actor_membership_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_account_id": {
+          "name": "target_account_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_user_id": {
+          "name": "target_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_membership_id": {
+          "name": "target_membership_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource": {
+          "name": "resource",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_id": {
+          "name": "request_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "ip": {
+          "name": "ip",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_audit_log_user_id": {
+          "name": "idx_audit_log_user_id",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_audit_log_action": {
+          "name": "idx_audit_log_action",
+          "columns": [
+            {
+              "expression": "action",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_audit_log_created_at": {
+          "name": "idx_audit_log_created_at",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_audit_log_target_account_id": {
+          "name": "idx_audit_log_target_account_id",
+          "columns": [
+            {
+              "expression": "target_account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "audit_log_user_id_fkey": {
+          "name": "audit_log_user_id_fkey",
+          "tableFrom": "audit_log",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "set null"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "audit.redactions": {
+      "name": "redactions",
+      "schema": "audit",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "original_user_id_hash": {
+          "name": "original_user_id_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "redacted_at": {
+          "name": "redacted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "reason": {
+          "name": "reason",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_redactions_original_user_id_hash": {
+          "name": "idx_redactions_original_user_id_hash",
+          "columns": [
+            {
+              "expression": "original_user_id_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "auth.session_retired_tokens": {
+      "name": "session_retired_tokens",
+      "schema": "auth",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "family_id": {
+          "name": "family_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_session_retired_tokens_hash_unique": {
+          "name": "idx_session_retired_tokens_hash_unique",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_session_retired_tokens_family_id": {
+          "name": "idx_session_retired_tokens_family_id",
+          "columns": [
+            {
+              "expression": "family_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "session_retired_tokens_session_id_fkey": {
+          "name": "session_retired_tokens_session_id_fkey",
+          "tableFrom": "session_retired_tokens",
+          "columnsFrom": [
+            "session_id"
+          ],
+          "tableTo": "sessions",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "auth.sessions": {
+      "name": "sessions",
+      "schema": "auth",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "family_id": {
+          "name": "family_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "previous_token_hash": {
+          "name": "previous_token_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_sessions_token_hash_unique": {
+          "name": "idx_sessions_token_hash_unique",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_sessions_previous_token_hash": {
+          "name": "idx_sessions_previous_token_hash",
+          "columns": [
+            {
+              "expression": "previous_token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_sessions_family_id": {
+          "name": "idx_sessions_family_id",
+          "columns": [
+            {
+              "expression": "family_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_sessions_user_id": {
+          "name": "idx_sessions_user_id",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_sessions_expires_at": {
+          "name": "idx_sessions_expires_at",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "sessions_user_id_fkey": {
+          "name": "sessions_user_id_fkey",
+          "tableFrom": "sessions",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "auth.email_verification_tokens": {
+      "name": "email_verification_tokens",
+      "schema": "auth",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_email_verification_tokens_token_hash": {
+          "name": "idx_email_verification_tokens_token_hash",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_email_verification_tokens_user_id": {
+          "name": "idx_email_verification_tokens_user_id",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "email_verification_tokens_user_id_fkey": {
+          "name": "email_verification_tokens_user_id_fkey",
+          "tableFrom": "email_verification_tokens",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "email_verification_tokens_token_hash_key": {
+          "name": "email_verification_tokens_token_hash_key",
+          "columns": [
+            "token_hash"
+          ],
+          "nullsNotDistinct": false
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "auth.mfa_recovery_codes": {
+      "name": "mfa_recovery_codes",
+      "schema": "auth",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code_hash": {
+          "name": "code_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "used_at": {
+          "name": "used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_mfa_recovery_codes_user_id": {
+          "name": "idx_mfa_recovery_codes_user_id",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "mfa_recovery_codes_user_id_fkey": {
+          "name": "mfa_recovery_codes_user_id_fkey",
+          "tableFrom": "mfa_recovery_codes",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "auth.password_reset_tokens": {
+      "name": "password_reset_tokens",
+      "schema": "auth",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_password_reset_tokens_token_hash": {
+          "name": "idx_password_reset_tokens_token_hash",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_password_reset_tokens_user_id": {
+          "name": "idx_password_reset_tokens_user_id",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "password_reset_tokens_user_id_fkey": {
+          "name": "password_reset_tokens_user_id_fkey",
+          "tableFrom": "password_reset_tokens",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "password_reset_tokens_token_hash_key": {
+          "name": "password_reset_tokens_token_hash_key",
+          "columns": [
+            "token_hash"
+          ],
+          "nullsNotDistinct": false
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "auth.user_auth_providers": {
+      "name": "user_auth_providers",
+      "schema": "auth",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_user_id": {
+          "name": "provider_user_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "password_hash": {
+          "name": "password_hash",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_user_auth_providers_provider_id": {
+          "name": "idx_user_auth_providers_provider_id",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_user_auth_providers_user_id": {
+          "name": "idx_user_auth_providers_user_id",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "user_auth_providers_user_id_fkey": {
+          "name": "user_auth_providers_user_id_fkey",
+          "tableFrom": "user_auth_providers",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "user_auth_providers_provider_provider_user_id_key": {
+          "name": "user_auth_providers_provider_provider_user_id_key",
+          "columns": [
+            "provider",
+            "provider_user_id"
+          ],
+          "nullsNotDistinct": false
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "auth.users": {
+      "name": "users",
+      "schema": "auth",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "first_name": {
+          "name": "first_name",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "last_name": {
+          "name": "last_name",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "email_verified_at": {
+          "name": "email_verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "is_platform_admin": {
+          "name": "is_platform_admin",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "mfa_enabled_at": {
+          "name": "mfa_enabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mfa_secret_encrypted": {
+          "name": "mfa_secret_encrypted",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mfa_last_totp_step": {
+          "name": "mfa_last_totp_step",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "idx_users_email": {
+          "name": "idx_users_email",
+          "columns": [
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_users_is_platform_admin": {
+          "name": "idx_users_is_platform_admin",
+          "columns": [
+            {
+              "expression": "is_platform_admin",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "users_email_key": {
+          "name": "users_email_key",
+          "columns": [
+            "email"
+          ],
+          "nullsNotDistinct": false
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "billing.account_plans": {
+      "name": "account_plans",
+      "schema": "billing",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plan_id": {
+          "name": "plan_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "current_period_end": {
+          "name": "current_period_end",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'stripe'"
+        },
+        "stripe_subscription_id": {
+          "name": "stripe_subscription_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stripe_subscription_created_at": {
+          "name": "stripe_subscription_created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_stripe_event_id": {
+          "name": "last_stripe_event_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_stripe_event_at": {
+          "name": "last_stripe_event_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "idx_account_plans_account_id": {
+          "name": "idx_account_plans_account_id",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_account_plans_status": {
+          "name": "idx_account_plans_status",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "uniq_account_plans_current": {
+          "name": "uniq_account_plans_current",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "where": "revoked_at IS NULL",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "account_plans_account_id_fkey": {
+          "name": "account_plans_account_id_fkey",
+          "tableFrom": "account_plans",
+          "columnsFrom": [
+            "account_id"
+          ],
+          "tableTo": "accounts",
+          "schemaTo": "app",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        },
+        "account_plans_plan_id_fkey": {
+          "name": "account_plans_plan_id_fkey",
+          "tableFrom": "account_plans",
+          "columnsFrom": [
+            "plan_id"
+          ],
+          "tableTo": "plans",
+          "schemaTo": "billing",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "restrict"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "billing.plan_features": {
+      "name": "plan_features",
+      "schema": "billing",
+      "columns": {
+        "plan_id": {
+          "name": "plan_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "feature_key": {
+          "name": "feature_key",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "plan_features_plan_id_fkey": {
+          "name": "plan_features_plan_id_fkey",
+          "tableFrom": "plan_features",
+          "columnsFrom": [
+            "plan_id"
+          ],
+          "tableTo": "plans",
+          "schemaTo": "billing",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {
+        "plan_features_pkey": {
+          "name": "plan_features_pkey",
+          "columns": [
+            "plan_id",
+            "feature_key"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "billing.plans": {
+      "name": "plans",
+      "schema": "billing",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "stripe_price_id": {
+          "name": "stripe_price_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "stripe_product_id": {
+          "name": "stripe_product_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "plans_name_key": {
+          "name": "plans_name_key",
+          "columns": [
+            "name"
+          ],
+          "nullsNotDistinct": false
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "billing.stripe_webhook_events": {
+      "name": "stripe_webhook_events",
+      "schema": "billing",
+      "columns": {
+        "event_id": {
+          "name": "event_id",
+          "type": "varchar(255)",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "auth.account_memberships": {
+      "name": "account_memberships",
+      "schema": "auth",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invited_by_user_id": {
+          "name": "invited_by_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "joined_at": {
+          "name": "joined_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_reason": {
+          "name": "revoked_reason",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "idx_account_memberships_account_id": {
+          "name": "idx_account_memberships_account_id",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_account_memberships_user_id": {
+          "name": "idx_account_memberships_user_id",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "uniq_account_memberships_active_user": {
+          "name": "uniq_account_memberships_active_user",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "where": "revoked_at IS NULL",
+          "concurrently": false
+        },
+        "uniq_account_memberships_active_owner": {
+          "name": "uniq_account_memberships_active_owner",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "where": "role = 'owner' AND revoked_at IS NULL",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "account_memberships_account_id_fkey": {
+          "name": "account_memberships_account_id_fkey",
+          "tableFrom": "account_memberships",
+          "columnsFrom": [
+            "account_id"
+          ],
+          "tableTo": "accounts",
+          "schemaTo": "app",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        },
+        "account_memberships_user_id_fkey": {
+          "name": "account_memberships_user_id_fkey",
+          "tableFrom": "account_memberships",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "notifications.email_suppression": {
+      "name": "email_suppression",
+      "schema": "notifications",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(320)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_message_id": {
+          "name": "provider_message_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "suppressed_at": {
+          "name": "suppressed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_email_suppression_email": {
+          "name": "idx_email_suppression_email",
+          "columns": [
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_email_suppression_suppressed_at": {
+          "name": "idx_email_suppression_suppressed_at",
+          "columns": [
+            {
+              "expression": "suppressed_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "notifications.notification": {
+      "name": "notification",
+      "schema": "notifications",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "recipient_user_id": {
+          "name": "recipient_user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "rendered": {
+          "name": "rendered",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unread'"
+        },
+        "read_at": {
+          "name": "read_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_notification_recipient_status_created_at": {
+          "name": "idx_notification_recipient_status_created_at",
+          "columns": [
+            {
+              "expression": "recipient_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_notification_event_type": {
+          "name": "idx_notification_event_type",
+          "columns": [
+            {
+              "expression": "event_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "notification_recipient_user_id_fkey": {
+          "name": "notification_recipient_user_id_fkey",
+          "tableFrom": "notification",
+          "columnsFrom": [
+            "recipient_user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "notifications.notification_dedup": {
+      "name": "notification_dedup",
+      "schema": "notifications",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "dedup_key": {
+          "name": "dedup_key",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_notification_dedup_key_unique": {
+          "name": "idx_notification_dedup_key_unique",
+          "columns": [
+            {
+              "expression": "dedup_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_notification_dedup_expires_at": {
+          "name": "idx_notification_dedup_expires_at",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "notifications.notification_delivery": {
+      "name": "notification_delivery",
+      "schema": "notifications",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "notification_id": {
+          "name": "notification_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "channel": {
+          "name": "channel",
+          "type": "varchar(30)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "sent_at": {
+          "name": "sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failed_at": {
+          "name": "failed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempts": {
+          "name": "attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_notification_delivery_notification_channel": {
+          "name": "idx_notification_delivery_notification_channel",
+          "columns": [
+            {
+              "expression": "notification_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "channel",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "notification_delivery_notification_id_fkey": {
+          "name": "notification_delivery_notification_id_fkey",
+          "tableFrom": "notification_delivery",
+          "columnsFrom": [
+            "notification_id"
+          ],
+          "tableTo": "notification",
+          "schemaTo": "notifications",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "notifications.notification_preference": {
+      "name": "notification_preference",
+      "schema": "notifications",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "channel": {
+          "name": "channel",
+          "type": "varchar(30)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_notification_preference_user_event_channel": {
+          "name": "idx_notification_preference_user_event_channel",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "event_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "channel",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "notification_preference_user_id_fkey": {
+          "name": "notification_preference_user_id_fkey",
+          "tableFrom": "notification_preference",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "notifications.push_subscription": {
+      "name": "push_subscription",
+      "schema": "notifications",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "endpoint": {
+          "name": "endpoint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "p256dh_key": {
+          "name": "p256dh_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "auth_key": {
+          "name": "auth_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_push_subscription_user_endpoint": {
+          "name": "idx_push_subscription_user_endpoint",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "endpoint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        },
+        "idx_push_subscription_user_id": {
+          "name": "idx_push_subscription_user_id",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "with": {},
+          "method": "btree",
+          "concurrently": false
+        }
+      },
+      "foreignKeys": {
+        "push_subscription_user_id_fkey": {
+          "name": "push_subscription_user_id_fkey",
+          "tableFrom": "push_subscription",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "tableTo": "users",
+          "schemaTo": "auth",
+          "columnsTo": [
+            "id"
+          ],
+          "onUpdate": "no action",
+          "onDelete": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {
+    "app": "app",
+    "audit": "audit",
+    "auth": "auth",
+    "billing": "billing",
+    "notifications": "notifications"
+  },
+  "views": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
\ No newline at end of file
diff --git a/apps/api/drizzle/meta/_journal.json b/apps/api/drizzle/meta/_journal.json
index 2c815928..a65342d0 100644
--- a/apps/api/drizzle/meta/_journal.json
+++ b/apps/api/drizzle/meta/_journal.json
@@ -15,6 +15,13 @@
       "when": 1789019374688,
       "tag": "0001_wild_gladiator",
       "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "7",
+      "when": 1791497355427,
+      "tag": "0002_metrics_exporter_grants",
+      "breakpoints": true
     }
   ]
 }
\ No newline at end of file
diff --git a/apps/api/osv-scanner.toml b/apps/api/osv-scanner.toml
index 5b6321c2..9434a9d7 100644
--- a/apps/api/osv-scanner.toml
+++ b/apps/api/osv-scanner.toml
@@ -24,3 +24,43 @@ micromatch; our usage is internal build-time tooling (vite, tsconfig
 resolution). No path from user input to micromatch in api source. Awaiting
 upstream patch via vite/jest transitive deps.
 """
+
+[[IgnoredVulns]]
+id = "GHSA-vfj7-8cjw-p6xm"
+ignoreUntil = "2026-11-18T00:00:00Z"
+reason = """
+braces 3.0.3 (no fixed release yet). Reached only through micromatch 4.0.5 in
+the @boring-stack-pkg ESLint plugins: lint-time tooling, never in the
+production image or reached by request input. Remove once braces is patched.
+"""
+
+# Handlebars has no release that is both patched and past the 7-day quarantine
+# (4.7.10 was published 2026-10-05, eligible from 2026-10-12). Bump
+# handlebars to 4.7.10 when it ages in, then drop these three entries.
+[[IgnoredVulns]]
+id = "GHSA-8r5x-fm3f-whwj"
+ignoreUntil = "2026-10-16T00:00:00Z"
+reason = """
+Handlebars compile-path JavaScript injection (bypass of CVE-2026-33937), fixed
+in 4.7.10. Templates are compiled only at build time (src/templates/email/build.ts,
+preview.ts) from files we own; runtime rendering uses precompiled templates via
+handlebars/runtime. No user-supplied template source reaches compile().
+"""
+
+[[IgnoredVulns]]
+id = "GHSA-p8wg-vrv2-v86f"
+ignoreUntil = "2026-10-16T00:00:00Z"
+reason = """
+Handlebars own-property check bypass leading to JavaScript injection, fixed in
+4.7.10. Same usage as GHSA-8r5x-fm3f-whwj: compile() runs only over owned
+templates at build time; no attacker-controlled template or helper source.
+"""
+
+[[IgnoredVulns]]
+id = "GHSA-xw65-4hp5-5hc7"
+ignoreUntil = "2026-10-16T00:00:00Z"
+reason = """
+Handlebars unsafe inline embedding of precompiled templates, fixed in 4.7.10.
+Only precompiled, repo-owned templates are embedded; no template content is
+derived from request input. Same expiry as GHSA-8r5x-fm3f-whwj.
+"""
diff --git a/apps/api/package.json b/apps/api/package.json
index 03e26116..a291fed2 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -78,7 +78,7 @@
     "fs-extra": "11.4.0",
     "handlebars": "4.7.9",
     "ioredis": "5.11.1",
-    "nodemailer": "10.0.0",
+    "nodemailer": "10.0.9",
     "openai": "7.10.0",
     "otpauth": "9.5.2",
     "pg": "8.23.0",
@@ -130,18 +130,24 @@
     "typescript-eslint": "8.69.0"
   },
   "//overrides": {
-    "_": "Why these transitive deps are pinned. Keep each entry in sync with the matching `overrides` key \u2014 enforced by the package-override-parity lint-meta rule.",
+    "_": "Why these transitive deps are pinned. Keep each entry in sync with the matching `overrides` key — enforced by the package-override-parity lint-meta rule.",
     "@typescript-eslint/utils": "Single @typescript-eslint/utils resolution across the workspace so the shared @boring-stack-pkg ESLint plugins all load the same utils version. The UI and docs apps mirror this exact pin; a mismatch makes the custom plugins resolve divergent utils copies and fail to load.",
-    "axios": "Pin patched axios (GHSA-gcfj-64vw-6mp9 and related SSRF/credential-leak advisories). 1.16.0 is vulnerable; 1.18.0 patches it. Pulled in transitively via @sendgrid/mail -> @sendgrid/client.",
+    "axios": "Pin patched axios (GHSA-gcfj-64vw-6mp9 and related SSRF/credential-leak advisories, then GHSA-r4gj-5m52-g5wh, GHSA-vh66-26gq-q6x8, GHSA-x97p-jq2g-jp4f). 1.18.0 is vulnerable; 1.20.0 patches it. Pulled in transitively via @sendgrid/mail -> @sendgrid/client. Mirrored by apps/docs.",
+    "@grpc/grpc-js": "Pin patched @grpc/grpc-js (GHSA-f596-whhp-79r4, GHSA-m9gg-hp2v-232j). 1.14.4 is vulnerable; 1.14.5 patches it. Pulled in transitively via @opentelemetry/otlp-grpc-exporter-base, which accepts ^1.14.3.",
     "form-data": "Pin patched form-data (GHSA-hmw2-7cc7-3qxx CRLF injection via unescaped multipart field names); 4.0.5 is vulnerable, 4.0.6 patches it. Pulled in transitively via @sendgrid/mail -> @sendgrid/client -> axios. Excluded from the install quarantine while <7 days old.",
-    "ioredis": "Force a single ioredis resolution across the tree. bullmq 5.80.2 exact-pins ioredis@5.10.1, so bumping the top-level dep to 5.11.1 otherwise leaves bullmq on its own nested 5.10.1 copy \u2014 two ioredis instances whose RedisOptions types are structurally incompatible (tsc fails on new Redis(options) calls). This override collapses bullmq's nested copy onto 5.11.1 too; 5.10.1 -> 5.11.1 is a semver patch and the Redis/BullMQ integration tests verify runtime compatibility. Drop this once bullmq advances its own ioredis pin.",
-    "protobufjs": "Pin patched protobufjs (GHSA-j3f2-48v5-ccww). 7.6.1 is vulnerable; 7.6.5 patches it. Transitive via the OpenTelemetry OTLP exporter (build/telemetry path)."
+    "ioredis": "Force a single ioredis resolution across the tree. bullmq 5.80.2 exact-pins ioredis@5.10.1, so bumping the top-level dep to 5.11.1 otherwise leaves bullmq on its own nested 5.10.1 copy — two ioredis instances whose RedisOptions types are structurally incompatible (tsc fails on new Redis(options) calls). This override collapses bullmq's nested copy onto 5.11.1 too; 5.10.1 -> 5.11.1 is a semver patch and the Redis/BullMQ integration tests verify runtime compatibility. Drop this once bullmq advances its own ioredis pin.",
+    "protobufjs": "Pin patched protobufjs (GHSA-j3f2-48v5-ccww). 7.6.1 is vulnerable; 7.6.5 patches it. Transitive via the OpenTelemetry OTLP exporter (build/telemetry path).",
+    "smol-toml": "Pin patched smol-toml (GHSA-r4xh-jqrq-34v2). 1.8.0 is vulnerable; 1.9.0 patches it. Transitive via knip (lint-time only). Mirrored in every app by the override-parity rule.",
+    "source-map-js": "Pin patched source-map-js (GHSA-68fv-2mgg-jv7q). 1.2.1 is vulnerable; 1.2.2 patches it. Transitive via postcss / css-tree build tooling. Mirrored in every app by the override-parity rule."
   },
   "overrides": {
+    "@grpc/grpc-js": "1.14.5",
     "@typescript-eslint/utils": "8.61.1",
-    "axios": "1.18.0",
+    "axios": "1.20.0",
     "form-data": "4.0.6",
     "ioredis": "5.11.1",
-    "protobufjs": "7.6.5"
+    "protobufjs": "7.6.5",
+    "smol-toml": "1.9.0",
+    "source-map-js": "1.2.2"
   }
 }
diff --git a/apps/api/scripts/db/seed-superuser.ts b/apps/api/scripts/db/seed-superuser.ts
index 7a4cfc85..db2e585d 100644
--- a/apps/api/scripts/db/seed-superuser.ts
+++ b/apps/api/scripts/db/seed-superuser.ts
@@ -33,7 +33,7 @@ async function main(): Promise<void> {
   if (email === "" || password === "") {
     console.log(
       "[seed-superuser] SUPERUSER_EMAIL or SUPERUSER_PASSWORD unset — skipping. " +
-        "Set both to create a privileged user on first migrate, or sign up via the UI. " +
+        "Set both, then run `bun run db:seed`, to create a privileged user, or sign up via the UI. " +
         "Running under docker-compose? The api-migrate service interpolates these " +
         "from compose/.env (NOT apps/api/.env)."
     );
diff --git a/apps/api/scripts/lint-meta/RULES.md b/apps/api/scripts/lint-meta/RULES.md
index 81f53b55..eea8692e 100644
--- a/apps/api/scripts/lint-meta/RULES.md
+++ b/apps/api/scripts/lint-meta/RULES.md
@@ -25,7 +25,7 @@ Run `bun run lint:meta --list-rules` for the machine-readable list from the regi
 | `github-actions-concurrency-explicit`     | ci           | no          | Workflows with a concurrency block must set cancel-in-progress explicitly.                                                                                                                                   |
 | `github-actions-paths-filter-parity`      | ci           | no          | Workflows pairing push.paths with a dorny/paths-filter gate must keep the two path sets mutually covered.                                                                                                    |
 | `github-actions-pip-install-pinned`       | ci           | no          | Workflow pip install steps must pin package versions with == so CI tools cannot drift with PyPI releases.                                                                                                    |
-| `github-actions-runner-pinned`            | ci           | no          | Workflows must pin runner images to an explicit OS version instead of floating *-latest labels.                                                                                                              |
+| `github-actions-runner-pinned`            | ci           | no          | Workflows must pin runner images to an explicit OS version instead of floating *-latest labels, and guard vars.CI_RUNNER against fork pull requests.                                                         |
 | `github-actions-security-no-cancel`       | ci           | no          | Security scan workflows (*-security-{sast,secrets,deps}) must set concurrency cancel-in-progress: false so no pushed ref goes unscanned.                                                                     |
 | `github-actions-expression-syntax`        | ci           | no          | Every expression opener in a workflow must be a well-formed Actions expression.                                                                                                                              |
 | `github-actions-service-image-digest-pin` | ci           | no          | Workflow service/container images must be pinned by @sha256 digest, not tag alone.                                                                                                                           |
diff --git a/apps/api/scripts/lint-meta/rules/ci/github-actions-runner-pinned.ts b/apps/api/scripts/lint-meta/rules/ci/github-actions-runner-pinned.ts
index a916d604..76325085 100644
--- a/apps/api/scripts/lint-meta/rules/ci/github-actions-runner-pinned.ts
+++ b/apps/api/scripts/lint-meta/rules/ci/github-actions-runner-pinned.ts
@@ -5,6 +5,7 @@ import type { IMetaRule, IViolation } from "../../types";
 const RULE_ID = "github-actions-runner-pinned";
 
 const RUNS_ON_REGEX = /^\s*runs-on:\s*(?<label>\S+)\s*(?:#.*)?$/u;
+const FORK_GUARD = "!github.event.pull_request.head.repo.fork";
 
 /*
  * `ubuntu-latest` floats on GitHub's migration schedule: preinstalled
@@ -14,12 +15,30 @@ const RUNS_ON_REGEX = /^\s*runs-on:\s*(?<label>\S+)\s*(?:#.*)?$/u;
  * action SHAs, scanner versions, bun, so runner images get the same
  * bar: name an explicit OS version (e.g. ubuntu-24.04). Expression
  * labels (matrix strategies) are out of scope for a line scan.
+ *
+ * The one expression that is checked is the self-hosted runner switch.
+ * `vars.CI_RUNNER` moves jobs onto the operator's own machines, and a
+ * pull request from a fork must never run there, so every use must
+ * carry the fork guard and fall back to a pinned hosted image.
  */
 export function checkWorkflowRunnerPinned(file: string): IViolation[] {
   const violations: IViolation[] = [];
   const lines = readFileSync(file, "utf8").split("\n");
 
   for (const line of lines) {
+    if (
+      /^\s*runs-on:/u.test(line) &&
+      line.includes("vars.CI_RUNNER") &&
+      !line.includes(FORK_GUARD)
+    ) {
+      violations.push({
+        file,
+        rule: RULE_ID,
+        message: `runs-on uses vars.CI_RUNNER without the fork guard: pull requests from forks would run on self-hosted runners. Use \${{ ${FORK_GUARD} && vars.CI_RUNNER || 'ubuntu-24.04' }}.`,
+      });
+      continue;
+    }
+
     const label = RUNS_ON_REGEX.exec(line)?.groups?.label;
 
     if (label === undefined || label.startsWith("$")) {
@@ -46,7 +65,7 @@ export const githubActionsRunnerPinnedRule: IMetaRule = {
   id: RULE_ID,
   category: "ci",
   description:
-    "Workflows must pin runner images to an explicit OS version instead of floating *-latest labels.",
+    "Workflows must pin runner images to an explicit OS version instead of floating *-latest labels, and guard vars.CI_RUNNER against fork pull requests.",
   run({ workflowFiles }) {
     return workflowFiles.flatMap(checkWorkflowRunnerPinned);
   },
diff --git a/apps/api/src/clients/postgres/index.ts b/apps/api/src/clients/postgres/index.ts
index 21af604e..596da1ad 100644
--- a/apps/api/src/clients/postgres/index.ts
+++ b/apps/api/src/clients/postgres/index.ts
@@ -2,27 +2,20 @@ import { drizzle } from "drizzle-orm/postgres-js";
 import postgres from "postgres";
 import { env } from "../../config/env";
 import { logger } from "../../config/logger";
+import { buildPostgresSsl } from "../../lib/postgres/connection";
 import * as schema from "./schema";
 
-const buildSslConfig = ():
-  false | { rejectUnauthorized: boolean; ca?: string } => {
-  if (!env.isProduction) {
-    return false;
-  }
-
-  return {
-    rejectUnauthorized: env.DATABASE_SSL_REJECT_UNAUTHORIZED,
-    ...(env.DATABASE_SSL_CA !== "" && { ca: env.DATABASE_SSL_CA }),
-  };
-};
-
 const client = postgres(env.DATABASE_URL, {
   max: env.DATABASE_POOL_SIZE,
   idle_timeout: 20,
   connect_timeout: env.isTest ? 1 : 10,
   max_lifetime: 60 * 30,
   prepare: true,
-  ssl: buildSslConfig(),
+  ssl: buildPostgresSsl({
+    isProduction: env.isProduction,
+    rejectUnauthorized: env.DATABASE_SSL_REJECT_UNAUTHORIZED,
+    ca: env.DATABASE_SSL_CA,
+  }),
   onnotice: (notice) => {
     if (!env.isDevelopment) {
       return;
diff --git a/apps/api/src/config/env/schema.ts b/apps/api/src/config/env/schema.ts
index 0581b0e5..f7971ffd 100644
--- a/apps/api/src/config/env/schema.ts
+++ b/apps/api/src/config/env/schema.ts
@@ -56,10 +56,11 @@ export const envSchema = t.Object({
   NOTIFICATION_SETTINGS_URL: t.String({ default: "" }),
 
   /*
-   * Optional first-boot superuser bootstrap. When both are set, the migrate
-   * job creates this user with admin role on first run. Empty = no user
-   * created; the operator signs up via the registration flow or sets these
-   * and re-runs `bun run db:seed`.
+   * Optional superuser bootstrap, applied by `bun run db:seed`. When both are
+   * set, that run creates this user with admin role; an existing user is left
+   * alone. The k3s migration Job runs db:migrate only, so production applies
+   * this as an explicit one-off (infra/k3s/README.md). Empty = no user
+   * created; the operator signs up via the registration flow.
    */
   SUPERUSER_EMAIL: t.String({ default: "" }),
   SUPERUSER_PASSWORD: t.String({ default: "" }),
diff --git a/apps/api/src/lib/postgres/connection.ts b/apps/api/src/lib/postgres/connection.ts
new file mode 100644
index 00000000..06dce465
--- /dev/null
+++ b/apps/api/src/lib/postgres/connection.ts
@@ -0,0 +1,67 @@
+/*
+ * One TLS policy for every Postgres connection the API opens: the runtime
+ * client (postgres-js, src/clients/postgres/index.ts) and the migration path
+ * (drizzle-kit, drizzle.config.ts). Both must trust the same CA, or migrations
+ * can pass against a trust store the app then refuses at boot.
+ *
+ * Pure on purpose: no env import, so drizzle.config.ts can use it without
+ * running the full API env validation.
+ */
+
+export interface IPostgresTlsSettings {
+  readonly isProduction: boolean;
+  readonly rejectUnauthorized: boolean;
+  /** PEM-encoded CA bundle that signed the server certificate. Empty = system CAs. */
+  readonly ca: string;
+}
+
+export type PostgresSsl = false | { rejectUnauthorized: boolean; ca?: string };
+
+export const buildPostgresSsl = ({
+  isProduction,
+  rejectUnauthorized,
+  ca,
+}: IPostgresTlsSettings): PostgresSsl => {
+  if (!isProduction) {
+    return false;
+  }
+
+  return { rejectUnauthorized, ...(ca !== "" && { ca }) };
+};
+
+export type DrizzleCredentials =
+  | { url: string }
+  | {
+      host: string;
+      port: number;
+      user: string;
+      password: string;
+      database: string;
+      ssl: Exclude<PostgresSsl, false>;
+    };
+
+/*
+ * drizzle-kit only accepts `ssl` alongside host-based credentials, not with
+ * `{ url }`. When TLS is on, split the URL into parts and carry the same ssl
+ * object the runtime client uses. Any `sslmode` query parameter is ignored
+ * here, so keep TLS policy in DATABASE_SSL_* rather than in the URL.
+ */
+export const buildDrizzleCredentials = (
+  databaseUrl: string,
+  ssl: PostgresSsl
+): DrizzleCredentials => {
+  if (ssl === false) {
+    return { url: databaseUrl };
+  }
+
+  const parsed = new URL(databaseUrl);
+
+  return {
+    host: parsed.hostname,
+    port: parsed.port === "" ? 5432 : Number(parsed.port),
+    user: decodeURIComponent(parsed.username),
+    password: decodeURIComponent(parsed.password),
+    database: decodeURIComponent(parsed.pathname.replace(/^\//, "")),
+    ssl,
+  };
+};
diff --git a/apps/api/tests/lib/postgres/connection.test.ts b/apps/api/tests/lib/postgres/connection.test.ts
new file mode 100644
index 00000000..95495331
--- /dev/null
+++ b/apps/api/tests/lib/postgres/connection.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from "bun:test";
+import {
+  buildDrizzleCredentials,
+  buildPostgresSsl,
+} from "../../../src/lib/postgres/connection";
+
+describe("buildPostgresSsl", () => {
+  it("disables TLS outside production", () => {
+    expect(
+      buildPostgresSsl({
+        isProduction: false,
+        rejectUnauthorized: true,
+        ca: "pem",
+      })
+    ).toBe(false);
+  });
+
+  it("verifies against system CAs in production when no CA is configured", () => {
+    expect(
+      buildPostgresSsl({ isProduction: true, rejectUnauthorized: true, ca: "" })
+    ).toEqual({ rejectUnauthorized: true });
+  });
+
+  it("carries the configured CA bundle in production", () => {
+    expect(
+      buildPostgresSsl({
+        isProduction: true,
+        rejectUnauthorized: true,
+        ca: "-----BEGIN CERTIFICATE-----",
+      })
+    ).toEqual({
+      rejectUnauthorized: true,
+      ca: "-----BEGIN CERTIFICATE-----",
+    });
+  });
+});
+
+describe("buildDrizzleCredentials", () => {
+  it("passes the URL through unchanged when TLS is off", () => {
+    expect(
+      buildDrizzleCredentials("postgresql://app:pw@localhost:5432/app", false)
+    ).toEqual({ url: "postgresql://app:pw@localhost:5432/app" });
+  });
+
+  it("splits the URL and carries the runtime ssl object when TLS is on", () => {
+    const ssl = { rejectUnauthorized: true, ca: "pem" };
+
+    expect(
+      buildDrizzleCredentials(
+        "postgresql://app%40ops:p%40ss%2Fword@db.internal:6432/tinkercaster",
+        ssl
+      )
+    ).toEqual({
+      host: "db.internal",
+      port: 6432,
+      user: "app@ops",
+      password: "p@ss/word",
+      database: "tinkercaster",
+      ssl,
+    });
+  });
+
+  it("defaults the port to 5432 when the URL omits it", () => {
+    expect(
+      buildDrizzleCredentials("postgresql://app:pw@db.internal/app", {
+        rejectUnauthorized: true,
+      })
+    ).toMatchObject({ host: "db.internal", port: 5432 });
+  });
+});
diff --git a/apps/api/tests/lint-meta/lint-meta.test.ts b/apps/api/tests/lint-meta/lint-meta.test.ts
index 26e2bdb5..3f750f0c 100644
--- a/apps/api/tests/lint-meta/lint-meta.test.ts
+++ b/apps/api/tests/lint-meta/lint-meta.test.ts
@@ -748,6 +748,9 @@ describe("checkWorkflowRunnerPinned", () => {
           "  matrix:",
           "    runs-on: ${{ matrix.os }}",
           "    steps: []",
+          "  selfhosted:",
+          "    runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}",
+          "    steps: []",
           "",
         ].join("\n")
       );
@@ -757,6 +760,27 @@ describe("checkWorkflowRunnerPinned", () => {
       rmSync(root, { recursive: true, force: true });
     }
   });
+
+  test("flags a self-hosted runner variable without the fork guard", () => {
+    const root = mkdtempSync(join(tmpdir(), "lint-meta-runner-pin-"));
+
+    try {
+      const file = writeNamedWorkflow(
+        root,
+        "wf.yml",
+        "jobs:\n  build:\n    runs-on: ${{ vars.CI_RUNNER || 'ubuntu-24.04' }}\n    steps: []\n"
+      );
+
+      const messages = checkWorkflowRunnerPinned(file).map(
+        (row) => row.message
+      );
+
+      expect(messages).toHaveLength(1);
+      expect(messages[0]).toContain("fork guard");
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
 });
 
 describe("checkWorkflowSecurityNoCancel", () => {
diff --git a/apps/docs/astro.config.mjs b/apps/docs/astro.config.mjs
index cf849989..da0be51a 100644
--- a/apps/docs/astro.config.mjs
+++ b/apps/docs/astro.config.mjs
@@ -704,6 +704,16 @@ The full config surface is machine-readable at https://boringstack.xyz/scaffold-
             { label: "Kubernetes (k3s)", link: "/infra/kubernetes/" },
           ],
         },
+        {
+          label: "Public site",
+          items: [
+            { label: "Overview", link: "/site/overview/" },
+            {
+              label: "Configuration and deployment",
+              link: "/site/deployment/",
+            },
+          ],
+        },
         {
           label: "Topics",
           items: [
@@ -800,8 +810,8 @@ The full config surface is machine-readable at https://boringstack.xyz/scaffold-
             },
             { label: "Codecov setup", link: "/runbooks/codecov-setup/" },
             {
-              label: "ArgoCD image updater (k3s)",
-              link: "/runbooks/argocd-image-updater/",
+              label: "Production releases (k3s)",
+              link: "/runbooks/production-release/",
             },
             {
               label: "Secrets backends (k3s)",
diff --git a/apps/docs/bun.lock b/apps/docs/bun.lock
index d45fb969..a108a174 100644
--- a/apps/docs/bun.lock
+++ b/apps/docs/bun.lock
@@ -34,18 +34,24 @@
   "overrides": {
     "@types/react": "19.2.18",
     "@types/react-dom": "19.2.5",
-    "adm-zip": "0.6.0",
-    "axios": "1.18.0",
-    "devalue": "5.8.1",
-    "dompurify": "3.4.13",
+    "adm-zip": "0.6.1",
+    "axios": "1.20.0",
+    "basic-ftp": "6.2.1",
+    "devalue": "5.9.3",
+    "dompurify": "3.4.16",
     "form-data": "4.0.6",
+    "ip-address": "10.7.2",
     "js-yaml": "4.3.2",
+    "katex": "0.18.2",
     "postcss": "8.5.23",
+    "postcss-nested": "7.0.2",
     "qs": "6.16.0",
-    "sharp": "0.35.4",
+    "sharp": "0.35.5",
+    "smol-toml": "1.9.0",
+    "source-map-js": "1.2.2",
     "svgo": "4.1.0",
     "tmp": "0.2.7",
-    "undici": "7.29.0",
+    "undici": "7.29.1",
     "ws": "8.21.3",
   },
   "packages": {
@@ -253,57 +259,57 @@
 
     "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="],
 
-    "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.3" }, "os": "darwin", "cpu": "arm64" }, "sha512-Uhfl4V4lhP2nbUVF9+hyH1+luj86f1gUFeo8ALYxFoULoU+G87D43BfeMP8XHsk9boxAnCY/bf2EHwhA7MuGsA=="],
+    "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.4" }, "os": "darwin", "cpu": "arm64" }, "sha512-QRUlFQ0WxvdWyqqG/WtI3iupfD5rBzmCHXSdPsY91sAtVtTo7Q4cb6zOccZ3gqEqkr0f1As1ehLqmEpDsRf+lg=="],
 
-    "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.3" }, "os": "darwin", "cpu": "x64" }, "sha512-hWniXY3bG5qKpkKrAwPe4y+VTPmf086YQAnkxWh7uA1YrlRouWGa0M0Mxj3ZjnXFkv7/TD1bTy9lGUK26vRvWw=="],
+    "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.4" }, "os": "darwin", "cpu": "x64" }, "sha512-+BR255RhDlpygUpOc/Jdt1nT6DQ3XG/ERo5wbcdOf5Q320dKtPCKPLR1LJs9VGXRaMa8l1uUa0tkCNOXiAxZUw=="],
 
-    "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.4", "", { "dependencies": { "@img/sharp-wasm32": "0.35.4" }, "os": "freebsd" }, "sha512-lIsKw/BU+kjB4eZjxrYrZmwOJYi3Ajrv66iAlBmUPyKc3HpnloevB1g3wxGD9P/5BbQ1brBGl65VRRrCvQDEqA=="],
+    "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.5", "", { "dependencies": { "@img/sharp-wasm32": "0.35.5" }, "os": "freebsd" }, "sha512-Y/z91nEZ4uIBX5X3nfTovjU9lHNKFYbL2lpHCLVNmXQK03VIZvXBBt0KxbPGp2SdGSF+2mQU4e+hQaWOt86iAw=="],
 
-    "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-suTBPTDGrI9WodccaDdwZItTSaBYASlBk1NSfElSHrUfzu3szG6lvIF58+WiFvnfzuK8ZBFS5zE00PxqxnRiPg=="],
+    "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-5R89nBYiRdUlSWJxPhO+GVtaXzXSxKnRu/xqMn3KTA3L9EB9Oy/P+Nn2f2vlhPuUdy/Zusb2DarbyTpGCfEDuw=="],
 
-    "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-FVJZ5mITMobmXIz/hPDTw0EintTW5H3WfrxwLqEqjiIihlu+hVRyGrFQ60xl0Lxn7Bt3zdpevPaQi0HEzqz9fw=="],
+    "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-iR2OKH80yi0U+dUplyh3/xdpFvps6YkCwsXenIJxqxR1v9o+xtKTGbS9H7cps+2Vxjc8B1j96p75NmTGjIhtpQ=="],
 
-    "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.3", "", { "os": "linux", "cpu": "arm" }, "sha512-3rbU4vqXXc3hY/OiXdl52xZvT0F1yEngWfvqudtPJg/KkyiaQw2DRsFrNzpmLvfavbwOq3qXn36GP8obHRULQA=="],
+    "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.4", "", { "os": "linux", "cpu": "arm" }, "sha512-LmRtTsOHuvM2+wlO2Db37dx5MiZhB0FvSunciw48YjdOkZz9KAiRbm8ujeMOA1INqmei5NapFxYEK1D1ZSidmw=="],
 
-    "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A=="],
+    "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-Y3dgX/6lE2QhQb+Gxy0WZxfg9MEm/JBjamZpS2IklP7xIQoKN4hzAm7KcMVGtaVDt3neE9OKBC7vAfonA/Lr1A=="],
 
-    "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.3", "", { "os": "linux", "cpu": "ppc64" }, "sha512-cdn1OvUBwsXhbC0zSzJnNzf5MZ/mTrobawDvNXBTxe8VtqKAm0sRuEY2Evzovb/w9JMk4TvRxqt1mekSuJz64w=="],
+    "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.4", "", { "os": "linux", "cpu": "ppc64" }, "sha512-Le6boB8Tai0Nis+gIxIpKx68UDVVIqdR8Tin5Yf1z2LJJQLDJvCDRqRu+jC2qCoD+eIomonmOwB4smBRxfVpYQ=="],
 
-    "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.3", "", { "os": "linux", "cpu": "none" }, "sha512-HjPVx7yKz+0lqdhDlTw1tt90wamBoxhiXpvl1XZpJLiHH4RCJ5yDTqH+VlYPv2fwFs89JFw4c1IexYOcQUi4IQ=="],
+    "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.4", "", { "os": "linux", "cpu": "none" }, "sha512-aHkkIEHPRdQEegJN20MLmGtxYD9R2wQr3Cwpddnu5+YKMt6Uzax7S9h5gpZTo8wyrGuZSlfQ63OevL5mTyOC7Q=="],
 
-    "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.3", "", { "os": "linux", "cpu": "s390x" }, "sha512-neWLh+3yCNThxnfy3c4BbVBeGgt9aftno+XbT56iK28RgeDs3UOFWviLWlUu0bArYVYJaFDK+RRohbicUNCm8Q=="],
+    "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.4", "", { "os": "linux", "cpu": "s390x" }, "sha512-ra/mB6MikESDUO7Yg+Mi95bFBb9GsObURuhnOv3OqknjGe9sZrG8tCe9q0xSIGrtLgvgw0gKnFWcK4blSgQOuQ=="],
 
-    "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA=="],
+    "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.4", "", { "os": "linux", "cpu": "x64" }, "sha512-GJ//SSXbnwSDes02umB3nDJLFcQzw8a18V8fyhqr6tV515tOEMdImjjxj1AoafMRz56F3PHgftnj1QEKSU1zkw=="],
 
-    "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-Y9kQaLMuNoB0bPYOOdcZMaseNrFpPodIWWMrx+CZyydf2xn68j9WYc6sWWRrDwNkzCQjKYfc68L7jKjGlHMibw=="],
+    "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-hvulFwtjUcagsis6BBxHwGFwWoNZjgYmULGVrZcyfNbjA8hKILbRxGg15/7w5HDyXHXUos/j6baAWqnCyQ2DWA=="],
 
-    "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-fj8Mv0HHfD1Rr+4I68+3agJynxDWtBFgicTbSOb9Bke6pIwzGcJ+RX/yHjmiEGFMCavY/dxvem7MyNaJF+wDiw=="],
+    "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.4", "", { "os": "linux", "cpu": "x64" }, "sha512-6zXKeE/p39I1AmA3cJG35eyBGNqNddLnUXjhwBnsGjFPWqf5VKkDBEqaEkPDoTEtkxwi2vv8Tcr2mDyP4So7Fg=="],
 
-    "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.3" }, "os": "linux", "cpu": "arm" }, "sha512-7OAS8gI0EReKGVN2HssHlM6umJgxF5VI3xN0p9FA91p/YO+ou5hiNghLdZ5BEHztwaaK5+bLKRf8x/o2L2nk9A=="],
+    "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.4" }, "os": "linux", "cpu": "arm" }, "sha512-LEaXK2WdXVK5ykcw0buWyPMsmLLL2vpHLD6yrNSW+JGEL3BZPA4tpKN6iaMc4AxTTAoaX/sU1rOL51lcIz48ZQ=="],
 
-    "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.3" }, "os": "linux", "cpu": "arm64" }, "sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ=="],
+    "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.4" }, "os": "linux", "cpu": "arm64" }, "sha512-LYVx5JTsOM2CBzmxreh+nl64/3H6Xb09iSLknqH47z2T2DFFxDeFLP5y4dJwe6H7uGQlHPyEEtIqyo3DYsRwdQ=="],
 
-    "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.3" }, "os": "linux", "cpu": "ppc64" }, "sha512-2oYZJeIl4kCcMGk4ouZVjnkCtFrpQFlNEtJ6GbxzhHQchwH0NH/qEb9ykmOl29dqwMq+JhFdZn+1ak2FKhI9fQ=="],
+    "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.4" }, "os": "linux", "cpu": "ppc64" }, "sha512-QVxAAq8evVRI9ia2vqgwrmWucn5Dfv+JdWzj75pD8omHLPSP7f8p20O8jxzjCcuCEQEOtYOZUmX1hkiZ0kdevA=="],
 
-    "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.3" }, "os": "linux", "cpu": "none" }, "sha512-cPbNChoRURAWdebDIHSenxRpgEdy7JkPydSnUxRm9VvKD7m0/xVaR/8Fzlu81pk5nHEvHH87UZUA7cTtwnbJSA=="],
+    "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.4" }, "os": "linux", "cpu": "none" }, "sha512-LtdreXguaavKODPIfzJ4kffx7UNt1omwtK0rch4EBbbSTXPnxWmYSayXdLJw0fJzQ97kHt1gL/yh4tvU+nCyRQ=="],
 
-    "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.3" }, "os": "linux", "cpu": "s390x" }, "sha512-RY0JFY8Fd6RonCBtHz+DvadaPkXDSI1AUn6yWL9TipqkZ1vY8w8evqdgyDFnkm4/K1ve1TvZiaePP5oSd4+WVQ=="],
+    "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.4" }, "os": "linux", "cpu": "s390x" }, "sha512-UZasTOFiYzotTsGOCu42BfUzP6Tu6Do/947iRm1RsLKvlllxwGcn4RN27LibGWceix4Y+Pmw3jsnTcCQIgWjqA=="],
 
-    "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.3" }, "os": "linux", "cpu": "x64" }, "sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA=="],
+    "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.4" }, "os": "linux", "cpu": "x64" }, "sha512-SxFtLTeJInhAA9Q836kux2vZNeOBQEx658qvbboZScr0wIARym3IcGmW7KpVD5sbVg0Ojy+udFQdayYIZyoNog=="],
 
-    "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.3" }, "os": "linux", "cpu": "arm64" }, "sha512-KB5jxpfWQTr0nc3xdHtWChdbifHrBGsd2SM62Eyxrl8afikm+f5qGBU75SJIZBT/S1MC8XyacdlXBMSWq6OURA=="],
+    "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.4" }, "os": "linux", "cpu": "arm64" }, "sha512-9HbMclmI1zlNkFRs3z9/eBtDjfD0sGlrX1z6b1qwmiFY5ElDLh4BC0LPBdVp7z1DXFiKlIcznf+ZlsuZzLxQqg=="],
 
-    "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.3" }, "os": "linux", "cpu": "x64" }, "sha512-f+eZJZIQNEEd26RPSW+76chwOf1XtA2Y/O+5ocVyLliHkeih3e+jhLVBdNTd2rS3IbNXK8+ug93Vf5ZXtF5Lxg=="],
+    "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.4" }, "os": "linux", "cpu": "x64" }, "sha512-4KOphqB035HrVdqLZfCgMzzERrQkkzOwRhl4OAkRO1YCldbaFjySXMaK534Mo0V+LndnlJk+sbUyLeU0ULyD1A=="],
 
-    "@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.4", "", { "dependencies": { "@emnapi/runtime": "^1.11.3" } }, "sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA=="],
+    "@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.5", "", { "dependencies": { "@emnapi/runtime": "^1.11.3" } }, "sha512-Ptsga1su4tQx+LLF1ECS9U6nz5kmrXKo6XVbtR48Ke3ZRxxgaWBu7IDtEe1quo8hiupwm6WFqxVlXaSf7IINGQ=="],
 
-    "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.4", "", { "dependencies": { "@img/sharp-wasm32": "0.35.4" }, "cpu": "none" }, "sha512-ESfNkywmCfPNyaZjxooddJQiQ+l/nTpGEOGthxiLnIHXC/CmcBixnfwUleX9mCz9ovrUUvKMap/pm8RYbzfwaA=="],
+    "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.5", "", { "dependencies": { "@img/sharp-wasm32": "0.35.5" }, "cpu": "none" }, "sha512-hfhF/FmoQyTUkA0bIKFOtw536BQSeBMe6BF6QyWlrPxT754+TFLaZ7sKKTfvvM0yJgKgaYTwnFCIZ/GuDw5SUA=="],
 
-    "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.4", "", { "os": "win32", "cpu": "arm64" }, "sha512-iNdlBX9gLVvqe2I3uIJSIKTq6wckP/DYxZtcqxm09x5Gi24DnFBmPAWZmr60ZyYMG0xlzo6goG3670ar+RXvRw=="],
+    "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-X4t7g+7ZA5DKblCBEXGjUqqemj4vczING/5viFwAL8h4N3qYeyjwdCvRLHi4EdOUI+2Z7UFlp1VM+p/AuEtm6Q=="],
 
-    "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.4", "", { "os": "win32", "cpu": "ia32" }, "sha512-kqRsbaa5CS6KHlpxnN7WhE6vAAugXyZButpRdvDWetlv6Qv4N9WTcrWzF7tXfB9T7MsoadqdI8hmwLq6UlLvtw=="],
+    "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.5", "", { "os": "win32", "cpu": "ia32" }, "sha512-5Zm82LoBc43nhwNybZlG7Y1KO//Zhsn306fQl29ZOuStHLGTo3BWL83q3cznX0poxSAMuYL1On/BHBxkBeKr6A=="],
 
-    "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.4", "", { "os": "win32", "cpu": "x64" }, "sha512-XtmnYhBcrORsJ4XJngyzr/EWP0hRZLAZRFaApdKuviyqF78+ylxh2y06ZmtULAMOnObJ3ucpN0AcwSWnMowTRg=="],
+    "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.5", "", { "os": "win32", "cpu": "x64" }, "sha512-x76eH0vEiHlcMQu8Y8IenntaACtddpT6W0wmXtWrnKcnKI7ME5DdgqhAD6SEWOEl1v2zDvkZDhFA9KnURwpfqg=="],
 
     "@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.13", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA=="],
 
@@ -547,7 +553,7 @@
 
     "acorn-jsx": ["acorn-jsx@5.3.2", "", { "peerDependencies": { "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ=="],
 
-    "adm-zip": ["adm-zip@0.6.0", "", {}, "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg=="],
+    "adm-zip": ["adm-zip@0.6.1", "", {}, "sha512-Xwrja8nx9e5o2N1my4DsKCeKpdrnACyr1wtbPxBDgGzKzKyE9kRtBFA8mWldI+RVlD7CBZNWY/wQ2+ydwOR6kQ=="],
 
     "agent-base": ["agent-base@9.0.0", "", {}, "sha512-TQf59BsZnytt8GdJKLPfUZ54g/iaUL2OWDSFCCvMOhsHduDQxO8xC4PNeyIkVcA5KwL2phPSv0douC0fgWzmnA=="],
 
@@ -581,7 +587,7 @@
 
     "axe-core": ["axe-core@4.13.0", "", {}, "sha512-UzGt8zg7Ny8djbYMhxl2zuEevVa7r2gJjYY5Lwr1xM7+XU2nd6CkIWFTVcCIbAP63vSz71NaVyyuSk9lHKcy0A=="],
 
-    "axios": ["axios@1.18.0", "", { "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.5", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, "sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw=="],
+    "axios": ["axios@1.20.0", "", { "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.6", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg=="],
 
     "axobject-query": ["axobject-query@4.1.0", "", {}, "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ=="],
 
@@ -591,7 +597,7 @@
 
     "basic-auth": ["basic-auth@2.0.1", "", { "dependencies": { "safe-buffer": "5.1.2" } }, "sha512-NF+epuEdnUYVlGuhaxbbq+dvJttwLnGY+YixlXlME5KpQ5W3CnXA5cVTneY3SPbPDRkcjMbifrwmFYcClgOZeg=="],
 
-    "basic-ftp": ["basic-ftp@5.3.1", "", {}, "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw=="],
+    "basic-ftp": ["basic-ftp@6.2.1", "", {}, "sha512-bK67isD+lKq46AU8vNtjvMaT2ZqAOAmNCbxUHlFBRD4k15NWxyEjmaKtZPlgce58So4BNTjITGQOVTjL9y0ECA=="],
 
     "bcp-47": ["bcp-47@2.1.1", "", { "dependencies": { "is-alphabetical": "^2.0.0", "is-alphanumerical": "^2.0.0", "is-decimal": "^2.0.0" } }, "sha512-KLw+H/gd2p4zly1X7Yh/qziuyae5/w/QFnvTng9eZL5fvszL7Whl3MBoWF8yxL7ksUjBfOD+OxkytiqbBpG+Fw=="],
 
@@ -773,7 +779,7 @@
 
     "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
 
-    "devalue": ["devalue@5.8.1", "", {}, "sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw=="],
+    "devalue": ["devalue@5.9.3", "", {}, "sha512-xRumYOCUZN/EesqHEU3WOXanOZNvfZFZ/o1AHVFDX1yI0UAkZkOgDXt341CzKoBVIkgQba55/+DjGBKrIoKcHw=="],
 
     "devlop": ["devlop@1.1.0", "", { "dependencies": { "dequal": "^2.0.0" } }, "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA=="],
 
@@ -787,7 +793,7 @@
 
     "domhandler": ["domhandler@5.0.3", "", { "dependencies": { "domelementtype": "^2.3.0" } }, "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w=="],
 
-    "dompurify": ["dompurify@3.4.13", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ=="],
+    "dompurify": ["dompurify@3.4.16", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ=="],
 
     "domutils": ["domutils@3.2.2", "", { "dependencies": { "dom-serializer": "^2.0.0", "domelementtype": "^2.3.0", "domhandler": "^5.0.3" } }, "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw=="],
 
@@ -987,7 +993,7 @@
 
     "internmap": ["internmap@2.0.3", "", {}, "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg=="],
 
-    "ip-address": ["ip-address@10.4.0", "", {}, "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ=="],
+    "ip-address": ["ip-address@10.7.2", "", {}, "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w=="],
 
     "ip-regex": ["ip-regex@2.1.0", "", {}, "sha512-58yWmlHpp7VYfcdTwMTvwMmqx/Elfxjd9RXTDyMsbL7lLWmhMylLEqiYVLKuLzOZqVgiWXD9MfR62Vv89VRxkw=="],
 
@@ -1027,7 +1033,7 @@
 
     "jszip": ["jszip@3.10.1", "", { "dependencies": { "lie": "~3.3.0", "pako": "~1.0.2", "readable-stream": "~2.3.6", "setimmediate": "^1.0.5" } }, "sha512-xXDvecyTpGLrqFrvkrUSoxxfJI5AH7U8zxxtVclpsUtMCq4JQ290LY8AW5c7Ggnr/Y/oK+bQMbqK2qmtk3pN4g=="],
 
-    "katex": ["katex@0.16.47", "", { "dependencies": { "commander": "^8.3.0" }, "bin": { "katex": "cli.js" } }, "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg=="],
+    "katex": ["katex@0.18.2", "", { "dependencies": { "commander": "^8.3.0" }, "bin": { "katex": "cli.js" } }, "sha512-3snve4y0SXTMequLim1FMiPvLGElySam0blN5xQZBqEY3lOJz1TnuaaiugnBZBqHzlSAGmFTYL7MCQkORuLKCA=="],
 
     "khroma": ["khroma@2.1.0", "", {}, "sha512-Ls993zuzfayK269Svk9hzpeGUKob/sIgZzyHYdjQoAdQetRKpOLj+k/QQQ/6Qi0Yz65mlROrfd+Ev+1+7dz9Kw=="],
 
@@ -1283,9 +1289,9 @@
 
     "postcss": ["postcss@8.5.23", "", { "dependencies": { "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg=="],
 
-    "postcss-nested": ["postcss-nested@6.2.0", "", { "dependencies": { "postcss-selector-parser": "^6.1.1" }, "peerDependencies": { "postcss": "^8.2.14" } }, "sha512-HQbt28KulC5AJzG+cZtj9kvKB93CFCdLvog1WFLf1D+xmMvPGlBstkpTEZfK5+AN9hfJocyBFCNiqyS48bpgzQ=="],
+    "postcss-nested": ["postcss-nested@7.0.2", "", { "dependencies": { "postcss-selector-parser": "^7.0.0" }, "peerDependencies": { "postcss": "^8.2.14" } }, "sha512-5osppouFc0VR9/VYzYxO03VaDa3e8F23Kfd6/9qcZTUI8P58GIYlArOET2Wq0ywSl2o2PjELhYOFI4W7l5QHKw=="],
 
-    "postcss-selector-parser": ["postcss-selector-parser@6.1.4", "", { "dependencies": { "cssesc": "^3.0.0", "util-deprecate": "^1.0.2" } }, "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ=="],
+    "postcss-selector-parser": ["postcss-selector-parser@7.1.6", "", { "dependencies": { "cssesc": "^3.0.0", "util-deprecate": "^1.0.2" } }, "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw=="],
 
     "prismjs": ["prismjs@1.30.0", "", {}, "sha512-DEvV2ZF2r2/63V+tK8hQvrR2ZGn10srHbXviTlcv7Kpzw8jWiNTqbVgjO3IY8RxrrOUF8VPMQQFysYYYv0YZxw=="],
 
@@ -1399,7 +1405,7 @@
 
     "setimmediate": ["setimmediate@1.0.5", "", {}, "sha512-MATJdZp8sLqDl/68LfQmbP8zKPLQNV6BIZoIgrscFDQ+RsvK/BxeDQOgyxKKoh0y/8h3BqVFnCqQ/gd+reiIXA=="],
 
-    "sharp": ["sharp@0.35.4", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.5" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.4", "@img/sharp-darwin-x64": "0.35.4", "@img/sharp-freebsd-wasm32": "0.35.4", "@img/sharp-libvips-darwin-arm64": "1.3.3", "@img/sharp-libvips-darwin-x64": "1.3.3", "@img/sharp-libvips-linux-arm": "1.3.3", "@img/sharp-libvips-linux-arm64": "1.3.3", "@img/sharp-libvips-linux-ppc64": "1.3.3", "@img/sharp-libvips-linux-riscv64": "1.3.3", "@img/sharp-libvips-linux-s390x": "1.3.3", "@img/sharp-libvips-linux-x64": "1.3.3", "@img/sharp-libvips-linuxmusl-arm64": "1.3.3", "@img/sharp-libvips-linuxmusl-x64": "1.3.3", "@img/sharp-linux-arm": "0.35.4", "@img/sharp-linux-arm64": "0.35.4", "@img/sharp-linux-ppc64": "0.35.4", "@img/sharp-linux-riscv64": "0.35.4", "@img/sharp-linux-s390x": "0.35.4", "@img/sharp-linux-x64": "0.35.4", "@img/sharp-linuxmusl-arm64": "0.35.4", "@img/sharp-linuxmusl-x64": "0.35.4", "@img/sharp-webcontainers-wasm32": "0.35.4", "@img/sharp-win32-arm64": "0.35.4", "@img/sharp-win32-ia32": "0.35.4", "@img/sharp-win32-x64": "0.35.4" }, "peerDependencies": { "@types/node": "*" }, "optionalPeers": ["@types/node"] }, "sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA=="],
+    "sharp": ["sharp@0.35.5", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.5" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.5", "@img/sharp-darwin-x64": "0.35.5", "@img/sharp-freebsd-wasm32": "0.35.5", "@img/sharp-libvips-darwin-arm64": "1.3.4", "@img/sharp-libvips-darwin-x64": "1.3.4", "@img/sharp-libvips-linux-arm": "1.3.4", "@img/sharp-libvips-linux-arm64": "1.3.4", "@img/sharp-libvips-linux-ppc64": "1.3.4", "@img/sharp-libvips-linux-riscv64": "1.3.4", "@img/sharp-libvips-linux-s390x": "1.3.4", "@img/sharp-libvips-linux-x64": "1.3.4", "@img/sharp-libvips-linuxmusl-arm64": "1.3.4", "@img/sharp-libvips-linuxmusl-x64": "1.3.4", "@img/sharp-linux-arm": "0.35.5", "@img/sharp-linux-arm64": "0.35.5", "@img/sharp-linux-ppc64": "0.35.5", "@img/sharp-linux-riscv64": "0.35.5", "@img/sharp-linux-s390x": "0.35.5", "@img/sharp-linux-x64": "0.35.5", "@img/sharp-linuxmusl-arm64": "0.35.5", "@img/sharp-linuxmusl-x64": "0.35.5", "@img/sharp-webcontainers-wasm32": "0.35.5", "@img/sharp-win32-arm64": "0.35.5", "@img/sharp-win32-ia32": "0.35.5", "@img/sharp-win32-x64": "0.35.5" }, "peerDependencies": { "@types/node": "*" }, "optionalPeers": ["@types/node"] }, "sha512-Ywn4OnzGukp7CDMrp08RQ50YKmuwG47brZgIVPTvBaaAfQlRlygrRqSrxdCiL9M+LlzLBiJ68IR1QqvzHyjC7g=="],
 
     "shiki": ["shiki@4.4.2", "", { "dependencies": { "@shikijs/core": "4.4.2", "@shikijs/engine-javascript": "4.4.2", "@shikijs/engine-oniguruma": "4.4.2", "@shikijs/langs": "4.4.2", "@shikijs/themes": "4.4.2", "@shikijs/types": "4.4.2", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5" } }, "sha512-P8F/dFhRevaw2uSdeIYlq/5SXZNY85DPtmXQ947gD1Zj2JqO5AkNvVVBar0Me9JkFx3uzVud/qOtP5ek9NEQGA=="],
 
@@ -1417,7 +1423,7 @@
 
     "smart-buffer": ["smart-buffer@4.2.0", "", {}, "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg=="],
 
-    "smol-toml": ["smol-toml@1.7.1", "", {}, "sha512-PPlsspAZ4jbMBu5DMFhfUGDQLu/vrL4SyBROVS37x8ynnVmFIs1VPBz1Co8Xks3TvpIaZXmU85y4DrQ+UyVFoQ=="],
+    "smol-toml": ["smol-toml@1.9.0", "", {}, "sha512-hpd+HLON7HdZXqYchMM/+LaTTbdK0AU3NngIJ4KVyWbY9bfQqdL9cD+4yf6dUoU2Ap4VsU0JkQi6FxAI1B2mXQ=="],
 
     "socks": ["socks@2.8.9", "", { "dependencies": { "ip-address": "^10.1.1", "smart-buffer": "^4.2.0" } }, "sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw=="],
 
@@ -1425,7 +1431,7 @@
 
     "source-map": ["source-map@0.7.6", "", {}, "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ=="],
 
-    "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
+    "source-map-js": ["source-map-js@1.2.2", "", {}, "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw=="],
 
     "space-separated-tokens": ["space-separated-tokens@2.0.2", "", {}, "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q=="],
 
@@ -1481,7 +1487,7 @@
 
     "uncrypto": ["uncrypto@0.1.3", "", {}, "sha512-Ql87qFHB3s/De2ClA9e0gsnS6zXG27SkTiSJwjCc9MebbfapQfuPzumMIUMi38ezPZVNFcHI9sUIepeQfw8J8Q=="],
 
-    "undici": ["undici@7.29.0", "", {}, "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw=="],
+    "undici": ["undici@7.29.1", "", {}, "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q=="],
 
     "undici-types": ["undici-types@7.18.2", "", {}, "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w=="],
 
diff --git a/apps/docs/bunfig.toml b/apps/docs/bunfig.toml
index 9d7101b5..a950fcc6 100644
--- a/apps/docs/bunfig.toml
+++ b/apps/docs/bunfig.toml
@@ -5,11 +5,9 @@ minimumReleaseAgeExcludes = [
   "@tailwindcss/oxide",
   "@tailwindcss/oxide*",
   "tmp",
-  # form-data 4.0.6 / undici 7.28.0 patch GHSA-hmw2-7cc7-3qxx and
-  # GHSA-vmh5-mc38-953g respectively; both patched releases are <7 days old,
-  # so exempt them from the quarantine window. Build-time tooling only.
+  # form-data 4.0.6 patches GHSA-hmw2-7cc7-3qxx; the patched release is <7 days
+  # old, so exempt it from the quarantine window. Build-time tooling only.
   "form-data",
-  "undici",
   # nanoid 3.3.18 patches GHSA-2v37-7h3g-55p8. Pulled in transitively by
   # postcss (build-time CSS tooling); the patched release is <7 days old, so
   # exempt it from the quarantine window.
diff --git a/apps/docs/osv-scanner.toml b/apps/docs/osv-scanner.toml
index e37b41f1..f1399d51 100644
--- a/apps/docs/osv-scanner.toml
+++ b/apps/docs/osv-scanner.toml
@@ -11,12 +11,22 @@
 # transitive versions have patched.
 
 [[IgnoredVulns]]
-id = "GHSA-vwc7-r8mq-g2x9"
-ignoreUntil = "2026-12-09T00:00:00Z"
+id = "GHSA-vfj7-8cjw-p6xm"
+ignoreUntil = "2026-11-18T00:00:00Z"
 reason = """
-adm-zip path traversal. 0.6.0 is the newest release and no patched version
-exists yet, so the existing override cannot clear it. Pulled in transitively
-by the wrangler/miniflare dev toolchain, which only unpacks archives it
-fetches from Cloudflare's own CDN — never user-supplied input — and never runs
-in the published static site. Re-evaluate when adm-zip ships a fix.
+braces 3.0.3 (no fixed release yet). Reached only through micromatch 4.0.5 in
+the Astro/Starlight build toolchain. Build-time pattern matching over repo
+files; never in the published static output and never reached by user input.
+Remove once braces is patched.
+"""
+
+[[IgnoredVulns]]
+id = "GHSA-ch52-4w7c-c8xp"
+ignoreUntil = "2026-11-18T00:00:00Z"
+reason = """
+http-cache-semantics 4.2.0 max-stale cache disclosure (no fixed release). Pulled
+in by astro's build-time dependency graph. The vulnerable path needs a shared
+HTTP cache serving several users; this build runs in CI with no shared cache,
+and the deployed site is static Cloudflare Pages output. Remove once astro
+moves to a patched http-cache-semantics.
 """
diff --git a/apps/docs/package.json b/apps/docs/package.json
index 2b35d105..3c42e3bb 100644
--- a/apps/docs/package.json
+++ b/apps/docs/package.json
@@ -61,38 +61,50 @@
     "wrangler": "4.129.0"
   },
   "//overrides": {
-    "_": "Why these transitive deps are pinned. Build-time/dev tooling only \u2014 the deployed site is static Cloudflare Pages. Re-evaluate quarterly (see osv-scanner.toml).",
-    "adm-zip": "Pin patched adm-zip (GHSA-xcpc-8h2w-3j85). 0.5.17 is vulnerable; 0.6.0 patches it. Build-time tooling only.",
-    "axios": "Pin patched axios (GHSA-gcfj-64vw-6mp9 and related). 1.16.1 is vulnerable; 1.18.0 patches it. Build-time tooling only.",
-    "dompurify": "Pin patched DOMPurify (GHSA-c2j3-45gr-mqc4). 3.4.12 is vulnerable (GHSA-55q2-fjhq-7xh7); 3.4.13 patches it. Pulled via mermaid diagram rendering; diagram source is author-controlled.",
+    "_": "Why these transitive deps are pinned. Build-time/dev tooling only — the deployed site is static Cloudflare Pages. Re-evaluate quarterly (see osv-scanner.toml).",
+    "adm-zip": "Pin patched adm-zip (GHSA-xcpc-8h2w-3j85, then GHSA-7q85-xj36-vmfc, GHSA-8238-w5pm-2374, GHSA-c6fg-446q-cg94, GHSA-j5f4-cc29-5x44, GHSA-p634-w6r4-rjp2, GHSA-rcw4-f5rp-g42v). 0.6.0 is vulnerable; 0.6.1 patches them. Build-time tooling only (wrangler/miniflare archive handling).",
+    "axios": "Pin patched axios (GHSA-gcfj-64vw-6mp9 and related, then GHSA-r4gj-5m52-g5wh, GHSA-vh66-26gq-q6x8, GHSA-x97p-jq2g-jp4f). 1.18.0 is vulnerable; 1.20.0 patches it. Build-time tooling only. Mirrors the API app pin.",
+    "dompurify": "Pin patched DOMPurify (GHSA-c2j3-45gr-mqc4, GHSA-55q2-fjhq-7xh7, then GHSA-6688-9rhm-gjv2, GHSA-p98j-92pf-mc4p). 3.4.13 is vulnerable; 3.4.16 patches them. Pulled via mermaid diagram rendering; diagram source is author-controlled.",
     "js-yaml": "Pin patched js-yaml (GHSA-52cp-r559-cp3m, GHSA-2883-xcg3-v3hh). 4.3.1 is vulnerable (maxTotalMergeKeys CPU exhaustion); 4.3.2 patches it. Build-time config loading only. Mirrors the UI app pin.",
     "postcss": "Pin patched postcss (GHSA-r28c-9q8g-f849). 8.5.18 is vulnerable (GHSA-fxqj-rqcc-2cmp); 8.5.23 patches it. Build-time CSS tooling via vite/tailwind.",
-    "sharp": "Collapse transitive sharp@0.34.5 (GHSA-f88m-g3jw-g9cj) onto the direct sharp@0.35.4 pin. 0.35.3 is vulnerable (GHSA-rgj7-g3m4-5g8c); 0.35.4 patches it. Image processing at build time only.",
+    "sharp": "Collapse transitive sharp@0.34.5 (GHSA-f88m-g3jw-g9cj) onto the direct sharp@0.35.5 pin. 0.35.3 and 0.35.4 are vulnerable (GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w); 0.35.5 patches them. Image processing at build time only.",
     "svgo": "Pin patched svgo (GHSA-2p49-hgcm-8545, GHSA-w27v-7q3p-w38r, GHSA-4vpr-x523-8j87). 4.0.2 is vulnerable; 4.1.0 patches it. SVG optimization at build time only.",
     "ws": "Pin patched ws (GHSA-58qx-3vcg-4xpx) pulled via miniflare/wrangler dev tooling.",
-    "devalue": "Pin patched devalue build-time serialization XSS (GHSA-77vg-94rm-hx3p).",
+    "devalue": "Pin patched devalue (GHSA-77vg-94rm-hx3p, then GHSA-4q55-j62x-fr9h, GHSA-9rgm-9g3h-6x36, GHSA-hx4r-w6wj-j8fg, GHSA-j22f-vq7h-c4qm, GHSA-mcm9-63f2-9j32, GHSA-r9w8-h9r3-54w4, GHSA-wf3x-273g-mvxv, GHSA-x5rw-q4pp-hg5g). 5.8.1 is vulnerable; 5.9.3 patches them. Pulled in by Astro. Build-time serialization only.",
     "qs": "Pin patched qs (GHSA-q8mj-m7cp-5q26, GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx). 6.15.2 is vulnerable; 6.16.0 patches it. Pulled via the http-server dev preview tool. Mirrors the UI app pin.",
     "tmp": "Pin patched tmp (GHSA-7c78-jf6q-g5cm type-confusion path traversal); 0.2.6 is now vulnerable, 0.2.7 patches it. Transitive dev-tooling dep. Mirrors the UI app pin.",
     "form-data": "Pin patched form-data (GHSA-hmw2-7cc7-3qxx CRLF injection); 4.0.5 is vulnerable, 4.0.6 patches it. Build-time tooling only (wrangler/astro fetches). Mirrors the API app pin. Excluded from the install quarantine while <7 days old.",
-    "undici": "Pin patched undici (GHSA-vmh5-mc38-953g TLS cert-validation bypass, GHSA-pr7r-676h-xcf6); 7.29.0 patches it (adds the GHSA-4cwx-7wf7-3272 batch). Build-time tooling only (wrangler/astro fetches). Mirrors the UI app pin. Excluded from the install quarantine while <7 days old.",
+    "undici": "Pin patched undici (GHSA-vmh5-mc38-953g TLS cert-validation bypass, GHSA-pr7r-676h-xcf6, the 7.29.0 batch, and GHSA-3wwx-pv8p-q78v fixed in 7.29.1). Build-time tooling only (wrangler/astro fetches). Mirrors the UI app pin. 7.29.0 is vulnerable.",
     "@types/react": "Match the UI app's @types/react pin so React types resolve identically across apps (@astrojs/react pulls them transitively here).",
-    "@types/react-dom": "Match the UI app's @types/react-dom pin for the same cross-app type parity."
+    "@types/react-dom": "Match the UI app's @types/react-dom pin for the same cross-app type parity.",
+    "basic-ftp": "Pin patched basic-ftp (GHSA-c475-qrg2-pj4r, CPU exhaustion parsing a directory listing). 5.3.1 is vulnerable; 6.2.1 patches it. Build-time tooling only. Mirrors the UI app pin.",
+    "ip-address": "Pin patched ip-address (GHSA-2vr4-cq9g-pvrc, GHSA-rpw4-54j3-4h4q, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv). 10.4.0 is vulnerable; 10.7.2 patches them. Transitive via socks in wrangler tooling. Mirrors the UI app pin.",
+    "katex": "Pin patched KaTeX (GHSA-238p-pmpm-9mq7, read-side prototype pollution gadget). 0.16.47 is vulnerable; 0.18.2 patches it. Mermaid pins ^0.16.47, so this is a deliberate forced major-line bump; verified by the docs build. Build-time and diagram rendering only.",
+    "postcss-nested": "Pin postcss-nested 7.x so the tree resolves postcss-selector-parser 7.x (GHSA-rj75-hqrm-r3gf, quadratic flat-selector parsing in 6.1.4). @expressive-code/core pins postcss-nested ^6.0.1; 7.0.2 is the upstream pairing with postcss-selector-parser ^7. Build-time CSS for code blocks only.",
+    "smol-toml": "Pin patched smol-toml (GHSA-r4xh-jqrq-34v2). 1.7.1 is vulnerable; 1.9.0 patches it. Transitive via astro (build-time config parsing). Mirrored in every app by the override-parity rule.",
+    "source-map-js": "Pin patched source-map-js (GHSA-68fv-2mgg-jv7q). 1.2.1 is vulnerable; 1.2.2 patches it. Transitive via postcss / build tooling. Mirrored in every app by the override-parity rule."
   },
   "overrides": {
-    "adm-zip": "0.6.0",
-    "axios": "1.18.0",
-    "devalue": "5.8.1",
-    "dompurify": "3.4.13",
+    "adm-zip": "0.6.1",
+    "axios": "1.20.0",
+    "devalue": "5.9.3",
+    "dompurify": "3.4.16",
     "form-data": "4.0.6",
     "js-yaml": "4.3.2",
     "postcss": "8.5.23",
     "qs": "6.16.0",
-    "sharp": "0.35.4",
+    "sharp": "0.35.5",
     "svgo": "4.1.0",
     "tmp": "0.2.7",
-    "undici": "7.29.0",
+    "undici": "7.29.1",
     "ws": "8.21.3",
     "@types/react": "19.2.18",
-    "@types/react-dom": "19.2.5"
+    "@types/react-dom": "19.2.5",
+    "basic-ftp": "6.2.1",
+    "ip-address": "10.7.2",
+    "katex": "0.18.2",
+    "postcss-nested": "7.0.2",
+    "smol-toml": "1.9.0",
+    "source-map-js": "1.2.2"
   }
 }
diff --git a/apps/docs/public/account-resource.json b/apps/docs/public/account-resource.json
index ff023ea0..96c8c98d 100644
--- a/apps/docs/public/account-resource.json
+++ b/apps/docs/public/account-resource.json
@@ -64,7 +64,7 @@
     "Use the existing UI component/feature conventions. Scope every query key by accountId; capture accountId in mutations and invalidate that exact account's queries.",
     "Render loading, empty, error and permission-denied states. Translate visible labels into both locales. Do not put service authorization exclusively in the UI.",
     "Verify owner/admin mutations, member/viewer read access, revoked membership, cross-account reads and writes, forged ownership, and account-switch cache isolation.",
-    "Run feature verification. If intentional test additions change the inventory, preview agent:inventory for the affected lanes, review its case diff, apply --accept=<token> (plus --allow-removals=<token> for intentional removals), and rerun verification. Run release-local before claiming full local readiness. Report blockers and GitHub-only checks separately."
+    "Run feature verification. It records intentional test additions in tools/agent/inventories automatically; include that inventory diff in the change. If it reports removed cases, run the single agent:inventory --accept=<token> --allow-removals=<token> command it prints after reviewing the listed removals, then rerun verification. Run release-local before claiming full local readiness. Report blockers and GitHub-only checks separately."
   ],
   "verificationProfile": "feature",
   "limitations": [
diff --git a/apps/docs/public/agents.md b/apps/docs/public/agents.md
index f608e26b..5d1d832e 100644
--- a/apps/docs/public/agents.md
+++ b/apps/docs/public/agents.md
@@ -70,10 +70,26 @@ curl -fsSL https://bun.sh/install | bash -s "bun-v1.4.2"
 ```
 
 
-Ports: `7331` UI, `7330` API, `5432` Postgres, `6379` Valkey. Optional overlays, all on by
-default in dev: `7332` bull-board, `8025` Mailpit, `8055` GlitchTip, `3010` Grafana,
+Ports: `7331` UI, `7330` API, `7333` public site, `5432` Postgres, `6379` Valkey. Optional overlays,
+all on by default in dev: `7332` bull-board, `8025` Mailpit, `8055` GlitchTip, `3010` Grafana,
 `9090` Prometheus, `9093` Alertmanager. Turn any of them off with `WITH_*=0`.
 
+## Layout
+
+| Path              | Role                                                                             |
+| ----------------- | -------------------------------------------------------------------------------- |
+| `apps/api`        | Bun + Elysia API, Drizzle schema and migrations                                  |
+| `apps/ui`         | Vite + React SPA, served on `app.<domain>` in prod                               |
+| `apps/site`       | Astro static marketing site and Markdown blog, served on the apex domain in prod |
+| `apps/docs`       | Astro Starlight docs (this site)                                                 |
+| `packages/*`      | Code shared by more than one app; discovered by `bun run check`, when present    |
+| `infra/compose`   | Docker Compose runtime, the default deploy path                                  |
+| `infra/k3s`       | Optional Kustomize + ArgoCD target for a Kubernetes cluster                      |
+| `infra/bootstrap` | Optional OpenTofu for a Hetzner VPS                                              |
+
+In prod the marketing site and the app are separate origins: `<domain>` serves `apps/site`, and
+`app.<domain>` serves `apps/ui` and `/api`. They share no cookies. The site makes no API calls.
+
 ## Verify it worked
 
 ```sh
@@ -118,6 +134,7 @@ The toggles you are most likely to be asked for, all in `infra/compose/compose/.
 | `WITH_GLITCHTIP`             | self-hosted error tracking                         |
 | `WITH_MAILPIT`               | catches outbound mail in dev                       |
 | `WITH_BULLMQ`                | bull-board queue UI                                |
+| `WITH_SITE`                  | public marketing site: on in dev (`:7333`), off in prod |
 | `BILLING_ENABLED`            | Stripe checkout + webhooks                         |
 | `EMAIL_PROVIDER`             | `resend` \| `sendgrid` \| `smtp`                   |
 | `OAUTH_PROVIDERS`            | e.g. `google,github`                               |
@@ -146,6 +163,8 @@ CI runs the same gates and a pre-push hook mirrors them.
 | Env access goes through the validator             | No direct `process.env` / `import.meta.env`. One typed entry point, and the schema must match `.env.example`.                                                           |
 | UI talks to the API only via the generated client | No raw `fetch` outside `src/lib/api`. Regenerate with `bun run regen` after an API change.                                                                              |
 | Dependencies are exact-pinned                     | No ranges. New packages face a 7-day `minimumReleaseAge` quarantine, so a fresh malicious release cannot land.                                                          |
+| Commits and PR titles are Conventional Commits    | `type(scope): summary`, checked by the `commit-msg` hook and the `pr-title` workflow. Main is squash-merged, so the PR title is what lands.                              |
+| Bundle budgets go up only with a recorded reason  | `bun run check:size-budget` fails when a UI limit is raised or an entry is added, unless `apps/ui/budgets.md` has a reason for it in the same change. Lowering needs none. |
 
 After changing anything cross-cutting: `bun run regen` then `bun run check`.
 
@@ -162,6 +181,7 @@ Verbs, not nouns. Find what you are about to do:
 | Looking for an env var                   | <https://boringstack.xyz/reference/env-vars/>                            |
 | Adding a job, upload, service, or Stripe | <https://boringstack.xyz/recipes/add-background-job/> and siblings       |
 | Deploying                                | <https://boringstack.xyz/topics/deployment/>                             |
+| Changing the public marketing site       | <https://boringstack.xyz/site/overview/>                                 |
 | Giving the agent runtime visibility      | <https://boringstack.xyz/reference/mcp-servers/>                         |
 | Working inside the repo                  | `AGENTS.md` at the root, then `apps/api/AGENTS.md` / `apps/ui/AGENTS.md` |
 
diff --git a/apps/docs/public/scaffold-manifest.json b/apps/docs/public/scaffold-manifest.json
index 34f6e933..9489e860 100644
--- a/apps/docs/public/scaffold-manifest.json
+++ b/apps/docs/public/scaffold-manifest.json
@@ -68,6 +68,15 @@
       "devDefault": "1",
       "addsServices": { "1": ["bullmq-dashboard"] }
     },
+    {
+      "key": "WITH_SITE",
+      "kind": "toggle",
+      "group": "infra",
+      "label": "Public marketing site (apps/site). Dev: Astro dev server on 7333. Prod: static site on the apex host, app on app.<domain>",
+      "devDefault": "1",
+      "prodDefault": "0",
+      "addsServices": { "1": ["site-dev", "site"] }
+    },
     {
       "key": "WUD",
       "kind": "toggle",
diff --git a/apps/docs/src/content/docs/architecture/agent-docs.mdx b/apps/docs/src/content/docs/architecture/agent-docs.mdx
index 60c80696..afb279b4 100644
--- a/apps/docs/src/content/docs/architecture/agent-docs.mdx
+++ b/apps/docs/src/content/docs/architecture/agent-docs.mdx
@@ -70,6 +70,26 @@ The docs explain the _why_; the plugins block the _what_.
 
 So `AGENTS.md` answers "which page is the why?" and nothing else.
 
+## Conventions that are gates, not prose
+
+`AGENTS.md` is harness-neutral. Codex, Claude Code and other agents all start there, and
+`CLAUDE.md` only points at it. A convention that a product depends on belongs in a hook,
+a lint rule or CI. Prose that only one harness reads stops being followed when the harness
+changes.
+
+Two conventions in the root `AGENTS.md` are gates:
+
+- **Conventional Commits.** Every commit subject and PR title is
+  `<type>(<scope>)!?: <summary>`, at most 100 characters, for example
+  `fix(api): keep the session after refresh`. The `commit-msg` hook (installed by
+  `bun install`) and the `pr-title` workflow both run `scripts/ci/check-commit-title.sh`.
+  Main is squash-merged, so the PR title is the commit that lands. Git's own `fixup!`,
+  `squash!`, `amend!`, merge and revert subjects pass.
+- **Generated content stays out of hand-written changes.** Large generated artifacts
+  (content libraries, catalogue imports, rendered diagrams) do not share a commit or PR
+  with hand-written code. Commit the generator and its source data, then regenerate in a
+  separate `chore(content): ...` change, or build the artifacts in CI.
+
 ## Where to look in this repo
 
 - `apps/api/AGENTS.md`: 30 lines, one table, points at 16 guides
diff --git a/apps/docs/src/content/docs/architecture/lint-as-contract.mdx b/apps/docs/src/content/docs/architecture/lint-as-contract.mdx
index 7fc81e51..3aa264de 100644
--- a/apps/docs/src/content/docs/architecture/lint-as-contract.mdx
+++ b/apps/docs/src/content/docs/architecture/lint-as-contract.mdx
@@ -110,6 +110,20 @@ The same merge gate runs in three places so a broken change cannot reach `main`.
 
 [Knip](https://knip.dev) sits alongside the lint plugins, surfacing unused files, unused exports, and unused dependencies. It runs as part of `validate` so dead code can't drift in unnoticed.
 
+## Bundle budgets need a recorded reason
+
+The UI's bundle budgets (`.size-limit.json`, plus the modulepreload coverage check) run in
+`bun run validate`. The budget limits do not go up silently. `bun run check:size-budget`
+runs in `validate`, in CI and in the pre-push hook. It fails when a limit is raised or a new
+entry is added, unless `apps/ui/budgets.md` has a reason for that entry, and the reason is
+new or changed in the same change. The check compares against the base branch, so an old
+reason cannot cover a later raise.
+
+Each reason is one line: the entry name in backticks, a colon, then a sentence of at least
+ten characters. Lowering a limit, or leaving it alone, needs no line. Budgets are reviewed
+per feature, so a raise states what grew and why that growth is acceptable. The line stays in
+the file as the record of that decision.
+
 ## Why this matters for agent-driven development
 
 Lint turns architecture into a closed loop: code is written, violations surface as parseable errors, the fix is specific (wrong layer, missing schema, env read outside the validator). Review time stays on product logic instead of rediscovering folder rules.
diff --git a/apps/docs/src/content/docs/architecture/monorepo-layout.mdx b/apps/docs/src/content/docs/architecture/monorepo-layout.mdx
index e3029335..0dc636ab 100644
--- a/apps/docs/src/content/docs/architecture/monorepo-layout.mdx
+++ b/apps/docs/src/content/docs/architecture/monorepo-layout.mdx
@@ -14,7 +14,10 @@ boringstack/
   apps/api/               Bun + Elysia HTTP API; Drizzle schema + migrations
   apps/ui/               Vite + React SPA; OpenAPI client generated from /swagger/json
   apps/docs/             Astro Starlight site (boringstack.xyz)
+  apps/site/             Astro static marketing site on the apex domain (see Public site)
+  packages/              Shared code used by more than one app (optional; see below)
   infra/compose/         Docker Compose runtime; services, env vars, profiles, overlays
+  infra/k3s/             Optional Kustomize + ArgoCD target for a Kubernetes cluster
   infra/bootstrap/       Optional OpenTofu for VPS provisioning on Hetzner + Cloudflare
 ```
 
@@ -24,7 +27,7 @@ Each app keeps its own `package.json`, lockfile, and lint config. CI workflows (
 
 **Smaller context:** Open `apps/ui` for UI work without loading the entire API schema graph.
 
-**Independent releases:** API and UI each publish their own GHCR image. Compose pins versions via env vars.
+**Independent releases:** Compose publishes `latest` and `sha-*` images per app for WUD, and pins versions via env vars. The Kubernetes target ships the API, migrations, UI and site as one digest-pinned set. See [Production releases](/runbooks/production-release/).
 
 **Explicit join points:** OpenAPI schema, ACL types, lint-meta RULES, and docs catalogs are regenerated from the repo root with `bun run regen`, so drift is caught by CI.
 
@@ -65,10 +68,43 @@ scripts and runbooks.
 boringstack.xyz Starlight site. Generated lint-meta and scripts
 tooling catalogs.
 
+### apps/site
+
+The public marketing site at the apex domain: static pages and a Markdown blog,
+built by Astro and served by nginx. It has no server code and makes no API calls.
+See [Public site](/site/overview/).
+
 ### infra/bootstrap (optional)
 
 Hetzner provisioning, Cloudflare DNS, cloud-init.
 
+## Shared packages
+
+Code used by two or more apps goes in `packages/<name>/`. Code used by one app stays in
+that app. A package holds no secrets and no app-specific routes or pages. The full
+convention is in [`apps/ui/docs/agents/shared-packages.md`](https://github.com/boringstack-xyz/boringstack/blob/main/apps/ui/docs/agents/shared-packages.md).
+
+Each package has `package.json` with `"private": true`, `src/index.ts` as its public
+entry, a `tsconfig.json` that extends the UI config, and an `eslint.config.mjs` that
+imports the UI rule set. Its `lint`, `format:check` and `typecheck` scripts run the
+binaries in `apps/ui/node_modules`, so run `bun install` in `apps/ui` first. Its
+`validate` script runs all three, and `lint` uses `--max-warnings=0`.
+
+Packages are discovered, not listed:
+
+- `bun run check` runs `validate` in every `packages/*/` that has a `package.json`.
+  A package without a `validate` script fails the check. A repo with no `packages/`
+  directory gets no package checks and no error.
+- `scripts/ci/pre-push.sh` runs the same gate when anything under `packages/` changed,
+  even if no app changed.
+- `.github/workflows/apps-ui-validate.yml` runs it on `packages/**` changes.
+- Dependabot has a `bun` entry for `/packages/*`. It matches nothing until the directory
+  exists.
+
+Wiring a package into `apps/ui` (tsconfig `paths`, `server.fs.allow`, `resolve.dedupe`) is
+a separate step, described in the same guide. Note that `lint:meta` does not scan
+`packages/`, so the package's own ESLint config is its only architecture gate.
+
 ## Cross-app contracts
 
 From the **repo root**:
diff --git a/apps/docs/src/content/docs/architecture/stack.mdx b/apps/docs/src/content/docs/architecture/stack.mdx
index d743665b..4f493a72 100644
--- a/apps/docs/src/content/docs/architecture/stack.mdx
+++ b/apps/docs/src/content/docs/architecture/stack.mdx
@@ -13,6 +13,8 @@ Runtime and dev dependencies, what each does, and why each piece exists. BoringS
 - **[apps/ui](/ui/overview/).** Vite React SPA: React 19, TanStack Query, Zustand, shadcn/ui, Playwright, and a generated client instead of hand-written API calls.
 - **[infra-compose](/infra/overview/).** Single-host Compose runtime: Postgres, Valkey, Traefik, and optional observability/error-tracking overlays for local and VPS environments.
 - **[infra-tofu](/topics/provisioning-with-tofu/).** First real deploy path: OpenTofu, Hetzner, Cloudflare, and cloud-init provision a VPS and drop the Compose stack in place.
+- **[apps/site](/site/overview/).** Static Astro marketing site on the apex domain: Markdown blog, no cookies, no API calls, served by nginx.
+- **[infra-k3s](/infra/kubernetes/).** Optional GitOps target for a Kubernetes cluster: Kustomize, ArgoCD, CloudNativePG, and one digest-pinned release of all four images.
 
 ## Full inventory
 
@@ -74,6 +76,13 @@ Runtime and dev dependencies, what each does, and why each piece exists. BoringS
 - **First boot.** cloud-init + `bootstrap.sh`; clone infra, `compose pull && up -d`.
 - **Backups (optional).** rclone via cron at apply time.
 
+### apps/site
+
+- **Static site: Astro.** Pages and Markdown blog built at image build time, with config validated by the build.
+- **Serving: nginx 1.31.** Non-root, read-only root filesystem, CSP and security headers from the same config.
+- **Social cards: Satori + Sharp.** 1200x630 PNGs rendered at build time.
+- **Analytics (optional).** Off by default; the script loads only after a consent banner accept.
+
 ## Architecture-enforcement plugins
 
 Each app workspace ships custom ESLint plugins (all open-sourced) that codify the patterns and stop drift at the lint gate.
diff --git a/apps/docs/src/content/docs/changelog.mdx b/apps/docs/src/content/docs/changelog.mdx
index 84da1549..4a49ce98 100644
--- a/apps/docs/src/content/docs/changelog.mdx
+++ b/apps/docs/src/content/docs/changelog.mdx
@@ -3,7 +3,37 @@ title: What's new
 description: "Recent changes to BoringStack: docs, templates, and tooling. Reverse-chronological; the top entry is the most recent."
 ---
 
-A log of substantial changes to the docs, templates, and tooling. For per-commit detail, see the git history of each [workspace app](https://github.com/boringstack-xyz). For the latest released images, see the [Image updates runbook](/runbooks/image-updates/).
+A log of substantial changes to the docs, templates, and tooling. For per-commit detail, see the git history of each [workspace app](https://github.com/boringstack-xyz). For released images, see the [Image updates runbook](/runbooks/image-updates/) (Compose) and [Production releases](/runbooks/production-release/) (k3s).
+
+## 2026-10
+
+### Lessons from the first product (Tinkercaster)
+
+A first product built on the template reported where the template slowed it down or let
+problems through. The fixes are tracked in the repository's product feedback ledger.
+
+- **Coordinated production release (k3s).** One workflow builds the API, migrations, UI and
+  public site for a commit and pins all four digests in one GitOps commit. The Argo
+  Application no longer uses `argocd-image-updater`. The migration Job runs `db:migrate` only,
+  as a Sync hook, and the API and migration roots are read-only. See
+  [Production releases](/runbooks/production-release/).
+- **Public marketing site.** New `apps/site`, an Astro static site on the apex domain with a
+  Markdown blog, consent-gated analytics and an nginx image. The app moves to `app.<domain>`.
+  Local dev is on `:7333` with `WITH_SITE=1`. See [Public site](/site/overview/).
+- **Business metrics.** CloudNativePG runs aggregate queries over sign-ups, active users,
+  plans, cancellations and Stripe events, with a Grafana dashboard. Only aggregates leave the
+  database. See [Observability](/topics/observability/#business-metrics-k3s).
+- **Conventional Commits gate.** Commit subjects and PR titles are checked by the `commit-msg`
+  hook and the `pr-title` workflow. See [Agent docs](/architecture/agent-docs/#conventions-that-are-gates-not-prose).
+- **Shared packages.** `packages/*` workspaces are discovered by `bun run check`, the pre-push
+  hook and Dependabot. See [Repository layout](/architecture/monorepo-layout/#shared-packages).
+- **Bundle budget reasons.** A raised UI budget or a new budget entry needs a recorded reason
+  in `apps/ui/budgets.md`. See [Lint as the contract](/architecture/lint-as-contract/#bundle-budgets-need-a-recorded-reason).
+- **Self-hosted CI runners.** `CI_RUNNER` moves jobs to self-hosted runners. Fork pull requests
+  always stay on GitHub-hosted runners, and a lint-meta rule enforces that guard. See
+  [Security pipeline](/topics/security/#self-hosted-runners).
+- **Structured verification.** Feature runs record new test-inventory cases automatically.
+  Removed cases still need an explicit acknowledgement. See [Verified workflow](/skills/verified-workflow/).
 
 ## 2026-09
 
diff --git a/apps/docs/src/content/docs/infra/kubernetes.mdx b/apps/docs/src/content/docs/infra/kubernetes.mdx
index 3fa4fbaa..1bf42294 100644
--- a/apps/docs/src/content/docs/infra/kubernetes.mdx
+++ b/apps/docs/src/content/docs/infra/kubernetes.mdx
@@ -8,8 +8,9 @@ description: Optional GitOps deployment target for any ArgoCD-managed k3s/Kubern
 paths. Pick the one that fits your operating model; you don't need all three.
 
 It ships BoringStack to any ArgoCD-managed k3s/Kubernetes cluster as GitOps: push
-code, CI builds and pushes a GHCR image, argocd-image-updater bumps the tag, and
-ArgoCD syncs. The whole app runs in one namespace with HA, autoscaling, and TLS.
+code, one release workflow builds the API, migration and UI images and pins their
+digests together, and ArgoCD syncs that set. The whole app runs in one namespace
+with HA, autoscaling, and TLS.
 
 BoringStack is Compose-first on purpose, so this target lives in its own
 `infra/k3s/` subtree and is entirely opt-in. It never sits in the default deploy
@@ -21,33 +22,38 @@ path.
 |---|---|---|
 | api | `base/api/` | Bun/Elysia, port 7330, `/health` (liveness) and `/ready` (readiness) |
 | ui | `base/ui/` | nginx static SPA, port 8080 |
+| site | `base/site/` | Public marketing site (`apps/site`), nginx static, port 8080, on the apex domain |
 | Postgres | `base/postgres/` | CloudNativePG `Cluster`, 1 instance (3 in prod) |
 | Valkey | `base/valkey/` | in-namespace cache and BullMQ backend |
 | GlitchTip | `overlays/prod/glitchtip/` | per-project error tracking (web and worker) |
-| migrations | `base/api/migration-job.yaml` | ArgoCD PreSync Job: `db:migrate && db:seed` |
+| migrations | `base/api/migration-job.yaml` | ArgoCD Sync hook at wave -1: `db:migrate` only. Seeds are a deliberate one-off. |
 
-Routing mirrors Compose prod: one domain with same-origin path routing.
-`Host && (/api or /health)` goes to the api; everything else goes to the ui
-(the SPA).
+Routing splits the public site from the app:
+
+- `Host(<domain>)` goes to the site, the static marketing site.
+- `Host(app.<domain>) && (/api or /health)` goes to the api, and everything else on
+  `app.<domain>` goes to the ui (the SPA). The app keeps same-origin `/api`.
+
+The two origins share no cookies. See [Public site](/site/deployment/).
 
 ## Layout
 
 ```
 infra/k3s/
-├── argocd/        ArgoCD Application (+ image-updater) and registration example
+├── argocd/        ArgoCD Application and registration example
 ├── base/          env-agnostic manifests: namespace, api, ui, valkey, postgres
 └── overlays/prod/ HA + TLS + secrets + GlitchTip + monitoring + patches
     └── secrets/   swappable backend: vault (default) | sealed | plain
 ```
 
 `base/` is generic. The prod overlay adds replicas and anti-affinity (api ×3,
-ui ×2, Postgres ×3), HPAs, PDBs, a ResourceQuota/LimitRange, Traefik middleware,
+ui ×2, site ×2, Postgres ×3), HPAs, PDBs, a ResourceQuota/LimitRange, Traefik middleware,
 the TLS `Certificate`, GlitchTip, and the monitoring integration.
 
 ## Prerequisites
 
-The cluster must provide ArgoCD + argocd-image-updater, the CloudNativePG
-operator, cert-manager with a DNS-01 `ClusterIssuer`, Traefik (k3s default), and
+The cluster must provide ArgoCD, the CloudNativePG operator, cert-manager with a
+DNS-01 `ClusterIssuer` whose credential covers your zone, Traefik (k3s default), and
 a persistent StorageClass. Optionally kube-prometheus-stack (for the
 ServiceMonitor and Grafana dashboards) and your chosen secrets backend.
 
@@ -72,6 +78,10 @@ The target does not deploy Prometheus/Grafana/Loki. It plugs into the cluster's
 kube-prometheus-stack via a `ServiceMonitor` that scrapes the api, plus optional
 Grafana dashboard ConfigMaps. See `overlays/prod/monitoring/README.md`.
 
+The prod overlay also adds business metrics: CloudNativePG runs aggregate queries over
+the sign-up, billing and audit tables, and a Grafana dashboard ConfigMap shows them. See
+[Observability](/topics/observability/#business-metrics-k3s).
+
 ## Get started
 
 Full knob list and walkthrough: [Provisioning with k3s](/topics/provisioning-with-k3s/)
@@ -80,7 +90,7 @@ and `infra/k3s/README.md`.
 ## Related
 
 - [Provisioning with k3s](/topics/provisioning-with-k3s/); zero to live on a cluster.
-- [ArgoCD image updater](/runbooks/argocd-image-updater/); the auto-deploy loop.
+- [Production releases](/runbooks/production-release/); the coordinated auto-deploy loop.
 - [Secrets backends (VSO / Sealed / plain)](/runbooks/vault-secrets-operator/).
 - [Postgres backups (CNPG)](/runbooks/cnpg-backups/).
 - [Infra overview](/infra/overview/); the Compose-first single-host target.
diff --git a/apps/docs/src/content/docs/infra/overview.mdx b/apps/docs/src/content/docs/infra/overview.mdx
index ccf53fd5..d446c1e6 100644
--- a/apps/docs/src/content/docs/infra/overview.mdx
+++ b/apps/docs/src/content/docs/infra/overview.mdx
@@ -14,6 +14,7 @@ The base stack (always on):
 - **api-migrate** - One-shot schema push plus optional superuser seed
 - **api-dev / api** - Bun + Elysia in dev, GHCR image in production
 - **ui-dev / ui** - Vite dev server locally, nginx static image in production
+- **site-dev / site** - public marketing site (`apps/site`). Astro dev server locally, nginx static image in prod. Controlled by `WITH_SITE`; see [Public site](/site/overview/)
 
 Optional overlays:
 - **observability** - Prometheus, Grafana, Loki, Promtail, and exporters
@@ -32,6 +33,7 @@ WITH_GLITCHTIP=0 ./dev.sh up -d        # skip glitchtip
 WITH_BULLMQ=1 ./dev.sh up -d           # add bull board (opt-in)
 WITH_WUD=1 ./dev.sh up -d              # add WUD image-update detector (opt-in)
 WITH_MAILPIT=1 ./dev.sh up -d          # add Mailpit local SMTP (opt-in)
+WITH_SITE=0 ./dev.sh up -d             # skip the public marketing site (on in dev, off in prod)
 ```
 
 The default stack includes Prometheus, Grafana, Loki, and GlitchTip. Niche tooling (Bull Board, WUD, Mailpit) is opt-in. See [Profiles & overlays](/infra/profiles-and-overlays/).
@@ -50,6 +52,7 @@ Under `infra/compose/`:
 - `docker-compose.bullmq.yml` - Bull Board in development
 - `docker-compose.wud.yml` - WUD image-update detector
 - `docker-compose.mailpit.yml` - Local SMTP catcher in development
+- `docker-compose.site.yml` - Public marketing site: `site-dev` in dev, `site` behind Traefik in prod
 - `dev.sh` - Orchestrator
 - `.env.example` - All knobs in one file
 - `prometheus/` - Scrape config
@@ -74,9 +77,9 @@ Two bridge networks. Services are split on purpose:
 
 **backend (data plane).** postgres, valkey, api[-dev], api-migrate, exporters, glitchtip, and mailpit.
 
-**frontend (ingress).** traefik in prod, ui[-dev], and glitchtip-web. Traefik joins both when it needs to route.
+**frontend (ingress).** traefik in prod, ui[-dev], site[-dev], and glitchtip-web. Traefik joins both when it needs to route.
 
-In prod, Traefik joins both networks so it can route HTTPS from `frontend` to services on `backend`. The data plane (Postgres, Valkey) is never exposed to `frontend`.
+In prod, Traefik joins both networks so it can route HTTPS from `frontend` to services on `backend`. The data plane (Postgres, Valkey) is never exposed to `frontend`. The site joins `frontend` only, because it calls no backend service.
 
 ## Resource budgets
 
diff --git a/apps/docs/src/content/docs/infra/profiles-and-overlays.mdx b/apps/docs/src/content/docs/infra/profiles-and-overlays.mdx
index e8e37879..bdc60410 100644
--- a/apps/docs/src/content/docs/infra/profiles-and-overlays.mdx
+++ b/apps/docs/src/content/docs/infra/profiles-and-overlays.mdx
@@ -50,6 +50,7 @@ These run unless you explicitly turn them off. They're the surface a `push to ma
 | `WITH_WUD` | What's Up Docker image-update daemon | ON in prod, OFF in dev | `WITH_WUD=0 STACK=prod ./scripts/compose-up.sh` |
 | `WITH_BULLMQ` | Bull-board queue UI | ON in dev only | `WITH_BULLMQ=0 ./dev.sh up -d` |
 | `WITH_MAILPIT` | Local SMTP catcher (`:8025` web UI) | ON in dev only | `WITH_MAILPIT=0 ./dev.sh up -d` |
+| `WITH_SITE` | Public marketing site (`apps/site`): `site-dev` on `:7333` in dev, `site` on the apex host in prod | ON in dev, OFF in prod | `WITH_SITE=0 ./dev.sh up -d` |
 
 WUD is what makes `git push origin main` deploy. It polls GHCR, pulls new app image tags, and recreates the container. See [Image updates](/runbooks/image-updates/) for the hybrid policy (app images auto-deploy, base images notify-only).
 
@@ -69,7 +70,7 @@ Never run WITH_BULLMQ=1 in a public production environment. The BullMQ dashboard
 
 - **API + UI.** Dev: bind-mounted source, hot reload. Prod: pre-built images pulled from GHCR.
 - **Traefik.** Dev: not started; Vite dev-server proxies `/api/*` directly. Prod: terminates TLS, path-routes `/api/*` and `/health` to the api container, everything else to ui.
-- **Host(s).** Dev: `http://localhost:7331`. Prod: `https://${PUBLIC_UI_HOST}` (one domain, same-origin).
+- **Host(s).** Dev: `http://localhost:7331`. Prod: `https://${PUBLIC_UI_HOST}` (one domain, same-origin). With `WITH_SITE=1` in prod, the marketing site takes the apex `PUBLIC_SITE_HOST` and the app moves to `PUBLIC_UI_HOST`, so the two origins stay separate. See [Public site](/site/deployment/).
 - **TLS.** Dev: none. Prod: Let's Encrypt ACME via Traefik.
 - **Data ports.** Dev: Postgres on `:5432`, Valkey on `:6379` published to host. Prod: internal-only, not published.
 
diff --git a/apps/docs/src/content/docs/quickstart.mdx b/apps/docs/src/content/docs/quickstart.mdx
index 2ee3e97a..d44978ff 100644
--- a/apps/docs/src/content/docs/quickstart.mdx
+++ b/apps/docs/src/content/docs/quickstart.mdx
@@ -12,7 +12,7 @@ every runtime, so you need no local Postgres and no local Node. You do
 need Bun to *develop* once it is up, because every root script
 (`bun run check`, `bun run regen`, `bun run rename:project`) runs on it.
 
-After boot you have a register/login UI at `http://localhost:7331`,
+After boot you have a register/login UI at `http://localhost:7331`, the marketing site at `http://localhost:7333`,
 the API at `http://localhost:7330/api/*` (OpenAPI spec served at
 `/swagger`), Postgres with migrations applied, Valkey for cache and
 BullMQ, and a generated TypeScript client wired into `apps/ui` that
@@ -195,6 +195,7 @@ the default. See [Spec loop](/skills/spec-loop/) for the deep dive.
 - **api-migrate (one-shot)**: runs `db:push` and the optional superuser seed, then exits.
 - **api-dev (port 7330)**: Bun + Elysia API with hot reload via bind mount.
 - **ui-dev (port 7331)**: Vite dev server; proxies `/api/*` to `api-dev`.
+- **site-dev (port 7333)**: Astro dev server for the public marketing site in `apps/site`. On by default in dev; set `WITH_SITE=0` to skip it. See [Public site](/site/overview/).
 
 Traefik runs only in the prod profile. In prod it terminates TLS and
 path-routes `/api/*` plus `/health` to the api container, everything
diff --git a/apps/docs/src/content/docs/recipes/add-account-resource.mdx b/apps/docs/src/content/docs/recipes/add-account-resource.mdx
index 0a7e69f6..46f32d3d 100644
--- a/apps/docs/src/content/docs/recipes/add-account-resource.mdx
+++ b/apps/docs/src/content/docs/recipes/add-account-resource.mdx
@@ -43,7 +43,7 @@ The shared account-switch mutation cancels outstanding queries, resets account d
 
 ## Verify
 
-Run the `feature` profile, review any intentional test-inventory additions, then rerun it. Run `release-local` for the broader local gate. Cover owner/admin writes, member/viewer reads, revoked membership, cross-account reads and writes, forged ownership and account-switch cache isolation.
+Run the `feature` profile. Commit any test-inventory additions it records with the change, acknowledge any reported removals, then rerun it. Run `release-local` for the broader local gate. Cover owner/admin writes, member/viewer reads, revoked membership, cross-account reads and writes, forged ownership and account-switch cache isolation.
 
 The generated list is bounded to 100 records. Design a pagination contract before relying on larger lists. Audit writes follow the existing best-effort convention; this generator does not add a durable outbox or deletion behavior.
 
diff --git a/apps/docs/src/content/docs/reference/commands.mdx b/apps/docs/src/content/docs/reference/commands.mdx
index 5af81f6b..9ce77b82 100644
--- a/apps/docs/src/content/docs/reference/commands.mdx
+++ b/apps/docs/src/content/docs/reference/commands.mdx
@@ -36,6 +36,14 @@ For every command below, see the source `package.json` for the full list and opt
 bun run regen     # ACL types, OpenAPI schema, lint-meta, docs JSON
 bun run check     # drift checks (API must be running on :7330)
 bun run agent:quality  # strict tooling types, lint and formatting
+bun run check:full     # adds the api, ui, site and docs gates
+```
+
+Commit subjects and PR titles must be Conventional Commits. The `commit-msg` hook checks
+local commits. To check a title by hand:
+
+```bash
+scripts/ci/check-commit-title.sh "feat(api): invoices can be voided"
 ```
 
 ### Structured verification (repo root)
@@ -62,10 +70,18 @@ bun run db:seed   # seed superuser (if vars set)
 
 ```bash
 bun run dev       # dev server on :7331
-bun run validate  # typecheck + lint + tests
+bun run validate  # typecheck + lint + tests + bundle budgets
+bun run check:size-budget  # bundle budget raises need a reason in budgets.md
 bun run generate:api  # sync OpenAPI schema
 ```
 
+### Public site (from apps/site)
+
+```bash
+bun run dev       # Astro dev server on :7333
+bun run validate  # format, astro check, unit tests, prod-config build, output checks
+```
+
 ## Environment modulation (infra commands from infra/compose/compose/)
 
 ```bash
@@ -74,6 +90,7 @@ WITH_OBSERVABILITY=0 ./scripts/compose-up.sh    # skip observability
 WITH_GLITCHTIP=0 ./scripts/compose-up.sh        # skip error tracking
 WITH_MAILPIT=1 ./scripts/compose-up.sh          # add local email catcher
 WITH_BULLMQ=1 ./scripts/compose-up.sh           # add queue dashboard (dev only)
+WITH_SITE=0 ./scripts/compose-up.sh             # skip the public marketing site (on in dev)
 ```
 
 Minimal: `WITH_OBSERVABILITY=0 WITH_GLITCHTIP=0 ./scripts/compose-up.sh` boots Postgres + Valkey + apps only.
diff --git a/apps/docs/src/content/docs/reference/env-vars.mdx b/apps/docs/src/content/docs/reference/env-vars.mdx
index ea78e33d..c3362f84 100644
--- a/apps/docs/src/content/docs/reference/env-vars.mdx
+++ b/apps/docs/src/content/docs/reference/env-vars.mdx
@@ -62,6 +62,7 @@ Env validation is strict. The API process will refuse to start if a required var
 - **Error tracking**: set `WITH_GLITCHTIP=0` to opt out (on by default)
 - **Queue dashboard**: set `WITH_BULLMQ=1` (dev only, no auth)
 - **Email catcher**: set `WITH_MAILPIT=1` (dev only)
+- **Public marketing site**: `WITH_SITE` is on in dev and off in prod. Prod also needs `PUBLIC_SITE_HOST`, `SITE_CONTACT_EMAIL` and `SITE_IMAGE_TAG`. See [Public site](/site/deployment/)
 
 ## Related
 
diff --git a/apps/docs/src/content/docs/reference/product-validation.mdx b/apps/docs/src/content/docs/reference/product-validation.mdx
index acfe9f17..2c511e82 100644
--- a/apps/docs/src/content/docs/reference/product-validation.mdx
+++ b/apps/docs/src/content/docs/reference/product-validation.mdx
@@ -47,7 +47,8 @@ existing database contents.
 
 The development Compose migrator uses schema push and seeding. That does not test
 migration history. Validate generated migrations against a fresh owned database
-before release; production uses `db:prepare` and committed migrations.
+before release. Production applies committed migrations with `db:migrate` only;
+seeds run as a deliberate one-off, never on every deploy.
 
 ## Recover interrupted verification
 
@@ -64,10 +65,10 @@ partially committed test data. Recreate the disposable sandbox if its state is
 uncertain. `sandbox_not_found` means the descriptor is absent; use `sandbox:up`
 to create an owned runtime before retrying.
 
-Inventory previews include an `acceptCommand` tied to the reviewed diff. Removed
-cases require an additional acknowledgement, included in that command. Review
-case identities before accepting; shrinking an inventory cannot repair tests
-that failed to execute.
+Additions to a test inventory are recorded by the feature run itself. Removed
+cases block the lane and the failure output prints the acknowledgement command
+with its removal token. Review the listed identities before running it; shrinking
+an inventory cannot repair tests that failed to execute.
 
 ## Use the same Compose project
 
diff --git a/apps/docs/src/content/docs/runbooks/argocd-image-updater.mdx b/apps/docs/src/content/docs/runbooks/argocd-image-updater.mdx
deleted file mode 100644
index f144e4f4..00000000
--- a/apps/docs/src/content/docs/runbooks/argocd-image-updater.mdx
+++ /dev/null
@@ -1,63 +0,0 @@
----
-title: ArgoCD image updater
-description: How the k3s target auto-deploys new builds via image-list, tag strategy, and git write-back, plus how to bootstrap and troubleshoot it.
----
-
-The [k3s target](/infra/kubernetes/) closes the deploy loop with
-[argocd-image-updater](https://argocd-image-updater.readthedocs.io/): when CI
-pushes a new GHCR image, the updater rewrites the tag in
-`overlays/prod/kustomization.yaml` and ArgoCD syncs it. All config lives in
-annotations on `infra/k3s/argocd/boringstack-prod.yaml`.
-
-## The annotations
-
-```yaml
-argocd-image-updater.argoproj.io/image-list: api=ghcr.io/<owner>/<project>-api, ui=ghcr.io/<owner>/<project>-ui
-argocd-image-updater.argoproj.io/api.update-strategy: newest-build
-argocd-image-updater.argoproj.io/api.allow-tags: regexp:^sha-[0-9a-f]{7,40}$
-argocd-image-updater.argoproj.io/write-back-method: git:secret:argocd/image-updater-git-creds
-argocd-image-updater.argoproj.io/write-back-target: kustomization
-argocd-image-updater.argoproj.io/git-branch: main
-```
-
-`image-list` pairs an alias with each image the updater watches.
-
-`update-strategy: newest-build` plus the `^sha-` regex tracks the newest
-`sha-<short>` build. BoringStack's release workflows tag every push to main as
-`latest` + `sha-<short>` (and a semver tag on a `v*` release), so this matches
-the `sha-` form and ignores `latest`. To deploy only tagged releases instead,
-use `update-strategy: semver` with `allow-tags: regexp:^v?\d+\.\d+\.\d+$`.
-
-`write-back-method: git` commits the tag bump back to your repo (the GitOps
-source of truth) using the `argocd/image-updater-git-creds` secret.
-`write-back-target: kustomization` edits the `images:` block rather than the
-Application spec.
-
-## Bootstrap
-
-1. Install argocd-image-updater in the `argocd` namespace.
-2. Create the git write-back credential it references:
-   ```bash
-   kubectl -n argocd create secret generic image-updater-git-creds \
-     --from-literal=username=<git-user> \
-     --from-literal=password=<git-PAT-or-deploy-token>
-   ```
-   (Or an `sshPrivateKey` key for SSH write-back.)
-3. Give it pull access to GHCR (a registry pull secret or `--registries-conf`)
-   so it can read tags from your private packages.
-
-## Troubleshooting
-
-No updates happen: check the image-updater pod logs and confirm the `allow-tags`
-regex matches the tags CI actually publishes.
-
-Updates detected but not committed: the git creds secret is missing or lacks
-push rights to `main`.
-
-Tag bumped but the app didn't change: confirm the Application's `images:` block
-names match `image-list` exactly (registry plus repo path).
-
-## Related
-
-- [Provisioning with k3s](/topics/provisioning-with-k3s/)
-- [Image updates (Compose / WUD)](/runbooks/image-updates/), the Compose-path equivalent.
diff --git a/apps/docs/src/content/docs/runbooks/production-release.mdx b/apps/docs/src/content/docs/runbooks/production-release.mdx
new file mode 100644
index 00000000..3d0483b2
--- /dev/null
+++ b/apps/docs/src/content/docs/runbooks/production-release.mdx
@@ -0,0 +1,81 @@
+---
+title: Production releases (k3s)
+description: How the k3s target ships api, migrations and ui together as one digest-pinned release, how to activate it, how migrations and seeds behave, and how to roll back.
+---
+
+The [k3s target](/infra/kubernetes/) deploys one coordinated release. It replaces
+per-image auto-updating. `.github/workflows/production-release.yml` is the only
+publisher for this target. It builds four candidate images for one commit (api,
+migrations, ui and the public site), then pins all four digests in
+`infra/k3s/overlays/prod/kustomization.yaml` in a single commit. ArgoCD syncs that
+commit.
+
+The per-image approach shipped the UI before the API image it needed existed. It
+also produced a stream of `automatic update` commits. Full detail lives in
+[`infra/k3s/README.md`](https://github.com/boringstack-xyz/boringstack/tree/main/infra/k3s#images-and-the-coordinated-release).
+
+## How a release runs
+
+1. Your push to `main` waits, up to 45 minutes, for every applicable CI workflow
+   at the same commit. Any missing, cancelled, failed or timed-out check blocks
+   the release.
+2. The workflow builds `boringstack-api`, `boringstack-migrations`,
+   `boringstack-ui` and `boringstack-site` as `candidate-<sha>` images. Nothing
+   moves `latest` or `sha-*` for this target. The site image takes its build-time
+   values from `infra/k3s/overlays/prod/site-build.env`, so a change there rebuilds it.
+3. Only after all four builds succeed does it pin the digests in one commit. A
+   newer `main` commit supersedes an older release.
+4. Argo syncs in wave order: infrastructure, then the migration Job (wave -1),
+   then the API (wave 0), then the UI and the public site (wave 1) once the API is
+   healthy.
+
+A successful workflow means the digests were promoted. It does not mean Argo has
+finished deploying. Check Synced and Healthy, then smoke-test sign-in and the
+main screens.
+
+## Activation
+
+1. Fresh fork: nothing to remove.
+2. If an older Argo Application still has `argocd-image-updater` annotations,
+   remove them first. Otherwise a per-image updater can overwrite the coordinated
+   digests.
+3. Set the repository variable `PRODUCTION_RELEASE_MODE=coordinated`. Without it,
+   the release fails before any image is built.
+4. Allow the release bot to push the promotion commit to `main`. Do not disable
+   branch protection to make a release pass.
+
+## Runtime and database TLS
+
+The API and migrations images run with a read-only root filesystem. Only `/tmp` is
+writable. The API's CMD runs `bun --no-install`, so it never installs packages at
+startup.
+
+Postgres TLS follows one policy for the runtime and the migration Job. The CA comes
+from the CloudNativePG-generated `boringstack-db-ca` secret and is injected as
+`DATABASE_SSL_CA`. The policy lives in `apps/api/src/lib/postgres/connection.ts`. Keep
+it in `DATABASE_SSL_*`, not in `sslmode` on the URL.
+
+## Migrations and seeds
+
+The migration Job runs `db:migrate` only. It runs on every sync, so it must never
+seed. `db:seed` upserts reference data and would revert admin edits. Run the first
+admin bootstrap as a deliberate one-off. The steps are in
+[`infra/k3s/README.md`](https://github.com/boringstack-xyz/boringstack/tree/main/infra/k3s#migrations-and-seeds).
+Its `db:seed` is idempotent: it creates the admin only when that user does not
+exist.
+
+## Rollback
+
+Restore all four digests from one earlier promotion in a reviewed commit, then
+sync the whole Application. The site image follows the same rule. It has no separate
+rollback path. Do not selectively sync Deployments. Migrations do not
+reverse automatically, so confirm the older API works with the current schema
+first.
+
+## Related
+
+- [Kubernetes (k3s) infra reference](/infra/kubernetes/)
+- [Provisioning with k3s](/topics/provisioning-with-k3s/)
+- [Secrets backends](/runbooks/vault-secrets-operator/)
+- [Image updates (Compose / WUD)](/runbooks/image-updates/), the Compose-path equivalent. Compose keeps its own `latest` publishers.
+- [Public site](/site/deployment/), the site image's configuration and runtime.
diff --git a/apps/docs/src/content/docs/site/deployment.mdx b/apps/docs/src/content/docs/site/deployment.mdx
new file mode 100644
index 00000000..d12107c3
--- /dev/null
+++ b/apps/docs/src/content/docs/site/deployment.mdx
@@ -0,0 +1,120 @@
+---
+title: Site configuration and deployment
+description: Build-time configuration for apps/site, why invalid values fail the build and not the container, the nginx image, and how the site runs in Compose and on k3s.
+---
+
+The site's configuration is fixed when the image is built. There is no runtime
+configuration and no secret. Each value is validated by the Astro build, so a bad
+value stops `astro build` (and `docker build`) rather than publishing pages with the
+wrong canonical origin or contact address.
+
+## Configuration
+
+| Variable               | Required      | Rule                                                                      |
+| ---------------------- | ------------- | ------------------------------------------------------------------------- |
+| `SITE_URL`             | yes           | Origin only, no path. https outside localhost. Canonical origin for every URL. |
+| `APP_URL`              | yes           | Origin only. Must differ from `SITE_URL`.                                 |
+| `CONTACT_EMAIL`        | public origin | Valid email. Required when `SITE_URL` is not localhost.                   |
+| `ANALYTICS_SCRIPT_URL` | no            | https origin of an analytics script. Set both analytics variables or neither. |
+| `ANALYTICS_WEBSITE_ID` | no            | 1 to 64 letters, digits, `-` or `_`. Sent as `data-website-id`.           |
+
+The validated values reach pages as a global (`__SITE_CONFIG__`), so pages never read
+`process.env`. `astro.config.mjs` and the nginx renderer share one implementation,
+`src/lib/config-core.mjs`. The template is in `apps/site/.env.example`.
+
+Rules that must not regress:
+
+- Invalid configuration throws during `astro build`. Nothing validates at container start.
+- Localhost builds are `noindex` and `Disallow: /`.
+- The consent banner exists only when analytics is configured.
+
+## Production values
+
+The production values live in `infra/k3s/overlays/prod/site-build.env`. Changing any value
+rebuilds the image.
+
+- `.github/workflows/production-release.yml` reads the file and passes the values as build
+  arguments to the candidate image in the coordinated release.
+- `.github/workflows/apps-site-release.yml` reads the same file for the Compose and WUD
+  path, and runs on changes to it.
+- Compose builds the site from `PUBLIC_SITE_HOST`, `SITE_CONTACT_EMAIL` and the
+  `SITE_ANALYTICS_*` variables.
+
+## The image
+
+`apps/site/Dockerfile` has four stages:
+
+1. `deps`: `bun install --frozen-lockfile`.
+2. `dev`: the Astro dev server, used by Compose `site-dev` on port 7333.
+3. `build`: `astro build`, then `render-nginx.mjs`, which writes the nginx configuration with
+   the CSP derived from the same validated configuration.
+4. `production`: `nginx:1.31-alpine`, pinned by digest, running as the non-root user `app`
+   (uid 1001) on port 8080. The build runs `nginx -t`.
+
+The container writes only to `/tmp`. Build it and run it read-only:
+
+```bash
+docker build -t boringstack-site \
+  --build-arg SITE_URL=https://example.com \
+  --build-arg APP_URL=https://app.example.com \
+  --build-arg CONTACT_EMAIL=hello@example.com .
+docker run --rm --read-only --tmpfs /tmp -p 8080:8080 boringstack-site
+curl -si http://localhost:8080/healthz
+```
+
+`GET /healthz` serves readiness and liveness.
+
+## nginx headers and cache
+
+Security headers are declared once at server level, because an `add_header` inside a
+location replaces the server's headers. They are the CSP, `X-Content-Type-Options`,
+`X-Frame-Options`, `Referrer-Policy`, `Permissions-Policy` and `Cross-Origin-Opener-Policy`.
+HSTS is set by the ingress, which terminates TLS.
+
+Cache policy, keyed on status and path:
+
+- `/_astro/*` (hashed assets): `public, max-age=31536000, immutable`.
+- Successful images and fonts: `public, max-age=86400`.
+- HTML and everything else: `no-cache`.
+- Errors: `no-store`.
+
+## Docker Compose
+
+`infra/compose/compose/docker-compose.site.yml` is merged when `WITH_SITE=1`. The default is
+`1` in dev and `0` in prod. `dev.sh` applies it.
+
+- Dev: `site-dev` on `SITE_HOST_PORT` (default `7333`).
+- Prod: `site` is routed by Traefik on `Host(PUBLIC_SITE_HOST)`. The app stays on
+  `PUBLIC_UI_HOST`, so the two origins never share cookies. `dev.sh` requires
+  `PUBLIC_SITE_HOST` (different from the app host), `SITE_CONTACT_EMAIL` and a pinned
+  `SITE_IMAGE_TAG` (a version or `sha-*`, never `latest`). A full pinned `SITE_IMAGE`
+  reference can replace the tag.
+
+`infra/compose/scripts/validate-guardrails.sh` renders the site overlay with the other prod
+services, so the healthcheck and `no-new-privileges` checks apply to `site` too.
+
+## Kubernetes (k3s)
+
+`infra/k3s/base/site` holds the Deployment, Service, NetworkPolicy and ServiceAccount. The
+Deployment has a read-only root filesystem, drops all capabilities, runs as uid 1001,
+probes `/healthz`, and mounts `/tmp` as an `emptyDir`. The NetworkPolicy allows ingress
+from Traefik and DNS egress only.
+
+The prod overlay routes:
+
+- `Host(<domain>)` to `site:8080` (IngressRoute `boringstack-site`).
+- `Host(app.<domain>)` to `api` for `/api` and `/health`, and to `ui` for everything else.
+- The certificate covers the apex, `app.<domain>` and the GlitchTip host.
+
+The site is in sync wave 1, with the UI, after the API is healthy. `site-pdb` keeps one
+replica available, and `patches/site-replicas.yaml` runs two replicas with spread
+constraints.
+
+The image is `ghcr.io/<owner>/<project>-site`. Its digest is pinned in
+`infra/k3s/overlays/prod/kustomization.yaml` by the coordinated release, together with the
+API, migrations and UI digests. See [Production releases](/runbooks/production-release/).
+The `latest` and `sha-*` tags that `apps-site-release.yml` publishes are for the Compose
+path only. Kubernetes never references them.
+
+`.github/workflows/apps-site-validate.yml` runs `bun run validate`, builds the same image and
+smoke-tests it read-only.
diff --git a/apps/docs/src/content/docs/site/overview.mdx b/apps/docs/src/content/docs/site/overview.mdx
new file mode 100644
index 00000000..2eb1abe5
--- /dev/null
+++ b/apps/docs/src/content/docs/site/overview.mdx
@@ -0,0 +1,100 @@
+---
+title: Public site
+description: apps/site, the static marketing site on the apex domain. Pages, the domain split with the app, the blog, and consent-gated analytics.
+---
+
+`apps/site` is the public marketing site: a landing page, pricing, about, contact,
+privacy and terms pages, and a blog written in Markdown. Astro renders every page at
+build time and nginx serves the output. The site has no server code, sets no cookies,
+and calls no API. The authenticated product stays in `apps/ui` and `apps/api`.
+
+## Domain split
+
+| Origin                  | Serves                                       |
+| ----------------------- | -------------------------------------------- |
+| `https://<domain>`      | `apps/site` (static, apex, indexable)        |
+| `https://app.<domain>`  | `apps/ui` and `/api` (the authenticated app) |
+
+`SITE_URL` and `APP_URL` must be different origins, so public pages and app pages never
+share cookies or search indexing. The site's sign-up and sign-in links point at `APP_URL`.
+The app's `FRONTEND_URL` and `VITE_PUBLIC_URL` should equal `APP_URL`. The site makes no
+API calls, so it needs no entry in the API's `ALLOWED_ORIGINS`.
+
+## Pages
+
+- `/` (landing), `/pricing`, `/about`, `/contact`, `/privacy`, `/terms`.
+- `/blog` and `/blog/<slug>`, built from Markdown.
+- A 404 page, marked `noindex`.
+
+Copy marked "Placeholder" is template text. Replace it before launch.
+
+## Local development
+
+With the Compose dev stack (`WITH_SITE=1` by default in dev), `site-dev` serves the site
+with live reload at `http://localhost:7333`. Sign-up links point at the UI on
+`http://localhost:7331`.
+
+Outside Docker:
+
+```bash
+cd apps/site
+bun install --frozen-lockfile
+bun run dev
+```
+
+`bun run dev` supplies localhost values for `SITE_URL` and `APP_URL`. Localhost builds are
+`noindex`, and `robots.txt` disallows everything, so a dev build cannot be indexed.
+
+Validation is one command:
+
+```bash
+bun run validate
+```
+
+It runs the format check, `astro check`, unit tests (including builds with invalid
+configuration that must fail), the production-config build with the nginx render, and
+output checks against `dist/`. The root `bun run check:full` runs the same gate whenever
+`apps/site` is present.
+
+## Blog
+
+Posts are flat Markdown files in `src/content/blog`, validated by `src/content.config.ts`.
+Frontmatter fields: `title`, `description`, `publishedAt` (`YYYY-MM-DD`), optional
+`updatedAt`, `author`, and `draft`, which defaults to `true`.
+
+- A draft is absent from the index, the post route, the sitemap and the social card routes.
+- A post with a future `publishedAt` stays hidden until a build on or after that date.
+  The site is static, so the post appears on the next build after its date.
+- The filename is the permanent URL. Renaming a published post breaks its link.
+
+The starter post is `src/content/blog/hello-world.md`.
+
+## SEO and social cards
+
+Every page renders through `BaseLayout`, which supplies the head through `Seo.astro`.
+`title` and `description` are required. Structured data:
+
+- Home: `Organization` and `WebSite` JSON-LD.
+- Posts: `BlogPosting`.
+- Every page: `WebPage`.
+
+Social cards are 1200x630 PNGs rendered at build time from `src/lib/social-card.ts`, at
+`/og/default.png` and `/og/blog/<slug>.png`. `@astrojs/sitemap` emits `sitemap-index.xml`
+and excludes `/404` and `/og/`.
+
+## Privacy and analytics
+
+No cookies are set. Analytics is off unless `ANALYTICS_SCRIPT_URL` and
+`ANALYTICS_WEBSITE_ID` are both set. When both are set:
+
+- A consent banner appears, and the analytics script loads only after the visitor accepts.
+- The Content-Security-Policy allows the analytics origin for `script-src` and `connect-src`.
+  Otherwise the policy is `'self'` only.
+
+With analytics off there is nothing to consent to, so no banner is rendered.
+
+## Where it runs
+
+The site runs in Compose (`site-dev` in dev, `site` behind Traefik in prod) and in the
+k3s prod overlay on the apex host. Configuration, the image, headers and the release path
+are in [Site configuration and deployment](/site/deployment/).
diff --git a/apps/docs/src/content/docs/skills/verified-workflow.mdx b/apps/docs/src/content/docs/skills/verified-workflow.mdx
index ddc73b95..23c08959 100644
--- a/apps/docs/src/content/docs/skills/verified-workflow.mdx
+++ b/apps/docs/src/content/docs/skills/verified-workflow.mdx
@@ -67,15 +67,15 @@ This applies committed migrations to the owned sandbox, builds test templates an
 
 The ordinary API, UI and browser suites compare observed test identities, including multiplicity, with `tools/agent/inventories/*.json`. This rejects missing or substituted tests even when the reported total looks plausible.
 
-A complete passing underlying suite records an observation even when new tests cause an inventory mismatch. Preview only the changed lanes:
+New tests need no separate step. When a feature verification run observes the committed inventory plus new cases and nothing removed, it rewrites that lane's `tools/agent/inventories/*.json` and reports `test_inventory_additions_recorded`. Commit the updated inventory with the feature change and review it in the diff against the actual tests.
+
+Removed, renamed or substituted cases block the lane. The failure output lists each removed identity and prints one acknowledgement command:
 
 ```sh
-bun run agent:inventory -- api.tests ui.tests ui.e2e
+bun run agent:inventory -- api.tests --accept=<token> --allow-removals=<token>
 ```
 
-The preview prints exact additions/removals and a review token without writing. Apply the reviewed diff with `--accept=<token>`. If it removes any case, also pass `--allow-removals=<token>`; this includes duplicate removal and same-count substitutions. Both approvals bind that exact checkout and diff, so changed observations or source invalidate them.
-
-Name fewer lanes when appropriate. Approve multiple changed lanes together, review the committed diff against the actual tests, then rerun verification. Do not approve an unexpected shrink to obtain a green result. The security suite has its own [per-case manifest](/topics/security-spec/).
+Run it only after reviewing the listed removals, then rerun verification. The token binds that exact checkout and diff, so changed observations or source invalidate it. Zero observed cases always block. Do not acknowledge an unexpected shrink to obtain a green result. The security suite has its own [per-case manifest](/topics/security-spec/).
 
 ## Tooling maintenance and boundaries
 
diff --git a/apps/docs/src/content/docs/topics/deployment.mdx b/apps/docs/src/content/docs/topics/deployment.mdx
index aa387872..45b6ea2f 100644
--- a/apps/docs/src/content/docs/topics/deployment.mdx
+++ b/apps/docs/src/content/docs/topics/deployment.mdx
@@ -271,6 +271,11 @@ IMAGE_OWNER=your-github-org
 # UI_IMAGE_NAME=your-fork-ui
 ```
 
+The public marketing site is off in prod by default (`WITH_SITE=0`). To serve it, set
+`WITH_SITE=1`, `PUBLIC_SITE_HOST` to the apex domain, `SITE_CONTACT_EMAIL`, and a pinned
+`SITE_IMAGE_TAG`. Then set `PUBLIC_UI_HOST` to `app.<your-domain>`, because the app moves to
+its own origin. The [Public site](/site/deployment/) page lists the rules.
+
 ```bash
 # compose/api.prod.env.tpl  (gitignored; renders to compose/api.prod.env)
 JWT_SECRET=op://Production/Auth/jwt_secret
diff --git a/apps/docs/src/content/docs/topics/observability.mdx b/apps/docs/src/content/docs/topics/observability.mdx
index 14997282..d115db4a 100644
--- a/apps/docs/src/content/docs/topics/observability.mdx
+++ b/apps/docs/src/content/docs/topics/observability.mdx
@@ -128,6 +128,52 @@ CPU by mode (user, system, iowait, etc.). iowait stat (red when sustained indica
 Drop additional dashboards into `compose/grafana/dashboards/` and Grafana picks them up within 30 seconds. Community starters to pair with the defaults: Node Exporter Full (id `1860`), PostgreSQL exporter quickstart (id `9628`), Loki Logs (id `13186`).
 
 
+## Business metrics (k3s)
+
+The k3s prod overlay adds product metrics next to the database health metrics. They are
+for the cluster's kube-prometheus-stack, and the Compose stack does not include them.
+The source is `infra/k3s/overlays/prod/monitoring/`.
+
+- A `PodMonitor` (`podmonitor.yaml`) scrapes the CloudNativePG exporter on every
+  Postgres instance every 30 seconds.
+- `cnpg-business-queries.yaml` adds custom queries to that exporter, through
+  `patches/postgres-monitoring.yaml`. They run on the primary only, so the three
+  instances do not triple-count. The list replaces the operator default, so the
+  standard health queries are repeated in the patch.
+- The queries run over the `auth`, `audit` and `billing` tables once per scrape.
+
+| Metric | What it counts |
+| ------ | -------------- |
+| `cnpg_boringstack_signups_daily_users` | Accounts created per UTC day (90 days) |
+| `cnpg_boringstack_active_users_last_{1d,7d,30d}` | Distinct users with a successful sign-in |
+| `cnpg_boringstack_account_plans_accounts` | Paid or granted plans by plan, status and source |
+| `cnpg_boringstack_churn_daily_canceled` | Subscriptions canceled per UTC day (approximate) |
+| `cnpg_boringstack_stripe_webhooks_events` | Stored Stripe webhook events by type |
+
+**Only aggregates leave the database.** The exporter does not connect as a superuser. It
+reads through the built-in `pg_monitor` role, and migration
+`apps/api/drizzle/0002_metrics_exporter_grants.sql` grants that role column by column.
+The grants cover `created_at` on users, `user_id`, `action` and `created_at` on the audit
+log, a few plan and status columns, and the Stripe event `type`. No email, name, IP
+address, user agent, audit metadata, password or MFA material, or Stripe identifier is
+readable. `infra/k3s/tests/business-metrics.test.ts` checks the queries against the schema
+and the grants.
+
+A query that touches a column outside the grant fails with "permission denied" in the
+instance log, and that query produces no series.
+
+**What is not derived.** Plans have no price in the database, so MRR is not computed. The
+Free plan has no row per account, so it is not counted in the plan series.
+
+**Scrape selector.** The PodMonitor carries `app: postgres` and matches the CNPG cluster
+label. Like the ServiceMonitor, it needs a label that your Prometheus
+`podMonitorSelector` matches (often `release: <helm-release>`). Otherwise install the
+stack with `podMonitorSelectorNilUsesHelmValues=false`.
+
+**Dashboard.** `dashboards/boringstack-business.json` ("Business metrics") is turned into a
+ConfigMap labelled `grafana_dashboard: "1"` on every render, so the Grafana sidecar imports
+it without a copy step.
+
 ## Querying
 
 **Metrics (Prometheus, PromQL).** Out of the box, node, postgres, and traefik metrics return data. Once you add the `/metrics` endpoint and its scrape job:
diff --git a/apps/docs/src/content/docs/topics/provisioning-with-k3s.mdx b/apps/docs/src/content/docs/topics/provisioning-with-k3s.mdx
index 1dd46441..66291b54 100644
--- a/apps/docs/src/content/docs/topics/provisioning-with-k3s.mdx
+++ b/apps/docs/src/content/docs/topics/provisioning-with-k3s.mdx
@@ -1,15 +1,15 @@
 ---
 title: Provisioning with k3s (GitOps)
-description: Ship BoringStack to any ArgoCD-managed k3s/Kubernetes cluster. Register one Application, seed secrets, and every CI build auto-deploys via argocd-image-updater.
+description: Ship BoringStack to any ArgoCD-managed k3s/Kubernetes cluster. Register one Application, seed secrets, and every main-branch release deploys the API, migrations, UI and site together.
 ---
 
 import { Aside } from "@astrojs/starlight/components";
 
 The cluster deployment path. Where [OpenTofu](/topics/provisioning-with-tofu/)
 gives you a single VPS running docker-compose, this gives you a GitOps loop on a
-Kubernetes cluster you already run: push code, CI publishes GHCR images,
-argocd-image-updater bumps the tag, and ArgoCD syncs. HA, autoscaling, and TLS
-come with it.
+Kubernetes cluster you already run: push code, the release workflow publishes the
+API, migration, UI and site images as one set, and ArgoCD syncs that set. HA,
+autoscaling, and TLS come with it.
 
 Source lives in [`infra/k3s`](https://github.com/boringstack-xyz/boringstack/tree/main/infra/k3s).
 
@@ -24,16 +24,19 @@ Source lives in [`infra/k3s`](https://github.com/boringstack-xyz/boringstack/tre
 
 A k3s/Kubernetes cluster with these operators installed:
 
-- ArgoCD + argocd-image-updater (with its `argocd/image-updater-git-creds` write-back secret)
+- ArgoCD
 - the CloudNativePG operator
-- cert-manager + a DNS-01-capable `ClusterIssuer`
+- cert-manager + a DNS-01-capable `ClusterIssuer` whose credential covers your zone
 - Traefik (ships with k3s) exposing `web` + `websecure` entrypoints
 - a default/persistent StorageClass
 - optional: kube-prometheus-stack (metrics and dashboards), and a secrets
   backend (Vault + VSO by default, or the SealedSecrets controller)
 
-You'll also need CI that builds and pushes `ghcr.io/<owner>/<project>-api` and
-`-ui` images, the same pipeline the Compose/WUD path uses.
+You'll also need the release workflow (`production-release.yml`), which builds and
+digest-pins `ghcr.io/<owner>/<project>-api`, `-migrations`, `-ui` and `-site`. Set the
+repository variable `PRODUCTION_RELEASE_MODE=coordinated` once the cluster is
+ready. The [production releases runbook](/runbooks/production-release/) has the
+activation steps.
 
 ## 1. Rebrand and set the knobs
 
@@ -47,8 +50,11 @@ That rewrites every `boringstack*` token across the repo, including the k3s
 manifests. Then edit the handful of cluster-specific values (all listed in
 `infra/k3s/README.md`):
 
-- the domain in `overlays/prod/ingress.yaml`, `certificate.yaml`, `glitchtip/`
-- the `ClusterIssuer` name in `overlays/prod/certificate.yaml`
+- the domain in `overlays/prod/ingress.yaml`, `certificate.yaml`, `glitchtip/`. The
+  site serves the apex (`<domain>`), the app serves `app.<domain>`, and GlitchTip serves
+  `glitchtip.<domain>`. Set the production site values in `overlays/prod/site-build.env`
+  too (see [Public site](/site/deployment/)).
+- the `ClusterIssuer` name in `overlays/prod/certificate.yaml` (its credential must cover every domain in `dnsNames`)
 - the `StorageClass` in `base/postgres/cluster.yaml` and `base/valkey/statefulset.yaml` (optional; defaults to the cluster default)
 - `source.repoURL` in `argocd/boringstack-prod.yaml`
 
@@ -80,30 +86,34 @@ app-of-apps repo. It points ArgoCD at your fork's `infra/k3s/argocd` directory.
 ```mermaid
 flowchart LR
   push["git push<br/>(app code)"]
-  ci["CI builds + pushes<br/>GHCR images"]
-  iu["argocd-image-updater<br/>bumps kustomization tag"]
+  ci["CI passes for the commit"]
+  build["Build api, migrations, ui, site<br/>as candidates"]
+  pin["One commit pins<br/>all four digests"]
   argo["ArgoCD syncs<br/>overlays/prod"]
-  presync["PreSync Job<br/>db:migrate + db:seed"]
-  k8s["Rolling deploy<br/>api · ui · GlitchTip"]
+  mig["Sync hook, wave -1<br/>db:migrate only"]
+  k8s["Rolling deploy<br/>api, then ui, site, GlitchTip"]
 
-  push --> ci --> iu --> argo --> presync --> k8s
+  push --> ci --> build --> pin --> argo --> mig --> k8s
 ```
 
-ArgoCD renders the prod overlay (base + secrets component + HA patches), runs the
-PreSync migration Job, then rolls out the Deployments. CloudNativePG manages
-Postgres, cert-manager issues the TLS cert, and the Vault Secrets Operator (or
-your chosen backend) materializes the app secrets.
+ArgoCD renders the prod overlay (base + secrets component + HA patches) and syncs
+in wave order: infrastructure first, then the migration Job, then the API, then
+the UI and the site once the API is healthy. CloudNativePG manages Postgres, cert-manager
+issues the TLS cert, and the Vault Secrets Operator (or your chosen backend)
+materializes the app secrets.
 
 ## 4. Verify
 
 ```bash
 kubectl -n boringstack-prod get pods            # all Running/Ready
-curl -sI https://<domain>/health                 # 200 from the api
-curl -sI https://<domain>/                        # 200 from the ui (SPA)
+curl -sI https://app.<domain>/health             # 200 from the api
+curl -sI https://app.<domain>/                   # 200 from the ui (SPA)
+curl -sI https://<domain>/                       # 200 from the public site
 ```
 
-In ArgoCD the Application should be Synced and Healthy, and a new commit's image
-should auto-roll within an image-updater poll interval.
+In ArgoCD the Application should be Synced and Healthy. Each promoted release
+should appear there as one sync, with the API, migration, UI and site digests
+changing together.
 
 ### First-deploy checks
 
@@ -126,6 +136,6 @@ deploy a second one.
 ## Related
 
 - [Kubernetes (k3s) infra reference](/infra/kubernetes/)
-- [ArgoCD image updater](/runbooks/argocd-image-updater/)
+- [Production releases](/runbooks/production-release/)
 - [Secrets backends](/runbooks/vault-secrets-operator/)
 - [Postgres backups (CNPG)](/runbooks/cnpg-backups/)
diff --git a/apps/docs/src/content/docs/topics/security.mdx b/apps/docs/src/content/docs/topics/security.mdx
index 826f3b74..f370eda7 100644
--- a/apps/docs/src/content/docs/topics/security.mdx
+++ b/apps/docs/src/content/docs/topics/security.mdx
@@ -61,6 +61,22 @@ All security workflows fire on `0 6 * * 1` (Monday morning UTC, staggered by min
 - An `ignoreUntil` allowlist entry expiring
 - A new rule release from Semgrep or osv
 
+### Self-hosted runners
+
+Set the repository variable `CI_RUNNER` to a runner label and jobs move off GitHub-hosted
+minutes. Each job selects its runner with the same expression:
+
+```yaml
+runs-on: ${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER || 'ubuntu-24.04' }}
+```
+
+Pull requests from forks always stay on `ubuntu-24.04`, so code from outside the repository
+never runs on your machines. `production-release.yml` always runs on GitHub-hosted runners.
+The lint-meta rule `github-actions-runner-pinned` enforces both halves. It requires an
+explicit OS version instead of a floating `*-latest` label, and it rejects a
+`vars.CI_RUNNER` expression that lacks the fork guard. The rule is listed in the
+[lint:meta rules](/architecture/lint-meta/) catalog.
+
 ## Executable API regression gate
 
 The [security specification](/topics/security-spec/) runs behavioral cases for the 22 tracked API findings against required Postgres and Valkey services. Named-case reconciliation and positive controls prevent a missing fixture or skipped test from masquerading as evidence. The `security spec (review findings)` workflow reports for PRs targeting `main` and runs the expensive cases when relevant paths change.
diff --git a/apps/docs/src/data/lint-meta-catalog.json b/apps/docs/src/data/lint-meta-catalog.json
index 2cf89a63..a78b311c 100644
--- a/apps/docs/src/data/lint-meta-catalog.json
+++ b/apps/docs/src/data/lint-meta-catalog.json
@@ -324,7 +324,7 @@
       "id": "github-actions-runner-pinned",
       "category": "ci",
       "ciCritical": false,
-      "description": "Workflows must pin runner images to an explicit OS version instead of floating *-latest labels."
+      "description": "Workflows must pin runner images to an explicit OS version instead of floating *-latest labels, and guard vars.CI_RUNNER against fork pull requests."
     },
     {
       "id": "github-actions-security-no-cancel",
diff --git a/apps/docs/src/data/scripts-catalog.json b/apps/docs/src/data/scripts-catalog.json
index d69095b4..6a12b76b 100644
--- a/apps/docs/src/data/scripts-catalog.json
+++ b/apps/docs/src/data/scripts-catalog.json
@@ -37,6 +37,12 @@
         "description": "After `bun run build`, every `<link rel=\"modulepreload\">` in dist/index.html must match at least one glob in `.size-limit.json`.",
         "invocation": "tsx scripts/quality/check-modulepreload-size-coverage.ts"
       },
+      {
+        "command": "check:size-budget",
+        "script": "quality/check-size-budget-raises.ts",
+        "description": "Bundle budget gate.",
+        "invocation": "tsx scripts/quality/check-size-budget-raises.ts"
+      },
       {
         "command": "lint:meta",
         "script": "lint-meta/cli.ts",
diff --git a/apps/site/.dockerignore b/apps/site/.dockerignore
new file mode 100644
index 00000000..979b6dd3
--- /dev/null
+++ b/apps/site/.dockerignore
@@ -0,0 +1,6 @@
+**/node_modules
+**/dist
+**/.astro
+**/.build
+**/.env
+**/.env.*
diff --git a/apps/site/.env.example b/apps/site/.env.example
new file mode 100644
index 00000000..a2219055
--- /dev/null
+++ b/apps/site/.env.example
@@ -0,0 +1,17 @@
+# Build-time configuration. Validated when Astro loads its config, so a bad
+# value fails `astro build` (and `docker build`) instead of publishing pages.
+# `bun run dev` supplies localhost defaults itself; see README.md.
+
+# Public origin of this site (no path). https outside localhost.
+SITE_URL=https://boringstack.example.com
+# Origin of the app (sign-up and sign-in links). Must differ from SITE_URL.
+APP_URL=https://app.boringstack.example.com
+# Required for a public-origin build. Shown on the contact page and in the
+# structured data. Use a real mailbox you monitor.
+CONTACT_EMAIL=hello@boringstack.example.com
+
+# Optional, off by default. Both or neither. The script loads only after the
+# visitor accepts analytics in the consent banner. Any provider that loads from
+# ANALYTICS_SCRIPT_URL and reads a data-website-id attribute works.
+ANALYTICS_SCRIPT_URL=
+ANALYTICS_WEBSITE_ID=
diff --git a/apps/site/.gitignore b/apps/site/.gitignore
new file mode 100644
index 00000000..bdced598
--- /dev/null
+++ b/apps/site/.gitignore
@@ -0,0 +1,7 @@
+node_modules/
+dist/
+.astro/
+.build/
+.env
+.env.*
+!.env.example
diff --git a/apps/site/.prettierignore b/apps/site/.prettierignore
new file mode 100644
index 00000000..fd02cf0c
--- /dev/null
+++ b/apps/site/.prettierignore
@@ -0,0 +1,5 @@
+node_modules/
+dist/
+.astro/
+.build/
+bun.lock
diff --git a/apps/site/.prettierrc.json b/apps/site/.prettierrc.json
new file mode 100644
index 00000000..62e020bc
--- /dev/null
+++ b/apps/site/.prettierrc.json
@@ -0,0 +1,4 @@
+{
+  "plugins": ["prettier-plugin-astro"],
+  "overrides": [{ "files": "*.astro", "options": { "parser": "astro" } }]
+}
diff --git a/apps/site/AGENTS.md b/apps/site/AGENTS.md
new file mode 100644
index 00000000..2b5ecb93
--- /dev/null
+++ b/apps/site/AGENTS.md
@@ -0,0 +1,17 @@
+# Public site: index
+
+Static marketing site (Astro, `output: "static"`) served by nginx. The
+authenticated app is `apps/ui`; this site links to it for sign-up and sign-in.
+[README.md](README.md) covers local development and the domain split.
+
+`bun run validate` is the gate: format, types, unit tests, production-config build,
+rendered nginx config and output checks. If a guide below disagrees with what
+`validate` says, the lint config wins.
+
+## Deep dives
+
+| When you're doing this                                                 | Read this                         |
+| ---------------------------------------------------------------------- | --------------------------------- |
+| Adding or changing `SITE_URL`, `APP_URL`, `CONTACT_EMAIL`, analytics   | [config](docs/agents/config.md)   |
+| Adding a page, a blog post, or changing SEO, cards and structured data | [content](docs/agents/content.md) |
+| Building the image, nginx headers and CSP, Compose and k3s wiring      | [deploy](docs/agents/deploy.md)   |
diff --git a/apps/site/Dockerfile b/apps/site/Dockerfile
new file mode 100644
index 00000000..b44fa5ac
--- /dev/null
+++ b/apps/site/Dockerfile
@@ -0,0 +1,52 @@
+# Image build. Every configuration check runs here, never at container start:
+# a bad SITE_URL, a missing CONTACT_EMAIL or a partial analytics setting fails
+# `docker build` instead of producing a crash-looping container.
+#
+# Build from apps/site:
+#   docker build --build-arg SITE_URL=https://example.com \
+#     --build-arg APP_URL=https://app.example.com \
+#     --build-arg CONTACT_EMAIL=hello@example.com -t boringstack-site .
+
+FROM oven/bun:1.4.2-alpine@sha256:d888c0ae6c86d7866ff10c5aafdd9077b36aee6455b33dd270fb93c0dd5cef6f AS deps
+WORKDIR /app
+COPY package.json bun.lock bunfig.toml ./
+RUN bun install --frozen-lockfile
+
+# Development server for `docker compose --profile dev` (site-dev).
+FROM deps AS dev
+COPY . .
+ENV HOST=0.0.0.0
+EXPOSE 7333
+CMD ["bun", "run", "dev"]
+
+FROM deps AS build
+COPY . .
+ARG SITE_URL=""
+ARG APP_URL=""
+ARG CONTACT_EMAIL=""
+ARG ANALYTICS_SCRIPT_URL=""
+ARG ANALYTICS_WEBSITE_ID=""
+ENV SITE_URL=$SITE_URL \
+    APP_URL=$APP_URL \
+    CONTACT_EMAIL=$CONTACT_EMAIL \
+    ANALYTICS_SCRIPT_URL=$ANALYTICS_SCRIPT_URL \
+    ANALYTICS_WEBSITE_ID=$ANALYTICS_WEBSITE_ID
+RUN bun run build && bun run render:nginx
+
+FROM nginx:1.31-alpine@sha256:72ba65eb42c10344912a84ff42408db7d34f2feb642204570ab8fc5ffd29f1d3 AS production
+RUN addgroup -g 1001 -S app \
+ && adduser -S app -u 1001 -G app
+COPY --from=build /app/.build/nginx.conf /etc/nginx/nginx.conf
+COPY --from=build /app/dist /usr/share/nginx/html
+RUN mkdir -p /tmp/nginx/client_temp /tmp/nginx/proxy_temp /tmp/nginx/fastcgi_temp /tmp/nginx/uwsgi_temp /tmp/nginx/scgi_temp \
+ && nginx -t -c /etc/nginx/nginx.conf \
+ && rm -rf /tmp/nginx
+USER app
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
+  CMD wget --quiet --spider http://127.0.0.1:8080/healthz || exit 1
+# /tmp is the only writable path (tmpfs or emptyDir at runtime), so the temp
+# directories are created when the container starts. The image's own entrypoint
+# scripts are skipped: they try to write conf.d and are not needed here.
+ENTRYPOINT []
+CMD ["sh", "-c", "mkdir -p /tmp/nginx/client_temp /tmp/nginx/proxy_temp /tmp/nginx/fastcgi_temp /tmp/nginx/uwsgi_temp /tmp/nginx/scgi_temp && exec nginx -g 'daemon off;'"]
diff --git a/apps/site/README.md b/apps/site/README.md
new file mode 100644
index 00000000..c10c8fae
--- /dev/null
+++ b/apps/site/README.md
@@ -0,0 +1,73 @@
+# BoringStack public site
+
+A static marketing site: landing, pricing, about, contact, legal stubs and a blog
+from Markdown. Astro renders everything at build time. nginx serves the result.
+The site has no server code and calls no API.
+
+## Local development
+
+Run the Compose dev stack (`infra/compose/compose/dev.sh`, `WITH_SITE=1` by default),
+which starts `site-dev` at http://localhost:7333 with live reload. Or outside Docker:
+
+```bash
+cd apps/site
+bun install --frozen-lockfile
+bun run dev          # http://localhost:7333, with localhost SITE_URL and APP_URL
+```
+
+Sign-up and sign-in links point at `APP_URL` (default http://localhost:7331).
+
+## Validate
+
+```bash
+bun run validate
+```
+
+This runs format, types, unit tests (including invalid-configuration builds that
+must fail), the production-config build, the rendered nginx config and the output
+checks against `dist/`.
+
+## The domain split
+
+| Origin                    | Serves                                       |
+| ------------------------- | -------------------------------------------- |
+| `https://example.com`     | this site (static, apex, indexable)          |
+| `https://app.example.com` | `apps/ui` and `/api` (the authenticated app) |
+
+Set `SITE_URL` to the apex and `APP_URL` to `app.<domain>`. They must be different
+origins, so public pages and app pages never share cookies or search indexing. The
+app's own `FRONTEND_URL` and `VITE_PUBLIC_URL` should equal `APP_URL`. The site makes
+no API calls, so it needs no CORS entry in `ALLOWED_ORIGINS`.
+
+## Configuration
+
+See [`.env.example`](.env.example) and [docs/agents/config.md](docs/agents/config.md).
+Configuration is validated when Astro loads its config. An invalid value fails the
+build (and `docker build`), never container start. A public-origin build needs
+`CONTACT_EMAIL`.
+
+## Content
+
+- Pages live in `src/pages`. Shared head and metadata are in `src/components/Seo.astro`.
+- Blog posts are Markdown files in `src/content/blog`. The filename is the permanent
+  URL. `draft` defaults to `true`; set it to `false` deliberately.
+- Placeholder copy is marked "Placeholder". Replace it before launch.
+
+## Privacy
+
+No cookies are set. Analytics is off unless `ANALYTICS_SCRIPT_URL` and
+`ANALYTICS_WEBSITE_ID` are both set. Then a consent banner appears, and the script
+loads only after the visitor accepts. The banner is not rendered when analytics is off.
+
+## Production image
+
+```bash
+docker build -t boringstack-site \
+  --build-arg SITE_URL=https://example.com \
+  --build-arg APP_URL=https://app.example.com \
+  --build-arg CONTACT_EMAIL=hello@example.com .
+docker run --rm --read-only --tmpfs /tmp -p 8080:8080 boringstack-site
+```
+
+The container listens on 8080 as a non-root user, reads nothing but its own files, and
+writes only under `/tmp`. Readiness and liveness: `GET /healthz`.
diff --git a/apps/site/astro.config.mjs b/apps/site/astro.config.mjs
new file mode 100644
index 00000000..78de9c21
--- /dev/null
+++ b/apps/site/astro.config.mjs
@@ -0,0 +1,40 @@
+import { defineConfig } from "astro/config";
+import sitemap from "@astrojs/sitemap";
+import { loadEnv } from "vite";
+import { resolveSiteConfig } from "./src/lib/config-core.mjs";
+
+// Validation happens here, before any page renders. A bad value throws and the
+// build exits non-zero. The result is also exposed to pages as the global
+// __SITE_CONFIG__ (see src/lib/site-config.ts), so pages and config never drift.
+const env = {
+  ...loadEnv(process.env.NODE_ENV ?? "production", process.cwd(), ""),
+  ...process.env,
+};
+const config = resolveSiteConfig(env);
+
+export default defineConfig({
+  site: config.siteUrl,
+  output: "static",
+  // Canonical URLs are slashless. nginx redirects trailing-slash variants.
+  trailingSlash: "never",
+  build: {
+    format: "file",
+    // Keep styles in external files so the CSP can forbid inline styles.
+    inlineStylesheets: "never",
+  },
+  server: {
+    host: process.env.HOST ?? "127.0.0.1",
+    port: 7333,
+  },
+  integrations: [
+    sitemap({
+      // Error pages and image endpoints are not indexable documents.
+      filter: (page) => !/\/(404|og)(\/|$)/.test(new URL(page).pathname),
+    }),
+  ],
+  vite: {
+    define: {
+      __SITE_CONFIG__: JSON.stringify(config),
+    },
+  },
+});
diff --git a/apps/site/bun.lock b/apps/site/bun.lock
new file mode 100644
index 00000000..5008deb1
--- /dev/null
+++ b/apps/site/bun.lock
@@ -0,0 +1,830 @@
+{
+  "lockfileVersion": 2,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "boringstack-site",
+      "dependencies": {
+        "@astrojs/sitemap": "3.7.4",
+        "@fontsource/manrope": "5.3.0",
+        "astro": "7.3.1",
+        "satori": "0.33.4",
+        "sharp": "0.35.4",
+      },
+      "devDependencies": {
+        "@astrojs/check": "0.9.10",
+        "@types/bun": "1.4.2",
+        "@types/node": "24.13.3",
+        "prettier": "3.9.6",
+        "prettier-plugin-astro": "1.0.1",
+        "typescript": "6.0.3",
+      },
+    },
+  },
+  "overrides": {
+    "devalue": "5.9.3",
+    "fflate": "0.8.3",
+    "postcss": "8.5.23",
+    "sharp": "0.35.5",
+    "undici": "7.29.1",
+  },
+  "packages": {
+    "@astrojs/astro2tsx": ["@astrojs/astro2tsx@0.1.2", "", { "dependencies": { "@emnapi/core": "1.11.3", "@napi-rs/wasm-runtime": "1.2.4" } }, "sha512-Uj/M9zbrhu5cIZEvWAGTbQJRKSxXWJ/E59BZwt7F+chrKhbfttW+9rkS/l+1QxoJP1KU3UnpM62M7yszfAI0WA=="],
+
+    "@astrojs/check": ["@astrojs/check@0.9.10", "", { "dependencies": { "@astrojs/language-server": "^2.16.7", "chokidar": "^4.0.3", "kleur": "^4.1.5", "yargs": "^18.0.0" }, "peerDependencies": { "typescript": "^5.0.0 || ^6.0.0" }, "bin": { "astro-check": "./bin/astro-check.js" } }, "sha512-zgx/UQMozdjOa3bOxjgeCFdtpE3c9rRX6xHwa+2QXvy8z8Akifu2AtubHyv/zzC2znO8dl8fFWL4K+Ba9kS8HQ=="],
+
+    "@astrojs/compiler-binding": ["@astrojs/compiler-binding@0.4.1", "", { "optionalDependencies": { "@astrojs/compiler-binding-android-arm64": "0.4.1", "@astrojs/compiler-binding-darwin-arm64": "0.4.1", "@astrojs/compiler-binding-darwin-x64": "0.4.1", "@astrojs/compiler-binding-linux-arm64-gnu": "0.4.1", "@astrojs/compiler-binding-linux-arm64-musl": "0.4.1", "@astrojs/compiler-binding-linux-x64-gnu": "0.4.1", "@astrojs/compiler-binding-linux-x64-musl": "0.4.1", "@astrojs/compiler-binding-wasm32-wasi": "0.4.1", "@astrojs/compiler-binding-win32-arm64-msvc": "0.4.1", "@astrojs/compiler-binding-win32-x64-msvc": "0.4.1" } }, "sha512-ZYVDW1P58OXyxqZbOMp+/2U9KA7y2esIx9r4pWdpZ/l6fCZhaw4ul+D7EgpRVxYLkyTWqzANbTTUFGPFP8zDHA=="],
+
+    "@astrojs/compiler-binding-android-arm64": ["@astrojs/compiler-binding-android-arm64@0.4.1", "", { "os": "android", "cpu": "arm64" }, "sha512-Wtx2DZORuNTLASLLZ8hlrjFaJe1LUloatcCn9EPq7knBhRpjMGXeJANIJMeBZG4igvz7x+3nyAJM2iwCSW9xog=="],
+
+    "@astrojs/compiler-binding-darwin-arm64": ["@astrojs/compiler-binding-darwin-arm64@0.4.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-7iwXcU+hB60Y1SvOfnWHNioT72gDsDQKaDipXh2Onwp/TvQMozhbvhy13wJR8Af940a0h6PbddCeJFpj791UDA=="],
+
+    "@astrojs/compiler-binding-darwin-x64": ["@astrojs/compiler-binding-darwin-x64@0.4.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-pifjICos49RXhSVKSDu5gDB0/8j0O7DmxSp1DaWW2PyLG5ekwSkcrfOZto5JqhdI7QYMZB3XOiXpsdOXpS4npA=="],
+
+    "@astrojs/compiler-binding-linux-arm64-gnu": ["@astrojs/compiler-binding-linux-arm64-gnu@0.4.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-hsZMlNWc6LqWHh9LlSwTq1/XCY7pxA5rkkKIdZRV8mgbOz9OwLvjEoe5Jry13eIZjMUQO8XnQyzk8o/Pjw2YFA=="],
+
+    "@astrojs/compiler-binding-linux-arm64-musl": ["@astrojs/compiler-binding-linux-arm64-musl@0.4.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-a3EW27f+Z9uf57vYmpLgUriA1y9wDhKz57PT8D8XlFZt2HZEWhUxKuxI1jvKVI9p8okYee11WXEm/FHY1G9yoQ=="],
+
+    "@astrojs/compiler-binding-linux-x64-gnu": ["@astrojs/compiler-binding-linux-x64-gnu@0.4.1", "", { "os": "linux", "cpu": "x64" }, "sha512-XruPTKB/SS4DFzeAjQ1ZyM0ieHDjapHkOSnnzRApZ4FXY2YAI7UY3mETjfJiIS/acyZyrnPH5jObv1gATTdUJQ=="],
+
+    "@astrojs/compiler-binding-linux-x64-musl": ["@astrojs/compiler-binding-linux-x64-musl@0.4.1", "", { "os": "linux", "cpu": "x64" }, "sha512-E8j7lGanqNpudtkUbsFaOLJhmwFe4Ecqux7K9hkj4wULIPNZRM2bYZNcMSj8r1oWvaUiwZl8LaaNwv3+14jqhw=="],
+
+    "@astrojs/compiler-binding-wasm32-wasi": ["@astrojs/compiler-binding-wasm32-wasi@0.4.1", "", { "dependencies": { "@napi-rs/wasm-runtime": "^1.2.4" }, "cpu": "none" }, "sha512-vNLxIv41ZE+nmPFtw24cRW5ZXG+ZPcAGtgigtjCP8lvcxKI7u2GrXoMsCgEH5fMw8WCEJpwLvsVBg15rJKAkyA=="],
+
+    "@astrojs/compiler-binding-win32-arm64-msvc": ["@astrojs/compiler-binding-win32-arm64-msvc@0.4.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-/xTDgRsFDoTh0/+KFXJ74DY4Jqn8CoSHwa8UP5RAblHfnRHkenwfSl4zYDET61O9vXKLk09UzHjjq09yP20/AQ=="],
+
+    "@astrojs/compiler-binding-win32-x64-msvc": ["@astrojs/compiler-binding-win32-x64-msvc@0.4.1", "", { "os": "win32", "cpu": "x64" }, "sha512-0x5J6iHZO0Fjo/CVzoIbXKzWnGESftDbEUQ/oXQ61HhUAFoR7+T1jfToZSNAS+gYyBXHSTpMWYC7lzarbhClcg=="],
+
+    "@astrojs/compiler-rs": ["@astrojs/compiler-rs@0.4.1", "", { "dependencies": { "@astrojs/compiler-binding": "0.4.1" } }, "sha512-//NmAuRhy7eU9iP0ceI5Pymy55M+nUZ//kS6XeOyhBWdDib2KbJOyFaVJ52k7sDkJwTKVox7oPu3SpYiVnGm5A=="],
+
+    "@astrojs/internal-helpers": ["@astrojs/internal-helpers@0.11.0", "", { "dependencies": { "@types/hast": "^3.0.4", "@types/mdast": "^4.0.4", "js-yaml": "^4.3.0", "picomatch": "^4.0.4", "retext-smartypants": "^6.2.0", "shiki": "^4.0.2", "smol-toml": "^1.6.0", "unified": "^11.0.5" } }, "sha512-3rzxJ+xbo0+8YyqOzLziIN32wmsHdCjEVz2sGOpRxJ+Ben/KiLph4ItxBy1abEL+E8fkRzqjg0rfXmaHJGw9JA=="],
+
+    "@astrojs/language-server": ["@astrojs/language-server@2.17.1", "", { "dependencies": { "@astrojs/astro2tsx": "^0.1.0", "@astrojs/yaml2ts": "^0.2.4", "@volar/kit": "~2.4.28", "@volar/language-core": "~2.4.28", "@volar/language-server": "~2.4.28", "@volar/language-service": "~2.4.28", "muggle-string": "^0.4.1", "tinyglobby": "^0.2.17", "volar-service-css": "0.0.71", "volar-service-emmet": "0.0.71", "volar-service-html": "0.0.71", "volar-service-prettier": "0.0.71", "volar-service-typescript": "0.0.71", "volar-service-typescript-twoslash-queries": "0.0.71", "volar-service-yaml": "0.0.71", "vscode-html-languageservice": "^5.6.2", "vscode-uri": "^3.2.0" }, "peerDependencies": { "prettier": "^3.0.0", "prettier-plugin-astro": ">=0.11.0" }, "optionalPeers": ["prettier", "prettier-plugin-astro"], "bin": { "astro-ls": "./bin/nodeServer.js" } }, "sha512-gG7bvMVNIXgoSe1pM9dI1HsSDLU1EIc/dSAYQ0DuReLyLkOBjsiqvaRYgQltWaldLxh0bNEqjgreLfjd9OnUxQ=="],
+
+    "@astrojs/markdown-satteri": ["@astrojs/markdown-satteri@0.4.0", "", { "dependencies": { "@astrojs/internal-helpers": "0.11.0", "@astrojs/prism": "4.0.2", "github-slugger": "^2.0.0", "satteri": "^0.10.3" } }, "sha512-wykOOW9KsUVcZweOpY/CeXpdKcCKZy6fQbdcteWFuI75+sQCiqxYM7VKsGa5b+aGl3cYQscFY37rsbbyal5MRw=="],
+
+    "@astrojs/prism": ["@astrojs/prism@4.0.2", "", { "dependencies": { "prismjs": "^1.30.0" } }, "sha512-KTivpmnz6lDsC6o9H4+DNm2SrE/GHzw8cNAvEJwAvUT+eoaEnn/4NtbDNfRRaxaJHdp15gf+tfHAWiXR4wB3BA=="],
+
+    "@astrojs/sitemap": ["@astrojs/sitemap@3.7.4", "", { "dependencies": { "sitemap": "^9.0.0", "zod": "^4.3.6" } }, "sha512-LbKNC24bdUWcQf/pThB6qLlSqHojxGjZDURIzFocY8rlWnAn2t74nnhnK6S5x0NHriHoAduLEpVjRykmeGiVvA=="],
+
+    "@astrojs/telemetry": ["@astrojs/telemetry@3.3.3", "", { "dependencies": { "ci-info": "^4.4.0", "dset": "^3.1.4", "is-docker": "^4.0.0", "package-manager-detector": "^1.6.0" } }, "sha512-C1TLn5sPJr0x4vk56piHWKbnqlEB8BKyte5Y45V02U+D7BGO5eMqZDH5aPjnkXQWJggvmsTXxH03QMZ9NgWLzQ=="],
+
+    "@astrojs/yaml2ts": ["@astrojs/yaml2ts@0.2.4", "", { "dependencies": { "yaml": "^2.8.3" } }, "sha512-8oddpOae35pJsXPQXhTkM0ypfKPskVsh2bCxRtbf7e+/Epw2nReakFYpLKjZMEr75CsoF203PMnCocpfz0s69A=="],
+
+    "@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/parser": ["@babel/parser@7.29.9", "", { "dependencies": { "@babel/types": "^7.29.8" }, "bin": "./bin/babel-parser.js" }, "sha512-CjXrNHTnvqBVqHgdBysY3vk2T8tpJHb5/RMeHJBTyVa9xgugCB0CJTx/3oO8RV2QRQP391RWpB7D6hLjm8V9uA=="],
+
+    "@babel/types": ["@babel/types@7.29.8", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg=="],
+
+    "@bruits/satteri-darwin-arm64": ["@bruits/satteri-darwin-arm64@0.10.5", "", { "os": "darwin", "cpu": "arm64" }, "sha512-27KTVl4TJkVahMy/ohyA7qd4938G5UNneFUz/PsScYfpIhj0IVAS23mpcJXdPF44sa6nva198lmV/cKIb2YPyA=="],
+
+    "@bruits/satteri-darwin-x64": ["@bruits/satteri-darwin-x64@0.10.5", "", { "os": "darwin", "cpu": "x64" }, "sha512-IjnLe3nKspq6qaeqGgjT7MT8VrTV74yWRlaag7ZdNsI8TDAYZ0iPxMCo+9KQZHUk5EyVB+reBI/PFWL5KuFw9Q=="],
+
+    "@bruits/satteri-linux-arm64-gnu": ["@bruits/satteri-linux-arm64-gnu@0.10.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-glkYXZCJywjP13v67eAyAMSJdF+ncvEbYvgi/wOtffL9tQ27lr/zsyzUfgs+ovjJ9d8JNQKiXeiArJcX8PJL9w=="],
+
+    "@bruits/satteri-linux-arm64-musl": ["@bruits/satteri-linux-arm64-musl@0.10.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-yWdgG1g17Nh2QyGVlFUxGRa3FEFwiMcpZEyMNWkbM3deC94cmVc+/i9OuyFpdKuWo3GkgoCtYVOoxk1uCnCZIA=="],
+
+    "@bruits/satteri-linux-x64-gnu": ["@bruits/satteri-linux-x64-gnu@0.10.5", "", { "os": "linux", "cpu": "x64" }, "sha512-FVaLoPT1fBgGl0J+AYebyyXJYBachGl8Oyyrf1lye4RTqCB4S0Gwkj1uM9RJyThUOvx5VUmAT1CnNh1SFHA+kw=="],
+
+    "@bruits/satteri-linux-x64-musl": ["@bruits/satteri-linux-x64-musl@0.10.5", "", { "os": "linux", "cpu": "x64" }, "sha512-EHpVAx2bqW3GINHTKkljtxVfQmVDGWIuwOYOP5YghTj+0PkBa2o8oKPRtQ9Kbsr1Fye8jtUcDjhwj2jMNugZKg=="],
+
+    "@bruits/satteri-wasm32-wasi": ["@bruits/satteri-wasm32-wasi@0.10.5", "", { "dependencies": { "@emnapi/core": "1.11.1", "@emnapi/runtime": "1.11.1", "@napi-rs/wasm-runtime": "^1.2.3" }, "cpu": "none" }, "sha512-ypz8c/Zmipxp4IoeDa228Gstv6TLzVmNs3yC6wKCoNSOjx1iwpgzu87Y3hTkXFdwChVGU85qeUDuOIarGUZQLw=="],
+
+    "@bruits/satteri-win32-arm64-msvc": ["@bruits/satteri-win32-arm64-msvc@0.10.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-siTV88nb0LRqNpkL2gXboqCwVdq95sLtzMHS1/3eONV2gLbB3NAK46wmSMvCO/yquBvI2lvaFIfd8P12ecsxBw=="],
+
+    "@bruits/satteri-win32-x64-msvc": ["@bruits/satteri-win32-x64-msvc@0.10.5", "", { "os": "win32", "cpu": "x64" }, "sha512-C3IfPvfvMXmlzBxaMPKFS1XiuV9pu2mC7YqkPk7PSvTgPZ8gbdASIpHpztDLvTTQjqZ0z1Ol8tK5X+V6XXC0wQ=="],
+
+    "@capsizecss/unpack": ["@capsizecss/unpack@4.0.1", "", { "dependencies": { "fontkitten": "^1.0.3" } }, "sha512-CuNiSqg7+e1cO/GjffyMOm5Tt2jUF9CWHHnvQ/UkqvtkGfHdgwEC0wpmq7fkN3gxwpRnrAN0WzO3vREKmNolMQ=="],
+
+    "@clack/core": ["@clack/core@1.5.1", "", { "dependencies": { "fast-wrap-ansi": "^0.2.0", "sisteransi": "^1.0.5" } }, "sha512-iHTrHA8MtVuLl2TfZySmcKv1qO2PoyC9Z7pfSDozEuV5vtY3/wcOPKJXlqJ5Oq2Cx5DDGQGAMVx6HZfRRoVEbQ=="],
+
+    "@clack/prompts": ["@clack/prompts@1.8.1", "", { "dependencies": { "@clack/core": "1.5.1", "fast-string-width": "^3.0.2", "fast-wrap-ansi": "^0.2.0", "sisteransi": "^1.0.5" } }, "sha512-dlT1m5e/0yUL0kRNcQn7yGLVThkgbB0Ga/1AmfDDC/8ik6AIiSf2QLQO2zPYvefsHP0aFgxO93cVLCCfDp7kzQ=="],
+
+    "@emmetio/abbreviation": ["@emmetio/abbreviation@2.3.3", "", { "dependencies": { "@emmetio/scanner": "^1.0.4" } }, "sha512-mgv58UrU3rh4YgbE/TzgLQwJ3pFsHHhCLqY20aJq+9comytTXUDNGG/SMtSeMJdkpxgXSXunBGLD8Boka3JyVA=="],
+
+    "@emmetio/css-abbreviation": ["@emmetio/css-abbreviation@2.1.8", "", { "dependencies": { "@emmetio/scanner": "^1.0.4" } }, "sha512-s9yjhJ6saOO/uk1V74eifykk2CBYi01STTK3WlXWGOepyKa23ymJ053+DNQjpFcy1ingpaO7AxCcwLvHFY9tuw=="],
+
+    "@emmetio/css-parser": ["@emmetio/css-parser@0.4.1", "", { "dependencies": { "@emmetio/stream-reader": "^2.2.0", "@emmetio/stream-reader-utils": "^0.1.0" } }, "sha512-2bC6m0MV/voF4CTZiAbG5MWKbq5EBmDPKu9Sb7s7nVcEzNQlrZP6mFFFlIaISM8X6514H9shWMme1fCm8cWAfQ=="],
+
+    "@emmetio/html-matcher": ["@emmetio/html-matcher@1.3.0", "", { "dependencies": { "@emmetio/scanner": "^1.0.0" } }, "sha512-NTbsvppE5eVyBMuyGfVu2CRrLvo7J4YHb6t9sBFLyY03WYhXET37qA4zOYUjBWFCRHO7pS1B9khERtY0f5JXPQ=="],
+
+    "@emmetio/scanner": ["@emmetio/scanner@1.0.4", "", {}, "sha512-IqRuJtQff7YHHBk4G8YZ45uB9BaAGcwQeVzgj/zj8/UdOhtQpEIupUhSk8dys6spFIWVZVeK20CzGEnqR5SbqA=="],
+
+    "@emmetio/stream-reader": ["@emmetio/stream-reader@2.2.0", "", {}, "sha512-fXVXEyFA5Yv3M3n8sUGT7+fvecGrZP4k6FnWWMSZVQf69kAq0LLpaBQLGcPR30m3zMmKYhECP4k/ZkzvhEW5kw=="],
+
+    "@emmetio/stream-reader-utils": ["@emmetio/stream-reader-utils@0.1.0", "", {}, "sha512-ZsZ2I9Vzso3Ho/pjZFsmmZ++FWeEd/txqybHTm4OgaZzdS8V9V/YYWQwg5TC38Z7uLWUV1vavpLLbjJtKubR1A=="],
+
+    "@emnapi/core": ["@emnapi/core@1.11.3", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.3", "tslib": "^2.4.0" } }, "sha512-zLpS5asjEb7lq8jYLq37N6XKaE41DIexlY1rF/z4/tIl3wo13Sqm28fRyfIsKZD+NZ8mM5RoKkpW/rBcuoSZSg=="],
+
+    "@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="],
+
+    "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-ELEBe8PsLvvJ6QMr0zLt8ffvOHW/dc1m3CEzNMg7aJUv3bMaoDtw2TXyDAwkYBuroxxuHEwhRTLJSe5sya547g=="],
+
+    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.2", "", { "os": "aix", "cpu": "ppc64" }, "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ=="],
+
+    "@esbuild/android-arm": ["@esbuild/android-arm@0.28.2", "", { "os": "android", "cpu": "arm" }, "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg=="],
+
+    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.2", "", { "os": "android", "cpu": "arm64" }, "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A=="],
+
+    "@esbuild/android-x64": ["@esbuild/android-x64@0.28.2", "", { "os": "android", "cpu": "x64" }, "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q=="],
+
+    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw=="],
+
+    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw=="],
+
+    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw=="],
+
+    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg=="],
+
+    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.2", "", { "os": "linux", "cpu": "arm" }, "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w=="],
+
+    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug=="],
+
+    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.2", "", { "os": "linux", "cpu": "ia32" }, "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ=="],
+
+    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ=="],
+
+    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA=="],
+
+    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ=="],
+
+    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA=="],
+
+    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg=="],
+
+    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.2", "", { "os": "linux", "cpu": "x64" }, "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ=="],
+
+    "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw=="],
+
+    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.2", "", { "os": "none", "cpu": "x64" }, "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw=="],
+
+    "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.2", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ=="],
+
+    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw=="],
+
+    "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q=="],
+
+    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.2", "", { "os": "sunos", "cpu": "x64" }, "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g=="],
+
+    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ=="],
+
+    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.2", "", { "os": "win32", "cpu": "ia32" }, "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA=="],
+
+    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.2", "", { "os": "win32", "cpu": "x64" }, "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g=="],
+
+    "@fontsource/manrope": ["@fontsource/manrope@5.3.0", "", {}, "sha512-obJ1Dv3+uCA6HlHgW8u4BGYxJR9In2HW7gjJhlflEvkrj1X1iSEwu0fToL+JYGC/FEKFfIz1sBuPduvcL2gIAA=="],
+
+    "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="],
+
+    "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.4" }, "os": "darwin", "cpu": "arm64" }, "sha512-QRUlFQ0WxvdWyqqG/WtI3iupfD5rBzmCHXSdPsY91sAtVtTo7Q4cb6zOccZ3gqEqkr0f1As1ehLqmEpDsRf+lg=="],
+
+    "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.4" }, "os": "darwin", "cpu": "x64" }, "sha512-+BR255RhDlpygUpOc/Jdt1nT6DQ3XG/ERo5wbcdOf5Q320dKtPCKPLR1LJs9VGXRaMa8l1uUa0tkCNOXiAxZUw=="],
+
+    "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.5", "", { "dependencies": { "@img/sharp-wasm32": "0.35.5" }, "os": "freebsd" }, "sha512-Y/z91nEZ4uIBX5X3nfTovjU9lHNKFYbL2lpHCLVNmXQK03VIZvXBBt0KxbPGp2SdGSF+2mQU4e+hQaWOt86iAw=="],
+
+    "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-5R89nBYiRdUlSWJxPhO+GVtaXzXSxKnRu/xqMn3KTA3L9EB9Oy/P+Nn2f2vlhPuUdy/Zusb2DarbyTpGCfEDuw=="],
+
+    "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-iR2OKH80yi0U+dUplyh3/xdpFvps6YkCwsXenIJxqxR1v9o+xtKTGbS9H7cps+2Vxjc8B1j96p75NmTGjIhtpQ=="],
+
+    "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.4", "", { "os": "linux", "cpu": "arm" }, "sha512-LmRtTsOHuvM2+wlO2Db37dx5MiZhB0FvSunciw48YjdOkZz9KAiRbm8ujeMOA1INqmei5NapFxYEK1D1ZSidmw=="],
+
+    "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-Y3dgX/6lE2QhQb+Gxy0WZxfg9MEm/JBjamZpS2IklP7xIQoKN4hzAm7KcMVGtaVDt3neE9OKBC7vAfonA/Lr1A=="],
+
+    "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.4", "", { "os": "linux", "cpu": "ppc64" }, "sha512-Le6boB8Tai0Nis+gIxIpKx68UDVVIqdR8Tin5Yf1z2LJJQLDJvCDRqRu+jC2qCoD+eIomonmOwB4smBRxfVpYQ=="],
+
+    "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.4", "", { "os": "linux", "cpu": "none" }, "sha512-aHkkIEHPRdQEegJN20MLmGtxYD9R2wQr3Cwpddnu5+YKMt6Uzax7S9h5gpZTo8wyrGuZSlfQ63OevL5mTyOC7Q=="],
+
+    "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.4", "", { "os": "linux", "cpu": "s390x" }, "sha512-ra/mB6MikESDUO7Yg+Mi95bFBb9GsObURuhnOv3OqknjGe9sZrG8tCe9q0xSIGrtLgvgw0gKnFWcK4blSgQOuQ=="],
+
+    "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.4", "", { "os": "linux", "cpu": "x64" }, "sha512-GJ//SSXbnwSDes02umB3nDJLFcQzw8a18V8fyhqr6tV515tOEMdImjjxj1AoafMRz56F3PHgftnj1QEKSU1zkw=="],
+
+    "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-hvulFwtjUcagsis6BBxHwGFwWoNZjgYmULGVrZcyfNbjA8hKILbRxGg15/7w5HDyXHXUos/j6baAWqnCyQ2DWA=="],
+
+    "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.4", "", { "os": "linux", "cpu": "x64" }, "sha512-6zXKeE/p39I1AmA3cJG35eyBGNqNddLnUXjhwBnsGjFPWqf5VKkDBEqaEkPDoTEtkxwi2vv8Tcr2mDyP4So7Fg=="],
+
+    "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.4" }, "os": "linux", "cpu": "arm" }, "sha512-LEaXK2WdXVK5ykcw0buWyPMsmLLL2vpHLD6yrNSW+JGEL3BZPA4tpKN6iaMc4AxTTAoaX/sU1rOL51lcIz48ZQ=="],
+
+    "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.4" }, "os": "linux", "cpu": "arm64" }, "sha512-LYVx5JTsOM2CBzmxreh+nl64/3H6Xb09iSLknqH47z2T2DFFxDeFLP5y4dJwe6H7uGQlHPyEEtIqyo3DYsRwdQ=="],
+
+    "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.4" }, "os": "linux", "cpu": "ppc64" }, "sha512-QVxAAq8evVRI9ia2vqgwrmWucn5Dfv+JdWzj75pD8omHLPSP7f8p20O8jxzjCcuCEQEOtYOZUmX1hkiZ0kdevA=="],
+
+    "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.4" }, "os": "linux", "cpu": "none" }, "sha512-LtdreXguaavKODPIfzJ4kffx7UNt1omwtK0rch4EBbbSTXPnxWmYSayXdLJw0fJzQ97kHt1gL/yh4tvU+nCyRQ=="],
+
+    "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.4" }, "os": "linux", "cpu": "s390x" }, "sha512-UZasTOFiYzotTsGOCu42BfUzP6Tu6Do/947iRm1RsLKvlllxwGcn4RN27LibGWceix4Y+Pmw3jsnTcCQIgWjqA=="],
+
+    "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.4" }, "os": "linux", "cpu": "x64" }, "sha512-SxFtLTeJInhAA9Q836kux2vZNeOBQEx658qvbboZScr0wIARym3IcGmW7KpVD5sbVg0Ojy+udFQdayYIZyoNog=="],
+
+    "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.4" }, "os": "linux", "cpu": "arm64" }, "sha512-9HbMclmI1zlNkFRs3z9/eBtDjfD0sGlrX1z6b1qwmiFY5ElDLh4BC0LPBdVp7z1DXFiKlIcznf+ZlsuZzLxQqg=="],
+
+    "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.4" }, "os": "linux", "cpu": "x64" }, "sha512-4KOphqB035HrVdqLZfCgMzzERrQkkzOwRhl4OAkRO1YCldbaFjySXMaK534Mo0V+LndnlJk+sbUyLeU0ULyD1A=="],
+
+    "@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.5", "", { "dependencies": { "@emnapi/runtime": "^1.11.3" } }, "sha512-Ptsga1su4tQx+LLF1ECS9U6nz5kmrXKo6XVbtR48Ke3ZRxxgaWBu7IDtEe1quo8hiupwm6WFqxVlXaSf7IINGQ=="],
+
+    "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.5", "", { "dependencies": { "@img/sharp-wasm32": "0.35.5" }, "cpu": "none" }, "sha512-hfhF/FmoQyTUkA0bIKFOtw536BQSeBMe6BF6QyWlrPxT754+TFLaZ7sKKTfvvM0yJgKgaYTwnFCIZ/GuDw5SUA=="],
+
+    "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-X4t7g+7ZA5DKblCBEXGjUqqemj4vczING/5viFwAL8h4N3qYeyjwdCvRLHi4EdOUI+2Z7UFlp1VM+p/AuEtm6Q=="],
+
+    "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.5", "", { "os": "win32", "cpu": "ia32" }, "sha512-5Zm82LoBc43nhwNybZlG7Y1KO//Zhsn306fQl29ZOuStHLGTo3BWL83q3cznX0poxSAMuYL1On/BHBxkBeKr6A=="],
+
+    "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.5", "", { "os": "win32", "cpu": "x64" }, "sha512-x76eH0vEiHlcMQu8Y8IenntaACtddpT6W0wmXtWrnKcnKI7ME5DdgqhAD6SEWOEl1v2zDvkZDhFA9KnURwpfqg=="],
+
+    "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.6.0", "", {}, "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw=="],
+
+    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.2.4", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.4", "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.4" } }, "sha512-AJxoUD2/15ESHbvpcyjU274nsAPLuOtPHCk0vKJM5pj//Fg/B1FXNWjPnXTT9PymCYYiHo4zPj0ZomXBKhoy7g=="],
+
+    "@oslojs/encoding": ["@oslojs/encoding@1.1.0", "", {}, "sha512-70wQhgYmndg4GCPxPPxPGevRKqTIJ2Nh4OkiMWmDAVYsTQ+Ta7Sq+rPevXyXGdzr30/qZBnyOalCszoMxlyldQ=="],
+
+    "@oxc-project/types": ["@oxc-project/types@0.152.0", "", {}, "sha512-oM/5rLBm2tPkg0iBgkH/FOeR3PCDpY19GTgAZjMFM8h9WI9VW7cLgzp6nwtarYKmovavIQZ+Fe/RKX/8C8O/Rw=="],
+
+    "@prettier/parse-srcset": ["@prettier/parse-srcset@3.1.0", "", {}, "sha512-FIRv2rZotO9NP/r66taYqD1zICpPiBbrECqjKV/xqNotqDxF7fLzzUeK+1RSRx9Tenk0DajR/GcRmTJ2qtHaKQ=="],
+
+    "@rolldown/binding-android-arm-eabi": ["@rolldown/binding-android-arm-eabi@1.2.12", "", { "os": "android", "cpu": "arm" }, "sha512-dB/a1214qKfHMXCpgqR4OZT+jS4kTyEXbQGJPqzobt5EwH5rX080pxE37alt3RzvR1bf1Yz/yGqRfrYAxuPw0A=="],
+
+    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.2.12", "", { "os": "android", "cpu": "arm64" }, "sha512-7KHFgQ5VJxIHcLlrwrc3Xbds7oTNQT7Pgi9gQCJKrd2VGab/UksIOYp6VD8MzCstGxOKMgNamPwUCfxPdP1OHg=="],
+
+    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.2.12", "", { "os": "darwin", "cpu": "arm64" }, "sha512-3YIhqHD96nA5SaYNRBR16HnGv4oavZvXfD/ayHM+oYZ0WD/8lBAtf6zQua4kEyAvpqrluKXl0lnOBoiNby7x9w=="],
+
+    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.2.12", "", { "os": "darwin", "cpu": "x64" }, "sha512-UuuJ35MFw4gmFOrE9pEqIV+K3syIKveph+Qc1/ljHZVdoDW4pz/JHR/eMVom+TZGl/5OOvGJOWaOCVt3ZfqhxA=="],
+
+    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.2.12", "", { "os": "freebsd", "cpu": "x64" }, "sha512-uMvssit0a4W+/7D8CbHUvG719mH3R2jwXAlh/XcPvuHTE0g++LymF88DCGNX0HM2rBOn0xrzgXktIB6fLSJBTQ=="],
+
+    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.2.12", "", { "os": "linux", "cpu": "arm" }, "sha512-XcFu0R0xWnwzSf4IQgFH1rJIckPN1pLy2R+4r9IDB7Yfu/ys9cVqfa4pBrMHj7a3gl8mIR4nRNPg0e5IvEVs6g=="],
+
+    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.2.12", "", { "os": "linux", "cpu": "arm64" }, "sha512-260UrKgn8tz39ak+SMDOirKzr7V04M9dWPw5llW00SwBivCZoWcRBKV1d8cXnRkUmSZA3BdiUmBHWk7734Ulpw=="],
+
+    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.2.12", "", { "os": "linux", "cpu": "arm64" }, "sha512-5YK1I9SqDkbPgc1IA8BgDl34suqUS2q0KWnBrirm0E51YjOs6eo6dV6jbQfNE/argHRSvd0QUGgtpIoYx+WWpw=="],
+
+    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.2.12", "", { "os": "linux", "cpu": "ppc64" }, "sha512-Rkcrmp7eFRg74yL5fXEU91JEWbdEPLevWwGtXpmhbjlD1StScbWTmO94Bhly+Mo+ketKYkdmM1vNUKeWSlx8cQ=="],
+
+    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.2.12", "", { "os": "linux", "cpu": "s390x" }, "sha512-qvK4DuAsQc2BSjlx+Xr+IzOIvvxbGZqxFwdWfG6F518Erj0GGISyQbJ6pIappnOxlNPzNHvo/L0BwB30GZ+zVw=="],
+
+    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.2.12", "", { "os": "linux", "cpu": "x64" }, "sha512-Q9uLBO53Xd4QIq1WOycVQyPP1O4HhraEV2qqb3uTrnVw6QZih9duY4vNXOivL1xoUS1/z+W8eF4NMfl2a8Sdjw=="],
+
+    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.2.12", "", { "os": "linux", "cpu": "x64" }, "sha512-3IBxWFMjbOZskDPKv8Lf9BCnahlKuHthWkYnyIxOH/QcJrFcS4EmcenthApkwr/5+nEqZlLzeYbxeMaX7A5u4g=="],
+
+    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.2.12", "", { "os": "none", "cpu": "arm64" }, "sha512-xtX61xg4LKPkPWilZU1ynKClz5Gj4bf74LML4r3eVLWumKnGjoEr1OSHQhMdbBDoYTi+yjrujvpZe2pUnqCrrA=="],
+
+    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.2.12", "", { "os": "win32", "cpu": "arm64" }, "sha512-At7fPB6PCaIjzgIhEZFxuT+BBFqiQibJDT4d3PhiR3f4E7bbMZF4aKblbFfEM3sETRDd1YiQx/+U/g/B/ou5Ew=="],
+
+    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.2.12", "", { "os": "win32", "cpu": "x64" }, "sha512-WIw2haVKwjuYdXkHaoC0mF8Le71TuCBxjrdKqLbJGctbBABj+ClfmNvtbOnzpq3RokNo5+V1qhtSzJyXorsklQ=="],
+
+    "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.1", "", {}, "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw=="],
+
+    "@shikijs/core": ["@shikijs/core@4.5.0", "", { "dependencies": { "@shikijs/primitive": "4.5.0", "@shikijs/types": "4.5.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5", "hast-util-to-html": "^9.0.5" } }, "sha512-6CIgwq+bt2JZ3OSjb/nBkkwEf/CfpHcbam+Mg5Pllco7HAGRQ2/EFhZrrJtbyNTgKwknfVS+llsXGygiDGwJWw=="],
+
+    "@shikijs/engine-javascript": ["@shikijs/engine-javascript@4.5.0", "", { "dependencies": { "@shikijs/types": "4.5.0", "@shikijs/vscode-textmate": "^10.0.2", "oniguruma-to-es": "^4.3.6" } }, "sha512-Ed6UdEj84LyYkwnxM5CvSMWAD+id9ExTYri0/+x41U9zrgNifPSS9lZm0JqBP0VfYI8yr8tY5nbNq9+p9R0kFA=="],
+
+    "@shikijs/engine-oniguruma": ["@shikijs/engine-oniguruma@4.5.0", "", { "dependencies": { "@shikijs/types": "4.5.0", "@shikijs/vscode-textmate": "^10.0.2" } }, "sha512-dKVmbJecVdB9recl8a/CU4jdpNXyjJQrIcesIkpS70s5HS02ohpnCSpMUbotPnEUzbAcLQ+S4hwZYbkBBiTcJw=="],
+
+    "@shikijs/langs": ["@shikijs/langs@4.5.0", "", { "dependencies": { "@shikijs/types": "4.5.0" } }, "sha512-wwBTqwduXSz0X4v9Qa2EWeFaYJEw1clCncWjoRNQRbVDu3SPRTRWucnouYapKj3b8Q+sk/41Vbc4B5c8nuYzLA=="],
+
+    "@shikijs/primitive": ["@shikijs/primitive@4.5.0", "", { "dependencies": { "@shikijs/types": "4.5.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5" } }, "sha512-UM7ShlA8oz0OWxLLO8BmO9Ip6fVqdkt8yF0EH7nOCqHfrx1eEAzF0ZUVK7L+I8NEgeu1PEWSRlxaiPPeCb4iDg=="],
+
+    "@shikijs/themes": ["@shikijs/themes@4.5.0", "", { "dependencies": { "@shikijs/types": "4.5.0" } }, "sha512-zGb87H3UBbpuI4yoh5UguB1XbU+2BDU3kflM7UfZ+Cy2hWo9lBtqjSVK20gmLY6ukYl040hAypGXMgud9vul8Q=="],
+
+    "@shikijs/types": ["@shikijs/types@4.5.0", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5" } }, "sha512-drtPrtD8N0DENyD2cyt6Ajy+IWsiCLgMxODwLTpvH1UsN6a9jf90tNTPjqwHvA+0Lzu9e0txk8DjfqH1p9UJRw=="],
+
+    "@shikijs/vscode-textmate": ["@shikijs/vscode-textmate@10.0.2", "", {}, "sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg=="],
+
+    "@shuding/opentype.js": ["@shuding/opentype.js@1.4.0-beta.0", "", { "dependencies": { "fflate": "^0.7.3", "string.prototype.codepointat": "^0.2.1" }, "bin": { "ot": "bin/ot" } }, "sha512-3NgmNyH3l/Hv6EvsWJbsvpcpUba6R8IREQ83nH83cyakCw7uM1arZKNfHwv1Wz6jgqrF/j4x5ELvR6PnK9nTcA=="],
+
+    "@tybys/wasm-util": ["@tybys/wasm-util@0.10.4", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-W3c4gRigFS0T/Ma4qIYF3GDAc5AQdHb1yL5znJT1Zv1YaD9Kitx656wBjvr19qbiosmZT8lWDM5BEMynUqX65A=="],
+
+    "@types/bun": ["@types/bun@1.4.2", "", { "dependencies": { "bun-types": "1.4.2" } }, "sha512-GimotNn7+ZV0uVArItBbriZsR1oNf0+WTzPkdcFrzShI7k2norL0uzEaJT8T33dWr7O/c9ZDuAFQrctKCi72oQ=="],
+
+    "@types/estree": ["@types/estree@1.0.9", "", {}, "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg=="],
+
+    "@types/estree-jsx": ["@types/estree-jsx@1.0.5", "", { "dependencies": { "@types/estree": "*" } }, "sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg=="],
+
+    "@types/hast": ["@types/hast@3.0.5", "", { "dependencies": { "@types/unist": "*" } }, "sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g=="],
+
+    "@types/mdast": ["@types/mdast@4.0.4", "", { "dependencies": { "@types/unist": "*" } }, "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA=="],
+
+    "@types/nlcst": ["@types/nlcst@2.0.3", "", { "dependencies": { "@types/unist": "*" } }, "sha512-vSYNSDe6Ix3q+6Z7ri9lyWqgGhJTmzRjZRqyq15N0Z/1/UnVsno9G/N40NBijoYx2seFDIl0+B2mgAb9mezUCA=="],
+
+    "@types/node": ["@types/node@24.13.3", "", { "dependencies": { "undici-types": "~7.18.0" } }, "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q=="],
+
+    "@types/sax": ["@types/sax@1.2.7", "", { "dependencies": { "@types/node": "*" } }, "sha512-rO73L89PJxeYM3s3pPPjiPgVVcymqU490g0YO5n5By0k2Erzj6tay/4lr1CHAAU4JyOWd1rpQ8bCf6cZfHU96A=="],
+
+    "@types/unist": ["@types/unist@3.0.3", "", {}, "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q=="],
+
+    "@ungap/structured-clone": ["@ungap/structured-clone@1.4.0", "", {}, "sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ=="],
+
+    "@volar/kit": ["@volar/kit@2.4.28", "", { "dependencies": { "@volar/language-service": "2.4.28", "@volar/typescript": "2.4.28", "typesafe-path": "^0.2.2", "vscode-languageserver-textdocument": "^1.0.11", "vscode-uri": "^3.0.8" }, "peerDependencies": { "typescript": "*" } }, "sha512-cKX4vK9dtZvDRaAzeoUdaAJEew6IdxHNCRrdp5Kvcl6zZOqb6jTOfk3kXkIkG3T7oTFXguEMt5+9ptyqYR84Pg=="],
+
+    "@volar/language-core": ["@volar/language-core@2.4.28", "", { "dependencies": { "@volar/source-map": "2.4.28" } }, "sha512-w4qhIJ8ZSitgLAkVay6AbcnC7gP3glYM3fYwKV3srj8m494E3xtrCv6E+bWviiK/8hs6e6t1ij1s2Endql7vzQ=="],
+
+    "@volar/language-server": ["@volar/language-server@2.4.28", "", { "dependencies": { "@volar/language-core": "2.4.28", "@volar/language-service": "2.4.28", "@volar/typescript": "2.4.28", "path-browserify": "^1.0.1", "request-light": "^0.7.0", "vscode-languageserver": "^9.0.1", "vscode-languageserver-protocol": "^3.17.5", "vscode-languageserver-textdocument": "^1.0.11", "vscode-uri": "^3.0.8" } }, "sha512-NqcLnE5gERKuS4PUFwlhMxf6vqYo7hXtbMFbViXcbVkbZ905AIVWhnSo0ZNBC2V127H1/2zP7RvVOVnyITFfBw=="],
+
+    "@volar/language-service": ["@volar/language-service@2.4.28", "", { "dependencies": { "@volar/language-core": "2.4.28", "vscode-languageserver-protocol": "^3.17.5", "vscode-languageserver-textdocument": "^1.0.11", "vscode-uri": "^3.0.8" } }, "sha512-Rh/wYCZJrI5vCwMk9xyw/Z+MsWxlJY1rmMZPsxUoJKfzIRjS/NF1NmnuEcrMbEVGja00aVpCsInJfixQTMdvLw=="],
+
+    "@volar/source-map": ["@volar/source-map@2.4.28", "", {}, "sha512-yX2BDBqJkRXfKw8my8VarTyjv48QwxdJtvRgUpNE5erCsgEUdI2DsLbpa+rOQVAJYshY99szEcRDmyHbF10ggQ=="],
+
+    "@volar/typescript": ["@volar/typescript@2.4.28", "", { "dependencies": { "@volar/language-core": "2.4.28", "path-browserify": "^1.0.1", "vscode-uri": "^3.0.8" } }, "sha512-Ja6yvWrbis2QtN4ClAKreeUZPVYMARDYZl9LMEv1iQ1QdepB6wn0jTRxA9MftYmYa4DQ4k/DaSZpFPUfxl8giw=="],
+
+    "@vscode/emmet-helper": ["@vscode/emmet-helper@2.11.0", "", { "dependencies": { "emmet": "^2.4.3", "jsonc-parser": "^2.3.0", "vscode-languageserver-textdocument": "^1.0.1", "vscode-languageserver-types": "^3.15.1", "vscode-uri": "^3.0.8" } }, "sha512-QLxjQR3imPZPQltfbWRnHU6JecWTF1QSWhx3GAKQpslx7y3Dp6sIIXhKjiUJ/BR9FX8PVthjr9PD6pNwOJfAzw=="],
+
+    "@vscode/l10n": ["@vscode/l10n@0.0.18", "", {}, "sha512-KYSIHVmslkaCDyw013pphY+d7x1qV8IZupYfeIfzNA+nsaWHbn5uPuQRvdRFsa9zFzGeudPuoGoZ1Op4jrJXIQ=="],
+
+    "ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
+
+    "ajv-draft-04": ["ajv-draft-04@1.0.0", "", { "peerDependencies": { "ajv": "^8.5.0" }, "optionalPeers": ["ajv"] }, "sha512-mv00Te6nmYbRp5DCwclxtt7yV/joXJPGS7nM+97GdxvuttCOfgI3K4U25zboyeX0O+myI8ERluxQe5wljMmVIw=="],
+
+    "ajv-i18n": ["ajv-i18n@4.2.0", "", { "peerDependencies": { "ajv": "^8.0.0-beta.0" } }, "sha512-v/ei2UkCEeuKNXh8RToiFsUclmU+G57LO1Oo22OagNMENIw+Yb8eMwvHu7Vn9fmkjJyv6XclhJ8TbuigSglPkg=="],
+
+    "am-i-vibing": ["am-i-vibing@0.4.0", "", { "dependencies": { "process-ancestry": "^0.1.0" }, "bin": { "am-i-vibing": "dist/cli.mjs" } }, "sha512-MxT4XZL7pzLHpuvhDKdMaQHMGGkJDLluKBLsbstn+8wv9sWcFT6h+0ve9qkml95amVTZtZV83gQe2hY+ojgHLg=="],
+
+    "ansi-regex": ["ansi-regex@6.4.0", "", {}, "sha512-KzTVk2tCWAHtYrvvvaP8bJKJq2pVinhLcGEQdtLIYPbmNGNyYe8QwNaTUYQp2J7/vIsUKt5QCqAfUkYyG9DkOw=="],
+
+    "ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
+
+    "anymatch": ["anymatch@3.1.3", "", { "dependencies": { "normalize-path": "^3.0.0", "picomatch": "^2.0.4" } }, "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw=="],
+
+    "arg": ["arg@5.0.2", "", {}, "sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg=="],
+
+    "argparse": ["argparse@2.0.1", "", {}, "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="],
+
+    "aria-query": ["aria-query@5.3.2", "", {}, "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw=="],
+
+    "astro": ["astro@7.3.1", "", { "dependencies": { "@astrojs/compiler-rs": "^0.4.0", "@astrojs/internal-helpers": "0.11.0", "@astrojs/markdown-satteri": "0.4.0", "@astrojs/telemetry": "3.3.3", "@capsizecss/unpack": "^4.0.0", "@clack/prompts": "^1.1.0", "@oslojs/encoding": "^1.1.0", "am-i-vibing": "^0.4.0", "aria-query": "^5.3.2", "axobject-query": "^4.1.0", "ci-info": "^4.4.0", "clsx": "^2.1.1", "common-ancestor-path": "^2.0.0", "cookie": "^2.0.1", "devalue": "^5.8.1", "diff": "^9.0.0", "dset": "^3.1.4", "es-module-lexer": "^2.0.0", "esbuild": "^0.28.0", "find-proc": "0.1.0", "flattie": "^1.1.1", "fontace": "~0.4.1", "get-tsconfig": "5.0.0-beta.4", "github-slugger": "^2.0.0", "html-escaper": "3.0.3", "http-cache-semantics": "^4.2.0", "js-yaml": "^4.3.0", "jsonc-parser": "^3.3.1", "magic-string": "^1.0.0", "magicast": "^0.5.2", "mrmime": "^2.0.1", "neotraverse": "^1.0.1", "obug": "^2.1.1", "p-limit": "^7.3.0", "p-queue": "^9.1.0", "package-manager-detector": "^1.6.0", "piccolore": "^0.1.3", "picomatch": "^4.0.4", "semver": "^7.7.4", "shiki": "^4.0.2", "smol-toml": "^1.6.0", "svgo": "^4.0.1", "tinyclip": "^0.1.12", "tinyexec": "^1.0.4", "tinyglobby": "^0.2.15", "ultrahtml": "^1.6.0", "unifont": "~0.7.5", "unstorage": "^1.17.5", "vite": "^8.0.13", "vitefu": "^1.1.2", "xxhash-wasm": "^1.1.0", "yargs-parser": "^22.0.0", "zod": "^4.5.4" }, "optionalDependencies": { "sharp": "^0.35.4" }, "peerDependencies": { "@astrojs/markdown-remark": "^7.3.0" }, "optionalPeers": ["@astrojs/markdown-remark"], "bin": { "astro": "./bin/astro.mjs" } }, "sha512-A/bJYHtc6n0UAdROY9W948fW6lX0pnUA+JWKW+IGCXRyDIGN2MsXC0OlS8onZGJjr+sv8htemwOc9W5PBRXCkw=="],
+
+    "axobject-query": ["axobject-query@4.1.0", "", {}, "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ=="],
+
+    "bail": ["bail@2.0.2", "", {}, "sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw=="],
+
+    "base64-js": ["base64-js@0.0.8", "", {}, "sha512-3XSA2cR/h/73EzlXXdU6YNycmYI7+kicTxks4eJg2g39biHR84slg2+des+p7iHYhbRg/udIS4TD53WabcOUkw=="],
+
+    "boolbase": ["boolbase@1.0.0", "", {}, "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww=="],
+
+    "bun-types": ["bun-types@1.4.2", "", { "dependencies": { "@types/node": "*" } }, "sha512-bxV1FgK7yBIzjRe5zBozIM4Bem11ZJcCXSrjWRG3YWLt8yFDePu4cLjpebO8OvPeIE9trbyPF4fuj3Cia4Fj3w=="],
+
+    "camelize": ["camelize@1.0.1", "", {}, "sha512-dU+Tx2fsypxTgtLoE36npi3UqcjSSMNYfkqgmoEhtZrraP5VWq0K7FkWVTYa8eMPtnU/G2txVsfdCJTn9uzpuQ=="],
+
+    "ccount": ["ccount@2.0.1", "", {}, "sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg=="],
+
+    "character-entities-html4": ["character-entities-html4@2.1.0", "", {}, "sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA=="],
+
+    "character-entities-legacy": ["character-entities-legacy@3.0.0", "", {}, "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ=="],
+
+    "chokidar": ["chokidar@4.0.3", "", { "dependencies": { "readdirp": "^4.0.1" } }, "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA=="],
+
+    "ci-info": ["ci-info@4.4.0", "", {}, "sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg=="],
+
+    "cliui": ["cliui@9.0.1", "", { "dependencies": { "string-width": "^7.2.0", "strip-ansi": "^7.1.0", "wrap-ansi": "^9.0.0" } }, "sha512-k7ndgKhwoQveBL+/1tqGJYNz097I7WOvwbmmU2AR5+magtbjPWQTS1C5vzGkBC8Ym8UWRzfKUzUUqFLypY4Q+w=="],
+
+    "clsx": ["clsx@2.1.1", "", {}, "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA=="],
+
+    "color-name": ["color-name@1.1.4", "", {}, "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="],
+
+    "comma-separated-tokens": ["comma-separated-tokens@2.0.3", "", {}, "sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg=="],
+
+    "commander": ["commander@11.1.0", "", {}, "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ=="],
+
+    "common-ancestor-path": ["common-ancestor-path@2.0.0", "", {}, "sha512-dnN3ibLeoRf2HNC+OlCiNc5d2zxbLJXOtiZUudNFSXZrNSydxcCsSpRzXwfu7BBWCIfHPw+xTayeBvJCP/D8Ng=="],
+
+    "cookie": ["cookie@2.0.1", "", {}, "sha512-yuToqVvRrj6pfDXREyQAAv8SkAEk/8GS3jQRTiUMm66TVtBYmqQeoEjL2Lmq8Rpo6271vH76InTChTitEAm65w=="],
+
+    "cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
+
+    "crossws": ["crossws@0.3.5", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA=="],
+
+    "css-background-parser": ["css-background-parser@0.1.0", "", {}, "sha512-2EZLisiZQ+7m4wwur/qiYJRniHX4K5Tc9w93MT3AS0WS1u5kaZ4FKXlOTBhOjc+CgEgPiGY+fX1yWD8UwpEqUA=="],
+
+    "css-box-shadow": ["css-box-shadow@1.0.0-3", "", {}, "sha512-9jaqR6e7Ohds+aWwmhe6wILJ99xYQbfmK9QQB9CcMjDbTxPZjwEmUQpU91OG05Xgm8BahT5fW+svbsQGjS/zPg=="],
+
+    "css-color-keywords": ["css-color-keywords@1.0.0", "", {}, "sha512-FyyrDHZKEjXDpNJYvVsV960FiqQyXc/LlYmsxl2BcdMb2WPx0OGRVgTg55rPSyLSNMqP52R9r8geSp7apN3Ofg=="],
+
+    "css-gradient-parser": ["css-gradient-parser@0.0.17", "", {}, "sha512-w2Xy9UMMwlKtou0vlRnXvWglPAceXCTtcmVSo8ZBUvqCV5aXEFP/PC6d+I464810I9FT++UACwTD5511bmGPUg=="],
+
+    "css-select": ["css-select@6.0.0", "", { "dependencies": { "boolbase": "^1.0.0", "css-what": "^7.0.0", "domhandler": "^5.0.3", "domutils": "^3.2.2", "nth-check": "^2.1.1" } }, "sha512-rZZVSLle8v0+EY8QAkDWrKhpgt6SA5OtHsgBnsj6ZaLb5dmDVOWUDtQitd9ydxxvEjhewNudS6eTVU7uOyzvXw=="],
+
+    "css-to-react-native": ["css-to-react-native@3.2.0", "", { "dependencies": { "camelize": "^1.0.0", "css-color-keywords": "^1.0.0", "postcss-value-parser": "^4.0.2" } }, "sha512-e8RKaLXMOFii+02mOlqwjbD00KSEKqblnpO9e++1aXS1fPQOpS1YoqdVHBqPjHNoxeF2mimzVqawm2KCbEdtHQ=="],
+
+    "css-tree": ["css-tree@3.2.1", "", { "dependencies": { "mdn-data": "2.27.1", "source-map-js": "^1.2.1" } }, "sha512-X7sjQzceUhu1u7Y/ylrRZFU2FS6LRiFVp6rKLPg23y3x3c3DOKAwuXGDp+PAGjh6CSnCjYeAul8pcT8bAl+lSA=="],
+
+    "css-what": ["css-what@7.0.0", "", {}, "sha512-wD5oz5xibMOPHzy13CyGmogB3phdvcDaB5t0W/Nr5Z2O/agcB8YwOz6e2Lsp10pNDzBoDO9nVa3RGs/2BttpHQ=="],
+
+    "csso": ["csso@5.0.5", "", { "dependencies": { "css-tree": "~2.2.0" } }, "sha512-0LrrStPOdJj+SPCCrGhzryycLjwcgUSHBtxNA8aIDxf0GLsRh1cKYhB00Gd1lDOS4yGH69+SNn13+TWbVHETFQ=="],
+
+    "defu": ["defu@6.1.7", "", {}, "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ=="],
+
+    "dequal": ["dequal@2.0.3", "", {}, "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA=="],
+
+    "destr": ["destr@2.0.5", "", {}, "sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA=="],
+
+    "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
+
+    "devalue": ["devalue@5.9.3", "", {}, "sha512-xRumYOCUZN/EesqHEU3WOXanOZNvfZFZ/o1AHVFDX1yI0UAkZkOgDXt341CzKoBVIkgQba55/+DjGBKrIoKcHw=="],
+
+    "devlop": ["devlop@1.1.0", "", { "dependencies": { "dequal": "^2.0.0" } }, "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA=="],
+
+    "diff": ["diff@9.0.0", "", {}, "sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw=="],
+
+    "dom-serializer": ["dom-serializer@2.0.0", "", { "dependencies": { "domelementtype": "^2.3.0", "domhandler": "^5.0.2", "entities": "^4.2.0" } }, "sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg=="],
+
+    "domelementtype": ["domelementtype@2.3.0", "", {}, "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw=="],
+
+    "domhandler": ["domhandler@5.0.3", "", { "dependencies": { "domelementtype": "^2.3.0" } }, "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w=="],
+
+    "domutils": ["domutils@3.2.2", "", { "dependencies": { "dom-serializer": "^2.0.0", "domelementtype": "^2.3.0", "domhandler": "^5.0.3" } }, "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw=="],
+
+    "dset": ["dset@3.1.4", "", {}, "sha512-2QF/g9/zTaPDc3BjNcVTGoBbXBgYfMTTceLaYcFJ/W9kggFUkhxD/hMEeuLKbugyef9SqAx8cpgwlIP/jinUTA=="],
+
+    "emmet": ["emmet@2.4.11", "", { "dependencies": { "@emmetio/abbreviation": "^2.3.3", "@emmetio/css-abbreviation": "^2.1.8" } }, "sha512-23QPJB3moh/U9sT4rQzGgeyyGIrcM+GH5uVYg2C6wZIxAIJq7Ng3QLT79tl8FUwDXhyq9SusfknOrofAKqvgyQ=="],
+
+    "emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
+
+    "emoji-regex-xs": ["emoji-regex-xs@2.0.1", "", {}, "sha512-1QFuh8l7LqUcKe24LsPUNzjrzJQ7pgRwp1QMcZ5MX6mFplk2zQ08NVCM84++1cveaUUYtcCYHmeFEuNg16sU4g=="],
+
+    "entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],
+
+    "es-module-lexer": ["es-module-lexer@2.3.2", "", {}, "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw=="],
+
+    "esbuild": ["esbuild@0.28.2", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.2", "@esbuild/android-arm": "0.28.2", "@esbuild/android-arm64": "0.28.2", "@esbuild/android-x64": "0.28.2", "@esbuild/darwin-arm64": "0.28.2", "@esbuild/darwin-x64": "0.28.2", "@esbuild/freebsd-arm64": "0.28.2", "@esbuild/freebsd-x64": "0.28.2", "@esbuild/linux-arm": "0.28.2", "@esbuild/linux-arm64": "0.28.2", "@esbuild/linux-ia32": "0.28.2", "@esbuild/linux-loong64": "0.28.2", "@esbuild/linux-mips64el": "0.28.2", "@esbuild/linux-ppc64": "0.28.2", "@esbuild/linux-riscv64": "0.28.2", "@esbuild/linux-s390x": "0.28.2", "@esbuild/linux-x64": "0.28.2", "@esbuild/netbsd-arm64": "0.28.2", "@esbuild/netbsd-x64": "0.28.2", "@esbuild/openbsd-arm64": "0.28.2", "@esbuild/openbsd-x64": "0.28.2", "@esbuild/openharmony-arm64": "0.28.2", "@esbuild/sunos-x64": "0.28.2", "@esbuild/win32-arm64": "0.28.2", "@esbuild/win32-ia32": "0.28.2", "@esbuild/win32-x64": "0.28.2" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA=="],
+
+    "escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="],
+
+    "escape-html": ["escape-html@1.0.3", "", {}, "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow=="],
+
+    "eventemitter3": ["eventemitter3@5.0.4", "", {}, "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw=="],
+
+    "extend": ["extend@3.0.2", "", {}, "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g=="],
+
+    "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="],
+
+    "fast-string-truncated-width": ["fast-string-truncated-width@3.0.3", "", {}, "sha512-0jjjIEL6+0jag3l2XWWizO64/aZVtpiGE3t0Zgqxv0DPuxiMjvB3M24fCyhZUO4KomJQPj3LTSUnDP3GpdwC0g=="],
+
+    "fast-string-width": ["fast-string-width@3.0.2", "", { "dependencies": { "fast-string-truncated-width": "^3.0.2" } }, "sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg=="],
+
+    "fast-uri": ["fast-uri@3.1.8", "", {}, "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg=="],
+
+    "fast-wrap-ansi": ["fast-wrap-ansi@0.2.2", "", { "dependencies": { "fast-string-width": "^3.0.2" } }, "sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q=="],
+
+    "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="],
+
+    "fflate": ["fflate@0.8.3", "", {}, "sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA=="],
+
+    "find-proc": ["find-proc@0.1.0", "", {}, "sha512-OaOpEYv2PiQ7SQ5LIrl+deA1XaWcxEjnpM6VuWXTUvn+teIXxeFTLDmu18/zDQpFmHN4o3oDBX+BT0AGwEhemg=="],
+
+    "flattie": ["flattie@1.1.1", "", {}, "sha512-9UbaD6XdAL97+k/n+N7JwX46K/M6Zc6KcFYskrYL8wbBV/Uyk0CTAMY0VT+qiK5PM7AIc9aTWYtq65U7T+aCNQ=="],
+
+    "fontace": ["fontace@0.4.1", "", { "dependencies": { "fontkitten": "^1.0.2" } }, "sha512-lDMvbAzSnHmbYMTEld5qdtvNH2/pWpICOqpean9IgC7vUbUJc3k+k5Dokp85CegamqQpFbXf0rAVkbzpyTA8aw=="],
+
+    "fontkitten": ["fontkitten@1.0.3", "", { "dependencies": { "tiny-inflate": "^1.0.3" } }, "sha512-Wp1zXWPVUPBmfoa3Cqc9ctaKuzKAV6uLstRqlR56kSjplf5uAce+qeyYym7F+PHbGTk+tCEdkCW6RD7DX/gBZw=="],
+
+    "fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="],
+
+    "get-caller-file": ["get-caller-file@2.0.5", "", {}, "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg=="],
+
+    "get-east-asian-width": ["get-east-asian-width@1.7.0", "", {}, "sha512-XjH1AECxf0giL2V1aU8vKyRR2ppRUb5c0EvT7zuJTokQ74bNo52zOtghqdWIqrhUD79fo3x0WfKZdOqxF6LG1Q=="],
+
+    "get-tsconfig": ["get-tsconfig@5.0.0-beta.4", "", { "dependencies": { "resolve-pkg-maps": "^1.0.0" } }, "sha512-7nF7C9fIPFEMHgEMEfgIlO9wDdZ8CyHw27rWciFZfHvHDReIiPhsYuzPRXsfvBCqFy1l8RRyyWV7QLM+ZhUJsQ=="],
+
+    "github-slugger": ["github-slugger@2.0.0", "", {}, "sha512-IaOQ9puYtjrkq7Y0Ygl9KDZnrf/aiUJYUpVf89y8kyaxbRG7Y1SrX/jaumrv81vc61+kiMempujsM3Yw7w5qcw=="],
+
+    "h3": ["h3@1.15.11", "", { "dependencies": { "cookie-es": "^1.2.3", "crossws": "^0.3.5", "defu": "^6.1.6", "destr": "^2.0.5", "iron-webcrypto": "^1.2.1", "node-mock-http": "^1.0.4", "radix3": "^1.1.2", "ufo": "^1.6.3", "uncrypto": "^0.1.3" } }, "sha512-L3THSe2MPeBwgIZVSH5zLdBBU90TOxarvhK9d04IDY2AmVS8j2Jz2LIWtwsGOU3lu2I5jCN7FNvVfY2+XyF+mg=="],
+
+    "harfbuzzjs": ["harfbuzzjs@0.10.0", "", {}, "sha512-SN8LVwCOzvTq3OPNd0+EAghgXugItz56wst567D1vs7LnnKGWprhi3EG58aVOBwhN8HEbQxL4I9NDWkcXUutRw=="],
+
+    "hast-util-to-html": ["hast-util-to-html@9.0.5", "", { "dependencies": { "@types/hast": "^3.0.0", "@types/unist": "^3.0.0", "ccount": "^2.0.0", "comma-separated-tokens": "^2.0.0", "hast-util-whitespace": "^3.0.0", "html-void-elements": "^3.0.0", "mdast-util-to-hast": "^13.0.0", "property-information": "^7.0.0", "space-separated-tokens": "^2.0.0", "stringify-entities": "^4.0.0", "zwitch": "^2.0.4" } }, "sha512-OguPdidb+fbHQSU4Q4ZiLKnzWo8Wwsf5bZfbvu7//a9oTYoqD/fWpe96NuHkoS9h0ccGOTe0C4NGXdtS0iObOw=="],
+
+    "hast-util-whitespace": ["hast-util-whitespace@3.0.0", "", { "dependencies": { "@types/hast": "^3.0.0" } }, "sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw=="],
+
+    "hex-rgb": ["hex-rgb@4.3.0", "", {}, "sha512-Ox1pJVrDCyGHMG9CFg1tmrRUMRPRsAWYc/PinY0XzJU4K7y7vjNoLKIQ7BR5UJMCxNN8EM1MNDmHWA/B3aZUuw=="],
+
+    "html-escaper": ["html-escaper@3.0.3", "", {}, "sha512-RuMffC89BOWQoY0WKGpIhn5gX3iI54O6nRA0yC124NYVtzjmFWBIiFd8M0x+ZdX0P9R4lADg1mgP8C7PxGOWuQ=="],
+
+    "html-void-elements": ["html-void-elements@3.0.0", "", {}, "sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg=="],
+
+    "http-cache-semantics": ["http-cache-semantics@4.2.0", "", {}, "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ=="],
+
+    "iron-webcrypto": ["iron-webcrypto@1.2.1", "", {}, "sha512-feOM6FaSr6rEABp/eDfVseKyTMDt+KGpeB35SkVn9Tyn0CqvVsY3EwI0v5i8nMHyJnzCIQf7nsy3p41TPkJZhg=="],
+
+    "is-docker": ["is-docker@4.0.0", "", { "bin": { "is-docker": "cli.js" } }, "sha512-LHE+wROyG/Y/0ZnbktRCoTix2c1RhgWaZraMZ8o1Q7zCh0VSrICJQO5oqIIISrcSBtrXv0o233w1IYwsWCjTzA=="],
+
+    "is-plain-obj": ["is-plain-obj@4.1.0", "", {}, "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg=="],
+
+    "js-yaml": ["js-yaml@4.3.2", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA=="],
+
+    "json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
+
+    "jsonc-parser": ["jsonc-parser@3.3.1", "", {}, "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ=="],
+
+    "kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="],
+
+    "lightningcss": ["lightningcss@1.33.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.33.0", "lightningcss-darwin-arm64": "1.33.0", "lightningcss-darwin-x64": "1.33.0", "lightningcss-freebsd-x64": "1.33.0", "lightningcss-linux-arm-gnueabihf": "1.33.0", "lightningcss-linux-arm64-gnu": "1.33.0", "lightningcss-linux-arm64-musl": "1.33.0", "lightningcss-linux-x64-gnu": "1.33.0", "lightningcss-linux-x64-musl": "1.33.0", "lightningcss-win32-arm64-msvc": "1.33.0", "lightningcss-win32-x64-msvc": "1.33.0" } }, "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA=="],
+
+    "lightningcss-android-arm64": ["lightningcss-android-arm64@1.33.0", "", { "os": "android", "cpu": "arm64" }, "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg=="],
+
+    "lightningcss-darwin-arm64": ["lightningcss-darwin-arm64@1.33.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg=="],
+
+    "lightningcss-darwin-x64": ["lightningcss-darwin-x64@1.33.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ=="],
+
+    "lightningcss-freebsd-x64": ["lightningcss-freebsd-x64@1.33.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg=="],
+
+    "lightningcss-linux-arm-gnueabihf": ["lightningcss-linux-arm-gnueabihf@1.33.0", "", { "os": "linux", "cpu": "arm" }, "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ=="],
+
+    "lightningcss-linux-arm64-gnu": ["lightningcss-linux-arm64-gnu@1.33.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg=="],
+
+    "lightningcss-linux-arm64-musl": ["lightningcss-linux-arm64-musl@1.33.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ=="],
+
+    "lightningcss-linux-x64-gnu": ["lightningcss-linux-x64-gnu@1.33.0", "", { "os": "linux", "cpu": "x64" }, "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg=="],
+
+    "lightningcss-linux-x64-musl": ["lightningcss-linux-x64-musl@1.33.0", "", { "os": "linux", "cpu": "x64" }, "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw=="],
+
+    "lightningcss-win32-arm64-msvc": ["lightningcss-win32-arm64-msvc@1.33.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA=="],
+
+    "lightningcss-win32-x64-msvc": ["lightningcss-win32-x64-msvc@1.33.0", "", { "os": "win32", "cpu": "x64" }, "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA=="],
+
+    "linebreak": ["linebreak@1.1.0", "", { "dependencies": { "base64-js": "0.0.8", "unicode-trie": "^2.0.0" } }, "sha512-MHp03UImeVhB7XZtjd0E4n6+3xr5Dq/9xI/5FptGk5FrbDR3zagPa2DS6U8ks/3HjbKWG9Q1M2ufOzxV2qLYSQ=="],
+
+    "lru-cache": ["lru-cache@11.5.3", "", {}, "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg=="],
+
+    "magic-string": ["magic-string@1.4.2", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.6.0" } }, "sha512-vG+rjFRj1PqdIBozIxAGMjPlOhaVe+GXpbttY/iSK7rGcJRMlwNJO7dcUwmUqkymsFLJiNGI06t4D7Fr7yRC9g=="],
+
+    "magicast": ["magicast@0.5.5", "", { "dependencies": { "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7", "source-map-js": "^1.2.1" } }, "sha512-UicdXN8zQ3JHlxVq+28afMXPr1z7WNY6+7EJnzTdQWkTAlMLF5fNCCKxJHBQwGaNGR11581EiQmQzx73+MvszA=="],
+
+    "mdast-util-to-hast": ["mdast-util-to-hast@13.2.1", "", { "dependencies": { "@types/hast": "^3.0.0", "@types/mdast": "^4.0.0", "@ungap/structured-clone": "^1.0.0", "devlop": "^1.0.0", "micromark-util-sanitize-uri": "^2.0.0", "trim-lines": "^3.0.0", "unist-util-position": "^5.0.0", "unist-util-visit": "^5.0.0", "vfile": "^6.0.0" } }, "sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA=="],
+
+    "mdn-data": ["mdn-data@2.27.1", "", {}, "sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ=="],
+
+    "micromark-util-character": ["micromark-util-character@2.1.1", "", { "dependencies": { "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q=="],
+
+    "micromark-util-encode": ["micromark-util-encode@2.0.1", "", {}, "sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw=="],
+
+    "micromark-util-sanitize-uri": ["micromark-util-sanitize-uri@2.0.1", "", { "dependencies": { "micromark-util-character": "^2.0.0", "micromark-util-encode": "^2.0.0", "micromark-util-symbol": "^2.0.0" } }, "sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ=="],
+
+    "micromark-util-symbol": ["micromark-util-symbol@2.0.1", "", {}, "sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q=="],
+
+    "micromark-util-types": ["micromark-util-types@2.0.3", "", {}, "sha512-oxB2Ik03hI0gv+VNn9tnh1t1YEe9MDPptViAEgfdf3YQHsn0pzGTgCdlSCJXcwhqm8phaEuM7zeEu3QQzVBrPg=="],
+
+    "mrmime": ["mrmime@2.0.1", "", {}, "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ=="],
+
+    "muggle-string": ["muggle-string@0.4.1", "", {}, "sha512-VNTrAak/KhO2i8dqqnqnAHOa3cYBwXEZe9h+D5h/1ZqFSTEFHdM65lR7RoIqq3tBBYavsOXV84NoHXZ0AkPyqQ=="],
+
+    "nanoid": ["nanoid@3.3.19", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug=="],
+
+    "neotraverse": ["neotraverse@1.0.1", "", {}, "sha512-WmmLty1YWwJl9yZi77v2dVIV6X2kuYV8YYBI/G3LWGKdGHmHUvL1z7FW0iDvEvGAwNEoc5x1tOOOyDnf5jJw/w=="],
+
+    "nlcst-to-string": ["nlcst-to-string@4.0.0", "", { "dependencies": { "@types/nlcst": "^2.0.0" } }, "sha512-YKLBCcUYKAg0FNlOBT6aI91qFmSiFKiluk655WzPF+DDMA02qIyy8uiRqI8QXtcFpEvll12LpL5MXqEmAZ+dcA=="],
+
+    "node-fetch-native": ["node-fetch-native@1.6.7", "", {}, "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q=="],
+
+    "node-mock-http": ["node-mock-http@1.0.5", "", {}, "sha512-KQyt/wLjG3TAc7DOUhpqWzgd4ERxR80JOlTK5VE5R1S12IaPVN5qkj4klBce9HPG1Njuup4Sb5bljaT34lIyjw=="],
+
+    "normalize-path": ["normalize-path@3.0.0", "", {}, "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA=="],
+
+    "nth-check": ["nth-check@2.1.1", "", { "dependencies": { "boolbase": "^1.0.0" } }, "sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w=="],
+
+    "obug": ["obug@2.2.1", "", {}, "sha512-XrsrhT5sybtKI6wakr2SPOlGZWWYbUXZ7a0jT8/QOeAPau+1X/bSegNe5YR75oJmEZQbKningirmGOEJCIk61Q=="],
+
+    "ofetch": ["ofetch@1.5.1", "", { "dependencies": { "destr": "^2.0.5", "node-fetch-native": "^1.6.7", "ufo": "^1.6.1" } }, "sha512-2W4oUZlVaqAPAil6FUg/difl6YhqhUR7x2eZY4bQCko22UXg3hptq9KLQdqFClV+Wu85UX7hNtdGTngi/1BxcA=="],
+
+    "ohash": ["ohash@2.0.12", "", {}, "sha512-65S/5gk9YSsaRjcyf7Nfa6h/d3E8/1gslpXfI4W7Dxn/oap8IKRuNT5VXkLQ1YFKIEg4apRY4Pj6aiwFzrDdmw=="],
+
+    "oniguruma-parser": ["oniguruma-parser@0.12.2", "", {}, "sha512-6HVa5oIrgMC6aA6WF6XyyqbhRPJrKR02L20+2+zpDtO5QAzGHAUGw5TKQvwi5vctNnRHkJYmjAhRVQF2EKdTQw=="],
+
+    "oniguruma-to-es": ["oniguruma-to-es@4.3.6", "", { "dependencies": { "oniguruma-parser": "^0.12.2", "regex": "^6.1.0", "regex-recursion": "^6.0.2" } }, "sha512-csuQ9x3Yr0cEIs/Zgx/OEt9iBw9vqIunAPQkx19R/fiMq2oGVTgcMqO/V3Ybqefr1TBvosI6jU539ksaBULJyA=="],
+
+    "p-limit": ["p-limit@7.3.3", "", { "dependencies": { "yocto-queue": "^1.2.1" } }, "sha512-SKgVvDU5TNIxQ4r30U75BNLC6a+6GOEjngrk/ysM5+Zu3oJuk1SC5ApzIzY/7PjCEjoVPMWJ0zho/4QUiEB7TQ=="],
+
+    "p-queue": ["p-queue@9.3.3", "", { "dependencies": { "eventemitter3": "^5.0.4", "p-timeout": "^7.0.0" } }, "sha512-NXAOdnEe5FsZJfT4oK84lE1Y5cFFdWlRuOo5tww8DyNMxyRXwn39fIkUtNLKppcPC+UYU/bXujNCUGDv01y7CA=="],
+
+    "p-timeout": ["p-timeout@7.0.2", "", {}, "sha512-prbX4Z3YszrFNgH+MW5Zoeq3baXrMtP/MQnFeET90UB/GtGcGDQ5Usg9OCy6ETjTTntOw1SL2z9fMPUppN3Guw=="],
+
+    "package-manager-detector": ["package-manager-detector@1.8.0", "", {}, "sha512-yQA4H19AmPEoMUeavPMDIe1higySl/gH/yaQrkT/s07Qp+7pp2hYz30N3z2l5BkjVkF9Ow6o0wjJamm2y7Sn0A=="],
+
+    "pako": ["pako@0.2.9", "", {}, "sha512-NUcwaKxUxWrZLpDG+z/xZaCgQITkA/Dv4V/T6bw7VON6l1Xz/VnrBqrYjZQ12TamKHzITTfOEIYUj48y2KXImA=="],
+
+    "parse-css-color": ["parse-css-color@0.2.1", "", { "dependencies": { "color-name": "^1.1.4", "hex-rgb": "^4.1.0" } }, "sha512-bwS/GGIFV3b6KS4uwpzCFj4w297Yl3uqnSgIPsoQkx7GMLROXfMnWvxfNkL0oh8HVhZA4hvJoEoEIqonfJ3BWg=="],
+
+    "path-browserify": ["path-browserify@1.0.1", "", {}, "sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g=="],
+
+    "piccolore": ["piccolore@0.1.3", "", {}, "sha512-o8bTeDWjE086iwKrROaDf31K0qC/BENdm15/uH9usSC/uZjJOKb2YGiVHfLY4GhwsERiPI1jmwI2XrA7ACOxVw=="],
+
+    "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
+
+    "picomatch": ["picomatch@4.0.7", "", {}, "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA=="],
+
+    "postcss": ["postcss@8.5.23", "", { "dependencies": { "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg=="],
+
+    "postcss-value-parser": ["postcss-value-parser@4.2.0", "", {}, "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ=="],
+
+    "prettier": ["prettier@3.9.6", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g=="],
+
+    "prettier-plugin-astro": ["prettier-plugin-astro@1.0.1", "", { "dependencies": { "@astrojs/compiler-rs": "^0.4.0", "@prettier/parse-srcset": "^3.1.0", "sass-formatter": "^0.8.0" }, "peerDependencies": { "prettier": "^3.5.3" } }, "sha512-FKLtmNgyAoUbUixxmgkyO9ZMjEWCpHgMLtci8IakhCIzr8b+ML9YssBqsMfNoDdd/iE27BixwBZSq2amWDwpFQ=="],
+
+    "prismjs": ["prismjs@1.30.0", "", {}, "sha512-DEvV2ZF2r2/63V+tK8hQvrR2ZGn10srHbXviTlcv7Kpzw8jWiNTqbVgjO3IY8RxrrOUF8VPMQQFysYYYv0YZxw=="],
+
+    "process-ancestry": ["process-ancestry@0.1.0", "", {}, "sha512-tGqJW/UnclpYASFcM6Xh8D8l/BMtaQ9+CSG0vlJSJTcdMM4lDRv4c6H0Pdcsfted+bVczdYSfk2fdukg2gQkZg=="],
+
+    "property-information": ["property-information@7.2.0", "", {}, "sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg=="],
+
+    "radix3": ["radix3@1.1.2", "", {}, "sha512-b484I/7b8rDEdSDKckSSBA8knMpcdsXudlE/LNL639wFoHKwLbEkQFZHWEYwDC0wa0FKUcCY+GAF73Z7wxNVFA=="],
+
+    "readdirp": ["readdirp@4.1.2", "", {}, "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg=="],
+
+    "regex": ["regex@6.1.0", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-6VwtthbV4o/7+OaAF9I5L5V3llLEsoPyq9P1JVXkedTP33c7MfCG0/5NOPcSJn0TzXcG9YUrR0gQSWioew3LDg=="],
+
+    "regex-recursion": ["regex-recursion@6.0.2", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-0YCaSCq2VRIebiaUviZNs0cBz1kg5kVS2UKUfNIx8YVs1cN3AV7NTctO5FOKBA+UT2BPJIWZauYHPqJODG50cg=="],
+
+    "regex-utilities": ["regex-utilities@2.3.0", "", {}, "sha512-8VhliFJAWRaUiVvREIiW2NXXTmHs4vMNnSzuJVhscgmGav3g9VDxLrQndI3dZZVVdp0ZO/5v0xmX516/7M9cng=="],
+
+    "request-light": ["request-light@0.7.0", "", {}, "sha512-lMbBMrDoxgsyO+yB3sDcrDuX85yYt7sS8BfQd11jtbW/z5ZWgLZRcEGLsLoYw7I0WSUGQBs8CC8ScIxkTX1+6Q=="],
+
+    "require-from-string": ["require-from-string@2.0.2", "", {}, "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw=="],
+
+    "resolve-pkg-maps": ["resolve-pkg-maps@1.0.0", "", {}, "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw=="],
+
+    "retext-smartypants": ["retext-smartypants@6.2.0", "", { "dependencies": { "@types/nlcst": "^2.0.0", "nlcst-to-string": "^4.0.0", "unist-util-visit": "^5.0.0" } }, "sha512-kk0jOU7+zGv//kfjXEBjdIryL1Acl4i9XNkHxtM7Tm5lFiCog576fjNC9hjoR7LTKQ0DsPWy09JummSsH1uqfQ=="],
+
+    "rolldown": ["rolldown@1.2.12", "", { "dependencies": { "@oxc-project/types": "=0.152.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm-eabi": "1.2.12", "@rolldown/binding-android-arm64": "1.2.12", "@rolldown/binding-darwin-arm64": "1.2.12", "@rolldown/binding-darwin-x64": "1.2.12", "@rolldown/binding-freebsd-x64": "1.2.12", "@rolldown/binding-linux-arm-gnueabihf": "1.2.12", "@rolldown/binding-linux-arm64-gnu": "1.2.12", "@rolldown/binding-linux-arm64-musl": "1.2.12", "@rolldown/binding-linux-ppc64-gnu": "1.2.12", "@rolldown/binding-linux-s390x-gnu": "1.2.12", "@rolldown/binding-linux-x64-gnu": "1.2.12", "@rolldown/binding-linux-x64-musl": "1.2.12", "@rolldown/binding-openharmony-arm64": "1.2.12", "@rolldown/binding-win32-arm64-msvc": "1.2.12", "@rolldown/binding-win32-x64-msvc": "1.2.12" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-8wafseiaG80xmXSfqidUNqZcylTlhmPZZt+za2m+js2sFZ8dTNlhIOV2WcbIPx2hgwPBJpEUGFAMZ9bgBBLTSQ=="],
+
+    "s.color": ["s.color@0.0.15", "", {}, "sha512-AUNrbEUHeKY8XsYr/DYpl+qk5+aM+DChopnWOPEzn8YKzOhv4l2zH6LzZms3tOZP3wwdOyc0RmTciyi46HLIuA=="],
+
+    "sass-formatter": ["sass-formatter@0.8.0", "", { "dependencies": { "suf-log": "^2.5.3" }, "bin": { "sass-formatter": "dist/cli.js" } }, "sha512-Nf4eMGE2O5vnJG7KPCRyksWS9gVKSYoUWtPeMXRRxwZSPVQhSGtL602xVYS65LvMkHmkvKa7xpauF0+/5pPwrg=="],
+
+    "satori": ["satori@0.33.4", "", { "dependencies": { "@shuding/opentype.js": "1.4.0-beta.0", "css-background-parser": "^0.1.0", "css-box-shadow": "1.0.0-3", "css-gradient-parser": "^0.0.17", "css-to-react-native": "^3.0.0", "emoji-regex-xs": "^2.0.1", "escape-html": "^1.0.3", "fflate": "0.7.3", "harfbuzzjs": "0.10.0", "linebreak": "^1.1.0", "parse-css-color": "^0.2.1", "postcss-value-parser": "^4.2.0", "yoga-layout": "^3.2.1" } }, "sha512-dCnaW6D/tkCJxG5UvpZPWnnvfTdGTVVSAq1tzH6xC5MeOhAeeswRcSq5zT7C6lRCdTGow9PRGus7PCzdp5JJYw=="],
+
+    "satteri": ["satteri@0.10.5", "", { "dependencies": { "@types/estree-jsx": "^1.0.5", "@types/hast": "^3.0.5", "@types/mdast": "^4.0.4", "@types/unist": "^3.0.3" }, "optionalDependencies": { "@bruits/satteri-darwin-arm64": "0.10.5", "@bruits/satteri-darwin-x64": "0.10.5", "@bruits/satteri-linux-arm64-gnu": "0.10.5", "@bruits/satteri-linux-arm64-musl": "0.10.5", "@bruits/satteri-linux-x64-gnu": "0.10.5", "@bruits/satteri-linux-x64-musl": "0.10.5", "@bruits/satteri-wasm32-wasi": "0.10.5", "@bruits/satteri-win32-arm64-msvc": "0.10.5", "@bruits/satteri-win32-x64-msvc": "0.10.5" } }, "sha512-Ao1LKpAEa9Wdg0otgbVKViZHEq9ebdXe4DMrp3s9vQAU0HNIuHnFEuMuOcm0ZIXyV0Yzxj91NvhLpvXZJO/5ZQ=="],
+
+    "sax": ["sax@1.6.1", "", {}, "sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q=="],
+
+    "semver": ["semver@7.8.5", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA=="],
+
+    "sharp": ["sharp@0.35.5", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.5" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.5", "@img/sharp-darwin-x64": "0.35.5", "@img/sharp-freebsd-wasm32": "0.35.5", "@img/sharp-libvips-darwin-arm64": "1.3.4", "@img/sharp-libvips-darwin-x64": "1.3.4", "@img/sharp-libvips-linux-arm": "1.3.4", "@img/sharp-libvips-linux-arm64": "1.3.4", "@img/sharp-libvips-linux-ppc64": "1.3.4", "@img/sharp-libvips-linux-riscv64": "1.3.4", "@img/sharp-libvips-linux-s390x": "1.3.4", "@img/sharp-libvips-linux-x64": "1.3.4", "@img/sharp-libvips-linuxmusl-arm64": "1.3.4", "@img/sharp-libvips-linuxmusl-x64": "1.3.4", "@img/sharp-linux-arm": "0.35.5", "@img/sharp-linux-arm64": "0.35.5", "@img/sharp-linux-ppc64": "0.35.5", "@img/sharp-linux-riscv64": "0.35.5", "@img/sharp-linux-s390x": "0.35.5", "@img/sharp-linux-x64": "0.35.5", "@img/sharp-linuxmusl-arm64": "0.35.5", "@img/sharp-linuxmusl-x64": "0.35.5", "@img/sharp-webcontainers-wasm32": "0.35.5", "@img/sharp-win32-arm64": "0.35.5", "@img/sharp-win32-ia32": "0.35.5", "@img/sharp-win32-x64": "0.35.5" }, "peerDependencies": { "@types/node": "*" }, "optionalPeers": ["@types/node"] }, "sha512-Ywn4OnzGukp7CDMrp08RQ50YKmuwG47brZgIVPTvBaaAfQlRlygrRqSrxdCiL9M+LlzLBiJ68IR1QqvzHyjC7g=="],
+
+    "shiki": ["shiki@4.5.0", "", { "dependencies": { "@shikijs/core": "4.5.0", "@shikijs/engine-javascript": "4.5.0", "@shikijs/engine-oniguruma": "4.5.0", "@shikijs/langs": "4.5.0", "@shikijs/themes": "4.5.0", "@shikijs/types": "4.5.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5" } }, "sha512-OcRW72ngQvc+MSVWBRIovC/BTW589iUE/Vxav7VeM4RcY9MUjqB+IR6ILG1k9nuW6LiG/nct9uma4/MBtnZbmQ=="],
+
+    "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="],
+
+    "sitemap": ["sitemap@9.0.1", "", { "dependencies": { "@types/node": "^24.9.2", "@types/sax": "^1.2.1", "arg": "^5.0.0", "sax": "^1.4.1" }, "bin": { "sitemap": "dist/esm/cli.js" } }, "sha512-S6hzjGJSG3d6if0YoF5kTyeRJvia6FSTBroE5fQ0bu1QNxyJqhhinfUsXi9fH3MgtXODWvwo2BDyQSnhPQ88uQ=="],
+
+    "smol-toml": ["smol-toml@1.9.0", "", {}, "sha512-hpd+HLON7HdZXqYchMM/+LaTTbdK0AU3NngIJ4KVyWbY9bfQqdL9cD+4yf6dUoU2Ap4VsU0JkQi6FxAI1B2mXQ=="],
+
+    "source-map-js": ["source-map-js@1.2.2", "", {}, "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw=="],
+
+    "space-separated-tokens": ["space-separated-tokens@2.0.2", "", {}, "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q=="],
+
+    "string-width": ["string-width@8.3.0", "", { "dependencies": { "get-east-asian-width": "^1.5.0", "strip-ansi": "^7.1.2" } }, "sha512-ZbmZM0JCihQN91dWnxoipT2KOEyHqEyfRXUyjuRhW8b/xnqPDoq4gWEVApTVa9db2wN8mmoikgFBbjh71+cGeQ=="],
+
+    "string.prototype.codepointat": ["string.prototype.codepointat@0.2.1", "", {}, "sha512-2cBVCj6I4IOvEnjgO/hWqXjqBGsY+zwPmHl12Srk9IXSZ56Jwwmy+66XO5Iut/oQVR7t5ihYdLB0GMa4alEUcg=="],
+
+    "stringify-entities": ["stringify-entities@4.0.4", "", { "dependencies": { "character-entities-html4": "^2.0.0", "character-entities-legacy": "^3.0.0" } }, "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg=="],
+
+    "strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="],
+
+    "suf-log": ["suf-log@2.5.3", "", { "dependencies": { "s.color": "0.0.15" } }, "sha512-KvC8OPjzdNOe+xQ4XWJV2whQA0aM1kGVczMQ8+dStAO6KfEB140JEVQ9dE76ONZ0/Ylf67ni4tILPJB41U0eow=="],
+
+    "svgo": ["svgo@4.1.0", "", { "dependencies": { "commander": "^11.1.0", "css-select": "^6.0.0", "css-tree": "^3.0.1", "css-what": "^7.0.0", "csso": "^5.0.5", "picocolors": "^1.1.1", "sax": "1.6.1" }, "bin": { "svgo": "bin/svgo.js" } }, "sha512-bkxnTg1kSU0guhIBmibA6UUhrQmPVA1XsQLN+ylCd+UWzbnLkySOcXpyk1mrl05f+pcaCx2eHb+sp6BgMZWX+Q=="],
+
+    "tiny-inflate": ["tiny-inflate@1.0.3", "", {}, "sha512-pkY1fj1cKHb2seWDy0B16HeWyczlJA9/WW3u3c4z/NiWDsO3DOU5D7nhTLE9CF0yXv/QZFY7sEJmj24dK+Rrqw=="],
+
+    "tinyclip": ["tinyclip@0.1.15", "", {}, "sha512-uo33abH+Ays0xYaDysoBt494Hb3hsEczMpcC0MwFl773pazORx4fmvKhclhR1wonUbB6vvpRsvVMwnhfqeMc+A=="],
+
+    "tinyexec": ["tinyexec@1.3.1", "", {}, "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA=="],
+
+    "tinyglobby": ["tinyglobby@0.2.17", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g=="],
+
+    "trim-lines": ["trim-lines@3.0.1", "", {}, "sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg=="],
+
+    "trough": ["trough@2.2.0", "", {}, "sha512-tmMpK00BjZiUyVyvrBK7knerNgmgvcV/KLVyuma/SC+TQN167GrMRciANTz09+k3zW8L8t60jWO1GpfkZdjTaw=="],
+
+    "tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
+
+    "typesafe-path": ["typesafe-path@0.2.2", "", {}, "sha512-OJabfkAg1WLZSqJAJ0Z6Sdt3utnbzr/jh+NAHoyWHJe8CMSy79Gm085094M9nvTPy22KzTVn5Zq5mbapCI/hPA=="],
+
+    "typescript": ["typescript@6.0.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw=="],
+
+    "typescript-auto-import-cache": ["typescript-auto-import-cache@0.3.6", "", { "dependencies": { "semver": "^7.3.8" } }, "sha512-RpuHXrknHdVdK7wv/8ug3Fr0WNsNi5l5aB8MYYuXhq2UH5lnEB1htJ1smhtD5VeCsGr2p8mUDtd83LCQDFVgjQ=="],
+
+    "ufo": ["ufo@1.6.4", "", {}, "sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA=="],
+
+    "ultrahtml": ["ultrahtml@1.7.0", "", {}, "sha512-2xRd0VHoAQE4M+vF/DvFFB7pUV0ZxTW1TLi7lHQWnF/Sb5TPeEUV/l+hxcNnGO00ZXGnR0voCMmYRKQf+rvJ2g=="],
+
+    "uncrypto": ["uncrypto@0.1.3", "", {}, "sha512-Ql87qFHB3s/De2ClA9e0gsnS6zXG27SkTiSJwjCc9MebbfapQfuPzumMIUMi38ezPZVNFcHI9sUIepeQfw8J8Q=="],
+
+    "undici": ["undici@7.29.1", "", {}, "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q=="],
+
+    "undici-types": ["undici-types@7.18.2", "", {}, "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w=="],
+
+    "unicode-trie": ["unicode-trie@2.0.0", "", { "dependencies": { "pako": "^0.2.5", "tiny-inflate": "^1.0.0" } }, "sha512-x7bc76x0bm4prf1VLg79uhAzKw8DVboClSN5VxJuQ+LKDOVEW9CdH+VY7SP+vX7xCYQqzzgQpFqz15zeLvAtZQ=="],
+
+    "unified": ["unified@11.0.5", "", { "dependencies": { "@types/unist": "^3.0.0", "bail": "^2.0.0", "devlop": "^1.0.0", "extend": "^3.0.0", "is-plain-obj": "^4.0.0", "trough": "^2.0.0", "vfile": "^6.0.0" } }, "sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA=="],
+
+    "unifont": ["unifont@0.7.5", "", { "dependencies": { "css-tree": "^3.1.0", "ohash": "^2.0.11", "undici": "^8.0.0" } }, "sha512-ULe/Cs+ZIsq+dcFofNkhqielCrUJnb5mr+Yc4EBM2VlL+6OZR6+cjtI2mT1bJvRBrVncqHAbLURxmPLcCXzWMg=="],
+
+    "unist-util-is": ["unist-util-is@6.0.1", "", { "dependencies": { "@types/unist": "^3.0.0" } }, "sha512-LsiILbtBETkDz8I9p1dQ0uyRUWuaQzd/cuEeS1hoRSyW5E5XGmTzlwY1OrNzzakGowI9Dr/I8HVaw4hTtnxy8g=="],
+
+    "unist-util-position": ["unist-util-position@5.0.0", "", { "dependencies": { "@types/unist": "^3.0.0" } }, "sha512-fucsC7HjXvkB5R3kTCO7kUjRdrS0BJt3M/FPxmHMBOm8JQi2BsHAHFsy27E0EolP8rp0NzXsJ+jNPyDWvOJZPA=="],
+
+    "unist-util-stringify-position": ["unist-util-stringify-position@4.0.0", "", { "dependencies": { "@types/unist": "^3.0.0" } }, "sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ=="],
+
+    "unist-util-visit": ["unist-util-visit@5.1.0", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-is": "^6.0.0", "unist-util-visit-parents": "^6.0.0" } }, "sha512-m+vIdyeCOpdr/QeQCu2EzxX/ohgS8KbnPDgFni4dQsfSCtpz8UqDyY5GjRru8PDKuYn7Fq19j1CQ+nJSsGKOzg=="],
+
+    "unist-util-visit-parents": ["unist-util-visit-parents@6.0.2", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-is": "^6.0.0" } }, "sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ=="],
+
+    "unstorage": ["unstorage@1.17.5", "", { "dependencies": { "anymatch": "^3.1.3", "chokidar": "^5.0.0", "destr": "^2.0.5", "h3": "^1.15.10", "lru-cache": "^11.2.7", "node-fetch-native": "^1.6.7", "ofetch": "^1.5.1", "ufo": "^1.6.3" }, "peerDependencies": { "@azure/app-configuration": "^1.8.0", "@azure/cosmos": "^4.2.0", "@azure/data-tables": "^13.3.0", "@azure/identity": "^4.6.0", "@azure/keyvault-secrets": "^4.9.0", "@azure/storage-blob": "^12.26.0", "@capacitor/preferences": "^6 || ^7 || ^8", "@deno/kv": ">=0.9.0", "@netlify/blobs": "^6.5.0 || ^7.0.0 || ^8.1.0 || ^9.0.0 || ^10.0.0", "@planetscale/database": "^1.19.0", "@upstash/redis": "^1.34.3", "@vercel/blob": ">=0.27.1", "@vercel/functions": "^2.2.12 || ^3.0.0", "@vercel/kv": "^1 || ^2 || ^3", "aws4fetch": "^1.0.20", "db0": ">=0.2.1", "idb-keyval": "^6.2.1", "ioredis": "^5.4.2", "uploadthing": "^7.4.4" }, "optionalPeers": ["@azure/app-configuration", "@azure/cosmos", "@azure/data-tables", "@azure/identity", "@azure/keyvault-secrets", "@azure/storage-blob", "@capacitor/preferences", "@deno/kv", "@netlify/blobs", "@planetscale/database", "@upstash/redis", "@vercel/blob", "@vercel/functions", "@vercel/kv", "aws4fetch", "db0", "idb-keyval", "ioredis", "uploadthing"] }, "sha512-0i3iqvRfx29hkNntHyQvJTpf5W9dQ9ZadSoRU8+xVlhVtT7jAX57fazYO9EHvcRCfBCyi5YRya7XCDOsbTgkPg=="],
+
+    "vfile": ["vfile@6.0.3", "", { "dependencies": { "@types/unist": "^3.0.0", "vfile-message": "^4.0.0" } }, "sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q=="],
+
+    "vfile-message": ["vfile-message@4.0.3", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-stringify-position": "^4.0.0" } }, "sha512-QTHzsGd1EhbZs4AsQ20JX1rC3cOlt/IWJruk893DfLRr57lcnOeMaWG4K0JrRta4mIJZKth2Au3mM3u03/JWKw=="],
+
+    "vite": ["vite@8.3.2", "", { "dependencies": { "lightningcss": "^1.33.0", "picomatch": "^4.0.7", "postcss": "^8.5.28", "rolldown": "~1.2.11", "tinyglobby": "^0.2.17" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.7.1", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-SQr1x6W5vVSbROg7vsyXIaxK9b0G7zsT68acdWWRmnBUsgDieLCRG+Rep9WdZgcposvv/GSnr4GUUBqB3vXq6w=="],
+
+    "vitefu": ["vitefu@1.1.3", "", { "peerDependencies": { "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["vite"] }, "sha512-ub4okH7Z5KLjb6hDyjqrGXqWtWvoYdU3IGm/NorpgHncKoLTCfRIbvlhBm7r0YstIaQRYlp4yEbFqDcKSzXSSg=="],
+
+    "volar-service-css": ["volar-service-css@0.0.71", "", { "dependencies": { "vscode-css-languageservice": "^6.3.0", "vscode-languageserver-textdocument": "^1.0.11", "vscode-uri": "^3.0.8" }, "peerDependencies": { "@volar/language-service": "~2.4.0" }, "optionalPeers": ["@volar/language-service"] }, "sha512-wRRFt9BpjMKCazcgOh67MSjUjiWUCAh99DyYSDIOTuxaRjEtDC7PpB0k1Y1wbJIW/pVtMUSVbpPo3UGSm0Byxw=="],
+
+    "volar-service-emmet": ["volar-service-emmet@0.0.71", "", { "dependencies": { "@emmetio/css-parser": "^0.4.1", "@emmetio/html-matcher": "^1.3.0", "@vscode/emmet-helper": "^2.9.3", "vscode-uri": "^3.0.8" }, "peerDependencies": { "@volar/language-service": "~2.4.0" }, "optionalPeers": ["@volar/language-service"] }, "sha512-zqjzt6bN95e3CUstBm0PBFAJnrfz0ZAARka87fart46/gNCLLuP3Vujy8V/J8HEziTFLnfkgIASLFYPUhonJcA=="],
+
+    "volar-service-html": ["volar-service-html@0.0.71", "", { "dependencies": { "vscode-html-languageservice": "^5.3.0", "vscode-languageserver-textdocument": "^1.0.11", "vscode-uri": "^3.0.8" }, "peerDependencies": { "@volar/language-service": "~2.4.0" }, "optionalPeers": ["@volar/language-service"] }, "sha512-e8tHPhgQ7ooLfudAEIku+kgd9pWkq3SSz8RbnQDI1+Eb8wbenkLGHqoirLqz5ORLV6wIMr2Iv08RWBG5eOcgpw=="],
+
+    "volar-service-prettier": ["volar-service-prettier@0.0.71", "", { "dependencies": { "vscode-uri": "^3.0.8" }, "peerDependencies": { "@volar/language-service": "~2.4.0", "prettier": "^2.2 || ^3.0" }, "optionalPeers": ["@volar/language-service", "prettier"] }, "sha512-Rz7JVH3qD108UCdmIEiZvOBNljMt2nLFdbN8AXcDfn7xD9F5I2aCIsDVqBbXw21PsnxG0b7MfwtNF+zPS/NKUg=="],
+
+    "volar-service-typescript": ["volar-service-typescript@0.0.71", "", { "dependencies": { "path-browserify": "^1.0.1", "semver": "^7.6.2", "typescript-auto-import-cache": "^0.3.5", "vscode-languageserver-textdocument": "^1.0.11", "vscode-nls": "^5.2.0", "vscode-uri": "^3.0.8" }, "peerDependencies": { "@volar/language-service": "~2.4.0" }, "optionalPeers": ["@volar/language-service"] }, "sha512-yTtM/BVT6hoyEYnDtaCyAtNhdNeS/mhTTABlBOdw3NNiRBUin3IznFJpgfjer4c6RYopiPjjQjc9VFhxVl1mLw=="],
+
+    "volar-service-typescript-twoslash-queries": ["volar-service-typescript-twoslash-queries@0.0.71", "", { "dependencies": { "vscode-uri": "^3.0.8" }, "peerDependencies": { "@volar/language-service": "~2.4.0" }, "optionalPeers": ["@volar/language-service"] }, "sha512-9K2k72s4n7rV9s4bX0MyjbX9iBribvKZbBJKuEmTCZfeWJXs6Yh7bGpY4eoc7UufAjvpheBqwyZCOIPBvxCv0A=="],
+
+    "volar-service-yaml": ["volar-service-yaml@0.0.71", "", { "dependencies": { "vscode-uri": "^3.0.8", "yaml-language-server": "~1.23.0" }, "peerDependencies": { "@volar/language-service": "~2.4.0" }, "optionalPeers": ["@volar/language-service"] }, "sha512-qYGWGuVpUTnZGu5P/CR4KLK4aIR8RrcVnmfZ2eRcj9q/I8VZCoC5yy9FtEvfNvnDp4MU17yhdJcvpQPIqhJS2Q=="],
+
+    "vscode-css-languageservice": ["vscode-css-languageservice@6.3.10", "", { "dependencies": { "@vscode/l10n": "^0.0.18", "vscode-languageserver-textdocument": "^1.0.12", "vscode-languageserver-types": "3.17.5", "vscode-uri": "^3.1.0" } }, "sha512-eq5N9Er3fC4vA9zd9EFhyBG90wtCCuXgRSpAndaOgXMh1Wgep5lBgRIeDgjZBW9pa+332yC9+49cZMW8jcL3MA=="],
+
+    "vscode-html-languageservice": ["vscode-html-languageservice@5.6.2", "", { "dependencies": { "@vscode/l10n": "^0.0.18", "vscode-languageserver-textdocument": "^1.0.12", "vscode-languageserver-types": "^3.17.5", "vscode-uri": "^3.1.0" } }, "sha512-ulCrSnFnfQ16YzvwnYUgEbUEl/ZG7u2eV27YhvLObSHKkb8fw1Z9cgsnUwjTEeDIdJDoTDTDpxuhQwoenoLNMg=="],
+
+    "vscode-json-languageservice": ["vscode-json-languageservice@4.1.8", "", { "dependencies": { "jsonc-parser": "^3.0.0", "vscode-languageserver-textdocument": "^1.0.1", "vscode-languageserver-types": "^3.16.0", "vscode-nls": "^5.0.0", "vscode-uri": "^3.0.2" } }, "sha512-0vSpg6Xd9hfV+eZAaYN63xVVMOTmJ4GgHxXnkLCh+9RsQBkWKIghzLhW2B9ebfG+LQQg8uLtsQ2aUKjTgE+QOg=="],
+
+    "vscode-jsonrpc": ["vscode-jsonrpc@9.0.3", "", {}, "sha512-qETYf9PCl1lVfwR+oBmMfc4vP2nqLNA35ABxorw3j06+xlKRgDVxbLgKm4Y/xPL0YWdeDjLoI4ImICIT3nB0zQ=="],
+
+    "vscode-languageserver": ["vscode-languageserver@9.0.1", "", { "dependencies": { "vscode-languageserver-protocol": "3.17.5" }, "bin": { "installServerIntoExtension": "bin/installServerIntoExtension" } }, "sha512-woByF3PDpkHFUreUa7Hos7+pUWdeWMXRd26+ZX2A8cFx6v/JPTtd4/uN0/jB6XQHYaOlHbio03NTHCqrgG5n7g=="],
+
+    "vscode-languageserver-protocol": ["vscode-languageserver-protocol@3.18.4", "", { "dependencies": { "vscode-jsonrpc": "9.0.3", "vscode-languageserver-types": "3.18.4" } }, "sha512-CCXbyr99dafRJzJH/0Ryk7ly5T8XPmSR0//OuF2w4m+9JiOin7zcAT5iET8GRE7Z9taFBejb3GbM0a0mbjdbrg=="],
+
+    "vscode-languageserver-textdocument": ["vscode-languageserver-textdocument@1.0.15", "", {}, "sha512-Gsfr9S8LU3S6885cS+NaleasJ0n3V5y/SOTqHCifQiXWFw3G9w9/YItDfwHrlCz+dSZWWZ8ilYVMcJe7Sz7Sxw=="],
+
+    "vscode-languageserver-types": ["vscode-languageserver-types@3.18.4", "", {}, "sha512-nQsacoiijvl0fRf2q28uFDrAVwRhdCa3QveiF7/CX0r18mLR5FU/1WskSsCKOjmEbtteKUnY8x8Yzxop+k0zwg=="],
+
+    "vscode-nls": ["vscode-nls@5.2.0", "", {}, "sha512-RAaHx7B14ZU04EU31pT+rKz2/zSl7xMsfIZuo8pd+KZO6PXtQmpevpq3vxvWNcrGbdmhM/rr5Uw5Mz+NBfhVng=="],
+
+    "vscode-uri": ["vscode-uri@3.2.0", "", {}, "sha512-m2gXo3bn0G1kT9InzMf07fTbqMbGtyckj3bH5ktLO+1Ssv+yiATZ4dhwaQv9UZWxJh6E9IFGnQyjgWVDWVBDrg=="],
+
+    "wrap-ansi": ["wrap-ansi@9.0.2", "", { "dependencies": { "ansi-styles": "^6.2.1", "string-width": "^7.0.0", "strip-ansi": "^7.1.0" } }, "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww=="],
+
+    "xxhash-wasm": ["xxhash-wasm@1.1.0", "", {}, "sha512-147y/6YNh+tlp6nd/2pWq38i9h6mz/EuQ6njIrmW8D1BS5nCqs0P6DG+m6zTGnNz5I+uhZ0SHxBs9BsPrwcKDA=="],
+
+    "y18n": ["y18n@5.0.8", "", {}, "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA=="],
+
+    "yaml": ["yaml@2.9.1", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw=="],
+
+    "yaml-language-server": ["yaml-language-server@1.23.0", "", { "dependencies": { "@vscode/l10n": "^0.0.18", "ajv": "^8.17.1", "ajv-draft-04": "^1.0.0", "ajv-i18n": "^4.2.0", "prettier": "^3.8.1", "request-light": "^0.5.7", "vscode-json-languageservice": "4.1.8", "vscode-languageserver": "^9.0.0", "vscode-languageserver-textdocument": "^1.0.1", "vscode-languageserver-types": "^3.16.0", "vscode-uri": "^3.0.2", "yaml": "2.8.3" }, "bin": { "yaml-language-server": "bin/yaml-language-server" } }, "sha512-3qVyCOexLCWw06PQa5kRPwvMWMZ/eZeCRWUvgD6a0OkqL/4iCnxy2WumbWifa937Uo5xhyWJ0uxlU39ljhNh7A=="],
+
+    "yargs": ["yargs@18.2.0", "", { "dependencies": { "cliui": "^9.0.1", "escalade": "^3.1.1", "get-caller-file": "^2.0.5", "string-width": "^8.2.1", "y18n": "^5.0.5", "yargs-parser": "^22.0.0" } }, "sha512-9OpKOLeaoNFecEp7P6iYbzze/5CqWoH7N3SMs/6y1XF4nMvFMspEGZzJ6uFi9MmQwXhyzqYoSEKO3tvA3Z/o2w=="],
+
+    "yargs-parser": ["yargs-parser@22.0.0", "", {}, "sha512-rwu/ClNdSMpkSrUb+d6BRsSkLUq1fmfsY6TOpYzTwvwkg1/NRG85KBy3kq++A8LKQwX6lsu+aWad+2khvuXrqw=="],
+
+    "yocto-queue": ["yocto-queue@1.2.2", "", {}, "sha512-4LCcse/U2MHZ63HAJVE+v71o7yOdIe4cZ70Wpf8D/IyjDKYQLV5GD46B+hSTjJsvV5PztjvHoU580EftxjDZFQ=="],
+
+    "yoga-layout": ["yoga-layout@3.2.1", "", {}, "sha512-0LPOt3AxKqMdFBZA3HBAt/t/8vIKq7VaQYbuA8WxCgung+p9TVyKRYdpvCb80HcdTN2NkbIKbhNwKUfm3tQywQ=="],
+
+    "zod": ["zod@4.6.5", "", {}, "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q=="],
+
+    "zwitch": ["zwitch@2.0.4", "", {}, "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A=="],
+
+    "@bruits/satteri-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.11.1", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.2", "tslib": "^2.4.0" } }, "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ=="],
+
+    "@bruits/satteri-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.11.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw=="],
+
+    "@vscode/emmet-helper/jsonc-parser": ["jsonc-parser@2.3.1", "", {}, "sha512-H8jvkz1O50L3dMZCsLqiuB2tA7muqbSg1AtGEkN0leAqGjsUzDJir3Zwr02BhqdcITPg3ei3mZ+HjMocAknhhg=="],
+
+    "anymatch/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
+
+    "cliui/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
+
+    "csso/css-tree": ["css-tree@2.2.1", "", { "dependencies": { "mdn-data": "2.0.28", "source-map-js": "^1.0.1" } }, "sha512-OA0mILzGc1kCOCSJerOeqDxDQ4HOh+G8NbOJFOTgOCzpw7fCBubk0fEyxp8AgOL/jvLgYA/uV0cMbe43ElF1JA=="],
+
+    "unstorage/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
+
+    "vscode-css-languageservice/vscode-languageserver-types": ["vscode-languageserver-types@3.17.5", "", {}, "sha512-Ld1VelNuX9pdF39h2Hgaeb5hEZM2Z3jUrrMgWQAu82jMtZp7p3vJT3BzToKtZI7NgQssZje5o0zryOrhQvzQAg=="],
+
+    "vscode-languageserver/vscode-languageserver-protocol": ["vscode-languageserver-protocol@3.17.5", "", { "dependencies": { "vscode-jsonrpc": "8.2.0", "vscode-languageserver-types": "3.17.5" } }, "sha512-mb1bvRJN8SVznADSGWM9u/b07H7Ecg0I3OgXDuLdn307rl/J3A9YD6/eYOssqhecL27hK1IPZAsaqh00i/Jljg=="],
+
+    "wrap-ansi/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
+
+    "yaml-language-server/request-light": ["request-light@0.5.8", "", {}, "sha512-3Zjgh+8b5fhRJBQZoy+zbVKpAQGLyka0MPgW3zruTF4dFFJ8Fqcfu9YsAvi/rvdcaTeWG3MkbZv4WKxAn/84Lg=="],
+
+    "yaml-language-server/yaml": ["yaml@2.8.3", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg=="],
+
+    "@bruits/satteri-wasm32-wasi/@emnapi/core/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA=="],
+
+    "csso/css-tree/mdn-data": ["mdn-data@2.0.28", "", {}, "sha512-aylIc7Z9y4yzHYAJNuESG3hfhC+0Ibp/MAMiaOZgNv4pmEdFyfZhhhny4MNiAfWdBQ1RQ2mfDWmM1x8SvGyp8g=="],
+
+    "unstorage/chokidar/readdirp": ["readdirp@5.1.1", "", {}, "sha512-Kko+Y5XQ6fM+Ce3dq3m9YGxnacYZYl9cA1wZjaF3Vbry2L3i1qVg8+CAgNPsXRArPMUMCaOR7oa9Nqntc43JKA=="],
+
+    "vscode-languageserver/vscode-languageserver-protocol/vscode-jsonrpc": ["vscode-jsonrpc@8.2.0", "", {}, "sha512-C+r0eKJUIfiDIfwJhria30+TYWPtuHJXHtI7J0YlOmKAo7ogxP20T0zxB7HZQIFhIyvoBPwWskjxrvAtfjyZfA=="],
+
+    "vscode-languageserver/vscode-languageserver-protocol/vscode-languageserver-types": ["vscode-languageserver-types@3.17.5", "", {}, "sha512-Ld1VelNuX9pdF39h2Hgaeb5hEZM2Z3jUrrMgWQAu82jMtZp7p3vJT3BzToKtZI7NgQssZje5o0zryOrhQvzQAg=="],
+  }
+}
diff --git a/apps/site/bunfig.toml b/apps/site/bunfig.toml
new file mode 100644
index 00000000..4080900d
--- /dev/null
+++ b/apps/site/bunfig.toml
@@ -0,0 +1,3 @@
+[install]
+# Quarantine newly published releases for seven days, as the other apps do.
+minimumReleaseAge = 604800
diff --git a/apps/site/docs/agents/config.md b/apps/site/docs/agents/config.md
new file mode 100644
index 00000000..3c649dd1
--- /dev/null
+++ b/apps/site/docs/agents/config.md
@@ -0,0 +1,28 @@
+# Configuration
+
+All configuration is build-time. `astro.config.mjs` reads it through
+`src/lib/config-core.mjs`, the one implementation shared with the nginx renderer and
+the tests. The result reaches pages as the global `__SITE_CONFIG__` (see
+`src/lib/site-config.ts`), so pages never read `process.env` themselves.
+
+| Variable               | Required      | Rule                                                                      |
+| ---------------------- | ------------- | ------------------------------------------------------------------------- |
+| `SITE_URL`             | yes           | Origin only. https outside localhost. Canonical origin for every URL.     |
+| `APP_URL`              | yes           | Origin only. Must differ from `SITE_URL`.                                 |
+| `CONTACT_EMAIL`        | public origin | Valid email. Required when `SITE_URL` is not localhost.                   |
+| `ANALYTICS_SCRIPT_URL` | no            | https origin of an analytics script. Both analytics variables or neither. |
+| `ANALYTICS_WEBSITE_ID` | no            | 1-64 letters, digits, `-` or `_`. Sent as `data-website-id`.              |
+
+Rules that must not regress:
+
+- Invalid configuration throws during `astro build`. The Dockerfile runs the build,
+  so `docker build` fails. Nothing validates at container start.
+- Localhost builds are `noindex` and `Disallow: /`, so a dev build cannot be indexed.
+- The Content-Security-Policy allows the analytics origin for `script-src` and
+  `connect-src` only, and only when configured. Otherwise it is `'self'` only.
+- The consent banner exists only when analytics is configured. With no analytics
+  there is nothing to consent to.
+
+Production values for the image live in `infra/k3s/overlays/prod/site-build.env`. CI
+passes them as build arguments. Compose builds them from `PUBLIC_SITE_HOST`,
+`PUBLIC_UI_HOST`, `SITE_CONTACT_EMAIL` and `SITE_ANALYTICS_*`.
diff --git a/apps/site/docs/agents/content.md b/apps/site/docs/agents/content.md
new file mode 100644
index 00000000..081d3b35
--- /dev/null
+++ b/apps/site/docs/agents/content.md
@@ -0,0 +1,50 @@
+# Content, SEO and social cards
+
+## Pages
+
+Pages are `.astro` files in `src/pages`. Each renders through `BaseLayout`, which
+supplies the head through `Seo.astro`:
+
+- `title` and `description` are required. The title gains the site name suffix.
+- `image` defaults to `/og/default.png`. A post uses `/og/blog/<slug>.png`.
+- `noindex` marks a page; the 404 page uses it.
+
+Links use paths without trailing slashes (`/blog/hello-world`). nginx redirects the
+alternatives, and the canonical tag is always the slashless form. Check output with
+`bun run test:output`.
+
+## Blog
+
+Posts are flat Markdown files in `src/content/blog`, validated by `src/content.config.ts`:
+`title`, `description`, `publishedAt` (YYYY-MM-DD), optional `updatedAt`, `author`,
+and `draft` (default `true`). A draft is absent from the index, the post route, the
+sitemap and the social card routes. Scheduled posts stay hidden until a build on or
+after their date. The filename is the permanent URL, so renaming a published post
+breaks its link.
+
+## Structured data
+
+- Home: `Organization` and `WebSite` JSON-LD.
+- Posts: `BlogPosting` with `mainEntityOfPage`, dates and image.
+- Every page: `WebPage`.
+
+`jsonLd()` in `src/lib/seo.ts` escapes `<`, so no value can close the script element.
+
+## Social cards
+
+`src/lib/social-card.ts` renders 1200x630 PNGs at build time with Satori and Sharp.
+Satori lays out plain element objects, so no React runtime is needed. The bundled
+Manrope fonts (`@fontsource/manrope`, WOFF) keep the output independent of container
+fonts. Endpoints: `src/pages/og/default.png.ts` and `src/pages/og/blog/[slug].png.ts`.
+
+## Sitemap and robots
+
+`@astrojs/sitemap` emits `sitemap-index.xml`, excluding `/404` and `/og/`.
+`robots.txt` points at the index on indexable origins and disallows everything on
+localhost.
+
+## Optional ideas, not implemented
+
+- An RSS feed for the blog.
+- Per-page `lastmod` taken from `updatedAt` in the sitemap.
+- Breadcrumb structured data for the blog.
diff --git a/apps/site/docs/agents/deploy.md b/apps/site/docs/agents/deploy.md
new file mode 100644
index 00000000..60e59db6
--- /dev/null
+++ b/apps/site/docs/agents/deploy.md
@@ -0,0 +1,69 @@
+# Deploy: image, nginx, Compose and k3s
+
+## Image
+
+`Dockerfile` has four stages:
+
+1. `deps`: `bun install --frozen-lockfile`.
+2. `dev`: the Astro dev server, used by Compose `site-dev`.
+3. `build`: `astro build` then `render-nginx.mjs`. It writes `.build/nginx.conf`, with the
+   CSP derived from the same validated configuration.
+4. `production`: `nginx:1.31-alpine`, pinned by digest, as the non-root user `app`
+   (uid 1001), listening on 8080. It runs `nginx -t` at build time.
+
+The container writes only to `/tmp`. It creates nginx's temp directories when it starts,
+so run it with `--read-only --tmpfs /tmp` or an `emptyDir` at `/tmp`.
+
+## nginx headers and cache
+
+Security headers are declared once at server level, since an `add_header` inside a
+location replaces the server's headers. They are: CSP, `X-Content-Type-Options`,
+`X-Frame-Options`, `Referrer-Policy`, `Permissions-Policy`, and
+`Cross-Origin-Opener-Policy`. HSTS is set by the ingress, which terminates TLS.
+
+Cache policy, keyed on status and path:
+
+- `/_astro/*` (hashed assets): `public, max-age=31536000, immutable`.
+- Successful images and fonts: `public, max-age=86400`.
+- HTML and everything else: `no-cache`.
+- Errors: `no-store`.
+
+## Compose
+
+`docker-compose.site.yml` is merged when `WITH_SITE=1` (default in dev, `0` in prod).
+
+- Dev: `site-dev` on `SITE_HOST_PORT` (default 7333).
+- Prod: `site` routed by Traefik on `Host(PUBLIC_SITE_HOST)`. The app stays on
+  `PUBLIC_UI_HOST`. `dev.sh` requires `PUBLIC_SITE_HOST` (different from the app host),
+  `SITE_CONTACT_EMAIL` and a pinned `SITE_IMAGE_TAG` (never `latest`).
+
+Guardrails in `infra/compose/scripts/validate-guardrails.sh` cover the site: healthcheck,
+`no-new-privileges`, resource reservations and digest-pinned images.
+
+## k3s
+
+`infra/k3s/base/site` holds the Deployment, Service, NetworkPolicy and ServiceAccount.
+The Deployment uses a read-only root filesystem, drops all capabilities, runs as uid
+1001, has probes on `/healthz`, and mounts `/tmp` as an `emptyDir`. The NetworkPolicy
+allows ingress from Traefik and DNS egress only.
+
+The prod overlay routes:
+
+- `Host(<apex>)` to `site:8080` (`boringstack-site` IngressRoute).
+- `Host(app.<apex>)` to `api` for `/api` and `/health`, and to `ui` for everything else.
+- The certificate covers the apex, `app.<apex>` and the GlitchTip host.
+- `site-pdb` keeps one replica available. `patches/site-replicas.yaml` runs two replicas
+  with spread constraints.
+
+Image updates: `.github/workflows/production-release.yml` builds the site as a
+`candidate-<sha>` image with the API, migrations and UI, and pins all four digests
+in one commit. Nothing watches tags.
+
+## Release
+
+For Kubernetes, `.github/workflows/production-release.yml` builds the site image with
+the build arguments from `infra/k3s/overlays/prod/site-build.env`. For the Compose/WUD
+path, `.github/workflows/apps-site-release.yml` publishes `latest` and `sha-*` tags
+built from the same file.
+`.github/workflows/apps-site-validate.yml` runs `bun run validate`, builds the same
+image and smoke-tests it read-only.
diff --git a/apps/site/nginx/nginx.conf.template b/apps/site/nginx/nginx.conf.template
new file mode 100644
index 00000000..b0e986cb
--- /dev/null
+++ b/apps/site/nginx/nginx.conf.template
@@ -0,0 +1,100 @@
+# Rendered by scripts/render-nginx.mjs at image build time. __CSP__ is the only
+# substituted value. Runs as a non-root user with a read-only root filesystem:
+# every writable path lives under /tmp, which the orchestrator mounts as a
+# tmpfs or emptyDir.
+worker_processes auto;
+pid /tmp/nginx/nginx.pid;
+error_log /dev/stderr warn;
+
+events {
+  worker_connections 1024;
+}
+
+http {
+  include /etc/nginx/mime.types;
+  default_type application/octet-stream;
+  charset utf-8;
+  access_log /dev/stdout;
+  sendfile on;
+  server_tokens off;
+
+  client_body_temp_path /tmp/nginx/client_temp;
+  proxy_temp_path /tmp/nginx/proxy_temp;
+  fastcgi_temp_path /tmp/nginx/fastcgi_temp;
+  uwsgi_temp_path /tmp/nginx/uwsgi_temp;
+  scgi_temp_path /tmp/nginx/scgi_temp;
+
+  gzip on;
+  gzip_vary on;
+  gzip_min_length 1024;
+  gzip_comp_level 5;
+  gzip_types text/css application/javascript application/json application/xml image/svg+xml text/plain;
+
+  # Hashed build assets are immutable. Successful pages and images get a short
+  # cache. HTML and every error response are revalidated or never stored, so a
+  # republished page is never served stale.
+  map "$status:$uri" $cache_control {
+    default "no-cache";
+    ~^[45][0-9][0-9]: "no-store";
+    ~^200:/_astro/ "public, max-age=31536000, immutable";
+    ~^200:.*\.(?:png|jpe?g|webp|svg|ico|woff2?)$ "public, max-age=86400";
+  }
+
+  server {
+    listen 8080;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+    absolute_redirect off;
+
+    # add_header inside a location replaces every server-level header, so the
+    # security headers are declared here only and no location adds its own.
+    # HSTS is set by the ingress, which terminates TLS.
+    add_header Content-Security-Policy "__CSP__" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), geolocation=(), microphone=(), payment=(), usb=()" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+    add_header Cache-Control $cache_control always;
+
+    # Readiness and liveness. Kept off the access log.
+    location = /healthz {
+      access_log off;
+      default_type text/plain;
+      return 200 "ok\n";
+    }
+
+    # Hidden files and directories are never served.
+    location ~ /\.(?!well-known) {
+      deny all;
+    }
+
+    # Canonical URLs are slashless and extensionless. Redirect the alternatives.
+    location = /index.html {
+      return 301 /;
+    }
+    location ~ ^/(.+)/index\.html$ {
+      return 301 /$1$is_args$args;
+    }
+    location ~ ^/(.+)\.html$ {
+      return 301 /$1$is_args$args;
+    }
+    location ~ ^/(.+)/+$ {
+      return 308 /$1$is_args$args;
+    }
+
+    location /_astro/ {
+      try_files $uri =404;
+    }
+
+    location / {
+      try_files $uri $uri.html $uri/index.html =404;
+    }
+
+    error_page 404 /404.html;
+    location = /404.html {
+      internal;
+    }
+  }
+}
diff --git a/apps/site/osv-scanner.toml b/apps/site/osv-scanner.toml
new file mode 100644
index 00000000..6b5b0dfb
--- /dev/null
+++ b/apps/site/osv-scanner.toml
@@ -0,0 +1,17 @@
+# osv-scanner accepted-risk allowlist for the BoringStack public site.
+#
+# The site is a static build (Astro output: "static") served by nginx. Its
+# runtime has no server-side code, no database and no user-input handling.
+# Every dependency here is build-time tooling. Add an entry only with a reason
+# and an ignoreUntil date, and re-evaluate it when the dependency is bumped.
+
+[[IgnoredVulns]]
+id = "GHSA-ch52-4w7c-c8xp"
+ignoreUntil = "2026-11-18T00:00:00Z"
+reason = """
+http-cache-semantics 4.2.0 max-stale cache disclosure (no fixed release). Pulled
+in by astro's build-time dependency graph. The vulnerable path needs a shared
+HTTP cache serving several users; this build runs in CI with no shared cache,
+and the public site is a static nginx build. Remove once astro moves to a
+patched http-cache-semantics.
+"""
diff --git a/apps/site/package.json b/apps/site/package.json
new file mode 100644
index 00000000..ab5da1a8
--- /dev/null
+++ b/apps/site/package.json
@@ -0,0 +1,55 @@
+{
+  "name": "boringstack-site",
+  "type": "module",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Public, static marketing site for BoringStack. Astro, output static, served by nginx.",
+  "engines": {
+    "node": ">=24.0.0",
+    "bun": "1.4.2"
+  },
+  "packageManager": "bun@1.4.2",
+  "scripts": {
+    "dev": "env SITE_URL=http://localhost:7333 APP_URL=http://localhost:7331 astro dev",
+    "build": "astro build",
+    "build:ci": "env SITE_URL=https://boringstack.example.com APP_URL=https://app.boringstack.example.com CONTACT_EMAIL=hello@boringstack.example.com sh -c 'astro build && node scripts/render-nginx.mjs'",
+    "preview": "env SITE_URL=https://boringstack.example.com APP_URL=https://app.boringstack.example.com CONTACT_EMAIL=hello@boringstack.example.com astro preview --port 7333",
+    "render:nginx": "node scripts/render-nginx.mjs",
+    "check": "env SITE_URL=https://boringstack.example.com APP_URL=https://app.boringstack.example.com CONTACT_EMAIL=hello@boringstack.example.com astro check",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "test": "bun test tests/unit",
+    "test:output": "bun test tests/output",
+    "validate": "bun run format:check && bun run check && bun run test && bun run build:ci && bun run test:output"
+  },
+  "dependencies": {
+    "@astrojs/sitemap": "3.7.4",
+    "@fontsource/manrope": "5.3.0",
+    "astro": "7.3.1",
+    "satori": "0.33.4",
+    "sharp": "0.35.4"
+  },
+  "devDependencies": {
+    "@astrojs/check": "0.9.10",
+    "@types/bun": "1.4.2",
+    "@types/node": "24.13.3",
+    "prettier": "3.9.6",
+    "prettier-plugin-astro": "1.0.1",
+    "typescript": "6.0.3"
+  },
+  "overrides": {
+    "devalue": "5.9.3",
+    "postcss": "8.5.23",
+    "sharp": "0.35.5",
+    "undici": "7.29.1",
+    "fflate": "0.8.3"
+  },
+  "//overrides": {
+    "_": "Pins patched transitive versions, mirroring apps/docs. Build-time tooling only: the deployed site is static nginx output.",
+    "devalue": "Patched build-time serialization (GHSA-77vg-94rm-hx3p, then GHSA-4q55-j62x-fr9h, GHSA-9rgm-9g3h-6x36, GHSA-hx4r-w6wj-j8fg, GHSA-j22f-vq7h-c4qm, GHSA-mcm9-63f2-9j32, GHSA-r9w8-h9r3-54w4, GHSA-wf3x-273g-mvxv, GHSA-x5rw-q4pp-hg5g). 5.8.1 is vulnerable; 5.9.3 patches them. Pulled in by Astro.",
+    "postcss": "Patched CSS tooling (GHSA-r28c-9q8g-f849). Build-time only.",
+    "sharp": "Patched image processing (GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w). 0.35.4 is vulnerable; 0.35.5 patches it. Build-time social-card rendering only.",
+    "undici": "Patched undici (GHSA-vmh5-mc38-953g, and the 7.29.0 batch fixed in 7.29.1). Build-time fetch tooling only. Mirrors the docs and UI app pins.",
+    "fflate": "Patched fflate (GHSA-px8p-9vwx-vf98, infinite loop on malformed ZIP64 archives). 0.7.3 is vulnerable; 0.8.3 patches it. satori pins fflate exactly to 0.7.3 in every release, so this forces the patched line for the OG image renderer. Build-time social-card rendering only."
+  }
+}
diff --git a/apps/site/public/brand-mark.svg b/apps/site/public/brand-mark.svg
new file mode 100644
index 00000000..1ac2b2f5
--- /dev/null
+++ b/apps/site/public/brand-mark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="14" fill="#2f6fed"/><path d="M16 22h32M16 32h24M16 42h16" stroke="#fff" stroke-width="5" stroke-linecap="round"/></svg>
diff --git a/apps/site/public/favicon.svg b/apps/site/public/favicon.svg
new file mode 100644
index 00000000..1ac2b2f5
--- /dev/null
+++ b/apps/site/public/favicon.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="14" fill="#2f6fed"/><path d="M16 22h32M16 32h24M16 42h16" stroke="#fff" stroke-width="5" stroke-linecap="round"/></svg>
diff --git a/apps/site/scripts/pre-push.sh b/apps/site/scripts/pre-push.sh
new file mode 100644
index 00000000..48435196
--- /dev/null
+++ b/apps/site/scripts/pre-push.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Local mirror of apps-site-validate.yml. Runs the same validate gate as CI.
+# Bypass: `git push --no-verify`.
+set -euo pipefail
+
+ROOT="$(git rev-parse --show-toplevel)"
+cd "$ROOT/apps/site"
+
+printf '\n\033[1;34m▶ site: install\033[0m\n'
+bun install --frozen-lockfile
+
+printf '\n\033[1;34m▶ site: validate (format, types, unit tests, build, output tests)\033[0m\n'
+bun run validate
+
+printf '\n\033[1;32m✓ site pre-push: all gates passed\033[0m\n'
diff --git a/apps/site/scripts/render-nginx.mjs b/apps/site/scripts/render-nginx.mjs
new file mode 100644
index 00000000..d8e98c50
--- /dev/null
+++ b/apps/site/scripts/render-nginx.mjs
@@ -0,0 +1,24 @@
+// Renders nginx/nginx.conf.template into .build/nginx.conf with the CSP derived
+// from the same validated configuration as the pages. Run after `astro build`
+// in the image build stage; the container never renders anything at start.
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { buildCsp, resolveSiteConfig } from "../src/lib/config-core.mjs";
+
+const root = fileURLToPath(new URL("../", import.meta.url));
+const env = { ...process.env };
+const config = resolveSiteConfig(env);
+const csp = buildCsp(config);
+if (csp.includes('"')) throw new Error("CSP must not contain double quotes");
+
+const template = await readFile(
+  join(root, "nginx/nginx.conf.template"),
+  "utf8",
+);
+if (!template.includes("__CSP__"))
+  throw new Error("nginx template is missing __CSP__");
+const output = join(root, ".build/nginx.conf");
+await mkdir(dirname(output), { recursive: true });
+await writeFile(output, template.replaceAll("__CSP__", csp));
+console.log(`Rendered ${output}`);
diff --git a/apps/site/src/components/ConsentBanner.astro b/apps/site/src/components/ConsentBanner.astro
new file mode 100644
index 00000000..dc02e33d
--- /dev/null
+++ b/apps/site/src/components/ConsentBanner.astro
@@ -0,0 +1,37 @@
+---
+import { siteConfig } from "../lib/site-config";
+
+// Rendered only when analytics is configured. Without an analytics script
+// there is nothing to consent to, so the banner is absent.
+const enabled = siteConfig.analytics !== null;
+---
+
+{enabled && (
+  <>
+    <section
+      class="consent"
+      aria-label="Cookie and analytics choice"
+      data-consent-banner
+      hidden
+    >
+      <div class="container">
+        <p>
+          We would like to measure visits to improve this site. Analytics stays
+          off unless you accept. Your choice is stored in this browser only. See
+          our <a href="/privacy">privacy notice</a>.
+        </p>
+        <div class="actions">
+          <button type="button" data-consent-decline>
+            Decline
+          </button>
+          <button type="button" class="primary" data-consent-accept>
+            Accept analytics
+          </button>
+        </div>
+      </div>
+    </section>
+    <script>
+      import "../scripts/consent";
+    </script>
+  </>
+)}
diff --git a/apps/site/src/components/Seo.astro b/apps/site/src/components/Seo.astro
new file mode 100644
index 00000000..d8adde74
--- /dev/null
+++ b/apps/site/src/components/Seo.astro
@@ -0,0 +1,80 @@
+---
+import { siteConfig, siteHref } from "../lib/site-config";
+import { canonicalPath, jsonLd } from "../lib/seo";
+import { siteName } from "../lib/site";
+
+interface Props {
+  title: string;
+  description: string;
+  /** Path of the social card image, relative to the site origin. */
+  image?: string;
+  imageAlt?: string;
+  type?: "website" | "article";
+  noindex?: boolean;
+  article?: { publishedAt: Date; updatedAt?: Date };
+  structuredData?: unknown[];
+}
+
+const {
+  title,
+  description,
+  image = "/og/default.png",
+  imageAlt = `${siteName}: placeholder social card`,
+  type = "website",
+  noindex = false,
+  article,
+  structuredData = [],
+} = Astro.props;
+
+const canonical = siteHref(canonicalPath(Astro.url.pathname));
+const imageUrl = siteHref(image);
+const robots =
+  noindex || !siteConfig.indexable ? "noindex, nofollow" : "index, follow";
+---
+
+<title>{title === siteName ? siteName : `${title} · ${siteName}`}</title>
+<meta name="description" content={description} />
+<link rel="canonical" href={canonical} />
+<meta name="robots" content={robots} />
+<meta property="og:type" content={type} />
+<meta property="og:site_name" content={siteName} />
+<meta property="og:title" content={title} />
+<meta property="og:description" content={description} />
+<meta property="og:url" content={canonical} />
+<meta property="og:image" content={imageUrl} />
+<meta property="og:image:type" content="image/png" />
+<meta property="og:image:width" content="1200" />
+<meta property="og:image:height" content="630" />
+<meta property="og:image:alt" content={imageAlt} />
+<meta name="twitter:card" content="summary_large_image" />
+<meta name="twitter:title" content={title} />
+<meta name="twitter:description" content={description} />
+<meta name="twitter:image" content={imageUrl} />
+<meta name="twitter:image:alt" content={imageAlt} />
+{article && (
+  <>
+    <meta
+      property="article:published_time"
+      content={article.publishedAt.toISOString()}
+    />
+    {article.updatedAt && (
+      <meta
+        property="article:modified_time"
+        content={article.updatedAt.toISOString()}
+      />
+    )}
+  </>
+)}
+<script
+  type="application/ld+json"
+  set:html={jsonLd({
+    "@context": "https://schema.org",
+    "@type": "WebPage",
+    name: title,
+    description,
+    url: canonical,
+  })}
+></script>
+{structuredData.map((item) => (
+  <script type="application/ld+json" set:html={jsonLd(item)}></script>
+))}
diff --git a/apps/site/src/content.config.ts b/apps/site/src/content.config.ts
new file mode 100644
index 00000000..d26fce59
--- /dev/null
+++ b/apps/site/src/content.config.ts
@@ -0,0 +1,21 @@
+import { defineCollection } from "astro:content";
+import { z } from "astro/zod";
+import { glob } from "astro/loaders";
+
+// Blog posts are flat Markdown files in src/content/blog. The filename (without
+// .md) is the permanent URL slug, so renaming a published post breaks its link.
+const blog = defineCollection({
+  loader: glob({ pattern: "*.md", base: "./src/content/blog" }),
+  schema: z.object({
+    title: z.string().min(1).max(120),
+    description: z.string().min(1).max(200),
+    // YYYY-MM-DD. A future date stays unpublished until a build on or after it.
+    publishedAt: z.coerce.date(),
+    updatedAt: z.coerce.date().optional(),
+    author: z.string().default("BoringStack team"),
+    // Drafts default to true so a new file cannot publish by accident.
+    draft: z.boolean().default(true),
+  }),
+});
+
+export const collections = { blog };
diff --git a/apps/site/src/content/blog/hello-world.md b/apps/site/src/content/blog/hello-world.md
new file mode 100644
index 00000000..0b899f95
--- /dev/null
+++ b/apps/site/src/content/blog/hello-world.md
@@ -0,0 +1,20 @@
+---
+title: "Hello world: an example article"
+description: "A placeholder article showing the blog format. Replace or delete it before launch."
+publishedAt: 2026-10-01
+author: "BoringStack team"
+draft: false
+---
+
+This is a placeholder article. It shows the layout, metadata and social card for a
+post. Copy the file, change the name and frontmatter, and set `draft: false` only when
+the article is ready.
+
+## How posts work
+
+Each file in `src/content/blog` becomes one page. The filename is its permanent URL,
+so keep it lowercase and hyphenated. Dates use `YYYY-MM-DD`.
+
+## Next steps
+
+Write the article you actually want to publish, then remove this placeholder.
diff --git a/apps/site/src/env.d.ts b/apps/site/src/env.d.ts
new file mode 100644
index 00000000..d33c8fbb
--- /dev/null
+++ b/apps/site/src/env.d.ts
@@ -0,0 +1,4 @@
+/// <reference types="astro/client" />
+
+/** Injected by astro.config.mjs from the validated build configuration. */
+declare const __SITE_CONFIG__: import("./lib/config-core.mjs").SiteConfig;
diff --git a/apps/site/src/layouts/BaseLayout.astro b/apps/site/src/layouts/BaseLayout.astro
new file mode 100644
index 00000000..a58805c6
--- /dev/null
+++ b/apps/site/src/layouts/BaseLayout.astro
@@ -0,0 +1,83 @@
+---
+import "../styles/global.css";
+import Seo from "../components/Seo.astro";
+import ConsentBanner from "../components/ConsentBanner.astro";
+import { siteConfig, appHref } from "../lib/site-config";
+import { navigation, legalLinks, siteName, siteTagline } from "../lib/site";
+
+interface Props {
+  title: string;
+  description: string;
+  image?: string;
+  imageAlt?: string;
+  type?: "website" | "article";
+  noindex?: boolean;
+  article?: { publishedAt: Date; updatedAt?: Date };
+  structuredData?: unknown[];
+}
+
+const { structuredData, ...seo } = Astro.props;
+const year = new Date().getFullYear();
+const path = Astro.url.pathname;
+const isCurrent = (href: string) =>
+  href === "/" ? path === "/" : path === href || path.startsWith(`${href}/`);
+---
+
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="theme-color" content="#f7f5f0" />
+    <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
+    <Seo {...seo} structuredData={structuredData} />
+  </head>
+  <body>
+    <a class="skip-link" href="#main">
+      Skip to content
+    </a>
+    <header class="site-header">
+      <div class="container">
+        <a class="brand" href="/">
+          {siteName}
+        </a>
+        <nav class="nav" aria-label="Main">
+          {navigation.map((item) => (
+            <a
+              href={item.href}
+              aria-current={isCurrent(item.href) ? "page" : undefined}
+            >
+              {item.label}
+            </a>
+          ))}
+          <a href={appHref("/login")}>Sign in</a>
+          <a href={appHref("/signup")} class="button">
+            Sign up
+          </a>
+        </nav>
+      </div>
+    </header>
+    <main id="main" class="container">
+      <slot />
+    </main>
+    <footer class="site-footer">
+      <div class="container">
+        <nav aria-label="Legal">
+          {legalLinks.map((item) => (
+            <a href={item.href}>{item.label}</a>
+          ))}
+          <a href="/contact">Contact</a>
+          {siteConfig.analytics && (
+            <button type="button" class="link-button" data-cookie-preferences>
+              Cookie preferences
+            </button>
+          )}
+        </nav>
+        <p>
+          {siteTagline} © {year} {siteName}.
+        </p>
+      </div>
+    </footer>
+    <ConsentBanner />
+  </body>
+</html>
diff --git a/apps/site/src/lib/config-core.d.mts b/apps/site/src/lib/config-core.d.mts
new file mode 100644
index 00000000..51101839
--- /dev/null
+++ b/apps/site/src/lib/config-core.d.mts
@@ -0,0 +1,27 @@
+export interface AnalyticsConfig {
+  /** Absolute https URL of the analytics script. */
+  readonly scriptUrl: string;
+  /** Origin of scriptUrl, allowed in the Content-Security-Policy. */
+  readonly origin: string;
+  readonly websiteId: string;
+}
+
+export interface SiteConfig {
+  /** Public origin, without a trailing slash. */
+  readonly siteUrl: string;
+  /** Origin of the authenticated app. */
+  readonly appUrl: string;
+  /** Empty only for local builds. */
+  readonly contactEmail: string;
+  /** False for localhost builds: they get noindex and disallow robots. */
+  readonly indexable: boolean;
+  readonly analytics: AnalyticsConfig | null;
+}
+
+export class SiteConfigError extends Error {}
+
+export function resolveSiteConfig(
+  env?: Record<string, string | undefined>,
+): SiteConfig;
+
+export function buildCsp(config: SiteConfig): string;
diff --git a/apps/site/src/lib/config-core.mjs b/apps/site/src/lib/config-core.mjs
new file mode 100644
index 00000000..a0e22a59
--- /dev/null
+++ b/apps/site/src/lib/config-core.mjs
@@ -0,0 +1,155 @@
+// Build-time configuration for the public site. Plain JavaScript so that
+// astro.config.mjs, the nginx renderer and the tests share one implementation.
+//
+// Every value is validated here. Astro loads this file before it renders
+// anything, so an invalid value fails `astro build` (and therefore
+// `docker build`) rather than publishing pages with a broken origin, an
+// empty contact address, or an analytics script nobody can audit.
+
+const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const ANALYTICS_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+
+export class SiteConfigError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SiteConfigError";
+  }
+}
+
+/**
+ * Parse an origin-only URL such as https://example.com. Paths, queries,
+ * fragments and credentials are rejected because every generated URL is built
+ * from the origin.
+ */
+function parseOrigin(name, raw) {
+  const value = (raw ?? "").trim();
+  if (!value) {
+    throw new SiteConfigError(
+      `${name} is required, for example https://example.com`,
+    );
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new SiteConfigError(
+      `${name} must be an absolute URL, got "${value}"`,
+    );
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw new SiteConfigError(`${name} must use http or https`);
+  }
+  if (url.username || url.password) {
+    throw new SiteConfigError(`${name} must not contain credentials`);
+  }
+  if (url.pathname !== "/" || url.search || url.hash) {
+    throw new SiteConfigError(
+      `${name} must be an origin without a path, query or fragment`,
+    );
+  }
+  return url;
+}
+
+/**
+ * Resolve and validate the site configuration from an environment object.
+ * Returns a frozen object; throws SiteConfigError on the first problem found.
+ */
+export function resolveSiteConfig(env = {}) {
+  const site = parseOrigin("SITE_URL", env.SITE_URL);
+  const app = parseOrigin("APP_URL", env.APP_URL);
+  const local = LOCAL_HOSTS.has(site.hostname);
+
+  if (!local && site.protocol !== "https:") {
+    throw new SiteConfigError(
+      `SITE_URL must use https outside localhost, got ${site.origin}`,
+    );
+  }
+  if (!LOCAL_HOSTS.has(app.hostname) && app.protocol !== "https:") {
+    throw new SiteConfigError(
+      `APP_URL must use https outside localhost, got ${app.origin}`,
+    );
+  }
+  // The public site and the authenticated app are split by host. Sharing an
+  // origin would let public pages and app pages share cookies and indexing.
+  if (site.origin === app.origin) {
+    throw new SiteConfigError(
+      "APP_URL must be a different origin from SITE_URL: the public site and the app run on separate hosts",
+    );
+  }
+
+  const contactEmail = (env.CONTACT_EMAIL ?? "").trim();
+  if (contactEmail && !EMAIL_PATTERN.test(contactEmail)) {
+    throw new SiteConfigError("CONTACT_EMAIL must be an email address");
+  }
+  if (!local && !contactEmail) {
+    throw new SiteConfigError(
+      `CONTACT_EMAIL is required for a public-origin build (SITE_URL=${site.origin}). Set it to a mailbox you monitor.`,
+    );
+  }
+
+  const scriptUrl = (env.ANALYTICS_SCRIPT_URL ?? "").trim();
+  const websiteId = (env.ANALYTICS_WEBSITE_ID ?? "").trim();
+  if (Boolean(scriptUrl) !== Boolean(websiteId)) {
+    throw new SiteConfigError(
+      "ANALYTICS_SCRIPT_URL and ANALYTICS_WEBSITE_ID must be set together, or both left empty",
+    );
+  }
+  let analytics = null;
+  if (scriptUrl) {
+    let script;
+    try {
+      script = new URL(scriptUrl);
+    } catch {
+      throw new SiteConfigError("ANALYTICS_SCRIPT_URL must be an absolute URL");
+    }
+    if (script.protocol !== "https:") {
+      throw new SiteConfigError("ANALYTICS_SCRIPT_URL must use https");
+    }
+    if (script.username || script.password || script.hash) {
+      throw new SiteConfigError(
+        "ANALYTICS_SCRIPT_URL must not contain credentials or a fragment",
+      );
+    }
+    if (!ANALYTICS_ID_PATTERN.test(websiteId)) {
+      throw new SiteConfigError(
+        "ANALYTICS_WEBSITE_ID must be 1-64 letters, digits, hyphens or underscores",
+      );
+    }
+    analytics = Object.freeze({
+      scriptUrl: script.href,
+      origin: script.origin,
+      websiteId,
+    });
+  }
+
+  return Object.freeze({
+    siteUrl: site.origin,
+    appUrl: app.origin,
+    contactEmail,
+    // Local builds stay out of search indexes. Public origins are indexable.
+    indexable: !local,
+    analytics,
+  });
+}
+
+/**
+ * Content-Security-Policy for the nginx container. The site ships no inline
+ * script or style, so 'self' covers everything except the optional analytics
+ * script, which is allowed by its exact origin and nothing else.
+ */
+export function buildCsp(config) {
+  const analyticsOrigin = config.analytics ? ` ${config.analytics.origin}` : "";
+  return [
+    "default-src 'self'",
+    `script-src 'self'${analyticsOrigin}`,
+    "style-src 'self'",
+    "img-src 'self' data:",
+    "font-src 'self'",
+    `connect-src 'self'${analyticsOrigin}`,
+    "object-src 'none'",
+    "base-uri 'self'",
+    "form-action 'self'",
+    "frame-ancestors 'none'",
+  ].join("; ");
+}
diff --git a/apps/site/src/lib/seo.ts b/apps/site/src/lib/seo.ts
new file mode 100644
index 00000000..6caa0ecf
--- /dev/null
+++ b/apps/site/src/lib/seo.ts
@@ -0,0 +1,19 @@
+/**
+ * Canonical path for a route: slashless, with `/` only for the home page.
+ * Mirrors the nginx redirects so the canonical URL is always a served URL.
+ */
+export function canonicalPath(pathname: string): string {
+  const withoutIndex = pathname
+    .replace(/\/index\.html$/, "/")
+    .replace(/\.html$/, "");
+  const trimmed = withoutIndex.replace(/\/+$/, "");
+  return trimmed === "" ? "/" : trimmed;
+}
+
+/**
+ * Serialise structured data for a `<script type="application/ld+json">` block.
+ * `<` is escaped so no value can close the script element early.
+ */
+export function jsonLd(value: unknown): string {
+  return JSON.stringify(value).replace(/</g, "\\u003c");
+}
diff --git a/apps/site/src/lib/site-config.ts b/apps/site/src/lib/site-config.ts
new file mode 100644
index 00000000..58d19af8
--- /dev/null
+++ b/apps/site/src/lib/site-config.ts
@@ -0,0 +1,19 @@
+import type { SiteConfig } from "./config-core.mjs";
+
+export type { SiteConfig, AnalyticsConfig } from "./config-core.mjs";
+
+/** Validated at build time by astro.config.mjs; never re-parsed in pages. */
+export const siteConfig: SiteConfig = __SITE_CONFIG__;
+
+/** Absolute URL of a path on the public site. Paths are slashless. */
+export function siteHref(path: string): string {
+  return new URL(path, `${siteConfig.siteUrl}/`).href;
+}
+
+/** Absolute URL of a path on the app origin, for sign-up and sign-in links. */
+export function appHref(path: string): string {
+  if (!path.startsWith("/") || path.startsWith("//") || path.includes("\\")) {
+    throw new Error(`Invalid app path: ${path}`);
+  }
+  return new URL(path, `${siteConfig.appUrl}/`).href;
+}
diff --git a/apps/site/src/lib/site.ts b/apps/site/src/lib/site.ts
new file mode 100644
index 00000000..a0fb5db7
--- /dev/null
+++ b/apps/site/src/lib/site.ts
@@ -0,0 +1,15 @@
+// Brand and navigation. Replace the placeholder copy before launch.
+export const siteName = "BoringStack";
+export const siteTagline = "Replace this with one sentence about your product.";
+
+export const navigation = [
+  { label: "Pricing", href: "/pricing" },
+  { label: "Blog", href: "/blog" },
+  { label: "About", href: "/about" },
+  { label: "Contact", href: "/contact" },
+];
+
+export const legalLinks = [
+  { label: "Privacy", href: "/privacy" },
+  { label: "Terms", href: "/terms" },
+];
diff --git a/apps/site/src/lib/social-card.ts b/apps/site/src/lib/social-card.ts
new file mode 100644
index 00000000..97ede2d7
--- /dev/null
+++ b/apps/site/src/lib/social-card.ts
@@ -0,0 +1,140 @@
+import { readFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import satori from "satori";
+import sharp from "sharp";
+import { siteName } from "./site";
+
+// Open Graph and Twitter card: 1200x630 PNG rendered at build time. Satori
+// lays out plain element objects, so no React runtime is needed. Only the
+// bundled Manrope fonts are used, which keeps the output independent of the
+// container's installed fonts.
+
+export interface SocialCardInput {
+  title: string;
+  description: string;
+  eyebrow?: string;
+}
+
+type Element = {
+  type: string;
+  props: {
+    style?: Record<string, string | number>;
+    children?: Child | Child[];
+  };
+};
+type Child = Element | string;
+
+function h(
+  type: string,
+  style: Record<string, string | number>,
+  ...children: Child[]
+): Element {
+  return {
+    type,
+    props: { style, children: children.length === 1 ? children[0] : children },
+  };
+}
+
+const COLORS = {
+  background: "#f7f5f0",
+  ink: "#15171a",
+  muted: "#4b5160",
+  accent: "#2f6fed",
+};
+
+let fontsPromise: Promise<{ regular: Buffer; bold: Buffer }> | undefined;
+
+function loadFonts() {
+  // Resolve from the project root: this module is bundled before it runs, so
+  // a path relative to import.meta.url would point at the bundle, not src/.
+  fontsPromise ??= (async () => {
+    const packageRoot = join(
+      createRequire(join(process.cwd(), "package.json")).resolve(
+        "@fontsource/manrope/package.json",
+      ),
+      "..",
+    );
+    const [regular, bold] = await Promise.all([
+      readFile(join(packageRoot, "files/manrope-latin-400-normal.woff")),
+      readFile(join(packageRoot, "files/manrope-latin-700-normal.woff")),
+    ]);
+    return { regular, bold };
+  })();
+  return fontsPromise;
+}
+
+export async function renderSocialCard(
+  input: SocialCardInput,
+): Promise<Buffer> {
+  const fonts = await loadFonts();
+  const title =
+    input.title.length > 110 ? `${input.title.slice(0, 107)}...` : input.title;
+  const description =
+    input.description.length > 160
+      ? `${input.description.slice(0, 157)}...`
+      : input.description;
+
+  const tree = h(
+    "div",
+    {
+      display: "flex",
+      flexDirection: "column",
+      justifyContent: "space-between",
+      width: 1200,
+      height: 630,
+      padding: "64px 72px",
+      background: COLORS.background,
+      color: COLORS.ink,
+      fontFamily: "Manrope",
+    },
+    h(
+      "div",
+      { display: "flex", flexDirection: "column" },
+      h(
+        "div",
+        {
+          display: "flex",
+          fontSize: 26,
+          fontWeight: 700,
+          color: COLORS.accent,
+          letterSpacing: 2,
+        },
+        (input.eyebrow ?? siteName).toUpperCase(),
+      ),
+      h(
+        "div",
+        {
+          display: "flex",
+          marginTop: 28,
+          fontSize: title.length > 60 ? 60 : 72,
+          fontWeight: 700,
+          lineHeight: 1.1,
+        },
+        title,
+      ),
+      h(
+        "div",
+        {
+          display: "flex",
+          marginTop: 28,
+          fontSize: 30,
+          lineHeight: 1.35,
+          color: COLORS.muted,
+        },
+        description,
+      ),
+    ),
+    h("div", { display: "flex", fontSize: 26, fontWeight: 700 }, siteName),
+  );
+
+  const svg = await satori(tree as unknown as Parameters<typeof satori>[0], {
+    width: 1200,
+    height: 630,
+    fonts: [
+      { name: "Manrope", data: fonts.regular, weight: 400, style: "normal" },
+      { name: "Manrope", data: fonts.bold, weight: 700, style: "normal" },
+    ],
+  });
+  return sharp(Buffer.from(svg)).png().toBuffer();
+}
diff --git a/apps/site/src/pages/404.astro b/apps/site/src/pages/404.astro
new file mode 100644
index 00000000..465fbf2f
--- /dev/null
+++ b/apps/site/src/pages/404.astro
@@ -0,0 +1,17 @@
+---
+import BaseLayout from "../layouts/BaseLayout.astro";
+---
+
+<BaseLayout
+  title="Page not found"
+  description="This page does not exist."
+  noindex
+>
+  <article class="prose">
+    <h1>Page not found</h1>
+    <p>The page you are looking for does not exist or has moved.</p>
+    <p>
+      <a href="/">Back to the home page</a>
+    </p>
+  </article>
+</BaseLayout>
diff --git a/apps/site/src/pages/about.astro b/apps/site/src/pages/about.astro
new file mode 100644
index 00000000..a0aff092
--- /dev/null
+++ b/apps/site/src/pages/about.astro
@@ -0,0 +1,24 @@
+---
+import BaseLayout from "../layouts/BaseLayout.astro";
+import { siteName } from "../lib/site";
+---
+
+<BaseLayout
+  title="About"
+  description={`About ${siteName}. Placeholder company story.`}
+>
+  <article class="prose">
+    <h1>About {siteName}</h1>
+    <p class="placeholder">
+      Placeholder: explain who builds this product and why, in your own words.
+    </p>
+    <h2>What we believe</h2>
+    <p class="placeholder">
+      Placeholder: one or two principles that guide the product.
+    </p>
+    <h2>Where we are</h2>
+    <p class="placeholder">
+      Placeholder: the company address, if you publish one.
+    </p>
+  </article>
+</BaseLayout>
diff --git a/apps/site/src/pages/blog/[slug].astro b/apps/site/src/pages/blog/[slug].astro
new file mode 100644
index 00000000..aaefbe52
--- /dev/null
+++ b/apps/site/src/pages/blog/[slug].astro
@@ -0,0 +1,61 @@
+---
+import { getCollection, render } from "astro:content";
+import BaseLayout from "../../layouts/BaseLayout.astro";
+import { siteHref } from "../../lib/site-config";
+import { siteName } from "../../lib/site";
+
+export async function getStaticPaths() {
+  const posts = await getCollection(
+    "blog",
+    ({ data }) => !data.draft && data.publishedAt <= new Date(),
+  );
+  return posts.map((post) => ({ params: { slug: post.id }, props: { post } }));
+}
+
+const { post } = Astro.props;
+const { Content } = await render(post);
+const published = post.data.publishedAt.toISOString().slice(0, 10);
+const updated = post.data.updatedAt?.toISOString().slice(0, 10);
+
+const structuredData = [
+  {
+    "@context": "https://schema.org",
+    "@type": "BlogPosting",
+    headline: post.data.title,
+    description: post.data.description,
+    datePublished: published,
+    ...(updated ? { dateModified: updated } : {}),
+    author: { "@type": "Organization", name: post.data.author },
+    publisher: { "@type": "Organization", name: siteName, url: siteHref("/") },
+    mainEntityOfPage: siteHref(`/blog/${post.id}`),
+    image: siteHref(`/og/blog/${post.id}.png`),
+  },
+];
+---
+
+<BaseLayout
+  title={post.data.title}
+  description={post.data.description}
+  type="article"
+  image={`/og/blog/${post.id}.png`}
+  imageAlt={post.data.title}
+  article={{
+    publishedAt: post.data.publishedAt,
+    updatedAt: post.data.updatedAt,
+  }}
+  structuredData={structuredData}
+>
+  <article class="prose">
+    <p class="meta">
+      <a href="/blog">Blog</a> · <time datetime={published}>{published}</time>
+      {updated && (
+        <>
+          {" "}
+          · updated <time datetime={updated}>{updated}</time>
+        </>
+      )}
+    </p>
+    <h1>{post.data.title}</h1>
+    <Content />
+  </article>
+</BaseLayout>
diff --git a/apps/site/src/pages/blog/index.astro b/apps/site/src/pages/blog/index.astro
new file mode 100644
index 00000000..152daf81
--- /dev/null
+++ b/apps/site/src/pages/blog/index.astro
@@ -0,0 +1,35 @@
+---
+import { getCollection } from "astro:content";
+import BaseLayout from "../../layouts/BaseLayout.astro";
+import { siteName } from "../../lib/site";
+
+const posts = (
+  await getCollection(
+    "blog",
+    ({ data }) => !data.draft && data.publishedAt <= new Date(),
+  )
+).sort((a, b) => b.data.publishedAt.valueOf() - a.data.publishedAt.valueOf());
+---
+
+<BaseLayout title="Blog" description={`Articles from the ${siteName} team.`}>
+  <h1>Blog</h1>
+  {posts.length === 0 ? (
+    <p class="placeholder">No articles yet.</p>
+  ) : (
+    <ul class="post-list">
+      {posts.map((post) => (
+        <li>
+          <h2 class="post-title">
+            <a href={`/blog/${post.id}`}>{post.data.title}</a>
+          </h2>
+          <p class="meta">
+            <time datetime={post.data.publishedAt.toISOString().slice(0, 10)}>
+              {post.data.publishedAt.toISOString().slice(0, 10)}
+            </time>
+          </p>
+          <p>{post.data.description}</p>
+        </li>
+      ))}
+    </ul>
+  )}
+</BaseLayout>
diff --git a/apps/site/src/pages/contact.astro b/apps/site/src/pages/contact.astro
new file mode 100644
index 00000000..30f78561
--- /dev/null
+++ b/apps/site/src/pages/contact.astro
@@ -0,0 +1,29 @@
+---
+import BaseLayout from "../layouts/BaseLayout.astro";
+import { siteConfig } from "../lib/site-config";
+---
+
+<BaseLayout
+  title="Contact"
+  description="How to reach the team behind this product."
+>
+  <article class="prose">
+    <h1>Contact</h1>
+    {siteConfig.contactEmail ? (
+      <p>
+        Email us at{" "}
+        <a href={`mailto:${siteConfig.contactEmail}`}>
+          {siteConfig.contactEmail}
+        </a>
+        .
+      </p>
+    ) : (
+      <p class="placeholder">
+        No contact address is configured for this build.
+      </p>
+    )}
+    <p class="placeholder">
+      Placeholder: add response times and what to include in a message.
+    </p>
+  </article>
+</BaseLayout>
diff --git a/apps/site/src/pages/index.astro b/apps/site/src/pages/index.astro
new file mode 100644
index 00000000..3c5b8b9b
--- /dev/null
+++ b/apps/site/src/pages/index.astro
@@ -0,0 +1,78 @@
+---
+import BaseLayout from "../layouts/BaseLayout.astro";
+import { appHref, siteConfig } from "../lib/site-config";
+import { siteName, siteTagline } from "../lib/site";
+
+const features = [
+  {
+    title: "Placeholder feature one",
+    body: "Describe the first thing your product does for people.",
+  },
+  {
+    title: "Placeholder feature two",
+    body: "Describe the second benefit in one or two plain sentences.",
+  },
+  {
+    title: "Placeholder feature three",
+    body: "Describe the third benefit, or remove this card.",
+  },
+];
+
+const structuredData = [
+  {
+    "@context": "https://schema.org",
+    "@type": "Organization",
+    name: siteName,
+    url: siteConfig.siteUrl,
+    logo: `${siteConfig.siteUrl}/brand-mark.svg`,
+    ...(siteConfig.contactEmail ? { email: siteConfig.contactEmail } : {}),
+  },
+  {
+    "@context": "https://schema.org",
+    "@type": "WebSite",
+    name: siteName,
+    url: siteConfig.siteUrl,
+  },
+];
+---
+
+<BaseLayout
+  title={siteName}
+  description={siteTagline}
+  structuredData={structuredData}
+>
+  <section class="hero hero-top">
+    <h1>{siteName}: a placeholder headline for your product</h1>
+    <p>
+      {siteTagline} Replace this paragraph with the promise your product keeps.
+    </p>
+    <a class="button" href={appHref("/signup")}>
+      Create an account
+    </a>
+  </section>
+
+  <section aria-labelledby="features-heading">
+    <h2 id="features-heading">Features</h2>
+    <div class="cards">
+      {features.map((feature) => (
+        <article class="card">
+          <h3>{feature.title}</h3>
+          <p>{feature.body}</p>
+        </article>
+      ))}
+    </div>
+  </section>
+
+  <section aria-labelledby="cta-heading">
+    <h2 id="cta-heading">Ready to start?</h2>
+    <p class="placeholder">
+      Placeholder call to action: one sentence that explains the next step.
+    </p>
+    <a class="button" href={appHref("/signup")}>
+      Sign up
+    </a>
+    <a class="button button-secondary gap-start" href="/pricing">
+      See pricing
+    </a>
+  </section>
+</BaseLayout>
diff --git a/apps/site/src/pages/og/blog/[slug].png.ts b/apps/site/src/pages/og/blog/[slug].png.ts
new file mode 100644
index 00000000..170a7d96
--- /dev/null
+++ b/apps/site/src/pages/og/blog/[slug].png.ts
@@ -0,0 +1,30 @@
+import type { APIRoute } from "astro";
+import { getCollection } from "astro:content";
+import { renderSocialCard } from "../../../lib/social-card";
+import { siteName } from "../../../lib/site";
+
+export async function getStaticPaths() {
+  const posts = await getCollection(
+    "blog",
+    ({ data }) => !data.draft && data.publishedAt <= new Date(),
+  );
+  return posts.map((post) => ({
+    params: { slug: post.id },
+    props: { title: post.data.title, description: post.data.description },
+  }));
+}
+
+export const GET: APIRoute = async ({ props }) => {
+  const { title, description } = props as {
+    title: string;
+    description: string;
+  };
+  const png = await renderSocialCard({
+    title,
+    description,
+    eyebrow: `${siteName} blog`,
+  });
+  return new Response(new Uint8Array(png), {
+    headers: { "Content-Type": "image/png" },
+  });
+};
diff --git a/apps/site/src/pages/og/default.png.ts b/apps/site/src/pages/og/default.png.ts
new file mode 100644
index 00000000..a4d593bb
--- /dev/null
+++ b/apps/site/src/pages/og/default.png.ts
@@ -0,0 +1,13 @@
+import type { APIRoute } from "astro";
+import { renderSocialCard } from "../../lib/social-card";
+import { siteName, siteTagline } from "../../lib/site";
+
+export const GET: APIRoute = async () => {
+  const png = await renderSocialCard({
+    title: siteName,
+    description: siteTagline,
+  });
+  return new Response(new Uint8Array(png), {
+    headers: { "Content-Type": "image/png" },
+  });
+};
diff --git a/apps/site/src/pages/pricing.astro b/apps/site/src/pages/pricing.astro
new file mode 100644
index 00000000..648f1a2b
--- /dev/null
+++ b/apps/site/src/pages/pricing.astro
@@ -0,0 +1,41 @@
+---
+import BaseLayout from "../layouts/BaseLayout.astro";
+import { appHref } from "../lib/site-config";
+import { siteName } from "../lib/site";
+
+const plans = [
+  {
+    name: "Free",
+    price: "Placeholder price",
+    body: "Replace with what the free plan includes.",
+  },
+  {
+    name: "Pro",
+    price: "Placeholder price",
+    body: "Replace with what the paid plan adds, and who it is for.",
+  },
+];
+---
+
+<BaseLayout
+  title="Pricing"
+  description={`Placeholder pricing for ${siteName}. Replace the plans and prices before launch.`}
+>
+  <h1>Pricing</h1>
+  <p class="placeholder prose">
+    Placeholder: replace these plans and prices before launch. Do not publish
+    invented prices.
+  </p>
+  <div class="cards">
+    {plans.map((plan) => (
+      <article class="card">
+        <h2 class="flush-top">{plan.name}</h2>
+        <p class="placeholder">{plan.price}</p>
+        <p>{plan.body}</p>
+        <a class="button" href={appHref("/signup")}>
+          Sign up
+        </a>
+      </article>
+    ))}
+  </div>
+</BaseLayout>
diff --git a/apps/site/src/pages/privacy.astro b/apps/site/src/pages/privacy.astro
new file mode 100644
index 00000000..e5198c27
--- /dev/null
+++ b/apps/site/src/pages/privacy.astro
@@ -0,0 +1,35 @@
+---
+import BaseLayout from "../layouts/BaseLayout.astro";
+import { siteConfig } from "../lib/site-config";
+---
+
+<BaseLayout
+  title="Privacy"
+  description="How this site handles cookies, consent and analytics."
+>
+  <article class="prose">
+    <h1>Privacy</h1>
+    <p class="placeholder">
+      Placeholder legal text. Have counsel review this page before launch. The
+      owner, retention periods and processors still need to be filled in.
+    </p>
+    <h2>Cookies and storage</h2>
+    <p>
+      This site sets no cookies. Your consent choice is kept in this browser's
+      local storage.
+    </p>
+    <h2>Analytics</h2>
+    {siteConfig.analytics ? (
+      <p>
+        Analytics loads only after you accept it in the consent banner. You can
+        change your choice at any time with Cookie preferences in the footer.
+      </p>
+    ) : (
+      <p>No analytics is configured for this site, so none runs.</p>
+    )}
+    <h2>Contact</h2>
+    <p>
+      Privacy questions: <a href="/contact">contact us</a>.
+    </p>
+  </article>
+</BaseLayout>
diff --git a/apps/site/src/pages/robots.txt.ts b/apps/site/src/pages/robots.txt.ts
new file mode 100644
index 00000000..43b34a2b
--- /dev/null
+++ b/apps/site/src/pages/robots.txt.ts
@@ -0,0 +1,11 @@
+import type { APIRoute } from "astro";
+import { siteConfig } from "../lib/site-config";
+
+export const GET: APIRoute = () => {
+  const body = siteConfig.indexable
+    ? `User-agent: *\nAllow: /\n\nSitemap: ${siteConfig.siteUrl}/sitemap-index.xml\n`
+    : "User-agent: *\nDisallow: /\n";
+  return new Response(body, {
+    headers: { "Content-Type": "text/plain; charset=utf-8" },
+  });
+};
diff --git a/apps/site/src/pages/terms.astro b/apps/site/src/pages/terms.astro
new file mode 100644
index 00000000..f4cdfc38
--- /dev/null
+++ b/apps/site/src/pages/terms.astro
@@ -0,0 +1,18 @@
+---
+import BaseLayout from "../layouts/BaseLayout.astro";
+import { siteName } from "../lib/site";
+---
+
+<BaseLayout title="Terms" description={`Terms of use for ${siteName}.`}>
+  <article class="prose">
+    <h1>Terms</h1>
+    <p class="placeholder">
+      Placeholder terms of use. Replace this page with your binding terms and
+      have them reviewed before launch.
+    </p>
+    <h2>Using this site</h2>
+    <p class="placeholder">
+      Placeholder: what visitors may and may not do with the public pages.
+    </p>
+  </article>
+</BaseLayout>
diff --git a/apps/site/src/scripts/consent.ts b/apps/site/src/scripts/consent.ts
new file mode 100644
index 00000000..730d0f3e
--- /dev/null
+++ b/apps/site/src/scripts/consent.ts
@@ -0,0 +1,68 @@
+import { siteConfig } from "../lib/site-config";
+
+// Consent is stored locally in this browser only. Analytics stays off until the
+// visitor accepts. Storage can be blocked, so every access is guarded.
+const STORAGE_KEY = "boringstack-consent-v1";
+
+type Choice = "accepted" | "declined";
+
+function readChoice(): Choice | null {
+  try {
+    const value = window.localStorage.getItem(STORAGE_KEY);
+    return value === "accepted" || value === "declined" ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+function writeChoice(choice: Choice): void {
+  try {
+    window.localStorage.setItem(STORAGE_KEY, choice);
+  } catch {
+    // Storage unavailable: the choice applies to this page view only.
+  }
+}
+
+function loadAnalytics(): void {
+  const analytics = siteConfig.analytics;
+  if (!analytics || document.querySelector("script[data-analytics]")) return;
+  const script = document.createElement("script");
+  script.src = analytics.scriptUrl;
+  script.defer = true;
+  script.dataset.analytics = "";
+  script.dataset.websiteId = analytics.websiteId;
+  document.head.append(script);
+}
+
+const banner = document.querySelector<HTMLElement>("[data-consent-banner]");
+
+function showBanner(): void {
+  if (banner) banner.hidden = false;
+}
+
+function hideBanner(): void {
+  if (banner) banner.hidden = true;
+}
+
+if (siteConfig.analytics) {
+  const choice = readChoice();
+  if (choice === "accepted") loadAnalytics();
+  if (choice === null) showBanner();
+
+  document
+    .querySelector("[data-consent-accept]")
+    ?.addEventListener("click", () => {
+      writeChoice("accepted");
+      hideBanner();
+      loadAnalytics();
+    });
+  document
+    .querySelector("[data-consent-decline]")
+    ?.addEventListener("click", () => {
+      writeChoice("declined");
+      hideBanner();
+    });
+  document
+    .querySelector("[data-cookie-preferences]")
+    ?.addEventListener("click", showBanner);
+}
diff --git a/apps/site/src/styles/global.css b/apps/site/src/styles/global.css
new file mode 100644
index 00000000..4321b163
--- /dev/null
+++ b/apps/site/src/styles/global.css
@@ -0,0 +1,327 @@
+:root {
+  color-scheme: light dark;
+  --color-background: #f7f5f0;
+  --color-surface: #ffffff;
+  --color-ink: #15171a;
+  --color-muted: #4b5160;
+  --color-border: #d9d6cc;
+  --color-accent: #2f6fed;
+  --color-accent-ink: #ffffff;
+  --measure: 68ch;
+  --gutter: 16px;
+}
+
+@media (prefers-color-scheme: dark) {
+  :root:not([data-theme="light"]) {
+    --color-background: #111316;
+    --color-surface: #1a1d22;
+    --color-ink: #eceae4;
+    --color-muted: #b4b9c4;
+    --color-border: #2e333b;
+    --color-accent: #7aa7ff;
+    --color-accent-ink: #0b0d10;
+  }
+}
+
+:root[data-theme="dark"] {
+  --color-background: #111316;
+  --color-surface: #1a1d22;
+  --color-ink: #eceae4;
+  --color-muted: #b4b9c4;
+  --color-border: #2e333b;
+  --color-accent: #7aa7ff;
+  --color-accent-ink: #0b0d10;
+}
+
+*,
+*::before,
+*::after {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+  background: var(--color-background);
+  color: var(--color-ink);
+  font-family:
+    "Manrope",
+    system-ui,
+    -apple-system,
+    "Segoe UI",
+    sans-serif;
+  font-size: 17px;
+  line-height: 1.6;
+  -webkit-font-smoothing: antialiased;
+}
+
+img,
+svg {
+  max-width: 100%;
+  height: auto;
+}
+
+a {
+  color: var(--color-accent);
+}
+
+h1,
+h2,
+h3 {
+  line-height: 1.2;
+  margin: 0 0 0.6em;
+}
+
+h1 {
+  font-size: clamp(2rem, 6vw, 3.25rem);
+}
+
+h2 {
+  font-size: clamp(1.5rem, 4vw, 2rem);
+  margin-top: 2em;
+}
+
+p {
+  margin: 0 0 1em;
+}
+
+.skip-link {
+  position: absolute;
+  left: var(--gutter);
+  top: -4rem;
+  background: var(--color-accent);
+  color: var(--color-accent-ink);
+  padding: 0.75rem 1rem;
+  border-radius: 6px;
+  z-index: 10;
+}
+
+.skip-link:focus {
+  top: 0.5rem;
+}
+
+.container {
+  width: min(100% - 2 * var(--gutter), 1080px);
+  margin-inline: auto;
+}
+
+.prose {
+  max-width: var(--measure);
+}
+
+.site-header,
+.site-footer {
+  border-color: var(--color-border);
+}
+
+.site-header {
+  border-bottom: 1px solid var(--color-border);
+}
+
+.site-header .container {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px 24px;
+  padding-block: 18px;
+}
+
+.brand {
+  font-weight: 700;
+  text-decoration: none;
+  color: var(--color-ink);
+}
+
+.nav {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px 18px;
+  font-size: 0.95rem;
+}
+
+.nav a {
+  color: var(--color-ink);
+  text-decoration: none;
+}
+
+.nav a[aria-current="page"],
+.nav a:hover {
+  color: var(--color-accent);
+}
+
+main {
+  padding-block: 48px 64px;
+}
+
+.hero p {
+  color: var(--color-muted);
+  font-size: 1.15rem;
+  max-width: var(--measure);
+}
+
+.button {
+  display: inline-block;
+  margin-top: 8px;
+  padding: 12px 20px;
+  border-radius: 8px;
+  background: var(--color-accent);
+  color: var(--color-accent-ink);
+  font-weight: 700;
+  text-decoration: none;
+}
+
+.button-secondary {
+  background: transparent;
+  color: var(--color-ink);
+  border: 1px solid var(--color-border);
+}
+
+.cards {
+  display: grid;
+  gap: 16px;
+  grid-template-columns: repeat(auto-fit, minmax(240px, 1fr));
+  margin-top: 32px;
+}
+
+.card {
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
+  border-radius: 12px;
+  padding: 20px;
+}
+
+.card p {
+  color: var(--color-muted);
+  margin: 0;
+}
+
+.hero-top {
+  padding-top: 24px;
+}
+
+.gap-start {
+  margin-left: 8px;
+}
+
+.flush-top {
+  margin-top: 0;
+}
+
+.post-title {
+  margin: 0 0 6px;
+  font-size: 1.25rem;
+}
+
+.placeholder {
+  color: var(--color-muted);
+  font-style: italic;
+}
+
+.post-list {
+  list-style: none;
+  padding: 0;
+}
+
+.post-list li {
+  padding-block: 18px;
+  border-bottom: 1px solid var(--color-border);
+}
+
+.post-list time,
+.meta {
+  color: var(--color-muted);
+  font-size: 0.9rem;
+}
+
+.site-footer {
+  border-top: 1px solid var(--color-border);
+  color: var(--color-muted);
+  font-size: 0.9rem;
+  padding-block: 32px;
+}
+
+.site-footer nav {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px 20px;
+  margin-bottom: 12px;
+}
+
+.site-footer a {
+  color: var(--color-muted);
+}
+
+.link-button {
+  background: none;
+  border: 0;
+  padding: 0;
+  font: inherit;
+  color: var(--color-muted);
+  text-decoration: underline;
+  cursor: pointer;
+}
+
+.consent {
+  position: fixed;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  background: var(--color-surface);
+  border-top: 1px solid var(--color-border);
+  padding: 16px 0;
+  z-index: 20;
+  box-shadow: 0 -8px 24px rgb(0 0 0 / 0.12);
+}
+
+.consent[hidden] {
+  display: none;
+}
+
+.consent .container {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px 24px;
+}
+
+.consent p {
+  margin: 0;
+  font-size: 0.95rem;
+  flex: 1 1 360px;
+}
+
+.consent .actions {
+  display: flex;
+  gap: 8px;
+}
+
+.consent button {
+  font: inherit;
+  padding: 10px 16px;
+  border-radius: 8px;
+  border: 1px solid var(--color-border);
+  background: var(--color-surface);
+  color: var(--color-ink);
+  cursor: pointer;
+}
+
+.consent button.primary {
+  background: var(--color-accent);
+  border-color: var(--color-accent);
+  color: var(--color-accent-ink);
+}
+
+@media (max-width: 540px) {
+  .site-header .container {
+    padding-block: 14px;
+  }
+
+  .consent .actions {
+    width: 100%;
+  }
+
+  .consent .actions button {
+    flex: 1 1 0;
+  }
+}
diff --git a/apps/site/tests/output/output.test.ts b/apps/site/tests/output/output.test.ts
new file mode 100644
index 00000000..5d6410ce
--- /dev/null
+++ b/apps/site/tests/output/output.test.ts
@@ -0,0 +1,161 @@
+import { describe, expect, test } from "bun:test";
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+// Validates the built static output in dist/. Run after `bun run build:ci`.
+const dist = fileURLToPath(new URL("../../dist/", import.meta.url));
+// Must match the origin used by build:ci in package.json.
+const ORIGIN = "https://boringstack.example.com";
+
+const read = (path: string) => readFileSync(`${dist}${path}`, "utf8");
+const canonicalOf = (html: string) =>
+  html.match(/<link rel="canonical" href="([^"]+)"/)?.[1];
+
+const pages = [
+  "index.html",
+  "about.html",
+  "pricing.html",
+  "contact.html",
+  "privacy.html",
+  "terms.html",
+  "blog.html",
+  "blog/hello-world.html",
+];
+
+describe("canonical URLs and sitemap", () => {
+  test.each(pages)(
+    "%s has a slashless canonical on the configured origin",
+    (page) => {
+      const canonical = canonicalOf(read(page));
+      expect(canonical).toBeDefined();
+      expect(new URL(canonical!).origin).toBe(ORIGIN);
+      if (canonical !== `${ORIGIN}/`)
+        expect(canonical!.endsWith("/")).toBe(false);
+      expect(canonical).not.toContain(".html");
+    },
+  );
+
+  test("the sitemap index references the sitemap and every sitemap entry is slashless", () => {
+    const index = read("sitemap-index.xml");
+    expect(index).toContain(`${ORIGIN}/sitemap-0.xml`);
+    const urls = [
+      ...read("sitemap-0.xml").matchAll(/<loc>([^<]+)<\/loc>/g),
+    ].map((m) => m[1]!);
+    expect(urls).toContain(`${ORIGIN}/`);
+    expect(urls).toContain(`${ORIGIN}/blog/hello-world`);
+    expect(urls).toContain(`${ORIGIN}/pricing`);
+    for (const url of urls) {
+      expect(new URL(url).origin).toBe(ORIGIN);
+      if (url !== `${ORIGIN}/`) expect(url.endsWith("/")).toBe(false);
+      expect(url).not.toContain("/404");
+      expect(url).not.toContain("/og/");
+    }
+  });
+
+  test("every canonical page is listed in the sitemap", () => {
+    const urls = new Set(
+      [...read("sitemap-0.xml").matchAll(/<loc>([^<]+)<\/loc>/g)].map(
+        (m) => m[1]!,
+      ),
+    );
+    for (const page of pages) {
+      expect(urls.has(canonicalOf(read(page))!)).toBe(true);
+    }
+  });
+});
+
+describe("robots and error pages", () => {
+  test("robots.txt allows crawling and points at the sitemap index", () => {
+    const robots = read("robots.txt");
+    expect(robots).toContain("Allow: /");
+    expect(robots).toContain(`Sitemap: ${ORIGIN}/sitemap-index.xml`);
+  });
+
+  test("the 404 page exists and is marked noindex", () => {
+    const html = read("404.html");
+    expect(html).toContain("Page not found");
+    expect(html).toContain('content="noindex, nofollow"');
+  });
+});
+
+describe("metadata and structured data", () => {
+  test.each(pages)(
+    "%s has a title, a description and Open Graph and Twitter cards",
+    (page) => {
+      const html = read(page);
+      expect(html).toMatch(/<title>[^<]+<\/title>/);
+      expect(html).toMatch(/<meta name="description" content="[^"]+"/);
+      expect(html).toContain('property="og:title"');
+      expect(html).toContain('property="og:image"');
+      expect(html).toContain(
+        'name="twitter:card" content="summary_large_image"',
+      );
+    },
+  );
+
+  test("the home page carries Organization and WebSite JSON-LD that parse", () => {
+    const blocks = [
+      ...read("index.html").matchAll(
+        /<script type="application\/ld\+json">([\s\S]*?)<\/script>/g,
+      ),
+    ].map((m) => JSON.parse(m[1]!));
+    const types = blocks.map((b) => b["@type"]);
+    expect(types).toContain("Organization");
+    expect(types).toContain("WebSite");
+  });
+
+  test("a blog post carries BlogPosting JSON-LD with its canonical URL", () => {
+    const blocks = [
+      ...read("blog/hello-world.html").matchAll(
+        /<script type="application\/ld\+json">([\s\S]*?)<\/script>/g,
+      ),
+    ].map((m) => JSON.parse(m[1]!));
+    const post = blocks.find((b) => b["@type"] === "BlogPosting");
+    expect(post).toBeDefined();
+    expect(post.mainEntityOfPage).toBe(`${ORIGIN}/blog/hello-world`);
+    expect(post.datePublished).toBe("2026-10-01");
+  });
+});
+
+describe("social cards", () => {
+  test.each(["og/default.png", "og/blog/hello-world.png"])(
+    "%s is a 1200x630 PNG",
+    (path) => {
+      const bytes = readFileSync(`${dist}${path}`);
+      expect(bytes.subarray(0, 8).toString("hex")).toBe("89504e470d0a1a0a");
+      // IHDR width and height are big-endian 32-bit integers after the chunk header.
+      expect(bytes.readUInt32BE(16)).toBe(1200);
+      expect(bytes.readUInt32BE(20)).toBe(630);
+    },
+  );
+});
+
+describe("CSP compatibility", () => {
+  test.each(pages)(
+    "%s has no inline style attributes or executable inline scripts",
+    (page) => {
+      const html = read(page);
+      expect(html).not.toMatch(/\sstyle="/);
+      // Only data blocks (JSON-LD) may be inline; every executable script must have src.
+      const inlineScripts = [
+        ...html.matchAll(/<script(?![^>]*\bsrc=)([^>]*)>/g),
+      ].filter((m) => !/type="application\/ld\+json"/.test(m[1]!));
+      expect(inlineScripts).toEqual([]);
+    },
+  );
+
+  test("no page references analytics when none is configured", () => {
+    for (const page of pages) {
+      expect(read(page)).not.toContain("data-website-id");
+      expect(read(page)).not.toContain("consent-banner");
+    }
+  });
+
+  test("the nginx render script ran against a valid configuration", () => {
+    expect(
+      existsSync(
+        fileURLToPath(new URL("../../.build/nginx.conf", import.meta.url)),
+      ),
+    ).toBe(true);
+  });
+});
diff --git a/apps/site/tests/unit/build-config.test.ts b/apps/site/tests/unit/build-config.test.ts
new file mode 100644
index 00000000..e99f79b7
--- /dev/null
+++ b/apps/site/tests/unit/build-config.test.ts
@@ -0,0 +1,75 @@
+import { describe, expect, test } from "bun:test";
+import { fileURLToPath } from "node:url";
+
+// The build must fail, not publish, when configuration is invalid. These run the
+// real Astro config loader; the build exits before rendering any page.
+const siteRoot = fileURLToPath(new URL("../../", import.meta.url));
+const astroBin = fileURLToPath(
+  new URL("../../node_modules/astro/bin/astro.mjs", import.meta.url),
+);
+
+async function build(overrides: Record<string, string | undefined>) {
+  const env: Record<string, string> = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (
+      value !== undefined &&
+      !key.startsWith("SITE_") &&
+      !key.startsWith("APP_") &&
+      !key.startsWith("CONTACT_") &&
+      !key.startsWith("ANALYTICS_")
+    ) {
+      env[key] = value;
+    }
+  }
+  for (const [key, value] of Object.entries(overrides)) {
+    if (value !== undefined) env[key] = value;
+  }
+  const outDir = `${siteRoot}.build/test-dist-${crypto.randomUUID()}`;
+  const proc = Bun.spawn(
+    [process.execPath, astroBin, "build", "--outDir", outDir],
+    {
+      cwd: siteRoot,
+      env,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
+  const [stderr, stdout, code] = await Promise.all([
+    new Response(proc.stderr).text(),
+    new Response(proc.stdout).text(),
+    proc.exited,
+  ]);
+  await Bun.$`rm -rf ${outDir}`.quiet().nothrow();
+  return { code, output: stderr + stdout };
+}
+
+describe("astro build rejects invalid configuration", () => {
+  test("a bad SITE_URL fails the build", async () => {
+    const result = await build({
+      SITE_URL: "http://boringstack.example.com",
+      APP_URL: "https://app.boringstack.example.com",
+      CONTACT_EMAIL: "hello@boringstack.example.com",
+    });
+    expect(result.code).not.toBe(0);
+    expect(result.output).toContain("SITE_URL must use https");
+  }, 60_000);
+
+  test("a missing CONTACT_EMAIL fails a public-origin build", async () => {
+    const result = await build({
+      SITE_URL: "https://boringstack.example.com",
+      APP_URL: "https://app.boringstack.example.com",
+      CONTACT_EMAIL: "",
+    });
+    expect(result.code).not.toBe(0);
+    expect(result.output).toContain("CONTACT_EMAIL is required");
+  }, 60_000);
+
+  test("an unset SITE_URL fails the build", async () => {
+    const result = await build({
+      SITE_URL: "",
+      APP_URL: "https://app.boringstack.example.com",
+    });
+    expect(result.code).not.toBe(0);
+    expect(result.output).toContain("SITE_URL is required");
+  }, 60_000);
+});
diff --git a/apps/site/tests/unit/site-config.test.ts b/apps/site/tests/unit/site-config.test.ts
new file mode 100644
index 00000000..56c0f569
--- /dev/null
+++ b/apps/site/tests/unit/site-config.test.ts
@@ -0,0 +1,207 @@
+import { describe, expect, test } from "bun:test";
+import {
+  buildCsp,
+  resolveSiteConfig,
+  SiteConfigError,
+} from "../../src/lib/config-core.mjs";
+import { canonicalPath, jsonLd } from "../../src/lib/seo";
+
+const valid = {
+  SITE_URL: "https://boringstack.example.com",
+  APP_URL: "https://app.boringstack.example.com",
+  CONTACT_EMAIL: "hello@boringstack.example.com",
+};
+
+function rejects(env: Record<string, string>, pattern: RegExp) {
+  expect(() => resolveSiteConfig(env)).toThrow(SiteConfigError);
+  expect(() => resolveSiteConfig(env)).toThrow(pattern);
+}
+
+describe("resolveSiteConfig", () => {
+  test("accepts a public origin and normalises it to an origin", () => {
+    const config = resolveSiteConfig({
+      ...valid,
+      SITE_URL: "https://Boringstack.example.com/",
+    });
+    expect(config.siteUrl).toBe("https://boringstack.example.com");
+    expect(config.appUrl).toBe("https://app.boringstack.example.com");
+    expect(config.indexable).toBe(true);
+    expect(config.analytics).toBeNull();
+  });
+
+  test("is frozen so pages cannot mutate build configuration", () => {
+    expect(Object.isFrozen(resolveSiteConfig(valid))).toBe(true);
+  });
+
+  test("rejects a missing SITE_URL", () => {
+    rejects({ ...valid, SITE_URL: "" }, /SITE_URL is required/);
+  });
+
+  test("rejects a SITE_URL that is not an absolute URL", () => {
+    rejects(
+      { ...valid, SITE_URL: "boringstack.example.com" },
+      /SITE_URL must be an absolute URL/,
+    );
+  });
+
+  test("rejects a non-http scheme", () => {
+    rejects(
+      { ...valid, SITE_URL: "ftp://boringstack.example.com" },
+      /must use http or https/,
+    );
+  });
+
+  test("rejects a SITE_URL with a path", () => {
+    rejects(
+      { ...valid, SITE_URL: "https://boringstack.example.com/blog" },
+      /without a path/,
+    );
+  });
+
+  test("rejects a SITE_URL with a query or fragment", () => {
+    rejects(
+      { ...valid, SITE_URL: "https://boringstack.example.com/?a=1" },
+      /without a path/,
+    );
+    rejects(
+      { ...valid, SITE_URL: "https://boringstack.example.com/#top" },
+      /without a path/,
+    );
+  });
+
+  test("rejects credentials in SITE_URL", () => {
+    rejects(
+      { ...valid, SITE_URL: "https://user:pw@boringstack.example.com" },
+      /credentials/,
+    );
+  });
+
+  test("rejects plain http outside localhost", () => {
+    rejects(
+      { ...valid, SITE_URL: "http://boringstack.example.com" },
+      /must use https outside localhost/,
+    );
+  });
+
+  test("allows http on localhost for development, without indexing", () => {
+    const config = resolveSiteConfig({
+      SITE_URL: "http://localhost:7333",
+      APP_URL: "http://localhost:7331",
+    });
+    expect(config.indexable).toBe(false);
+    expect(config.contactEmail).toBe("");
+  });
+
+  test("requires CONTACT_EMAIL for a public-origin build", () => {
+    rejects({ ...valid, CONTACT_EMAIL: "" }, /CONTACT_EMAIL is required/);
+    rejects({ ...valid, CONTACT_EMAIL: "   " }, /CONTACT_EMAIL is required/);
+  });
+
+  test("rejects a malformed CONTACT_EMAIL", () => {
+    rejects(
+      { ...valid, CONTACT_EMAIL: "not-an-address" },
+      /CONTACT_EMAIL must be an email address/,
+    );
+  });
+
+  test("requires APP_URL to be a different origin from SITE_URL", () => {
+    rejects(
+      { ...valid, APP_URL: "https://boringstack.example.com" },
+      /different origin/,
+    );
+  });
+
+  test("rejects plain http APP_URL outside localhost", () => {
+    rejects(
+      { ...valid, APP_URL: "http://app.boringstack.example.com" },
+      /APP_URL must use https/,
+    );
+  });
+
+  test("analytics is off unless both values are set", () => {
+    expect(resolveSiteConfig(valid).analytics).toBeNull();
+    rejects(
+      {
+        ...valid,
+        ANALYTICS_SCRIPT_URL: "https://analytics.example.com/script.js",
+      },
+      /set together/,
+    );
+    rejects({ ...valid, ANALYTICS_WEBSITE_ID: "abc123" }, /set together/);
+  });
+
+  test("accepts a configured analytics script on https", () => {
+    const config = resolveSiteConfig({
+      ...valid,
+      ANALYTICS_SCRIPT_URL: "https://analytics.example.com/script.js",
+      ANALYTICS_WEBSITE_ID: "abc-123_X",
+    });
+    expect(config.analytics).toEqual({
+      scriptUrl: "https://analytics.example.com/script.js",
+      origin: "https://analytics.example.com",
+      websiteId: "abc-123_X",
+    });
+  });
+
+  test("rejects an analytics script that is not https", () => {
+    rejects(
+      {
+        ...valid,
+        ANALYTICS_SCRIPT_URL: "http://analytics.example.com/s.js",
+        ANALYTICS_WEBSITE_ID: "abc",
+      },
+      /must use https/,
+    );
+  });
+
+  test("rejects an analytics website id with unsafe characters", () => {
+    rejects(
+      {
+        ...valid,
+        ANALYTICS_SCRIPT_URL: "https://analytics.example.com/s.js",
+        ANALYTICS_WEBSITE_ID: 'x"><script>',
+      },
+      /ANALYTICS_WEBSITE_ID must be/,
+    );
+  });
+});
+
+describe("buildCsp", () => {
+  test("allows only 'self' when analytics is off", () => {
+    const csp = buildCsp(resolveSiteConfig(valid));
+    expect(csp).toContain("script-src 'self';");
+    expect(csp).toContain("style-src 'self';");
+    expect(csp).toContain("frame-ancestors 'none'");
+    expect(csp).not.toContain("https://");
+    expect(csp).not.toContain("unsafe-inline");
+  });
+
+  test("allows exactly the analytics origin for script and connect when configured", () => {
+    const csp = buildCsp(
+      resolveSiteConfig({
+        ...valid,
+        ANALYTICS_SCRIPT_URL: "https://analytics.example.com/s.js",
+        ANALYTICS_WEBSITE_ID: "abc",
+      }),
+    );
+    expect(csp).toContain("script-src 'self' https://analytics.example.com;");
+    expect(csp).toContain("connect-src 'self' https://analytics.example.com;");
+    expect(csp).not.toContain("https://analytics.example.com/s.js");
+  });
+});
+
+describe("canonical paths and structured data", () => {
+  test("canonicalPath is slashless and maps index pages to their directory", () => {
+    expect(canonicalPath("/")).toBe("/");
+    expect(canonicalPath("/index.html")).toBe("/");
+    expect(canonicalPath("/about/")).toBe("/about");
+    expect(canonicalPath("/about.html")).toBe("/about");
+    expect(canonicalPath("/blog/hello-world")).toBe("/blog/hello-world");
+  });
+
+  test("jsonLd escapes < so a value cannot close the script element", () => {
+    const out = jsonLd({ name: "</script><script>alert(1)" });
+    expect(out).not.toContain("</script>");
+    expect(JSON.parse(out)).toEqual({ name: "</script><script>alert(1)" });
+  });
+});
diff --git a/apps/site/tsconfig.json b/apps/site/tsconfig.json
new file mode 100644
index 00000000..efae4478
--- /dev/null
+++ b/apps/site/tsconfig.json
@@ -0,0 +1,8 @@
+{
+  "extends": "astro/tsconfigs/strict",
+  "include": [".astro/types.d.ts", "**/*"],
+  "exclude": ["dist", "node_modules", ".build"],
+  "compilerOptions": {
+    "types": ["bun", "node", "astro/client"]
+  }
+}
diff --git a/apps/ui/AGENTS.md b/apps/ui/AGENTS.md
index b57dcb53..a85edee8 100644
--- a/apps/ui/AGENTS.md
+++ b/apps/ui/AGENTS.md
@@ -25,6 +25,7 @@ focused pattern guides under [`docs/agents/`](docs/agents/).
 | Catching `ApiError`, error boundaries, Sentry                             | [errors](docs/agents/errors.md)                       |
 | Adding a shadcn primitive; `@theme` token wiring                          | [shadcn](docs/agents/shadcn.md)                       |
 | Adding an allowlist entry; debugging a security workflow                  | [security-pipeline](docs/agents/security-pipeline.md) |
+| Sharing code across apps; a `packages/` workspace; consuming it           | [shared-packages](docs/agents/shared-packages.md)     |
 | Starting a UI feature or a vertical slice (`/build-feature`)              | [feature-skills](docs/agents/feature-skills.md)       |
 | Reviewing a diff or running instance for security                         | [security-skills](docs/agents/security-skills.md)     |
 
diff --git a/apps/ui/budgets.md b/apps/ui/budgets.md
new file mode 100644
index 00000000..1d75f872
--- /dev/null
+++ b/apps/ui/budgets.md
@@ -0,0 +1,14 @@
+# Bundle budget reasons
+
+Limits in `.size-limit.json` do not go up silently. `bun run check:size-budget`
+(part of `bun run validate`, CI and pre-push) fails when a limit is raised, or a
+new entry is added, unless this file has a reason for that entry that is new or
+changed in the same change. Compare against the base branch, so an old reason
+cannot cover a later raise.
+
+Each reason is one line, written as the entry name in backticks, a colon, then
+the reason in a sentence. Reasons are at least ten characters long. Lowering a
+limit, or leaving it alone, needs no line here.
+
+Budgets are reviewed per feature. A raise states what grew and why the growth
+is acceptable, and the line is kept as the record of that decision.
diff --git a/apps/ui/bun.lock b/apps/ui/bun.lock
index abe546d6..9f00366d 100644
--- a/apps/ui/bun.lock
+++ b/apps/ui/bun.lock
@@ -99,14 +99,21 @@
     "@types/react": "19.2.18",
     "@types/react-dom": "19.2.5",
     "@typescript-eslint/utils": "8.61.1",
+    "basic-ftp": "6.2.1",
     "body-parser": "1.20.6",
+    "compression": "1.8.2",
+    "ip-address": "10.7.2",
     "js-yaml": "4.3.2",
     "postcss": "8.5.23",
+    "proxy-addr": "2.0.8",
     "qs": "6.16.0",
     "react": "19.2.8",
     "react-dom": "19.2.8",
+    "shell-quote": "1.11.0",
+    "smol-toml": "1.9.0",
+    "source-map-js": "1.2.2",
     "tmp": "0.2.7",
-    "undici": "7.29.0",
+    "undici": "7.29.1",
     "ws": "8.21.3",
   },
   "packages": {
@@ -386,7 +393,7 @@
 
     "@manypkg/tools": ["@manypkg/tools@2.1.2", "", { "dependencies": { "jju": "^1.4.0", "tinyglobby": "^0.2.13", "yaml": "^2.9.0" } }, "sha512-6QEf6yqFbETdwGITKq57aYoPfX/3K8XFNwsAlx0C1M7o8cb79sv1M3w+tWuWvIcSbNqrLF7OD7YpZMVVz335hQ=="],
 
-    "@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.30.0", "", { "dependencies": { "@hono/node-server": "^1.19.9 || ^2.0.5", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA=="],
+    "@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.31.0", "", { "dependencies": { "@hono/node-server": "^1.19.9 || ^2.0.5", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-UvTMgnNlnIBO/22ob2RcVGDlcvOslQs8T59+FTGdA0L27a39fdGF/EDETNtDVK4DZGpwomlsYpRdA8UXcVL/pw=="],
 
     "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.2.2", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.3", "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.3" } }, "sha512-JfB4kuJQjaoHuCTseIINHtHWeJnvgEcxjwA5t/Y00ZgaOO1Crz3fjT/p8kT28zA/Caz7oiUMn3d6H2yOVCVwuw=="],
 
@@ -1012,13 +1019,13 @@
 
     "baseline-browser-mapping": ["baseline-browser-mapping@2.11.12", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-r7WnVImvVCeFpf2DOXfy41aPWzeNg3H/A2X4dKmy1QL0MSyyk/e7z8ihJ3N6Nn2PsdhkVlqnEfnUE4a05P2aTA=="],
 
-    "basic-ftp": ["basic-ftp@5.3.1", "", {}, "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw=="],
+    "basic-ftp": ["basic-ftp@6.2.1", "", {}, "sha512-bK67isD+lKq46AU8vNtjvMaT2ZqAOAmNCbxUHlFBRD4k15NWxyEjmaKtZPlgce58So4BNTjITGQOVTjL9y0ECA=="],
 
     "bidi-js": ["bidi-js@1.0.3", "", { "dependencies": { "require-from-string": "^2.0.2" } }, "sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw=="],
 
     "body-parser": ["body-parser@1.20.6", "", { "dependencies": { "bytes": "~3.1.2", "content-type": "~1.0.5", "debug": "2.6.9", "depd": "2.0.0", "destroy": "~1.2.0", "http-errors": "~2.0.1", "iconv-lite": "~0.4.24", "on-finished": "~2.4.1", "qs": "~6.15.1", "raw-body": "~2.5.3", "type-is": "~1.6.18", "unpipe": "~1.0.0" } }, "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g=="],
 
-    "brace-expansion": ["brace-expansion@2.1.4", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg=="],
+    "brace-expansion": ["brace-expansion@2.1.7", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g=="],
 
     "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
 
@@ -1090,7 +1097,7 @@
 
     "compressible": ["compressible@2.0.18", "", { "dependencies": { "mime-db": ">= 1.43.0 < 2" } }, "sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg=="],
 
-    "compression": ["compression@1.8.1", "", { "dependencies": { "bytes": "3.1.2", "compressible": "~2.0.18", "debug": "2.6.9", "negotiator": "~0.6.4", "on-headers": "~1.1.0", "safe-buffer": "5.2.1", "vary": "~1.1.2" } }, "sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w=="],
+    "compression": ["compression@1.8.2", "", { "dependencies": { "bytes": "3.1.2", "compressible": "~2.0.18", "debug": "2.6.9", "destroy": "1.2.0", "negotiator": "~0.6.4", "on-headers": "~1.1.0", "safe-buffer": "5.2.1", "vary": "~1.1.2" } }, "sha512-o8vI5RE5A6EVVOd9o41jKp41aJom+QTEO/Bx8MYNjexMo/Bv2WOjUfZr+aL0WnYSgymUy6zeguqLTsIhV0gMvQ=="],
 
     "concat-map": ["concat-map@0.0.1", "", {}, "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="],
 
@@ -1334,7 +1341,7 @@
 
     "fast-string-width": ["fast-string-width@3.0.2", "", { "dependencies": { "fast-string-truncated-width": "^3.0.2" } }, "sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg=="],
 
-    "fast-uri": ["fast-uri@3.1.7", "", {}, "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg=="],
+    "fast-uri": ["fast-uri@3.1.8", "", {}, "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg=="],
 
     "fast-wrap-ansi": ["fast-wrap-ansi@0.2.2", "", { "dependencies": { "fast-string-width": "^3.0.2" } }, "sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q=="],
 
@@ -1500,7 +1507,7 @@
 
     "invariant": ["invariant@2.2.4", "", { "dependencies": { "loose-envify": "^1.0.0" } }, "sha512-phJfQVBuaJM5raOpJjSfkiD6BpbCE4Ns//LaXl6wGYtUBY83nWS6Rf9tXm2e8VaK60JEjYldbPif/A2B1C2gNA=="],
 
-    "ip-address": ["ip-address@10.4.0", "", {}, "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ=="],
+    "ip-address": ["ip-address@10.7.2", "", {}, "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w=="],
 
     "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="],
 
@@ -1940,7 +1947,7 @@
 
     "prop-types": ["prop-types@15.8.1", "", { "dependencies": { "loose-envify": "^1.4.0", "object-assign": "^4.1.1", "react-is": "^16.13.1" } }, "sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg=="],
 
-    "proxy-addr": ["proxy-addr@2.0.7", "", { "dependencies": { "forwarded": "0.2.0", "ipaddr.js": "1.9.1" } }, "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg=="],
+    "proxy-addr": ["proxy-addr@2.0.8", "", { "dependencies": { "forwarded": "0.2.0", "ipaddr.js": "1.9.1" } }, "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ=="],
 
     "proxy-agent": ["proxy-agent@6.5.0", "", { "dependencies": { "agent-base": "^7.1.2", "debug": "^4.3.4", "http-proxy-agent": "^7.0.1", "https-proxy-agent": "^7.0.6", "lru-cache": "^7.14.1", "pac-proxy-agent": "^7.1.0", "proxy-from-env": "^1.1.0", "socks-proxy-agent": "^8.0.5" } }, "sha512-TmatMXdr2KlRiA2CyDu8GqR8EjahTG3aY3nXjdzFyoZbmB8hrBsTyMezhULIXKnC0jpfjlmiZ3+EaCzoInSu/A=="],
 
@@ -2084,7 +2091,7 @@
 
     "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
 
-    "shell-quote": ["shell-quote@1.10.0", "", {}, "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA=="],
+    "shell-quote": ["shell-quote@1.11.0", "", {}, "sha512-JdxDPD0DBTyu08pq0kPC0xSNet/qsU07qT6IsX1AS8oO2ICNRY4ldNa8OAI6PuwAH8tG3lxEhbqmyp4Dw4036g=="],
 
     "side-channel": ["side-channel@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4", "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ=="],
 
@@ -2104,7 +2111,7 @@
 
     "smart-buffer": ["smart-buffer@4.2.0", "", {}, "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg=="],
 
-    "smol-toml": ["smol-toml@1.8.0", "", {}, "sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ=="],
+    "smol-toml": ["smol-toml@1.9.0", "", {}, "sha512-hpd+HLON7HdZXqYchMM/+LaTTbdK0AU3NngIJ4KVyWbY9bfQqdL9cD+4yf6dUoU2Ap4VsU0JkQi6FxAI1B2mXQ=="],
 
     "snake-case": ["snake-case@3.0.4", "", { "dependencies": { "dot-case": "^3.0.4", "tslib": "^2.0.3" } }, "sha512-LAOh4z89bGQvl9pFfNF8V146i7o7/CqFPbqzYgP+yYzDIDeS9HaNFtXABamRW+AQzEVODcvE79ljJ+8a9YSdMg=="],
 
@@ -2116,7 +2123,7 @@
 
     "source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
 
-    "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
+    "source-map-js": ["source-map-js@1.2.2", "", {}, "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw=="],
 
     "speedline-core": ["speedline-core@1.4.3", "", { "dependencies": { "@types/node": "*", "image-ssim": "^0.2.0", "jpeg-js": "^0.4.1" } }, "sha512-DI7/OuAUD+GMpR6dmu8lliO2Wg5zfeh+/xsdyJZCzd8o5JgFUjCeLsBDuZjIQJdwXS3J0L/uZYrELKYqx+PXog=="],
 
@@ -2264,7 +2271,7 @@
 
     "unbox-primitive": ["unbox-primitive@1.1.0", "", { "dependencies": { "call-bound": "^1.0.3", "has-bigints": "^1.0.2", "has-symbols": "^1.1.0", "which-boxed-primitive": "^1.1.1" } }, "sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw=="],
 
-    "undici": ["undici@7.29.0", "", {}, "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw=="],
+    "undici": ["undici@7.29.1", "", {}, "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q=="],
 
     "undici-types": ["undici-types@8.3.0", "", {}, "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ=="],
 
@@ -2754,7 +2761,7 @@
 
     "@dotenvx/dotenvx/which/isexe": ["isexe@3.1.5", "", {}, "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w=="],
 
-    "@eslint/config-array/minimatch/brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
+    "@eslint/config-array/minimatch/brace-expansion": ["brace-expansion@5.0.12", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ=="],
 
     "@modelcontextprotocol/sdk/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
 
@@ -2814,11 +2821,11 @@
 
     "@tailwindcss/node/lightningcss/lightningcss-win32-x64-msvc": ["lightningcss-win32-x64-msvc@1.32.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q=="],
 
-    "@ts-morph/common/minimatch/brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
+    "@ts-morph/common/minimatch/brace-expansion": ["brace-expansion@5.0.12", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ=="],
 
     "@typescript-eslint/eslint-plugin/@typescript-eslint/scope-manager/@typescript-eslint/types": ["@typescript-eslint/types@8.69.0", "", {}, "sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA=="],
 
-    "@typescript-eslint/typescript-estree/minimatch/brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
+    "@typescript-eslint/typescript-estree/minimatch/brace-expansion": ["brace-expansion@5.0.12", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ=="],
 
     "@typescript-eslint/utils/@typescript-eslint/typescript-estree/@typescript-eslint/project-service": ["@typescript-eslint/project-service@8.61.1", "", { "dependencies": { "@typescript-eslint/tsconfig-utils": "^8.61.1", "@typescript-eslint/types": "^8.61.1", "debug": "^4.4.3" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-PrC4JYGmR241lYnfhmKGTXkFqv8+ymbTFgSAY0fVXpY82/QkMw5TZPl+vGzuDDU2QYJk9fIDOBTntF+yDv9LEA=="],
 
@@ -2850,17 +2857,17 @@
 
     "enquirer/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
 
-    "eslint-plugin-import/minimatch/brace-expansion": ["brace-expansion@1.1.18", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw=="],
+    "eslint-plugin-import/minimatch/brace-expansion": ["brace-expansion@1.1.21", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw=="],
 
     "eslint-plugin-import/tsconfig-paths/json5": ["json5@1.0.2", "", { "dependencies": { "minimist": "^1.2.0" }, "bin": { "json5": "lib/cli.js" } }, "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA=="],
 
-    "eslint-plugin-jsx-a11y/minimatch/brace-expansion": ["brace-expansion@1.1.18", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw=="],
+    "eslint-plugin-jsx-a11y/minimatch/brace-expansion": ["brace-expansion@1.1.21", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw=="],
 
-    "eslint-plugin-react/minimatch/brace-expansion": ["brace-expansion@1.1.18", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw=="],
+    "eslint-plugin-react/minimatch/brace-expansion": ["brace-expansion@1.1.21", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw=="],
 
-    "eslint-plugin-sonarjs/minimatch/brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
+    "eslint-plugin-sonarjs/minimatch/brace-expansion": ["brace-expansion@5.0.12", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ=="],
 
-    "eslint/minimatch/brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
+    "eslint/minimatch/brace-expansion": ["brace-expansion@5.0.12", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ=="],
 
     "estimo/puppeteer-core/@puppeteer/browsers": ["@puppeteer/browsers@2.10.10", "", { "dependencies": { "debug": "^4.4.3", "extract-zip": "^2.0.1", "progress": "^2.0.3", "proxy-agent": "^6.5.0", "semver": "^7.7.2", "tar-fs": "^3.1.0", "yargs": "^17.7.2" }, "bin": { "browsers": "lib/cjs/main-cli.js" } }, "sha512-3ZG500+ZeLql8rE0hjfhkycJjDj0pI/btEh3L9IkWUYcOrgP0xCNRq3HbtbqOPbvDhFaAWD88pDFtlLv8ns8gA=="],
 
@@ -2878,7 +2885,7 @@
 
     "find-chrome-bin/@puppeteer/browsers/yargs": ["yargs@17.7.3", "", { "dependencies": { "cliui": "^8.0.1", "escalade": "^3.1.1", "get-caller-file": "^2.0.5", "require-directory": "^2.1.1", "string-width": "^4.2.3", "y18n": "^5.0.5", "yargs-parser": "^21.1.1" } }, "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g=="],
 
-    "glob/minimatch/brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
+    "glob/minimatch/brace-expansion": ["brace-expansion@5.0.12", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ=="],
 
     "lighthouse-logger/debug/ms": ["ms@2.0.0", "", {}, "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="],
 
@@ -3038,7 +3045,7 @@
 
     "@typescript-eslint/utils/@typescript-eslint/typescript-estree/@typescript-eslint/project-service/@typescript-eslint/types": ["@typescript-eslint/types@8.65.0", "", {}, "sha512-JSSwWNy+H0E/01jJEM+hrX6N0OFDzFzeIhHFSAS01tlVaevpG8cFyYRPhS5yjGOvBUx3sqQHVMjCL1CAZZMxBg=="],
 
-    "@typescript-eslint/utils/@typescript-eslint/typescript-estree/minimatch/brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
+    "@typescript-eslint/utils/@typescript-eslint/typescript-estree/minimatch/brace-expansion": ["brace-expansion@5.0.12", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ=="],
 
     "eslint-plugin-sonarjs/minimatch/brace-expansion/balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
 
@@ -3074,7 +3081,7 @@
 
     "pkg-up/find-up/locate-path/path-exists": ["path-exists@3.0.0", "", {}, "sha512-bpC7GYwiDYQ4wYLe+FA8lhRjhQCMcQGuSgGGqDkg/QerRWw9CmGRT0iSOVRSZJ29NMLZgIzqaljJ63oaL4NIJQ=="],
 
-    "rimraf/glob/minimatch/brace-expansion": ["brace-expansion@1.1.18", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw=="],
+    "rimraf/glob/minimatch/brace-expansion": ["brace-expansion@1.1.21", "", { "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" } }, "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw=="],
 
     "storybook/open/wsl-utils/is-wsl": ["is-wsl@3.1.1", "", { "dependencies": { "is-inside-container": "^1.0.0" } }, "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw=="],
 
diff --git a/apps/ui/bunfig.toml b/apps/ui/bunfig.toml
index 19cd2793..4a3579b3 100644
--- a/apps/ui/bunfig.toml
+++ b/apps/ui/bunfig.toml
@@ -33,12 +33,6 @@ minimumReleaseAgeExcludes = [
   # by @lhci/cli; 0.15.1 is the latest @lhci/cli so we override `tmp` directly
   # to clear `bun audit`.
   "tmp",
-  # undici 7.29.0 patches GHSA-vmh5-mc38-953g (TLS cert-validation bypass) and
-  # GHSA-pr7r-676h-xcf6, plus the GHSA-4cwx-7wf7-3272 / GHSA-8xcm-r25x-g524 /
-  # GHSA-jr45-8vmc-qm54 / GHSA-m8rv-5g2x-5cg5 / GHSA-v3r7-h72x-cjcm batch.
-  # Pulled in transitively by jsdom (test env only); the patched release is
-  # <7 days old, so exempt it from the quarantine window.
-  "undici",
   # nanoid 3.3.18 patches GHSA-2v37-7h3g-55p8. Pulled in transitively by
   # postcss (build-time CSS tooling); the patched release is <7 days old, so
   # exempt it from the quarantine window.
diff --git a/apps/ui/docs/agents/shared-packages.md b/apps/ui/docs/agents/shared-packages.md
new file mode 100644
index 00000000..f93bb9ce
--- /dev/null
+++ b/apps/ui/docs/agents/shared-packages.md
@@ -0,0 +1,91 @@
+# Shared packages (`packages/*`)
+
+Read when code must be shared by more than one app, when adding a package under
+`packages/`, or when the UI starts consuming one.
+
+## Where shared code goes
+
+Code used by two or more apps goes in `packages/<name>/`. Code used by one app
+stays in that app. A package holds no secrets and no app-specific routes or
+pages.
+
+## Package shape
+
+```
+packages/<name>/
+  package.json        "private": true, scripts below
+  src/index.ts        public entry; everything else is internal
+  tsconfig.json       extends ../../apps/ui/tsconfig.json
+  eslint.config.mjs   imports the UI config (see below)
+```
+
+A package borrows the UI toolchain. Its lint, format and typecheck scripts run
+the binaries installed in `apps/ui/node_modules`, so run `bun install` in
+`apps/ui` first. A package with runtime dependencies of its own lists them in
+its `package.json` and installs them itself.
+
+## Required scripts
+
+```json
+{
+  "lint": "bun ../../apps/ui/node_modules/eslint/bin/eslint.js --max-warnings=0 .",
+  "format:check": "bun ../../apps/ui/node_modules/prettier/bin/prettier.cjs --check .",
+  "typecheck": "bun ../../apps/ui/node_modules/typescript/bin/tsc -p tsconfig.json",
+  "validate": "bun run lint && bun run typecheck && bun run format:check"
+}
+```
+
+`validate` is the package gate. It is required. `--max-warnings=0` is required
+on `lint`, so a warning fails the gate the same way an error does.
+
+## Lint and tsconfig
+
+`eslint.config.mjs` reuses the UI rule set, so the package is held to the same
+architecture rules as the app:
+
+```js
+import uiConfig from "../../apps/ui/eslint.config.mjs";
+
+export default [{ ignores: ["node_modules", "dist"] }, ...uiConfig];
+```
+
+The UI config's file globs (`src/**`) are relative to the UI directory, so a
+package keeps its code under `src/` to match them. Turn off a UI rule in a
+later block only when it cannot apply, and say why in a comment.
+
+`tsconfig.json` extends the UI config and sets `"include": ["src/**/*.ts"]` with
+`"noEmit": true`.
+
+## Root wiring
+
+- `scripts/stack-lib.sh` (`validate_packages`) runs `bun run validate` in every
+  `packages/*/` that has a `package.json`. A package without a `validate` script
+  fails the check.
+- `scripts/stack-check.sh` runs that as the `packages validate` step of
+  `bun run check`.
+- `scripts/ci/pre-push.sh` runs it when anything under `packages/` changed.
+- `.github/workflows/apps-ui-validate.yml` runs it on `packages/**` changes.
+
+A product with no `packages/` directory gets no packages checks and no error.
+
+## Consuming a package from `apps/ui`
+
+Nothing in the UI build knows about packages until one is consumed. When the
+first one is, add:
+
+- `tsconfig.json`: a `paths` entry such as
+  `"@/lib/<name>": ["../../packages/<name>/src/index.ts"]` (keep the `@/*` entry
+  for `src/`), and the package's `src/**/*.ts` in `include`. Vitest reads these
+  paths through `tsconfigPaths: true`, so tests resolve the same way.
+- `vite.config.ts`, `server.fs.allow`: add `"../../packages"`. Without it the dev
+  server refuses to serve files outside `apps/ui`.
+- `vite.config.ts`, `resolve.dedupe`: list every dependency that both the app and
+  the package declare (for example `zod`), so the bundle carries one copy.
+
+## Known gaps
+
+- `lint:meta` scans only `src/`, `tests/`, `e2e/` and `.storybook/`
+  (`scripts/lint-meta/context.ts`). Its architecture rules do not run on
+  `packages/`. The package's own ESLint config is the only architecture gate
+  there.
+- The bundle budget gate (`check:size-budget`) covers `apps/ui` output only.
diff --git a/apps/ui/osv-scanner.toml b/apps/ui/osv-scanner.toml
index 8e4c01e8..a77b89ea 100644
--- a/apps/ui/osv-scanner.toml
+++ b/apps/ui/osv-scanner.toml
@@ -15,6 +15,15 @@ exposes glob handling to user input. Awaiting upstream patch in the
 transitive tree.
 """
 
+[[IgnoredVulns]]
+id = "GHSA-vfj7-8cjw-p6xm"
+ignoreUntil = "2026-11-18T00:00:00Z"
+reason = """
+braces 3.0.3 (no fixed release yet). Reached only through micromatch 4.0.5 in
+build and lint tooling (vite, eslint plugins, fast-glob). Never in the shipped
+bundle and never reached by user input. Remove once braces is patched.
+"""
+
 [[IgnoredVulns]]
 id = "GHSA-48c2-rrv3-qjmp"
 ignoreUntil = "2026-11-18T00:00:00Z"
diff --git a/apps/ui/package.json b/apps/ui/package.json
index bc661422..5824737c 100644
--- a/apps/ui/package.json
+++ b/apps/ui/package.json
@@ -15,10 +15,11 @@
     "dev:docker": "bun --no-install ./node_modules/.bin/vite",
     "build": "vite build && (cp _headers dist/ 2>/dev/null || true)",
     "preview": "vite preview",
-    "validate": "bun run check && bun run test:ci && bun run build && bun run size:check && bun run size:check:modulepreload",
+    "validate": "bun run check && bun run test:ci && bun run build && bun run size:check && bun run size:check:modulepreload && bun run check:size-budget",
     "validate:full": "bun run validate && bun run e2e:ci",
     "size:check": "size-limit",
     "size:check:modulepreload": "tsx scripts/quality/check-modulepreload-size-coverage.ts",
+    "check:size-budget": "tsx scripts/quality/check-size-budget-raises.ts",
     "size:why": "size-limit --why",
     "analyze": "ANALYZE=true bun run build && open dist/stats.html",
     "lighthouse": "bun run build && lhci autorun",
@@ -154,7 +155,14 @@
     "ws": "Pin patched ws (GHSA-58qx-3vcg-4xpx) pulled via lighthouse dev tooling; mirrors the docs app pin.",
     "qs": "Pin patched qs (GHSA-q8mj-m7cp-5q26, GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx). 6.15.2 is vulnerable; 6.16.0 patches it. Pulled via dev tooling; mirrors the docs app pin.",
     "tmp": "Pin patched tmp (GHSA-7c78-jf6q-g5cm type-confusion path traversal); 0.2.6 is now vulnerable, 0.2.7 patches it. Transitive dev-tooling dep via @lhci/cli. Mirrors the docs app pin.",
-    "undici": "Pin patched undici (GHSA-vmh5-mc38-953g TLS cert-validation bypass, GHSA-pr7r-676h-xcf6, plus the 7.29.0 batch: GHSA-4cwx-7wf7-3272, GHSA-8xcm-r25x-g524, GHSA-jr45-8vmc-qm54, GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcm); pulled in transitively by jsdom (test environment only). 7.29.0 is the patched release. Excluded from the install quarantine while <7 days old.",
+    "undici": "Pin patched undici (GHSA-vmh5-mc38-953g TLS cert-validation bypass, GHSA-pr7r-676h-xcf6, the 7.29.0 batch: GHSA-4cwx-7wf7-3272, GHSA-8xcm-r25x-g524, GHSA-jr45-8vmc-qm54, GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcm, and GHSA-3wwx-pv8p-q78v plus the 7.29.0 advisories fixed in 7.29.1); pulled in transitively by jsdom (test environment only). 7.29.1 is the patched release. Mirrors the docs and site app pins.",
+    "basic-ftp": "Pin patched basic-ftp (GHSA-c475-qrg2-pj4r, CPU exhaustion parsing a directory listing). 5.3.1 is vulnerable; 6.2.1 patches it. Transitive via proxy-agent -> get-uri in the puppeteer / Lighthouse CI tooling; 6.0's only break (separate transfer hosts off by default) does not touch get-uri's use. Mirrored by apps/docs.",
+    "compression": "Pin patched compression (GHSA-vc2v-76pw-4v95). 1.8.1 is vulnerable; 1.8.2 patches it. Transitive via dev/CI server tooling (http-server, Lighthouse CI); never in the static bundle.",
+    "ip-address": "Pin patched ip-address (GHSA-2vr4-cq9g-pvrc, GHSA-rpw4-54j3-4h4q, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv). 10.4.0 is vulnerable; 10.7.2 patches them. Transitive via proxy-agent -> socks and express-rate-limit in the puppeteer / Lighthouse CI tooling. Mirrored by apps/docs.",
+    "proxy-addr": "Pin patched proxy-addr (GHSA-jqcg-44mw-7w3h). 2.0.7 is vulnerable; 2.0.8 patches it. Transitive via express in @lhci/cli (CI-only).",
+    "shell-quote": "Pin patched shell-quote (GHSA-pqg4-j6r4-53mv). 1.10.0 is vulnerable; 1.11.0 patches it. Transitive via launch-editor (dev tooling).",
+    "smol-toml": "Pin patched smol-toml (GHSA-r4xh-jqrq-34v2). 1.8.0 is vulnerable; 1.9.0 patches it. Transitive via knip (lint-time only). Mirrored in every app by the override-parity rule.",
+    "source-map-js": "Pin patched source-map-js (GHSA-68fv-2mgg-jv7q). 1.2.1 is vulnerable; 1.2.2 patches it. Transitive via postcss / css-tree build tooling. Mirrored in every app by the override-parity rule.",
     "@types/react": "Single React types resolution across the workspace.",
     "@types/react-dom": "Single React DOM types resolution across the workspace.",
     "@typescript-eslint/utils": "Match the API app's pin so the shared ESLint plugins resolve one utils version.",
@@ -165,14 +173,21 @@
     "@types/react": "19.2.18",
     "@types/react-dom": "19.2.5",
     "@typescript-eslint/utils": "8.61.1",
+    "basic-ftp": "6.2.1",
     "body-parser": "1.20.6",
+    "compression": "1.8.2",
+    "ip-address": "10.7.2",
     "js-yaml": "4.3.2",
     "postcss": "8.5.23",
+    "proxy-addr": "2.0.8",
     "qs": "6.16.0",
     "react": "19.2.8",
     "react-dom": "19.2.8",
+    "shell-quote": "1.11.0",
+    "smol-toml": "1.9.0",
+    "source-map-js": "1.2.2",
     "tmp": "0.2.7",
-    "undici": "7.29.0",
+    "undici": "7.29.1",
     "ws": "8.21.3"
   }
 }
diff --git a/apps/ui/scripts/README.md b/apps/ui/scripts/README.md
index 9fec1cdd..d79a481a 100644
--- a/apps/ui/scripts/README.md
+++ b/apps/ui/scripts/README.md
@@ -25,6 +25,7 @@ When you add a `package.json` script that runs a file under `scripts/`, update t
 | `bun run generate:lint-meta-docs`  | `lint-meta/generate-rules-md.ts`               |
 | `bun run test:ci`                  | `quality/run-tests-clean.ts`                   |
 | `bun run size:check:modulepreload` | `quality/check-modulepreload-size-coverage.ts` |
+| `bun run check:size-budget`        | `quality/check-size-budget-raises.ts`          |
 | `bun run generate:api`             | `codegen/generate-api.ts`                      |
 | `bun run generate:api:check`       | `codegen/generate-api.ts --check`              |
 | `bun run new:component`            | `codegen/new-component.ts`                     |
diff --git a/apps/ui/scripts/ci/pre-push.manifest.json b/apps/ui/scripts/ci/pre-push.manifest.json
index 0687595c..3cd1b424 100644
--- a/apps/ui/scripts/ci/pre-push.manifest.json
+++ b/apps/ui/scripts/ci/pre-push.manifest.json
@@ -5,6 +5,7 @@
     "bun run test:ci",
     "bun run build",
     "bun run size:check",
-    "bun run size:check:modulepreload"
+    "bun run size:check:modulepreload",
+    "bun run check:size-budget"
   ]
 }
diff --git a/apps/ui/scripts/ci/pre-push.sh b/apps/ui/scripts/ci/pre-push.sh
index 51adbfc9..b5cece45 100755
--- a/apps/ui/scripts/ci/pre-push.sh
+++ b/apps/ui/scripts/ci/pre-push.sh
@@ -7,7 +7,7 @@
 #   2. Dependency    : osv-scanner against bun.lock
 #   3. Tests         : vitest run --coverage (no services needed)
 #   4. Build         : vite build (catches type-level regressions through routes)
-#   5. Size          : size-limit budget
+#   5. Size          : size-limit budget and budget raise reasons
 #   6. OpenAPI drift : if apps/api is reachable on :7330, ensure schema is fresh
 #
 # Set ALLOW_OPENAPI_DRIFT_SKIP=false to fail instead of skip when the API is
@@ -66,6 +66,7 @@ RAN=$((RAN + 1))
 step "5/${TOTAL} Bundle size budgets"
 bun run size:check
 bun run size:check:modulepreload
+bun run check:size-budget
 ok "size budgets met"
 RAN=$((RAN + 1))
 
diff --git a/apps/ui/scripts/quality/check-size-budget-raises.ts b/apps/ui/scripts/quality/check-size-budget-raises.ts
new file mode 100644
index 00000000..9ac7c8ac
--- /dev/null
+++ b/apps/ui/scripts/quality/check-size-budget-raises.ts
@@ -0,0 +1,233 @@
+#!/usr/bin/env tsx
+/**
+ * Bundle budget gate. A limit in .size-limit.json may only go up with a reason.
+ *
+ * An entry is "raised" when its limit grows against the base, and "new" when the
+ * base does not have it. Each one needs a reason line in budgets.md that is new
+ * or changed relative to the base, so an old reason cannot cover a later raise.
+ * Decreases and unchanged entries need nothing.
+ *
+ * Base: `--base <ref>`, else the merge-base of origin/main and HEAD. When that
+ * merge-base is HEAD itself (a push to main), HEAD~1 is used instead.
+ * Head: the working tree, so the same check runs locally and in CI.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const SIZE_LIMIT_FILE = ".size-limit.json";
+export const BUDGET_LEDGER_FILE = "budgets.md";
+export const MIN_REASON_LENGTH = 10;
+
+const EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+const UNIT_BYTES = new Map<string, number>([
+  ["b", 1],
+  ["kb", 1024],
+  ["mb", 1024 * 1024]
+]);
+const LIMIT_PATTERN = /^\s*(\d+(?:\.\d+)?)\s*(B|KB|MB)\s*$/iu;
+const LEDGER_LINE_PATTERN = /^- `([^`]+)`:\s*(.+)$/u;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+export function parseLimitBytes(limit: string): number {
+  const match = LIMIT_PATTERN.exec(limit);
+  const value = match?.[1];
+  const unit = match?.[2];
+  const multiplier =
+    unit === undefined ? undefined : UNIT_BYTES.get(unit.toLowerCase());
+
+  if (value === undefined || multiplier === undefined) {
+    throw new Error(`unsupported size-limit limit "${limit}"`);
+  }
+
+  return Math.round(Number(value) * multiplier);
+}
+
+/** Entry name to limit in bytes. Entries without a string limit are not budgets. */
+export function parseSizeLimit(json: string): Map<string, number> {
+  const parsed: unknown = JSON.parse(json);
+
+  if (!Array.isArray(parsed)) {
+    throw new Error(`${SIZE_LIMIT_FILE} must be a JSON array`);
+  }
+
+  const limits = new Map<string, number>();
+
+  for (const entry of parsed) {
+    if (
+      isRecord(entry) &&
+      typeof entry.name === "string" &&
+      typeof entry.limit === "string"
+    ) {
+      limits.set(entry.name, parseLimitBytes(entry.limit));
+    }
+  }
+
+  return limits;
+}
+
+/** Entry name to reason, from lines shaped as "- `<entry name>`: <reason>". */
+export function parseLedger(markdown: string): Map<string, string> {
+  const reasons = new Map<string, string>();
+
+  for (const line of markdown.split("\n")) {
+    const match = LEDGER_LINE_PATTERN.exec(line.trim());
+    const name = match?.[1];
+    const reason = match?.[2]?.trim();
+
+    if (name !== undefined && reason !== undefined) {
+      reasons.set(name, reason);
+    }
+  }
+
+  return reasons;
+}
+
+function formatKb(bytes: number): string {
+  return `${(bytes / 1024).toFixed(2)} KB`;
+}
+
+export interface IBudgetSnapshot {
+  readonly limits: ReadonlyMap<string, number>;
+  readonly reasons: ReadonlyMap<string, string>;
+}
+
+export function findBudgetRaiseViolations(
+  base: IBudgetSnapshot,
+  head: IBudgetSnapshot
+): string[] {
+  const violations: string[] = [];
+
+  for (const [name, headBytes] of head.limits) {
+    const baseBytes = base.limits.get(name);
+
+    if (baseBytes !== undefined && headBytes <= baseBytes) {
+      continue;
+    }
+
+    const change =
+      baseBytes === undefined
+        ? `new entry at ${formatKb(headBytes)}`
+        : `raised from ${formatKb(baseBytes)} to ${formatKb(headBytes)}`;
+    const reason = head.reasons.get(name);
+
+    if (reason === undefined || reason.length < MIN_REASON_LENGTH) {
+      violations.push(
+        `"${name}": ${change} needs a reason line in ${BUDGET_LEDGER_FILE}: - \`${name}\`: <why>`
+      );
+    } else if (reason === base.reasons.get(name)) {
+      violations.push(
+        `"${name}": ${change}; its reason in ${BUDGET_LEDGER_FILE} is unchanged from the base, write one for this change`
+      );
+    }
+  }
+
+  return violations;
+}
+
+const UI_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
+
+function git(args: readonly string[]): string | null {
+  try {
+    return execFileSync("git", args, {
+      cwd: UI_ROOT,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return null;
+  }
+}
+
+/** Contents of a file at a git ref, or null when the file does not exist there. */
+function readAtRef(ref: string, file: string): string | null {
+  return git(["show", `${ref}:./${file}`]);
+}
+
+function resolveBase(explicit: string | undefined): string {
+  if (explicit !== undefined) {
+    return explicit;
+  }
+
+  const mergeBase = git(["merge-base", "origin/main", "HEAD"])?.trim();
+
+  if (mergeBase === undefined || mergeBase === "") {
+    throw new Error(
+      "cannot resolve origin/main; fetch it or pass --base <ref>"
+    );
+  }
+
+  if (mergeBase !== git(["rev-parse", "HEAD"])?.trim()) {
+    return mergeBase;
+  }
+
+  return (
+    git(["rev-parse", "--verify", "--quiet", "HEAD~1"])?.trim() ??
+    EMPTY_TREE_SHA
+  );
+}
+
+function readBaseSnapshot(ref: string): IBudgetSnapshot {
+  const limitJson = readAtRef(ref, SIZE_LIMIT_FILE);
+  const ledger = readAtRef(ref, BUDGET_LEDGER_FILE);
+
+  return {
+    limits: limitJson === null ? new Map() : parseSizeLimit(limitJson),
+    reasons: ledger === null ? new Map() : parseLedger(ledger)
+  };
+}
+
+function readHeadSnapshot(): IBudgetSnapshot {
+  const limitPath = resolve(UI_ROOT, SIZE_LIMIT_FILE);
+  const ledgerPath = resolve(UI_ROOT, BUDGET_LEDGER_FILE);
+  const ledger = existsSync(ledgerPath) ? readFileSync(ledgerPath, "utf8") : "";
+
+  return {
+    limits: parseSizeLimit(readFileSync(limitPath, "utf8")),
+    reasons: parseLedger(ledger)
+  };
+}
+
+function main(): void {
+  const args = process.argv.slice(2);
+  const baseIndex = args.indexOf("--base");
+  const explicitBase = baseIndex === -1 ? undefined : args[baseIndex + 1];
+
+  if (baseIndex !== -1 && explicitBase === undefined) {
+    throw new Error("--base needs a git ref");
+  }
+
+  const base = resolveBase(explicitBase);
+  const violations = findBudgetRaiseViolations(
+    readBaseSnapshot(base),
+    readHeadSnapshot()
+  );
+
+  if (violations.length > 0) {
+    console.error(
+      `[check:size-budget] ${String(violations.length)} budget raise(s) without a reason (base ${base.slice(0, 12)}):\n`
+    );
+
+    for (const violation of violations) {
+      console.error(`  - ${violation}`);
+    }
+
+    process.exit(1);
+  }
+
+  console.log(
+    `[check:size-budget] no budget raised or added without a reason (base ${base.slice(0, 12)}).`
+  );
+}
+
+const isEntrypoint =
+  process.argv[1] !== undefined &&
+  resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+
+if (isEntrypoint) {
+  main();
+}
diff --git a/apps/ui/tests/scripts/check-size-budget-raises.test.ts b/apps/ui/tests/scripts/check-size-budget-raises.test.ts
new file mode 100644
index 00000000..47e11d52
--- /dev/null
+++ b/apps/ui/tests/scripts/check-size-budget-raises.test.ts
@@ -0,0 +1,159 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  type IBudgetSnapshot,
+  findBudgetRaiseViolations,
+  parseLedger,
+  parseLimitBytes,
+  parseSizeLimit
+} from "../../scripts/quality/check-size-budget-raises";
+
+const REASON = "Tailwind grew with the new settings screens.";
+
+function snapshot(
+  limits: Record<string, string>,
+  reasons: Record<string, string> = {}
+): IBudgetSnapshot {
+  return {
+    limits: new Map(
+      Object.entries(limits).map(([name, limit]) => [
+        name,
+        parseLimitBytes(limit)
+      ])
+    ),
+    reasons: new Map(Object.entries(reasons))
+  };
+}
+
+describe("parseLimitBytes", () => {
+  it("reads KB, MB and B limits", () => {
+    expect(parseLimitBytes("12 KB")).toBe(12 * 1024);
+    expect(parseLimitBytes("1 MB")).toBe(1024 * 1024);
+    expect(parseLimitBytes("512 B")).toBe(512);
+  });
+
+  it("rejects limits it cannot read", () => {
+    expect(() => parseLimitBytes("twelve")).toThrow(/unsupported/u);
+  });
+});
+
+describe("parseSizeLimit", () => {
+  it("keeps entry names with parentheses and colons, skips entries without a limit", () => {
+    const limits = parseSizeLimit(
+      JSON.stringify([
+        { name: "Initial route (cold start: index + react)", limit: "255 KB" },
+        { name: "no limit here", path: "dist/x.js" }
+      ])
+    );
+
+    expect([...limits.keys()]).toEqual([
+      "Initial route (cold start: index + react)"
+    ]);
+  });
+});
+
+describe("parseLedger", () => {
+  it("reads only reason lines, ignoring headings and prose", () => {
+    const reasons = parseLedger(
+      [
+        "# Budget reasons",
+        "",
+        "Prose that mentions `budgets` and a colon: here.",
+        "",
+        "- `Initial route (cold start: index + react)`: Settings shell moved into the cold route.",
+        "- `CSS (Tailwind compiled)`:    New tokens for the billing screens."
+      ].join("\n")
+    );
+
+    expect(reasons.get("Initial route (cold start: index + react)")).toBe(
+      "Settings shell moved into the cold route."
+    );
+    expect(reasons.get("CSS (Tailwind compiled)")).toBe(
+      "New tokens for the billing screens."
+    );
+    expect(reasons.size).toBe(2);
+  });
+});
+
+describe("findBudgetRaiseViolations", () => {
+  it("fails a raised limit with no reason", () => {
+    const violations = findBudgetRaiseViolations(
+      snapshot({ CSS: "12 KB" }),
+      snapshot({ CSS: "26.5 KB" })
+    );
+
+    expect(violations).toHaveLength(1);
+    expect(violations[0]).toContain('"CSS"');
+    expect(violations[0]).toContain("needs a reason line");
+  });
+
+  it("passes a raised limit whose reason is new in the change", () => {
+    const violations = findBudgetRaiseViolations(
+      snapshot({ CSS: "12 KB" }),
+      snapshot({ CSS: "26.5 KB" }, { CSS: REASON })
+    );
+
+    expect(violations).toEqual([]);
+  });
+
+  it("fails a raise whose reason was already in the base", () => {
+    const violations = findBudgetRaiseViolations(
+      snapshot({ CSS: "12 KB" }, { CSS: REASON }),
+      snapshot({ CSS: "26.5 KB" }, { CSS: REASON })
+    );
+
+    expect(violations).toHaveLength(1);
+    expect(violations[0]).toContain("unchanged from the base");
+  });
+
+  it("passes a decrease with no reason", () => {
+    const violations = findBudgetRaiseViolations(
+      snapshot({ CSS: "26.5 KB" }),
+      snapshot({ CSS: "12 KB" })
+    );
+
+    expect(violations).toEqual([]);
+  });
+
+  it("passes an unchanged limit with no reason", () => {
+    const violations = findBudgetRaiseViolations(
+      snapshot({ CSS: "12 KB" }),
+      snapshot({ CSS: "12 KB" })
+    );
+
+    expect(violations).toEqual([]);
+  });
+
+  it("fails a new entry with no reason", () => {
+    const violations = findBudgetRaiseViolations(
+      snapshot({ CSS: "12 KB" }),
+      snapshot({ CSS: "12 KB", "Billing chunk": "4 KB" })
+    );
+
+    expect(violations).toHaveLength(1);
+    expect(violations[0]).toContain('"Billing chunk"');
+    expect(violations[0]).toContain("new entry");
+  });
+
+  it("passes a new entry that carries a reason", () => {
+    const violations = findBudgetRaiseViolations(
+      snapshot({ CSS: "12 KB" }),
+      snapshot(
+        { CSS: "12 KB", "Billing chunk": "4 KB" },
+        { "Billing chunk": REASON }
+      )
+    );
+
+    expect(violations).toEqual([]);
+  });
+
+  it("treats a reason shorter than the minimum as missing", () => {
+    const violations = findBudgetRaiseViolations(
+      snapshot({ CSS: "12 KB" }),
+      snapshot({ CSS: "26.5 KB" }, { CSS: "tbd" })
+    );
+
+    expect(violations).toHaveLength(1);
+    expect(violations[0]).toContain("needs a reason line");
+  });
+});
diff --git a/codecov.yml b/codecov.yml
index 57d2d09c..a1742365 100644
--- a/codecov.yml
+++ b/codecov.yml
@@ -56,6 +56,7 @@ ignore:
   - "**/scripts/**"
   - "**/coverage/**"
   - "apps/docs/**"
+  - "apps/site/**"
   - "apps/api/src/templates/**"
   - "apps/api/drizzle/**"
   - "apps/ui/src/lib/api/schema.ts"
diff --git a/docs/maintenance/product-feedback.md b/docs/maintenance/product-feedback.md
index 1d6518d4..3be5db7a 100644
--- a/docs/maintenance/product-feedback.md
+++ b/docs/maintenance/product-feedback.md
@@ -94,3 +94,34 @@ agent-built product. Existing security and coverage gates remain enforced.
 | 81     | Wins.                                                                                                                                              | Preserve: reported win; no corrective change requested.                                                                                                                                                                                                                                                       |
 | 82     | `component-folder-structure` treats every `const X: FC` in a folder as a component needing its own siblings.                                       | Implemented upstream: `eslint-plugin-react-component-architecture` 0.3.1 exempts `.tsx` files that export nothing; the anatomy applies once a file gains an export (boringstack-xyz/eslint-plugins#15). Component anatomy guide updated.                                                                      |
 | 83     | Wins.                                                                                                                                              | Preserve: reported win; no corrective change requested.                                                                                                                                                                                                                                                       |
+
+## Report 2: Tinkercaster in production, 2026-09-14 to 2026-10-08
+
+Source: the Tinkercaster git history and its `docs/operations`, `docs/audits`
+and `docs/reviews` after the first report. The product went to production on
+k3s, added billing, a public site and an LLM assistant, and stopped taking
+template updates around 2026-09-15. Nothing from this period was reported back
+until this review, so the entries come from commits, not from a written
+report. The same rules apply: an entry is closed by a reproduction, a
+correction or a documented scope decision.
+
+| Report | Observation | Status / evidence |
+| ------ | ----------- | ----------------- |
+| 84 | argocd-image-updater bumped api and ui independently; the UI shipped before its API image existed, and one day produced 28 automatic update commits. | Implemented: `production-release.yml` builds api, migrations and ui as `candidate-<sha>` after CI passes at that commit, then pins all three digests in one commit; image-updater annotations removed; sync waves order config, data, migrations, api, ui. `scripts/release/release.test.ts`, `infra/k3s/tests/deployment.test.ts`. Activation needs `PRODUCTION_RELEASE_MODE=coordinated`. |
+| 85 | The migration Job was a PreSync hook that ran `db:seed` on every sync and reverted admin edits. | Implemented: Sync hook at wave -1 runs `db:migrate` only, from a migrations image, with no app secrets mounted. The superuser bootstrap is a documented one-off in `infra/k3s/README.md`. |
+| 86 | Migrations (drizzle-kit, node-postgres) did not verify the CNPG certificate while the runtime (postgres-js) did, so migrations passed and the app was refused. | Implemented: `src/lib/postgres/connection.ts` is the single TLS policy for the runtime client and `drizzle.config.ts`; both receive `DATABASE_SSL_CA` from `boringstack-db-ca`. `tests/lib/postgres/connection.test.ts`. |
+| 87 | The API crashed with EROFS on a read-only root filesystem because bun tried to install at startup. | Implemented: `bun --no-install`, a `/tmp` emptyDir with `TMPDIR`, and `readOnlyRootFilesystem: true` on the API and migrations; asserted by the deployment test. Smoke-tested with `docker run --read-only`. |
+| 88 | Every Vault key arrived in one env var. | Implemented: VSO `excludeRaw` on the app and registry secrets. |
+| 89 | Migration pods could not reach Postgres. | Implemented: the Postgres network policy admits `app: api-migrations`. |
+| 90 | The DNS-01 ClusterIssuer covered another zone. | Documented: `overlays/prod/certificate.yaml` and the k3s README. |
+| 91 | The public site built inside the container at start and crash-looped on an empty config value. | Implemented: the template now ships `apps/site`, a static Astro marketing site at the apex domain with the app at `app.<domain>`. Config is validated by the build and the image only serves files; `infra/k3s/tests/deployment.test.ts` asserts the runtime stage never builds. It is the fourth image in the coordinated release. |
+| 92 | Accepting test inventories was a third of the first three days' commits, then was skipped and the protection lapsed. | Implemented: feature verification records additions-only inventory changes itself; removals, renames and empty runs still block and print one acknowledgement command. `tools/agent/inventory.test.ts`. Open: CI does not compare observed cases with the committed inventories. |
+| 93 | `packages/wiring-engine` and `apps/site` sat outside every gate; tooling hard-coded the app list. | Implemented: root check and pre-push validate each `packages/*`, pre-push discovers `apps/*`, dependency scans skip missing apps, Dependabot covers packages; `apps/ui/docs/agents/shared-packages.md`. Open: lint-meta does not scan `packages/`. |
+| 94 | `.size-limit.json` was raised in 30 commits (CSS 12 KB to 26.5 KB) despite the per-feature review policy (12, 29, 44). | Implemented: `check:size-budget` fails a raise or a new entry without a new reason line in `apps/ui/budgets.md`; runs in validate, pre-push and CI. `tests/scripts/check-size-budget-raises.test.ts`. |
+| 95 | After the agent harness changed, conventional commit subjects fell from 98% to 13% and the agent guides were not updated again. | Implemented: `commit-msg` hook and `pr-title` workflow share `scripts/ci/check-commit-title.sh`; squash title is the PR title; AGENTS.md states the harness-neutral rule. `tools/agent/commit-title.test.ts`. |
+| 96 | Generated wiring-library content made the largest PRs (+544k lines in one). | Documented: AGENTS.md keeps generated artifacts out of hand-written PRs. |
+| 97 | The product moved CI to a self-hosted runner through a `CI_RUNNER` variable. | Implemented: every job runs on `${{ !github.event.pull_request.head.repo.fork && vars.CI_RUNNER \|\| 'ubuntu-24.04' }}`, so fork pull requests never reach self-hosted runners; the production release stays GitHub-hosted. The `github-actions-runner-pinned` lint-meta rule rejects an unguarded `vars.CI_RUNNER`. |
+| 98 | Database restore has never been exercised. | Open: no restore drill in the template. |
+| 99 | A release was blocked by an e2e asserting heading copy. | Open: needs a product fixture before any lint or guide change. |
+| 100 | Found in this review: in Compose production the API enables TLS for Postgres, but the Compose Postgres has no TLS, and postgres-js refuses a server that declines TLS. Migrations now share the runtime policy, so they fail the same way. | Open: reproduce with the `prod` profile, then either give Compose Postgres TLS or make the policy explicit per target. |
+| 101 | The product built a business-metrics Grafana dashboard (sign-ups, billing, plans) from CNPG custom queries. | Implemented: aggregate queries over the template's auth, audit and billing tables, a CNPG PodMonitor and a dashboard ConfigMap. Migration 0002 grants `pg_monitor` only the counted columns; `infra/k3s/tests/business-metrics.test.ts` checks every column against the drizzle snapshot and the grants. MRR is not derived because plans carry no price. |
diff --git a/infra/compose/compose/.env.example b/infra/compose/compose/.env.example
index 799e29d9..d19a1356 100644
--- a/infra/compose/compose/.env.example
+++ b/infra/compose/compose/.env.example
@@ -152,6 +152,24 @@ GRAFANA_ADMIN_USER=admin
 # MAILPIT_LIMITS_CPUS=0.25
 # MAILPIT_LIMITS_MEMORY=128M
 
+# --- Public marketing site (apps/site, WITH_SITE) ------------------------
+# dev (default 1): site-dev at http://localhost:7333; sign-up links go to :7331.
+# prod (default 0): set WITH_SITE=1 to serve the static site on the apex host.
+# Domain split when enabled: PUBLIC_SITE_HOST=example.com (the site),
+# PUBLIC_UI_HOST=app.example.com (the app and /api), FRONTEND_URL and
+# APP_URL=https://app.example.com. See infra/k3s/README.md "Domain split".
+# WITH_SITE=0
+# SITE_HOST_PORT=7333
+# SITE_DEV_ORIGIN=http://localhost:7333
+# SITE_DEV_APP_ORIGIN=http://localhost:7331
+# PUBLIC_SITE_HOST=example.com
+# SITE_CONTACT_EMAIL=hello@example.com
+# SITE_IMAGE_TAG=v0.1.0
+# Optional cookieless analytics, loaded only after the visitor accepts.
+# Both or neither: SITE_ANALYTICS_SCRIPT_URL and SITE_ANALYTICS_WEBSITE_ID.
+# SITE_ANALYTICS_SCRIPT_URL=
+# SITE_ANALYTICS_WEBSITE_ID=
+
 # --- BullMQ dashboard (optional, dev-only, WITH_BULLMQ=1) ---------------
 # Visualizes Bull / BullMQ jobs in the API app's Valkey. Reachable at
 # http://bullmq.localhost or http://localhost:7332 once the overlay is on.
diff --git a/infra/compose/compose/dev.sh b/infra/compose/compose/dev.sh
index 9070488d..62326e80 100755
--- a/infra/compose/compose/dev.sh
+++ b/infra/compose/compose/dev.sh
@@ -172,6 +172,31 @@ if [[ "$WITH_GLITCHTIP" == "1" && -f "$ROOT/docker-compose.glitchtip.yml" ]]; th
   fi
 fi
 
+# Public marketing site (apps/site). On by default in dev (site-dev on :7333).
+# Off by default in prod: enabling it puts the static site on the apex host and
+# moves the app to PUBLIC_UI_HOST (app.<domain>). The validation is below.
+if [[ "${WITH_SITE:-}" == "" ]]; then
+  if [[ "$STACK" == "dev" ]]; then WITH_SITE=1; else WITH_SITE=0; fi
+fi
+if [[ "$WITH_SITE" == "1" && -f "$ROOT/docker-compose.site.yml" ]]; then
+  if [[ "$STACK" == "prod" ]]; then
+    : "${PUBLIC_SITE_HOST:?PUBLIC_SITE_HOST required when WITH_SITE=1 in prod. Bare apex DNS name, e.g. example.com. The app moves to PUBLIC_UI_HOST, e.g. app.example.com.}"
+    : "${SITE_CONTACT_EMAIL:?SITE_CONTACT_EMAIL required when WITH_SITE=1 in prod. The mailbox shown on the contact page.}"
+    if [[ "$PUBLIC_SITE_HOST" == "$PUBLIC_UI_HOST" ]]; then
+      echo "[ERROR] PUBLIC_SITE_HOST and PUBLIC_UI_HOST must differ when WITH_SITE=1: the site is the apex, the app is app.<domain>." >&2
+      exit 1
+    fi
+    if [[ -z "${SITE_IMAGE:-}" ]]; then
+      : "${SITE_IMAGE_TAG:?SITE_IMAGE_TAG required in prod when WITH_SITE=1 (semver like v0.1.0 or sha-<digest>; never latest). Or set SITE_IMAGE to a full pinned reference.}"
+    fi
+    if [[ "${SITE_IMAGE_TAG:-}" == "latest" || "${SITE_IMAGE:-}" == *:latest ]]; then
+      echo "[ERROR] Site image must be pinned in prod: SITE_IMAGE_TAG=latest (or SITE_IMAGE ending :latest) is not allowed." >&2
+      exit 1
+    fi
+  fi
+  COMPOSE_ARGS+=(-f "$ROOT/docker-compose.site.yml")
+fi
+
 if [[ "${WITH_BULLMQ:-}" == "" && "$STACK" == "dev" ]]; then
   WITH_BULLMQ=1
 fi
diff --git a/infra/compose/compose/docker-compose.site.yml b/infra/compose/compose/docker-compose.site.yml
new file mode 100644
index 00000000..0cd927be
--- /dev/null
+++ b/infra/compose/compose/docker-compose.site.yml
@@ -0,0 +1,111 @@
+# Public marketing site overlay: merged by dev.sh when WITH_SITE=1 (default in dev).
+#
+# dev  (profile dev):  site-dev runs the Astro dev server with live reload at
+#                      http://localhost:7333. Sign-up links point at the UI on :7331.
+# prod (profile prod): site serves the pre-built static site from nginx. Traefik
+#                      routes the apex host PUBLIC_SITE_HOST to it. The app stays on
+#                      PUBLIC_UI_HOST (app.<domain>), so the two hosts never share
+#                      cookies or indexing. See infra/k3s/README.md for the split.
+#
+# Build-time configuration (SITE_URL, APP_URL, CONTACT_EMAIL, analytics) is baked
+# into the prod image. Invalid values fail `docker build`, not container start.
+
+services:
+  site-dev:
+    profiles: [dev]
+    build:
+      context: ../../../apps/site
+      dockerfile: Dockerfile
+      target: dev
+    restart: "no"
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "5"
+    working_dir: /app
+    command: ["bun", "run", "dev"]
+    volumes:
+      - ../../../apps/site:/app
+      - site_dev_node_modules:/app/node_modules
+    environment:
+      HOST: 0.0.0.0
+      SITE_URL: ${SITE_DEV_ORIGIN:-http://localhost:7333}
+      APP_URL: ${SITE_DEV_APP_ORIGIN:-http://localhost:7331}
+      CONTACT_EMAIL: ${SITE_DEV_CONTACT_EMAIL:-}
+    networks:
+      - frontend
+    ports:
+      - "${SITE_HOST_PORT:-7333}:7333"
+    security_opt:
+      - no-new-privileges:true
+    deploy:
+      resources:
+        limits:
+          cpus: "${SITE_DEV_LIMITS_CPUS:-1.0}"
+          memory: "${SITE_DEV_LIMITS_MEMORY:-1G}"
+        reservations:
+          cpus: "${SITE_DEV_RESERVATIONS_CPUS:-0.1}"
+          memory: "${SITE_DEV_RESERVATIONS_MEMORY:-128M}"
+
+  site:
+    profiles: [prod]
+    image: ${SITE_IMAGE:-ghcr.io/${IMAGE_OWNER:-boringstack-xyz}/${SITE_IMAGE_NAME:-boringstack-site}:${SITE_IMAGE_TAG:-latest}}
+    build:
+      context: ../../../apps/site
+      dockerfile: Dockerfile
+      target: production
+      args:
+        # Origins only. The apex site and the app are separate hosts.
+        SITE_URL: https://${PUBLIC_SITE_HOST:-}
+        APP_URL: https://${PUBLIC_UI_HOST:-}
+        CONTACT_EMAIL: ${SITE_CONTACT_EMAIL:-}
+        ANALYTICS_SCRIPT_URL: ${SITE_ANALYTICS_SCRIPT_URL:-}
+        ANALYTICS_WEBSITE_ID: ${SITE_ANALYTICS_WEBSITE_ID:-}
+    labels:
+      - "wud.watch=true"
+      - "wud.trigger.include=docker.app,discord.1,slack.alerts"
+      - "traefik.enable=true"
+      - "traefik.http.routers.site.rule=Host(`${PUBLIC_SITE_HOST:-site.invalid}`)"
+      - "traefik.http.routers.site.priority=1"
+      - "traefik.http.routers.site.entrypoints=websecure"
+      - "traefik.http.routers.site.tls=true"
+      - "traefik.http.routers.site.tls.certresolver=myresolver"
+      - "traefik.http.services.site.loadbalancer.server.port=8080"
+      - "traefik.http.routers.site.middlewares=boringstack-security-headers,boringstack-compress"
+      - "traefik.docker.network=frontend"
+    restart: unless-stopped
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "5"
+    networks:
+      - frontend
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "wget",
+          "--no-verbose",
+          "--tries=1",
+          "--spider",
+          "http://127.0.0.1:8080/healthz",
+        ]
+      interval: 5s
+      timeout: 3s
+      retries: 12
+      start_period: 5s
+    security_opt:
+      - no-new-privileges:true
+    deploy:
+      resources:
+        limits:
+          cpus: "${SITE_LIMITS_CPUS:-0.5}"
+          memory: "${SITE_LIMITS_MEMORY:-128M}"
+        reservations:
+          cpus: "${SITE_RESERVATIONS_CPUS:-0.1}"
+          memory: "${SITE_RESERVATIONS_MEMORY:-32M}"
+
+volumes:
+  site_dev_node_modules:
diff --git a/infra/compose/scripts/validate-guardrails.sh b/infra/compose/scripts/validate-guardrails.sh
index d9e9f34b..46d76e7c 100755
--- a/infra/compose/scripts/validate-guardrails.sh
+++ b/infra/compose/scripts/validate-guardrails.sh
@@ -45,6 +45,7 @@ render_full_config() {
     -f docker-compose.glitchtip.yml \
     -f docker-compose.bullmq.yml \
     -f docker-compose.wud.yml \
+    -f docker-compose.site.yml \
     --profile prod \
     --profile observability \
     --profile glitchtip-prod \
diff --git a/infra/k3s/README.md b/infra/k3s/README.md
index ab31e2d9..17ddeda2 100644
--- a/infra/k3s/README.md
+++ b/infra/k3s/README.md
@@ -5,9 +5,20 @@ k3s/Kubernetes cluster. This is the cluster alternative to the single-host
 [`infra/compose`](../compose) and [`infra/bootstrap`](../bootstrap) targets.
 Pick the one that fits; you don't need all three.
 
-Push code, CI builds and pushes GHCR images, argocd-image-updater bumps the tag,
-and ArgoCD syncs. The full app (api, ui, Postgres, Valkey, GlitchTip) runs in one
-namespace with HA, autoscaling, and TLS.
+Push code. The production release workflow builds the API, migrations, UI and
+public site images for that commit, then pins all four digests in one commit.
+ArgoCD syncs that set. The full app (site, api, ui, Postgres, Valkey, GlitchTip)
+runs in one namespace with HA, autoscaling, and TLS.
+
+## Domain split
+
+The public site (`apps/site`, static Astro) answers on the apex domain
+(`boringstack.example.com`) so it can be indexed. The authenticated app answers
+on `app.boringstack.example.com`: the UI at `/` and the API at `/api` and
+`/health`. Set `FRONTEND_URL` and the UI's public URL to the app origin. The
+site makes no API calls, so `ALLOWED_ORIGINS` does not change. Both hosts are on
+the one certificate in `overlays/prod/certificate.yaml`, and the site's
+build-time values live in `overlays/prod/site-build.env`.
 
 > This target is Compose-first BoringStack's opt-in cluster path. It is kept in
 > its own `infra/k3s/` subtree precisely so it never blurs the simpler Compose
@@ -17,10 +28,11 @@ namespace with HA, autoscaling, and TLS.
 
 ```
 infra/k3s/
-├── argocd/        ArgoCD Application (+ image-updater) and registration example
+├── argocd/        ArgoCD Application and registration example
 ├── base/          env-agnostic manifests: namespace, api, ui, valkey, postgres
-└── overlays/prod/ HA + TLS + secrets + GlitchTip + monitoring + patches
-    └── secrets/   swappable secrets backend: vault (default) | sealed | plain
+├── overlays/prod/ HA + TLS + secrets + GlitchTip + monitoring + patches
+│   └── secrets/   swappable secrets backend: vault (default) | sealed | plain
+└── tests/         release invariants, run against the real prod render
 ```
 
 ## Cluster prerequisites
@@ -29,12 +41,12 @@ The target cluster must provide these (all common, operator-installable):
 
 | Need | Used for |
 |------|----------|
-| ArgoCD + argocd-image-updater | GitOps sync and auto image bumps |
+| ArgoCD | GitOps sync and wave-ordered rollout |
 | CloudNativePG operator | the Postgres `Cluster` |
 | cert-manager + a DNS-01 `ClusterIssuer` | TLS certs |
 | Traefik (k3s default) with `web`/`websecure` entrypoints | ingress |
 | a default/persistent StorageClass | Postgres and Valkey volumes |
-| (optional) kube-prometheus-stack | the ServiceMonitor and Grafana dashboards |
+| (optional) kube-prometheus-stack | the ServiceMonitor, the database PodMonitor and the Grafana dashboards |
 | a secrets backend | Vault+VSO (default), or the SealedSecrets controller |
 
 ## The knobs to edit (per fork)
@@ -46,26 +58,39 @@ The target cluster must provide these (all common, operator-installable):
    `glitchtip.boringstack.example.com`) in `overlays/prod/ingress.yaml`,
    `certificate.yaml`, and `glitchtip/`.
 3. ClusterIssuer. Set `issuerRef.name` in `overlays/prod/certificate.yaml` to
-   your cluster's DNS-01 issuer (`kubectl get clusterissuer`).
+   the DNS-01 issuer for your zone (`kubectl get clusterissuer`). See
+   [the issuer pitfall](#clusterissuer-pitfall) below.
 4. StorageClass. Uncomment/set `storageClass` in `base/postgres/cluster.yaml` and
    `base/valkey/statefulset.yaml` if you don't want the cluster default.
 5. Repo URL. Set `source.repoURL` in `argocd/boringstack-prod.yaml` to your fork,
    and add it to ArgoCD as a repo credential.
-6. Image tag strategy. `argocd/boringstack-prod.yaml` assumes CI tags images with
-   the git SHA. If your CI uses semver, switch the `update-strategy` /
-   `allow-tags` annotations.
+6. Public UI settings. `VITE_PUBLIC_URL`, `VITE_SENTRY_DSN` and
+   `VITE_VAPID_PUBLIC_KEY` are GitHub repository variables read by
+   `.github/workflows/production-release.yml`. No domain is hard-coded there.
+
+### ClusterIssuer pitfall
+
+A `ClusterIssuer` carries one DNS-01 credential, usually scoped to one zone. If
+the Certificate's `dnsNames` include a zone that credential cannot write, the
+`_acme-challenge` TXT record is never created. The Certificate then stays
+`Ready=False` forever, and Traefik keeps serving its self-signed default
+certificate. Cloudflare tokens are per account, so two zones in two accounts
+need two issuers. Pick the issuer whose token covers every `dnsName`, and check
+with `kubectl describe certificate` and the challenge events before the first
+sync.
 
 ## Secrets
 
 Workloads only ever read two k8s Secrets, `boringstack-secrets` (app env) and
 `ghcr-registry-secret` (GHCR pull), plus the CNPG-generated `boringstack-db-app`
-(`DATABASE_URL`). How those get populated is the swappable component in
-`overlays/prod/secrets/`:
+(`DATABASE_URL`) and `boringstack-db-ca` (the CNPG CA, `ca.crt`). How those get
+populated is the swappable component in `overlays/prod/secrets/`:
 
 - `vault` (default). Vault + Vault Secrets Operator. Seed KV-v2 paths
   `secret/boringstack`, `secret/boringstack-registry` (and `secret/boringstack-backup`
   for backups), and bind a Vault role `boringstack-prod-role` to the
-  `boringstack-prod/default` ServiceAccount.
+  `boringstack-prod/default` ServiceAccount. The VSO secrets set `excludeRaw`, so
+  the `_raw` Vault response is not added as one JSON env var.
 - `sealed`. Bitnami SealedSecrets (commit encrypted manifests). See its README.
 - `plain`. Kustomize `secretGenerator` over a gitignored `secret.env`. See its README.
 
@@ -80,6 +105,9 @@ Populate from there rather than copying a list that drifts. The k3s-specific
 points:
 
 - `DATABASE_URL` is injected by CloudNativePG, so it is NOT a key here.
+- `DATABASE_SSL_CA` is injected from `boringstack-db-ca`, so it is not a key here
+  either. The API and the migration Job verify the database certificate against
+  it. Leave `DATABASE_SSL_REJECT_UNAUTHORIZED` at its default (`true`).
 - `VALKEY_PASSWORD` is shared: the api, GlitchTip, and the Valkey StatefulSet's
   `--requirepass` all read it.
 - The GlitchTip overlay needs `GLITCHTIP_SECRET_KEY` plus `GLITCHTIP_SUPERUSER_EMAIL`
@@ -88,19 +116,98 @@ points:
   `FRONTEND_URL`, `PUBLIC_API_URL`, `QUEUES_ENABLED=true`, `CACHE_PROVIDER=valkey`.
   Email, OAuth, Stripe, Web Push, and AI keys follow the reference.
 
+## Images and the coordinated release
+
+`.github/workflows/production-release.yml` is the only publisher of images for
+this target. On every push to `main` that touches the app or this target, it:
+
+1. Waits, up to 45 minutes, for every applicable push workflow at the same
+   commit to succeed. Missing, cancelled, failed and timed-out checks block the
+   release. A newer `main` commit supersedes an older one.
+2. Builds four **candidate** images for that commit: `boringstack-api`,
+   `boringstack-migrations`, `boringstack-ui` and `boringstack-site`, tagged
+   `candidate-<sha>`. Nothing moves `latest` or `sha-*` for this target.
+3. Only after all four builds succeed, makes **one** commit that pins all four
+   digests in `overlays/prod/kustomization.yaml`. A failed or interrupted build
+   leaves production unchanged. A non-fast-forward push fails without retry.
+
+The Compose/WUD path is unchanged. `apps-api-release.yml`, `apps-ui-release.yml`
+and `apps-site-release.yml` still publish `latest` and `sha-*` for WUD. Kubernetes never
+references those tags, so a partial Compose publish cannot reach this target.
+
+### Activation (required before the first release)
+
+1. Fresh fork: nothing to remove.
+2. Existing Argo Application that still has `argocd-image-updater.argoproj.io/*`
+   annotations, or an image-updater watching these images: remove those
+   annotations and the updater's write-back for this app first. Otherwise it can
+   overwrite the coordinated digests with per-image tags. Let any running
+   per-image release finish, and record the current digests for rollback.
+3. Set the GitHub repository variable `PRODUCTION_RELEASE_MODE=coordinated`.
+   Without it, the release fails before any image is built. The variable is an
+   operator assertion, not a live check.
+4. Repository policy must allow `github-actions[bot]` to push the promotion
+   commit to `main`. If branch protection blocks it, promotion fails closed.
+   Do not disable protection to make a release pass.
+
+### Release contract and rollback
+
+- Argo performs a **full application sync** in wave order: infrastructure at
+  -4/-2, the migration Job at -1, the API at 0, the UI at 1 once the API is
+  healthy. Do not selectively sync Deployments: that bypasses the migration hook
+  and wave ordering.
+- A successful workflow means the digests were promoted, not that Argo has
+  finished. Check Synced/Healthy, then smoke-test sign-in and the main screens.
+- API and database changes must stay compatible with the previous UI during the
+  rollout.
+- To roll back application images, restore **all four digests from one previous
+  promotion** in a reviewed commit, then sync the whole Application.
+- Migrations are not reversed automatically. Confirm the previous API works with
+  the current schema before rolling back.
+
+## Migrations and seeds
+
+The migration Job runs `bun run db:migrate` (drizzle-kit migrate) and nothing
+else. It is an Argo `Sync` hook at wave -1, so it runs on **every** sync, and any
+data it writes lands on a live database. For that reason:
+
+- The Job never runs `db:seed` or `db:prepare`. `db:seed` upserts reference
+  data, so it would revert admin edits on each sync. A test enforces this.
+- Reference data that the product needs must be insert-if-missing, and it is
+  applied deliberately, not on every sync.
+- The first administrator is a one-off, and it is idempotent. Run it once with
+  the migrations image from the same release. Use the candidate tag for the
+  promoted commit (the promotion commit names it):
+
+  ```bash
+  SHA=<promoted source commit>
+  kubectl -n boringstack-prod run superuser-bootstrap --rm -i --restart=Never \
+    --image=ghcr.io/boringstack-xyz/boringstack-migrations:candidate-$SHA \
+    --overrides='{"spec":{"serviceAccountName":"api","nodeSelector":{"kubernetes.io/arch":"amd64"},"imagePullSecrets":[{"name":"ghcr-registry-secret"}],"containers":[{"name":"superuser-bootstrap","image":"ghcr.io/boringstack-xyz/boringstack-migrations:candidate-'"$SHA"'","envFrom":[{"secretRef":{"name":"boringstack-secrets"}}],"env":[{"name":"NODE_ENV","value":"production"},{"name":"DATABASE_URL","valueFrom":{"secretKeyRef":{"name":"boringstack-db-app","key":"uri"}}},{"name":"DATABASE_SSL_CA","valueFrom":{"secretKeyRef":{"name":"boringstack-db-ca","key":"ca.crt"}}}]}]}}' \
+    -- bun run db:seed
+  ```
+
+  It needs `SUPERUSER_EMAIL` and `SUPERUSER_PASSWORD` in `boringstack-secrets`.
+  It creates the admin only if that user does not exist. Without those values it
+  does nothing, and users can sign up instead.
+- A from-scratch rebuild of reference data is also a one-off run of the seed
+  command, never a change to the Job.
+
 ## Deploy
 
 1. Rebrand and edit the knobs above.
-2. Ensure CI builds and pushes `ghcr.io/<owner>/<project>-api` and `-ui`. The UI
-   build must pass the `VITE_*` build args (`VITE_API_URL` empty for same-origin,
-   `VITE_SENTRY_DSN` set to your GlitchTip DSN). This is the same image pipeline
-   the Compose/WUD path uses.
-3. Populate secrets via your chosen backend.
-4. Register with ArgoCD, either:
+2. Populate secrets via your chosen backend.
+3. Register with ArgoCD, either:
    - `kubectl apply -f infra/k3s/argocd/boringstack-prod.yaml`, or
    - add `argocd/app-of-apps-registration.example.yaml` to your app-of-apps repo.
-5. ArgoCD runs the PreSync migration Job (`db:migrate && db:seed`), then rolls
-   out the deployments. Watch it reach Healthy.
+4. Complete [activation](#activation-required-before-the-first-release).
+5. Merge to `main`. The release workflow publishes the four candidates and
+   promotes them in one commit. Argo then syncs. Watch the Application reach
+   Healthy.
+6. Run the one-off superuser bootstrap if you want a first admin.
+
+Startup order is set by waves: namespace and secrets (-4), Postgres and Valkey
+(-2), migrations (-1), API (0), UI and site (1).
 
 ## Verify
 
@@ -108,12 +215,29 @@ points:
 # Structural render (no cluster needed)
 kubectl kustomize infra/k3s/overlays/prod | head
 
+# Release invariants on the real render (digest pins, no image-updater,
+# migrate-only Job, read-only API, CA wiring, network policy, release script,
+# business-metrics queries against the drizzle schema and grants)
+bun test infra/k3s/tests scripts/release
+
 # Live
 kubectl -n boringstack-prod get pods
-curl -sI https://<domain>/health        # 200 from the api
-curl -sI https://<domain>/              # 200 from the ui (SPA)
+curl -sI https://app.<domain>/health    # 200 from the api
+curl -sI https://app.<domain>/          # 200 from the ui (SPA)
+curl -sI https://<domain>/              # 200 from the public site
 ```
 
+## Runtime notes
+
+- The API image runs on a read-only root filesystem. Its CMD is
+  `bun --no-install run dist/index.js`, so bun never tries to install packages at
+  startup (that attempt fails with `EROFS`). Only `/tmp` (256 MiB) is writable,
+  and Bun's transpiler cache lives there.
+- The API and the migration Job share one TLS policy for Postgres
+  (`apps/api/src/lib/postgres/connection.ts`), driven by `DATABASE_SSL_CA`. Keep
+  TLS settings in `DATABASE_SSL_*`, not in `sslmode` on the URL.
+- Valkey uses AOF with `everysec` fsync so queued BullMQ jobs survive a restart.
+
 ## What's intentionally not here
 
 - In-cluster Prometheus/Grafana/Loki. Integrate with the cluster's stack
diff --git a/infra/k3s/argocd/boringstack-prod.yaml b/infra/k3s/argocd/boringstack-prod.yaml
index 6ea11cea..33ff9844 100644
--- a/infra/k3s/argocd/boringstack-prod.yaml
+++ b/infra/k3s/argocd/boringstack-prod.yaml
@@ -3,24 +3,10 @@ kind: Application
 metadata:
   name: boringstack-prod
   namespace: argocd
-  annotations:
-    # --- argocd-image-updater: auto-deploy new GHCR builds ----------------
-    # alias=full-image-path. The updater watches GHCR and writes the new tag
-    # back into overlays/prod/kustomization.yaml, which triggers a sync.
-    argocd-image-updater.argoproj.io/image-list: api=ghcr.io/boringstack-xyz/boringstack-api, ui=ghcr.io/boringstack-xyz/boringstack-ui
-    # Track the newest `sha-<short>` build. BoringStack's release workflows tag
-    # every push to main as `latest` + `sha-<short>` (and a semver tag on a
-    # changesets/`v*` release), so allow-tags matches the sha- form and ignores
-    # `latest`. To pin to releases instead, switch to `update-strategy: semver`
-    # with `allow-tags: regexp:^v?\d+\.\d+\.\d+$`.
-    argocd-image-updater.argoproj.io/api.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/api.allow-tags: regexp:^sha-[0-9a-f]{7,40}$
-    argocd-image-updater.argoproj.io/ui.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/ui.allow-tags: regexp:^sha-[0-9a-f]{7,40}$
-    # Commit the tag bump back to git (GitOps source of truth).
-    argocd-image-updater.argoproj.io/write-back-method: git:secret:argocd/image-updater-git-creds
-    argocd-image-updater.argoproj.io/write-back-target: kustomization
-    argocd-image-updater.argoproj.io/git-branch: main
+  # No argocd-image-updater annotations. Image digests are promoted by
+  # .github/workflows/production-release.yml in one commit to
+  # overlays/prod/kustomization.yaml, and that commit is what Argo syncs.
+  # A per-image updater would ship one image ahead of the others.
 spec:
   project: default
   source:
diff --git a/infra/k3s/base/api/deployment.yaml b/infra/k3s/base/api/deployment.yaml
index 620f5982..95dd0ae2 100644
--- a/infra/k3s/base/api/deployment.yaml
+++ b/infra/k3s/base/api/deployment.yaml
@@ -18,7 +18,16 @@ spec:
       labels:
         app: api
     spec:
+      # Release workflows publish linux/amd64 images only.
+      nodeSelector:
+        kubernetes.io/arch: amd64
       serviceAccountName: api
+      # The root filesystem is read-only. /tmp is the only writable scratch
+      # space, and Bun's transpiler cache lives there too (see env below).
+      volumes:
+        - name: runtime-tmp
+          emptyDir:
+            sizeLimit: 256Mi
       terminationGracePeriodSeconds: 30
       securityContext:
         runAsNonRoot: true
@@ -35,8 +44,13 @@ spec:
             capabilities:
               drop:
                 - ALL
+          # Tag is a placeholder: overlays/prod pins a digest from one
+          # coordinated release. The image CMD is `bun --no-install run dist/index.js`.
           image: ghcr.io/boringstack-xyz/boringstack-api:latest
           imagePullPolicy: Always
+          volumeMounts:
+            - name: runtime-tmp
+              mountPath: /tmp
           ports:
             - name: http
               containerPort: 7330
@@ -49,12 +63,23 @@ spec:
             - secretRef:
                 name: boringstack-secrets
           env:
+            - name: TMPDIR
+              value: /tmp
+            - name: BUN_RUNTIME_TRANSPILER_CACHE_PATH
+              value: /tmp/bun-transpiler
             # CloudNativePG publishes the app connection string here.
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
                   name: boringstack-db-app
                   key: uri
+            # CloudNativePG's CA. The runtime client and the migration Job both
+            # verify the server certificate against it (src/lib/postgres/connection.ts).
+            - name: DATABASE_SSL_CA
+              valueFrom:
+                secretKeyRef:
+                  name: boringstack-db-ca
+                  key: ca.crt
             # Infra topology (not secret): the in-namespace Valkey Service.
             - name: VALKEY_HOST
               value: valkey
diff --git a/infra/k3s/base/api/migration-job.yaml b/infra/k3s/base/api/migration-job.yaml
index 7766a249..eaaee904 100644
--- a/infra/k3s/base/api/migration-job.yaml
+++ b/infra/k3s/base/api/migration-job.yaml
@@ -4,8 +4,12 @@ metadata:
   name: api-migrations
   namespace: boringstack
   annotations:
-    # Runs before every sync, so schema is migrated before new pods roll out.
-    argocd.argoproj.io/hook: PreSync
+    # A Sync hook at wave -1 runs after the database (wave -2) exists and
+    # before the API Deployment (wave 0). It runs on every sync, so it must
+    # only migrate. Never add db:seed or db:prepare here: they re-assert seed
+    # data over admin edits. See infra/k3s/README.md, "Migrations and seeds".
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/sync-wave: "-1"
     argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
 spec:
   ttlSecondsAfterFinished: 300
@@ -15,6 +19,9 @@ spec:
       labels:
         app: api-migrations
     spec:
+      # Release workflows publish linux/amd64 images only.
+      nodeSelector:
+        kubernetes.io/arch: amd64
       restartPolicy: OnFailure
       serviceAccountName: api
       imagePullSecrets:
@@ -26,37 +33,43 @@ spec:
         fsGroup: 1001
         seccompProfile:
           type: RuntimeDefault
+      volumes:
+        - name: runtime-tmp
+          emptyDir:
+            sizeLimit: 256Mi
       containers:
         - name: migrate
-          image: ghcr.io/boringstack-xyz/boringstack-api:latest
+          image: ghcr.io/boringstack-xyz/boringstack-migrations:latest
           imagePullPolicy: Always
-          command:
-            - /bin/sh
-            - -c
-            - |
-              echo "Running Drizzle migrations..."
-              bun run db:migrate
-              echo "Seeding..."
-              bun run db:seed
-              echo "Migrations complete."
-          envFrom:
-            - secretRef:
-                name: boringstack-secrets
+          # ENTRYPOINT is dumb-init. The migrations image also runs
+          # `bun run db:migrate` by default; this is explicit on purpose.
+          args: ["bun", "run", "db:migrate"]
+          volumeMounts:
+            - name: runtime-tmp
+              mountPath: /tmp
+          # Deliberately no envFrom: migrations need only the database
+          # connection, so the app secret set (JWT, Stripe, email keys) is not
+          # mounted into this pod.
           env:
+            - name: TMPDIR
+              value: /tmp
+            - name: NODE_ENV
+              value: production
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
                   name: boringstack-db-app
                   key: uri
-            - name: VALKEY_HOST
-              value: valkey
-            - name: VALKEY_PORT
-              value: "6379"
-            - name: NODE_ENV
-              value: production
+            # Same CA as the API runtime client, so drizzle-kit verifies the
+            # CNPG server certificate the same way (src/lib/postgres/connection.ts).
+            - name: DATABASE_SSL_CA
+              valueFrom:
+                secretKeyRef:
+                  name: boringstack-db-ca
+                  key: ca.crt
           securityContext:
             allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
+            readOnlyRootFilesystem: true
             capabilities:
               drop:
                 - ALL
diff --git a/infra/k3s/base/api/networkpolicy.yaml b/infra/k3s/base/api/networkpolicy.yaml
index 875957ac..fc28eb63 100644
--- a/infra/k3s/base/api/networkpolicy.yaml
+++ b/infra/k3s/base/api/networkpolicy.yaml
@@ -22,6 +22,18 @@ spec:
       ports:
         - protocol: TCP
           port: 7330
+    # Cluster Prometheus scraping /metrics (overlays/prod/monitoring/servicemonitor.yaml).
+    # Without this the policy blocks the scrape while the target looks healthy.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
+      ports:
+        - protocol: TCP
+          port: 7330
   egress:
     # DNS
     - to:
diff --git a/infra/k3s/base/kustomization.yaml b/infra/k3s/base/kustomization.yaml
index b7d6ca9b..ea27b31e 100644
--- a/infra/k3s/base/kustomization.yaml
+++ b/infra/k3s/base/kustomization.yaml
@@ -10,3 +10,4 @@ resources:
   - valkey
   - api
   - ui
+  - site
diff --git a/infra/k3s/base/postgres/networkpolicy.yaml b/infra/k3s/base/postgres/networkpolicy.yaml
index e9121939..c6d871bd 100644
--- a/infra/k3s/base/postgres/networkpolicy.yaml
+++ b/infra/k3s/base/postgres/networkpolicy.yaml
@@ -11,11 +11,15 @@ spec:
     - Ingress
     - Egress
   ingress:
-    # From the API and GlitchTip pods.
+    # From the API, the migration Job (its own pod label, so it is not covered
+    # by `app: api`) and GlitchTip pods.
     - from:
         - podSelector:
             matchLabels:
               app: api
+        - podSelector:
+            matchLabels:
+              app: api-migrations
         - podSelector:
             matchLabels:
               app: glitchtip
diff --git a/infra/k3s/base/site/deployment.yaml b/infra/k3s/base/site/deployment.yaml
new file mode 100644
index 00000000..4d98d1be
--- /dev/null
+++ b/infra/k3s/base/site/deployment.yaml
@@ -0,0 +1,88 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: site
+  namespace: boringstack
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app: site
+  template:
+    metadata:
+      labels:
+        app: site
+    spec:
+      serviceAccountName: site
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001
+        runAsGroup: 1001
+        fsGroup: 1001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: site
+          securityContext:
+            allowPrivilegeEscalation: false
+            # The static site is baked into the image at build time (SITE_URL and
+            # friends are validated there), so the container only serves files.
+            # nginx writes its temp files and pid under /tmp, the only writable mount.
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          # Built from apps/site/Dockerfile by apps-site-release.yml. The
+          # overlay's images: entry rewrites the tag on every CI build.
+          image: ghcr.io/boringstack-xyz/boringstack-site:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          startupProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            periodSeconds: 2
+            timeoutSeconds: 3
+            failureThreshold: 15
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            periodSeconds: 30
+            timeoutSeconds: 3
+            failureThreshold: 3
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "sleep 5"]
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          resources:
+            requests:
+              memory: "32Mi"
+              cpu: "25m"
+            limits:
+              memory: "128Mi"
+              cpu: "250m"
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 64Mi
diff --git a/infra/k3s/base/site/kustomization.yaml b/infra/k3s/base/site/kustomization.yaml
new file mode 100644
index 00000000..4a90d09e
--- /dev/null
+++ b/infra/k3s/base/site/kustomization.yaml
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml
+  - networkpolicy.yaml
+  - rbac.yaml
diff --git a/infra/k3s/base/site/networkpolicy.yaml b/infra/k3s/base/site/networkpolicy.yaml
new file mode 100644
index 00000000..af80a133
--- /dev/null
+++ b/infra/k3s/base/site/networkpolicy.yaml
@@ -0,0 +1,36 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: site-network-policy
+  namespace: boringstack
+spec:
+  podSelector:
+    matchLabels:
+      app: site
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Browsers reach the static site only through the Traefik ingress.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080
+  egress:
+    # DNS only. The site makes no outbound or API calls at runtime.
+    - to:
+        - namespaceSelector: {}
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
diff --git a/infra/k3s/base/site/rbac.yaml b/infra/k3s/base/site/rbac.yaml
new file mode 100644
index 00000000..2ed7815a
--- /dev/null
+++ b/infra/k3s/base/site/rbac.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: site
+  namespace: boringstack
+automountServiceAccountToken: false
diff --git a/infra/k3s/base/site/service.yaml b/infra/k3s/base/site/service.yaml
new file mode 100644
index 00000000..e55da0f5
--- /dev/null
+++ b/infra/k3s/base/site/service.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: site
+  namespace: boringstack
+  labels:
+    app: site
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: site
diff --git a/infra/k3s/base/ui/deployment.yaml b/infra/k3s/base/ui/deployment.yaml
index 9b7d9fc6..31fbdef4 100644
--- a/infra/k3s/base/ui/deployment.yaml
+++ b/infra/k3s/base/ui/deployment.yaml
@@ -18,6 +18,9 @@ spec:
       labels:
         app: ui
     spec:
+      # Release workflows publish linux/amd64 images only.
+      nodeSelector:
+        kubernetes.io/arch: amd64
       serviceAccountName: ui
       terminationGracePeriodSeconds: 30
       securityContext:
diff --git a/infra/k3s/base/valkey/statefulset.yaml b/infra/k3s/base/valkey/statefulset.yaml
index d3cb38fd..7296c704 100644
--- a/infra/k3s/base/valkey/statefulset.yaml
+++ b/infra/k3s/base/valkey/statefulset.yaml
@@ -37,16 +37,16 @@ spec:
           command:
             - valkey-server
           args:
-            # Cache + BullMQ queue backend. Light persistence (RDB) to /data so
-            # queued jobs survive a restart; flip --save "" + --appendonly no for
-            # a pure cache. requirepass must equal the password the API sends.
+            # Cache + BullMQ queue backend. AOF with fsync every second bounds
+            # queued-job loss to about a second on restart; RDB snapshots alone
+            # can lose minutes of queue mutations. For a pure cache, drop the
+            # appendonly flags. requirepass must equal the password the API sends.
             - --dir
             - /data
-            - --save
-            - "60"
-            - "1000"
             - --appendonly
-            - "no"
+            - "yes"
+            - --appendfsync
+            - everysec
             - --maxmemory-policy
             - noeviction
             - --requirepass
diff --git a/infra/k3s/overlays/prod/certificate.yaml b/infra/k3s/overlays/prod/certificate.yaml
index 66b0522f..345ca2b2 100644
--- a/infra/k3s/overlays/prod/certificate.yaml
+++ b/infra/k3s/overlays/prod/certificate.yaml
@@ -1,8 +1,12 @@
-# TLS certificate for the app + GlitchTip subdomain.
+# TLS certificate for the apex site, the app host and the GlitchTip subdomain.
 # Prerequisites:
 #   - cert-manager installed in the cluster
 #   - a DNS-01-capable ClusterIssuer (verify name: kubectl get clusterissuer)
 # The issuer name below is a per-cluster knob, see infra/k3s/README.md.
+# Pitfall: the issuer's DNS-01 credential must be able to write _acme-challenge
+# records in the zone of EVERY dnsName here. A token scoped to a different zone
+# leaves the Certificate Ready=False while Traefik serves its default cert.
+# Check with `kubectl describe certificate` and the challenge events.
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -15,4 +19,5 @@ spec:
     kind: ClusterIssuer
   dnsNames:
     - boringstack.example.com
+    - app.boringstack.example.com
     - glitchtip.boringstack.example.com
diff --git a/infra/k3s/overlays/prod/ingress.yaml b/infra/k3s/overlays/prod/ingress.yaml
index 99eee8ef..8b0d151a 100644
--- a/infra/k3s/overlays/prod/ingress.yaml
+++ b/infra/k3s/overlays/prod/ingress.yaml
@@ -1,8 +1,11 @@
-# Single-domain, same-origin path routing (mirrors infra/compose prod):
-#   Host(domain) && (PathPrefix(/api) || Path(/health))  -> api:7330
-#   Host(domain)                                          -> ui:8080  (SPA fallback)
-# One domain, one TLS cert, no CORS. The api route has higher priority so it
-# matches before the ui catch-all. Replace boringstack.example.com everywhere.
+# Domain split (see infra/k3s/README.md "Domain split"):
+#   Host(site)                                            -> site:8080 (static marketing site, apex)
+#   Host(app) && (PathPrefix(/api) || Path(/health))      -> api:7330
+#   Host(app)                                             -> ui:8080   (SPA fallback)
+# site = boringstack.example.com (apex), app = app.boringstack.example.com.
+# The app keeps one origin with /api (same-origin, no CORS). The site makes no
+# API calls, and the two hosts share no cookies. Replace boringstack.example.com
+# everywhere (rename-project.sh does this for the project name).
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -12,12 +15,12 @@ spec:
   entryPoints:
     - web
   routes:
-    - match: Host(`boringstack.example.com`)
+    - match: Host(`boringstack.example.com`) || Host(`app.boringstack.example.com`)
       kind: Rule
       middlewares:
         - name: redirect-https
       services:
-        - name: ui
+        - name: site
           port: 8080
 ---
 apiVersion: traefik.io/v1alpha1
@@ -30,7 +33,7 @@ spec:
     - websecure
   routes:
     # API, must precede the UI catch-all.
-    - match: Host(`boringstack.example.com`) && (PathPrefix(`/api`) || Path(`/health`))
+    - match: Host(`app.boringstack.example.com`) && (PathPrefix(`/api`) || Path(`/health`))
       kind: Rule
       priority: 10
       middlewares:
@@ -39,8 +42,8 @@ spec:
       services:
         - name: api
           port: 7330
-    # UI, host-wide fallback (SPA shell + assets).
-    - match: Host(`boringstack.example.com`)
+    # UI, host-wide fallback for the app host (SPA shell + assets).
+    - match: Host(`app.boringstack.example.com`)
       kind: Rule
       priority: 1
       middlewares:
@@ -50,3 +53,26 @@ spec:
           port: 8080
   tls:
     secretName: boringstack-tls
+---
+# Apex marketing site. Traefik adds HSTS and the frame deny here; nginx sets the
+# CSP and the other headers. Both sides set X-Frame-Options and X-Content-Type-Options.
+# Check a live response for duplicated header values after the first deploy.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: boringstack-site
+  namespace: boringstack-prod
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`boringstack.example.com`)
+      kind: Rule
+      priority: 1
+      middlewares:
+        - name: security-headers
+      services:
+        - name: site
+          port: 8080
+  tls:
+    secretName: boringstack-tls
diff --git a/infra/k3s/overlays/prod/kustomization.yaml b/infra/k3s/overlays/prod/kustomization.yaml
index bbfb120b..619c9ef8 100644
--- a/infra/k3s/overlays/prod/kustomization.yaml
+++ b/infra/k3s/overlays/prod/kustomization.yaml
@@ -40,15 +40,54 @@ resources:
   # uncomment this line AND the postgres-backup patch below.
   # - scheduled-backup.yaml
 
-# Image Updater rewrites these tags on every CI build (write-back-target:
-# kustomization). The initial value is a bootstrap placeholder.
+# Digests come from ONE coordinated release: .github/workflows/production-release.yml
+# builds every image for a commit, then pins all four digests here in a single
+# commit. Never edit these by hand, and never use mutable tags.
+# The all-zero digests are a bootstrap placeholder: pulls fail closed until the
+# first release has run.
 images:
   - name: ghcr.io/boringstack-xyz/boringstack-api
-    newTag: latest
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+  - name: ghcr.io/boringstack-xyz/boringstack-migrations
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
   - name: ghcr.io/boringstack-xyz/boringstack-ui
-    newTag: latest
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+  - name: ghcr.io/boringstack-xyz/boringstack-site
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
 
 patches:
+  # Argo sync waves. A full sync applies in this order:
+  #   -4 namespace, identity, config and secrets
+  #   -2 database and cache (kept on prune)
+  #   -1 migrations (Sync hook, base/api/migration-job.yaml)
+  #    0 api, plus the edge and monitoring resources
+  #    1 ui and the public site, once the api is healthy
+  # Ordering is what makes a first sync work: a PreSync hook would run before
+  # the database exists.
+  - target:
+      kind: Namespace|ServiceAccount|Role|RoleBinding|VaultConnection|VaultAuth|VaultStaticSecret|ConfigMap|NetworkPolicy|Service|ResourceQuota|LimitRange
+    patch: |-
+      - op: add
+        path: /metadata/annotations
+        value:
+          argocd.argoproj.io/sync-wave: "-4"
+  - target:
+      kind: Cluster|StatefulSet
+    patch: |-
+      - op: add
+        path: /metadata/annotations
+        value:
+          argocd.argoproj.io/sync-wave: "-2"
+          argocd.argoproj.io/sync-options: Delete=false,Prune=false
+  - target:
+      kind: Deployment
+      name: ui|site
+    patch: |-
+      - op: add
+        path: /metadata/annotations
+        value:
+          argocd.argoproj.io/sync-wave: "1"
+
   # Pull private GHCR images on every Deployment in the overlay.
   - patch: |-
       apiVersion: apps/v1
@@ -74,10 +113,19 @@ patches:
     target:
       kind: Deployment
       name: ui
+  - path: patches/site-replicas.yaml
+    target:
+      kind: Deployment
+      name: site
   - path: patches/postgres-ha.yaml
     target:
       kind: Cluster
       name: boringstack-db
+  # Business metrics: loads the CNPG custom queries from monitoring/.
+  - path: patches/postgres-monitoring.yaml
+    target:
+      kind: Cluster
+      name: boringstack-db
   # Opt-in barman backup store (enable with scheduled-backup.yaml above):
   # - path: patches/postgres-backup.yaml
   #   target:
diff --git a/infra/k3s/overlays/prod/monitoring/README.md b/infra/k3s/overlays/prod/monitoring/README.md
index 1449d6d8..15b14d4b 100644
--- a/infra/k3s/overlays/prod/monitoring/README.md
+++ b/infra/k3s/overlays/prod/monitoring/README.md
@@ -11,10 +11,33 @@ cluster's existing [kube-prometheus-stack](https://github.com/prometheus-communi
   2. Prometheus is allowed to discover ServiceMonitors in `boringstack-prod`
      (its `serviceMonitorNamespaceSelector` must match this namespace).
 
+- Database and business metrics. `podmonitor.yaml` scrapes the CloudNativePG
+  exporter on every Postgres instance (the same label rule as above, for
+  `podMonitorSelector`). `cnpg-business-queries.yaml` is loaded into that
+  exporter by `patches/postgres-monitoring.yaml`. It runs aggregate queries over
+  the `auth`, `audit` and `billing` tables, once per scrape on the primary:
+
+  | Metric | What it counts |
+  | ------ | -------------- |
+  | `cnpg_boringstack_signups_daily_users` | Accounts created per UTC day (90 days) |
+  | `cnpg_boringstack_active_users_last_{1d,7d,30d}` | Distinct users with a successful sign-in |
+  | `cnpg_boringstack_account_plans_accounts` | Paid or granted plans by plan, status and source |
+  | `cnpg_boringstack_churn_daily_canceled` | Subscriptions canceled per UTC day (approximate) |
+  | `cnpg_boringstack_stripe_webhooks_events` | Stored Stripe webhook events by type |
+
+  Only aggregates leave the database. The exporter's role is granted specific
+  columns in `apps/api/drizzle/0002_metrics_exporter_grants.sql`. It cannot read
+  emails, names, IP addresses, user agents, audit metadata, secrets or Stripe
+  identifiers. `infra/k3s/tests/business-metrics.test.ts` enforces this and the
+  schema contract. Plans have no price in the database, so MRR is not derived.
+  The Free plan has no row per account, so it is not counted.
+
 - Logs. Promtail/Alloy in the cluster already scrapes pod stdout by
   namespace/pod labels; no per-app manifest needed. The pods log to stdout.
 
-- Dashboards. The BoringStack Grafana dashboards live in
+- Dashboards. `dashboards/boringstack-business.json` ("Business metrics") is
+  generated into a ConfigMap by `kustomization.yaml` on every render, so it needs
+  no copy step. The other BoringStack Grafana dashboards live in
   `infra/compose/compose/grafana/dashboards/`. To auto-import them into the
   cluster Grafana (sidecar discovery), copy the JSON files into
   `./dashboards/` here and uncomment the `configMapGenerator` in
diff --git a/infra/k3s/overlays/prod/monitoring/cnpg-business-queries.yaml b/infra/k3s/overlays/prod/monitoring/cnpg-business-queries.yaml
new file mode 100644
index 00000000..ed117313
--- /dev/null
+++ b/infra/k3s/overlays/prod/monitoring/cnpg-business-queries.yaml
@@ -0,0 +1,121 @@
+# Business metrics for the cluster Grafana, aggregated from the template's own
+# auth, audit and billing tables. Aggregates only: no row-level data, no emails,
+# names, IPs, user agents, metadata or Stripe identifiers leave the database.
+#
+# CloudNativePG's built-in exporter runs these on every scrape and publishes
+# them as cnpg_<query>_<column>. Prometheus keeps 7 days, so the per-day series
+# are rebuilt on every scrape from the source tables instead of stored.
+#
+# Read access is column-level, granted to pg_monitor in drizzle migration
+# 0002_metrics_exporter_grants. A query touching any other column fails with
+# "permission denied" in the instance log and simply produces no series.
+# Every column reference below is table-qualified so
+# infra/k3s/tests/business-metrics.test.ts can check it against the schema and
+# the grants.
+#
+# primary: true everywhere, so the three instances don't triple-count.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: boringstack-db-business-metrics
+  labels:
+    # Tells CNPG to reload the queries when this ConfigMap changes.
+    cnpg.io/reload: ""
+data:
+  queries: |
+    boringstack_signups_daily:
+      query: |
+        SELECT to_char(u.created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD') AS day,
+               count(*) AS users
+        FROM auth.users u
+        WHERE u.created_at >= date_trunc('day', now() AT TIME ZONE 'UTC') AT TIME ZONE 'UTC' - interval '89 days'
+        GROUP BY 1
+      primary: true
+      target_databases: ["boringstack"]
+      metrics:
+        - day:
+            usage: "LABEL"
+            description: "UTC day, YYYY-MM-DD"
+        - users:
+            usage: "GAUGE"
+            description: "Accounts created on this day (last 90 days)"
+
+    boringstack_active_users:
+      query: |
+        SELECT count(DISTINCT al.user_id) FILTER (WHERE al.created_at >= now() - interval '1 day') AS last_1d,
+               count(DISTINCT al.user_id) FILTER (WHERE al.created_at >= now() - interval '7 days') AS last_7d,
+               count(DISTINCT al.user_id) AS last_30d
+        FROM audit.audit_log al
+        WHERE al.created_at >= now() - interval '30 days'
+          AND al.user_id IS NOT NULL
+          AND al.action IN ('auth.login_success', 'auth.oauth_login', 'auth.mfa_login_success')
+      primary: true
+      target_databases: ["boringstack"]
+      metrics:
+        - last_1d:
+            usage: "GAUGE"
+            description: "Distinct users who signed in during the last 24h"
+        - last_7d:
+            usage: "GAUGE"
+            description: "Distinct users who signed in during the last 7 days"
+        - last_30d:
+            usage: "GAUGE"
+            description: "Distinct users who signed in during the last 30 days"
+
+    boringstack_account_plans:
+      query: |
+        SELECT p.name AS plan, ap.status AS status, ap.source AS source, count(*) AS accounts
+        FROM billing.account_plans ap
+        JOIN billing.plans p ON p.id = ap.plan_id
+        WHERE ap.revoked_at IS NULL
+        GROUP BY 1, 2, 3
+      primary: true
+      target_databases: ["boringstack"]
+      metrics:
+        - plan:
+            usage: "LABEL"
+            description: "Plan name"
+        - status:
+            usage: "LABEL"
+            description: "Subscription status (active, trialing, past_due, canceled, ...)"
+        - source:
+            usage: "LABEL"
+            description: "stripe, or admin_grant for manually granted plans"
+        - accounts:
+            usage: "GAUGE"
+            description: "Accounts currently holding this plan"
+
+    boringstack_churn_daily:
+      # Approximation: updated_at on a canceled row is the day it was last
+      # written, which for a cancellation is the day it was canceled.
+      query: |
+        SELECT to_char(ap.updated_at AT TIME ZONE 'UTC', 'YYYY-MM-DD') AS day,
+               count(*) AS canceled
+        FROM billing.account_plans ap
+        WHERE ap.status = 'canceled'
+          AND ap.updated_at >= date_trunc('day', now() AT TIME ZONE 'UTC') AT TIME ZONE 'UTC' - interval '89 days'
+        GROUP BY 1
+      primary: true
+      target_databases: ["boringstack"]
+      metrics:
+        - day:
+            usage: "LABEL"
+            description: "UTC day, YYYY-MM-DD"
+        - canceled:
+            usage: "GAUGE"
+            description: "Paid subscriptions canceled on this day (last 90 days, approximate)"
+
+    boringstack_stripe_webhooks:
+      query: |
+        SELECT swe.type AS type, count(*) AS events
+        FROM billing.stripe_webhook_events swe
+        GROUP BY 1
+      primary: true
+      target_databases: ["boringstack"]
+      metrics:
+        - type:
+            usage: "LABEL"
+            description: "Stripe event type, e.g. invoice.paid, invoice.payment_failed"
+        - events:
+            usage: "GAUGE"
+            description: "Stripe webhook events received and stored"
diff --git a/infra/k3s/overlays/prod/monitoring/dashboards/boringstack-business.json b/infra/k3s/overlays/prod/monitoring/dashboards/boringstack-business.json
new file mode 100644
index 00000000..1944592c
--- /dev/null
+++ b/infra/k3s/overlays/prod/monitoring/dashboards/boringstack-business.json
@@ -0,0 +1,139 @@
+{
+  "annotations": { "list": [] },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "id": null,
+  "links": [],
+  "panels": [
+    {
+      "id": 1,
+      "type": "stat",
+      "title": "Active users (24h)",
+      "description": "Distinct users with a successful sign-in in the last 24 hours. From audit.audit_log.",
+      "gridPos": { "h": 4, "w": 8, "x": 0, "y": 0 },
+      "datasource": { "type": "prometheus", "uid": "${datasource}" },
+      "targets": [
+        { "refId": "A", "datasource": { "type": "prometheus", "uid": "${datasource}" },
+          "expr": "max(cnpg_boringstack_active_users_last_1d)", "instant": true }
+      ],
+      "fieldConfig": { "defaults": { "unit": "short" }, "overrides": [] },
+      "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "colorMode": "none", "graphMode": "none", "textMode": "auto" }
+    },
+    {
+      "id": 2,
+      "type": "stat",
+      "title": "Active users (7d)",
+      "gridPos": { "h": 4, "w": 8, "x": 8, "y": 0 },
+      "datasource": { "type": "prometheus", "uid": "${datasource}" },
+      "targets": [
+        { "refId": "A", "datasource": { "type": "prometheus", "uid": "${datasource}" },
+          "expr": "max(cnpg_boringstack_active_users_last_7d)", "instant": true }
+      ],
+      "fieldConfig": { "defaults": { "unit": "short" }, "overrides": [] },
+      "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "colorMode": "none", "graphMode": "none", "textMode": "auto" }
+    },
+    {
+      "id": 3,
+      "type": "stat",
+      "title": "Active users (30d)",
+      "gridPos": { "h": 4, "w": 8, "x": 16, "y": 0 },
+      "datasource": { "type": "prometheus", "uid": "${datasource}" },
+      "targets": [
+        { "refId": "A", "datasource": { "type": "prometheus", "uid": "${datasource}" },
+          "expr": "max(cnpg_boringstack_active_users_last_30d)", "instant": true }
+      ],
+      "fieldConfig": { "defaults": { "unit": "short" }, "overrides": [] },
+      "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "colorMode": "none", "graphMode": "none", "textMode": "auto" }
+    },
+    {
+      "id": 4,
+      "type": "table",
+      "title": "Sign-ups per day (90d)",
+      "description": "Accounts created per UTC day. From auth.users.",
+      "gridPos": { "h": 10, "w": 12, "x": 0, "y": 4 },
+      "datasource": { "type": "prometheus", "uid": "${datasource}" },
+      "targets": [
+        { "refId": "A", "datasource": { "type": "prometheus", "uid": "${datasource}" },
+          "expr": "max by (day) (cnpg_boringstack_signups_daily_users)", "instant": true, "format": "table" }
+      ],
+      "fieldConfig": { "defaults": {}, "overrides": [] },
+      "options": { "showHeader": true, "sortBy": [{ "displayName": "day", "desc": true }] },
+      "transformations": [
+        { "id": "organize", "options": { "excludeByName": { "Time": true }, "renameByName": { "day": "Day", "Value": "Sign-ups" } } }
+      ]
+    },
+    {
+      "id": 5,
+      "type": "table",
+      "title": "Subscriptions canceled per day (90d)",
+      "description": "Paid subscriptions canceled per UTC day. Approximate: uses the last update time of the canceled row. From billing.account_plans.",
+      "gridPos": { "h": 10, "w": 12, "x": 12, "y": 4 },
+      "datasource": { "type": "prometheus", "uid": "${datasource}" },
+      "targets": [
+        { "refId": "A", "datasource": { "type": "prometheus", "uid": "${datasource}" },
+          "expr": "max by (day) (cnpg_boringstack_churn_daily_canceled)", "instant": true, "format": "table" }
+      ],
+      "fieldConfig": { "defaults": {}, "overrides": [] },
+      "options": { "showHeader": true, "sortBy": [{ "displayName": "day", "desc": true }] },
+      "transformations": [
+        { "id": "organize", "options": { "excludeByName": { "Time": true }, "renameByName": { "day": "Day", "Value": "Canceled" } } }
+      ]
+    },
+    {
+      "id": 6,
+      "type": "bargauge",
+      "title": "Accounts by plan and status",
+      "description": "Accounts currently holding a plan, excluding revoked rows. Accounts on the default Free plan have no row and are not counted. From billing.account_plans.",
+      "gridPos": { "h": 9, "w": 12, "x": 0, "y": 14 },
+      "datasource": { "type": "prometheus", "uid": "${datasource}" },
+      "targets": [
+        { "refId": "A", "datasource": { "type": "prometheus", "uid": "${datasource}" },
+          "expr": "sum by (plan, status) (cnpg_boringstack_account_plans_accounts)", "instant": true, "legendFormat": "{{plan}} / {{status}}" }
+      ],
+      "fieldConfig": { "defaults": { "unit": "short", "min": 0 }, "overrides": [] },
+      "options": { "orientation": "horizontal", "displayMode": "gradient", "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false } }
+    },
+    {
+      "id": 7,
+      "type": "bargauge",
+      "title": "Stripe webhook events by type",
+      "description": "Stored Stripe webhook events grouped by type. From billing.stripe_webhook_events.",
+      "gridPos": { "h": 9, "w": 12, "x": 12, "y": 14 },
+      "datasource": { "type": "prometheus", "uid": "${datasource}" },
+      "targets": [
+        { "refId": "A", "datasource": { "type": "prometheus", "uid": "${datasource}" },
+          "expr": "sum by (type) (cnpg_boringstack_stripe_webhooks_events)", "instant": true, "legendFormat": "{{type}}" }
+      ],
+      "fieldConfig": { "defaults": { "unit": "short", "min": 0 }, "overrides": [] },
+      "options": { "orientation": "horizontal", "displayMode": "gradient", "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false } }
+    }
+  ],
+  "refresh": "5m",
+  "schemaVersion": 39,
+  "tags": ["boringstack", "business"],
+  "templating": {
+    "list": [
+      {
+        "name": "datasource",
+        "label": "Prometheus",
+        "type": "datasource",
+        "query": "prometheus",
+        "current": {},
+        "hide": 0,
+        "includeAll": false,
+        "multi": false,
+        "options": [],
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false
+      }
+    ]
+  },
+  "time": { "from": "now-90d", "to": "now" },
+  "timepicker": {},
+  "timezone": "utc",
+  "title": "Business metrics",
+  "uid": "boringstack-business",
+  "version": 1
+}
diff --git a/infra/k3s/overlays/prod/monitoring/kustomization.yaml b/infra/k3s/overlays/prod/monitoring/kustomization.yaml
index c84fb4a7..b5b6660a 100644
--- a/infra/k3s/overlays/prod/monitoring/kustomization.yaml
+++ b/infra/k3s/overlays/prod/monitoring/kustomization.yaml
@@ -3,12 +3,26 @@ kind: Kustomization
 
 # Integrates with the cluster's existing kube-prometheus-stack, it does NOT
 # deploy Prometheus/Grafana/Loki. The ServiceMonitor gets the api scraped by
-# the cluster Prometheus. See README.md to also surface the BoringStack Grafana
-# dashboards via the Grafana sidecar.
+# the cluster Prometheus. The PodMonitor scrapes the CloudNativePG exporter, and
+# cnpg-business-queries.yaml turns the template's own tables into aggregate
+# business metrics. See README.md to also surface the dashboards via the Grafana
+# sidecar.
 resources:
   - servicemonitor.yaml
+  - podmonitor.yaml
+  - cnpg-business-queries.yaml
 
-# --- Grafana dashboards (optional) ---------------------------------------
+# Business metrics dashboard, auto-imported by the cluster Grafana sidecar.
+configMapGenerator:
+  - name: boringstack-business-dashboard
+    files:
+      - dashboards/boringstack-business.json
+    options:
+      labels:
+        grafana_dashboard: "1"
+      disableNameSuffixHash: true
+
+# --- Grafana dashboards from compose (optional) --------------------------
 # The BoringStack dashboards live in infra/compose/compose/grafana/dashboards/.
 # To have the cluster Grafana auto-import them, generate a ConfigMap labelled
 # `grafana_dashboard: "1"`. Cross-tree file refs need ArgoCD/kustomize's
diff --git a/infra/k3s/overlays/prod/monitoring/podmonitor.yaml b/infra/k3s/overlays/prod/monitoring/podmonitor.yaml
new file mode 100644
index 00000000..385c5f0f
--- /dev/null
+++ b/infra/k3s/overlays/prod/monitoring/podmonitor.yaml
@@ -0,0 +1,23 @@
+# Scrapes CloudNativePG's exporter on every instance: the default database
+# health metrics (cnpg_collector_up, replication lag, backends, database size)
+# plus the business queries in cnpg-business-queries.yaml, which run on the
+# primary only.
+#
+# Created by hand rather than via spec.monitoring.enablePodMonitor: that field
+# is deprecated. Like the ServiceMonitor, it needs the label your Prometheus
+# `podMonitorSelector` matches (often `release: <helm-release>`), or the stack
+# is installed with `podMonitorSelectorNilUsesHelmValues=false`.
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: boringstack-db
+  labels:
+    # release: kube-prometheus-stack
+    app: postgres
+spec:
+  selector:
+    matchLabels:
+      cnpg.io/cluster: boringstack-db
+  podMetricsEndpoints:
+    - port: metrics
+      interval: 30s
diff --git a/infra/k3s/overlays/prod/patches/postgres-ha.yaml b/infra/k3s/overlays/prod/patches/postgres-ha.yaml
index 9587d0ce..d8f91899 100644
--- a/infra/k3s/overlays/prod/patches/postgres-ha.yaml
+++ b/infra/k3s/overlays/prod/patches/postgres-ha.yaml
@@ -18,7 +18,7 @@ spec:
       cpu: "250m"
     limits:
       memory: "2Gi"
-      cpu: "1000m"
+      cpu: "1" # CNPG stores 1000m as "1"; write it that way or every sync shows drift.
   postgresql:
     parameters:
       shared_buffers: "256MB"
diff --git a/infra/k3s/overlays/prod/patches/postgres-monitoring.yaml b/infra/k3s/overlays/prod/patches/postgres-monitoring.yaml
new file mode 100644
index 00000000..3fee5dd5
--- /dev/null
+++ b/infra/k3s/overlays/prod/patches/postgres-monitoring.yaml
@@ -0,0 +1,14 @@
+# Loads the business metric queries into the CNPG exporter. The list replaces
+# the operator default, so cnpg-default-monitoring is repeated to keep the
+# standard health metrics.
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: boringstack-db
+spec:
+  monitoring:
+    customQueriesConfigMap:
+      - name: cnpg-default-monitoring
+        key: queries
+      - name: boringstack-db-business-metrics
+        key: queries
diff --git a/infra/k3s/overlays/prod/patches/site-replicas.yaml b/infra/k3s/overlays/prod/patches/site-replicas.yaml
new file mode 100644
index 00000000..97caa9f6
--- /dev/null
+++ b/infra/k3s/overlays/prod/patches/site-replicas.yaml
@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: site
+spec:
+  replicas: 2
+  template:
+    spec:
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app: site
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app: site
+                topologyKey: kubernetes.io/hostname
diff --git a/infra/k3s/overlays/prod/pdbs.yaml b/infra/k3s/overlays/prod/pdbs.yaml
index 6f1c3397..34b9d383 100644
--- a/infra/k3s/overlays/prod/pdbs.yaml
+++ b/infra/k3s/overlays/prod/pdbs.yaml
@@ -4,7 +4,12 @@ metadata:
   name: api-pdb
   namespace: boringstack-prod
 spec:
-  minAvailable: 2
+  # maxUnavailable, not minAvailable: 2. The api runs 3 replicas with
+  # preferred (not required) anti-affinity, so on a small cluster they can
+  # land 2/1 across nodes. Draining the node that holds two then never
+  # satisfies minAvailable: 2, and node maintenance blocks indefinitely.
+  # maxUnavailable: 1 expresses the same intent and drains cleanly.
+  maxUnavailable: 1
   selector:
     matchLabels:
       app: api
@@ -22,6 +27,17 @@ spec:
 ---
 apiVersion: policy/v1
 kind: PodDisruptionBudget
+metadata:
+  name: site-pdb
+  namespace: boringstack-prod
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: site
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
 metadata:
   name: postgres-pdb
   namespace: boringstack-prod
diff --git a/infra/k3s/overlays/prod/secrets/vault/vault-registry-secret.yaml b/infra/k3s/overlays/prod/secrets/vault/vault-registry-secret.yaml
index a1106fd3..567ca005 100644
--- a/infra/k3s/overlays/prod/secrets/vault/vault-registry-secret.yaml
+++ b/infra/k3s/overlays/prod/secrets/vault/vault-registry-secret.yaml
@@ -15,6 +15,8 @@ spec:
     overwrite: true
     type: kubernetes.io/dockerconfigjson
     transformation:
+      # Drop VSO's `_raw` copy of the Vault response; only the dockerconfigjson key is needed.
+      excludeRaw: true
       templates:
         .dockerconfigjson:
           text: "{{ .Secrets.DOCKER_CONFIG_JSON }}"
diff --git a/infra/k3s/overlays/prod/secrets/vault/vault-secrets.yaml b/infra/k3s/overlays/prod/secrets/vault/vault-secrets.yaml
index ce0966cc..58785491 100644
--- a/infra/k3s/overlays/prod/secrets/vault/vault-secrets.yaml
+++ b/infra/k3s/overlays/prod/secrets/vault/vault-secrets.yaml
@@ -15,5 +15,17 @@ spec:
     create: true
     overwrite: true
     type: Opaque
+    # REQUIRED here. VSO adds a `_raw` key holding the entire Vault response as
+    # JSON. Workloads consume this Secret with `envFrom: secretRef`, so without
+    # excludeRaw every secret would also land in one env var, JSON-encoded, in
+    # every api and valkey pod. Node error pages and APM agents dump process.env.
+    transformation:
+      excludeRaw: true
   # Re-sync the k8s Secret (and roll consumers) when the Vault value changes.
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: api
+    - kind: StatefulSet
+      name: valkey
+  refreshAfter: 1m
   hmacSecretData: true
diff --git a/infra/k3s/overlays/prod/site-build.env b/infra/k3s/overlays/prod/site-build.env
new file mode 100644
index 00000000..82c14f7d
--- /dev/null
+++ b/infra/k3s/overlays/prod/site-build.env
@@ -0,0 +1,12 @@
+# Build-time public site configuration for production images. Read by
+# .github/workflows/apps-site-release.yml and apps-site-validate.yml, and passed as
+# --build-arg values. Changing any value rebuilds the site image.
+#
+# Placeholders: rename-project.sh rewrites the boringstack.example.com host. Replace
+# the mailbox with one you monitor before launch. Optional analytics stays off
+# until both ANALYTICS_* values are set (see apps/site/README.md).
+SITE_URL=https://boringstack.example.com
+APP_URL=https://app.boringstack.example.com
+CONTACT_EMAIL=hello@boringstack.example.com
+ANALYTICS_SCRIPT_URL=
+ANALYTICS_WEBSITE_ID=
diff --git a/infra/k3s/tests/business-metrics.test.ts b/infra/k3s/tests/business-metrics.test.ts
new file mode 100644
index 00000000..2f1c1d73
--- /dev/null
+++ b/infra/k3s/tests/business-metrics.test.ts
@@ -0,0 +1,303 @@
+import { describe, expect, test } from "bun:test";
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { YAML } from "bun";
+
+/*
+ * Business metrics contract: the CNPG custom queries and the Grafana dashboard
+ * may only read the template's real tables and columns, only through the
+ * column grants shipped in the drizzle migrations, and never expose columns
+ * that identify or authenticate a person.
+ */
+
+const repoRoot = join(import.meta.dir, "..", "..", "..");
+const drizzleDir = join(repoRoot, "apps/api/drizzle");
+const monitoringDir = join(repoRoot, "infra/k3s/overlays/prod/monitoring");
+
+// Never granted to the exporter, even as aggregates.
+const DENIED_COLUMNS = new Set([
+  "email",
+  "first_name",
+  "last_name",
+  "ip",
+  "user_agent",
+  "metadata",
+  "password_hash",
+  "token_hash",
+  "code_hash",
+  "mfa_secret_encrypted",
+  "mfa_last_totp_step",
+  "stripe_customer_id",
+  "stripe_subscription_id",
+  "last_stripe_event_id",
+  "event_id",
+  "resource",
+  "request_id",
+]);
+
+interface ISnapshot {
+  tables: Record<string, { columns: Record<string, unknown> }>;
+}
+
+interface IQuery {
+  query: string;
+  primary: boolean;
+  target_databases: string[];
+  metrics: Array<Record<string, { usage: string }>>;
+}
+
+const unquote = (identifier: string) => identifier.trim().replace(/"/g, "");
+
+const stripSqlComments = (sql: string) =>
+  sql.replace(/\/\*[\s\S]*?\*\//g, "").replace(/--.*$/gm, "");
+
+const latestSnapshot = (): ISnapshot => {
+  const journal = JSON.parse(
+    readFileSync(join(drizzleDir, "meta/_journal.json"), "utf8"),
+  ) as { entries: Array<{ tag: string }> };
+  const tag = journal.entries.at(-1)?.tag;
+  if (!tag) throw new Error("drizzle journal has no entries");
+  return JSON.parse(
+    readFileSync(
+      join(drizzleDir, "meta", `${tag.split("_")[0]}_snapshot.json`),
+      "utf8",
+    ),
+  ) as ISnapshot;
+};
+
+// schema.table -> column names, from the latest drizzle snapshot.
+const schemaColumns = (): Map<string, Set<string>> => {
+  const snapshot = latestSnapshot();
+  return new Map(
+    Object.entries(snapshot.tables).map(([table, value]) => [
+      table,
+      new Set(Object.keys(value.columns)),
+    ]),
+  );
+};
+
+// Grants to pg_monitor across every migration, in statement order.
+const monitorGrants = () => {
+  const sql = readdirSync(drizzleDir)
+    .filter((file) => file.endsWith(".sql"))
+    .sort()
+    .map((file) => stripSqlComments(readFileSync(join(drizzleDir, file), "utf8")))
+    .join("\n");
+  const schemas = new Set<string>();
+  for (const match of sql.matchAll(
+    /GRANT\s+USAGE\s+ON\s+SCHEMA\s+([^;]+?)\s+TO\s+pg_monitor/gi,
+  )) {
+    for (const schema of (match[1] ?? "").split(",")) {
+      schemas.add(unquote(schema));
+    }
+  }
+  const columns = new Map<string, Set<string>>();
+  for (const match of sql.matchAll(
+    /GRANT\s+SELECT\s*\(([^)]*)\)\s+ON\s+([^;]+?)\s+TO\s+pg_monitor/gi,
+  )) {
+    const table = (match[2] ?? "")
+      .split(".")
+      .map((part) => unquote(part))
+      .join(".");
+    const granted = columns.get(table) ?? new Set<string>();
+    for (const column of (match[1] ?? "").split(",")) {
+      granted.add(unquote(column));
+    }
+    columns.set(table, granted);
+  }
+  return { schemas, columns };
+};
+
+const businessQueries = (): Record<string, IQuery> => {
+  const configMap = YAML.parse(
+    readFileSync(join(monitoringDir, "cnpg-business-queries.yaml"), "utf8"),
+  ) as { data: { queries: string } };
+  return YAML.parse(configMap.data.queries) as Record<string, IQuery>;
+};
+
+// cnpg_<query>_<column> for every non-label column.
+const producedMetrics = (queries: Record<string, IQuery>) => {
+  const metrics = new Map<string, { labels: Set<string> }>();
+  for (const [name, query] of Object.entries(queries)) {
+    const labels = new Set<string>();
+    for (const entry of query.metrics) {
+      for (const [column, spec] of Object.entries(entry)) {
+        if (spec.usage === "LABEL") labels.add(column);
+      }
+    }
+    for (const entry of query.metrics) {
+      for (const [column, spec] of Object.entries(entry)) {
+        if (spec.usage !== "LABEL") {
+          metrics.set(`cnpg_${name}_${column}`, { labels });
+        }
+      }
+    }
+  }
+  return metrics;
+};
+
+describe("business metrics: queries against the template schema", () => {
+  const schema = schemaColumns();
+  const grants = monitorGrants();
+  const queries = businessQueries();
+
+  test("every granted column exists in the schema and is not a denied column", () => {
+    for (const [table, columns] of grants.columns) {
+      expect(schema.has(table)).toBe(true);
+      for (const column of columns) {
+        expect(schema.get(table)?.has(column)).toBe(true);
+        expect(DENIED_COLUMNS.has(column)).toBe(false);
+      }
+    }
+  });
+
+  test("the exporter can use the schemas the queries touch", () => {
+    for (const table of grants.columns.keys()) {
+      const [owner] = table.split(".");
+      expect(grants.schemas.has(owner ?? "")).toBe(true);
+    }
+  });
+
+  test("queries are primary-only and target the application database", () => {
+    for (const [name, query] of Object.entries(queries)) {
+      expect({ name, primary: query.primary }).toEqual({ name, primary: true });
+      expect(query.target_databases).toEqual(["boringstack"]);
+    }
+  });
+
+  test("every qualified column in every query is a real, granted column", () => {
+    for (const [name, query] of Object.entries(queries)) {
+      const sql = query.query;
+      expect(sql, name).not.toMatch(/SELECT\s+\*/i);
+      const aliases = new Map<string, string>();
+      for (const match of sql.matchAll(
+        /\b(?:FROM|JOIN)\s+(\w+)\.(\w+)\s+(\w+)/gi,
+      )) {
+        aliases.set(match[3] ?? "", `${match[1]}.${match[2]}`);
+      }
+      expect(aliases.size, name).toBeGreaterThan(0);
+      const cleaned = sql
+        .replace(/'[^']*'/g, "''")
+        .replace(/\b(FROM|JOIN)\s+\w+\.\w+\s+\w+/gi, "$1 ")
+        .replace(/\bAS\s+\w+/gi, "");
+      for (const match of cleaned.matchAll(/\b(\w+)\.(\w+)\b/g)) {
+        const [, alias, column] = match;
+        const table = aliases.get(alias ?? "");
+        expect(table, `${name}: unknown alias ${alias}`).toBeDefined();
+        expect(
+          schema.get(table ?? "")?.has(column ?? ""),
+          `${name}: ${table}.${column} is not a column`,
+        ).toBe(true);
+        expect(
+          grants.columns.get(table ?? "")?.has(column ?? ""),
+          `${name}: ${table}.${column} is not granted to pg_monitor`,
+        ).toBe(true);
+      }
+    }
+  });
+
+  test("each query's output columns match its declared metrics", () => {
+    for (const [name, query] of Object.entries(queries)) {
+      const selectList = query.query.slice(
+        0,
+        query.query.search(/\bFROM\b/i),
+      );
+      const outputs = [...selectList.matchAll(/\bAS\s+(\w+)/gi)].map(
+        (match) => match[1],
+      );
+      const declared = query.metrics.flatMap((entry) => Object.keys(entry));
+      expect(outputs.sort(), name).toEqual(declared.sort());
+    }
+  });
+});
+
+describe("business metrics: rendered production overlay", () => {
+  const rendered = Bun.spawnSync(
+    ["kubectl", "kustomize", "infra/k3s/overlays/prod"],
+    { cwd: repoRoot },
+  );
+  if (rendered.exitCode !== 0) {
+    throw new Error(rendered.stderr.toString());
+  }
+  const documents = rendered.stdout
+    .toString()
+    .split(/^---$/m)
+    .filter((doc) => doc.trim() !== "")
+    .map((doc) => YAML.parse(doc) as Record<string, any>);
+  const resource = (kind: string, name: string) => {
+    const item = documents.find(
+      (doc) => doc.kind === kind && doc.metadata?.name === name,
+    );
+    if (!item) throw new Error(`Missing ${kind}/${name}`);
+    return item;
+  };
+
+  test("the CNPG cluster loads the default and business query sets", () => {
+    const names = resource("Cluster", "boringstack-db").spec.monitoring
+      .customQueriesConfigMap.map((ref: { name: string }) => ref.name);
+    expect(names).toEqual([
+      "cnpg-default-monitoring",
+      "boringstack-db-business-metrics",
+    ]);
+    expect(
+      resource("ConfigMap", "boringstack-db-business-metrics").metadata.labels[
+        "cnpg.io/reload"
+      ],
+    ).toBe("");
+  });
+
+  test("the PodMonitor scrapes every CNPG instance of the cluster", () => {
+    const monitor = resource("PodMonitor", "boringstack-db");
+    expect(monitor.spec.selector.matchLabels).toEqual({
+      "cnpg.io/cluster": "boringstack-db",
+    });
+    expect(monitor.spec.podMetricsEndpoints[0].port).toBe("metrics");
+  });
+
+  test("the rendered queries match the source file", () => {
+    const rendered = resource(
+      "ConfigMap",
+      "boringstack-db-business-metrics",
+    ).data.queries;
+    expect(Object.keys(YAML.parse(rendered))).toEqual(
+      Object.keys(businessQueries()),
+    );
+  });
+
+  test("the dashboard ConfigMap is picked up by the Grafana sidecar", () => {
+    const dashboard = resource("ConfigMap", "boringstack-business-dashboard");
+    expect(dashboard.metadata.labels.grafana_dashboard).toBe("1");
+  });
+
+  test("every dashboard query reads a metric the queries produce, grouped by its labels", () => {
+    const dashboard = JSON.parse(
+      resource("ConfigMap", "boringstack-business-dashboard").data[
+        "boringstack-business.json"
+      ],
+    ) as {
+      panels: Array<{
+        targets: Array<{ expr: string }>;
+      }>;
+    };
+    const produced = producedMetrics(businessQueries());
+    const exprs = dashboard.panels.flatMap((panel) =>
+      panel.targets.map((target) => target.expr),
+    );
+    expect(exprs.length).toBeGreaterThan(0);
+    for (const expr of exprs) {
+      for (const [metric] of expr.matchAll(/cnpg_[a-z0-9_]+/g)) {
+        const known = produced.get(metric);
+        expect(known, `dashboard reads unknown metric ${metric}`).toBeDefined();
+        const grouped = expr.match(/\bby\s*\(([^)]*)\)/);
+        for (const label of (grouped?.[1] ?? "").split(",")) {
+          const name = label.trim();
+          if (name === "") continue;
+          expect(
+            known?.labels.has(name),
+            `${metric} has no label ${name}`,
+          ).toBe(true);
+        }
+      }
+    }
+  });
+});
diff --git a/infra/k3s/tests/deployment.test.ts b/infra/k3s/tests/deployment.test.ts
new file mode 100644
index 00000000..1f288b93
--- /dev/null
+++ b/infra/k3s/tests/deployment.test.ts
@@ -0,0 +1,232 @@
+import { describe, expect, test } from "bun:test";
+import { YAML } from "bun";
+
+// Invariants for the production release path. These run against the real
+// `kubectl kustomize` render, so they assert what Argo will apply.
+const overlay = new URL("../overlays/prod", import.meta.url).pathname;
+const rendered = Bun.spawnSync(["kubectl", "kustomize", overlay]);
+if (rendered.exitCode !== 0) throw new Error(rendered.stderr.toString());
+const renderedText = rendered.stdout.toString();
+// Rendered documents are controlled deployment fixtures, parsed only in tests.
+const documents = renderedText
+  .split(/^---$/m)
+  .map((doc) => doc.trim())
+  .filter((doc) => doc.length > 0)
+  .map((doc) => YAML.parse(doc));
+
+type Doc = (typeof documents)[number];
+
+const resource = (kind: string, name: string): Doc => {
+  const item = documents.find(
+    (doc) => doc.kind === kind && doc.metadata.name === name,
+  );
+  if (!item) throw new Error(`Missing ${kind}/${name}`);
+  return item;
+};
+const wave = (item: Doc) =>
+  Number(item.metadata.annotations?.["argocd.argoproj.io/sync-wave"] ?? 0);
+const podSpec = (item: Doc) => item.spec.template.spec;
+const container = (item: Doc, name: string) => {
+  const found = podSpec(item).containers.find(
+    (c: { name: string }) => c.name === name,
+  );
+  if (!found) throw new Error(`Missing container ${name}`);
+  return found;
+};
+const env = (item: Doc, name: string) => {
+  const found = container(item, "api").env as Array<{
+    name: string;
+    valueFrom?: { secretKeyRef?: { name: string; key: string } };
+  }>;
+  return found.find((entry) => entry.name === name);
+};
+const images = () =>
+  documents.flatMap((doc) =>
+    doc.spec?.template?.spec?.containers
+      ? doc.spec.template.spec.containers.map(
+          (c: { image: string }) => c.image,
+        )
+      : [],
+  );
+
+describe("production release contracts", () => {
+  test("project images are pinned by digest and no image renders as latest", () => {
+    const all = images();
+    expect(all.length).toBeGreaterThan(0);
+    for (const image of all) {
+      expect(image).not.toMatch(/:latest\b/);
+      expect(image).toContain(":");
+      if (image.startsWith("ghcr.io/boringstack-xyz/")) {
+        expect(image).toMatch(/@sha256:[a-f0-9]{64}$/);
+      }
+    }
+    expect(renderedText).not.toMatch(/image: \S+:latest\b/);
+  });
+
+  test("the four release images are the ones the release workflow pins", () => {
+    const names = images().map((image) => image.split("@")[0]);
+    expect(names).toContain("ghcr.io/boringstack-xyz/boringstack-api");
+    expect(names).toContain("ghcr.io/boringstack-xyz/boringstack-migrations");
+    expect(names).toContain("ghcr.io/boringstack-xyz/boringstack-ui");
+    expect(names).toContain("ghcr.io/boringstack-xyz/boringstack-site");
+  });
+
+  test("the public site is prebuilt, read-only and rolls out with the UI", async () => {
+    const site = resource("Deployment", "site");
+    const app = container(site, "site");
+    expect(app.securityContext.readOnlyRootFilesystem).toBe(true);
+    expect(app.securityContext.allowPrivilegeEscalation).toBe(false);
+    expect(podSpec(site).securityContext.runAsNonRoot).toBe(true);
+    expect(wave(site)).toBe(wave(resource("Deployment", "ui")));
+    expect(wave(resource("Deployment", "api"))).toBeLessThan(wave(site));
+    // Tinkercaster's site crash-looped because it built at container start.
+    // The image builds at image build time and only serves files at runtime.
+    const dockerfile = await Bun.file(
+      new URL("../../../apps/site/Dockerfile", import.meta.url),
+    ).text();
+    const runtime = dockerfile.slice(dockerfile.lastIndexOf("\nFROM "));
+    expect(runtime).toContain("nginx");
+    expect(runtime).not.toMatch(/astro build|bun run build/);
+  });
+
+  test("argocd-image-updater annotations are gone from the Application and the render", async () => {
+    const application = YAML.parse(
+      await Bun.file(
+        new URL("../argocd/boringstack-prod.yaml", import.meta.url),
+      ).text(),
+    ) as { metadata: { annotations?: Record<string, string> } };
+    const keys = Object.keys(application.metadata.annotations ?? {});
+    expect(keys.filter((key) => key.startsWith("argocd-image-updater."))).toEqual(
+      [],
+    );
+    expect(renderedText).not.toContain("argocd-image-updater");
+  });
+
+  test("first sync creates infrastructure before migrations, and migrations before the API", () => {
+    const migration = resource("Job", "api-migrations");
+    expect(migration.metadata.annotations["argocd.argoproj.io/hook"]).toBe(
+      "Sync",
+    );
+    expect(
+      wave(resource("VaultStaticSecret", "boringstack-secrets")),
+    ).toBeLessThan(wave(resource("Cluster", "boringstack-db")));
+    expect(wave(resource("Cluster", "boringstack-db"))).toBeLessThan(
+      wave(migration),
+    );
+    expect(wave(resource("StatefulSet", "valkey"))).toBeLessThan(
+      wave(migration),
+    );
+    expect(wave(migration)).toBeLessThan(wave(resource("Deployment", "api")));
+    expect(wave(resource("Deployment", "api"))).toBeLessThan(
+      wave(resource("Deployment", "ui")),
+    );
+  });
+
+  test("the migration Job migrates only and never seeds", () => {
+    const migration = resource("Job", "api-migrations");
+    const pod = podSpec(migration);
+    const migrate = pod.containers[0];
+    expect(migrate.image).toMatch(/boringstack-migrations@sha256:/);
+    const invocation = [
+      ...(migrate.command ?? []),
+      ...(migrate.args ?? []),
+    ].join(" ");
+    expect(invocation).toContain("db:migrate");
+    expect(invocation).not.toMatch(/db:seed|db:prepare|seed/);
+    // No app secret set: migrations need only the database connection.
+    expect(migrate.envFrom).toBeUndefined();
+    expect(migrate.securityContext.readOnlyRootFilesystem).toBe(true);
+    expect(migrate.volumeMounts).toContainEqual({
+      name: "runtime-tmp",
+      mountPath: "/tmp",
+    });
+  });
+
+  test("the API runs on a read-only root with only /tmp writable", async () => {
+    const api = resource("Deployment", "api");
+    const pod = podSpec(api);
+    const app = container(api, "api");
+    expect(app.securityContext.readOnlyRootFilesystem).toBe(true);
+    expect(app.securityContext.allowPrivilegeEscalation).toBe(false);
+    expect(app.volumeMounts).toContainEqual({
+      name: "runtime-tmp",
+      mountPath: "/tmp",
+    });
+    expect(pod.volumes).toContainEqual({
+      name: "runtime-tmp",
+      emptyDir: { sizeLimit: "256Mi" },
+    });
+    expect(env(api, "BUN_RUNTIME_TRANSPILER_CACHE_PATH")?.value).toBe(
+      "/tmp/bun-transpiler",
+    );
+    // The image CMD must not let bun install packages at startup.
+    const dockerfile = await Bun.file(
+      new URL("../../../apps/api/Dockerfile.prod", import.meta.url),
+    ).text();
+    expect(dockerfile).toContain(
+      'CMD ["bun", "--no-install", "run", "dist/index.js"]',
+    );
+  });
+
+  test("runtime client and migrations verify the database with the same CA", () => {
+    const apiCa = env(resource("Deployment", "api"), "DATABASE_SSL_CA");
+    const migrateEnv = container(
+      resource("Job", "api-migrations"),
+      "migrate",
+    ).env as Array<{
+      name: string;
+      valueFrom?: { secretKeyRef?: { name: string; key: string } };
+    }>;
+    const migrationCa = migrateEnv.find(
+      (entry) => entry.name === "DATABASE_SSL_CA",
+    );
+    expect(apiCa?.valueFrom?.secretKeyRef).toEqual({
+      name: "boringstack-db-ca",
+      key: "ca.crt",
+    });
+    expect(migrationCa?.valueFrom?.secretKeyRef).toEqual(
+      apiCa?.valueFrom?.secretKeyRef,
+    );
+  });
+
+  test("network policies admit the migration Job to Postgres and Prometheus to the API", () => {
+    const postgresIngress = JSON.stringify(
+      resource("NetworkPolicy", "postgres-network-policy").spec.ingress,
+    );
+    expect(postgresIngress).toContain('"app":"api-migrations"');
+    const apiIngress = JSON.stringify(
+      resource("NetworkPolicy", "api-network-policy").spec.ingress,
+    );
+    expect(apiIngress).toContain('"app.kubernetes.io/name":"prometheus"');
+    expect(apiIngress).toContain('"app.kubernetes.io/name":"traefik"');
+  });
+
+  test("API disruption budget tolerates a single node drain", () => {
+    const budget = resource("PodDisruptionBudget", "api-pdb");
+    expect(budget.spec.maxUnavailable).toBe(1);
+    expect(budget.spec.minAvailable).toBeUndefined();
+  });
+
+  test("app secrets exclude VSO's _raw copy so they never reach one env var", () => {
+    const secret = resource("VaultStaticSecret", "boringstack-secrets");
+    expect(secret.spec.destination.transformation.excludeRaw).toBe(true);
+    expect(
+      resource("VaultStaticSecret", "ghcr-registry-secret").spec.destination
+        .transformation.excludeRaw,
+    ).toBe(true);
+  });
+
+  test("the database and cache resist pruning and use canonical quantities", () => {
+    for (const [kind, name] of [
+      ["Cluster", "boringstack-db"],
+      ["StatefulSet", "valkey"],
+    ] as const) {
+      expect(
+        resource(kind, name).metadata.annotations[
+          "argocd.argoproj.io/sync-options"
+        ],
+      ).toContain("Prune=false");
+    }
+    expect(renderedText).not.toContain('"1000m"');
+  });
+});
diff --git a/scripts/audit-repo-settings.sh b/scripts/audit-repo-settings.sh
index 67b913f8..49276b5a 100755
--- a/scripts/audit-repo-settings.sh
+++ b/scripts/audit-repo-settings.sh
@@ -53,10 +53,10 @@ done
 #
 # --- Section 2: merge settings
 #
-MERGE_CURRENT=$(gh api "repos/$REPO" --jq '{delete_branch_on_merge, allow_squash_merge, allow_merge_commit, allow_rebase_merge}')
+MERGE_CURRENT=$(gh api "repos/$REPO" --jq '{delete_branch_on_merge, allow_squash_merge, allow_merge_commit, allow_rebase_merge, squash_merge_commit_title}')
 MERGE_DESIRED=$(jq -c '.merge' "$DESIRED")
 
-for key in delete_branch_on_merge allow_squash_merge allow_merge_commit allow_rebase_merge; do
+for key in delete_branch_on_merge allow_squash_merge allow_merge_commit allow_rebase_merge squash_merge_commit_title; do
   want=$(echo "$MERGE_DESIRED" | jq -r --arg k "$key" '.[$k]')
   have=$(echo "$MERGE_CURRENT" | jq -r --arg k "$key" '.[$k]')
   if [[ "$have" != "$want" ]]; then
diff --git a/scripts/ci/check-commit-title.sh b/scripts/ci/check-commit-title.sh
new file mode 100755
index 00000000..bfae5a6e
--- /dev/null
+++ b/scripts/ci/check-commit-title.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Enforce the Conventional Commits subject line on commits and PR titles.
+#
+#   scripts/ci/check-commit-title.sh "feat(api): add invoices"  # a title
+#   scripts/ci/check-commit-title.sh --file .git/COMMIT_EDITMSG  # a message file
+#
+# The commit-msg hook (scripts/ci/install-git-hooks.sh) checks local commits;
+# .github/workflows/pr-title.yml checks the PR title, which becomes the squash
+# commit on main. Prose that only lives in a guide does not survive a change
+# of agent or harness, so the convention is a gate, not a suggestion.
+
+set -euo pipefail
+
+TYPES='feat|fix|perf|refactor|test|docs|build|ci|chore|style|revert|deps'
+PATTERN="^(${TYPES})(\([a-z0-9][a-z0-9._/-]*\))?!?: [^ ].*$"
+
+if [[ "${1:-}" == "--file" ]]; then
+  [[ -n "${2:-}" && -f "$2" ]] || { echo "check-commit-title: no message file: ${2:-}" >&2; exit 2; }
+  # First line that is neither blank nor a git comment.
+  title="$(grep -v '^#' "$2" | grep -m1 -v '^[[:space:]]*$' || true)"
+else
+  title="${1:-}"
+fi
+
+# Git's own generated subjects pass untouched: autosquash markers, merges and
+# reverts are rewritten or squashed away before they reach main.
+case "$title" in
+  "fixup! "* | "squash! "* | "amend! "* | "Merge "* | "Revert \""*) exit 0 ;;
+esac
+
+if [[ "$title" =~ $PATTERN ]] && (( ${#title} <= 100 )); then
+  exit 0
+fi
+
+cat >&2 <<EOF
+Commit title does not follow Conventional Commits:
+
+  $title
+
+Expected: <type>(<optional scope>)!?: <summary>, at most 100 characters.
+Types: ${TYPES//|/, }
+Example: feat(api): invoices can be voided
+EOF
+exit 1
diff --git a/scripts/ci/install-git-hooks.sh b/scripts/ci/install-git-hooks.sh
index 630347e8..0a77b3e2 100755
--- a/scripts/ci/install-git-hooks.sh
+++ b/scripts/ci/install-git-hooks.sh
@@ -1,13 +1,14 @@
 #!/usr/bin/env bash
-# Install the root-level git pre-push hook for the monorepo.
+# Install the root-level git pre-push and commit-msg hooks for the monorepo.
 #
 # Run automatically by the root `package.json` postinstall on
 # `bun install`. Safe to run manually:
 #
 #   bun run scripts/ci/install-git-hooks.sh
 #
-# The hook delegates to scripts/ci/pre-push.sh, which fans out to each
+# pre-push delegates to scripts/ci/pre-push.sh, which fans out to each
 # app's own husky gate based on what changed since `origin/main`.
+# commit-msg delegates to scripts/ci/check-commit-title.sh.
 
 set -euo pipefail
 
@@ -46,3 +47,14 @@ EOF
 
 chmod +x "$HOOK_FILE"
 echo "[install-git-hooks] Installed root pre-push hook → $HOOK_FILE"
+
+COMMIT_MSG_HOOK="$HOOKS_DIR/commit-msg"
+
+cat > "$COMMIT_MSG_HOOK" <<'EOF'
+#!/usr/bin/env bash
+# Auto-installed by scripts/ci/install-git-hooks.sh: Conventional Commits titles.
+exec "$(git rev-parse --show-toplevel)/scripts/ci/check-commit-title.sh" --file "$1"
+EOF
+
+chmod +x "$COMMIT_MSG_HOOK"
+echo "[install-git-hooks] Installed root commit-msg hook → $COMMIT_MSG_HOOK"
diff --git a/scripts/ci/pre-push.sh b/scripts/ci/pre-push.sh
index 2855c682..a4db9d39 100755
--- a/scripts/ci/pre-push.sh
+++ b/scripts/ci/pre-push.sh
@@ -120,13 +120,24 @@ bash "$ROOT/scripts/ci/pre-push-smoke.sh"
 
 RAN_ANY=0
 
-for app in api ui docs; do
+for app_path in "$ROOT"/apps/*/; do
+  [[ -d "$app_path" ]] || continue
+  app="$(basename "$app_path")"
   if app_changed "$app"; then
     run_app_gate "$app"
     RAN_ANY=1
   fi
 done
 
+# Shared packages run their own validate; they borrow the UI toolchain, so a
+# change to them is gated here whether or not any app changed.
+if [[ -z "$CHANGED_PATHS" ]] || grep -q '^packages/' <<< "$CHANGED_PATHS"; then
+  step "Running shared packages validate"
+  bash -c 'source "$1/scripts/stack-lib.sh" && validate_packages' _ "$ROOT"
+  ok "shared packages validate passed"
+  RAN_ANY=1
+fi
+
 if infra_compose_changed; then
   step "Running infra/compose pre-push gate (compose config + shellcheck + yamllint)"
   bash "$ROOT/infra/compose/scripts/pre-push.sh"
diff --git a/scripts/release/release.mjs b/scripts/release/release.mjs
new file mode 100644
index 00000000..a29b0ff8
--- /dev/null
+++ b/scripts/release/release.mjs
@@ -0,0 +1,155 @@
+import { readdir, readFile, writeFile } from "node:fs/promises";
+import { Glob, YAML } from "bun";
+
+// Every image the production overlay pins. Keep in sync with the `images:`
+// block in infra/k3s/overlays/prod/kustomization.yaml (the tests enforce it).
+const images = ["api", "migrations", "ui", "site"];
+const releasePath = ".github/workflows/production-release.yml";
+const overlayPath = "infra/k3s/overlays/prod/kustomization.yaml";
+
+function matches(patterns, path) {
+  let included = false;
+  for (const pattern of patterns) {
+    const negative = pattern.startsWith("!");
+    if (new Glob(negative ? pattern.slice(1) : pattern).match(path))
+      included = !negative;
+  }
+  return included;
+}
+
+// Which push workflows must succeed for this commit. A workflow is required
+// when a main push would run it: branch filter, path filter and ignore lists
+// all apply, exactly as GitHub evaluates them.
+export function expectedWorkflows(workflows, changed) {
+  return workflows
+    .filter((workflow) => {
+      if (
+        workflow.path === releasePath ||
+        !Object.hasOwn(workflow.on ?? {}, "push")
+      )
+        return false;
+      const push = workflow.on.push ?? {};
+      if (push.tags && !push.branches) return false;
+      if (push.branches && !matches(push.branches, "main")) return false;
+      if (push["branches-ignore"] && matches(push["branches-ignore"], "main"))
+        return false;
+      if (push.paths && !changed.some((path) => matches(push.paths, path)))
+        return false;
+      if (
+        push["paths-ignore"] &&
+        changed.every((path) => matches(push["paths-ignore"], path))
+      )
+        return false;
+      return true;
+    })
+    .map((workflow) => workflow.path);
+}
+
+// GitHub returns newest runs first. A rerun must never inherit an old success.
+export function checkRuns(expected, runs) {
+  if (!expected.length)
+    throw new Error("No required workflows discovered; refusing release");
+  let ready = true;
+  for (const path of expected) {
+    const run = runs.find((item) => item.path === path);
+    if (!run || run.status !== "completed") {
+      ready = false;
+    } else if (run.conclusion !== "success") {
+      throw new Error(`Release blocked by ${path}: ${run.conclusion}`);
+    }
+  }
+  return ready;
+}
+
+export function pinImages(text, repository, digests) {
+  if (!/^[a-z0-9_.-]+\/[a-z0-9_.-]+$/.test(repository))
+    throw new Error("Invalid repository");
+  for (const image of images) {
+    if (!/^sha256:[a-f0-9]{64}$/.test(digests[image] ?? ""))
+      throw new Error(`Missing/invalid ${image} digest`);
+    const escaped = `ghcr.io/${repository}-${image}`.replace(
+      /[.*+?^${}()|[\]\\]/g,
+      "\\$&",
+    );
+    const pattern = new RegExp(
+      `(  - name: ${escaped}\\n)((?:    [^\\n]*\\n)*)`,
+      "g",
+    );
+    let count = 0;
+    text = text.replace(pattern, (whole, name) => {
+      count++;
+      return `${name}    digest: ${digests[image]}\n`;
+    });
+    if (count !== 1)
+      throw new Error(`Expected exactly one production ${image} image`);
+  }
+  return text;
+}
+
+async function command(args) {
+  const child = Bun.spawn(args, { stdout: "pipe", stderr: "inherit" });
+  const output = await new Response(child.stdout).text();
+  if ((await child.exited) !== 0)
+    throw new Error(`Command failed: ${args[0]} ${args[1]}`);
+  return output.trim();
+}
+
+async function gate() {
+  const event = JSON.parse(
+    await readFile(process.env.GITHUB_EVENT_PATH, "utf8"),
+  );
+  const sha = process.env.GITHUB_SHA;
+  if (
+    !/^[a-f0-9]{40}$/.test(sha ?? "") ||
+    !/^[a-f0-9]{40}$/.test(event.before ?? "")
+  )
+    throw new Error("Release requires a main push event");
+  const changed = (
+    await command(["git", "diff", "--name-only", event.before, sha])
+  ).split("\n");
+  const workflows = [];
+  for (const file of await readdir(".github/workflows")) {
+    if (!/\.ya?ml$/.test(file)) continue;
+    const path = `.github/workflows/${file}`;
+    workflows.push({ ...YAML.parse(await readFile(path, "utf8")), path });
+  }
+  const expected = expectedWorkflows(workflows, changed);
+  console.log("Waiting for successful checks at", sha, expected);
+  const deadline = Date.now() + 45 * 60_000;
+  while (Date.now() < deadline) {
+    const pages = JSON.parse(
+      await command([
+        "gh",
+        "api",
+        "--paginate",
+        "--slurp",
+        `repos/${process.env.GITHUB_REPOSITORY}/actions/runs?head_sha=${sha}&event=push&per_page=100`,
+      ]),
+    );
+    const runs = pages.flatMap((page) => page.workflow_runs);
+    if (checkRuns(expected, runs)) return;
+    await Bun.sleep(15_000);
+  }
+  throw new Error(
+    "CI did not complete within 45 minutes; no production images changed",
+  );
+}
+
+async function promote() {
+  const digests = Object.fromEntries(
+    images.map((image) => [image, process.env[`${image.toUpperCase()}_DIGEST`]]),
+  );
+  const text = await readFile(overlayPath, "utf8");
+  // Validate the full set before touching disk.
+  await writeFile(
+    overlayPath,
+    pinImages(text, process.env.GITHUB_REPOSITORY, digests),
+  );
+}
+
+if (import.meta.main) {
+  const action = process.argv[2];
+  if (action === "gate") await gate();
+  else if (action === "pin") await promote();
+  else throw new Error("Expected gate or pin");
+}
diff --git a/scripts/release/release.test.ts b/scripts/release/release.test.ts
new file mode 100644
index 00000000..8ddf900a
--- /dev/null
+++ b/scripts/release/release.test.ts
@@ -0,0 +1,197 @@
+import { describe, expect, test } from "bun:test";
+import { YAML } from "bun";
+import { checkRuns, expectedWorkflows, pinImages } from "./release.mjs";
+
+const repository = "boringstack-xyz/boringstack";
+const imageNames = ["api", "migrations", "ui", "site"];
+const hexFor = { api: "a", migrations: "b", ui: "c", site: "d" } as const;
+const digestOf = (name: string) =>
+  "sha256:" + hexFor[name as keyof typeof hexFor].repeat(64);
+const digests = Object.fromEntries(
+  imageNames.map((name) => [name, digestOf(name)]),
+);
+const placeholderOverlay = (suffix = "") =>
+  "resources:\n  - ../../base\nimages:\n" +
+  imageNames
+    .map(
+      (name) =>
+        `  - name: ghcr.io/${repository}-${name}\n    newTag: latest\n`,
+    )
+    .join("") +
+  "patches: []\n" +
+  suffix;
+
+describe("coordinated release", () => {
+  test("requires matching workflows by file path, including unfiltered checks", () => {
+    const workflows = [
+      { path: "all.yml", on: { push: { branches: ["main"] } } },
+      { path: "api.yml", on: { push: { paths: ["apps/api/**"] } } },
+      { path: "ui.yml", on: { push: { paths: ["apps/ui/**"] } } },
+      { path: "pr.yml", on: { pull_request: {} } },
+      {
+        path: ".github/workflows/production-release.yml",
+        on: { push: { branches: ["main"] } },
+      },
+    ];
+    expect(expectedWorkflows(workflows, ["apps/api/a.ts"])).toEqual([
+      "all.yml",
+      "api.yml",
+    ]);
+  });
+  test("honours branch and ignore filters as GitHub does", () => {
+    const workflows = [
+      { path: "tags.yml", on: { push: { tags: ["v*"] } } },
+      { path: "other.yml", on: { push: { branches: ["dev"] } } },
+      {
+        path: "ignored.yml",
+        on: { push: { "paths-ignore": ["docs/**"] } },
+      },
+    ];
+    expect(expectedWorkflows(workflows, ["docs/readme.md"])).toEqual([]);
+    expect(expectedWorkflows(workflows, ["apps/api/a.ts"])).toEqual([
+      "ignored.yml",
+    ]);
+  });
+  test("never treats missing, running or failed checks as success", () => {
+    expect(checkRuns(["a"], [])).toBe(false);
+    expect(checkRuns(["a"], [{ path: "a", status: "queued" }])).toBe(false);
+    expect(() =>
+      checkRuns(
+        ["a"],
+        [{ path: "a", status: "completed", conclusion: "failure" }],
+      ),
+    ).toThrow();
+    expect(() =>
+      checkRuns(
+        ["a"],
+        [{ path: "a", status: "completed", conclusion: "cancelled" }],
+      ),
+    ).toThrow();
+    expect(
+      checkRuns(
+        ["a"],
+        [{ path: "a", status: "completed", conclusion: "success" }],
+      ),
+    ).toBe(true);
+    expect(() => checkRuns([], [])).toThrow();
+  });
+  test("latest rerun takes precedence over older successful run", () => {
+    expect(
+      checkRuns(
+        ["a"],
+        [
+          { path: "a", status: "queued" },
+          { path: "a", status: "completed", conclusion: "success" },
+        ],
+      ),
+    ).toBe(false);
+  });
+  test("pins every image or changes nothing; preserves unrelated configuration", () => {
+    const text = placeholderOverlay();
+    const result = pinImages(text, repository, digests);
+    expect(result.match(/digest: sha256:/g)).toHaveLength(imageNames.length);
+    expect(result).not.toContain("newTag");
+    expect(result).toContain("patches: []");
+    expect(result).toContain("resources:\n  - ../../base");
+    expect(() =>
+      pinImages(text, repository, { ...digests, api: "" }),
+    ).toThrow();
+    expect(() =>
+      pinImages(text.replace("boringstack-ui", "other"), repository, digests),
+    ).toThrow();
+    expect(pinImages(result, repository, digests)).toBe(result);
+  });
+  test("the committed overlay pins exactly the images the release publishes", async () => {
+    const overlay = YAML.parse(
+      await Bun.file("infra/k3s/overlays/prod/kustomization.yaml").text(),
+    ) as { images: Array<{ name: string; digest?: string }> };
+    const names = overlay.images.map((image) => image.name).sort();
+    expect(names).toEqual(
+      imageNames
+        .map((name) => `ghcr.io/${repository}-${name}`)
+        .sort(),
+    );
+    // The committed overlay must stay in the shape the pin step rewrites.
+    const pinned = pinImages(
+      await Bun.file("infra/k3s/overlays/prod/kustomization.yaml").text(),
+      repository,
+      digests,
+    );
+    for (const name of imageNames) {
+      expect(pinned).toContain(
+        `  - name: ghcr.io/${repository}-${name}\n    digest: ${digests[name]}\n`,
+      );
+    }
+  });
+});
+
+test("release configuration has one k8s publisher, requires activation, checks and a complete set", async () => {
+  const workflow = YAML.parse(
+    await Bun.file(".github/workflows/production-release.yml").text(),
+  ) as {
+    jobs: {
+      release: {
+        "runs-on": string;
+        steps: Array<{
+          run?: string;
+          uses?: string;
+          with?: { tags?: string; target?: string };
+          env?: Record<string, string>;
+        }>;
+      };
+    };
+  };
+  const release = workflow.jobs.release;
+  expect(release["runs-on"]).toBe("ubuntu-24.04");
+  const steps = release.steps;
+  expect(steps[0].run).toContain('"$RELEASE_MODE" != coordinated');
+  const gate = steps.findIndex((step) =>
+    step.run?.includes("release.mjs gate"),
+  );
+  const builds = steps.filter((step) =>
+    step.uses?.startsWith("docker/build-push-action"),
+  );
+  expect(builds).toHaveLength(imageNames.length);
+  expect(gate).toBeGreaterThan(-1);
+  expect(gate).toBeLessThan(steps.indexOf(builds[0]));
+  expect(builds.every((step) => step.with?.tags?.includes(":candidate-"))).toBe(
+    true,
+  );
+  expect(
+    builds.map((step) => step.with?.tags?.match(/-(api|migrations|ui|site):/)?.[1]),
+  ).toEqual(imageNames);
+  const promotion = steps.at(-1);
+  expect(Object.keys(promotion?.env ?? {}).sort()).toEqual([
+    "API_DIGEST",
+    "MIGRATIONS_DIGEST",
+    "SITE_DIGEST",
+    "UI_DIGEST",
+  ]);
+  expect(promotion?.run).toContain(
+    'test "$(git rev-parse origin/main)" = "$GITHUB_SHA"',
+  );
+  expect(promotion?.run).not.toContain("--force");
+  // Only the release workflow may write the production image pins.
+  for (const file of [
+    ".github/workflows/apps-api-release.yml",
+    ".github/workflows/apps-ui-release.yml",
+    ".github/workflows/apps-site-release.yml",
+    ".github/workflows/infra-k3s-validate.yml",
+  ]) {
+    expect(await Bun.file(file).text()).not.toContain(
+      "overlays/prod/kustomization.yaml",
+    );
+  }
+});
+
+test("no workflow still runs the Argo Image Updater for Kubernetes", async () => {
+  const glob = new Bun.Glob(".github/workflows/*.yml");
+  for await (const file of glob.scan(".")) {
+    expect(await Bun.file(file).text()).not.toContain(
+      "argocd-image-updater.argoproj.io/",
+    );
+  }
+  expect(
+    await Bun.file("infra/k3s/argocd/boringstack-prod.yaml").text(),
+  ).not.toContain("argocd-image-updater.argoproj.io/");
+});
diff --git a/scripts/stack-check.sh b/scripts/stack-check.sh
index e94f4ceb..6e21a2d2 100755
--- a/scripts/stack-check.sh
+++ b/scripts/stack-check.sh
@@ -47,6 +47,9 @@ fi
 run_check "ui lint-meta docs" bash -c "cd \"$BORINGSTACK_UI_DIR\" && bun run check:lint-meta-docs"
 run_check "ui scripts docs" bash -c "cd \"$BORINGSTACK_UI_DIR\" && bun run check:scripts-docs"
 
+# Packages are discovered, so a product without packages/ skips this silently.
+run_check "packages validate" validate_packages
+
 if [[ "$HAS_DOCS" == "1" ]]; then
   run_check "docs data" bash -c "cd \"$BORINGSTACK_DOCS_DIR\" && BORINGSTACK_API_DIR=\"$BORINGSTACK_API_DIR\" BORINGSTACK_UI_DIR=\"$BORINGSTACK_UI_DIR\" bun run check:docs-data"
 fi
@@ -54,6 +57,10 @@ fi
 if [[ "$FULL" == "--full" ]]; then
   run_check "api validate" bash -c "cd \"$BORINGSTACK_API_DIR\" && bun run validate"
   run_check "ui validate" bash -c "cd \"$BORINGSTACK_UI_DIR\" && bun run validate"
+  # The public site is a product app in every fork, so it is checked whenever present.
+  if [[ -d "$BORINGSTACK_SITE_DIR" ]]; then
+    run_check "site validate" bash -c "cd \"$BORINGSTACK_SITE_DIR\" && bun run validate"
+  fi
   if [[ "$HAS_DOCS" == "1" ]]; then
     run_check "docs build:ci" bash -c "cd \"$BORINGSTACK_DOCS_DIR\" && BORINGSTACK_API_DIR=\"$BORINGSTACK_API_DIR\" BORINGSTACK_UI_DIR=\"$BORINGSTACK_UI_DIR\" bun run build:ci"
   fi
diff --git a/scripts/stack-lib.sh b/scripts/stack-lib.sh
index cf55a4f1..069efbaf 100755
--- a/scripts/stack-lib.sh
+++ b/scripts/stack-lib.sh
@@ -7,6 +7,8 @@ export BORINGSTACK_ROOT="$ROOT"
 export BORINGSTACK_API_DIR="${BORINGSTACK_API_DIR:-$ROOT/apps/api}"
 export BORINGSTACK_UI_DIR="${BORINGSTACK_UI_DIR:-$ROOT/apps/ui}"
 export BORINGSTACK_DOCS_DIR="${BORINGSTACK_DOCS_DIR:-$ROOT/apps/docs}"
+export BORINGSTACK_SITE_DIR="${BORINGSTACK_SITE_DIR:-$ROOT/apps/site}"
+export BORINGSTACK_PACKAGES_DIR="${BORINGSTACK_PACKAGES_DIR:-$ROOT/packages}"
 export BORINGSTACK_INFRA_COMPOSE_DIR="${BORINGSTACK_INFRA_COMPOSE_DIR:-$ROOT/infra/compose/compose}"
 
 c_red()    { printf '\033[1;31m%s\033[0m\n' "$*"; }
@@ -37,3 +39,31 @@ require_api_swagger() {
   c_yellow "  start the API or set OPENAPI_URL; strict evidence: bun run agent:verify -- --json"
   return 1
 }
+
+# Workspace packages are every packages/<name>/ that has a package.json. A
+# missing packages/ directory means there are none, which is not an error.
+list_packages() {
+  local dir
+  for dir in "$BORINGSTACK_PACKAGES_DIR"/*/; do
+    if [[ -f "${dir}package.json" ]]; then
+      printf '%s\n' "${dir%/}"
+    fi
+  done
+}
+
+# Each package must define a `validate` script (its own lint, typecheck and
+# tests). Runs all of them and returns non-zero if any fails.
+validate_packages() {
+  local dir name failed=0
+  while IFS= read -r dir; do
+    name="$(basename "$dir")"
+    step "package $name validate"
+    if (cd "$dir" && bun run validate); then
+      ok "package $name validate"
+    else
+      c_red "✗ package $name validate"
+      failed=1
+    fi
+  done < <(list_packages)
+  return "$failed"
+}
diff --git a/setup.sh b/setup.sh
index 5c79161c..ce2ee71b 100755
--- a/setup.sh
+++ b/setup.sh
@@ -60,17 +60,19 @@ row() {
 read_env() {
   local key="$1" file="$2"
   if [[ -f "$file" ]]; then
-    grep -E "^${key}=" "$file" | tail -n1 | sed "s/^${key}=//"
+    # A missing key is an empty value, not an error (pipefail is on).
+    grep -E "^${key}=" "$file" | tail -n1 | sed "s/^${key}=//" || true
   fi
 }
 
 print_dev_urls() {
   local env_file="$INFRA/compose/.env"
-  local with_obs with_glitch with_bullmq with_mailpit
+  local with_obs with_glitch with_bullmq with_mailpit with_site
   with_obs="$(read_env WITH_OBSERVABILITY "$env_file")"
   with_glitch="$(read_env WITH_GLITCHTIP "$env_file")"
   with_bullmq="$(read_env WITH_BULLMQ "$env_file")"
   with_mailpit="$(read_env WITH_MAILPIT "$env_file")"
+  with_site="$(read_env WITH_SITE "$env_file")"
 
   echo
   echo "BoringStack is up. Open these:"
@@ -78,6 +80,8 @@ print_dev_urls() {
   row "UI"            "http://localhost:7331"
   row "API"           "http://localhost:7330"
   row "API OpenAPI"   "http://localhost:7330/swagger"
+  # Public marketing site defaults on in dev; opt out with WITH_SITE=0.
+  [[ "$with_site" != "0" ]] && row "Site"          "http://localhost:7333"
 
   # Dev defaults: Mailpit + Bull-board are on unless explicitly disabled.
   [[ "$with_mailpit" != "0" ]] && row "Mailpit"     "http://localhost:8025"
diff --git a/tools/agent/README.md b/tools/agent/README.md
index 83140c09..2a551b26 100644
--- a/tools/agent/README.md
+++ b/tools/agent/README.md
@@ -111,30 +111,56 @@ The desired repository settings list `agent verification contract` as required.
 ## Updating the expected test inventory
 
 Ordinary API, UI and browser lanes compare every observed case identity, including
-multiplicity, against `tools/agent/inventories/*.json`. Missing, substituted and
-unexpected cases block verification. This deliberately requires review when tests
-are added or removed, including generated feature tests.
-
-Run the feature profile first. A complete passing underlying suite writes a private
-observation even if its inventory disagrees. Then explicitly run:
-
-```sh
-bun run agent:inventory -- api.tests ui.tests ui.e2e
-```
-
-This first command is a preview: it prints exact added/removed identities and a
-review token without updating files. Approve the same diff explicitly:
-
-```sh
-bun run agent:inventory -- api.tests ui.tests ui.e2e --accept=<token>
-```
-
-If any cases are removed (including one occurrence of a duplicate or a same-count
-replacement), also supply `--allow-removals=<token>`. This acknowledges the exact
-removals already displayed; it is not a blanket permission for future reductions.
-The token binds the checkout, old baseline and fresh observation. Any change
-invalidates approval. Choose only changed lanes, approve them together, review the
-committed diff, then rerun verification. Approval never declares the update verified.
+multiplicity, against `tools/agent/inventories/*.json`. The protocol:
+
+- **Additions are recorded automatically.** When a lane's observation is the baseline
+  plus new cases and nothing is removed, the feature verification run rewrites that
+  lane's baseline after the checkout is confirmed unchanged. The lane reports
+  `test_inventory_additions_recorded`. Commit the updated `tools/agent/inventories/*.json`
+  with the feature change; no separate accept step is needed.
+- **Removals block and are never recorded.** A removed, renamed or same-count
+  substituted case (including one fewer occurrence of a duplicate) fails the lane with
+  `test_inventory_disagrees`. The failure output lists each removed identity and prints
+  one command. Run it, then rerun verification:
+
+  ```sh
+  bun run agent:inventory -- api.tests --accept=<token> --allow-removals=<token>
+  ```
+
+  The token binds the checkout, the old baseline and the fresh observation, so any
+  source or test change invalidates it. Review the printed identities before running it.
+  Acknowledgement only updates the baseline; it does not declare the run verified.
+
+- **Zero observed cases block** with `test_inventory_empty`; they are never recorded
+  and cannot be acknowledged. Fix the lane so it runs its tests.
+- **Preview** is still available and writes nothing:
+  `bun run agent:inventory -- api.tests ui.tests ui.e2e`.
+
+A run writes baselines only when no lane has removals, and only from observations
+bound to the run's own fingerprint. The run's reported checkout fingerprint describes
+the tree before that write, so review the inventory diff as part of the feature diff.
+
+Limitation: CI does not compare observed cases with the committed inventories. See
+"CI enforcement" below.
+
+### CI enforcement
+
+CI does not enforce that the committed inventories match what a run observed.
+Verified facts:
+
+- `.github/workflows/agent-verification.yml` runs `agent:check`, `agent:check:docker`
+  and `agent:eval --deterministic`. None of these runs the API, UI or browser lanes, so
+  no JUnit report and no observation is produced there.
+- `apps-api-ci.yml` runs `bun run test` against Postgres, and the UI workflows run their
+  own test scripts. None writes JUnit or reads `tools/agent/inventories`.
+- Running the `feature` profile in CI would need the owned Docker sandbox, migrations,
+  Chromium and every suite. That is not cheap, so it was not added.
+
+What CI does enforce: `agent:check` asserts that each committed baseline parses and is
+non-empty. That catches an emptied or deleted baseline. It does not catch a removed test
+whose baseline was left stale, or a feature change merged without running feature
+verification. Closing that gap needs a CI job that runs the feature profile, or a JUnit
+comparison in the API workflow.
 
 Owned browser invocations disable retries. A retry attachment is blocked if fed
 back as evidence. Coverage/forbidden-warning gate failures are reported as failures
diff --git a/tools/agent/cli.ts b/tools/agent/cli.ts
index b3428c86..ed1bebfe 100644
--- a/tools/agent/cli.ts
+++ b/tools/agent/cli.ts
@@ -46,13 +46,18 @@ if (
           `${result.profile}: ${result.status}`,
           ...result.checks.map((check) =>
             [
-              `${check.checkId}: ${check.status} (${check.reason})`,
-              check.durationMs === undefined
-                ? ""
-                : `${(check.durationMs / 1000).toFixed(1)}s`,
+              [
+                `${check.checkId}: ${check.status} (${check.reason})`,
+                check.durationMs === undefined
+                  ? ""
+                  : `${(check.durationMs / 1000).toFixed(1)}s`,
+              ]
+                .filter(Boolean)
+                .join(" "),
+              check.remediation ?? "",
             ]
               .filter(Boolean)
-              .join(" ")
+              .join("\n")
           ),
         ].join("\n")
   );
diff --git a/tools/agent/commit-title.test.ts b/tools/agent/commit-title.test.ts
new file mode 100644
index 00000000..2ba3c308
--- /dev/null
+++ b/tools/agent/commit-title.test.ts
@@ -0,0 +1,57 @@
+import { expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const script = fileURLToPath(
+  new URL("../../scripts/ci/check-commit-title.sh", import.meta.url)
+);
+
+const check = (...args: string[]): number =>
+  spawnSync("/bin/bash", [script, ...args], { encoding: "utf8" }).status ?? -1;
+
+test("conventional titles pass", () => {
+  for (const title of [
+    "feat(api): invoices can be voided",
+    "fix: keep the session after refresh",
+    "feat(k3s)!: pin every image digest in one release commit",
+    "chore(deps): bump elysia",
+    "fixup! feat(api): invoices can be voided",
+    'Revert "feat(api): invoices can be voided"',
+  ]) {
+    expect(check(title)).toBe(0);
+  }
+});
+
+test("prose, unknown types and overlong titles fail", () => {
+  for (const title of [
+    "Homepage leads with the product demo video (#77)",
+    "feature(api): invoices",
+    "feat(API): uppercase scope",
+    "feat:missing space",
+    "",
+    `feat: ${"x".repeat(100)}`,
+  ]) {
+    expect(check(title)).toBe(1);
+  }
+});
+
+test("message files are read from their first non-comment line", () => {
+  const dir = mkdtempSync(join(tmpdir(), "commit-title-"));
+
+  try {
+    const good = join(dir, "good");
+
+    writeFileSync(good, "# comment\n\nfix(ui): label contrast\n\nBody.\n");
+    const bad = join(dir, "bad");
+
+    writeFileSync(bad, "Fix the label contrast\n");
+    expect(check("--file", good)).toBe(0);
+    expect(check("--file", bad)).toBe(1);
+    expect(check("--file", join(dir, "missing"))).toBe(2);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
diff --git a/tools/agent/inventory-cli.ts b/tools/agent/inventory-cli.ts
index b3dcc1eb..000a6671 100644
--- a/tools/agent/inventory-cli.ts
+++ b/tools/agent/inventory-cli.ts
@@ -1,6 +1,7 @@
 import { fileURLToPath } from "node:url";
 import {
   acceptInventories,
+  acknowledgeCommand,
   isInventoryLane,
   reviewInventories,
 } from "./inventory";
@@ -40,7 +41,7 @@ try {
       {
         fingerprint: review.fingerprint,
         token: review.token,
-        acceptCommand: `bun run agent:inventory -- ${lanes.join(" ")} --accept=${review.token}${review.changes.some((change) => change.removed.length > 0) ? ` --allow-removals=${review.token}` : ""}`,
+        acceptCommand: acknowledgeCommand(lanes, review),
         changes: review.changes.map((change) => ({
           lane: change.lane,
           beforeCount: change.before.length,
diff --git a/tools/agent/inventory.test.ts b/tools/agent/inventory.test.ts
new file mode 100644
index 00000000..ac5f3bab
--- /dev/null
+++ b/tools/agent/inventory.test.ts
@@ -0,0 +1,207 @@
+import { afterEach, expect, test } from "bun:test";
+import { execFileSync } from "node:child_process";
+import {
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { identifyCheckout } from "./checkout";
+import {
+  INVENTORY_REASONS,
+  inventoryEvidence,
+  readInventory,
+  reviewInventories,
+  settleInventories,
+} from "./inventory";
+import type { ICheckResult } from "./result";
+
+const dirs: string[] = [];
+const passed: ICheckResult = {
+  checkId: "api.tests",
+  status: "passed",
+  reason: "tests_passed",
+};
+
+function fixture(cases: string[]): string {
+  const dir = mkdtempSync(join(tmpdir(), "bs-inventory-evidence-"));
+
+  dirs.push(dir);
+  execFileSync("git", ["init", "-q", dir]);
+  writeFileSync(join(dir, ".gitignore"), ".agent-state/\n");
+  writeFileSync(join(dir, "README.md"), "fixture\n");
+  execFileSync("git", ["-C", dir, "add", "."]);
+  execFileSync("git", [
+    "-C",
+    dir,
+    "-c",
+    "user.name=Test",
+    "-c",
+    "user.email=test@example.com",
+    "-c",
+    "commit.gpgsign=false",
+    "commit",
+    "-qm",
+    "fixture",
+  ]);
+  mkdirSync(join(dir, "tools/agent/inventories"), { recursive: true });
+  writeFileSync(
+    join(dir, "tools/agent/inventories/api.tests.json"),
+    `${JSON.stringify({ schemaVersion: 1, cases }, null, 2)}\n`
+  );
+
+  return dir;
+}
+
+function xmlFor(names: string[]): string {
+  const cases = names
+    .map((name) => `<testcase file="a.ts" name="${name}"/>`)
+    .join("");
+
+  return `<testsuites>${cases}</testsuites>`;
+}
+
+function baseline(dir: string): string[] {
+  return readInventory(join(dir, "tools/agent/inventories/api.tests.json"))
+    .cases;
+}
+
+afterEach(() => {
+  for (const dir of dirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+const control = JSON.stringify(["a.ts", "control"]);
+const added = JSON.stringify(["a.ts", "new case"]);
+
+test("additions pass and are written to the baseline by the same run", () => {
+  const dir = fixture([control]);
+  const fingerprint = identifyCheckout(dir).fingerprint;
+  const evidence = inventoryEvidence(
+    dir,
+    "api.tests",
+    xmlFor(["control", "new case"]),
+    passed,
+    fingerprint
+  );
+
+  expect(evidence.status).toBe("passed");
+  expect(evidence.reason).toBe(INVENTORY_REASONS.additions);
+
+  const settled = settleInventories(dir, [evidence], fingerprint);
+
+  expect(settled[0]?.status).toBe("passed");
+  expect(baseline(dir)).toEqual([added, control].sort());
+
+  const rerunFingerprint = identifyCheckout(dir).fingerprint;
+  const rerun = inventoryEvidence(
+    dir,
+    "api.tests",
+    xmlFor(["control", "new case"]),
+    passed,
+    rerunFingerprint
+  );
+
+  expect(rerun).toEqual(passed);
+});
+
+test("removals stay blocked, are never written, and print one acknowledgement command", () => {
+  const dir = fixture([control, added]);
+  const fingerprint = identifyCheckout(dir).fingerprint;
+  const before = readFileSync(
+    join(dir, "tools/agent/inventories/api.tests.json"),
+    "utf8"
+  );
+  const evidence = inventoryEvidence(
+    dir,
+    "api.tests",
+    xmlFor(["control"]),
+    passed,
+    fingerprint
+  );
+
+  expect(evidence.status).toBe("blocked");
+  expect(evidence.reason).toBe(INVENTORY_REASONS.disagrees);
+
+  const [settled] = settleInventories(dir, [evidence], fingerprint);
+  const token = reviewInventories(dir, ["api.tests"]).token;
+  const command = `bun run agent:inventory -- api.tests --accept=${token} --allow-removals=${token}`;
+
+  expect(settled?.status).toBe("blocked");
+  expect(settled?.remediation).toContain(command);
+  expect(settled?.remediation).toContain("new case");
+  expect(
+    readFileSync(join(dir, "tools/agent/inventories/api.tests.json"), "utf8")
+  ).toBe(before);
+});
+
+test("zero observed cases stay blocked and are never recorded", () => {
+  const dir = fixture([control]);
+  const fingerprint = identifyCheckout(dir).fingerprint;
+  const evidence = inventoryEvidence(
+    dir,
+    "api.tests",
+    "<testsuites></testsuites>",
+    passed,
+    fingerprint
+  );
+
+  expect(evidence.status).toBe("blocked");
+  expect(evidence.reason).toBe(INVENTORY_REASONS.empty);
+  expect(settleInventories(dir, [evidence], fingerprint)[0]?.remediation).toBe(
+    undefined
+  );
+  expect(baseline(dir)).toEqual([control]);
+});
+
+test("additions in one lane are not written while another lane has removals", () => {
+  const dir = fixture([control]);
+  const fingerprint = identifyCheckout(dir).fingerprint;
+  const additions = inventoryEvidence(
+    dir,
+    "api.tests",
+    xmlFor(["control", "new case"]),
+    passed,
+    fingerprint
+  );
+  const uiRemoval: ICheckResult = {
+    checkId: "ui.tests",
+    status: "blocked",
+    reason: INVENTORY_REASONS.disagrees,
+  };
+  const settled = settleInventories(dir, [additions, uiRemoval], fingerprint);
+
+  expect(settled.find((check) => check.checkId === "api.tests")?.status).toBe(
+    "passed"
+  );
+  expect(baseline(dir)).toEqual([control]);
+});
+
+test("additions are not recorded when the observation is not bound to this checkout", () => {
+  const dir = fixture([control]);
+  const evidence = inventoryEvidence(
+    dir,
+    "api.tests",
+    xmlFor(["control", "new case"]),
+    passed,
+    "not-this-checkout"
+  );
+
+  expect(evidence.status).toBe("blocked");
+  expect(evidence.reason).toBe(INVENTORY_REASONS.disagrees);
+  expect(baseline(dir)).toEqual([control]);
+});
+
+test("committed baselines are valid, non-empty inventories", () => {
+  for (const lane of ["api.tests", "ui.tests", "ui.e2e"]) {
+    const inventory = readInventory(
+      join(import.meta.dir, "inventories", `${lane}.json`)
+    );
+
+    expect(inventory.cases.length).toBeGreaterThan(0);
+  }
+});
diff --git a/tools/agent/inventory.ts b/tools/agent/inventory.ts
index fd8d8a15..443cb512 100644
--- a/tools/agent/inventory.ts
+++ b/tools/agent/inventory.ts
@@ -11,6 +11,7 @@ import { identifyCheckout } from "./checkout";
 import {
   inventoryChange,
   inventoryReview,
+  type IInventoryChange,
   type IInventoryReview,
 } from "./inventory-review";
 import type { IInventory, InventoryLane } from "./inventory.types";
@@ -20,6 +21,14 @@ import { isRecord, isStringArray, parseRecord } from "./validation";
 export const LANES = ["api.tests", "ui.tests", "ui.e2e"] as const;
 export type Lane = InventoryLane;
 
+/** Reasons a lane check carries; the last two are settled after every lane has finished. */
+export const INVENTORY_REASONS = {
+  empty: "test_inventory_empty",
+  disagrees: "test_inventory_disagrees",
+  additions: "test_inventory_additions_recorded",
+  updateFailed: "test_inventory_update_failed",
+} as const;
+
 export function isInventoryLane(value: string): value is InventoryLane {
   const names: readonly string[] = LANES;
 
@@ -72,7 +81,7 @@ export function compareInventory(
   );
 }
 
-function readInventory(path: string): IInventory {
+export function readInventory(path: string): IInventory {
   const value = parseRecord(readFileSync(path, "utf8"));
 
   if (
@@ -92,16 +101,21 @@ function assertSafePath(path: string): void {
   }
 }
 
+function baselinePath(root: string, lane: InventoryLane): string {
+  return join(root, "tools/agent/inventories", `${lane}.json`);
+}
+
+/** Returns false when the observation is not bound to the checkout that produced it. */
 function recordObservation(
   root: string,
   lane: InventoryLane,
   cases: string[],
   expectedFingerprint?: string
-): void {
+): boolean {
   const checkout = identifyCheckout(root);
 
   if (expectedFingerprint !== checkout.fingerprint) {
-    return;
+    return false;
   }
 
   const directory = join(root, ".agent-state/observed-tests");
@@ -113,8 +127,15 @@ function recordObservation(
   writeFileSync(path, JSON.stringify({ schemaVersion: 1, checkout, cases }), {
     mode: 0o600,
   });
+
+  return true;
 }
 
+/**
+ * Classifies one lane's observed cases against its committed baseline.
+ * Additions alone pass and are written by settleInventories once the run is stable.
+ * Removals and empty observations block; removals are never recorded automatically.
+ */
 export function inventoryEvidence(
   root: string,
   lane: InventoryLane,
@@ -123,27 +144,42 @@ export function inventoryEvidence(
   expectedFingerprint?: string
 ): ICheckResult {
   const actual = identities(xml, root);
-
-  if (evidence.status === "passed") {
+  const recorded =
+    evidence.status === "passed" &&
     recordObservation(root, lane, actual, expectedFingerprint);
-  }
 
   if (evidence.status === "blocked") {
     return evidence;
   }
 
+  if (actual.length === 0) {
+    return { ...evidence, status: "blocked", reason: INVENTORY_REASONS.empty };
+  }
+
   try {
-    const path = join(root, "tools/agent/inventories", `${lane}.json`);
-    const expected = readInventory(path);
+    const expected = readInventory(baselinePath(root, lane));
 
     if (compareInventory(expected.cases, actual)) {
       return evidence;
     }
+
+    const change = inventoryChange(lane, expected.cases, actual);
+
+    if (recorded && change.removed.length === 0) {
+      return {
+        ...evidence,
+        reason: INVENTORY_REASONS.additions,
+      };
+    }
   } catch {
     // Missing or malformed expectations cannot establish complete execution.
   }
 
-  return { ...evidence, status: "blocked", reason: "test_inventory_disagrees" };
+  return {
+    ...evidence,
+    status: "blocked",
+    reason: INVENTORY_REASONS.disagrees,
+  };
 }
 
 function readFreshObservation(
@@ -215,20 +251,139 @@ export function acceptInventories(
     throw new Error("Test removals require --allow-removals=<review token>");
   }
 
+  writeBaselines(root, review.changes);
+}
+
+/** The exact command an operator runs to acknowledge a reviewed diff. */
+export function acknowledgeCommand(
+  lanes: readonly InventoryLane[],
+  review: IInventoryReview
+): string {
+  const removals = review.changes.some((change) => change.removed.length > 0);
+
+  return `bun run agent:inventory -- ${lanes.join(" ")} --accept=${review.token}${removals ? ` --allow-removals=${review.token}` : ""}`;
+}
+
+function writeBaselines(
+  root: string,
+  changes: readonly IInventoryChange[]
+): void {
   const directory = join(root, "tools/agent/inventories");
 
   assertSafePath(directory);
 
-  for (const lane of lanes) {
-    assertSafePath(join(directory, `${lane}.json`));
+  for (const change of changes) {
+    assertSafePath(baselinePath(root, change.lane));
   }
 
   mkdirSync(directory, { recursive: true });
 
-  for (const change of review.changes) {
+  for (const change of changes) {
     writeFileSync(
-      join(directory, `${change.lane}.json`),
+      baselinePath(root, change.lane),
       `${JSON.stringify({ schemaVersion: 1, cases: change.after }, null, 2)}\n`
     );
   }
 }
+
+/** Writes additions-only baselines from observations bound to the run's fingerprint. */
+function recordAdditions(
+  root: string,
+  lanes: readonly InventoryLane[],
+  fingerprint: string
+): void {
+  const changes = lanes.map((lane) => {
+    const observation = readFreshObservation(root, lane, fingerprint);
+    const change = inventoryChange(
+      lane,
+      readInventory(baselinePath(root, lane)).cases,
+      observation.cases
+    );
+
+    if (change.removed.length > 0 || change.added.length === 0) {
+      throw new Error("Only additions can be recorded automatically");
+    }
+
+    return change;
+  });
+
+  writeBaselines(root, changes);
+}
+
+/** Lists removed cases and the single acknowledgement command for blocked lanes. */
+function explainRemovals(
+  root: string,
+  checks: readonly ICheckResult[],
+  lanes: readonly InventoryLane[]
+): ICheckResult[] {
+  let review: IInventoryReview;
+
+  try {
+    review = reviewInventories(root, lanes);
+  } catch {
+    return [...checks];
+  }
+
+  const removed = review.changes.flatMap((change) =>
+    change.removed.map((identity) => `${change.lane} removed: ${identity}`)
+  );
+  const remediation = [
+    ...removed,
+    `Acknowledge the reviewed diff with: ${acknowledgeCommand(lanes, review)}`,
+    "Then rerun verification.",
+  ].join("\n");
+
+  return checks.map((check): ICheckResult =>
+    isInventoryLane(check.checkId) &&
+    lanes.includes(check.checkId) &&
+    check.reason === INVENTORY_REASONS.disagrees
+      ? { ...check, remediation }
+      : check
+  );
+}
+
+/**
+ * Runs after every lane has finished and the checkout is confirmed unchanged.
+ * Any removal blocks recording and prints one acknowledgement command; otherwise
+ * additions-only lanes are written to their baselines so the change rides along
+ * in the same commit as the tests.
+ */
+export function settleInventories(
+  root: string,
+  checks: readonly ICheckResult[],
+  fingerprint: string
+): ICheckResult[] {
+  const laneIds = (reason: string): InventoryLane[] =>
+    checks.flatMap((check) =>
+      isInventoryLane(check.checkId) && check.reason === reason
+        ? [check.checkId]
+        : []
+    );
+  const disagreeing = laneIds(INVENTORY_REASONS.disagrees);
+
+  if (disagreeing.length > 0) {
+    return explainRemovals(root, checks, disagreeing);
+  }
+
+  const additions = laneIds(INVENTORY_REASONS.additions);
+
+  if (additions.length === 0) {
+    return [...checks];
+  }
+
+  try {
+    recordAdditions(root, additions, fingerprint);
+
+    return [...checks];
+  } catch {
+    return checks.map((check): ICheckResult =>
+      isInventoryLane(check.checkId) && additions.includes(check.checkId)
+        ? {
+            ...check,
+            status: "blocked",
+            reason: INVENTORY_REASONS.updateFailed,
+          }
+        : check
+    );
+  }
+}
diff --git a/tools/agent/profiles.ts b/tools/agent/profiles.ts
index e7e826a6..652ab956 100644
--- a/tools/agent/profiles.ts
+++ b/tools/agent/profiles.ts
@@ -5,6 +5,7 @@ import { now } from "../../apps/api/src/lib/time/now";
 import { identifyCheckout } from "./checkout";
 import { RELEASE_CHECKS, STATIC_CHECKS, type Profile } from "./checks";
 import { openApiUrl } from "./environment";
+import { settleInventories } from "./inventory";
 import { orderChecks } from "./lanes";
 import { executionBudget } from "./scheduling";
 import { runTasks } from "./scheduler";
@@ -132,6 +133,12 @@ export async function runProfile(
         status: "passed",
         reason: "checkout_unchanged",
       });
+      // Writes happen only after the stability check, so the run's fingerprint still describes what was tested.
+      result.checks = settleInventories(
+        root,
+        result.checks,
+        result.checkout.fingerprint
+      );
     }
 
     if (isAborted(signal)) {
diff --git a/tools/agent/result.ts b/tools/agent/result.ts
index 714282fb..66e03978 100644
--- a/tools/agent/result.ts
+++ b/tools/agent/result.ts
@@ -12,6 +12,8 @@ export interface ICheckResult {
   cases?: { passed: number; failed: number; skipped: number };
   status: Status;
   reason: string;
+  /** Operator guidance for a blocked check, such as the acknowledgement command. */
+  remediation?: string;
 }
 
 export interface IVerificationResult {
diff --git a/tools/agent/tasks/account-resource.json b/tools/agent/tasks/account-resource.json
index ff023ea0..96c8c98d 100644
--- a/tools/agent/tasks/account-resource.json
+++ b/tools/agent/tasks/account-resource.json
@@ -64,7 +64,7 @@
     "Use the existing UI component/feature conventions. Scope every query key by accountId; capture accountId in mutations and invalidate that exact account's queries.",
     "Render loading, empty, error and permission-denied states. Translate visible labels into both locales. Do not put service authorization exclusively in the UI.",
     "Verify owner/admin mutations, member/viewer read access, revoked membership, cross-account reads and writes, forged ownership, and account-switch cache isolation.",
-    "Run feature verification. If intentional test additions change the inventory, preview agent:inventory for the affected lanes, review its case diff, apply --accept=<token> (plus --allow-removals=<token> for intentional removals), and rerun verification. Run release-local before claiming full local readiness. Report blockers and GitHub-only checks separately."
+    "Run feature verification. It records intentional test additions in tools/agent/inventories automatically; include that inventory diff in the change. If it reports removed cases, run the single agent:inventory --accept=<token> --allow-removals=<token> command it prints after reviewing the listed removals, then rerun verification. Run release-local before claiming full local readiness. Report blockers and GitHub-only checks separately."
   ],
   "verificationProfile": "feature",
   "limitations": [