From ace62632c9b09dc56d2ecab640e10b9e9faf23ad Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 18:38:17 +0530
Subject: [PATCH 01/43] feat(dashboard): update file picker dialog

---
 .../src/components/file-picker-dialog.tsx     | 187 ++++--------------
 1 file changed, 39 insertions(+), 148 deletions(-)

diff --git a/apps/dashboard/src/components/file-picker-dialog.tsx b/apps/dashboard/src/components/file-picker-dialog.tsx
index 0c02b48e..0a907893 100644
--- a/apps/dashboard/src/components/file-picker-dialog.tsx
+++ b/apps/dashboard/src/components/file-picker-dialog.tsx
@@ -5,22 +5,12 @@ import {
   ImagePlus,
   Music,
   Search,
-  Trash2,
   Upload,
   Video,
 } from "lucide-react";
 import { useCallback, useMemo, useRef, useState } from "react";
 import { toast } from "sonner";
-import {
-  AlertDialog,
-  AlertDialogAction,
-  AlertDialogCancel,
-  AlertDialogContent,
-  AlertDialogDescription,
-  AlertDialogFooter,
-  AlertDialogHeader,
-  AlertDialogTitle,
-} from "@/components/ui/alert-dialog";
+
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import {
@@ -32,13 +22,11 @@ import {
   DialogTitle,
 } from "@/components/ui/dialog";
 import { Input } from "@/components/ui/input";
+import { ScrollArea } from "@/components/ui/scroll-area";
 import { Skeleton } from "@/components/ui/skeleton";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import {
-  deleteFile,
   type FileItem,
-  type FileReference,
-  getFileReferences,
   getFiles,
   uploadFile,
 } from "@/lib/api";
@@ -139,16 +127,13 @@ export function FilePickerDialog({
   const [page, setPage] = useState(1);
   const [tab, setTab] = useState("library");
   const [dragOver, setDragOver] = useState(false);
-  const [pendingDelete, setPendingDelete] = useState<{
-    file: FileItem;
-    refs: FileReference[];
-  } | null>(null);
 
   const fileInputRef = useRef<HTMLInputElement>(null);
   const queryClient = useQueryClient();
 
   // Derived values – memoised so they don't recalculate on every render.
   const fileType = useMemo(() => deriveFileType(accept), [accept]);
+  const skeletonKeys = useMemo(() => Array.from({ length: 8 }, (_, i) => i), []);
 
   const { data, isLoading, isError } = useQuery({
     queryKey: ["files", siteId, page, search, fileType],
@@ -194,16 +179,6 @@ export function FilePickerDialog({
     onError: (err: Error) => toast.error(err.message),
   });
 
-  const deleteMutation = useMutation({
-    mutationFn: (fileId: string) => deleteFile(siteId, fileId),
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ["files", siteId] });
-      toast.success("File deleted");
-      setPendingDelete(null);
-    },
-    onError: (err: Error) => toast.error(err.message),
-  });
-
   // ---------------------------------------------------------------------------
   // Handlers
   // ---------------------------------------------------------------------------
@@ -226,33 +201,6 @@ export function FilePickerDialog({
     [handleFileSelect],
   );
 
-  const handleDelete = useCallback(
-    async (file: FileItem) => {
-      let refs: FileReference[] = [];
-      try {
-        refs = await getFileReferences(siteId, file.id);
-      } catch {
-        // Treat a failed reference lookup the same as "no references" so the
-        // user can still delete the file, but warn them just in case.
-        toast.warning(
-          "Could not check file references. Proceeding with delete.",
-        );
-      }
-
-      if (refs.length > 0) {
-        setPendingDelete({ file, refs });
-      } else {
-        deleteMutation.mutate(file.id);
-      }
-    },
-    [siteId, deleteMutation],
-  );
-
-  const confirmDelete = useCallback(() => {
-    if (!pendingDelete) return;
-    deleteMutation.mutate(pendingDelete.file.id);
-  }, [pendingDelete, deleteMutation]);
-
   const handleSearchChange = useCallback(
     (e: React.ChangeEvent<HTMLInputElement>) => {
       setSearch(e.target.value);
@@ -293,14 +241,9 @@ export function FilePickerDialog({
       <Upload data-icon="inline-start" />
     );
 
-  const pendingCollections = pendingDelete
-    ? [...new Set(pendingDelete.refs.map((r) => r.collection_name))].join(", ")
-    : "";
-
   return (
-    <>
-      <Dialog open={open} onOpenChange={handleOpenChange}>
-        <DialogContent className="flex max-h-[80vh] flex-col sm:max-w-3xl">
+    <Dialog open={open} onOpenChange={handleOpenChange}>
+        <DialogContent className="flex h-[80vh] flex-col overflow-hidden sm:max-w-3xl">
           <DialogHeader>
             <DialogTitle>File Library</DialogTitle>
             <DialogDescription>
@@ -311,7 +254,7 @@ export function FilePickerDialog({
           <Tabs
             value={tab}
             onValueChange={setTab}
-            className="flex flex-1 flex-col overflow-hidden"
+            className="flex min-h-0 flex-1 flex-col overflow-hidden"
           >
             <TabsList>
               <TabsTrigger value="library">Library</TabsTrigger>
@@ -323,7 +266,7 @@ export function FilePickerDialog({
             ---------------------------------------------------------------- */}
             <TabsContent
               value="library"
-              className="flex flex-1 flex-col gap-3 overflow-hidden"
+              className="flex min-h-0 flex-1 flex-col gap-3 overflow-hidden"
             >
               <div className="relative">
                 <Search className="absolute left-2.5 top-2.5 size-4 text-muted-foreground" />
@@ -337,8 +280,8 @@ export function FilePickerDialog({
 
               {isLoading ? (
                 <div className="grid grid-cols-3 gap-3 sm:grid-cols-4">
-                  {Array.from({ length: 8 }, (_, i) => (
-                    <Skeleton key={i} className="aspect-square rounded-lg" />
+                  {skeletonKeys.map((k) => (
+                    <Skeleton key={k} className="aspect-square rounded-lg" />
                   ))}
                 </div>
               ) : isError ? (
@@ -350,19 +293,20 @@ export function FilePickerDialog({
                   No files found.
                 </div>
               ) : (
-                <div className="grid grid-cols-3 gap-3 overflow-y-auto sm:grid-cols-4">
-                  {filteredItems.map((file) => (
-                    <FileGridItem
-                      key={file.id}
-                      file={file}
-                      onSelect={() => {
-                        onSelect(file);
-                        handleOpenChange(false);
-                      }}
-                      onDelete={() => handleDelete(file)}
-                    />
-                  ))}
-                </div>
+                <ScrollArea className="min-h-0 flex-1">
+                  <div className="grid grid-cols-3 gap-3 pr-3 sm:grid-cols-4">
+                    {filteredItems.map((file) => (
+                      <FileGridItem
+                        key={file.id}
+                        file={file}
+                        onSelect={() => {
+                          onSelect(file);
+                          handleOpenChange(false);
+                        }}
+                      />
+                    ))}
+                  </div>
+                </ScrollArea>
               )}
 
               {data && data.total > data.per_page && (
@@ -397,11 +341,14 @@ export function FilePickerDialog({
                 <input> receives clicks without needing an imperative ref call,
                 and biome's a11y/noStaticElementInteractions lint is satisfied.
             ---------------------------------------------------------------- */}
-            <TabsContent value="upload" className="flex-1">
+            <TabsContent
+              value="upload"
+              className="flex min-h-0 flex-1 flex-col"
+            >
               <label
                 htmlFor="file-picker-input"
                 className={[
-                  "flex flex-col items-center justify-center gap-4 rounded-lg border-2 border-dashed p-12 transition-colors cursor-pointer",
+                  "flex flex-1 flex-col items-center justify-center gap-4 rounded-lg border-2 border-dashed p-12 transition-colors cursor-pointer",
                   dragOver
                     ? "border-primary bg-primary/5"
                     : "border-muted-foreground/25 hover:border-muted-foreground/50",
@@ -457,43 +404,7 @@ export function FilePickerDialog({
             </Button>
           </DialogFooter>
         </DialogContent>
-      </Dialog>
-
-      {/* -----------------------------------------------------------------------
-          Delete-with-references confirmation dialog
-      ----------------------------------------------------------------------- */}
-      <AlertDialog
-        open={!!pendingDelete}
-        onOpenChange={(isOpen) => {
-          if (!isOpen) setPendingDelete(null);
-        }}
-      >
-        <AlertDialogContent>
-          <AlertDialogHeader>
-            <AlertDialogTitle>Delete file?</AlertDialogTitle>
-            <AlertDialogDescription>
-              This file is used in <strong>{pendingDelete?.refs.length}</strong>{" "}
-              content item
-              {pendingDelete?.refs.length === 1 ? "" : "s"}
-              {pendingCollections ? ` (${pendingCollections})` : ""}. Deleting
-              it may break those pages.
-            </AlertDialogDescription>
-          </AlertDialogHeader>
-          <AlertDialogFooter>
-            <AlertDialogCancel disabled={deleteMutation.isPending}>
-              Cancel
-            </AlertDialogCancel>
-            <AlertDialogAction
-              variant="destructive"
-              onClick={confirmDelete}
-              disabled={deleteMutation.isPending}
-            >
-              {deleteMutation.isPending ? "Deleting…" : "Delete"}
-            </AlertDialogAction>
-          </AlertDialogFooter>
-        </AlertDialogContent>
-      </AlertDialog>
-    </>
+    </Dialog>
   );
 }
 
@@ -504,27 +415,23 @@ export function FilePickerDialog({
 interface FileGridItemProps {
   file: FileItem;
   onSelect: () => void;
-  onDelete: () => void;
 }
 
-function FileGridItem({ file, onSelect, onDelete }: FileGridItemProps) {
+function FileGridItem({ file, onSelect }: FileGridItemProps) {
   const isImage = file.mime_type.startsWith("image/");
   const isVideo = file.mime_type.startsWith("video/");
   const hasPreview = isImage || (isVideo && !!file.thumbnail_url);
 
   return (
-    <div
-      role="button"
-      tabIndex={0}
-      className="group relative aspect-square cursor-pointer overflow-hidden rounded-lg border text-left transition-shadow hover:shadow-md focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2"
-      onClick={onSelect}
-      onKeyDown={(e) => {
-        if (e.key === "Enter" || e.key === " ") {
-          e.preventDefault();
-          onSelect();
-        }
-      }}
-    >
+    <div className="group relative aspect-square overflow-hidden rounded-lg border text-left transition-shadow hover:shadow-md">
+      {/* Overlay button captures card clicks */}
+      <button
+        type="button"
+        aria-label={`Select ${file.original_name}`}
+        className="absolute inset-0 z-10 cursor-pointer focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2"
+        onClick={onSelect}
+      />
+
       {hasPreview ? (
         <img
           src={file.thumbnail_url ?? file.url}
@@ -543,22 +450,6 @@ function FileGridItem({ file, onSelect, onDelete }: FileGridItemProps) {
         </div>
       )}
 
-      {/* Delete button — only visible on hover/focus-within */}
-      <div className="absolute right-1 top-1 opacity-0 transition-opacity group-hover:opacity-100 group-focus-within:opacity-100">
-        <Button
-          variant="ghost"
-          size="icon-sm"
-          aria-label={`Delete ${file.original_name}`}
-          className="bg-black/40 text-white hover:bg-black/60 hover:text-white"
-          onClick={(e) => {
-            e.stopPropagation();
-            onDelete();
-          }}
-        >
-          <Trash2 />
-        </Button>
-      </div>
-
       {/* Filename / size overlay */}
       <div className="absolute bottom-0 left-0 right-0 bg-linear-to-t from-black/60 to-transparent p-1.5">
         <p className="truncate text-xs text-white">{file.original_name}</p>

From 813e31798b32ab1bfdee2bfa021d89d310da88ef Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 18:38:47 +0530
Subject: [PATCH 02/43] chore(dashboard): fix lint issues

---
 .../src/components/app-breadcrumb.tsx         | 16 +++++----
 .../components/backups/backups-section.tsx    | 34 +++++++++----------
 .../dashboard/src/components/dynamic-form.tsx | 26 +++++++++-----
 .../src/components/revisions-panel.tsx        |  5 +--
 .../src/components/sidebar/app-sidebar.tsx    |  2 +-
 .../src/components/sidebar/site-switcher.tsx  |  2 +-
 .../site-settings/user-combobox.tsx           |  1 -
 apps/dashboard/src/lib/api.ts                 |  4 +--
 apps/dashboard/src/routes/_admin.tsx          |  2 +-
 .../_admin/sites.$siteId/collections.tsx      |  2 +-
 10 files changed, 51 insertions(+), 43 deletions(-)

diff --git a/apps/dashboard/src/components/app-breadcrumb.tsx b/apps/dashboard/src/components/app-breadcrumb.tsx
index 2ad8821c..6f1165d6 100644
--- a/apps/dashboard/src/components/app-breadcrumb.tsx
+++ b/apps/dashboard/src/components/app-breadcrumb.tsx
@@ -70,7 +70,7 @@ function useSiteName(siteId: string | undefined) {
 
   const { data: site } = useQuery({
     queryKey: ["site", siteId],
-    queryFn: () => getSite(siteId!),
+    queryFn: () => getSite(siteId as string),
     enabled: !!siteId && !siteFromList,
   });
 
@@ -80,7 +80,7 @@ function useSiteName(siteId: string | undefined) {
 function useCollectionName(siteId: string | undefined, collectionSlug: string | undefined) {
   const { data: collections } = useQuery({
     queryKey: ["collections", siteId],
-    queryFn: () => getCollections(siteId!),
+    queryFn: () => getCollections(siteId as string),
     enabled: !!siteId && !!collectionSlug,
   });
 
@@ -90,7 +90,7 @@ function useCollectionName(siteId: string | undefined, collectionSlug: string |
 function useSingletonName(siteId: string | undefined, slug: string | undefined) {
   const { data: collections } = useQuery({
     queryKey: ["collections", siteId],
-    queryFn: () => getCollections(siteId!),
+    queryFn: () => getCollections(siteId as string),
     enabled: !!siteId && !!slug,
   });
 
@@ -100,7 +100,7 @@ function useSingletonName(siteId: string | undefined, slug: string | undefined)
 function useEntrySlugLabel(siteId: string | undefined, entryId: string | undefined) {
   const { data: entry } = useQuery({
     queryKey: ["entry", siteId, entryId],
-    queryFn: () => getEntryById(siteId!, entryId!),
+    queryFn: () => getEntryById(siteId as string, entryId as string),
     enabled: !!siteId && !!entryId,
   });
 
@@ -125,6 +125,8 @@ function useBreadcrumbLabels(defs: BreadcrumbDef[], params: Record<string, strin
         return singletonName ?? null;
       case "entrySlug":
         return entrySlug ?? null;
+      default:
+        return null;
     }
   });
 }
@@ -186,8 +188,8 @@ export function AppBreadcrumb() {
     return (
       <Breadcrumb>
         <BreadcrumbList>
-          {config.crumbs.map((_, i) => (
-            <Fragment key={i}>
+          {config.crumbs.map((def, i) => (
+            <Fragment key={`crumb-${"label" in def ? def.label : def.labelFrom}`}>
               {i > 0 && <BreadcrumbSeparator />}
               <BreadcrumbItem>
                 <Skeleton className="h-4 w-20" />
@@ -207,7 +209,7 @@ export function AppBreadcrumb() {
           const href = buildHref(routeId, params, i);
 
           return (
-            <Fragment key={i}>
+            <Fragment key={label}>
               {i > 0 && <BreadcrumbSeparator />}
               <BreadcrumbItem>
                 {isLast ? (
diff --git a/apps/dashboard/src/components/backups/backups-section.tsx b/apps/dashboard/src/components/backups/backups-section.tsx
index f5cdd38a..c6a20d81 100644
--- a/apps/dashboard/src/components/backups/backups-section.tsx
+++ b/apps/dashboard/src/components/backups/backups-section.tsx
@@ -253,17 +253,17 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
         <CardContent className="flex flex-col gap-4">
           <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
             <div className="flex flex-wrap items-center gap-4">
-              <label className="flex items-center gap-2 text-sm">
+              <span className="flex items-center gap-2 text-sm">
                 <Checkbox
                   checked={includeFiles}
                   onCheckedChange={(v) => setIncludeFiles(Boolean(v))}
                 />
                 Include uploaded files
-              </label>
-              <label className="flex items-center gap-2 text-sm">
+              </span>
+              <span className="flex items-center gap-2 text-sm">
                 <Checkbox checked={encrypt} onCheckedChange={(v) => setEncrypt(Boolean(v))} />
                 Encrypt
-              </label>
+              </span>
             </div>
             <div className="flex gap-2">
               <label>
@@ -328,10 +328,8 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
                                 variant="ghost"
                                 size="icon"
                                 title="Download"
-                                render={<a href={backupDownloadUrl(scope, b.id)} />}
-                              >
-                                <Download className="size-4" />
-                              </Button>
+                                render={<a href={backupDownloadUrl(scope, b.id)}><Download className="size-4" /></a>}
+                              />
                               <Button
                                 variant="ghost"
                                 size="icon"
@@ -448,10 +446,10 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
             )}
 
             {((isInstance && restoreMode === "site") || !isInstance) && (
-              <label className="flex items-center gap-2 text-sm">
+              <span className="flex items-center gap-2 text-sm">
                 <Checkbox checked={importAsNew} onCheckedChange={(v) => setImportAsNew(Boolean(v))} />
                 Import as a new site (keep the existing one)
-              </label>
+              </span>
             )}
 
             <div className="flex flex-col gap-2">
@@ -503,14 +501,14 @@ function SitePicker({
   const allSelected = selected.length === sites.length;
   return (
     <div className="rounded-md border">
-      <label className="flex items-center gap-2 border-b px-3 py-2 text-sm font-medium">
+      <span className="flex items-center gap-2 border-b px-3 py-2 text-sm font-medium">
         <Checkbox checked={allSelected} onCheckedChange={(v) => onToggleAll(Boolean(v))} />
         Select all ({selected.length}/{sites.length})
-      </label>
+      </span>
       <ScrollArea className="max-h-48">
         <div className="flex flex-col">
           {sites.map((s) => (
-            <label
+            <div
               key={s.id}
               className="flex items-center gap-2 px-3 py-2 text-sm hover:bg-muted/50"
             >
@@ -519,7 +517,7 @@ function SitePicker({
                 <span className="font-medium">{s.name ?? "(unnamed site)"}</span>
                 <span className="font-mono text-xs text-muted-foreground">{s.id}</span>
               </span>
-            </label>
+            </div>
           ))}
         </div>
       </ScrollArea>
@@ -608,14 +606,14 @@ function SchedulesCard({ schedules, loading, onCreate, onToggle, onRun, onDelete
             />
           </div>
           <div className="flex flex-col gap-2 sm:col-span-2 lg:col-span-1 lg:flex-row lg:items-center lg:gap-4 lg:pb-2">
-            <label className="flex items-center gap-2 text-sm">
+            <span className="flex items-center gap-2 text-sm">
               <Checkbox checked={includeFiles} onCheckedChange={(v) => setIncludeFiles(Boolean(v))} />
               Files
-            </label>
-            <label className="flex items-center gap-2 text-sm">
+            </span>
+            <span className="flex items-center gap-2 text-sm">
               <Checkbox checked={encrypt} onCheckedChange={(v) => setEncrypt(Boolean(v))} />
               Encrypt
-            </label>
+            </span>
           </div>
           <Button onClick={submit} disabled={submitting}>
             <Plus className="size-4" /> Add schedule
diff --git a/apps/dashboard/src/components/dynamic-form.tsx b/apps/dashboard/src/components/dynamic-form.tsx
index a47da9ec..86e1563d 100644
--- a/apps/dashboard/src/components/dynamic-form.tsx
+++ b/apps/dashboard/src/components/dynamic-form.tsx
@@ -1,5 +1,7 @@
 import { Archive, FileText, Music } from "lucide-react";
-import React, {
+import type { AnyFieldApi } from "@tanstack/react-form";
+import type React from "react";
+import {
   Component,
   memo,
   useCallback,
@@ -228,6 +230,7 @@ export const DynamicForm = memo(function DynamicForm({
 
 interface DynamicFieldProps {
   field: ContentField;
+  // biome-ignore lint/suspicious/noExplicitAny: TanStack Form instance with complex generics
   form: any;
   prefix: string;
   siteId?: string;
@@ -247,7 +250,7 @@ const DynamicField = memo(function DynamicField({
 
   return (
     <form.Field name={fieldName}>
-      {(f: any) => {
+      {(f: AnyFieldApi) => {
         const isInvalid = f.state.meta.isTouched && !f.state.meta.isValid;
         return (
           <Field data-invalid={isInvalid || undefined}>
@@ -337,13 +340,16 @@ const FieldInput = memo(function FieldInput({
     onBlur,
   } as const;
 
+  const stableStringChange = useStableHandler(onChange, extractString);
+  const stableNumberChange = useStableHandler(onChange, extractNumber);
+
   switch (field.type) {
     case "text":
       return (
         <Input
           {...inputBaseProps}
           value={strValue}
-          onChange={useStableHandler(onChange, extractString)}
+          onChange={stableStringChange}
         />
       );
 
@@ -353,7 +359,7 @@ const FieldInput = memo(function FieldInput({
           {...inputBaseProps}
           value={strValue}
           rows={4}
-          onChange={useStableHandler(onChange, extractString)}
+          onChange={stableStringChange}
         />
       );
 
@@ -374,7 +380,7 @@ const FieldInput = memo(function FieldInput({
           {...inputBaseProps}
           type="number"
           value={numValue}
-          onChange={useStableHandler(onChange, extractNumber)}
+          onChange={stableNumberChange}
         />
       );
 
@@ -402,7 +408,7 @@ const FieldInput = memo(function FieldInput({
           {...inputBaseProps}
           type="date"
           value={strValue}
-          onChange={useStableHandler(onChange, extractString)}
+          onChange={stableStringChange}
         />
       );
 
@@ -441,7 +447,7 @@ const FieldInput = memo(function FieldInput({
             {...inputBaseProps}
             placeholder="https://…"
             value={strValue}
-            onChange={useStableHandler(onChange, extractString)}
+            onChange={stableStringChange}
           />
           {strValue && (
             <img
@@ -478,7 +484,7 @@ const FieldInput = memo(function FieldInput({
         <Input
           {...inputBaseProps}
           value={strValue}
-          onChange={useStableHandler(onChange, extractString)}
+          onChange={stableStringChange}
         />
       );
   }
@@ -711,7 +717,9 @@ const FilePreview = memo(function FilePreview({
         />
       )}
       {isAudio && value && (
-        <audio controls src={value} className="w-full" />
+        <audio controls src={value} className="w-full">
+          <track kind="captions" />
+        </audio>
       )}
     </div>
   );
diff --git a/apps/dashboard/src/components/revisions-panel.tsx b/apps/dashboard/src/components/revisions-panel.tsx
index 0a657044..e499cefa 100644
--- a/apps/dashboard/src/components/revisions-panel.tsx
+++ b/apps/dashboard/src/components/revisions-panel.tsx
@@ -390,10 +390,11 @@ export function RevisionsPanel({
 // ---------------------------------------------------------------------------
 
 function RevisionListSkeleton() {
+  const keys = useMemo(() => Array.from({ length: 5 }, (_, i) => i), []);
   return (
     <div className="flex flex-col gap-px py-1">
-      {Array.from({ length: 5 }, (_, i) => (
-        <div key={i} className="px-5 py-4">
+      {keys.map((k) => (
+        <div key={k} className="px-5 py-4">
           <div className="flex items-center justify-between">
             <div className="flex items-center gap-2">
               <Skeleton className="h-5 w-14 rounded-md" />
diff --git a/apps/dashboard/src/components/sidebar/app-sidebar.tsx b/apps/dashboard/src/components/sidebar/app-sidebar.tsx
index 28494993..907916d4 100644
--- a/apps/dashboard/src/components/sidebar/app-sidebar.tsx
+++ b/apps/dashboard/src/components/sidebar/app-sidebar.tsx
@@ -30,7 +30,7 @@ import { useAuth } from "@/contexts/auth-context";
 import { getCollections, getSites, siteRoleLabel } from "@/lib/api";
 
 export function AppSidebar({ ...props }: ComponentProps<typeof Sidebar>) {
-  const { siteId } = useParams({ from: "/_admin/sites/$siteId" as any });
+  const { siteId } = useParams({ from: "/_admin/sites/$siteId" });
   const auth = useAuth();
   const pathname = useRouterState({ select: (s) => s.location.pathname });
 
diff --git a/apps/dashboard/src/components/sidebar/site-switcher.tsx b/apps/dashboard/src/components/sidebar/site-switcher.tsx
index 2a2743cb..df252a40 100644
--- a/apps/dashboard/src/components/sidebar/site-switcher.tsx
+++ b/apps/dashboard/src/components/sidebar/site-switcher.tsx
@@ -37,7 +37,7 @@ export function SiteSwitcher({
 }) {
   const { isMobile } = useSidebar();
   const navigate = useNavigate();
-  const { siteId } = useParams({ from: "/_admin/sites/$siteId" as any });
+  const { siteId } = useParams({ from: "/_admin/sites/$siteId" });
   const [sidebarHovered, setSidebarHovered] = useState(false);
   const [hoveredSiteId, setHoveredSiteId] = useState<string | null>(null);
 
diff --git a/apps/dashboard/src/components/site-settings/user-combobox.tsx b/apps/dashboard/src/components/site-settings/user-combobox.tsx
index 04680552..4e3f44d8 100644
--- a/apps/dashboard/src/components/site-settings/user-combobox.tsx
+++ b/apps/dashboard/src/components/site-settings/user-combobox.tsx
@@ -44,7 +44,6 @@ export function UserCombobox({
         render={
           <Button
             variant="outline"
-            // biome-ignore lint/a11y/useSemanticElements: combobox trigger pattern
             role="combobox"
             aria-expanded={open}
             className="w-full justify-between font-normal"
diff --git a/apps/dashboard/src/lib/api.ts b/apps/dashboard/src/lib/api.ts
index 484957cc..3ace12d3 100644
--- a/apps/dashboard/src/lib/api.ts
+++ b/apps/dashboard/src/lib/api.ts
@@ -3,9 +3,9 @@ const AUTH_URL = "/api/auth";
 
 export class ApiError extends Error {
   status: number;
-  body?: any;
+  body?: Record<string, unknown>;
 
-  constructor(status: number, message?: string, body?: any) {
+  constructor(status: number, message?: string, body?: Record<string, unknown>) {
     super(message);
     this.status = status;
     this.body = body;
diff --git a/apps/dashboard/src/routes/_admin.tsx b/apps/dashboard/src/routes/_admin.tsx
index 8a9631fd..4c02ad61 100644
--- a/apps/dashboard/src/routes/_admin.tsx
+++ b/apps/dashboard/src/routes/_admin.tsx
@@ -11,7 +11,7 @@ export const Route = createFileRoute("/_admin")({
       if (user.must_change_password && location.pathname !== "/account") {
         throw redirect({ to: "/account" });
       }
-    } catch (err: any) {
+    } catch (err: unknown) {
       // Only redirect on auth failure
       if (err instanceof ApiError && err.status === 401) {
         throw redirect({ to: "/login" });
diff --git a/apps/dashboard/src/routes/_admin/sites.$siteId/collections.tsx b/apps/dashboard/src/routes/_admin/sites.$siteId/collections.tsx
index 3f08f8ba..feed21bb 100644
--- a/apps/dashboard/src/routes/_admin/sites.$siteId/collections.tsx
+++ b/apps/dashboard/src/routes/_admin/sites.$siteId/collections.tsx
@@ -480,7 +480,7 @@ function SortableFieldItem({
             <div className="flex flex-wrap gap-1">
               {(field.options ?? []).map((opt, optIdx) => (
                 <span
-                  key={optIdx}
+                  key={opt}
                   className="inline-flex items-center gap-1 rounded-md border border-border bg-background px-2 py-0.5 text-xs"
                 >
                   {opt}

From 5e537db58f42afa883aa5132b2948ed82f42a5db Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:23:40 +0530
Subject: [PATCH 03/43] chore: add rustfmt and clippy to rust-toolchain.toml

---
 rust-toolchain.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 4683c9e4..082d5904 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,2 +1,3 @@
 [toolchain]
 channel = "1.94"
+components = ["rustfmt", "clippy"]

From 86e078abe3ec4daf30a3717b30632ca9645ea3fa Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:23:45 +0530
Subject: [PATCH 04/43] chore: set publish = false in Cargo.toml

---
 apps/backend/Cargo.toml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/apps/backend/Cargo.toml b/apps/backend/Cargo.toml
index 49c8dff9..55c39b82 100644
--- a/apps/backend/Cargo.toml
+++ b/apps/backend/Cargo.toml
@@ -3,6 +3,9 @@ name = "cms"
 version = "0.1.0"
 edition = "2024"
 build = "build.rs"
+# Application binary, never published to crates.io. Lets cargo-deny skip the
+# license check for our own crate (see `[licenses] private` in deny.toml).
+publish = false
 
 [features]
 default = ["embed-dashboard"]

From e37137c544338f5e42b569e7131f3886bdb5e5d1 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:23:51 +0530
Subject: [PATCH 05/43] ci: add Dependabot, cargo-deny, and release workflow

---
 .github/dependabot.yml        | 36 +++++++++++++++++
 .github/workflows/audit.yml   | 29 ++++++++++++++
 .github/workflows/release.yml | 75 +++++++++++++++++++++++++++++++++++
 deny.toml                     | 59 +++++++++++++++++++++++++++
 4 files changed, 199 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/audit.yml
 create mode 100644 .github/workflows/release.yml
 create mode 100644 deny.toml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..02087b4c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,36 @@
+version: 2
+updates:
+  # Rust backend (workspace). Replaces hand-bumping deps.
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      cargo-minor-patch:
+        update-types:
+          - minor
+          - patch
+
+  # Frontend + web (bun reads package.json; npm ecosystem covers the workspace).
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      npm-minor-patch:
+        update-types:
+          - minor
+          - patch
+
+  # Keep the SHA-pinned GitHub Actions current so pinning doesn't rot.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      actions-all:
+        patterns:
+          - "*"
diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
new file mode 100644
index 00000000..f0baae58
--- /dev/null
+++ b/.github/workflows/audit.yml
@@ -0,0 +1,29 @@
+name: Security audit
+
+# Scheduled RustSec advisory scan. Unlike the per-PR cargo-deny job, this catches
+# NEW advisories filed against the existing Cargo.lock even when no code changes.
+on:
+  schedule:
+    # 06:00 UTC every Monday.
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+  push:
+    paths:
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - ".github/workflows/audit.yml"
+
+permissions:
+  contents: read
+  issues: write
+  checks: write
+
+jobs:
+  audit:
+    name: cargo audit (RustSec)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..2a54d500
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,75 @@
+name: Release
+
+# Tag-driven. Push a tag like `v1.2.3` to build per-OS binaries and attach them to
+# a GitHub Release. The release binary embeds apps/dashboard/dist via rust-embed,
+# so the dashboard MUST be built before `cargo build --release`.
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Build (${{ matrix.target }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            bin: cms
+            asset: cms-x86_64-linux
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            bin: cms.exe
+            asset: cms-x86_64-windows.exe
+          - os: macos-latest
+            target: aarch64-apple-darwin
+            bin: cms
+            asset: cms-aarch64-macos
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
+        with:
+          toolchain: "1.94"
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: apps/backend
+          key: release-${{ matrix.target }}
+      # Persist the Nx local cache across runs. Ephemeral runners wipe .nx/cache, so
+      # without this Nx caching is a no-op. This lets dashboard:build (8-10s) replay
+      # from cache instead of rebuilding; the Rust compile stays on rust-cache above.
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: .nx/cache
+          key: nx-${{ runner.os }}-${{ hashFiles('apps/dashboard/**', 'bun.lock', 'package.json', 'nx.json') }}
+          restore-keys: |
+            nx-${{ runner.os }}-
+
+      # Single Nx command owns the dashboard -> backend ordering: backend:build
+      # dependsOn dashboard:build (rust-embed bakes apps/dashboard/dist into the
+      # binary) and sets SKIP_DASHBOARD_BUILD=1 so cargo consumes the built dist.
+      - name: Build release binary (dashboard + backend via Nx)
+        run: |
+          bun install --frozen-lockfile
+          bunx nx run backend:build
+
+      - name: Stage artifact
+        shell: bash
+        run: |
+          mkdir -p dist
+          cp "target/release/${{ matrix.bin }}" "dist/${{ matrix.asset }}"
+
+      - name: Attach to release
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        with:
+          files: dist/${{ matrix.asset }}
+          generate_release_notes: true
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 00000000..38f34711
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,59 @@
+# cargo-deny policy. Run: `cargo deny check` (from apps/backend, or with
+# `--manifest-path apps/backend/Cargo.toml`). Enforced in CI by the `security` job.
+
+[graph]
+# Check the dependency graph for all targets we actually ship on.
+all-features = false
+
+[advisories]
+# RustSec advisory DB: deny anything with a known vulnerability. Yanked crates
+# are denied by default. Add advisory IDs here only with a written justification.
+version = 2
+ignore = [
+  # `paste` is unmaintained but pulled in only transitively via the AVIF decode
+  # path (image -> ravif -> rav1e -> paste). It is a proc-macro with no known
+  # vulnerability and there is no safe upgrade available. Revisit when `image`
+  # drops the dependency.
+  "RUSTSEC-2024-0436",
+]
+
+[licenses]
+# Allowlist of SPDX licenses acceptable in the dependency tree. A new transitive
+# dep with a license not listed here fails CI on purpose — review then add it.
+version = 2
+confidence-threshold = 0.8
+# Skip the license check for our own unpublished crate(s) (publish = false).
+private = { ignore = true }
+allow = [
+  "MIT",
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "ISC",
+  "Zlib",
+  "MPL-2.0",
+  "Unicode-3.0",
+  "Unicode-DFS-2016",
+  "CC0-1.0",
+  "NCSA",
+  "CDLA-Permissive-2.0",
+  "OpenSSL",
+]
+# Per-crate license exceptions go here, e.g.
+# exceptions = [{ allow = ["..."], name = "some-crate" }]
+exceptions = []
+
+[bans]
+# Duplicate versions are noisy in a large tree — warn, don't fail.
+multiple-versions = "warn"
+wildcards = "deny"
+# Crates we never want pulled in (add as needed), e.g.
+# deny = [{ name = "openssl-sys" }]
+deny = []
+
+[sources]
+# Only allow crates from crates.io; reject unknown registries / git sources.
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]

From 1fe252e095f89c75c43de20ad19e583936d06f81 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:23:56 +0530
Subject: [PATCH 06/43] ci: update CI workflow with expanded test matrix

---
 .github/workflows/ci.yml | 204 ++++++++++++++++++++++++++++++++++-----
 1 file changed, 181 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index febdc657..5c38b374 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,37 +5,114 @@ on:
   push:
     branches: [main]
 
-# Cancel superseded runs on the same ref to save CI minutes.
+# Cancel superseded runs on the same ref to save CI minutes. Only cancel on PRs —
+# never cancel an in-flight run on main, which could be the one catching a regression.
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+# Least privilege: jobs only read the repo (setup-protoc gets the token it needs).
+permissions:
+  contents: read
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  # Decide which areas changed so we only run the jobs that matter. Pure doc edits
+  # (README, CLAUDE.md, AGENTS.md, LICENSE, .agents/**, .claude/**) match no filter,
+  # so every build job below is skipped while the `ci-status` gate stays green.
+  changes:
+    name: Detect changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      rust: ${{ steps.filter.outputs.rust }}
+      dashboard: ${{ steps.filter.outputs.dashboard }}
+      web: ${{ steps.filter.outputs.web }}
+      other: ${{ steps.filter.outputs.other }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
+        id: filter
+        with:
+          filters: |
+            rust:
+              - 'apps/backend/**'
+              - 'libs/proto/**'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'rust-toolchain.toml'
+              - 'clippy.toml'
+              - 'rustfmt.toml'
+              - 'deny.toml'
+              - '.github/workflows/**'
+            dashboard:
+              - 'apps/dashboard/**'
+              - 'package.json'
+              - 'bun.lock'
+              - 'nx.json'
+              - '.github/workflows/**'
+            web:
+              - 'apps/web/**'
+              - 'package.json'
+              - 'bun.lock'
+              - 'nx.json'
+              - '.github/workflows/**'
+            # Catch-all: anything that is NOT purely docs/agent files. Guards against
+            # the default-skip trap where a change matching none of the area filters
+            # above (e.g. a new Dockerfile or top-level script) would silently skip all
+            # build jobs while ci-status stays green. The rust lanes treat `other` as a
+            # baseline trigger, so non-doc changes always compile + test the core.
+            other:
+              - '!**/*.md'
+              - '!.claude/**'
+              - '!.agents/**'
+              - '!LICENSE'
+              - '!AGENTS.md'
+
   lint:
     name: Rust lint (fmt + clippy)
+    needs: changes
+    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.other == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     defaults:
       run:
         working-directory: apps/backend
     steps:
-      - uses: actions/checkout@v4
-      - name: Install protoc
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
         with:
-          components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      # Toolchain (channel + rustfmt/clippy components) comes from rust-toolchain.toml.
+      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: apps/backend
       - run: cargo fmt --all -- --check
-      - run: cargo clippy --all-targets --locked -- -D warnings
+      # --no-default-features drops `embed-dashboard`, whose RustEmbed derive needs
+      # apps/dashboard/dist at compile time (not built in CI).
+      - run: cargo clippy --no-default-features --all-targets --locked -- -D warnings
+
+  security:
+    name: Supply-chain (cargo-deny)
+    needs: changes
+    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.other == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2
+        with:
+          command: check
 
   test:
     name: Tests (${{ matrix.db }})
+    needs: changes
+    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.other == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     defaults:
       run:
         working-directory: apps/backend
@@ -64,6 +141,8 @@ jobs:
       TEST_DATABASE_URL: ${{ matrix.test_database_url }}
     # Both services run for every lane; the sqlite lane simply ignores them
     # (GitHub Actions can't attach services conditionally per matrix value).
+    # Service containers are Linux-only, which is why Windows/macOS live in the
+    # separate `test-os` job (SQLite only).
     services:
       postgres:
         image: postgres:16
@@ -90,37 +169,116 @@ jobs:
           --health-timeout 5s
           --health-retries 15
     steps:
-      - uses: actions/checkout@v4
-      - name: Install protoc
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: apps/backend
+          key: linux-${{ matrix.db }}
+      # --no-default-features drops `embed-dashboard` (RustEmbed needs a built
+      # apps/dashboard/dist at compile time, which CI doesn't produce).
+      - name: cargo test
+        run: cargo test --no-default-features --locked ${{ matrix.test_args }}
+
+  # Cross-platform coverage. The binary ships on Windows/macOS/Linux, so the suite
+  # must run off Linux too. Service containers don't run on these runners, so only
+  # the SQLite lane (in-memory, no external server) is exercised here.
+  test-os:
+    name: Tests (${{ matrix.os }}, sqlite)
+    needs: changes
+    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.other == 'true'
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    defaults:
+      run:
+        working-directory: apps/backend
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+    env:
+      TEST_DATABASE: sqlite
+      TEST_DATABASE_URL: ""
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: apps/backend
-          key: ${{ matrix.db }}
+          key: ${{ matrix.os }}-sqlite
+      # --no-default-features drops `embed-dashboard` (no built dashboard/dist in CI).
       - name: cargo test
-        run: cargo test --locked ${{ matrix.test_args }}
+        run: cargo test --no-default-features --locked
 
   frontend:
     name: Frontend (dashboard)
+    needs: changes
+    if: needs.changes.outputs.dashboard == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - run: bun install --frozen-lockfile
+      # Persist the Nx local cache so dashboard:build replays across runs.
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: .nx/cache
+          key: nx-${{ runner.os }}-${{ hashFiles('apps/dashboard/**', 'bun.lock', 'package.json', 'nx.json') }}
+          restore-keys: |
+            nx-${{ runner.os }}-
       - name: Biome lint
         run: bunx nx run dashboard:lint
       - name: Typecheck
-        run: bun run test:dashboard
+        run: bunx nx run dashboard:typecheck
       - name: Build
-        run: bun run build:dashboard
+        run: bunx nx run dashboard:build
 
   web:
     name: Web (landing + docs)
+    needs: changes
+    if: needs.changes.outputs.web == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - run: bun install --frozen-lockfile
+      # Persist the Nx local cache so web:build replays across runs.
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: .nx/cache
+          key: nx-${{ runner.os }}-${{ hashFiles('apps/web/**', 'bun.lock', 'package.json', 'nx.json') }}
+          restore-keys: |
+            nx-${{ runner.os }}-
+      - name: Biome lint
+        run: bunx nx run web:lint
+      - name: Typecheck
+        run: bunx nx run web:typecheck
       - name: Build
-        run: bun run build:web
+        run: bunx nx run web:build
+
+  # Single required status check. Branch protection should require ONLY this job.
+  # It passes when every needed job either succeeded or was skipped (path filter),
+  # and fails if any of them actually failed or was cancelled. This avoids the
+  # "skipped required check stays pending forever" trap of naive path filtering.
+  ci-status:
+    name: CI status
+    needs: [changes, lint, security, test, test-os, frontend, web]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Verify no job failed
+        run: |
+          if echo '${{ join(needs.*.result, ',') }}' | grep -Eq 'failure|cancelled'; then
+            echo "A required job failed or was cancelled: ${{ join(needs.*.result, ',') }}"
+            exit 1
+          fi
+          echo "All jobs succeeded or were skipped: ${{ join(needs.*.result, ',') }}"

From 97343f992b10522a14d3d592a5b630200d116322 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:24:01 +0530
Subject: [PATCH 07/43] refactor: box figment error in Config::load

---
 apps/backend/src/config.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/backend/src/config.rs b/apps/backend/src/config.rs
index ff1fce46..e3c01c8a 100644
--- a/apps/backend/src/config.rs
+++ b/apps/backend/src/config.rs
@@ -181,7 +181,7 @@ struct RawLog {
 impl Config {
     /// Load configuration by merging, in increasing precedence:
     /// built-in defaults < config file < environment variables < CLI flags.
-    pub fn load(cli: &Cli) -> Result<Self, figment::Error> {
+    pub fn load(cli: &Cli) -> Result<Self, Box<figment::Error>> {
         let mut figment = Figment::new();
 
         // Lowest-precedence secret layer: persisted HMAC secret from
@@ -228,7 +228,7 @@ impl Config {
             figment = figment.merge(Serialized::default("log.level", v));
         }
 
-        Ok(figment.extract::<RawConfig>()?.into_config())
+        Ok(figment.extract::<RawConfig>().map_err(Box::new)?.into_config())
     }
 
     /// Convenience for callers that only want env + defaults (no CLI flags).

From 8b28d97f9987c5562f9a26bacde2f0db226b5ead Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:24:06 +0530
Subject: [PATCH 08/43] refactor: use let-chaining in paths::home

---
 apps/backend/src/paths.rs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/apps/backend/src/paths.rs b/apps/backend/src/paths.rs
index bbc5af1c..22852347 100644
--- a/apps/backend/src/paths.rs
+++ b/apps/backend/src/paths.rs
@@ -26,10 +26,10 @@ pub const CMS_HOME_ENV: &str = "CMS_HOME";
 /// `$CMS_HOME` wins if set and non-empty. Otherwise `~/.cms`. As a last resort
 /// (no detectable home directory) falls back to `.cms` in the current dir.
 pub fn home() -> PathBuf {
-    if let Some(value) = std::env::var_os(CMS_HOME_ENV) {
-        if !value.is_empty() {
-            return PathBuf::from(value);
-        }
+    if let Some(value) = std::env::var_os(CMS_HOME_ENV)
+        && !value.is_empty()
+    {
+        return PathBuf::from(value);
     }
 
     directories::BaseDirs::new()

From 23382721edcd90570526a2717c4d5269c2a5f3d3 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:24:11 +0530
Subject: [PATCH 09/43] refactor: return bool from RateLimiter::check instead
 of Result

---
 apps/backend/src/middleware/rate_limit.rs | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/apps/backend/src/middleware/rate_limit.rs b/apps/backend/src/middleware/rate_limit.rs
index 04dead58..decc06f4 100644
--- a/apps/backend/src/middleware/rate_limit.rs
+++ b/apps/backend/src/middleware/rate_limit.rs
@@ -39,7 +39,9 @@ impl RateLimiter {
         }
     }
 
-    pub fn check(&self, key: &str) -> Result<(), ()> {
+    /// Records a request against `key`'s bucket and returns whether it is allowed
+    /// (`true`) or has exceeded the limit for the current window (`false`).
+    pub fn check(&self, key: &str) -> bool {
         let now = Instant::now();
 
         // Bound memory: drop expired buckets once the map grows large. Done
@@ -60,11 +62,7 @@ impl RateLimiter {
         }
         entry.count += 1;
 
-        if entry.count > self.max_requests {
-            Err(())
-        } else {
-            Ok(())
-        }
+        entry.count <= self.max_requests
     }
 
     /// Derive the rate-limit bucket key for a request. When `trust_proxy_headers`
@@ -110,12 +108,13 @@ pub async fn rate_limit_middleware(
 ) -> Response {
     let key = limiter.extract_client_key(&req);
 
-    match limiter.check(&key) {
-        Ok(()) => next.run(req).await,
-        Err(()) => (
+    if limiter.check(&key) {
+        next.run(req).await
+    } else {
+        (
             StatusCode::TOO_MANY_REQUESTS,
             Json(json!({"error": "Too many requests. Please try again later."})),
         )
-            .into_response(),
+            .into_response()
     }
 }

From 731d9c3d028f38e2c6e3bc6bf65c9fd2730f5734 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:24:16 +0530
Subject: [PATCH 10/43] refactor: rename StorageKind::from_str to parse

---
 apps/backend/src/storage/mod.rs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/apps/backend/src/storage/mod.rs b/apps/backend/src/storage/mod.rs
index 021daeaf..ec225bff 100644
--- a/apps/backend/src/storage/mod.rs
+++ b/apps/backend/src/storage/mod.rs
@@ -20,7 +20,7 @@ pub enum StorageKind {
 }
 
 impl StorageKind {
-    pub fn from_str(s: &str) -> Option<Self> {
+    pub fn parse(s: &str) -> Option<Self> {
         match s {
             STORAGE_KIND_FILESYSTEM => Some(StorageKind::Filesystem),
             STORAGE_KIND_S3 => Some(StorageKind::S3),
@@ -150,9 +150,9 @@ mod tests {
 
     #[test]
     fn test_storage_kind_from_str() {
-        assert_eq!(StorageKind::from_str("filesystem"), Some(StorageKind::Filesystem));
-        assert_eq!(StorageKind::from_str("s3"), Some(StorageKind::S3));
-        assert_eq!(StorageKind::from_str("unknown"), None);
+        assert_eq!(StorageKind::parse("filesystem"), Some(StorageKind::Filesystem));
+        assert_eq!(StorageKind::parse("s3"), Some(StorageKind::S3));
+        assert_eq!(StorageKind::parse("unknown"), None);
     }
 
     #[test]

From 3f1678ace17532d61b59b0728532905f23c22fa2 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:24:20 +0530
Subject: [PATCH 11/43] refactor: use ArtifactBundle type alias and
 let-chaining in backup service

---
 apps/backend/src/services/backup/mod.rs | 67 ++++++++++++-------------
 1 file changed, 33 insertions(+), 34 deletions(-)

diff --git a/apps/backend/src/services/backup/mod.rs b/apps/backend/src/services/backup/mod.rs
index 230ca421..7f24e0bd 100644
--- a/apps/backend/src/services/backup/mod.rs
+++ b/apps/backend/src/services/backup/mod.rs
@@ -277,10 +277,10 @@ impl BackupService {
         }
 
         // Retention pruning for scheduled backups.
-        if let Some(sched_id) = &opts.schedule_id {
-            if let Ok(Some(sched)) = meta::get_schedule(&self.pool, sched_id).await {
-                let _ = self.prune_retention(sched_id, sched.retention_n).await;
-            }
+        if let Some(sched_id) = &opts.schedule_id
+            && let Ok(Some(sched)) = meta::get_schedule(&self.pool, sched_id).await
+        {
+            let _ = self.prune_retention(sched_id, sched.retention_n).await;
         }
 
         meta::get_backup(&self.pool, &id).await?.ok_or(BackupError::NotFound)
@@ -307,10 +307,10 @@ impl BackupService {
 
     /// Delete a backup artifact and its row.
     pub async fn delete_backup(&self, id: &str) -> Result<(), BackupError> {
-        if let Some(row) = meta::get_backup(&self.pool, id).await? {
-            if let Some(key) = &row.destination_key {
-                let _ = self.destination.delete(key).await;
-            }
+        if let Some(row) = meta::get_backup(&self.pool, id).await?
+            && let Some(key) = &row.destination_key
+        {
+            let _ = self.destination.delete(key).await;
         }
         meta::delete_backup_row(&self.pool, id).await
     }
@@ -350,10 +350,10 @@ impl BackupService {
             if let Some(Some(k)) = row.get(key_i) {
                 keys.push(k.clone());
             }
-            if let Some(ti) = thumb_i {
-                if let Some(Some(tk)) = row.get(ti) {
-                    keys.push(tk.clone());
-                }
+            if let Some(ti) = thumb_i
+                && let Some(Some(tk)) = row.get(ti)
+            {
+                keys.push(tk.clone());
             }
             for key in keys {
                 if !seen.insert(key.clone()) {
@@ -470,7 +470,7 @@ impl BackupService {
                 build_instance_plan(self.pool.backend(), &tables)
             }
             RestoreTarget::Site { site_id, import_as_new } => {
-                self.build_site_restore_plan(&manifest, &tables, &[site_id.clone()], *import_as_new, &req)
+                self.build_site_restore_plan(&manifest, &tables, std::slice::from_ref(site_id), *import_as_new, &req)
                     .await?
             }
             RestoreTarget::Sites {
@@ -606,10 +606,7 @@ impl BackupService {
     }
 
     /// Decrypt/decompress an artifact into (manifest, table NDJSON, file blobs).
-    fn open(
-        &self,
-        bytes: &[u8],
-    ) -> Result<(Manifest, HashMap<String, Vec<u8>>, HashMap<String, Vec<u8>>), BackupError> {
+    fn open(&self, bytes: &[u8]) -> Result<ArtifactBundle, BackupError> {
         if bytes.len() < MAGIC.len() + 1 || &bytes[..MAGIC.len()] != MAGIC {
             return Err(BackupError::Invalid("not a CMS backup artifact".into()));
         }
@@ -747,6 +744,10 @@ fn inserts_for(backend: crate::database::backend::DatabaseBackend, tables: &Tabl
 type Row = serde_json::Map<String, serde_json::Value>;
 type Tables = HashMap<String, Vec<Row>>;
 
+/// A decoded backup artifact: the manifest, the per-table NDJSON bytes (keyed by
+/// table name), and the uploaded file blobs (keyed by storage key).
+type ArtifactBundle = (Manifest, HashMap<String, Vec<u8>>, HashMap<String, Vec<u8>>);
+
 fn parse_all_tables(ndjson: &HashMap<String, Vec<u8>>) -> Result<Tables, BackupError> {
     let mut tables = Tables::new();
     for (name, bytes) in ndjson {
@@ -857,10 +858,10 @@ fn reconcile_user_refs(tables: &mut Tables, existing: &HashSet<String>, fallback
     for (table, col) in nullable {
         if let Some(rows) = tables.get_mut(table) {
             for m in rows.iter_mut() {
-                if let Some(u) = str_field(m, col) {
-                    if !existing.contains(u) {
-                        m.insert(col.to_string(), serde_json::Value::Null);
-                    }
+                if let Some(u) = str_field(m, col)
+                    && !existing.contains(u)
+                {
+                    m.insert(col.to_string(), serde_json::Value::Null);
                 }
             }
         }
@@ -871,10 +872,8 @@ fn reconcile_user_refs(tables: &mut Tables, existing: &HashSet<String>, fallback
             let missing = str_field(m, "created_by")
                 .map(|u| !existing.contains(u))
                 .unwrap_or(true);
-            if missing {
-                if let Some(fb) = fallback_user {
-                    m.insert("created_by".to_string(), serde_json::Value::String(fb.to_string()));
-                }
+            if missing && let Some(fb) = fallback_user {
+                m.insert("created_by".to_string(), serde_json::Value::String(fb.to_string()));
             }
         }
     }
@@ -911,10 +910,10 @@ fn remap_ids(tables: &mut Tables) {
     }
 
     let remap = |row: &mut Row, col: &str, map: &HashMap<String, String>| {
-        if let Some(old) = str_field(row, col).map(String::from) {
-            if let Some(new) = map.get(&old) {
-                row.insert(col.to_string(), serde_json::Value::String(new.clone()));
-            }
+        if let Some(old) = str_field(row, col).map(String::from)
+            && let Some(new) = map.get(&old)
+        {
+            row.insert(col.to_string(), serde_json::Value::String(new.clone()));
         }
     };
     let sites = maps["sites"].clone();
@@ -955,10 +954,10 @@ fn remap_ids(tables: &mut Tables) {
 }
 
 fn pick_fallback_user(actor: Option<&str>, existing: &HashSet<String>) -> Option<String> {
-    if let Some(a) = actor {
-        if existing.contains(a) {
-            return Some(a.to_string());
-        }
+    if let Some(a) = actor
+        && existing.contains(a)
+    {
+        return Some(a.to_string());
     }
     existing.iter().next().cloned()
 }
@@ -1012,7 +1011,7 @@ fn append_entry(builder: &mut tar::Builder<Vec<u8>>, path: &str, data: &[u8]) ->
         .map_err(|e| BackupError::Io(e.to_string()))
 }
 
-fn read_tar(tar_bytes: &[u8]) -> Result<(Manifest, HashMap<String, Vec<u8>>, HashMap<String, Vec<u8>>), BackupError> {
+fn read_tar(tar_bytes: &[u8]) -> Result<ArtifactBundle, BackupError> {
     let mut archive = tar::Archive::new(std::io::Cursor::new(tar_bytes));
     let mut manifest: Option<Manifest> = None;
     let mut tables = HashMap::new();

From 31a9eabed6e0dd051a191643cfa6c77c1ddf6dbb Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:24:25 +0530
Subject: [PATCH 12/43] refactor: add parameter structs for repository trait
 methods

---
 apps/backend/src/repository/traits.rs | 100 ++++++++++++++------------
 1 file changed, 54 insertions(+), 46 deletions(-)

diff --git a/apps/backend/src/repository/traits.rs b/apps/backend/src/repository/traits.rs
index bd8aded1..51cdc909 100644
--- a/apps/backend/src/repository/traits.rs
+++ b/apps/backend/src/repository/traits.rs
@@ -106,6 +106,17 @@ pub trait CollectionRepository: Send + Sync {
     ) -> Result<(), RepositoryError>;
 }
 
+/// Fields for an entry update (see [`EntryRepository::update`]).
+pub struct UpdateEntryParams<'a> {
+    pub id: &'a str,
+    pub site_id: &'a str,
+    pub data: &'a str,
+    pub slug: &'a str,
+    pub status: &'a str,
+    pub created_by: Option<&'a str>,
+    pub change_summary: Option<&'a str>,
+}
+
 #[async_trait]
 pub trait EntryRepository: Send + Sync {
     async fn get_by_id(&self, id: &str, site_id: &str, published_only: bool) -> Result<Option<Entry>, RepositoryError>;
@@ -145,16 +156,7 @@ pub trait EntryRepository: Send + Sync {
         created_by: Option<&str>,
         change_summary: Option<&str>,
     ) -> Result<Entry, RepositoryError>;
-    async fn update(
-        &self,
-        id: &str,
-        site_id: &str,
-        data: &str,
-        slug: &str,
-        status: &str,
-        created_by: Option<&str>,
-        change_summary: Option<&str>,
-    ) -> Result<Entry, RepositoryError>;
+    async fn update(&self, params: UpdateEntryParams<'_>) -> Result<Entry, RepositoryError>;
     async fn delete(&self, id: &str, site_id: &str) -> Result<u64, RepositoryError>;
     async fn publish(&self, id: &str, site_id: &str) -> Result<Entry, RepositoryError>;
     async fn unpublish(&self, id: &str, site_id: &str) -> Result<Entry, RepositoryError>;
@@ -229,26 +231,28 @@ pub struct FileListResult {
     pub per_page: i64,
 }
 
+/// A new file record to persist (see [`FileRepository::create`]).
+pub struct NewFile<'a> {
+    pub id: &'a str,
+    pub site_id: &'a str,
+    pub filename: &'a str,
+    pub original_name: &'a str,
+    pub mime_type: &'a str,
+    pub size: i64,
+    pub storage_provider: &'a str,
+    pub storage_key: &'a str,
+    pub thumbnail_key: Option<&'a str>,
+    pub width: Option<i32>,
+    pub height: Option<i32>,
+    pub created_by: Option<&'a str>,
+}
+
 #[async_trait]
 pub trait FileRepository: Send + Sync {
     async fn get_by_id(&self, id: &str, site_id: &str) -> Result<Option<File>, RepositoryError>;
     async fn get_by_id_any(&self, id: &str) -> Result<Option<File>, RepositoryError>;
     async fn list(&self, params: ListFilesParams<'_>) -> Result<FileListResult, RepositoryError>;
-    async fn create(
-        &self,
-        id: &str,
-        site_id: &str,
-        filename: &str,
-        original_name: &str,
-        mime_type: &str,
-        size: i64,
-        storage_provider: &str,
-        storage_key: &str,
-        thumbnail_key: Option<&str>,
-        width: Option<i32>,
-        height: Option<i32>,
-        created_by: Option<&str>,
-    ) -> Result<File, RepositoryError>;
+    async fn create(&self, file: NewFile<'_>) -> Result<File, RepositoryError>;
     async fn soft_delete(&self, id: &str, site_id: &str) -> Result<u64, RepositoryError>;
     async fn restore(&self, id: &str, site_id: &str) -> Result<u64, RepositoryError>;
     async fn batch_soft_delete(&self, site_id: &str, ids: &[String]) -> Result<u64, RepositoryError>;
@@ -275,25 +279,38 @@ pub type AccessTokenLookupRow = (
     String,
 );
 
+/// A new access token to persist (see [`AccessTokenRepository::create`]).
+pub struct NewAccessToken<'a> {
+    pub id: &'a str,
+    pub site_id: &'a str,
+    pub name: &'a str,
+    pub token_hash: &'a str,
+    pub token_prefix: &'a str,
+    pub token_hmac: &'a str,
+    pub permission: &'a str,
+    pub created_by_user_id: Option<&'a str>,
+}
+
 #[async_trait]
 pub trait AccessTokenRepository: Send + Sync {
     async fn list(&self, site_id: &str) -> Result<Vec<AccessToken>, RepositoryError>;
-    async fn create(
-        &self,
-        id: &str,
-        site_id: &str,
-        name: &str,
-        token_hash: &str,
-        token_prefix: &str,
-        token_hmac: &str,
-        permission: &str,
-        created_by_user_id: Option<&str>,
-    ) -> Result<(), RepositoryError>;
+    async fn create(&self, token: NewAccessToken<'_>) -> Result<(), RepositoryError>;
     async fn delete(&self, id: &str, site_id: &str) -> Result<u64, RepositoryError>;
     async fn find_by_prefix(&self, prefix: &str) -> Result<Vec<AccessTokenLookupRow>, RepositoryError>;
     async fn update_last_used(&self, id: &str) -> Result<(), RepositoryError>;
 }
 
+/// A webhook delivery record to insert (see [`WebhookRepository::create_delivery`]).
+pub struct NewWebhookDelivery<'a> {
+    pub id: &'a str,
+    pub webhook_id: &'a str,
+    pub status: &'a str,
+    pub status_code: Option<i32>,
+    pub response_body: Option<&'a str>,
+    pub duration_ms: Option<i64>,
+    pub triggered_by: Option<&'a str>,
+}
+
 #[async_trait]
 pub trait WebhookRepository: Send + Sync {
     async fn list_for_site(&self, site_id: &str) -> Result<Vec<SiteWebhook>, RepositoryError>;
@@ -315,16 +332,7 @@ pub trait WebhookRepository: Send + Sync {
         headers_encrypted: Option<&str>,
     ) -> Result<SiteWebhook, RepositoryError>;
     async fn delete(&self, id: &str, site_id: &str) -> Result<u64, RepositoryError>;
-    async fn create_delivery(
-        &self,
-        id: &str,
-        webhook_id: &str,
-        status: &str,
-        status_code: Option<i32>,
-        response_body: Option<&str>,
-        duration_ms: Option<i64>,
-        triggered_by: Option<&str>,
-    ) -> Result<WebhookDelivery, RepositoryError>;
+    async fn create_delivery(&self, delivery: NewWebhookDelivery<'_>) -> Result<WebhookDelivery, RepositoryError>;
     async fn list_deliveries(
         &self,
         webhook_id: &str,

From 9f3fb82dc6003156df311aaddcb9ca5e0cffad67 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:24:31 +0530
Subject: [PATCH 13/43] refactor: update SQLite repositories to use parameter
 structs

---
 .../src/repository/sqlite/access_token.rs     | 24 +++++++-------
 apps/backend/src/repository/sqlite/entry.rs   | 24 +++++++-------
 apps/backend/src/repository/sqlite/file.rs    | 32 +++++++++----------
 apps/backend/src/repository/sqlite/webhook.rs | 22 ++++++-------
 4 files changed, 52 insertions(+), 50 deletions(-)

diff --git a/apps/backend/src/repository/sqlite/access_token.rs b/apps/backend/src/repository/sqlite/access_token.rs
index 8d85a79b..c169b5f5 100644
--- a/apps/backend/src/repository/sqlite/access_token.rs
+++ b/apps/backend/src/repository/sqlite/access_token.rs
@@ -3,7 +3,7 @@ use sqlx::SqlitePool;
 
 use crate::models::access_token::AccessToken;
 use crate::repository::error::RepositoryError;
-use crate::repository::traits::{AccessTokenLookupRow, AccessTokenRepository};
+use crate::repository::traits::{AccessTokenLookupRow, AccessTokenRepository, NewAccessToken};
 
 pub struct SqliteAccessTokenRepository {
     pool: SqlitePool,
@@ -29,17 +29,17 @@ impl AccessTokenRepository for SqliteAccessTokenRepository {
         Ok(rows)
     }
 
-    async fn create(
-        &self,
-        id: &str,
-        site_id: &str,
-        name: &str,
-        token_hash: &str,
-        token_prefix: &str,
-        token_hmac: &str,
-        permission: &str,
-        created_by_user_id: Option<&str>,
-    ) -> Result<(), RepositoryError> {
+    async fn create(&self, token: NewAccessToken<'_>) -> Result<(), RepositoryError> {
+        let NewAccessToken {
+            id,
+            site_id,
+            name,
+            token_hash,
+            token_prefix,
+            token_hmac,
+            permission,
+            created_by_user_id,
+        } = token;
         sqlx::query(
             "INSERT INTO access_tokens
              (id, site_id, name, token_hash, token_prefix, token_hmac, permission, created_by_user_id)
diff --git a/apps/backend/src/repository/sqlite/entry.rs b/apps/backend/src/repository/sqlite/entry.rs
index 67958405..dcdd3c1c 100644
--- a/apps/backend/src/repository/sqlite/entry.rs
+++ b/apps/backend/src/repository/sqlite/entry.rs
@@ -8,7 +8,9 @@ use uuid::Uuid;
 
 use crate::models::entry::{Entry, EntryRevision};
 use crate::repository::error::RepositoryError;
-use crate::repository::traits::{EntriesListResult, EntryRepository, ListEntriesParams, RevisionsListResult};
+use crate::repository::traits::{
+    EntriesListResult, EntryRepository, ListEntriesParams, RevisionsListResult, UpdateEntryParams,
+};
 
 static FILE_URL_RE: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"/api/files/([^/]+)(?:/thumbnail)?").unwrap());
 
@@ -273,16 +275,16 @@ impl EntryRepository for SqliteEntryRepository {
         self.get_by_id_any_site(id).await?.ok_or(RepositoryError::NotFound)
     }
 
-    async fn update(
-        &self,
-        id: &str,
-        site_id: &str,
-        data: &str,
-        slug: &str,
-        status: &str,
-        created_by: Option<&str>,
-        change_summary: Option<&str>,
-    ) -> Result<Entry, RepositoryError> {
+    async fn update(&self, params: UpdateEntryParams<'_>) -> Result<Entry, RepositoryError> {
+        let UpdateEntryParams {
+            id,
+            site_id,
+            data,
+            slug,
+            status,
+            created_by,
+            change_summary,
+        } = params;
         let mut tx = self.pool.begin().await?;
 
         let next_number: i64 =
diff --git a/apps/backend/src/repository/sqlite/file.rs b/apps/backend/src/repository/sqlite/file.rs
index 016e8cdf..c8a84704 100644
--- a/apps/backend/src/repository/sqlite/file.rs
+++ b/apps/backend/src/repository/sqlite/file.rs
@@ -3,7 +3,7 @@ use sqlx::SqlitePool;
 
 use crate::models::file::{File, FileReference};
 use crate::repository::error::RepositoryError;
-use crate::repository::traits::{FileListResult, FileRepository, ListFilesParams};
+use crate::repository::traits::{FileListResult, FileRepository, ListFilesParams, NewFile};
 
 pub struct SqliteFileRepository {
     pool: SqlitePool,
@@ -125,21 +125,21 @@ impl FileRepository for SqliteFileRepository {
         })
     }
 
-    async fn create(
-        &self,
-        id: &str,
-        site_id: &str,
-        filename: &str,
-        original_name: &str,
-        mime_type: &str,
-        size: i64,
-        storage_provider: &str,
-        storage_key: &str,
-        thumbnail_key: Option<&str>,
-        width: Option<i32>,
-        height: Option<i32>,
-        created_by: Option<&str>,
-    ) -> Result<File, RepositoryError> {
+    async fn create(&self, file: NewFile<'_>) -> Result<File, RepositoryError> {
+        let NewFile {
+            id,
+            site_id,
+            filename,
+            original_name,
+            mime_type,
+            size,
+            storage_provider,
+            storage_key,
+            thumbnail_key,
+            width,
+            height,
+            created_by,
+        } = file;
         sqlx::query(
             "INSERT INTO files (id, site_id, filename, original_name, mime_type, size, storage_provider, storage_key, thumbnail_key, width, height, created_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
         )
diff --git a/apps/backend/src/repository/sqlite/webhook.rs b/apps/backend/src/repository/sqlite/webhook.rs
index 7be86de3..3aea7246 100644
--- a/apps/backend/src/repository/sqlite/webhook.rs
+++ b/apps/backend/src/repository/sqlite/webhook.rs
@@ -3,7 +3,7 @@ use sqlx::SqlitePool;
 
 use crate::models::webhook::{SiteWebhook, WebhookDelivery};
 use crate::repository::error::RepositoryError;
-use crate::repository::traits::WebhookRepository;
+use crate::repository::traits::{NewWebhookDelivery, WebhookRepository};
 
 pub struct SqliteWebhookRepository {
     pool: SqlitePool,
@@ -98,16 +98,16 @@ impl WebhookRepository for SqliteWebhookRepository {
         Ok(result.rows_affected())
     }
 
-    async fn create_delivery(
-        &self,
-        id: &str,
-        webhook_id: &str,
-        status: &str,
-        status_code: Option<i32>,
-        response_body: Option<&str>,
-        duration_ms: Option<i64>,
-        triggered_by: Option<&str>,
-    ) -> Result<WebhookDelivery, RepositoryError> {
+    async fn create_delivery(&self, delivery: NewWebhookDelivery<'_>) -> Result<WebhookDelivery, RepositoryError> {
+        let NewWebhookDelivery {
+            id,
+            webhook_id,
+            status,
+            status_code,
+            response_body,
+            duration_ms,
+            triggered_by,
+        } = delivery;
         sqlx::query(
             "INSERT INTO site_webhook_deliveries (id, webhook_id, status, status_code, response_body, duration_ms, triggered_by) VALUES (?, ?, ?, ?, ?, ?, ?)",
         )

From cd2ee53a32f57c5e89ac07fda6257a2835a85746 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:24:36 +0530
Subject: [PATCH 14/43] refactor: update Postgres repositories to use parameter
 structs

---
 .../src/repository/postgres/access_token.rs   | 24 +++++++-------
 apps/backend/src/repository/postgres/entry.rs | 24 +++++++-------
 apps/backend/src/repository/postgres/file.rs  | 32 +++++++++----------
 .../src/repository/postgres/webhook.rs        | 22 ++++++-------
 4 files changed, 52 insertions(+), 50 deletions(-)

diff --git a/apps/backend/src/repository/postgres/access_token.rs b/apps/backend/src/repository/postgres/access_token.rs
index 7ee8e826..025dda33 100644
--- a/apps/backend/src/repository/postgres/access_token.rs
+++ b/apps/backend/src/repository/postgres/access_token.rs
@@ -3,7 +3,7 @@ use sqlx::PgPool;
 
 use crate::models::access_token::AccessToken;
 use crate::repository::error::RepositoryError;
-use crate::repository::traits::{AccessTokenLookupRow, AccessTokenRepository};
+use crate::repository::traits::{AccessTokenLookupRow, AccessTokenRepository, NewAccessToken};
 
 pub struct PostgresAccessTokenRepository {
     pool: PgPool,
@@ -29,17 +29,17 @@ impl AccessTokenRepository for PostgresAccessTokenRepository {
         Ok(rows)
     }
 
-    async fn create(
-        &self,
-        id: &str,
-        site_id: &str,
-        name: &str,
-        token_hash: &str,
-        token_prefix: &str,
-        token_hmac: &str,
-        permission: &str,
-        created_by_user_id: Option<&str>,
-    ) -> Result<(), RepositoryError> {
+    async fn create(&self, token: NewAccessToken<'_>) -> Result<(), RepositoryError> {
+        let NewAccessToken {
+            id,
+            site_id,
+            name,
+            token_hash,
+            token_prefix,
+            token_hmac,
+            permission,
+            created_by_user_id,
+        } = token;
         sqlx::query(
             "INSERT INTO access_tokens
              (id, site_id, name, token_hash, token_prefix, token_hmac, permission, created_by_user_id)
diff --git a/apps/backend/src/repository/postgres/entry.rs b/apps/backend/src/repository/postgres/entry.rs
index d0feee94..a8cb9280 100644
--- a/apps/backend/src/repository/postgres/entry.rs
+++ b/apps/backend/src/repository/postgres/entry.rs
@@ -7,7 +7,9 @@ use uuid::Uuid;
 
 use crate::models::entry::{Entry, EntryRevision};
 use crate::repository::error::RepositoryError;
-use crate::repository::traits::{EntriesListResult, EntryRepository, ListEntriesParams, RevisionsListResult};
+use crate::repository::traits::{
+    EntriesListResult, EntryRepository, ListEntriesParams, RevisionsListResult, UpdateEntryParams,
+};
 
 pub struct PostgresEntryRepository {
     pool: PgPool,
@@ -236,16 +238,16 @@ impl EntryRepository for PostgresEntryRepository {
         self.get_by_id_any_site(id).await?.ok_or(RepositoryError::NotFound)
     }
 
-    async fn update(
-        &self,
-        id: &str,
-        site_id: &str,
-        data: &str,
-        slug: &str,
-        status: &str,
-        created_by: Option<&str>,
-        change_summary: Option<&str>,
-    ) -> Result<Entry, RepositoryError> {
+    async fn update(&self, params: UpdateEntryParams<'_>) -> Result<Entry, RepositoryError> {
+        let UpdateEntryParams {
+            id,
+            site_id,
+            data,
+            slug,
+            status,
+            created_by,
+            change_summary,
+        } = params;
         let mut tx = self.pool.begin().await?;
 
         sqlx::query(
diff --git a/apps/backend/src/repository/postgres/file.rs b/apps/backend/src/repository/postgres/file.rs
index a53b95d1..3061b8b0 100644
--- a/apps/backend/src/repository/postgres/file.rs
+++ b/apps/backend/src/repository/postgres/file.rs
@@ -3,7 +3,7 @@ use sqlx::PgPool;
 
 use crate::models::file::{File, FileReference};
 use crate::repository::error::RepositoryError;
-use crate::repository::traits::{FileListResult, FileRepository, ListFilesParams};
+use crate::repository::traits::{FileListResult, FileRepository, ListFilesParams, NewFile};
 
 pub struct PostgresFileRepository {
     pool: PgPool,
@@ -131,21 +131,21 @@ impl FileRepository for PostgresFileRepository {
         })
     }
 
-    async fn create(
-        &self,
-        id: &str,
-        site_id: &str,
-        filename: &str,
-        original_name: &str,
-        mime_type: &str,
-        size: i64,
-        storage_provider: &str,
-        storage_key: &str,
-        thumbnail_key: Option<&str>,
-        width: Option<i32>,
-        height: Option<i32>,
-        created_by: Option<&str>,
-    ) -> Result<File, RepositoryError> {
+    async fn create(&self, file: NewFile<'_>) -> Result<File, RepositoryError> {
+        let NewFile {
+            id,
+            site_id,
+            filename,
+            original_name,
+            mime_type,
+            size,
+            storage_provider,
+            storage_key,
+            thumbnail_key,
+            width,
+            height,
+            created_by,
+        } = file;
         sqlx::query(
             "INSERT INTO files (id, site_id, filename, original_name, mime_type, size, storage_provider, storage_key, thumbnail_key, width, height, created_by) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)",
         )
diff --git a/apps/backend/src/repository/postgres/webhook.rs b/apps/backend/src/repository/postgres/webhook.rs
index acaa5555..56e45f41 100644
--- a/apps/backend/src/repository/postgres/webhook.rs
+++ b/apps/backend/src/repository/postgres/webhook.rs
@@ -3,7 +3,7 @@ use sqlx::PgPool;
 
 use crate::models::webhook::{SiteWebhook, WebhookDelivery};
 use crate::repository::error::RepositoryError;
-use crate::repository::traits::WebhookRepository;
+use crate::repository::traits::{NewWebhookDelivery, WebhookRepository};
 
 pub struct PostgresWebhookRepository {
     pool: PgPool,
@@ -100,16 +100,16 @@ impl WebhookRepository for PostgresWebhookRepository {
         Ok(result.rows_affected())
     }
 
-    async fn create_delivery(
-        &self,
-        id: &str,
-        webhook_id: &str,
-        status: &str,
-        status_code: Option<i32>,
-        response_body: Option<&str>,
-        duration_ms: Option<i64>,
-        triggered_by: Option<&str>,
-    ) -> Result<WebhookDelivery, RepositoryError> {
+    async fn create_delivery(&self, delivery: NewWebhookDelivery<'_>) -> Result<WebhookDelivery, RepositoryError> {
+        let NewWebhookDelivery {
+            id,
+            webhook_id,
+            status,
+            status_code,
+            response_body,
+            duration_ms,
+            triggered_by,
+        } = delivery;
         sqlx::query(
             "INSERT INTO site_webhook_deliveries (id, webhook_id, status, status_code, response_body, duration_ms, triggered_by) VALUES ($1, $2, $3, $4, $5, $6, $7)",
         )

From 6dc16f672407cc3959fdf1ac94e48c1549ab14b6 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:24:41 +0530
Subject: [PATCH 15/43] refactor: update MySQL repositories to use parameter
 structs

---
 .../src/repository/mysql/access_token.rs      | 24 +++++++-------
 apps/backend/src/repository/mysql/entry.rs    | 24 +++++++-------
 apps/backend/src/repository/mysql/file.rs     | 32 +++++++++----------
 apps/backend/src/repository/mysql/webhook.rs  | 22 ++++++-------
 4 files changed, 52 insertions(+), 50 deletions(-)

diff --git a/apps/backend/src/repository/mysql/access_token.rs b/apps/backend/src/repository/mysql/access_token.rs
index 5aef9190..6c2dc25f 100644
--- a/apps/backend/src/repository/mysql/access_token.rs
+++ b/apps/backend/src/repository/mysql/access_token.rs
@@ -3,7 +3,7 @@ use sqlx::MySqlPool;
 
 use crate::models::access_token::AccessToken;
 use crate::repository::error::RepositoryError;
-use crate::repository::traits::{AccessTokenLookupRow, AccessTokenRepository};
+use crate::repository::traits::{AccessTokenLookupRow, AccessTokenRepository, NewAccessToken};
 
 pub struct MysqlAccessTokenRepository {
     pool: MySqlPool,
@@ -29,17 +29,17 @@ impl AccessTokenRepository for MysqlAccessTokenRepository {
         Ok(rows)
     }
 
-    async fn create(
-        &self,
-        id: &str,
-        site_id: &str,
-        name: &str,
-        token_hash: &str,
-        token_prefix: &str,
-        token_hmac: &str,
-        permission: &str,
-        created_by_user_id: Option<&str>,
-    ) -> Result<(), RepositoryError> {
+    async fn create(&self, token: NewAccessToken<'_>) -> Result<(), RepositoryError> {
+        let NewAccessToken {
+            id,
+            site_id,
+            name,
+            token_hash,
+            token_prefix,
+            token_hmac,
+            permission,
+            created_by_user_id,
+        } = token;
         sqlx::query(
             "INSERT INTO access_tokens
              (id, site_id, name, token_hash, token_prefix, token_hmac, permission, created_by_user_id)
diff --git a/apps/backend/src/repository/mysql/entry.rs b/apps/backend/src/repository/mysql/entry.rs
index a7c72180..5e158d6f 100644
--- a/apps/backend/src/repository/mysql/entry.rs
+++ b/apps/backend/src/repository/mysql/entry.rs
@@ -7,7 +7,9 @@ use uuid::Uuid;
 
 use crate::models::entry::{Entry, EntryRevision};
 use crate::repository::error::RepositoryError;
-use crate::repository::traits::{EntriesListResult, EntryRepository, ListEntriesParams, RevisionsListResult};
+use crate::repository::traits::{
+    EntriesListResult, EntryRepository, ListEntriesParams, RevisionsListResult, UpdateEntryParams,
+};
 
 pub struct MysqlEntryRepository {
     pool: MySqlPool,
@@ -224,16 +226,16 @@ impl EntryRepository for MysqlEntryRepository {
         self.get_by_id_any_site(id).await?.ok_or(RepositoryError::NotFound)
     }
 
-    async fn update(
-        &self,
-        id: &str,
-        site_id: &str,
-        data: &str,
-        slug: &str,
-        status: &str,
-        created_by: Option<&str>,
-        change_summary: Option<&str>,
-    ) -> Result<Entry, RepositoryError> {
+    async fn update(&self, params: UpdateEntryParams<'_>) -> Result<Entry, RepositoryError> {
+        let UpdateEntryParams {
+            id,
+            site_id,
+            data,
+            slug,
+            status,
+            created_by,
+            change_summary,
+        } = params;
         let mut tx = self.pool.begin().await?;
 
         sqlx::query(
diff --git a/apps/backend/src/repository/mysql/file.rs b/apps/backend/src/repository/mysql/file.rs
index 403845ba..4d1807dd 100644
--- a/apps/backend/src/repository/mysql/file.rs
+++ b/apps/backend/src/repository/mysql/file.rs
@@ -3,7 +3,7 @@ use sqlx::MySqlPool;
 
 use crate::models::file::{File, FileReference};
 use crate::repository::error::RepositoryError;
-use crate::repository::traits::{FileListResult, FileRepository, ListFilesParams};
+use crate::repository::traits::{FileListResult, FileRepository, ListFilesParams, NewFile};
 
 pub struct MysqlFileRepository {
     pool: MySqlPool,
@@ -116,21 +116,21 @@ impl FileRepository for MysqlFileRepository {
         })
     }
 
-    async fn create(
-        &self,
-        id: &str,
-        site_id: &str,
-        filename: &str,
-        original_name: &str,
-        mime_type: &str,
-        size: i64,
-        storage_provider: &str,
-        storage_key: &str,
-        thumbnail_key: Option<&str>,
-        width: Option<i32>,
-        height: Option<i32>,
-        created_by: Option<&str>,
-    ) -> Result<File, RepositoryError> {
+    async fn create(&self, file: NewFile<'_>) -> Result<File, RepositoryError> {
+        let NewFile {
+            id,
+            site_id,
+            filename,
+            original_name,
+            mime_type,
+            size,
+            storage_provider,
+            storage_key,
+            thumbnail_key,
+            width,
+            height,
+            created_by,
+        } = file;
         sqlx::query(
             "INSERT INTO files (id, site_id, filename, original_name, mime_type, size, storage_provider, storage_key, thumbnail_key, width, height, created_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
         )
diff --git a/apps/backend/src/repository/mysql/webhook.rs b/apps/backend/src/repository/mysql/webhook.rs
index f66ecfc1..e700fc89 100644
--- a/apps/backend/src/repository/mysql/webhook.rs
+++ b/apps/backend/src/repository/mysql/webhook.rs
@@ -3,7 +3,7 @@ use sqlx::MySqlPool;
 
 use crate::models::webhook::{SiteWebhook, WebhookDelivery};
 use crate::repository::error::RepositoryError;
-use crate::repository::traits::WebhookRepository;
+use crate::repository::traits::{NewWebhookDelivery, WebhookRepository};
 
 pub struct MysqlWebhookRepository {
     pool: MySqlPool,
@@ -98,16 +98,16 @@ impl WebhookRepository for MysqlWebhookRepository {
         Ok(result.rows_affected())
     }
 
-    async fn create_delivery(
-        &self,
-        id: &str,
-        webhook_id: &str,
-        status: &str,
-        status_code: Option<i32>,
-        response_body: Option<&str>,
-        duration_ms: Option<i64>,
-        triggered_by: Option<&str>,
-    ) -> Result<WebhookDelivery, RepositoryError> {
+    async fn create_delivery(&self, delivery: NewWebhookDelivery<'_>) -> Result<WebhookDelivery, RepositoryError> {
+        let NewWebhookDelivery {
+            id,
+            webhook_id,
+            status,
+            status_code,
+            response_body,
+            duration_ms,
+            triggered_by,
+        } = delivery;
         sqlx::query(
             "INSERT INTO site_webhook_deliveries (id, webhook_id, status, status_code, response_body, duration_ms, triggered_by) VALUES (?, ?, ?, ?, ?, ?, ?)",
         )

From f52304a47206391ccda538247dae12077ee2fa52 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:24:47 +0530
Subject: [PATCH 16/43] refactor: update services to use input parameter
 structs

---
 apps/backend/src/services/access_token.rs |  18 ++--
 apps/backend/src/services/entry.rs        | 101 ++++++++++++++++------
 apps/backend/src/services/file.rs         |  61 ++++++++-----
 apps/backend/src/services/webhook.rs      |  32 +++----
 4 files changed, 138 insertions(+), 74 deletions(-)

diff --git a/apps/backend/src/services/access_token.rs b/apps/backend/src/services/access_token.rs
index fe41ccf7..6a6f0530 100644
--- a/apps/backend/src/services/access_token.rs
+++ b/apps/backend/src/services/access_token.rs
@@ -9,7 +9,7 @@ use uuid::Uuid;
 
 use crate::middleware::auth::compute_key_hmac;
 use crate::models::access_token::{AccessToken, AccessTokenPermission, AccessTokenResponse};
-use crate::repository::traits::AccessTokenRepository;
+use crate::repository::traits::{AccessTokenRepository, NewAccessToken};
 
 const SITE_TOKEN_PREFIX: &str = "cms_site_";
 
@@ -91,16 +91,16 @@ impl AccessTokenService {
         let permission_str = permission.as_str();
 
         self.access_token_repo
-            .create(
-                &id,
+            .create(NewAccessToken {
+                id: &id,
                 site_id,
                 name,
-                &token_hash,
-                &prefix,
-                &token_hmac,
-                permission_str,
-                created_by,
-            )
+                token_hash: &token_hash,
+                token_prefix: &prefix,
+                token_hmac: &token_hmac,
+                permission: permission_str,
+                created_by_user_id: created_by,
+            })
             .await
             .map_err(|e| {
                 error!("Failed to create site token: site_id={}, error={}", site_id, e);
diff --git a/apps/backend/src/services/entry.rs b/apps/backend/src/services/entry.rs
index a04c6150..9578f753 100644
--- a/apps/backend/src/services/entry.rs
+++ b/apps/backend/src/services/entry.rs
@@ -11,6 +11,7 @@ use crate::models::entry::{Entry, EntryRevision};
 use crate::repository::error::RepositoryError;
 use crate::repository::traits::{
     CollectionRepository, EntriesListResult, EntryRepository, FileRepository, ListEntriesParams, RevisionsListResult,
+    UpdateEntryParams,
 };
 use crate::services::search::queue::{OP_DELETE, OP_INDEX, SearchQueue};
 use crate::services::search::{SearchError, SearchParams, SearchService};
@@ -27,6 +28,18 @@ pub struct EntryService {
     search_queue: Option<Arc<SearchQueue>>,
 }
 
+/// Fields for [`EntryService::update_entry`]. All but `id`/`site_id` are optional;
+/// `None` leaves the existing value unchanged.
+pub struct UpdateEntryInput<'a> {
+    pub id: &'a str,
+    pub site_id: &'a str,
+    pub data: Option<&'a Value>,
+    pub slug: Option<&'a str>,
+    pub status: Option<&'a str>,
+    pub created_by: Option<&'a str>,
+    pub change_summary: Option<&'a str>,
+}
+
 #[derive(Error, Debug)]
 pub enum EntryError {
     #[error("Not found")]
@@ -280,16 +293,16 @@ impl EntryService {
         }
     }
 
-    pub async fn update_entry(
-        &self,
-        id: &str,
-        site_id: &str,
-        data: Option<&Value>,
-        slug: Option<&str>,
-        status: Option<&str>,
-        created_by: Option<&str>,
-        change_summary: Option<&str>,
-    ) -> Result<Entry, EntryError> {
+    pub async fn update_entry(&self, input: UpdateEntryInput<'_>) -> Result<Entry, EntryError> {
+        let UpdateEntryInput {
+            id,
+            site_id,
+            data,
+            slug,
+            status,
+            created_by,
+            change_summary,
+        } = input;
         debug!("Updating entry: id={}, site_id={}", id, site_id);
 
         let existing = self
@@ -333,15 +346,15 @@ impl EntryService {
         );
 
         self.entry_repo
-            .update(
+            .update(UpdateEntryParams {
                 id,
                 site_id,
-                &data_str,
-                final_slug,
-                final_status,
+                data: &data_str,
+                slug: final_slug,
+                status: final_status,
                 created_by,
                 change_summary,
-            )
+            })
             .await
             .map_err(|e| {
                 error!(
@@ -661,15 +674,15 @@ mod tests {
 
         let new_data = json!({"title": "Updated Title"});
         let result = service
-            .update_entry(
-                "entry-123",
-                "site-123",
-                Some(&new_data),
-                Some("updated-slug"),
-                None,
-                None,
-                None,
-            )
+            .update_entry(UpdateEntryInput {
+                id: "entry-123",
+                site_id: "site-123",
+                data: Some(&new_data),
+                slug: Some("updated-slug"),
+                status: None,
+                created_by: None,
+                change_summary: None,
+            })
             .await;
         assert!(result.is_ok());
         let entry = result.unwrap();
@@ -683,7 +696,15 @@ mod tests {
         let service = EntryService::new(entry_repo, file_repo, test_collection_repo());
 
         let result = service
-            .update_entry("nonexistent", "site-123", Some(&json!({})), None, None, None, None)
+            .update_entry(UpdateEntryInput {
+                id: "nonexistent",
+                site_id: "site-123",
+                data: Some(&json!({})),
+                slug: None,
+                status: None,
+                created_by: None,
+                change_summary: None,
+            })
             .await;
         assert!(matches!(result, Err(EntryError::NotFound)));
     }
@@ -696,7 +717,15 @@ mod tests {
         let service = EntryService::new(entry_repo, file_repo, test_collection_repo());
 
         let result = service
-            .update_entry("entry-123", "site-123", None, None, Some("published"), None, None)
+            .update_entry(UpdateEntryInput {
+                id: "entry-123",
+                site_id: "site-123",
+                data: None,
+                slug: None,
+                status: Some("published"),
+                created_by: None,
+                change_summary: None,
+            })
             .await;
         assert!(result.is_ok());
         assert_eq!(result.unwrap().status, "published");
@@ -945,7 +974,15 @@ mod tests {
 
         let updated = json!({"title": "Updated"});
         service
-            .update_entry(&entry.id, "site-123", Some(&updated), None, None, None, None)
+            .update_entry(UpdateEntryInput {
+                id: &entry.id,
+                site_id: "site-123",
+                data: Some(&updated),
+                slug: None,
+                status: None,
+                created_by: None,
+                change_summary: None,
+            })
             .await
             .unwrap();
 
@@ -1026,7 +1063,15 @@ mod tests {
         let service = EntryService::new(entry_repo, file_repo, col_repo);
         let data = json!({"title": "not-a-number"});
         let result = service
-            .update_entry("entry-123", "site-123", Some(&data), None, None, None, None)
+            .update_entry(UpdateEntryInput {
+                id: "entry-123",
+                site_id: "site-123",
+                data: Some(&data),
+                slug: None,
+                status: None,
+                created_by: None,
+                change_summary: None,
+            })
             .await;
         assert!(matches!(result, Err(EntryError::ValidationFailed(_))));
     }
diff --git a/apps/backend/src/services/file.rs b/apps/backend/src/services/file.rs
index 9348f082..eca303fd 100644
--- a/apps/backend/src/services/file.rs
+++ b/apps/backend/src/services/file.rs
@@ -10,7 +10,7 @@ use uuid::Uuid;
 
 use crate::config::Config;
 use crate::models::file::{File, FileReference, FileWithUrl};
-use crate::repository::traits::{FileListResult, FileRepository, ListFilesParams};
+use crate::repository::traits::{FileListResult, FileRepository, ListFilesParams, NewFile};
 use crate::storage::StorageProvider;
 
 #[derive(Clone)]
@@ -19,6 +19,17 @@ pub struct FileService {
     config: Arc<Config>,
 }
 
+/// Inputs for [`FileService::upload_file`].
+pub struct UploadFileRequest<'a> {
+    pub site_id: &'a str,
+    pub data: Bytes,
+    pub filename: &'a str,
+    pub content_type: &'a str,
+    pub created_by: Option<&'a str>,
+    pub storage: Arc<dyn StorageProvider>,
+    pub storage_provider: &'a str,
+}
+
 #[derive(Error, Debug)]
 pub enum FileError {
     #[error("Not found")]
@@ -97,16 +108,16 @@ impl FileService {
             .map_err(|e| FileError::DatabaseError(e.to_string()))
     }
 
-    pub async fn upload_file(
-        &self,
-        site_id: &str,
-        data: Bytes,
-        filename: &str,
-        content_type: &str,
-        created_by: Option<&str>,
-        storage: Arc<dyn StorageProvider>,
-        storage_provider: &str,
-    ) -> Result<FileWithUrl, FileError> {
+    pub async fn upload_file(&self, req: UploadFileRequest<'_>) -> Result<FileWithUrl, FileError> {
+        let UploadFileRequest {
+            site_id,
+            data,
+            filename,
+            content_type,
+            created_by,
+            storage,
+            storage_provider,
+        } = req;
         info!(
             "Uploading file: site_id={}, content_type={}, size={} bytes",
             site_id,
@@ -228,20 +239,20 @@ impl FileService {
         debug!("Creating file record in repository: id={}", file_id);
         let file = self
             .file_repo
-            .create(
-                &file_id,
+            .create(NewFile {
+                id: &file_id,
                 site_id,
-                &generated_filename,
-                &original_name,
-                &mime_type,
-                file_size,
+                filename: &generated_filename,
+                original_name: &original_name,
+                mime_type: &mime_type,
+                size: file_size,
                 storage_provider,
-                &storage_key,
-                thumb_key_str,
+                storage_key: &storage_key,
+                thumbnail_key: thumb_key_str,
                 width,
                 height,
                 created_by,
-            )
+            })
             .await
             .map_err(|e| {
                 error!(
@@ -595,7 +606,15 @@ mod tests {
         let data = Bytes::from(&[0u8; 200][..]);
 
         let result = service
-            .upload_file("site-123", data, "test.txt", "text/plain", None, storage, "filesystem")
+            .upload_file(UploadFileRequest {
+                site_id: "site-123",
+                data,
+                filename: "test.txt",
+                content_type: "text/plain",
+                created_by: None,
+                storage,
+                storage_provider: "filesystem",
+            })
             .await;
 
         assert!(matches!(result, Err(FileError::FileTooLarge(_))));
diff --git a/apps/backend/src/services/webhook.rs b/apps/backend/src/services/webhook.rs
index 9495c32c..fc30bf0f 100644
--- a/apps/backend/src/services/webhook.rs
+++ b/apps/backend/src/services/webhook.rs
@@ -17,7 +17,7 @@ use uuid::Uuid;
 
 use crate::models::webhook::{SiteWebhook, WebhookDelivery};
 use crate::repository::error::RepositoryError;
-use crate::repository::traits::WebhookRepository;
+use crate::repository::traits::{NewWebhookDelivery, WebhookRepository};
 
 const WEBHOOK_TIMEOUT_SECS: u64 = 30;
 const MAX_RESPONSE_BODY_CHARS: usize = 1024;
@@ -326,15 +326,15 @@ impl WebhookService {
                 );
 
                 self.webhook_repo
-                    .create_delivery(
-                        &delivery_id,
-                        id,
+                    .create_delivery(NewWebhookDelivery {
+                        id: &delivery_id,
+                        webhook_id: id,
                         status,
-                        Some(status_code),
-                        Some(&truncated_body),
-                        Some(duration_ms),
+                        status_code: Some(status_code),
+                        response_body: Some(&truncated_body),
+                        duration_ms: Some(duration_ms),
                         triggered_by,
-                    )
+                    })
                     .await
                     .map_err(|e| {
                         error!(
@@ -353,15 +353,15 @@ impl WebhookService {
                 );
 
                 self.webhook_repo
-                    .create_delivery(
-                        &delivery_id,
-                        id,
-                        "failed",
-                        None,
-                        Some(&e.to_string()),
-                        Some(duration_ms),
+                    .create_delivery(NewWebhookDelivery {
+                        id: &delivery_id,
+                        webhook_id: id,
+                        status: "failed",
+                        status_code: None,
+                        response_body: Some(&e.to_string()),
+                        duration_ms: Some(duration_ms),
                         triggered_by,
-                    )
+                    })
                     .await
                     .map_err(|e| {
                         error!(

From d937952491aa6121e3b793a435384f2a451cdffe Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:24:51 +0530
Subject: [PATCH 17/43] refactor: update in-memory test helpers to use
 parameter structs

---
 apps/backend/src/test_helpers.rs | 93 ++++++++++++++++----------------
 1 file changed, 48 insertions(+), 45 deletions(-)

diff --git a/apps/backend/src/test_helpers.rs b/apps/backend/src/test_helpers.rs
index dcd4538b..ee9484fe 100644
--- a/apps/backend/src/test_helpers.rs
+++ b/apps/backend/src/test_helpers.rs
@@ -13,8 +13,8 @@ use crate::models::user::User;
 use crate::repository::error::RepositoryError;
 use crate::repository::traits::{
     AccessTokenLookupRow, AccessTokenRepository, CollectionRepository, EntriesListResult, EntryRepository,
-    FileListResult, FileRepository, ListEntriesParams, ListFilesParams, RevisionsListResult, SessionRepository,
-    SiteRepository, UserRepository,
+    FileListResult, FileRepository, ListEntriesParams, ListFilesParams, NewAccessToken, NewFile, NewWebhookDelivery,
+    RevisionsListResult, SessionRepository, SiteRepository, UpdateEntryParams, UserRepository,
 };
 
 pub fn now_timestamp() -> String {
@@ -661,16 +661,16 @@ impl EntryRepository for InMemoryEntryRepository {
         Ok(entry)
     }
 
-    async fn update(
-        &self,
-        id: &str,
-        _site_id: &str,
-        data: &str,
-        slug: &str,
-        status: &str,
-        created_by: Option<&str>,
-        change_summary: Option<&str>,
-    ) -> Result<Entry, RepositoryError> {
+    async fn update(&self, params: UpdateEntryParams<'_>) -> Result<Entry, RepositoryError> {
+        let UpdateEntryParams {
+            id,
+            site_id: _,
+            data,
+            slug,
+            status,
+            created_by,
+            change_summary,
+        } = params;
         let mut entries = self.entries.lock().unwrap();
         if let Some(entry) = entries.iter_mut().find(|e| e.id == id) {
             entry.data = data.to_string();
@@ -962,21 +962,21 @@ impl FileRepository for InMemoryFileRepository {
         })
     }
 
-    async fn create(
-        &self,
-        id: &str,
-        site_id: &str,
-        filename: &str,
-        original_name: &str,
-        mime_type: &str,
-        size: i64,
-        storage_provider: &str,
-        storage_key: &str,
-        thumbnail_key: Option<&str>,
-        width: Option<i32>,
-        height: Option<i32>,
-        created_by: Option<&str>,
-    ) -> Result<File, RepositoryError> {
+    async fn create(&self, file: NewFile<'_>) -> Result<File, RepositoryError> {
+        let NewFile {
+            id,
+            site_id,
+            filename,
+            original_name,
+            mime_type,
+            size,
+            storage_provider,
+            storage_key,
+            thumbnail_key,
+            width,
+            height,
+            created_by,
+        } = file;
         let mut files = self.files.lock().unwrap();
         let file = File {
             id: id.to_string(),
@@ -1118,17 +1118,17 @@ impl AccessTokenRepository for InMemoryAccessTokenRepository {
         Ok(tokens.iter().filter(|t| t.site_id == site_id).cloned().collect())
     }
 
-    async fn create(
-        &self,
-        id: &str,
-        site_id: &str,
-        name: &str,
-        _token_hash: &str,
-        token_prefix: &str,
-        token_hmac: &str,
-        permission: &str,
-        created_by_user_id: Option<&str>,
-    ) -> Result<(), RepositoryError> {
+    async fn create(&self, token: NewAccessToken<'_>) -> Result<(), RepositoryError> {
+        let NewAccessToken {
+            id,
+            site_id,
+            name,
+            token_hash: _,
+            token_prefix,
+            token_hmac,
+            permission,
+            created_by_user_id,
+        } = token;
         let mut tokens = self.tokens.lock().unwrap();
         let token = AccessToken {
             id: id.to_string(),
@@ -1277,14 +1277,17 @@ impl crate::repository::traits::WebhookRepository for InMemoryWebhookRepository
 
     async fn create_delivery(
         &self,
-        id: &str,
-        webhook_id: &str,
-        status: &str,
-        status_code: Option<i32>,
-        response_body: Option<&str>,
-        duration_ms: Option<i64>,
-        triggered_by: Option<&str>,
+        delivery: NewWebhookDelivery<'_>,
     ) -> Result<crate::models::webhook::WebhookDelivery, RepositoryError> {
+        let NewWebhookDelivery {
+            id,
+            webhook_id,
+            status,
+            status_code,
+            response_body,
+            duration_ms,
+            triggered_by,
+        } = delivery;
         let mut deliveries = self.deliveries.lock().unwrap();
         let delivery = crate::models::webhook::WebhookDelivery {
             id: id.to_string(),

From 95bd31d394a242e7b1bf93d495e037d1161c69da Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:24:56 +0530
Subject: [PATCH 18/43] refactor: update HTTP handlers and GraphQL mutation to
 use service input structs

---
 apps/backend/src/graphql/mutation/entry.rs    | 14 +++---
 apps/backend/src/handlers/backup_handler.rs   | 46 +++++++++----------
 apps/backend/src/handlers/entry_handler.rs    | 31 ++++++-------
 apps/backend/src/handlers/file_handler.rs     | 15 +++---
 .../backend/src/handlers/singleton_handler.rs | 14 ++----
 5 files changed, 57 insertions(+), 63 deletions(-)

diff --git a/apps/backend/src/graphql/mutation/entry.rs b/apps/backend/src/graphql/mutation/entry.rs
index ebae0a0f..15eed664 100644
--- a/apps/backend/src/graphql/mutation/entry.rs
+++ b/apps/backend/src/graphql/mutation/entry.rs
@@ -32,15 +32,15 @@ impl EntryMutation {
         let entry = gql_ctx
             .services
             .entry
-            .update_entry(
-                &id,
+            .update_entry(crate::services::entry::UpdateEntryInput {
+                id: &id,
                 site_id,
-                input.data.as_ref().map(|d| &d.0),
-                input.slug.as_deref(),
-                input.status.as_deref(),
+                data: input.data.as_ref().map(|d| &d.0),
+                slug: input.slug.as_deref(),
+                status: input.status.as_deref(),
                 created_by,
-                input.change_summary.as_deref(),
-            )
+                change_summary: input.change_summary.as_deref(),
+            })
             .await
             .map_err(|e| async_graphql::Error::new(format!("Error: {}", e)))?;
 
diff --git a/apps/backend/src/handlers/backup_handler.rs b/apps/backend/src/handlers/backup_handler.rs
index 0fd6661f..90c8cb65 100644
--- a/apps/backend/src/handlers/backup_handler.rs
+++ b/apps/backend/src/handlers/backup_handler.rs
@@ -155,10 +155,10 @@ async fn load_scoped_backup(
         Ok(None) => return Err(err_response(BackupError::NotFound)),
         Err(e) => return Err(err_response(e)),
     };
-    if let Some(site) = expect_site {
-        if row.scope != "site" || row.site_id.as_deref() != Some(site) {
-            return Err(err_response(BackupError::NotFound));
-        }
+    if let Some(site) = expect_site
+        && (row.scope != "site" || row.site_id.as_deref() != Some(site))
+    {
+        return Err(err_response(BackupError::NotFound));
     }
     Ok(row)
 }
@@ -309,10 +309,10 @@ async fn list_schedules(backup: &BackupService, scope: &str, site_id: Option<&st
 async fn update_schedule(backup: &BackupService, id: &str, expect_site: Option<&str>, body: ScheduleBody) -> Response {
     match meta::get_schedule(backup.pool(), id).await {
         Ok(Some(row)) => {
-            if let Some(site) = expect_site {
-                if row.scope != "site" || row.site_id.as_deref() != Some(site) {
-                    return err_response(BackupError::NotFound);
-                }
+            if let Some(site) = expect_site
+                && (row.scope != "site" || row.site_id.as_deref() != Some(site))
+            {
+                return err_response(BackupError::NotFound);
             }
         }
         Ok(None) => return err_response(BackupError::NotFound),
@@ -344,10 +344,10 @@ async fn update_schedule(backup: &BackupService, id: &str, expect_site: Option<&
 async fn delete_schedule(backup: &BackupService, id: &str, expect_site: Option<&str>) -> Response {
     match meta::get_schedule(backup.pool(), id).await {
         Ok(Some(row)) => {
-            if let Some(site) = expect_site {
-                if row.scope != "site" || row.site_id.as_deref() != Some(site) {
-                    return err_response(BackupError::NotFound);
-                }
+            if let Some(site) = expect_site
+                && (row.scope != "site" || row.site_id.as_deref() != Some(site))
+            {
+                return err_response(BackupError::NotFound);
             }
         }
         Ok(None) => return err_response(BackupError::NotFound),
@@ -370,10 +370,10 @@ async fn run_schedule_now(
         Ok(None) => return err_response(BackupError::NotFound),
         Err(e) => return err_response(e),
     };
-    if let Some(site) = expect_site {
-        if row.scope != "site" || row.site_id.as_deref() != Some(site) {
-            return err_response(BackupError::NotFound);
-        }
+    if let Some(site) = expect_site
+        && (row.scope != "site" || row.site_id.as_deref() != Some(site))
+    {
+        return err_response(BackupError::NotFound);
     }
     let scope = match row.scope.as_str() {
         "site" => match row.site_id.clone() {
@@ -514,14 +514,14 @@ fn instance_restore_target(
     site_id: Option<String>,
     site_ids: Option<Vec<String>>,
     import_as_new: bool,
-) -> Result<RestoreTarget, Response> {
+) -> Result<RestoreTarget, Box<Response>> {
     match mode {
         Some("site") => {
             let ids = match site_ids {
                 Some(ids) if !ids.is_empty() => ids,
                 _ => match site_id {
                     Some(s) => vec![s],
-                    None => return Err(bad_request("site restore requires site_ids or site_id")),
+                    None => return Err(Box::new(bad_request("site restore requires site_ids or site_id"))),
                 },
             };
             Ok(RestoreTarget::Sites {
@@ -558,7 +558,7 @@ pub async fn restore_instance(
         body.import_as_new,
     ) {
         Ok(t) => t,
-        Err(r) => return r,
+        Err(r) => return *r,
     };
     let resp = run_restore(
         &backup,
@@ -570,10 +570,10 @@ pub async fn restore_instance(
     )
     .await;
     // Clean up any single-use staged upload referenced by this restore.
-    if let Some(key) = body.destination_key.as_deref() {
-        if key.starts_with(TEMP_RESTORE_PREFIX) {
-            backup.delete_destination(key).await;
-        }
+    if let Some(key) = body.destination_key.as_deref()
+        && key.starts_with(TEMP_RESTORE_PREFIX)
+    {
+        backup.delete_destination(key).await;
     }
     resp
 }
diff --git a/apps/backend/src/handlers/entry_handler.rs b/apps/backend/src/handlers/entry_handler.rs
index e4c1d8ab..cd4e5020 100644
--- a/apps/backend/src/handlers/entry_handler.rs
+++ b/apps/backend/src/handlers/entry_handler.rs
@@ -26,6 +26,7 @@ use crate::models::entry::{CreateEntry, Entry, EntryRevisionResponse, RevisionsL
 use crate::repository::Repository;
 use crate::repository::traits::ListEntriesParams;
 use crate::services::Services;
+use crate::services::entry::UpdateEntryInput;
 use crate::storage::{StorageProvider, StorageRegistry};
 use crate::utils::diff::compute_diff_for_revision;
 
@@ -52,14 +53,10 @@ pub struct DiffQuery {
 fn get_storage_for_site(
     site_storage_provider: &str,
     registry: &StorageRegistry,
-) -> Result<Arc<dyn StorageProvider>, Response> {
-    registry.get(site_storage_provider).ok_or_else(|| {
-        (
-            StatusCode::INTERNAL_SERVER_ERROR,
-            Json(json!({"error": "Storage not configured"})),
-        )
-            .into_response()
-    })
+) -> Result<Arc<dyn StorageProvider>, StatusCode> {
+    registry
+        .get(site_storage_provider)
+        .ok_or(StatusCode::INTERNAL_SERVER_ERROR)
 }
 
 #[utoipa::path(
@@ -156,7 +153,7 @@ pub async fn get_entry(
                 .unwrap_or_else(|_| "filesystem".into());
             let storage = match get_storage_for_site(&storage_provider, &storage_registry) {
                 Ok(s) => s,
-                Err(resp) => return resp,
+                Err(status) => return (status, Json(json!({"error": "Storage not configured"}))).into_response(),
             };
             let resolved = services
                 .entry
@@ -239,15 +236,15 @@ pub async fn update_entry(
     let created_by = ctx.auth.actor.user_id();
     match services
         .entry
-        .update_entry(
-            &id,
-            &ctx.site_id,
-            payload.data.as_ref(),
-            payload.slug.as_deref(),
-            payload.status.as_deref(),
+        .update_entry(UpdateEntryInput {
+            id: &id,
+            site_id: &ctx.site_id,
+            data: payload.data.as_ref(),
+            slug: payload.slug.as_deref(),
+            status: payload.status.as_deref(),
             created_by,
-            payload.change_summary.as_deref(),
-        )
+            change_summary: payload.change_summary.as_deref(),
+        })
         .await
     {
         Ok(item) => (StatusCode::OK, Json(item)).into_response(),
diff --git a/apps/backend/src/handlers/file_handler.rs b/apps/backend/src/handlers/file_handler.rs
index ecbb279a..70cb0a93 100644
--- a/apps/backend/src/handlers/file_handler.rs
+++ b/apps/backend/src/handlers/file_handler.rs
@@ -24,6 +24,7 @@ use crate::models::file::{BatchFileIds, FileWithUrl};
 use crate::repository::Repository;
 use crate::repository::traits::ListFilesParams;
 use crate::services::Services;
+use crate::services::file::UploadFileRequest;
 use crate::storage::{StorageProvider, StorageRegistry};
 
 #[derive(Deserialize, utoipa::IntoParams)]
@@ -204,15 +205,15 @@ pub async fn upload_file(
 
     match services
         .file
-        .upload_file(
-            &site_id,
-            file_data,
-            &file_name,
-            &content_type,
+        .upload_file(UploadFileRequest {
+            site_id: &site_id,
+            data: file_data,
+            filename: &file_name,
+            content_type: &content_type,
             created_by,
             storage,
-            &storage_provider,
-        )
+            storage_provider: &storage_provider,
+        })
         .await
     {
         Ok(file) => (StatusCode::CREATED, Json(file)).into_response(),
diff --git a/apps/backend/src/handlers/singleton_handler.rs b/apps/backend/src/handlers/singleton_handler.rs
index bfbe8437..f3aa7643 100644
--- a/apps/backend/src/handlers/singleton_handler.rs
+++ b/apps/backend/src/handlers/singleton_handler.rs
@@ -24,14 +24,10 @@ use crate::storage::{StorageProvider, StorageRegistry};
 fn get_storage_for_site(
     site_storage_provider: &str,
     registry: &StorageRegistry,
-) -> Result<Arc<dyn StorageProvider>, Response> {
-    registry.get(site_storage_provider).ok_or_else(|| {
-        (
-            StatusCode::INTERNAL_SERVER_ERROR,
-            Json(json!({"error": "Storage not configured"})),
-        )
-            .into_response()
-    })
+) -> Result<Arc<dyn StorageProvider>, StatusCode> {
+    registry
+        .get(site_storage_provider)
+        .ok_or(StatusCode::INTERNAL_SERVER_ERROR)
 }
 
 #[utoipa::path(
@@ -91,7 +87,7 @@ pub async fn get_singleton(
         .unwrap_or_else(|_| "filesystem".into());
     let storage = match get_storage_for_site(&storage_provider, &storage_registry) {
         Ok(s) => s,
-        Err(resp) => return resp,
+        Err(status) => return (status, Json(json!({"error": "Storage not configured"}))).into_response(),
     };
 
     match services.singleton.get_singleton(&ctx.site_id, &slug, storage).await {

From 8e5d9815d9baa8ba6ef8342e7706d124f9ffe382 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:25:02 +0530
Subject: [PATCH 19/43] refactor: update gRPC layer to use input structs and
 InvalidToken error

---
 apps/backend/src/grpc/auth.rs           | 12 ++++++++----
 apps/backend/src/grpc/server.rs         |  5 ++++-
 apps/backend/src/grpc/services/entry.rs | 19 ++++++++++---------
 3 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/apps/backend/src/grpc/auth.rs b/apps/backend/src/grpc/auth.rs
index 7c169214..08e927f7 100644
--- a/apps/backend/src/grpc/auth.rs
+++ b/apps/backend/src/grpc/auth.rs
@@ -10,15 +10,19 @@ pub struct AuthContext {
     pub hmac: String,
 }
 
+/// Returned when a raw Bearer token fails format validation.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct InvalidToken;
+
 /// Parse and validate the raw Bearer token format.
 ///
-/// Returns an `AuthContext` on success, or `()` on any validation failure.
-pub fn parse_token(token: &str, config: &Config) -> Result<AuthContext, ()> {
+/// Returns an `AuthContext` on success, or `InvalidToken` on any validation failure.
+pub fn parse_token(token: &str, config: &Config) -> Result<AuthContext, InvalidToken> {
     if !token.starts_with("cms_site_") {
-        return Err(());
+        return Err(InvalidToken);
     }
 
-    let prefix = token.get(..24).ok_or(())?.to_string();
+    let prefix = token.get(..24).ok_or(InvalidToken)?.to_string();
     let hmac = compute_key_hmac(token, &config.hmac_secret);
 
     Ok(AuthContext {
diff --git a/apps/backend/src/grpc/server.rs b/apps/backend/src/grpc/server.rs
index fda8bf37..91ab03ae 100644
--- a/apps/backend/src/grpc/server.rs
+++ b/apps/backend/src/grpc/server.rs
@@ -18,6 +18,9 @@ use crate::repository::Repository;
 use crate::services::Services;
 use crate::storage::StorageRegistry;
 
+/// Boxed, pinned future returned by [`spawn_grpc_server`] (the gRPC server task).
+type GrpcServerFuture = Pin<Box<dyn Future<Output = Result<(), Box<dyn std::error::Error + Send + Sync>>> + Send>>;
+
 pub async fn start_grpc_server(
     services: Services,
     repository: Arc<Repository>,
@@ -102,7 +105,7 @@ pub fn spawn_grpc_server(
     config: Arc<Config>,
     storage_registry: Arc<StorageRegistry>,
     grpc_addr: SocketAddr,
-) -> Pin<Box<dyn Future<Output = Result<(), Box<dyn std::error::Error + Send + Sync>>> + Send>> {
+) -> GrpcServerFuture {
     Box::pin(start_grpc_server(
         services,
         repository,
diff --git a/apps/backend/src/grpc/services/entry.rs b/apps/backend/src/grpc/services/entry.rs
index c6977522..7fe048fc 100644
--- a/apps/backend/src/grpc/services/entry.rs
+++ b/apps/backend/src/grpc/services/entry.rs
@@ -14,6 +14,7 @@ use crate::models::entry::{Entry, EntryRevision};
 use crate::repository::Repository;
 use crate::repository::traits::ListEntriesParams;
 use crate::services::entry::EntryService as AppEntryService;
+use crate::services::entry::UpdateEntryInput;
 
 #[derive(Clone)]
 pub struct EntryServiceImpl {
@@ -112,15 +113,15 @@ impl EntryService for EntryServiceImpl {
 
         let entry = self
             .app_entry_service
-            .update_entry(
-                &req.id,
-                &site_id,
-                data.as_ref(),
-                req.slug.as_deref(),
-                req.status.as_deref(),
-                None,
-                req.change_summary.as_deref(),
-            )
+            .update_entry(UpdateEntryInput {
+                id: &req.id,
+                site_id: &site_id,
+                data: data.as_ref(),
+                slug: req.slug.as_deref(),
+                status: req.status.as_deref(),
+                created_by: None,
+                change_summary: req.change_summary.as_deref(),
+            })
             .await
             .map_err(|e| Status::internal(format!("Error: {}", e)))?;
 

From a6dd964b0c144aa34924855f2c7a1267fe2b7154 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:25:07 +0530
Subject: [PATCH 20/43] refactor: reorganize MCP server module order and use
 UpdateEntryInput

---
 apps/backend/src/mcp/server.rs      | 1306 +++++++++++++--------------
 apps/backend/src/mcp/tools/entry.rs |   19 +-
 2 files changed, 663 insertions(+), 662 deletions(-)

diff --git a/apps/backend/src/mcp/server.rs b/apps/backend/src/mcp/server.rs
index cabf7e9d..359f6106 100644
--- a/apps/backend/src/mcp/server.rs
+++ b/apps/backend/src/mcp/server.rs
@@ -1,653 +1,653 @@
-use std::sync::Arc;
-use std::time::Instant;
-
-use rmcp::handler::server::wrapper::Parameters;
-use rmcp::model::{
-    CallToolRequestParams, CallToolResult, Implementation, InitializeRequestParams, ListResourcesResult,
-    ListToolsResult, PaginatedRequestParams, ReadResourceRequestParams, ReadResourceResult, ServerCapabilities,
-    ServerInfo,
-};
-use rmcp::service::RequestContext;
-use rmcp::service::RoleServer;
-use rmcp::{ErrorData as McpError, ServerHandler, tool, tool_handler, tool_router};
-
-use crate::config::Config;
-use crate::middleware::auth::Actor;
-use crate::repository::Repository;
-use crate::services::Services;
-use crate::services::authorization::AuthorizationService;
-use crate::storage::StorageRegistry;
-
-use crate::mcp::resources::site_schema;
-use crate::mcp::tools::{collection, entry, file, singleton, site, webhook};
-
-#[derive(Clone)]
-pub struct CmsServer {
-    pub services: Arc<Services>,
-    pub repository: Arc<Repository>,
-    pub storage_registry: Arc<StorageRegistry>,
-    pub config: Arc<Config>,
-    pub authorizer: Arc<AuthorizationService>,
-    stdio_token: Option<Arc<str>>,
-}
-
-#[tool_router]
-impl CmsServer {
-    pub fn new(
-        services: Arc<Services>,
-        repository: Arc<Repository>,
-        storage_registry: Arc<StorageRegistry>,
-        config: Arc<Config>,
-    ) -> Self {
-        let authorizer = Arc::new(AuthorizationService::new(repository.user.clone()));
-        Self {
-            services,
-            repository,
-            storage_registry,
-            config,
-            authorizer,
-            stdio_token: None,
-        }
-    }
-
-    pub fn new_stdio(
-        services: Arc<Services>,
-        repository: Arc<Repository>,
-        storage_registry: Arc<StorageRegistry>,
-        config: Arc<Config>,
-        token: String,
-    ) -> Self {
-        let mut server = Self::new(services, repository, storage_registry, config);
-        server.stdio_token = Some(Arc::from(token));
-        server
-    }
-
-    #[tool(description = "Get details of a specific site by ID")]
-    async fn get_site(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<site::GetSiteParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        site::get_site(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Update a site's name")]
-    async fn update_site(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<site::UpdateSiteParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        site::update_site(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "List collections in a site")]
-    async fn list_collections(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<collection::ListCollectionsParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        collection::list_collections(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Get a collection by slug")]
-    async fn get_collection(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<collection::GetCollectionParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        collection::get_collection(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Create a new collection")]
-    async fn create_collection(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<collection::CreateCollectionParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        collection::create_collection(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Update a collection's definition")]
-    async fn update_collection(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<collection::UpdateCollectionParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        collection::update_collection(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Delete a collection")]
-    async fn delete_collection(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<collection::DeleteCollectionParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        collection::delete_collection(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "List entries in a site, optionally filtered by collection and status")]
-    async fn list_entries(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<entry::ListEntriesParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        entry::list_entries(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Get an entry by ID")]
-    async fn get_entry(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<entry::GetEntryParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        entry::get_entry(&self.authorizer, &self.services, &self.storage_registry, &actor, params).await
-    }
-
-    #[tool(description = "Create a new entry")]
-    async fn create_entry(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<entry::CreateEntryParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        entry::create_entry(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Update an entry")]
-    async fn update_entry(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<entry::UpdateEntryParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        entry::update_entry(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Delete an entry")]
-    async fn delete_entry(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<entry::DeleteEntryParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        entry::delete_entry(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Publish an entry")]
-    async fn publish_entry(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<entry::PublishEntryParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        entry::publish_entry(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Unpublish an entry")]
-    async fn unpublish_entry(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<entry::UnpublishEntryParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        entry::unpublish_entry(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "List singletons in a site")]
-    async fn list_singletons(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<singleton::ListSingletonsParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        singleton::list_singletons(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Get a singleton by slug")]
-    async fn get_singleton(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<singleton::GetSingletonParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        singleton::get_singleton(&self.authorizer, &self.services, &self.storage_registry, &actor, params).await
-    }
-
-    #[tool(description = "Update a singleton's data")]
-    async fn update_singleton(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<singleton::UpdateSingletonParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        singleton::update_singleton(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "List files in a site")]
-    async fn list_files(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<file::ListFilesParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        file::list_files(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Get file details by ID")]
-    async fn get_file(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<file::GetFileParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        file::get_file(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Create a signed upload URL for uploading a file")]
-    async fn create_upload_url(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<file::CreateUploadUrlParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        let public_base_url = self.public_base_url(&ctx);
-        file::create_upload_url(&self.authorizer, &self.config, &actor, public_base_url, params).await
-    }
-
-    #[tool(description = "Delete a file (soft delete)")]
-    async fn delete_file(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<file::DeleteFileParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        file::delete_file(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "List webhooks for a site")]
-    async fn list_webhooks(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<webhook::ListWebhooksParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        webhook::list_webhooks(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Create a webhook")]
-    async fn create_webhook(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<webhook::CreateWebhookParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        webhook::create_webhook(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Trigger a webhook")]
-    async fn trigger_webhook(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<webhook::TriggerWebhookParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        webhook::trigger_webhook(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Delete a webhook")]
-    async fn delete_webhook(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<webhook::DeleteWebhookParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        webhook::delete_webhook(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Get a webhook by ID")]
-    async fn get_webhook(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<webhook::GetWebhookParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        webhook::get_webhook(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Update a webhook")]
-    async fn update_webhook(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<webhook::UpdateWebhookParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        webhook::update_webhook(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "List delivery attempts for a webhook")]
-    async fn list_webhook_deliveries(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<webhook::ListWebhookDeliveriesParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        webhook::list_webhook_deliveries(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Restore a soft-deleted file")]
-    async fn restore_file(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<file::RestoreFileParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        file::restore_file(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "List revisions of an entry")]
-    async fn list_revisions(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<entry::ListRevisionsParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        entry::list_revisions(&self.authorizer, &self.services, &actor, params).await
-    }
-
-    #[tool(description = "Restore an entry to a previous revision")]
-    async fn restore_revision(
-        &self,
-        ctx: RequestContext<RoleServer>,
-        params: Parameters<entry::RestoreRevisionParams>,
-    ) -> Result<CallToolResult, McpError> {
-        let actor = self.resolve_actor(&ctx)?;
-        entry::restore_revision(&self.authorizer, &self.services, &actor, params).await
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::collections::HashSet;
-
-    use super::CmsServer;
-    use crate::mcp::schema::clean_input_schema;
-
-    #[test]
-    fn tool_router_lists_registered_tools() {
-        let tools = CmsServer::tool_router().list_all();
-        assert!(tools.iter().any(|tool| tool.name == "get_site"));
-        assert!(!tools.iter().any(|tool| tool.name.contains("token")));
-        assert!(!tools.iter().any(|tool| tool.name == "list_sites"));
-        assert!(tools.len() > 15);
-    }
-
-    fn all_tools() -> Vec<rmcp::model::Tool> {
-        CmsServer::tool_router().list_all()
-    }
-
-    #[test]
-    fn no_type_null_in_schemas() {
-        for tool in all_tools() {
-            let cleaned = clean_input_schema(tool.input_schema);
-            assert_eq!(
-                cleaned.get("type").and_then(|v| v.as_str()),
-                Some("object"),
-                "tool '{}' input_schema must have type 'object'",
-                tool.name
-            );
-        }
-    }
-
-    #[test]
-    fn no_boolean_properties_in_schemas() {
-        for tool in all_tools() {
-            let cleaned = clean_input_schema(tool.input_schema);
-            if let Some(props) = cleaned.get("properties").and_then(|v| v.as_object()) {
-                for (key, value) in props {
-                    assert!(
-                        value.is_object() || value.is_array(),
-                        "tool '{}' property '{}' must be a schema object, got {:?}",
-                        tool.name,
-                        key,
-                        value
-                    );
-                }
-            }
-        }
-    }
-
-    #[test]
-    fn all_input_schemas_are_valid_objects() {
-        for tool in all_tools() {
-            let cleaned = clean_input_schema(tool.input_schema);
-            assert!(
-                cleaned.get("type").and_then(|v| v.as_str()) == Some("object"),
-                "tool '{}' input_schema must have type 'object'",
-                tool.name
-            );
-            let has_properties = cleaned.contains_key("properties");
-            let has_required = cleaned.contains_key("required");
-            assert!(
-                has_properties || !has_required,
-                "tool '{}' has 'required' but no 'properties'",
-                tool.name
-            );
-        }
-    }
-
-    #[test]
-    fn no_type_null_anywhere() {
-        for tool in all_tools() {
-            let schema_str = serde_json::to_string(&*tool.input_schema).unwrap();
-            if schema_str.contains(r#""type":"null""#) {
-                panic!("tool '{}' still contains \"type\":\"null\"", tool.name,);
-            }
-        }
-    }
-
-    #[test]
-    fn no_boolean_schema_values() {
-        for tool in all_tools() {
-            if let Some(props) = tool.input_schema.get("properties").and_then(|v| v.as_object()) {
-                for (key, value) in props {
-                    if value.is_boolean() {
-                        panic!("tool '{}' property '{}' is boolean {:?}", tool.name, key, value);
-                    }
-                }
-            }
-        }
-    }
-
-    #[test]
-    fn cleaned_schemas_have_no_schema_or_title() {
-        for tool in all_tools() {
-            let cleaned = clean_input_schema(tool.input_schema);
-            assert!(
-                !cleaned.contains_key("$schema"),
-                "tool '{}' still has $schema",
-                tool.name
-            );
-            assert!(!cleaned.contains_key("title"), "tool '{}' still has title", tool.name);
-        }
-    }
-
-    #[test]
-    fn required_fields_are_subset_of_properties() {
-        for tool in all_tools() {
-            let cleaned = clean_input_schema(tool.input_schema);
-            let props: HashSet<&str> = cleaned
-                .get("properties")
-                .and_then(|v| v.as_object())
-                .map(|m| m.keys().map(|k| k.as_str()).collect())
-                .unwrap_or_default();
-            if let Some(required) = cleaned.get("required").and_then(|v| v.as_array()) {
-                for req in required {
-                    let req_str = req.as_str().unwrap_or("");
-                    assert!(
-                        props.contains(req_str),
-                        "tool '{}' required field '{}' not in properties",
-                        tool.name,
-                        req_str
-                    );
-                }
-            }
-        }
-    }
-}
-
-use crate::mcp::schema::clean_input_schema;
-
-#[tool_handler]
-impl ServerHandler for CmsServer {
-    fn get_info(&self) -> ServerInfo {
-        ServerInfo::new(ServerCapabilities::builder().enable_tools().enable_resources().build())
-            .with_server_info(Implementation::new("cms", env!("CARGO_PKG_VERSION")))
-    }
-
-    async fn initialize(
-        &self,
-        request: InitializeRequestParams,
-        mut context: RequestContext<RoleServer>,
-    ) -> Result<ServerInfo, McpError> {
-        let started = Instant::now();
-        self.authenticate_context(&mut context).await?;
-        if context.peer.peer_info().is_none() {
-            context.peer.set_peer_info(request.clone());
-        }
-        tracing::info!(
-            mcp_method = "initialize",
-            duration_ms = started.elapsed().as_millis(),
-            outcome = "success",
-            "MCP operation completed"
-        );
-        Ok(self.get_info().with_protocol_version(request.protocol_version))
-    }
-
-    async fn list_tools(
-        &self,
-        _request: Option<PaginatedRequestParams>,
-        mut ctx: RequestContext<RoleServer>,
-    ) -> Result<ListToolsResult, McpError> {
-        let started = Instant::now();
-        self.authenticate_context(&mut ctx).await?;
-        let tools = Self::tool_router()
-            .list_all()
-            .into_iter()
-            .map(|mut tool| {
-                tool.input_schema = clean_input_schema(tool.input_schema);
-                tool
-            })
-            .collect();
-        let result = ListToolsResult {
-            tools,
-            meta: None,
-            next_cursor: None,
-        };
-        tracing::info!(
-            mcp_method = "tools/list",
-            duration_ms = started.elapsed().as_millis(),
-            outcome = "success",
-            "MCP operation completed"
-        );
-        Ok(result)
-    }
-
-    async fn call_tool(
-        &self,
-        request: CallToolRequestParams,
-        mut ctx: RequestContext<RoleServer>,
-    ) -> Result<CallToolResult, McpError> {
-        let started = Instant::now();
-        let tool_name = request.name.to_string();
-        self.authenticate_context(&mut ctx).await?;
-        let tool_context = rmcp::handler::server::tool::ToolCallContext::new(self, request, ctx);
-        let result = Self::tool_router().call(tool_context).await;
-        tracing::info!(
-            mcp_method = "tools/call",
-            mcp_tool = %tool_name,
-            duration_ms = started.elapsed().as_millis(),
-            outcome = if result.is_ok() { "success" } else { "error" },
-            "MCP operation completed"
-        );
-        result
-    }
-
-    async fn list_resources(
-        &self,
-        request: Option<PaginatedRequestParams>,
-        mut ctx: RequestContext<RoleServer>,
-    ) -> Result<ListResourcesResult, McpError> {
-        let started = Instant::now();
-        let actor = self.authenticate_context(&mut ctx).await?;
-        let result = site_schema::list_resources(&self.authorizer, &self.services, &actor, request).await;
-        tracing::info!(
-            mcp_method = "resources/list",
-            duration_ms = started.elapsed().as_millis(),
-            outcome = if result.is_ok() { "success" } else { "error" },
-            "MCP operation completed"
-        );
-        result
-    }
-
-    async fn read_resource(
-        &self,
-        request: ReadResourceRequestParams,
-        mut ctx: RequestContext<RoleServer>,
-    ) -> Result<ReadResourceResult, McpError> {
-        let started = Instant::now();
-        let actor = self.authenticate_context(&mut ctx).await?;
-        let result = site_schema::read_resource(&self.authorizer, &self.services, &actor, &request.uri).await;
-        tracing::info!(
-            mcp_method = "resources/read",
-            duration_ms = started.elapsed().as_millis(),
-            outcome = if result.is_ok() { "success" } else { "error" },
-            "MCP operation completed"
-        );
-        result
-    }
-}
-
-impl CmsServer {
-    async fn authenticate_context(&self, ctx: &mut RequestContext<RoleServer>) -> Result<Actor, McpError> {
-        if let Some(token) = &self.stdio_token {
-            let actor = crate::mcp::auth::verify_stdio_token(token, &self.repository, &self.config.hmac_secret).await?;
-            ctx.extensions.insert(actor.clone());
-            return Ok(actor);
-        }
-
-        self.resolve_actor(ctx)
-    }
-
-    fn resolve_actor(&self, ctx: &RequestContext<RoleServer>) -> Result<Actor, McpError> {
-        crate::mcp::auth::resolve_actor(ctx)
-    }
-
-    fn public_base_url(&self, ctx: &RequestContext<RoleServer>) -> Option<String> {
-        if let Some(public_url) = &self.config.public_url {
-            return Some(public_url.clone());
-        }
-
-        let parts = ctx.extensions.get::<http::request::Parts>()?;
-        let headers = &parts.headers;
-        let host = headers
-            .get("x-forwarded-host")
-            .or_else(|| headers.get("host"))?
-            .to_str()
-            .ok()?;
-        let proto = headers
-            .get("x-forwarded-proto")
-            .and_then(|value| value.to_str().ok())
-            .unwrap_or("http");
-
-        Some(format!("{}://{}", proto, host).trim_end_matches('/').to_string())
-    }
-}
+use std::sync::Arc;
+use std::time::Instant;
+
+use rmcp::handler::server::wrapper::Parameters;
+use rmcp::model::{
+    CallToolRequestParams, CallToolResult, Implementation, InitializeRequestParams, ListResourcesResult,
+    ListToolsResult, PaginatedRequestParams, ReadResourceRequestParams, ReadResourceResult, ServerCapabilities,
+    ServerInfo,
+};
+use rmcp::service::RequestContext;
+use rmcp::service::RoleServer;
+use rmcp::{ErrorData as McpError, ServerHandler, tool, tool_handler, tool_router};
+
+use crate::config::Config;
+use crate::middleware::auth::Actor;
+use crate::repository::Repository;
+use crate::services::Services;
+use crate::services::authorization::AuthorizationService;
+use crate::storage::StorageRegistry;
+
+use crate::mcp::resources::site_schema;
+use crate::mcp::tools::{collection, entry, file, singleton, site, webhook};
+
+#[derive(Clone)]
+pub struct CmsServer {
+    pub services: Arc<Services>,
+    pub repository: Arc<Repository>,
+    pub storage_registry: Arc<StorageRegistry>,
+    pub config: Arc<Config>,
+    pub authorizer: Arc<AuthorizationService>,
+    stdio_token: Option<Arc<str>>,
+}
+
+#[tool_router]
+impl CmsServer {
+    pub fn new(
+        services: Arc<Services>,
+        repository: Arc<Repository>,
+        storage_registry: Arc<StorageRegistry>,
+        config: Arc<Config>,
+    ) -> Self {
+        let authorizer = Arc::new(AuthorizationService::new(repository.user.clone()));
+        Self {
+            services,
+            repository,
+            storage_registry,
+            config,
+            authorizer,
+            stdio_token: None,
+        }
+    }
+
+    pub fn new_stdio(
+        services: Arc<Services>,
+        repository: Arc<Repository>,
+        storage_registry: Arc<StorageRegistry>,
+        config: Arc<Config>,
+        token: String,
+    ) -> Self {
+        let mut server = Self::new(services, repository, storage_registry, config);
+        server.stdio_token = Some(Arc::from(token));
+        server
+    }
+
+    #[tool(description = "Get details of a specific site by ID")]
+    async fn get_site(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<site::GetSiteParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        site::get_site(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Update a site's name")]
+    async fn update_site(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<site::UpdateSiteParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        site::update_site(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "List collections in a site")]
+    async fn list_collections(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<collection::ListCollectionsParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        collection::list_collections(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Get a collection by slug")]
+    async fn get_collection(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<collection::GetCollectionParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        collection::get_collection(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Create a new collection")]
+    async fn create_collection(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<collection::CreateCollectionParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        collection::create_collection(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Update a collection's definition")]
+    async fn update_collection(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<collection::UpdateCollectionParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        collection::update_collection(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Delete a collection")]
+    async fn delete_collection(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<collection::DeleteCollectionParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        collection::delete_collection(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "List entries in a site, optionally filtered by collection and status")]
+    async fn list_entries(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<entry::ListEntriesParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        entry::list_entries(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Get an entry by ID")]
+    async fn get_entry(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<entry::GetEntryParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        entry::get_entry(&self.authorizer, &self.services, &self.storage_registry, &actor, params).await
+    }
+
+    #[tool(description = "Create a new entry")]
+    async fn create_entry(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<entry::CreateEntryParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        entry::create_entry(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Update an entry")]
+    async fn update_entry(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<entry::UpdateEntryParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        entry::update_entry(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Delete an entry")]
+    async fn delete_entry(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<entry::DeleteEntryParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        entry::delete_entry(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Publish an entry")]
+    async fn publish_entry(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<entry::PublishEntryParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        entry::publish_entry(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Unpublish an entry")]
+    async fn unpublish_entry(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<entry::UnpublishEntryParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        entry::unpublish_entry(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "List singletons in a site")]
+    async fn list_singletons(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<singleton::ListSingletonsParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        singleton::list_singletons(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Get a singleton by slug")]
+    async fn get_singleton(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<singleton::GetSingletonParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        singleton::get_singleton(&self.authorizer, &self.services, &self.storage_registry, &actor, params).await
+    }
+
+    #[tool(description = "Update a singleton's data")]
+    async fn update_singleton(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<singleton::UpdateSingletonParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        singleton::update_singleton(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "List files in a site")]
+    async fn list_files(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<file::ListFilesParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        file::list_files(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Get file details by ID")]
+    async fn get_file(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<file::GetFileParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        file::get_file(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Create a signed upload URL for uploading a file")]
+    async fn create_upload_url(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<file::CreateUploadUrlParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        let public_base_url = self.public_base_url(&ctx);
+        file::create_upload_url(&self.authorizer, &self.config, &actor, public_base_url, params).await
+    }
+
+    #[tool(description = "Delete a file (soft delete)")]
+    async fn delete_file(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<file::DeleteFileParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        file::delete_file(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "List webhooks for a site")]
+    async fn list_webhooks(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<webhook::ListWebhooksParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        webhook::list_webhooks(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Create a webhook")]
+    async fn create_webhook(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<webhook::CreateWebhookParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        webhook::create_webhook(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Trigger a webhook")]
+    async fn trigger_webhook(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<webhook::TriggerWebhookParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        webhook::trigger_webhook(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Delete a webhook")]
+    async fn delete_webhook(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<webhook::DeleteWebhookParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        webhook::delete_webhook(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Get a webhook by ID")]
+    async fn get_webhook(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<webhook::GetWebhookParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        webhook::get_webhook(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Update a webhook")]
+    async fn update_webhook(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<webhook::UpdateWebhookParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        webhook::update_webhook(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "List delivery attempts for a webhook")]
+    async fn list_webhook_deliveries(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<webhook::ListWebhookDeliveriesParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        webhook::list_webhook_deliveries(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Restore a soft-deleted file")]
+    async fn restore_file(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<file::RestoreFileParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        file::restore_file(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "List revisions of an entry")]
+    async fn list_revisions(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<entry::ListRevisionsParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        entry::list_revisions(&self.authorizer, &self.services, &actor, params).await
+    }
+
+    #[tool(description = "Restore an entry to a previous revision")]
+    async fn restore_revision(
+        &self,
+        ctx: RequestContext<RoleServer>,
+        params: Parameters<entry::RestoreRevisionParams>,
+    ) -> Result<CallToolResult, McpError> {
+        let actor = self.resolve_actor(&ctx)?;
+        entry::restore_revision(&self.authorizer, &self.services, &actor, params).await
+    }
+}
+
+use crate::mcp::schema::clean_input_schema;
+
+#[tool_handler]
+impl ServerHandler for CmsServer {
+    fn get_info(&self) -> ServerInfo {
+        ServerInfo::new(ServerCapabilities::builder().enable_tools().enable_resources().build())
+            .with_server_info(Implementation::new("cms", env!("CARGO_PKG_VERSION")))
+    }
+
+    async fn initialize(
+        &self,
+        request: InitializeRequestParams,
+        mut context: RequestContext<RoleServer>,
+    ) -> Result<ServerInfo, McpError> {
+        let started = Instant::now();
+        self.authenticate_context(&mut context).await?;
+        if context.peer.peer_info().is_none() {
+            context.peer.set_peer_info(request.clone());
+        }
+        tracing::info!(
+            mcp_method = "initialize",
+            duration_ms = started.elapsed().as_millis(),
+            outcome = "success",
+            "MCP operation completed"
+        );
+        Ok(self.get_info().with_protocol_version(request.protocol_version))
+    }
+
+    async fn list_tools(
+        &self,
+        _request: Option<PaginatedRequestParams>,
+        mut ctx: RequestContext<RoleServer>,
+    ) -> Result<ListToolsResult, McpError> {
+        let started = Instant::now();
+        self.authenticate_context(&mut ctx).await?;
+        let tools = Self::tool_router()
+            .list_all()
+            .into_iter()
+            .map(|mut tool| {
+                tool.input_schema = clean_input_schema(tool.input_schema);
+                tool
+            })
+            .collect();
+        let result = ListToolsResult {
+            tools,
+            meta: None,
+            next_cursor: None,
+        };
+        tracing::info!(
+            mcp_method = "tools/list",
+            duration_ms = started.elapsed().as_millis(),
+            outcome = "success",
+            "MCP operation completed"
+        );
+        Ok(result)
+    }
+
+    async fn call_tool(
+        &self,
+        request: CallToolRequestParams,
+        mut ctx: RequestContext<RoleServer>,
+    ) -> Result<CallToolResult, McpError> {
+        let started = Instant::now();
+        let tool_name = request.name.to_string();
+        self.authenticate_context(&mut ctx).await?;
+        let tool_context = rmcp::handler::server::tool::ToolCallContext::new(self, request, ctx);
+        let result = Self::tool_router().call(tool_context).await;
+        tracing::info!(
+            mcp_method = "tools/call",
+            mcp_tool = %tool_name,
+            duration_ms = started.elapsed().as_millis(),
+            outcome = if result.is_ok() { "success" } else { "error" },
+            "MCP operation completed"
+        );
+        result
+    }
+
+    async fn list_resources(
+        &self,
+        request: Option<PaginatedRequestParams>,
+        mut ctx: RequestContext<RoleServer>,
+    ) -> Result<ListResourcesResult, McpError> {
+        let started = Instant::now();
+        let actor = self.authenticate_context(&mut ctx).await?;
+        let result = site_schema::list_resources(&self.authorizer, &self.services, &actor, request).await;
+        tracing::info!(
+            mcp_method = "resources/list",
+            duration_ms = started.elapsed().as_millis(),
+            outcome = if result.is_ok() { "success" } else { "error" },
+            "MCP operation completed"
+        );
+        result
+    }
+
+    async fn read_resource(
+        &self,
+        request: ReadResourceRequestParams,
+        mut ctx: RequestContext<RoleServer>,
+    ) -> Result<ReadResourceResult, McpError> {
+        let started = Instant::now();
+        let actor = self.authenticate_context(&mut ctx).await?;
+        let result = site_schema::read_resource(&self.authorizer, &self.services, &actor, &request.uri).await;
+        tracing::info!(
+            mcp_method = "resources/read",
+            duration_ms = started.elapsed().as_millis(),
+            outcome = if result.is_ok() { "success" } else { "error" },
+            "MCP operation completed"
+        );
+        result
+    }
+}
+
+impl CmsServer {
+    async fn authenticate_context(&self, ctx: &mut RequestContext<RoleServer>) -> Result<Actor, McpError> {
+        if let Some(token) = &self.stdio_token {
+            let actor = crate::mcp::auth::verify_stdio_token(token, &self.repository, &self.config.hmac_secret).await?;
+            ctx.extensions.insert(actor.clone());
+            return Ok(actor);
+        }
+
+        self.resolve_actor(ctx)
+    }
+
+    fn resolve_actor(&self, ctx: &RequestContext<RoleServer>) -> Result<Actor, McpError> {
+        crate::mcp::auth::resolve_actor(ctx)
+    }
+
+    fn public_base_url(&self, ctx: &RequestContext<RoleServer>) -> Option<String> {
+        if let Some(public_url) = &self.config.public_url {
+            return Some(public_url.clone());
+        }
+
+        let parts = ctx.extensions.get::<http::request::Parts>()?;
+        let headers = &parts.headers;
+        let host = headers
+            .get("x-forwarded-host")
+            .or_else(|| headers.get("host"))?
+            .to_str()
+            .ok()?;
+        let proto = headers
+            .get("x-forwarded-proto")
+            .and_then(|value| value.to_str().ok())
+            .unwrap_or("http");
+
+        Some(format!("{}://{}", proto, host).trim_end_matches('/').to_string())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashSet;
+
+    use super::CmsServer;
+    use crate::mcp::schema::clean_input_schema;
+
+    #[test]
+    fn tool_router_lists_registered_tools() {
+        let tools = CmsServer::tool_router().list_all();
+        assert!(tools.iter().any(|tool| tool.name == "get_site"));
+        assert!(!tools.iter().any(|tool| tool.name.contains("token")));
+        assert!(!tools.iter().any(|tool| tool.name == "list_sites"));
+        assert!(tools.len() > 15);
+    }
+
+    fn all_tools() -> Vec<rmcp::model::Tool> {
+        CmsServer::tool_router().list_all()
+    }
+
+    #[test]
+    fn no_type_null_in_schemas() {
+        for tool in all_tools() {
+            let cleaned = clean_input_schema(tool.input_schema);
+            assert_eq!(
+                cleaned.get("type").and_then(|v| v.as_str()),
+                Some("object"),
+                "tool '{}' input_schema must have type 'object'",
+                tool.name
+            );
+        }
+    }
+
+    #[test]
+    fn no_boolean_properties_in_schemas() {
+        for tool in all_tools() {
+            let cleaned = clean_input_schema(tool.input_schema);
+            if let Some(props) = cleaned.get("properties").and_then(|v| v.as_object()) {
+                for (key, value) in props {
+                    assert!(
+                        value.is_object() || value.is_array(),
+                        "tool '{}' property '{}' must be a schema object, got {:?}",
+                        tool.name,
+                        key,
+                        value
+                    );
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn all_input_schemas_are_valid_objects() {
+        for tool in all_tools() {
+            let cleaned = clean_input_schema(tool.input_schema);
+            assert!(
+                cleaned.get("type").and_then(|v| v.as_str()) == Some("object"),
+                "tool '{}' input_schema must have type 'object'",
+                tool.name
+            );
+            let has_properties = cleaned.contains_key("properties");
+            let has_required = cleaned.contains_key("required");
+            assert!(
+                has_properties || !has_required,
+                "tool '{}' has 'required' but no 'properties'",
+                tool.name
+            );
+        }
+    }
+
+    #[test]
+    fn no_type_null_anywhere() {
+        for tool in all_tools() {
+            let schema_str = serde_json::to_string(&*tool.input_schema).unwrap();
+            if schema_str.contains(r#""type":"null""#) {
+                panic!("tool '{}' still contains \"type\":\"null\"", tool.name,);
+            }
+        }
+    }
+
+    #[test]
+    fn no_boolean_schema_values() {
+        for tool in all_tools() {
+            if let Some(props) = tool.input_schema.get("properties").and_then(|v| v.as_object()) {
+                for (key, value) in props {
+                    if value.is_boolean() {
+                        panic!("tool '{}' property '{}' is boolean {:?}", tool.name, key, value);
+                    }
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn cleaned_schemas_have_no_schema_or_title() {
+        for tool in all_tools() {
+            let cleaned = clean_input_schema(tool.input_schema);
+            assert!(
+                !cleaned.contains_key("$schema"),
+                "tool '{}' still has $schema",
+                tool.name
+            );
+            assert!(!cleaned.contains_key("title"), "tool '{}' still has title", tool.name);
+        }
+    }
+
+    #[test]
+    fn required_fields_are_subset_of_properties() {
+        for tool in all_tools() {
+            let cleaned = clean_input_schema(tool.input_schema);
+            let props: HashSet<&str> = cleaned
+                .get("properties")
+                .and_then(|v| v.as_object())
+                .map(|m| m.keys().map(|k| k.as_str()).collect())
+                .unwrap_or_default();
+            if let Some(required) = cleaned.get("required").and_then(|v| v.as_array()) {
+                for req in required {
+                    let req_str = req.as_str().unwrap_or("");
+                    assert!(
+                        props.contains(req_str),
+                        "tool '{}' required field '{}' not in properties",
+                        tool.name,
+                        req_str
+                    );
+                }
+            }
+        }
+    }
+}
diff --git a/apps/backend/src/mcp/tools/entry.rs b/apps/backend/src/mcp/tools/entry.rs
index 4735abf4..8f045ce6 100644
--- a/apps/backend/src/mcp/tools/entry.rs
+++ b/apps/backend/src/mcp/tools/entry.rs
@@ -11,6 +11,7 @@ use crate::mcp::schema::ArbitraryJson;
 use crate::middleware::auth::Actor;
 use crate::models::authorization::Action;
 use crate::repository::traits::ListEntriesParams as RepoListEntriesParams;
+use crate::services::entry::UpdateEntryInput;
 use crate::services::{Services, authorization::AuthorizationService};
 use crate::storage::StorageRegistry;
 
@@ -166,15 +167,15 @@ pub async fn update_entry(
     }
     match services
         .entry
-        .update_entry(
-            &params.0.id,
-            &site_id,
-            params.0.values.as_ref(),
-            params.0.slug.as_deref(),
-            params.0.published.map(|b| if b { "published" } else { "draft" }),
-            None,
-            params.0.change_summary.as_deref(),
-        )
+        .update_entry(UpdateEntryInput {
+            id: &params.0.id,
+            site_id: &site_id,
+            data: params.0.values.as_ref(),
+            slug: params.0.slug.as_deref(),
+            status: params.0.published.map(|b| if b { "published" } else { "draft" }),
+            created_by: None,
+            change_summary: params.0.change_summary.as_deref(),
+        })
         .await
     {
         Ok(entry) => ok_result(&entry),

From 395e81c2ff77fa260e69397fc059e8a6d8e85f4b Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:25:13 +0530
Subject: [PATCH 21/43] chore: suppress clippy::too_many_arguments on GraphQL
 entries query

---
 apps/backend/src/graphql/query/mod.rs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/apps/backend/src/graphql/query/mod.rs b/apps/backend/src/graphql/query/mod.rs
index 01e2e48f..9ed0d989 100644
--- a/apps/backend/src/graphql/query/mod.rs
+++ b/apps/backend/src/graphql/query/mod.rs
@@ -67,6 +67,10 @@ impl QueryRoot {
         Ok(super::types::collection::db_collection_to_gql(db_collection))
     }
 
+    // Each parameter is a GraphQL field argument exposed in the public schema and
+    // consumed positionally by the dashboard's queries; collapsing them into an
+    // input object would be a breaking schema change, so the arg count stands.
+    #[allow(clippy::too_many_arguments)]
     async fn entries(
         &self,
         ctx: &Context<'_>,

From 3c5043d512c6ff37c1772a9a1cb88d8cc0425044 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:25:18 +0530
Subject: [PATCH 22/43] style: fix doc comment indentation in search schema

---
 apps/backend/src/services/search/schema.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/backend/src/services/search/schema.rs b/apps/backend/src/services/search/schema.rs
index b4204575..12695abc 100644
--- a/apps/backend/src/services/search/schema.rs
+++ b/apps/backend/src/services/search/schema.rs
@@ -10,7 +10,7 @@
 //! - `status`        — exact-match filter (`draft` / `published`).
 //! - `slug`          — tokenized + stored, lightly searchable.
 //! - `body`          — the flattened, tokenized text of all scalar values in
-//!                     `entries.data`; the main ranked field.
+//!   `entries.data`; the main ranked field.
 //!
 //! `body`/`slug` use an English-stemming analyzer so "running" matches "run".
 

From aa77e186611bfa46fd0135ed4ca6a368909ecd4a Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:25:23 +0530
Subject: [PATCH 23/43] test: update integration tests for API changes

---
 apps/backend/tests/common/grpc.rs             | 36 +++++-----
 apps/backend/tests/common/server.rs           | 71 ++++++++++---------
 .../tests/graphql/collections_tests.rs        |  6 +-
 apps/backend/tests/graphql/entries_tests.rs   |  2 +-
 apps/backend/tests/graphql/files_tests.rs     |  4 +-
 apps/backend/tests/graphql/webhooks_tests.rs  |  2 +-
 apps/backend/tests/grpc/files_tests.rs        |  2 +-
 apps/backend/tests/grpc/webhooks_tests.rs     |  6 +-
 apps/backend/tests/mcp_stdio.rs               |  7 +-
 apps/backend/tests/rest/backups_tests.rs      |  5 +-
 apps/backend/tests/rest/collections_tests.rs  |  9 ++-
 apps/backend/tests/rest/roles_tests.rs        |  8 ++-
 12 files changed, 87 insertions(+), 71 deletions(-)

diff --git a/apps/backend/tests/common/grpc.rs b/apps/backend/tests/common/grpc.rs
index ac8e65b5..7df1239e 100644
--- a/apps/backend/tests/common/grpc.rs
+++ b/apps/backend/tests/common/grpc.rs
@@ -41,23 +41,25 @@ impl GrpcTestContext {
         let storage_dir = tempfile::tempdir().expect("Failed to create temp storage dir");
         let storage_path = storage_dir.path().to_str().unwrap().to_string();
 
-        let mut config = Config::default();
-        config.database_url = "sqlite::memory:".to_string();
-        config.hmac_secret = "test-hmac-secret-integration".to_string();
-        config.storage_fs_path = Some(storage_path.clone());
-        config.cookie_secure = false;
-        config.mcp_enabled = false;
-        config.rate_limit_max_requests = 10000;
-        config.rate_limit_window_secs = 60;
-        config.db_max_connections = 5;
-        config.db_min_connections = 1;
-        config.db_acquire_timeout_secs = 30;
-        config.db_idle_timeout_secs = 600;
-        config.max_upload_size_bytes = 50 * 1024 * 1024;
-        config.public_registration_enabled = true;
-        config.bcrypt_cost = bcrypt::DEFAULT_COST;
-        config.webhook_allow_private_targets = true;
-        config.backup_local_path = Some(format!("{storage_path}/backups"));
+        let config = Config {
+            database_url: "sqlite::memory:".to_string(),
+            hmac_secret: "test-hmac-secret-integration".to_string(),
+            storage_fs_path: Some(storage_path.clone()),
+            cookie_secure: false,
+            mcp_enabled: false,
+            rate_limit_max_requests: 10000,
+            rate_limit_window_secs: 60,
+            db_max_connections: 5,
+            db_min_connections: 1,
+            db_acquire_timeout_secs: 30,
+            db_idle_timeout_secs: 600,
+            max_upload_size_bytes: 50 * 1024 * 1024,
+            public_registration_enabled: true,
+            bcrypt_cost: bcrypt::DEFAULT_COST,
+            webhook_allow_private_targets: true,
+            backup_local_path: Some(format!("{storage_path}/backups")),
+            ..Default::default()
+        };
 
         let pool = init_db_with_config(&config)
             .await
diff --git a/apps/backend/tests/common/server.rs b/apps/backend/tests/common/server.rs
index b89b88f6..f47851db 100644
--- a/apps/backend/tests/common/server.rs
+++ b/apps/backend/tests/common/server.rs
@@ -49,41 +49,42 @@ impl TestServer {
         // `TEST_DATABASE` selects one. The handle drops the database on teardown.
         let (database_url, db_handle) = super::test_db::provision().await;
 
-        let mut config = Config::default();
-        config.database_url = database_url;
-        config.hmac_secret = "test-hmac-secret-integration".to_string();
-        config.storage_fs_path = Some(storage_path.clone());
-        config.cookie_secure = false;
-        // Real config defaults this to 24h; `Config::default()` leaves it 0, which
-        // mints already-expired sessions. SQLite hid that (it compares the datetime
-        // columns lexicographically, where the stored `…T…+00:00` sorts above
-        // `datetime('now')`); Postgres/MySQL do a real timestamp compare and reject.
-        config.session_lifetime_hours = 24;
-        config.mcp_enabled = true;
-        config.mcp_allowed_hosts = vec!["127.0.0.1".to_string()];
-        config.mcp_allowed_origins = vec![];
-        config.rate_limit_max_requests = 10000;
-        config.rate_limit_window_secs = 60;
-        // Tests spin up many servers in parallel against one shared Postgres/MySQL
-        // instance. Keep each pool tiny and release idle connections fast so the
-        // aggregate stays well under the server's connection ceiling (Postgres
-        // defaults to 100); otherwise high-core CI runners intermittently exhaust
-        // it. A single TestServer needs almost no internal concurrency.
-        config.db_max_connections = 2;
-        config.db_min_connections = 1;
-        config.db_acquire_timeout_secs = 30;
-        config.db_idle_timeout_secs = 5;
-        config.max_upload_size_bytes = 50 * 1024 * 1024;
-        config.public_registration_enabled = true;
-        config.bcrypt_cost = bcrypt::DEFAULT_COST;
-        config.webhook_allow_private_targets = true;
-        config.backup_local_path = Some(storage_dir.path().join("backups").to_string_lossy().into_owned());
-        // Deterministic 32-byte (hex) key so encrypted-backup tests can round-trip.
-        config.backup_encryption_key =
-            Some("00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff".to_string());
-        config.backup_enabled = false; // don't run the poller during tests
-        config.search_enabled = search_enabled;
-        config.search_index_path = Some(storage_dir.path().join("search").to_string_lossy().into_owned());
+        let config = Config {
+            database_url,
+            hmac_secret: "test-hmac-secret-integration".to_string(),
+            storage_fs_path: Some(storage_path.clone()),
+            cookie_secure: false,
+            // Real config defaults this to 24h; `Config::default()` leaves it 0, which
+            // mints already-expired sessions. SQLite hid that (it compares the datetime
+            // columns lexicographically, where the stored `…T…+00:00` sorts above
+            // `datetime('now')`); Postgres/MySQL do a real timestamp compare and reject.
+            session_lifetime_hours: 24,
+            mcp_enabled: true,
+            mcp_allowed_hosts: vec!["127.0.0.1".to_string()],
+            mcp_allowed_origins: vec![],
+            rate_limit_max_requests: 10000,
+            rate_limit_window_secs: 60,
+            // Tests spin up many servers in parallel against one shared Postgres/MySQL
+            // instance. Keep each pool tiny and release idle connections fast so the
+            // aggregate stays well under the server's connection ceiling (Postgres
+            // defaults to 100); otherwise high-core CI runners intermittently exhaust
+            // it. A single TestServer needs almost no internal concurrency.
+            db_max_connections: 2,
+            db_min_connections: 1,
+            db_acquire_timeout_secs: 30,
+            db_idle_timeout_secs: 5,
+            max_upload_size_bytes: 50 * 1024 * 1024,
+            public_registration_enabled: true,
+            bcrypt_cost: bcrypt::DEFAULT_COST,
+            webhook_allow_private_targets: true,
+            backup_local_path: Some(storage_dir.path().join("backups").to_string_lossy().into_owned()),
+            // Deterministic 32-byte (hex) key so encrypted-backup tests can round-trip.
+            backup_encryption_key: Some("00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff".to_string()),
+            backup_enabled: false, // don't run the poller during tests
+            search_enabled,
+            search_index_path: Some(storage_dir.path().join("search").to_string_lossy().into_owned()),
+            ..Default::default()
+        };
 
         let pool = init_db_with_config(&config)
             .await
diff --git a/apps/backend/tests/graphql/collections_tests.rs b/apps/backend/tests/graphql/collections_tests.rs
index 01d542a8..0caeedb4 100644
--- a/apps/backend/tests/graphql/collections_tests.rs
+++ b/apps/backend/tests/graphql/collections_tests.rs
@@ -165,7 +165,7 @@ async fn test_delete_collection_mutation() {
 
     let body = gql(&server, &token, r#"mutation { deleteCollection(slug: "to-delete") }"#).await;
     assert!(body["errors"].is_null());
-    assert_eq!(body["data"]["deleteCollection"].as_bool().unwrap(), true);
+    assert!(body["data"]["deleteCollection"].as_bool().unwrap());
 }
 
 #[tokio::test]
@@ -177,7 +177,7 @@ async fn test_create_singleton_collection() {
     assert!(body["errors"].is_null(), "errors: {:?}", body["errors"]);
     assert_eq!(body["data"]["createCollection"]["name"].as_str().unwrap(), "Settings");
     assert_eq!(body["data"]["createCollection"]["slug"].as_str().unwrap(), "settings");
-    assert_eq!(body["data"]["createCollection"]["isSingleton"].as_bool().unwrap(), true);
+    assert!(body["data"]["createCollection"]["isSingleton"].as_bool().unwrap());
 }
 
 #[tokio::test]
@@ -225,5 +225,5 @@ async fn test_collection_not_singleton() {
 
     let body = gql(&server, &token, r#"{ collection(slug: "regular") { id isSingleton } }"#).await;
     assert!(body["errors"].is_null(), "errors: {:?}", body["errors"]);
-    assert_eq!(body["data"]["collection"]["isSingleton"].as_bool().unwrap(), false);
+    assert!(!body["data"]["collection"]["isSingleton"].as_bool().unwrap());
 }
diff --git a/apps/backend/tests/graphql/entries_tests.rs b/apps/backend/tests/graphql/entries_tests.rs
index 95691339..a976c691 100644
--- a/apps/backend/tests/graphql/entries_tests.rs
+++ b/apps/backend/tests/graphql/entries_tests.rs
@@ -286,7 +286,7 @@ async fn test_delete_entry_mutation() {
     let query = format!(r#"mutation {{ deleteEntry(id: "{}") }}"#, entry_id);
     let body = gql(&server, &token, &query).await;
     assert!(body["errors"].is_null());
-    assert_eq!(body["data"]["deleteEntry"].as_bool().unwrap(), true);
+    assert!(body["data"]["deleteEntry"].as_bool().unwrap());
 }
 
 #[tokio::test]
diff --git a/apps/backend/tests/graphql/files_tests.rs b/apps/backend/tests/graphql/files_tests.rs
index 96697a28..7b09b700 100644
--- a/apps/backend/tests/graphql/files_tests.rs
+++ b/apps/backend/tests/graphql/files_tests.rs
@@ -170,7 +170,7 @@ async fn test_delete_file_mutation() {
     let query = format!(r#"mutation {{ deleteFile(id: "{}") }}"#, file_id);
     let body = gql(&server, &token, &query).await;
     assert!(body["errors"].is_null());
-    assert_eq!(body["data"]["deleteFile"].as_bool().unwrap(), true);
+    assert!(body["data"]["deleteFile"].as_bool().unwrap());
 }
 
 #[tokio::test]
@@ -195,7 +195,7 @@ async fn test_restore_file_mutation() {
     let query = format!(r#"mutation {{ restoreFile(id: "{}") }}"#, file_id);
     let body = gql(&server, &token, &query).await;
     assert!(body["errors"].is_null());
-    assert_eq!(body["data"]["restoreFile"].as_bool().unwrap(), true);
+    assert!(body["data"]["restoreFile"].as_bool().unwrap());
 }
 
 #[tokio::test]
diff --git a/apps/backend/tests/graphql/webhooks_tests.rs b/apps/backend/tests/graphql/webhooks_tests.rs
index a7951cb0..0a80a89d 100644
--- a/apps/backend/tests/graphql/webhooks_tests.rs
+++ b/apps/backend/tests/graphql/webhooks_tests.rs
@@ -162,7 +162,7 @@ async fn test_delete_webhook_mutation() {
     );
     let body = gql(&server, &token, &query).await;
     assert!(body["errors"].is_null());
-    assert_eq!(body["data"]["deleteWebhook"].as_bool().unwrap(), true);
+    assert!(body["data"]["deleteWebhook"].as_bool().unwrap());
 }
 
 #[tokio::test]
diff --git a/apps/backend/tests/grpc/files_tests.rs b/apps/backend/tests/grpc/files_tests.rs
index 78a82322..01b3967b 100644
--- a/apps/backend/tests/grpc/files_tests.rs
+++ b/apps/backend/tests/grpc/files_tests.rs
@@ -20,7 +20,7 @@ async fn seed_file(ctx: &GrpcTestContext, site_id: &str, name: &str) -> String {
 }
 
 async fn seed_file_with_mime(ctx: &GrpcTestContext, site_id: &str, name: &str, mime_type: &str) -> String {
-    let ext = mime_type.split('/').last().unwrap_or("bin");
+    let ext = mime_type.split('/').next_back().unwrap_or("bin");
     let body = ctx
         .upload_file(site_id, &format!("{}.{}", name, ext), b"test content", mime_type)
         .await;
diff --git a/apps/backend/tests/grpc/webhooks_tests.rs b/apps/backend/tests/grpc/webhooks_tests.rs
index 33ce9bce..a2ca0072 100644
--- a/apps/backend/tests/grpc/webhooks_tests.rs
+++ b/apps/backend/tests/grpc/webhooks_tests.rs
@@ -34,7 +34,7 @@ async fn test_create_webhook() {
     assert_eq!(resp.label, "Test Webhook");
     assert_eq!(resp.url, "https://example.com/hook");
     assert_eq!(resp.site_id, site_id);
-    assert!(resp.headers.get("X-Custom").is_some());
+    assert!(resp.headers.contains_key("X-Custom"));
     assert!(!resp.id.is_empty());
 }
 
@@ -139,7 +139,7 @@ async fn test_update_webhook() {
 
     assert_eq!(updated.label, "New Hook");
     assert_eq!(updated.url, "https://example.com/new");
-    assert!(updated.headers.get("X-Updated").is_some());
+    assert!(updated.headers.contains_key("X-Updated"));
 }
 
 #[tokio::test]
@@ -262,6 +262,6 @@ async fn test_list_webhook_deliveries() {
         .unwrap()
         .into_inner();
 
-    assert!(resp.items.len() >= 1);
+    assert!(!resp.items.is_empty());
     assert!(resp.total >= 1);
 }
diff --git a/apps/backend/tests/mcp_stdio.rs b/apps/backend/tests/mcp_stdio.rs
index cb1eee4a..41178493 100644
--- a/apps/backend/tests/mcp_stdio.rs
+++ b/apps/backend/tests/mcp_stdio.rs
@@ -148,11 +148,8 @@ async fn setup_database(permission: AccessTokenPermission) -> (tempfile::TempDir
 /// HMAC secret. Mirrors what `cms serve` leaves behind on first run.
 async fn setup_home_instance(home: &std::path::Path) -> String {
     let hmac_secret = "home-instance-hmac-secret".to_string();
-    std::fs::write(
-        home.join("secrets.toml"),
-        format!("hmac_secret = \"{hmac_secret}\"\n"),
-    )
-    .expect("write secrets.toml");
+    std::fs::write(home.join("secrets.toml"), format!("hmac_secret = \"{hmac_secret}\"\n"))
+        .expect("write secrets.toml");
 
     let database_path = home.join("cms.db");
     let database_url = format!("sqlite://{}", database_path.to_string_lossy().replace('\\', "/"));
diff --git a/apps/backend/tests/rest/backups_tests.rs b/apps/backend/tests/rest/backups_tests.rs
index a04b20b2..2627b8b8 100644
--- a/apps/backend/tests/rest/backups_tests.rs
+++ b/apps/backend/tests/rest/backups_tests.rs
@@ -514,5 +514,8 @@ async fn instance_backup_and_restore_round_trip() {
 
     // Instance restore wipes sessions; re-login, then verify the data is back.
     let (token2, csrf2) = login(&server, "admin", "admin").await;
-    assert_eq!(get_entry_status(&server, &token2, &csrf2, &site_id, &entry_id).await, 200);
+    assert_eq!(
+        get_entry_status(&server, &token2, &csrf2, &site_id, &entry_id).await,
+        200
+    );
 }
diff --git a/apps/backend/tests/rest/collections_tests.rs b/apps/backend/tests/rest/collections_tests.rs
index d44c7ed5..aa3500d3 100644
--- a/apps/backend/tests/rest/collections_tests.rs
+++ b/apps/backend/tests/rest/collections_tests.rs
@@ -2,7 +2,14 @@ use serde_json::{Value, json};
 
 use crate::common::{TestServer, auth::auth_header, fixtures::setup};
 
-async fn create_collection(server: &TestServer, token: &str, csrf: &str, site_id: &str, name: &str, slug: &str) -> Value {
+async fn create_collection(
+    server: &TestServer,
+    token: &str,
+    csrf: &str,
+    site_id: &str,
+    name: &str,
+    slug: &str,
+) -> Value {
     let client = reqwest::Client::builder().build().unwrap();
     let resp = client
         .post(format!(
diff --git a/apps/backend/tests/rest/roles_tests.rs b/apps/backend/tests/rest/roles_tests.rs
index 0ecac1ad..74e91e30 100644
--- a/apps/backend/tests/rest/roles_tests.rs
+++ b/apps/backend/tests/rest/roles_tests.rs
@@ -119,7 +119,13 @@ async fn remove_member(
         .unwrap()
 }
 
-async fn create_collection(server: &TestServer, token: &str, csrf: &str, site_id: &str, slug: &str) -> reqwest::Response {
+async fn create_collection(
+    server: &TestServer,
+    token: &str,
+    csrf: &str,
+    site_id: &str,
+    slug: &str,
+) -> reqwest::Response {
     let client = reqwest::Client::builder().build().unwrap();
     client
         .post(format!(

From 1eb5b34fd984fa732690754cf742cc81d870d1dd Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:43:30 +0530
Subject: [PATCH 24/43] ci: pass explicit toolchain to dtolnay/rust-toolchain

3 steps in ci.yml omitted toolchain input. The action requires it when pinned to a SHA; it does not read rust-toolchain.toml. Add toolchain: 1.94 to all three usages (lint, test, test-os).
---
 .github/workflows/ci.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5c38b374..d8f5b359 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,6 +87,8 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
       # Toolchain (channel + rustfmt/clippy components) comes from rust-toolchain.toml.
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
+        with:
+          toolchain: "1.94"
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: apps/backend
@@ -174,6 +176,8 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
+        with:
+          toolchain: "1.94"
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: apps/backend
@@ -208,6 +212,8 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
+        with:
+          toolchain: "1.94"
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: apps/backend

From 44110296a35c55ee474d64ac734d49e83e0d7e26 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 07:58:46 +0530
Subject: [PATCH 25/43] feat(dashboard): enhance backups section with Field
 components for better accessibility

---
 .../components/backups/backups-section.tsx    | 67 ++++++++++---------
 1 file changed, 34 insertions(+), 33 deletions(-)

diff --git a/apps/dashboard/src/components/backups/backups-section.tsx b/apps/dashboard/src/components/backups/backups-section.tsx
index c6a20d81..65506932 100644
--- a/apps/dashboard/src/components/backups/backups-section.tsx
+++ b/apps/dashboard/src/components/backups/backups-section.tsx
@@ -21,6 +21,7 @@ import {
   CardTitle,
 } from "@/components/ui/card";
 import { Checkbox } from "@/components/ui/checkbox";
+import { Field, FieldLabel } from "@/components/ui/field";
 import {
   Dialog,
   DialogContent,
@@ -253,17 +254,18 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
         <CardContent className="flex flex-col gap-4">
           <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
             <div className="flex flex-wrap items-center gap-4">
-              <span className="flex items-center gap-2 text-sm">
+              <Field orientation="horizontal">
                 <Checkbox
+                  id="backup-include-files"
                   checked={includeFiles}
                   onCheckedChange={(v) => setIncludeFiles(Boolean(v))}
                 />
-                Include uploaded files
-              </span>
-              <span className="flex items-center gap-2 text-sm">
-                <Checkbox checked={encrypt} onCheckedChange={(v) => setEncrypt(Boolean(v))} />
-                Encrypt
-              </span>
+                <FieldLabel htmlFor="backup-include-files">Include uploaded files</FieldLabel>
+              </Field>
+              <Field orientation="horizontal">
+                <Checkbox id="backup-encrypt" checked={encrypt} onCheckedChange={(v) => setEncrypt(Boolean(v))} />
+                <FieldLabel htmlFor="backup-encrypt">Encrypt</FieldLabel>
+              </Field>
             </div>
             <div className="flex gap-2">
               <label>
@@ -446,10 +448,10 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
             )}
 
             {((isInstance && restoreMode === "site") || !isInstance) && (
-              <span className="flex items-center gap-2 text-sm">
-                <Checkbox checked={importAsNew} onCheckedChange={(v) => setImportAsNew(Boolean(v))} />
-                Import as a new site (keep the existing one)
-              </span>
+              <Field orientation="horizontal">
+                <Checkbox id="restore-import-as-new" checked={importAsNew} onCheckedChange={(v) => setImportAsNew(Boolean(v))} />
+                <FieldLabel htmlFor="restore-import-as-new">Import as a new site (keep the existing one)</FieldLabel>
+              </Field>
             )}
 
             <div className="flex flex-col gap-2">
@@ -501,23 +503,22 @@ function SitePicker({
   const allSelected = selected.length === sites.length;
   return (
     <div className="rounded-md border">
-      <span className="flex items-center gap-2 border-b px-3 py-2 text-sm font-medium">
-        <Checkbox checked={allSelected} onCheckedChange={(v) => onToggleAll(Boolean(v))} />
-        Select all ({selected.length}/{sites.length})
-      </span>
+      <Field orientation="horizontal" className="border-b px-3 py-2 text-sm font-medium">
+        <Checkbox id="site-picker-select-all" checked={allSelected} onCheckedChange={(v) => onToggleAll(Boolean(v))} />
+        <FieldLabel htmlFor="site-picker-select-all">Select all ({selected.length}/{sites.length})</FieldLabel>
+      </Field>
       <ScrollArea className="max-h-48">
         <div className="flex flex-col">
           {sites.map((s) => (
-            <div
-              key={s.id}
-              className="flex items-center gap-2 px-3 py-2 text-sm hover:bg-muted/50"
-            >
-              <Checkbox checked={selected.includes(s.id)} onCheckedChange={() => onToggle(s.id)} />
-              <span className="flex flex-col">
-                <span className="font-medium">{s.name ?? "(unnamed site)"}</span>
-                <span className="font-mono text-xs text-muted-foreground">{s.id}</span>
-              </span>
-            </div>
+            <Field key={s.id} orientation="horizontal" className="px-3 py-2 text-sm hover:bg-muted/50">
+              <Checkbox id={`site-picker-${s.id}`} checked={selected.includes(s.id)} onCheckedChange={() => onToggle(s.id)} />
+              <FieldLabel htmlFor={`site-picker-${s.id}`}>
+                <span className="flex flex-col">
+                  <span className="font-medium">{s.name ?? "(unnamed site)"}</span>
+                  <span className="font-mono text-xs text-muted-foreground">{s.id}</span>
+                </span>
+              </FieldLabel>
+            </Field>
           ))}
         </div>
       </ScrollArea>
@@ -606,14 +607,14 @@ function SchedulesCard({ schedules, loading, onCreate, onToggle, onRun, onDelete
             />
           </div>
           <div className="flex flex-col gap-2 sm:col-span-2 lg:col-span-1 lg:flex-row lg:items-center lg:gap-4 lg:pb-2">
-            <span className="flex items-center gap-2 text-sm">
-              <Checkbox checked={includeFiles} onCheckedChange={(v) => setIncludeFiles(Boolean(v))} />
-              Files
-            </span>
-            <span className="flex items-center gap-2 text-sm">
-              <Checkbox checked={encrypt} onCheckedChange={(v) => setEncrypt(Boolean(v))} />
-              Encrypt
-            </span>
+            <Field orientation="horizontal">
+              <Checkbox id="schedule-files" checked={includeFiles} onCheckedChange={(v) => setIncludeFiles(Boolean(v))} />
+              <FieldLabel htmlFor="schedule-files">Files</FieldLabel>
+            </Field>
+            <Field orientation="horizontal">
+              <Checkbox id="schedule-encrypt" checked={encrypt} onCheckedChange={(v) => setEncrypt(Boolean(v))} />
+              <FieldLabel htmlFor="schedule-encrypt">Encrypt</FieldLabel>
+            </Field>
           </div>
           <Button onClick={submit} disabled={submitting}>
             <Plus className="size-4" /> Add schedule

From aaff8452c9b7b890a58ea9ed9b7de343342b0c60 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 07:59:05 +0530
Subject: [PATCH 26/43] fix(breadcrumb): update mapping logic for breadcrumb
 items to ensure correct keys and labels

---
 apps/dashboard/src/components/app-breadcrumb.tsx | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/apps/dashboard/src/components/app-breadcrumb.tsx b/apps/dashboard/src/components/app-breadcrumb.tsx
index 6f1165d6..1006304a 100644
--- a/apps/dashboard/src/components/app-breadcrumb.tsx
+++ b/apps/dashboard/src/components/app-breadcrumb.tsx
@@ -188,7 +188,7 @@ export function AppBreadcrumb() {
     return (
       <Breadcrumb>
         <BreadcrumbList>
-          {config.crumbs.map((def, i) => (
+            {config.crumbs.map((def, i) => (
             <Fragment key={`crumb-${"label" in def ? def.label : def.labelFrom}`}>
               {i > 0 && <BreadcrumbSeparator />}
               <BreadcrumbItem>
@@ -204,12 +204,13 @@ export function AppBreadcrumb() {
   return (
     <Breadcrumb>
       <BreadcrumbList>
-        {labels.map((label, i) => {
-          const isLast = i === labels.length - 1;
+        {config.crumbs.map((def, i) => {
+          const label = labels[i];
+          const isLast = i === config.crumbs.length - 1;
           const href = buildHref(routeId, params, i);
 
           return (
-            <Fragment key={label}>
+            <Fragment key={`crumb-${"label" in def ? def.label : def.labelFrom}`}>
               {i > 0 && <BreadcrumbSeparator />}
               <BreadcrumbItem>
                 {isLast ? (

From 3de0175684ed0a495120e074038c41fb164e6cfa Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 07:59:54 +0530
Subject: [PATCH 27/43] fix(workflows): add persist-credentials option to
 checkout step for audit and release workflows

---
 .github/workflows/audit.yml   | 2 ++
 .github/workflows/release.yml | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index f0baae58..008bfa4d 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -24,6 +24,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2a54d500..556cbd3f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,6 +33,8 @@ jobs:
             asset: cms-aarch64-macos
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}

From f2bbbf976d6980c886190c7654a693bfb8d52f93 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 08:09:27 +0530
Subject: [PATCH 28/43] fix(tests): include site_id in entry update logic to
 ensure correct entry modification

---
 apps/backend/src/test_helpers.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/backend/src/test_helpers.rs b/apps/backend/src/test_helpers.rs
index ee9484fe..a230808f 100644
--- a/apps/backend/src/test_helpers.rs
+++ b/apps/backend/src/test_helpers.rs
@@ -664,7 +664,7 @@ impl EntryRepository for InMemoryEntryRepository {
     async fn update(&self, params: UpdateEntryParams<'_>) -> Result<Entry, RepositoryError> {
         let UpdateEntryParams {
             id,
-            site_id: _,
+            site_id,
             data,
             slug,
             status,
@@ -672,7 +672,7 @@ impl EntryRepository for InMemoryEntryRepository {
             change_summary,
         } = params;
         let mut entries = self.entries.lock().unwrap();
-        if let Some(entry) = entries.iter_mut().find(|e| e.id == id) {
+        if let Some(entry) = entries.iter_mut().find(|e| e.id == id && e.site_id == site_id) {
             entry.data = data.to_string();
             entry.slug = slug.to_string();
             entry.status = status.to_string();

From 09c51daa5035f1cd01f08b1103e68e3d410a6801 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 08:10:01 +0530
Subject: [PATCH 29/43] fix(handlers): replace StatusCode with AppError for
 storage retrieval errors

---
 apps/backend/src/handlers/entry_handler.rs     | 7 ++++---
 apps/backend/src/handlers/singleton_handler.rs | 8 ++++----
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/apps/backend/src/handlers/entry_handler.rs b/apps/backend/src/handlers/entry_handler.rs
index cd4e5020..30c6ad13 100644
--- a/apps/backend/src/handlers/entry_handler.rs
+++ b/apps/backend/src/handlers/entry_handler.rs
@@ -20,6 +20,7 @@ pub struct RevisionId {
     number: i64,
 }
 
+use crate::error::AppError;
 use crate::middleware::auth::{Actor, RequestContext, require_site_action};
 use crate::models::authorization::Action;
 use crate::models::entry::{CreateEntry, Entry, EntryRevisionResponse, RevisionsListResponse, UpdateEntry};
@@ -53,10 +54,10 @@ pub struct DiffQuery {
 fn get_storage_for_site(
     site_storage_provider: &str,
     registry: &StorageRegistry,
-) -> Result<Arc<dyn StorageProvider>, StatusCode> {
+) -> Result<Arc<dyn StorageProvider>, AppError> {
     registry
         .get(site_storage_provider)
-        .ok_or(StatusCode::INTERNAL_SERVER_ERROR)
+        .ok_or(AppError::Internal("Storage provider not found".into()))
 }
 
 #[utoipa::path(
@@ -153,7 +154,7 @@ pub async fn get_entry(
                 .unwrap_or_else(|_| "filesystem".into());
             let storage = match get_storage_for_site(&storage_provider, &storage_registry) {
                 Ok(s) => s,
-                Err(status) => return (status, Json(json!({"error": "Storage not configured"}))).into_response(),
+                Err(e) => return e.into_response(),
             };
             let resolved = services
                 .entry
diff --git a/apps/backend/src/handlers/singleton_handler.rs b/apps/backend/src/handlers/singleton_handler.rs
index f3aa7643..c7f10940 100644
--- a/apps/backend/src/handlers/singleton_handler.rs
+++ b/apps/backend/src/handlers/singleton_handler.rs
@@ -5,7 +5,6 @@ use axum::{
     response::{IntoResponse, Response},
 };
 use serde::Deserialize;
-use serde_json::json;
 use std::sync::Arc;
 use tracing::instrument;
 
@@ -14,6 +13,7 @@ pub struct SingletonSlug {
     slug: String,
 }
 
+use crate::error::AppError;
 use crate::middleware::auth::{RequestContext, require_site_action};
 use crate::models::authorization::Action;
 use crate::models::collection::{SingletonResponse, UpdateSingletonData};
@@ -24,10 +24,10 @@ use crate::storage::{StorageProvider, StorageRegistry};
 fn get_storage_for_site(
     site_storage_provider: &str,
     registry: &StorageRegistry,
-) -> Result<Arc<dyn StorageProvider>, StatusCode> {
+) -> Result<Arc<dyn StorageProvider>, AppError> {
     registry
         .get(site_storage_provider)
-        .ok_or(StatusCode::INTERNAL_SERVER_ERROR)
+        .ok_or(AppError::Internal("Storage provider not found".into()))
 }
 
 #[utoipa::path(
@@ -87,7 +87,7 @@ pub async fn get_singleton(
         .unwrap_or_else(|_| "filesystem".into());
     let storage = match get_storage_for_site(&storage_provider, &storage_registry) {
         Ok(s) => s,
-        Err(status) => return (status, Json(json!({"error": "Storage not configured"}))).into_response(),
+        Err(e) => return e.into_response(),
     };
 
     match services.singleton.get_singleton(&ctx.site_id, &slug, storage).await {

From 619e02f27c32b92e842a12eef6c5ebfdb11d6140 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 08:27:34 +0530
Subject: [PATCH 30/43] style: formatting

---
 apps/web/biome.json                           |  18 ++-
 apps/web/next.config.mjs                      |   4 +-
 apps/web/package.json                         |   2 +-
 apps/web/postcss.config.mjs                   |   2 +-
 apps/web/project.json                         |  90 ++++++------
 apps/web/source.config.ts                     |   6 +-
 apps/web/src/app/(home)/_download/page.tsx    |   3 +-
 apps/web/src/app/(home)/home.css              |  77 +++++++----
 apps/web/src/app/api/search/route.ts          |   6 +-
 apps/web/src/app/docs/[[...slug]]/page.tsx    |  24 ++--
 apps/web/src/app/docs/docs.css                |   6 +-
 apps/web/src/app/global.css                   |   2 +-
 apps/web/src/app/layout.tsx                   |   4 +-
 apps/web/src/app/llms-full.txt/route.ts       |   4 +-
 .../app/llms.mdx/docs/[[...slug]]/route.ts    |  11 +-
 apps/web/src/app/llms.txt/route.ts            |   4 +-
 apps/web/src/app/og/docs/[...slug]/route.tsx  |  21 ++-
 .../src/components/landing/ascii-scene.tsx    |   8 +-
 .../src/components/landing/backup-section.tsx |   1 -
 .../components/landing/database-section.tsx   | 130 ++++++++++++------
 .../components/landing/features-section.tsx   |  54 +++++---
 .../components/landing/security-section.tsx   |  89 +++++++-----
 apps/web/src/components/mdx.tsx               |   4 +-
 apps/web/src/components/provider.tsx          |   8 +-
 apps/web/src/components/search.tsx            |  25 ++--
 apps/web/src/components/ui/button.tsx         |  20 +--
 apps/web/src/components/ui/select.tsx         |  57 ++++----
 apps/web/src/lib/cn.ts                        |   2 +-
 apps/web/src/lib/layout.shared.tsx            |   4 +-
 apps/web/src/lib/shared.ts                    |  14 +-
 apps/web/src/lib/source.ts                    |  22 +--
 apps/web/src/lib/utils.ts                     |   6 +-
 apps/web/tsconfig.json                        |  20 +--
 33 files changed, 431 insertions(+), 317 deletions(-)

diff --git a/apps/web/biome.json b/apps/web/biome.json
index 64ae1e3b..1d3a073a 100644
--- a/apps/web/biome.json
+++ b/apps/web/biome.json
@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.2.0/schema.json",
+  "$schema": "node_modules/@biomejs/biome/configuration_schema.json",
   "vcs": {
     "enabled": true,
     "clientKind": "git",
@@ -7,14 +7,7 @@
   },
   "files": {
     "ignoreUnknown": true,
-    "includes": [
-      "**",
-      "!node_modules",
-      "!.next",
-      "!dist",
-      "!build",
-      "!.source"
-    ]
+    "includes": ["**", "!node_modules", "!.next", "!dist", "!build", "!.source"]
   },
   "formatter": {
     "enabled": true,
@@ -37,5 +30,10 @@
         "organizeImports": "on"
       }
     }
+  },
+  "css": {
+    "parser": {
+      "tailwindDirectives": true
+    }
   }
-}
\ No newline at end of file
+}
diff --git a/apps/web/next.config.mjs b/apps/web/next.config.mjs
index 219f24de..52f509d7 100644
--- a/apps/web/next.config.mjs
+++ b/apps/web/next.config.mjs
@@ -1,10 +1,10 @@
-import { createMDX } from 'fumadocs-mdx/next';
+import { createMDX } from "fumadocs-mdx/next";
 
 const withMDX = createMDX();
 
 /** @type {import('next').NextConfig} */
 const config = {
-  output: 'export',
+  output: "export",
   reactStrictMode: true,
 };
 
diff --git a/apps/web/package.json b/apps/web/package.json
index ace557ee..f461a2c5 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -40,4 +40,4 @@
     "typescript": "^6.0.3",
     "@biomejs/biome": "^2.4.16"
   }
-}
\ No newline at end of file
+}
diff --git a/apps/web/postcss.config.mjs b/apps/web/postcss.config.mjs
index 297374d8..61e36849 100644
--- a/apps/web/postcss.config.mjs
+++ b/apps/web/postcss.config.mjs
@@ -1,6 +1,6 @@
 const config = {
   plugins: {
-    '@tailwindcss/postcss': {},
+    "@tailwindcss/postcss": {},
   },
 };
 
diff --git a/apps/web/project.json b/apps/web/project.json
index eebf5a1a..d2bed1d0 100644
--- a/apps/web/project.json
+++ b/apps/web/project.json
@@ -1,45 +1,45 @@
-{
-  "name": "web",
-  "$schema": "../../node_modules/nx/schemas/project-schema.json",
-  "sourceRoot": "apps/web/src",
-  "projectType": "application",
-  "targets": {
-    "build": {
-      "executor": "nx:run-commands",
-      "cache": true,
-      "options": {
-        "command": "bun run build",
-        "cwd": "apps/web"
-      },
-      "outputs": ["{workspaceRoot}/apps/web/out"]
-    },
-    "dev": {
-      "executor": "nx:run-commands",
-      "options": {
-        "command": "bun run dev",
-        "cwd": "apps/web"
-      }
-    },
-    "typecheck": {
-      "executor": "nx:run-commands",
-      "options": {
-        "command": "bun run types:check",
-        "cwd": "apps/web"
-      }
-    },
-    "lint": {
-      "executor": "nx:run-commands",
-      "options": {
-        "command": "bun run lint",
-        "cwd": "apps/web"
-      }
-    },
-    "format": {
-      "executor": "nx:run-commands",
-      "options": {
-        "command": "bun run format",
-        "cwd": "apps/web"
-      }
-    }
-  }
-}
+{
+  "name": "web",
+  "$schema": "../../node_modules/nx/schemas/project-schema.json",
+  "sourceRoot": "apps/web/src",
+  "projectType": "application",
+  "targets": {
+    "build": {
+      "executor": "nx:run-commands",
+      "cache": true,
+      "options": {
+        "command": "bun run build",
+        "cwd": "apps/web"
+      },
+      "outputs": ["{workspaceRoot}/apps/web/out"]
+    },
+    "dev": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "bun run dev",
+        "cwd": "apps/web"
+      }
+    },
+    "typecheck": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "bun run types:check",
+        "cwd": "apps/web"
+      }
+    },
+    "lint": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "bun run lint",
+        "cwd": "apps/web"
+      }
+    },
+    "format": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "bun run format",
+        "cwd": "apps/web"
+      }
+    }
+  }
+}
diff --git a/apps/web/source.config.ts b/apps/web/source.config.ts
index a35628ab..43aeb805 100644
--- a/apps/web/source.config.ts
+++ b/apps/web/source.config.ts
@@ -1,10 +1,10 @@
-import { defineConfig, defineDocs } from 'fumadocs-mdx/config';
-import { metaSchema, pageSchema } from 'fumadocs-core/source/schema';
+import { defineConfig, defineDocs } from "fumadocs-mdx/config";
+import { metaSchema, pageSchema } from "fumadocs-core/source/schema";
 
 // You can customize Zod schemas for frontmatter and `meta.json` here
 // see https://fumadocs.dev/docs/mdx/collections
 export const docs = defineDocs({
-  dir: 'content/docs',
+  dir: "content/docs",
   docs: {
     schema: pageSchema,
     postprocess: {
diff --git a/apps/web/src/app/(home)/_download/page.tsx b/apps/web/src/app/(home)/_download/page.tsx
index 173cfa98..df0d9a76 100644
--- a/apps/web/src/app/(home)/_download/page.tsx
+++ b/apps/web/src/app/(home)/_download/page.tsx
@@ -266,8 +266,7 @@ export default function DownloadPage() {
                   <p className="text-muted-foreground">
                     {selectedOS === "linux" && "For Linux systems"}
                     {selectedOS === "macos" && "For macOS systems"}
-                    {selectedOS === "windows" &&
-                      "For Windows systems"} with{" "}
+                    {selectedOS === "windows" && "For Windows systems"} with{" "}
                     {selectedArch === "x86_64"
                       ? "Intel/AMD"
                       : selectedArch === "aarch64"
diff --git a/apps/web/src/app/(home)/home.css b/apps/web/src/app/(home)/home.css
index 1efd8ca3..546f5b37 100644
--- a/apps/web/src/app/(home)/home.css
+++ b/apps/web/src/app/(home)/home.css
@@ -1,5 +1,5 @@
-@import 'tailwindcss';
-@import 'tw-animate-css';
+@import "tailwindcss";
+@import "tw-animate-css";
 @import "shadcn/tailwind.css";
 
 @custom-variant dark (&:is(.dark *));
@@ -28,7 +28,7 @@
   --chart-2: oklch(0.72 0.01 90);
   --chart-3: oklch(0.52 0.015 90);
   --chart-4: oklch(0.35 0.01 90);
-  --chart-5: oklch(0.20 0.008 90);
+  --chart-5: oklch(0.2 0.008 90);
   --radius: 0.25rem;
   --sidebar: oklch(0.06 0.008 260);
   --sidebar-foreground: oklch(0.94 0.005 90);
@@ -41,9 +41,10 @@
 }
 
 @theme inline {
-  --font-sans: var(--font-instrument), 'Instrument Sans', system-ui, sans-serif;
-  --font-mono: var(--font-jetbrains), 'JetBrains Mono', monospace;
-  --font-display: var(--font-instrument-serif), 'Instrument Serif', Georgia, serif;
+  --font-sans: var(--font-instrument), "Instrument Sans", system-ui, sans-serif;
+  --font-mono: var(--font-jetbrains), "JetBrains Mono", monospace;
+  --font-display:
+    var(--font-instrument-serif), "Instrument Serif", Georgia, serif;
   --color-background: var(--background);
   --color-foreground: var(--foreground);
   --color-card: var(--card);
@@ -98,62 +99,72 @@
   .font-display {
     font-family: var(--font-display);
   }
-  
+
   .text-stroke {
     -webkit-text-stroke: 1.5px currentColor;
     -webkit-text-fill-color: transparent;
   }
-  
+
   .marquee {
     animation: marquee 30s linear infinite;
   }
-  
+
   .marquee-reverse {
     animation: marquee-reverse 25s linear infinite;
   }
 
   @keyframes marquee {
-    0% { transform: translateX(0); }
-    100% { transform: translateX(-50%); }
+    0% {
+      transform: translateX(0);
+    }
+    100% {
+      transform: translateX(-50%);
+    }
   }
-  
+
   @keyframes marquee-reverse {
-    0% { transform: translateX(-50%); }
-    100% { transform: translateX(0); }
+    0% {
+      transform: translateX(-50%);
+    }
+    100% {
+      transform: translateX(0);
+    }
   }
-  
+
   .line-reveal {
     clip-path: inset(0 100% 0 0);
     animation: line-reveal 0.8s cubic-bezier(0.77, 0, 0.175, 1) forwards;
   }
-  
+
   @keyframes line-reveal {
-    to { clip-path: inset(0 0 0 0); }
+    to {
+      clip-path: inset(0 0 0 0);
+    }
   }
-  
+
   .hover-lift {
     transition: transform 0.4s cubic-bezier(0.34, 1.56, 0.64, 1);
   }
-  
+
   .hover-lift:hover {
     transform: translateY(-4px);
   }
-  
+
   .letter-spin {
     display: inline-block;
     transition: transform 0.6s cubic-bezier(0.34, 1.56, 0.64, 1);
   }
-  
+
   .letter-spin:hover {
     transform: rotateY(360deg);
   }
-  
+
   .animate-char-in {
     animation: char-in 0.4s cubic-bezier(0.22, 1, 0.36, 1) forwards;
     opacity: 0;
     transform: translateY(60%);
   }
-  
+
   @keyframes char-in {
     0% {
       opacity: 0;
@@ -168,9 +179,9 @@
   .noise-overlay {
     position: relative;
   }
-  
+
   .noise-overlay::after {
-    content: '';
+    content: "";
     position: absolute;
     inset: 0;
     background-image: url("data:image/svg+xml,%3Csvg viewBox='0 0 256 256' xmlns='http://www.w3.org/2000/svg'%3E%3Cfilter id='noise'%3E%3CfeTurbulence type='fractalNoise' baseFrequency='0.9' numOctaves='4' stitchTiles='stitch'/%3E%3C/filter%3E%3Crect width='100%25' height='100%25' filter='url(%23noise)'/%3E%3C/svg%3E");
@@ -178,9 +189,9 @@
     pointer-events: none;
     z-index: 1;
   }
-  
+
   .how-it-works-bg {
-    background-color: oklch(0.10 0.008 260);
+    background-color: oklch(0.1 0.008 260);
   }
 
   .word-gradient {
@@ -200,8 +211,14 @@
   }
 
   @keyframes gradient-shift {
-    0%   { background-position: 0% 50%; }
-    50%  { background-position: 100% 50%; }
-    100% { background-position: 0% 50%; }
+    0% {
+      background-position: 0% 50%;
+    }
+    50% {
+      background-position: 100% 50%;
+    }
+    100% {
+      background-position: 0% 50%;
+    }
   }
 }
diff --git a/apps/web/src/app/api/search/route.ts b/apps/web/src/app/api/search/route.ts
index aaaff7ff..85448f9d 100644
--- a/apps/web/src/app/api/search/route.ts
+++ b/apps/web/src/app/api/search/route.ts
@@ -1,9 +1,9 @@
-import { source } from '@/lib/source';
-import { createFromSource } from 'fumadocs-core/search/server';
+import { source } from "@/lib/source";
+import { createFromSource } from "fumadocs-core/search/server";
 
 export const revalidate = false;
 
 export const { staticGET: GET } = createFromSource(source, {
   // https://docs.orama.com/docs/orama-js/supported-languages
-  language: 'english',
+  language: "english",
 });
diff --git a/apps/web/src/app/docs/[[...slug]]/page.tsx b/apps/web/src/app/docs/[[...slug]]/page.tsx
index 53ce219c..54115be6 100644
--- a/apps/web/src/app/docs/[[...slug]]/page.tsx
+++ b/apps/web/src/app/docs/[[...slug]]/page.tsx
@@ -1,4 +1,4 @@
-import { getPageImage, getPageMarkdownUrl, source } from '@/lib/source';
+import { getPageImage, getPageMarkdownUrl, source } from "@/lib/source";
 import {
   DocsBody,
   DocsDescription,
@@ -6,14 +6,14 @@ import {
   DocsTitle,
   MarkdownCopyButton,
   ViewOptionsPopover,
-} from 'fumadocs-ui/layouts/docs/page';
-import { notFound } from 'next/navigation';
-import { getMDXComponents } from '@/components/mdx';
-import type { Metadata } from 'next';
-import { createRelativeLink } from 'fumadocs-ui/mdx';
-import { gitConfig } from '@/lib/shared';
+} from "fumadocs-ui/layouts/docs/page";
+import { notFound } from "next/navigation";
+import { getMDXComponents } from "@/components/mdx";
+import type { Metadata } from "next";
+import { createRelativeLink } from "fumadocs-ui/mdx";
+import { gitConfig } from "@/lib/shared";
 
-export default async function Page(props: PageProps<'/docs/[[...slug]]'>) {
+export default async function Page(props: PageProps<"/docs/[[...slug]]">) {
   const params = await props.params;
   const page = source.getPage(params.slug);
   if (!page) notFound();
@@ -24,7 +24,9 @@ export default async function Page(props: PageProps<'/docs/[[...slug]]'>) {
   return (
     <DocsPage toc={page.data.toc} full={page.data.full}>
       <DocsTitle>{page.data.title}</DocsTitle>
-      <DocsDescription className="mb-0">{page.data.description}</DocsDescription>
+      <DocsDescription className="mb-0">
+        {page.data.description}
+      </DocsDescription>
       <div className="flex flex-row gap-2 items-center border-b pb-6">
         <MarkdownCopyButton markdownUrl={markdownUrl} />
         <ViewOptionsPopover
@@ -48,7 +50,9 @@ export async function generateStaticParams() {
   return source.generateParams();
 }
 
-export async function generateMetadata(props: PageProps<'/docs/[[...slug]]'>): Promise<Metadata> {
+export async function generateMetadata(
+  props: PageProps<"/docs/[[...slug]]">,
+): Promise<Metadata> {
   const params = await props.params;
   const page = source.getPage(params.slug);
   if (!page) notFound();
diff --git a/apps/web/src/app/docs/docs.css b/apps/web/src/app/docs/docs.css
index f86f3c9d..488ce0ee 100644
--- a/apps/web/src/app/docs/docs.css
+++ b/apps/web/src/app/docs/docs.css
@@ -1,6 +1,6 @@
-@import 'tailwindcss';
-@import 'fumadocs-ui/css/neutral.css';
-@import 'fumadocs-ui/css/preset.css';
+@import "tailwindcss";
+@import "fumadocs-ui/css/neutral.css";
+@import "fumadocs-ui/css/preset.css";
 
 html {
   scrollbar-gutter: stable;
diff --git a/apps/web/src/app/global.css b/apps/web/src/app/global.css
index d4b50785..f1d8c73c 100644
--- a/apps/web/src/app/global.css
+++ b/apps/web/src/app/global.css
@@ -1 +1 @@
-@import 'tailwindcss';
+@import "tailwindcss";
diff --git a/apps/web/src/app/layout.tsx b/apps/web/src/app/layout.tsx
index 7802f899..787e60cc 100644
--- a/apps/web/src/app/layout.tsx
+++ b/apps/web/src/app/layout.tsx
@@ -10,9 +10,7 @@ export const metadata: Metadata = {
 export default function Layout({ children }: LayoutProps<"/">) {
   return (
     <html lang="en" suppressHydrationWarning>
-      <body>
-        {children}
-      </body>
+      <body>{children}</body>
     </html>
   );
 }
diff --git a/apps/web/src/app/llms-full.txt/route.ts b/apps/web/src/app/llms-full.txt/route.ts
index d494d2cb..fcccaeef 100644
--- a/apps/web/src/app/llms-full.txt/route.ts
+++ b/apps/web/src/app/llms-full.txt/route.ts
@@ -1,4 +1,4 @@
-import { getLLMText, source } from '@/lib/source';
+import { getLLMText, source } from "@/lib/source";
 
 export const revalidate = false;
 
@@ -6,5 +6,5 @@ export async function GET() {
   const scan = source.getPages().map(getLLMText);
   const scanned = await Promise.all(scan);
 
-  return new Response(scanned.join('\n\n'));
+  return new Response(scanned.join("\n\n"));
 }
diff --git a/apps/web/src/app/llms.mdx/docs/[[...slug]]/route.ts b/apps/web/src/app/llms.mdx/docs/[[...slug]]/route.ts
index 012e877c..1ccfc9c3 100644
--- a/apps/web/src/app/llms.mdx/docs/[[...slug]]/route.ts
+++ b/apps/web/src/app/llms.mdx/docs/[[...slug]]/route.ts
@@ -1,9 +1,12 @@
-import { getLLMText, getPageMarkdownUrl, source } from '@/lib/source';
-import { notFound } from 'next/navigation';
+import { getLLMText, getPageMarkdownUrl, source } from "@/lib/source";
+import { notFound } from "next/navigation";
 
 export const revalidate = false;
 
-export async function GET(_req: Request, { params }: RouteContext<'/llms.mdx/docs/[[...slug]]'>) {
+export async function GET(
+  _req: Request,
+  { params }: RouteContext<"/llms.mdx/docs/[[...slug]]">,
+) {
   const { slug } = await params;
   // remove the appended "content.md"
   const page = source.getPage(slug?.slice(0, -1));
@@ -11,7 +14,7 @@ export async function GET(_req: Request, { params }: RouteContext<'/llms.mdx/doc
 
   return new Response(await getLLMText(page), {
     headers: {
-      'Content-Type': 'text/markdown',
+      "Content-Type": "text/markdown",
     },
   });
 }
diff --git a/apps/web/src/app/llms.txt/route.ts b/apps/web/src/app/llms.txt/route.ts
index fc80cb65..f18f409c 100644
--- a/apps/web/src/app/llms.txt/route.ts
+++ b/apps/web/src/app/llms.txt/route.ts
@@ -1,5 +1,5 @@
-import { source } from '@/lib/source';
-import { llms } from 'fumadocs-core/source';
+import { source } from "@/lib/source";
+import { llms } from "fumadocs-core/source";
 
 export const revalidate = false;
 
diff --git a/apps/web/src/app/og/docs/[...slug]/route.tsx b/apps/web/src/app/og/docs/[...slug]/route.tsx
index 877166d3..451e98ea 100644
--- a/apps/web/src/app/og/docs/[...slug]/route.tsx
+++ b/apps/web/src/app/og/docs/[...slug]/route.tsx
@@ -1,18 +1,25 @@
-import { getPageImage, source } from '@/lib/source';
-import { notFound } from 'next/navigation';
-import { ImageResponse } from 'next/og';
-import { generate as DefaultImage } from 'fumadocs-ui/og';
-import { appName } from '@/lib/shared';
+import { getPageImage, source } from "@/lib/source";
+import { notFound } from "next/navigation";
+import { ImageResponse } from "next/og";
+import { generate as DefaultImage } from "fumadocs-ui/og";
+import { appName } from "@/lib/shared";
 
 export const revalidate = false;
 
-export async function GET(_req: Request, { params }: RouteContext<'/og/docs/[...slug]'>) {
+export async function GET(
+  _req: Request,
+  { params }: RouteContext<"/og/docs/[...slug]">,
+) {
   const { slug } = await params;
   const page = source.getPage(slug.slice(0, -1));
   if (!page) notFound();
 
   return new ImageResponse(
-    <DefaultImage title={page.data.title} description={page.data.description} site={appName} />,
+    <DefaultImage
+      title={page.data.title}
+      description={page.data.description}
+      site={appName}
+    />,
     {
       width: 1200,
       height: 630,
diff --git a/apps/web/src/components/landing/ascii-scene.tsx b/apps/web/src/components/landing/ascii-scene.tsx
index b575f6d1..6535c65a 100644
--- a/apps/web/src/components/landing/ascii-scene.tsx
+++ b/apps/web/src/components/landing/ascii-scene.tsx
@@ -52,7 +52,7 @@ export function AsciiScene() {
       p: number,
       q: number,
       segments: number,
-      tubeSegments: number
+      tubeSegments: number,
     ): Point3D[] => {
       const points: Point3D[] = [];
       for (let i = 0; i < segments; i++) {
@@ -87,7 +87,7 @@ export function AsciiScene() {
       point: Point3D,
       angleX: number,
       angleY: number,
-      angleZ: number
+      angleZ: number,
     ): Point3D => {
       let { x, y, z } = point;
 
@@ -117,7 +117,7 @@ export function AsciiScene() {
       point: Point3D,
       centerX: number,
       centerY: number,
-      scale: number
+      scale: number,
     ): { x: number; y: number; z: number } => {
       const perspective = 5;
       const factor = perspective / (perspective + point.z);
@@ -184,7 +184,7 @@ export function AsciiScene() {
         ctx.fillText(
           ASCII_CHARS[Math.floor(pz * (ASCII_CHARS.length - 1))],
           px,
-          py
+          py,
         );
       }
 
diff --git a/apps/web/src/components/landing/backup-section.tsx b/apps/web/src/components/landing/backup-section.tsx
index 131fe4d9..82babab3 100644
--- a/apps/web/src/components/landing/backup-section.tsx
+++ b/apps/web/src/components/landing/backup-section.tsx
@@ -107,7 +107,6 @@ export function BackupSection() {
                 downtime.
               </p>
             </div>
-            
           </div>
         </div>
 
diff --git a/apps/web/src/components/landing/database-section.tsx b/apps/web/src/components/landing/database-section.tsx
index bbce36d0..0a2fc006 100644
--- a/apps/web/src/components/landing/database-section.tsx
+++ b/apps/web/src/components/landing/database-section.tsx
@@ -19,7 +19,7 @@ export function DatabaseSection() {
       ([entry]) => {
         if (entry.isIntersecting) setIsVisible(true);
       },
-      { threshold: 0.1 }
+      { threshold: 0.1 },
     );
 
     if (sectionRef.current) observer.observe(sectionRef.current);
@@ -34,24 +34,34 @@ export function DatabaseSection() {
   }, []);
 
   return (
-    <section id="infra" ref={sectionRef} className="relative py-32 lg:py-40 overflow-hidden">
-        {/* Background accent — retiré, remplacé par l'image sphère */}
-      
+    <section
+      id="infra"
+      ref={sectionRef}
+      className="relative py-32 lg:py-40 overflow-hidden"
+    >
+      {/* Background accent — retiré, remplacé par l'image sphère */}
+
       <div className="max-w-350 mx-auto px-6 lg:px-12">
         {/* Header */}
         <div className="mb-20">
-          <span className={`inline-flex items-center gap-4 text-sm font-mono text-muted-foreground mb-8 transition-all duration-700 ${
-            isVisible ? "opacity-100" : "opacity-0"
-          }`}>
+          <span
+            className={`inline-flex items-center gap-4 text-sm font-mono text-muted-foreground mb-8 transition-all duration-700 ${
+              isVisible ? "opacity-100" : "opacity-0"
+            }`}
+          >
             <span className="w-12 h-px bg-foreground/20" />
             Database Support
           </span>
-          
+
           <div className="grid lg:grid-cols-[auto_1fr] gap-8 lg:gap-16 items-stretch">
             {/* Image globe — colonne gauche, pleine hauteur */}
-            <div className={`w-48 lg:w-72 xl:w-80 shrink-0 transition-all duration-1000 ${
-              isVisible ? "opacity-100 translate-y-0" : "opacity-0 translate-y-8"
-            }`}>
+            <div
+              className={`w-48 lg:w-72 xl:w-80 shrink-0 transition-all duration-1000 ${
+                isVisible
+                  ? "opacity-100 translate-y-0"
+                  : "opacity-0 translate-y-8"
+              }`}
+            >
               <img
                 src="/assets/database.png"
                 alt="Global network sphere"
@@ -61,18 +71,25 @@ export function DatabaseSection() {
 
             {/* Titre + description empilés */}
             <div className="flex flex-col justify-center">
-              <h2 className={`text-6xl md:text-7xl lg:text-[128px] font-display tracking-tight leading-[0.9] transition-all duration-1000 ${
-                isVisible ? "opacity-100 translate-y-0" : "opacity-0 translate-y-8"
-              }`}>
+              <h2
+                className={`text-6xl md:text-7xl lg:text-[128px] font-display tracking-tight leading-[0.9] transition-all duration-1000 ${
+                  isVisible
+                    ? "opacity-100 translate-y-0"
+                    : "opacity-0 translate-y-8"
+                }`}
+              >
                 Your choice
                 <br />
                 <span className="text-muted-foreground">of database.</span>
               </h2>
 
-              <p className={`mt-8 text-xl text-muted-foreground leading-relaxed max-w-lg transition-all duration-1000 delay-100 ${
-                isVisible ? "opacity-100" : "opacity-0"
-              }`}>
-                Embedded SQLite for lightweight workloads, MySQL for scalable deployments, PostgreSQL for complex, high-volume systems.
+              <p
+                className={`mt-8 text-xl text-muted-foreground leading-relaxed max-w-lg transition-all duration-1000 delay-100 ${
+                  isVisible ? "opacity-100" : "opacity-0"
+                }`}
+              >
+                Embedded SQLite for lightweight workloads, MySQL for scalable
+                deployments, PostgreSQL for complex, high-volume systems.
               </p>
             </div>
           </div>
@@ -81,9 +98,13 @@ export function DatabaseSection() {
         {/* Main content grid */}
         <div className="grid lg:grid-cols-3 gap-6">
           {/* Large stat card */}
-          <div className={`lg:col-span-2 relative p-8 lg:p-12 border border-foreground/10 bg-foreground/2 overflow-hidden transition-all duration-700 ${
-            isVisible ? "opacity-100 translate-y-0" : "opacity-0 translate-y-8"
-          }`}>
+          <div
+            className={`lg:col-span-2 relative p-8 lg:p-12 border border-foreground/10 bg-foreground/2 overflow-hidden transition-all duration-700 ${
+              isVisible
+                ? "opacity-100 translate-y-0"
+                : "opacity-0 translate-y-8"
+            }`}
+          >
             {/* Animated dots background with connecting lines */}
             <div className="absolute inset-0 opacity-70">
               {/* SVG for connecting lines */}
@@ -140,53 +161,76 @@ export function DatabaseSection() {
                 />
               ))}
             </div>
-            
+
             <div className="relative z-10">
               <div className="flex items-baseline gap-2 mb-4">
-                <span className="text-8xl lg:text-[10rem] font-display leading-none">3</span>
-                <span className="text-2xl text-muted-foreground">databases</span>
+                <span className="text-8xl lg:text-[10rem] font-display leading-none">
+                  3
+                </span>
+                <span className="text-2xl text-muted-foreground">
+                  databases
+                </span>
               </div>
               <p className="text-muted-foreground max-w-md">
-                Built-in support for the most popular databases. Configure once, scale anywhere.
+                Built-in support for the most popular databases. Configure once,
+                scale anywhere.
               </p>
             </div>
           </div>
 
           {/* Stacked stat cards */}
           <div className="flex flex-col gap-6">
-            <div className={`p-8 border border-foreground/10 bg-foreground/2 transition-all duration-700 delay-100 ${
-              isVisible ? "opacity-100 translate-y-0" : "opacity-0 translate-y-8"
-            }`}>
-              <span className="text-5xl lg:text-6xl font-display">&lt; 20MB</span>
-              <span className="block text-sm text-muted-foreground mt-2">Binary size</span>
+            <div
+              className={`p-8 border border-foreground/10 bg-foreground/2 transition-all duration-700 delay-100 ${
+                isVisible
+                  ? "opacity-100 translate-y-0"
+                  : "opacity-0 translate-y-8"
+              }`}
+            >
+              <span className="text-5xl lg:text-6xl font-display">
+                &lt; 20MB
+              </span>
+              <span className="block text-sm text-muted-foreground mt-2">
+                Binary size
+              </span>
             </div>
-            
-            <div className={`p-8 border border-foreground/10 bg-foreground/2 transition-all duration-700 delay-200 ${
-              isVisible ? "opacity-100 translate-y-0" : "opacity-0 translate-y-8"
-            }`}>
+
+            <div
+              className={`p-8 border border-foreground/10 bg-foreground/2 transition-all duration-700 delay-200 ${
+                isVisible
+                  ? "opacity-100 translate-y-0"
+                  : "opacity-0 translate-y-8"
+              }`}
+            >
               <span className="text-5xl lg:text-6xl font-display">∞</span>
-              <span className="block text-sm text-muted-foreground mt-2">Projects per instance</span>
+              <span className="block text-sm text-muted-foreground mt-2">
+                Projects per instance
+              </span>
             </div>
           </div>
         </div>
 
         {/* Region list */}
-        <div className={`mt-12 grid grid-cols-2 lg:grid-cols-4 gap-4 transition-all duration-1000 delay-300 ${
-          isVisible ? "opacity-100" : "opacity-0"
-        }`}>
+        <div
+          className={`mt-12 grid grid-cols-2 lg:grid-cols-4 gap-4 transition-all duration-1000 delay-300 ${
+            isVisible ? "opacity-100" : "opacity-0"
+          }`}
+        >
           {regions.map((region, index) => (
             <div
               key={region.name}
               className={`p-6 border transition-all duration-300 cursor-default ${
-                activeRegion === index 
-                  ? "border-foreground/30 bg-foreground/4" 
+                activeRegion === index
+                  ? "border-foreground/30 bg-foreground/4"
                   : "border-foreground/10"
               }`}
             >
               <div className="flex items-center gap-2 mb-3">
-                <span className={`w-2 h-2 rounded-full transition-colors ${
-                  activeRegion === index ? "bg-[#eca8d6]" : "bg-foreground/20"
-                }`} />
+                <span
+                  className={`w-2 h-2 rounded-full transition-colors ${
+                    activeRegion === index ? "bg-[#eca8d6]" : "bg-foreground/20"
+                  }`}
+                />
                 <span className="text-xs font-mono text-muted-foreground uppercase tracking-wider">
                   {region.status}
                 </span>
diff --git a/apps/web/src/components/landing/features-section.tsx b/apps/web/src/components/landing/features-section.tsx
index b3786494..aaa88554 100644
--- a/apps/web/src/components/landing/features-section.tsx
+++ b/apps/web/src/components/landing/features-section.tsx
@@ -6,25 +6,29 @@ const features = [
   {
     number: "01",
     title: "Single Binary Deployment",
-    description: "Deploy Velopulent CMS as a single binary with built-in embedded dashboard. No dependencies, no complex setup required. Perfect for individuals, agencies, and enterprises.",
+    description:
+      "Deploy Velopulent CMS as a single binary with built-in embedded dashboard. No dependencies, no complex setup required. Perfect for individuals, agencies, and enterprises.",
     stats: { value: "<15MB", label: "memory footprint" },
   },
   {
     number: "02",
     title: "Multi-Protocol Support",
-    description: "Built-in REST, GraphQL, gRPC and MCP protocols in a single binary. Connect to any framework or tech stack with zero integration hassle.",
+    description:
+      "Built-in REST, GraphQL, gRPC and MCP protocols in a single binary. Connect to any framework or tech stack with zero integration hassle.",
     stats: { value: "4", label: "protocols supported" },
   },
   {
     number: "03",
     title: "Flexible Database Support",
-    description: "Works seamlessly with SQLite, MySQL, PostgreSQL and more. Configure once and scale across your infrastructure.",
+    description:
+      "Works seamlessly with SQLite, MySQL, PostgreSQL and more. Configure once and scale across your infrastructure.",
     stats: { value: "3+", label: "database engines" },
   },
   {
     number: "04",
     title: "Multi-Project Management",
-    description: "Manage multiple sites and projects from a single instance. Built-in access control with admin, editor, and viewer roles.",
+    description:
+      "Manage multiple sites and projects from a single instance. Built-in access control with admin, editor, and viewer roles.",
     stats: { value: "∞", label: "projects supported" },
   },
 ];
@@ -65,8 +69,8 @@ function ParticleVisualization() {
     const particles = Array.from({ length: COUNT }, (_, i) => {
       const seed = i * 1.618;
       return {
-        bx: ((seed * 127.1) % 1),
-        by: ((seed * 311.7) % 1),
+        bx: (seed * 127.1) % 1,
+        by: (seed * 311.7) % 1,
         phase: seed * Math.PI * 2,
         speed: 0.4 + (seed % 0.4),
         radius: 1.2 + (seed % 2.2),
@@ -138,7 +142,7 @@ export function FeaturesSection() {
       ([entry]) => {
         if (entry.isIntersecting) setIsVisible(true);
       },
-      { threshold: 0.1 }
+      { threshold: 0.1 },
     );
 
     if (sectionRef.current) observer.observe(sectionRef.current);
@@ -162,7 +166,9 @@ export function FeaturesSection() {
               </span>
               <h2
                 className={`text-6xl md:text-7xl lg:text-[128px] font-display tracking-tight leading-[0.9] transition-all duration-1000 ${
-                  isVisible ? "opacity-100 translate-y-0" : "opacity-0 translate-y-8"
+                  isVisible
+                    ? "opacity-100 translate-y-0"
+                    : "opacity-0 translate-y-8"
                 }`}
               >
                 Powerful
@@ -171,10 +177,16 @@ export function FeaturesSection() {
               </h2>
             </div>
             <div className="lg:col-span-5 lg:pb-4">
-              <p className={`text-xl text-muted-foreground leading-relaxed transition-all duration-1000 delay-200 ${
-                isVisible ? "opacity-100 translate-y-0" : "opacity-0 translate-y-4"
-              }`}>
-                Everything you need to manage content at scale. From single projects to enterprise deployments with multiple sites and teams.
+              <p
+                className={`text-xl text-muted-foreground leading-relaxed transition-all duration-1000 delay-200 ${
+                  isVisible
+                    ? "opacity-100 translate-y-0"
+                    : "opacity-0 translate-y-4"
+                }`}
+              >
+                Everything you need to manage content at scale. From single
+                projects to enterprise deployments with multiple sites and
+                teams.
               </p>
             </div>
           </div>
@@ -183,9 +195,11 @@ export function FeaturesSection() {
         {/* Bento Grid Layout */}
         <div className="grid lg:grid-cols-12 gap-4 lg:gap-6">
           {/* Large feature card */}
-          <div 
+          <div
             className={`lg:col-span-12 relative bg-black border border-foreground/10 min-h-125 overflow-hidden group transition-all duration-700 flex ${
-              isVisible ? "opacity-100 translate-y-0" : "opacity-0 translate-y-12"
+              isVisible
+                ? "opacity-100 translate-y-0"
+                : "opacity-0 translate-y-12"
             }`}
             onMouseEnter={() => setActiveFeature(0)}
           >
@@ -193,7 +207,9 @@ export function FeaturesSection() {
             <div className="relative flex-1 p-8 lg:p-12 bg-black">
               <ParticleVisualization />
               <div className="relative z-10">
-                <span className="font-mono text-sm text-muted-foreground">{features[0].number}</span>
+                <span className="font-mono text-sm text-muted-foreground">
+                  {features[0].number}
+                </span>
                 <h3 className="text-3xl lg:text-4xl font-display mt-4 mb-6 group-hover:translate-x-2 transition-transform duration-500">
                   {features[0].title}
                 </h3>
@@ -201,8 +217,12 @@ export function FeaturesSection() {
                   {features[0].description}
                 </p>
                 <div>
-                  <span className="text-5xl lg:text-6xl font-display">{features[0].stats.value}</span>
-                  <span className="block text-sm text-muted-foreground font-mono mt-2">{features[0].stats.label}</span>
+                  <span className="text-5xl lg:text-6xl font-display">
+                    {features[0].stats.value}
+                  </span>
+                  <span className="block text-sm text-muted-foreground font-mono mt-2">
+                    {features[0].stats.label}
+                  </span>
                 </div>
               </div>
             </div>
diff --git a/apps/web/src/components/landing/security-section.tsx b/apps/web/src/components/landing/security-section.tsx
index 49c5f52f..c806091a 100644
--- a/apps/web/src/components/landing/security-section.tsx
+++ b/apps/web/src/components/landing/security-section.tsx
@@ -42,7 +42,7 @@ export function SecuritySection() {
       ([entry]) => {
         if (entry.isIntersecting) setIsVisible(true);
       },
-      { threshold: 0.1 }
+      { threshold: 0.1 },
     );
 
     if (sectionRef.current) observer.observe(sectionRef.current);
@@ -57,34 +57,47 @@ export function SecuritySection() {
   }, []);
 
   return (
-    <section id="security" ref={sectionRef} className="relative py-32 lg:py-40 overflow-hidden">
+    <section
+      id="security"
+      ref={sectionRef}
+      className="relative py-32 lg:py-40 overflow-hidden"
+    >
       {/* Background accent removed */}
-      
+
       <div className="max-w-350 mx-auto px-6 lg:px-12">
         {/* Header */}
         <div className="mb-20">
-          <span className={`inline-flex items-center gap-4 text-sm font-mono text-muted-foreground mb-8 transition-all duration-700 ${
-            isVisible ? "opacity-100" : "opacity-0"
-          }`}>
+          <span
+            className={`inline-flex items-center gap-4 text-sm font-mono text-muted-foreground mb-8 transition-all duration-700 ${
+              isVisible ? "opacity-100" : "opacity-0"
+            }`}
+          >
             <span className="w-12 h-px bg-foreground/20" />
             Security
           </span>
-          
+
           {/* Title — full width */}
-          <h2 className={`text-6xl md:text-7xl lg:text-[128px] font-display tracking-tight leading-[0.9] mb-12 transition-all duration-1000 ${
-            isVisible ? "opacity-100 translate-y-0" : "opacity-0 translate-y-8"
-          }`}>
+          <h2
+            className={`text-6xl md:text-7xl lg:text-[128px] font-display tracking-tight leading-[0.9] mb-12 transition-all duration-1000 ${
+              isVisible
+                ? "opacity-100 translate-y-0"
+                : "opacity-0 translate-y-8"
+            }`}
+          >
             Built for trust.
             <br />
             <span className="text-muted-foreground">Auditable and open.</span>
           </h2>
-          
+
           {/* Description — below title */}
-          <div className={`transition-all duration-1000 delay-100 ${
-            isVisible ? "opacity-100" : "opacity-0"
-          }`}>
+          <div
+            className={`transition-all duration-1000 delay-100 ${
+              isVisible ? "opacity-100" : "opacity-0"
+            }`}
+          >
             <p className="text-xl text-muted-foreground leading-relaxed max-w-2xl">
-              100% open source means you control your data. Role-based access control for teams. Complete audit history of all changes.
+              100% open source means you control your data. Role-based access
+              control for teams. Complete audit history of all changes.
             </p>
           </div>
         </div>
@@ -92,9 +105,13 @@ export function SecuritySection() {
         {/* Main content */}
         <div className="grid lg:grid-cols-12 gap-6">
           {/* Large visual card */}
-          <div className={`lg:col-span-7 relative p-8 lg:p-12 border border-foreground/10 min-h-100 overflow-hidden transition-all duration-700 ${
-            isVisible ? "opacity-100 translate-y-0" : "opacity-0 translate-y-8"
-          }`}>
+          <div
+            className={`lg:col-span-7 relative p-8 lg:p-12 border border-foreground/10 min-h-100 overflow-hidden transition-all duration-700 ${
+              isVisible
+                ? "opacity-100 translate-y-0"
+                : "opacity-0 translate-y-8"
+            }`}
+          >
             {/* Dynamic feature image with cross-fade — desktop only */}
             <div className="absolute inset-0 pointer-events-none items-center justify-end hidden lg:flex">
               {securityFeatures.map((feature, index) => (
@@ -107,22 +124,28 @@ export function SecuritySection() {
                 />
               ))}
             </div>
-            
+
             <div className="relative z-10">
-              <span className="font-mono text-sm text-muted-foreground">Your data</span>
+              <span className="font-mono text-sm text-muted-foreground">
+                Your data
+              </span>
               <div className="mt-8">
                 <span className="text-7xl lg:text-8xl font-display">100%</span>
-                <span className="block text-muted-foreground mt-2">Under your control</span>
+                <span className="block text-muted-foreground mt-2">
+                  Under your control
+                </span>
               </div>
             </div>
-            
+
             {/* Certification badges */}
             <div className="absolute bottom-8 left-8 right-8 flex flex-wrap gap-2">
               {certifications.map((cert, index) => (
                 <span
                   key={cert}
                   className={`px-3 py-1 border border-foreground/10 text-xs font-mono text-muted-foreground transition-all duration-500 ${
-                    isVisible ? "opacity-100 translate-y-0" : "opacity-0 translate-y-4"
+                    isVisible
+                      ? "opacity-100 translate-y-0"
+                      : "opacity-0 translate-y-4"
                   }`}
                   style={{ transitionDelay: `${index * 100 + 300}ms` }}
                 >
@@ -138,8 +161,8 @@ export function SecuritySection() {
               <div
                 key={feature.title}
                 className={`p-6 border transition-all duration-500 cursor-default ${
-                  activeFeature === index 
-                    ? "border-foreground/30 bg-foreground/4" 
+                  activeFeature === index
+                    ? "border-foreground/30 bg-foreground/4"
                     : "border-foreground/10"
                 } ${isVisible ? "opacity-100 translate-x-0" : "opacity-0 translate-x-8"}`}
                 style={{ transitionDelay: `${index * 80}ms` }}
@@ -147,16 +170,20 @@ export function SecuritySection() {
                 onMouseEnter={() => setActiveFeature(index)}
               >
                 <div className="flex items-start gap-4">
-                  <div className={`shrink-0 w-10 h-10 flex items-center justify-center border transition-colors ${
-                    activeFeature === index 
-                      ? "border-foreground bg-foreground text-background" 
-                      : "border-foreground/20"
-                  }`}>
+                  <div
+                    className={`shrink-0 w-10 h-10 flex items-center justify-center border transition-colors ${
+                      activeFeature === index
+                        ? "border-foreground bg-foreground text-background"
+                        : "border-foreground/20"
+                    }`}
+                  >
                     <feature.icon className="w-5 h-5" />
                   </div>
                   <div>
                     <h3 className="font-medium mb-1">{feature.title}</h3>
-                    <p className="text-sm text-muted-foreground">{feature.description}</p>
+                    <p className="text-sm text-muted-foreground">
+                      {feature.description}
+                    </p>
                   </div>
                 </div>
               </div>
diff --git a/apps/web/src/components/mdx.tsx b/apps/web/src/components/mdx.tsx
index a640575f..62ce6e51 100644
--- a/apps/web/src/components/mdx.tsx
+++ b/apps/web/src/components/mdx.tsx
@@ -1,5 +1,5 @@
-import defaultMdxComponents from 'fumadocs-ui/mdx';
-import type { MDXComponents } from 'mdx/types';
+import defaultMdxComponents from "fumadocs-ui/mdx";
+import type { MDXComponents } from "mdx/types";
 
 export function getMDXComponents(components?: MDXComponents) {
   return {
diff --git a/apps/web/src/components/provider.tsx b/apps/web/src/components/provider.tsx
index 522282b2..6f92c0c4 100644
--- a/apps/web/src/components/provider.tsx
+++ b/apps/web/src/components/provider.tsx
@@ -1,7 +1,7 @@
-'use client';
-import SearchDialog from '@/components/search';
-import { RootProvider } from 'fumadocs-ui/provider/next';
-import { type ReactNode } from 'react';
+"use client";
+import SearchDialog from "@/components/search";
+import { RootProvider } from "fumadocs-ui/provider/next";
+import { type ReactNode } from "react";
 
 export function Provider({ children }: { children: ReactNode }) {
   return <RootProvider search={{ SearchDialog }}>{children}</RootProvider>;
diff --git a/apps/web/src/components/search.tsx b/apps/web/src/components/search.tsx
index 1f704205..a88ce513 100644
--- a/apps/web/src/components/search.tsx
+++ b/apps/web/src/components/search.tsx
@@ -1,4 +1,4 @@
-'use client';
+"use client";
 import {
   SearchDialog,
   SearchDialogClose,
@@ -9,29 +9,34 @@ import {
   SearchDialogList,
   SearchDialogOverlay,
   type SharedProps,
-} from 'fumadocs-ui/components/dialog/search';
-import { useDocsSearch } from 'fumadocs-core/search/client';
-import { create } from '@orama/orama';
-import { useI18n } from 'fumadocs-ui/contexts/i18n';
+} from "fumadocs-ui/components/dialog/search";
+import { useDocsSearch } from "fumadocs-core/search/client";
+import { create } from "@orama/orama";
+import { useI18n } from "fumadocs-ui/contexts/i18n";
 
 function initOrama() {
   return create({
-    schema: { _: 'string' },
+    schema: { _: "string" },
     // https://docs.orama.com/docs/orama-js/supported-languages
-    language: 'english',
+    language: "english",
   });
 }
 
 export default function DefaultSearchDialog(props: SharedProps) {
   const { locale } = useI18n(); // (optional) for i18n
   const { search, setSearch, query } = useDocsSearch({
-    type: 'static',
+    type: "static",
     initOrama,
     locale,
   });
 
   return (
-    <SearchDialog search={search} onSearchChange={setSearch} isLoading={query.isLoading} {...props}>
+    <SearchDialog
+      search={search}
+      onSearchChange={setSearch}
+      isLoading={query.isLoading}
+      {...props}
+    >
       <SearchDialogOverlay />
       <SearchDialogContent>
         <SearchDialogHeader>
@@ -39,7 +44,7 @@ export default function DefaultSearchDialog(props: SharedProps) {
           <SearchDialogInput />
           <SearchDialogClose />
         </SearchDialogHeader>
-        <SearchDialogList items={query.data !== 'empty' ? query.data : null} />
+        <SearchDialogList items={query.data !== "empty" ? query.data : null} />
       </SearchDialogContent>
     </SearchDialog>
   );
diff --git a/apps/web/src/components/ui/button.tsx b/apps/web/src/components/ui/button.tsx
index 6138844d..fb5b30b3 100644
--- a/apps/web/src/components/ui/button.tsx
+++ b/apps/web/src/components/ui/button.tsx
@@ -1,8 +1,8 @@
-import * as React from "react"
-import { cva, type VariantProps } from "class-variance-authority"
-import { Slot } from "radix-ui"
+import * as React from "react";
+import { cva, type VariantProps } from "class-variance-authority";
+import { Slot } from "radix-ui";
 
-import { cn } from "@/lib/utils"
+import { cn } from "@/lib/utils";
 
 const buttonVariants = cva(
   "group/button inline-flex shrink-0 items-center justify-center rounded-lg border border-transparent bg-clip-padding text-sm font-medium whitespace-nowrap transition-all outline-none select-none focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 active:not-aria-[haspopup]:translate-y-px disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
@@ -38,8 +38,8 @@ const buttonVariants = cva(
       variant: "default",
       size: "default",
     },
-  }
-)
+  },
+);
 
 function Button({
   className,
@@ -49,9 +49,9 @@ function Button({
   ...props
 }: React.ComponentProps<"button"> &
   VariantProps<typeof buttonVariants> & {
-    asChild?: boolean
+    asChild?: boolean;
   }) {
-  const Comp = asChild ? Slot.Root : "button"
+  const Comp = asChild ? Slot.Root : "button";
 
   return (
     <Comp
@@ -61,7 +61,7 @@ function Button({
       className={cn(buttonVariants({ variant, size, className }))}
       {...props}
     />
-  )
+  );
 }
 
-export { Button, buttonVariants }
+export { Button, buttonVariants };
diff --git a/apps/web/src/components/ui/select.tsx b/apps/web/src/components/ui/select.tsx
index f09dfb48..88d61f2d 100644
--- a/apps/web/src/components/ui/select.tsx
+++ b/apps/web/src/components/ui/select.tsx
@@ -1,15 +1,15 @@
-"use client"
+"use client";
 
-import * as React from "react"
-import { Select as SelectPrimitive } from "radix-ui"
+import * as React from "react";
+import { Select as SelectPrimitive } from "radix-ui";
 
-import { cn } from "@/lib/utils"
-import { ChevronDownIcon, CheckIcon, ChevronUpIcon } from "lucide-react"
+import { cn } from "@/lib/utils";
+import { ChevronDownIcon, CheckIcon, ChevronUpIcon } from "lucide-react";
 
 function Select({
   ...props
 }: React.ComponentProps<typeof SelectPrimitive.Root>) {
-  return <SelectPrimitive.Root data-slot="select" {...props} />
+  return <SelectPrimitive.Root data-slot="select" {...props} />;
 }
 
 function SelectGroup({
@@ -22,13 +22,13 @@ function SelectGroup({
       className={cn("scroll-my-1 p-1", className)}
       {...props}
     />
-  )
+  );
 }
 
 function SelectValue({
   ...props
 }: React.ComponentProps<typeof SelectPrimitive.Value>) {
-  return <SelectPrimitive.Value data-slot="select-value" {...props} />
+  return <SelectPrimitive.Value data-slot="select-value" {...props} />;
 }
 
 function SelectTrigger({
@@ -37,7 +37,7 @@ function SelectTrigger({
   children,
   ...props
 }: React.ComponentProps<typeof SelectPrimitive.Trigger> & {
-  size?: "sm" | "default"
+  size?: "sm" | "default";
 }) {
   return (
     <SelectPrimitive.Trigger
@@ -45,7 +45,7 @@ function SelectTrigger({
       data-size={size}
       className={cn(
         "flex w-fit items-center justify-between gap-1.5 rounded-lg border border-input bg-transparent py-2 pr-2 pl-2.5 text-sm whitespace-nowrap transition-colors outline-none select-none focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 data-placeholder:text-muted-foreground data-[size=default]:h-8 data-[size=sm]:h-7 data-[size=sm]:rounded-[min(var(--radius-md),10px)] *:data-[slot=select-value]:line-clamp-1 *:data-[slot=select-value]:flex *:data-[slot=select-value]:items-center *:data-[slot=select-value]:gap-1.5 dark:bg-input/30 dark:hover:bg-input/50 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
-        className
+        className,
       )}
       {...props}
     >
@@ -54,7 +54,7 @@ function SelectTrigger({
         <ChevronDownIcon className="pointer-events-none size-4 text-muted-foreground" />
       </SelectPrimitive.Icon>
     </SelectPrimitive.Trigger>
-  )
+  );
 }
 
 function SelectContent({
@@ -69,7 +69,12 @@ function SelectContent({
       <SelectPrimitive.Content
         data-slot="select-content"
         data-align-trigger={position === "item-aligned"}
-        className={cn("relative z-50 max-h-(--radix-select-content-available-height) min-w-36 origin-(--radix-select-content-transform-origin) overflow-x-hidden overflow-y-auto rounded-lg bg-popover text-popover-foreground shadow-md ring-1 ring-foreground/10 duration-100 data-[align-trigger=true]:animate-none data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95", position ==="popper"&&"data-[side=bottom]:translate-y-1 data-[side=left]:-translate-x-1 data-[side=right]:translate-x-1 data-[side=top]:-translate-y-1", className )}
+        className={cn(
+          "relative z-50 max-h-(--radix-select-content-available-height) min-w-36 origin-(--radix-select-content-transform-origin) overflow-x-hidden overflow-y-auto rounded-lg bg-popover text-popover-foreground shadow-md ring-1 ring-foreground/10 duration-100 data-[align-trigger=true]:animate-none data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95",
+          position === "popper" &&
+            "data-[side=bottom]:translate-y-1 data-[side=left]:-translate-x-1 data-[side=right]:translate-x-1 data-[side=top]:-translate-y-1",
+          className,
+        )}
         position={position}
         align={align}
         {...props}
@@ -79,7 +84,7 @@ function SelectContent({
           data-position={position}
           className={cn(
             "data-[position=popper]:h-(--radix-select-trigger-height) data-[position=popper]:w-full data-[position=popper]:min-w-(--radix-select-trigger-width)",
-            position === "popper" && ""
+            position === "popper" && "",
           )}
         >
           {children}
@@ -87,7 +92,7 @@ function SelectContent({
         <SelectScrollDownButton />
       </SelectPrimitive.Content>
     </SelectPrimitive.Portal>
-  )
+  );
 }
 
 function SelectLabel({
@@ -100,7 +105,7 @@ function SelectLabel({
       className={cn("px-1.5 py-1 text-xs text-muted-foreground", className)}
       {...props}
     />
-  )
+  );
 }
 
 function SelectItem({
@@ -113,7 +118,7 @@ function SelectItem({
       data-slot="select-item"
       className={cn(
         "relative flex w-full cursor-default items-center gap-1.5 rounded-md py-1 pr-8 pl-1.5 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 *:[span]:last:flex *:[span]:last:items-center *:[span]:last:gap-2",
-        className
+        className,
       )}
       {...props}
     >
@@ -124,7 +129,7 @@ function SelectItem({
       </span>
       <SelectPrimitive.ItemText>{children}</SelectPrimitive.ItemText>
     </SelectPrimitive.Item>
-  )
+  );
 }
 
 function SelectSeparator({
@@ -137,7 +142,7 @@ function SelectSeparator({
       className={cn("pointer-events-none -mx-1 my-1 h-px bg-border", className)}
       {...props}
     />
-  )
+  );
 }
 
 function SelectScrollUpButton({
@@ -149,14 +154,13 @@ function SelectScrollUpButton({
       data-slot="select-scroll-up-button"
       className={cn(
         "z-10 flex cursor-default items-center justify-center bg-popover py-1 [&_svg:not([class*='size-'])]:size-4",
-        className
+        className,
       )}
       {...props}
     >
-      <ChevronUpIcon
-      />
+      <ChevronUpIcon />
     </SelectPrimitive.ScrollUpButton>
-  )
+  );
 }
 
 function SelectScrollDownButton({
@@ -168,14 +172,13 @@ function SelectScrollDownButton({
       data-slot="select-scroll-down-button"
       className={cn(
         "z-10 flex cursor-default items-center justify-center bg-popover py-1 [&_svg:not([class*='size-'])]:size-4",
-        className
+        className,
       )}
       {...props}
     >
-      <ChevronDownIcon
-      />
+      <ChevronDownIcon />
     </SelectPrimitive.ScrollDownButton>
-  )
+  );
 }
 
 export {
@@ -189,4 +192,4 @@ export {
   SelectSeparator,
   SelectTrigger,
   SelectValue,
-}
+};
diff --git a/apps/web/src/lib/cn.ts b/apps/web/src/lib/cn.ts
index ba66fd25..8e473dac 100644
--- a/apps/web/src/lib/cn.ts
+++ b/apps/web/src/lib/cn.ts
@@ -1 +1 @@
-export { twMerge as cn } from 'tailwind-merge';
+export { twMerge as cn } from "tailwind-merge";
diff --git a/apps/web/src/lib/layout.shared.tsx b/apps/web/src/lib/layout.shared.tsx
index 88b9ca86..ff20abdc 100644
--- a/apps/web/src/lib/layout.shared.tsx
+++ b/apps/web/src/lib/layout.shared.tsx
@@ -1,5 +1,5 @@
-import type { BaseLayoutProps } from 'fumadocs-ui/layouts/shared';
-import { appName, gitConfig } from './shared';
+import type { BaseLayoutProps } from "fumadocs-ui/layouts/shared";
+import { appName, gitConfig } from "./shared";
 
 export function baseOptions(): BaseLayoutProps {
   return {
diff --git a/apps/web/src/lib/shared.ts b/apps/web/src/lib/shared.ts
index 96f75463..743d25f4 100644
--- a/apps/web/src/lib/shared.ts
+++ b/apps/web/src/lib/shared.ts
@@ -1,11 +1,11 @@
-export const appName = 'Velopulent CMS';
-export const docsRoute = '/docs';
-export const docsImageRoute = '/og/docs';
-export const docsContentRoute = '/llms.mdx/docs';
+export const appName = "Velopulent CMS";
+export const docsRoute = "/docs";
+export const docsImageRoute = "/og/docs";
+export const docsContentRoute = "/llms.mdx/docs";
 
 // fill this with your actual GitHub info, for example:
 export const gitConfig = {
-  user: 'velopulent',
-  repo: 'cms',
-  branch: 'main',
+  user: "velopulent",
+  repo: "cms",
+  branch: "main",
 };
diff --git a/apps/web/src/lib/source.ts b/apps/web/src/lib/source.ts
index f5d0eae2..47710c0b 100644
--- a/apps/web/src/lib/source.ts
+++ b/apps/web/src/lib/source.ts
@@ -1,6 +1,6 @@
-import { docs } from 'collections/server';
-import { loader } from 'fumadocs-core/source';
-import { docsContentRoute, docsImageRoute, docsRoute } from './shared';
+import { docs } from "collections/server";
+import { loader } from "fumadocs-core/source";
+import { docsContentRoute, docsImageRoute, docsRoute } from "./shared";
 
 // See https://fumadocs.dev/docs/headless/source-api for more info
 export const source = loader({
@@ -9,26 +9,26 @@ export const source = loader({
   plugins: [],
 });
 
-export function getPageImage(page: (typeof source)['$inferPage']) {
-  const segments = [...page.slugs, 'image.png'];
+export function getPageImage(page: (typeof source)["$inferPage"]) {
+  const segments = [...page.slugs, "image.png"];
 
   return {
     segments,
-    url: `${docsImageRoute}/${segments.join('/')}`,
+    url: `${docsImageRoute}/${segments.join("/")}`,
   };
 }
 
-export function getPageMarkdownUrl(page: (typeof source)['$inferPage']) {
-  const segments = [...page.slugs, 'content.md'];
+export function getPageMarkdownUrl(page: (typeof source)["$inferPage"]) {
+  const segments = [...page.slugs, "content.md"];
 
   return {
     segments,
-    url: `${docsContentRoute}/${segments.join('/')}`,
+    url: `${docsContentRoute}/${segments.join("/")}`,
   };
 }
 
-export async function getLLMText(page: (typeof source)['$inferPage']) {
-  const processed = await page.data.getText('processed');
+export async function getLLMText(page: (typeof source)["$inferPage"]) {
+  const processed = await page.data.getText("processed");
 
   return `# ${page.data.title} (${page.url})
 
diff --git a/apps/web/src/lib/utils.ts b/apps/web/src/lib/utils.ts
index bd0c391d..a5ef1935 100644
--- a/apps/web/src/lib/utils.ts
+++ b/apps/web/src/lib/utils.ts
@@ -1,6 +1,6 @@
-import { clsx, type ClassValue } from "clsx"
-import { twMerge } from "tailwind-merge"
+import { clsx, type ClassValue } from "clsx";
+import { twMerge } from "tailwind-merge";
 
 export function cn(...inputs: ClassValue[]) {
-  return twMerge(clsx(inputs))
+  return twMerge(clsx(inputs));
 }
diff --git a/apps/web/tsconfig.json b/apps/web/tsconfig.json
index 59c41baa..f43f8735 100644
--- a/apps/web/tsconfig.json
+++ b/apps/web/tsconfig.json
@@ -1,11 +1,7 @@
 {
   "compilerOptions": {
     "target": "ESNext",
-    "lib": [
-      "dom",
-      "dom.iterable",
-      "esnext"
-    ],
+    "lib": ["dom", "dom.iterable", "esnext"],
     "allowJs": true,
     "skipLibCheck": true,
     "strict": true,
@@ -19,12 +15,8 @@
     "jsx": "react-jsx",
     "incremental": true,
     "paths": {
-      "@/*": [
-        "./src/*"
-      ],
-      "collections/*": [
-        "./.source/*"
-      ]
+      "@/*": ["./src/*"],
+      "collections/*": ["./.source/*"]
     },
     "plugins": [
       {
@@ -39,7 +31,5 @@
     ".next/types/**/*.ts",
     ".next/dev/types/**/*.ts"
   ],
-  "exclude": [
-    "node_modules"
-  ]
-}
\ No newline at end of file
+  "exclude": ["node_modules"]
+}

From 2d6d0ce899a9e9f94b356e0a8f54c788d81dc1a3 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 09:18:24 +0530
Subject: [PATCH 31/43] fix(workflows): enhance release workflow for
 multi-architecture support and caching

---
 .github/workflows/release.yml | 111 ++++++++++++++++++++++++----------
 1 file changed, 79 insertions(+), 32 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 556cbd3f..936be0ef 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,8 +1,12 @@
 name: Release
 
-# Tag-driven. Push a tag like `v1.2.3` to build per-OS binaries and attach them to
-# a GitHub Release. The release binary embeds apps/dashboard/dist via rust-embed,
+# Tag-driven. Push a tag like `v1.2.3` to build per-OS/arch binaries and attach them
+# to a GitHub Release. The release binary embeds apps/dashboard/dist via rust-embed,
 # so the dashboard MUST be built before `cargo build --release`.
+#
+# The dashboard dist is static (JS/HTML) and identical for every target, so it is
+# built ONCE here and shared to all build jobs as an artifact. The build matrix then
+# runs natively on each OS/arch (no cross-compilation) and compiles cargo directly.
 on:
   push:
     tags:
@@ -12,57 +16,100 @@ permissions:
   contents: write
 
 jobs:
+  # Build the static dashboard once. Every build job consumes this same dist.
+  dashboard:
+    name: Build dashboard
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      # Persist the Nx local cache across runs. Ephemeral runners wipe .nx/cache, so
+      # without this Nx caching is a no-op. This lets dashboard:build (8-10s) replay
+      # from cache instead of rebuilding.
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: .nx/cache
+          key: nx-${{ runner.os }}-${{ hashFiles('apps/dashboard/**', 'bun.lock', 'package.json', 'nx.json') }}
+          restore-keys: |
+            nx-${{ runner.os }}-
+      - name: Build dashboard
+        run: |
+          bun install --frozen-lockfile
+          bunx nx run dashboard:build
+      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        with:
+          name: dashboard-dist
+          path: apps/dashboard/dist
+          if-no-files-found: error
+
   build:
-    name: Build (${{ matrix.target }})
-    runs-on: ${{ matrix.os }}
+    name: Build (${{ matrix.os }}-${{ matrix.arch }})
+    needs: dashboard
+    runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            target: x86_64-unknown-linux-gnu
+          - os: linux
+            arch: amd64
+            runner: ubuntu-latest
             bin: cms
-            asset: cms-x86_64-linux
-          - os: windows-latest
-            target: x86_64-pc-windows-msvc
-            bin: cms.exe
-            asset: cms-x86_64-windows.exe
-          - os: macos-latest
-            target: aarch64-apple-darwin
+            asset: cms-${{ github.ref_name }}-linux-amd64
+          - os: linux
+            arch: arm64
+            runner: ubuntu-24.04-arm
+            bin: cms
+            asset: cms-${{ github.ref_name }}-linux-arm64
+          - os: macos
+            arch: amd64
+            runner: macos-13
+            bin: cms
+            asset: cms-${{ github.ref_name }}-macos-amd64
+          - os: macos
+            arch: arm64
+            runner: macos-14
             bin: cms
-            asset: cms-aarch64-macos
+            asset: cms-${{ github.ref_name }}-macos-arm64
+          - os: windows
+            arch: amd64
+            runner: windows-latest
+            bin: cms.exe
+            asset: cms-${{ github.ref_name }}-windows-amd64.exe
+          - os: windows
+            arch: arm64
+            runner: windows-11-arm
+            bin: cms.exe
+            asset: cms-${{ github.ref_name }}-windows-arm64.exe
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
+      # rust-embed (#[folder = "../dashboard/dist"]) needs the built dashboard present
+      # at compile time. Pull the shared artifact into apps/dashboard/dist.
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          name: dashboard-dist
+          path: apps/dashboard/dist
       - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      # Installs the host toolchain, which on each runner is already the target arch
+      # (native build, no --target needed).
       - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
         with:
           toolchain: "1.94"
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: apps/backend
-          key: release-${{ matrix.target }}
-      # Persist the Nx local cache across runs. Ephemeral runners wipe .nx/cache, so
-      # without this Nx caching is a no-op. This lets dashboard:build (8-10s) replay
-      # from cache instead of rebuilding; the Rust compile stays on rust-cache above.
-      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
-        with:
-          path: .nx/cache
-          key: nx-${{ runner.os }}-${{ hashFiles('apps/dashboard/**', 'bun.lock', 'package.json', 'nx.json') }}
-          restore-keys: |
-            nx-${{ runner.os }}-
+          key: release-${{ matrix.os }}-${{ matrix.arch }}
 
-      # Single Nx command owns the dashboard -> backend ordering: backend:build
-      # dependsOn dashboard:build (rust-embed bakes apps/dashboard/dist into the
-      # binary) and sets SKIP_DASHBOARD_BUILD=1 so cargo consumes the built dist.
-      - name: Build release binary (dashboard + backend via Nx)
-        run: |
-          bun install --frozen-lockfile
-          bunx nx run backend:build
+      # Build cargo directly (dist is already present from the artifact); keep the
+      # default `embed-dashboard` feature so rust-embed bakes in apps/dashboard/dist.
+      - name: Build release binary
+        working-directory: apps/backend
+        run: cargo build --release --locked
 
       - name: Stage artifact
         shell: bash

From bf80677c34f8a8128b9ca3fda98e3e22fe9c6caa Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 09:24:21 +0530
Subject: [PATCH 32/43] style: sort imports

---
 apps/web/source.config.ts                        |  2 +-
 apps/web/src/app/(home)/_download/page.tsx       |  8 ++++----
 apps/web/src/app/(home)/layout.tsx               |  2 +-
 apps/web/src/app/(home)/page.tsx                 | 16 ++++++++--------
 apps/web/src/app/api/search/route.ts             |  2 +-
 apps/web/src/app/docs/[[...slug]]/page.tsx       |  6 +++---
 apps/web/src/app/docs/layout.tsx                 |  6 +++---
 apps/web/src/app/layout.tsx                      |  2 +-
 .../src/app/llms.mdx/docs/[[...slug]]/route.ts   |  2 +-
 apps/web/src/app/llms.txt/route.ts               |  2 +-
 apps/web/src/app/og/docs/[...slug]/route.tsx     |  4 ++--
 apps/web/src/components/landing/ascii-scene.tsx  |  2 +-
 .../src/components/landing/backup-section.tsx    |  4 ++--
 apps/web/src/components/landing/cta-section.tsx  |  8 ++++++--
 .../src/components/landing/dashboard-section.tsx |  4 ++--
 .../src/components/landing/database-section.tsx  |  2 +-
 .../src/components/landing/footer-section.tsx    |  1 +
 apps/web/src/components/landing/hero-section.tsx |  4 ++--
 .../components/landing/integrations-section.tsx  |  2 +-
 apps/web/src/components/landing/navigation.tsx   |  4 ++--
 .../src/components/landing/security-section.tsx  |  4 ++--
 .../components/landing/testimonials-section.tsx  |  2 +-
 apps/web/src/components/landing/use-cases.tsx    |  2 +-
 apps/web/src/components/provider.tsx             |  4 ++--
 apps/web/src/components/search.tsx               |  4 ++--
 apps/web/src/lib/utils.ts                        |  2 +-
 26 files changed, 53 insertions(+), 48 deletions(-)

diff --git a/apps/web/source.config.ts b/apps/web/source.config.ts
index 43aeb805..4cef0055 100644
--- a/apps/web/source.config.ts
+++ b/apps/web/source.config.ts
@@ -1,5 +1,5 @@
-import { defineConfig, defineDocs } from "fumadocs-mdx/config";
 import { metaSchema, pageSchema } from "fumadocs-core/source/schema";
+import { defineConfig, defineDocs } from "fumadocs-mdx/config";
 
 // You can customize Zod schemas for frontmatter and `meta.json` here
 // see https://fumadocs.dev/docs/mdx/collections
diff --git a/apps/web/src/app/(home)/_download/page.tsx b/apps/web/src/app/(home)/_download/page.tsx
index df0d9a76..e6b2d57c 100644
--- a/apps/web/src/app/(home)/_download/page.tsx
+++ b/apps/web/src/app/(home)/_download/page.tsx
@@ -1,8 +1,11 @@
 "use client";
 
+import { Icon } from "@iconify-icon/react";
+import { Check, Code2, Download } from "lucide-react";
+import Image from "next/image";
 import { useState } from "react";
-import { Navigation } from "@/components/landing/navigation";
 import { FooterSection } from "@/components/landing/footer-section";
+import { Navigation } from "@/components/landing/navigation";
 import { Button } from "@/components/ui/button";
 import {
   Select,
@@ -11,9 +14,6 @@ import {
   SelectTrigger,
   SelectValue,
 } from "@/components/ui/select";
-import { Check, Download, Code2 } from "lucide-react";
-import { Icon } from "@iconify-icon/react";
-import Image from "next/image";
 
 type OS = "linux" | "macos" | "windows";
 type Architecture = "x86_64" | "aarch64" | "arm64";
diff --git a/apps/web/src/app/(home)/layout.tsx b/apps/web/src/app/(home)/layout.tsx
index 94893fae..8f356971 100644
--- a/apps/web/src/app/(home)/layout.tsx
+++ b/apps/web/src/app/(home)/layout.tsx
@@ -1,10 +1,10 @@
-import React from "react";
 import type { Metadata } from "next";
 import {
   Instrument_Sans,
   Instrument_Serif,
   JetBrains_Mono,
 } from "next/font/google";
+import type React from "react";
 import "./home.css";
 import { Navigation } from "@/components/landing/navigation";
 
diff --git a/apps/web/src/app/(home)/page.tsx b/apps/web/src/app/(home)/page.tsx
index c3504e21..308aef62 100644
--- a/apps/web/src/app/(home)/page.tsx
+++ b/apps/web/src/app/(home)/page.tsx
@@ -1,16 +1,16 @@
-import { Navigation } from "@/components/landing/navigation";
-import { HeroSection } from "@/components/landing/hero-section";
+import { BackupSection } from "@/components/landing/backup-section";
+import { CtaSection } from "@/components/landing/cta-section";
+import { DashboardSection } from "@/components/landing/dashboard-section";
+import { DatabaseSection } from "@/components/landing/database-section";
 import { FeaturesSection } from "@/components/landing/features-section";
+import { FooterSection } from "@/components/landing/footer-section";
+import { HeroSection } from "@/components/landing/hero-section";
 import { HowItWorksSection } from "@/components/landing/how-it-works-section";
-import { DatabaseSection } from "@/components/landing/database-section";
-import { DashboardSection } from "@/components/landing/dashboard-section";
 import { IntegrationsSection } from "@/components/landing/integrations-section";
+import { Navigation } from "@/components/landing/navigation";
 import { SecuritySection } from "@/components/landing/security-section";
-import { UseCasesSection } from "@/components/landing/use-cases";
 import { TestimonialsSection } from "@/components/landing/testimonials-section";
-import { CtaSection } from "@/components/landing/cta-section";
-import { FooterSection } from "@/components/landing/footer-section";
-import { BackupSection } from "@/components/landing/backup-section";
+import { UseCasesSection } from "@/components/landing/use-cases";
 
 export default function Home() {
   return (
diff --git a/apps/web/src/app/api/search/route.ts b/apps/web/src/app/api/search/route.ts
index 85448f9d..c312b919 100644
--- a/apps/web/src/app/api/search/route.ts
+++ b/apps/web/src/app/api/search/route.ts
@@ -1,5 +1,5 @@
-import { source } from "@/lib/source";
 import { createFromSource } from "fumadocs-core/search/server";
+import { source } from "@/lib/source";
 
 export const revalidate = false;
 
diff --git a/apps/web/src/app/docs/[[...slug]]/page.tsx b/apps/web/src/app/docs/[[...slug]]/page.tsx
index 54115be6..074d053a 100644
--- a/apps/web/src/app/docs/[[...slug]]/page.tsx
+++ b/apps/web/src/app/docs/[[...slug]]/page.tsx
@@ -1,4 +1,3 @@
-import { getPageImage, getPageMarkdownUrl, source } from "@/lib/source";
 import {
   DocsBody,
   DocsDescription,
@@ -7,11 +6,12 @@ import {
   MarkdownCopyButton,
   ViewOptionsPopover,
 } from "fumadocs-ui/layouts/docs/page";
+import { createRelativeLink } from "fumadocs-ui/mdx";
+import type { Metadata } from "next";
 import { notFound } from "next/navigation";
 import { getMDXComponents } from "@/components/mdx";
-import type { Metadata } from "next";
-import { createRelativeLink } from "fumadocs-ui/mdx";
 import { gitConfig } from "@/lib/shared";
+import { getPageImage, getPageMarkdownUrl, source } from "@/lib/source";
 
 export default async function Page(props: PageProps<"/docs/[[...slug]]">) {
   const params = await props.params;
diff --git a/apps/web/src/app/docs/layout.tsx b/apps/web/src/app/docs/layout.tsx
index 5f237b0b..7ecb42d2 100644
--- a/apps/web/src/app/docs/layout.tsx
+++ b/apps/web/src/app/docs/layout.tsx
@@ -1,10 +1,10 @@
 import "./docs.css";
-import { source } from "@/lib/source";
 import { DocsLayout } from "fumadocs-ui/layouts/docs";
-import { baseOptions } from "@/lib/layout.shared";
-import { Provider as FumadocsProvider } from "@/components/provider";
 import { Geist, Inter } from "next/font/google";
+import { Provider as FumadocsProvider } from "@/components/provider";
 import { cn } from "@/lib/cn";
+import { baseOptions } from "@/lib/layout.shared";
+import { source } from "@/lib/source";
 
 const geist = Geist({ subsets: ["latin"], variable: "--font-sans" });
 
diff --git a/apps/web/src/app/layout.tsx b/apps/web/src/app/layout.tsx
index 787e60cc..f37e6c76 100644
--- a/apps/web/src/app/layout.tsx
+++ b/apps/web/src/app/layout.tsx
@@ -1,5 +1,5 @@
 import "./global.css";
-import { Metadata } from "next";
+import type { Metadata } from "next";
 
 export const metadata: Metadata = {
   title: "Velopulent CMS",
diff --git a/apps/web/src/app/llms.mdx/docs/[[...slug]]/route.ts b/apps/web/src/app/llms.mdx/docs/[[...slug]]/route.ts
index 1ccfc9c3..f6f13190 100644
--- a/apps/web/src/app/llms.mdx/docs/[[...slug]]/route.ts
+++ b/apps/web/src/app/llms.mdx/docs/[[...slug]]/route.ts
@@ -1,5 +1,5 @@
-import { getLLMText, getPageMarkdownUrl, source } from "@/lib/source";
 import { notFound } from "next/navigation";
+import { getLLMText, getPageMarkdownUrl, source } from "@/lib/source";
 
 export const revalidate = false;
 
diff --git a/apps/web/src/app/llms.txt/route.ts b/apps/web/src/app/llms.txt/route.ts
index f18f409c..775be71f 100644
--- a/apps/web/src/app/llms.txt/route.ts
+++ b/apps/web/src/app/llms.txt/route.ts
@@ -1,5 +1,5 @@
-import { source } from "@/lib/source";
 import { llms } from "fumadocs-core/source";
+import { source } from "@/lib/source";
 
 export const revalidate = false;
 
diff --git a/apps/web/src/app/og/docs/[...slug]/route.tsx b/apps/web/src/app/og/docs/[...slug]/route.tsx
index 451e98ea..5e951cf1 100644
--- a/apps/web/src/app/og/docs/[...slug]/route.tsx
+++ b/apps/web/src/app/og/docs/[...slug]/route.tsx
@@ -1,8 +1,8 @@
-import { getPageImage, source } from "@/lib/source";
+import { generate as DefaultImage } from "fumadocs-ui/og";
 import { notFound } from "next/navigation";
 import { ImageResponse } from "next/og";
-import { generate as DefaultImage } from "fumadocs-ui/og";
 import { appName } from "@/lib/shared";
+import { getPageImage, source } from "@/lib/source";
 
 export const revalidate = false;
 
diff --git a/apps/web/src/components/landing/ascii-scene.tsx b/apps/web/src/components/landing/ascii-scene.tsx
index 6535c65a..382a2455 100644
--- a/apps/web/src/components/landing/ascii-scene.tsx
+++ b/apps/web/src/components/landing/ascii-scene.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { useEffect, useRef, useCallback } from "react";
+import { useCallback, useEffect, useRef } from "react";
 
 interface Point3D {
   x: number;
diff --git a/apps/web/src/components/landing/backup-section.tsx b/apps/web/src/components/landing/backup-section.tsx
index 82babab3..eca26f21 100644
--- a/apps/web/src/components/landing/backup-section.tsx
+++ b/apps/web/src/components/landing/backup-section.tsx
@@ -1,7 +1,7 @@
 "use client";
 
-import { useEffect, useState, useRef } from "react";
-import { HardDrive, Cloud, Shield, RotateCcw } from "lucide-react";
+import { Cloud, HardDrive, RotateCcw, Shield } from "lucide-react";
+import { useEffect, useRef, useState } from "react";
 
 const backupFeatures = [
   {
diff --git a/apps/web/src/components/landing/cta-section.tsx b/apps/web/src/components/landing/cta-section.tsx
index cfb8c29a..21aca4ed 100644
--- a/apps/web/src/components/landing/cta-section.tsx
+++ b/apps/web/src/components/landing/cta-section.tsx
@@ -1,8 +1,8 @@
 "use client";
 
+import { ArrowRight } from "lucide-react";
 import { useEffect, useRef, useState } from "react";
 import { Button } from "@/components/ui/button";
-import { ArrowRight } from "lucide-react";
 
 export function CtaSection() {
   const [isVisible, setIsVisible] = useState(false);
@@ -81,7 +81,11 @@ export function CtaSection() {
                     className="h-14 px-8 text-base rounded-full border-foreground/20 hover:bg-foreground/5"
                     asChild
                   >
-                    <a target="_blank" href="https://github.com/velopulent/cms">
+                    <a
+                      target="_blank"
+                      href="https://github.com/velopulent/cms"
+                      rel="noopener"
+                    >
                       Github
                     </a>
                   </Button>
diff --git a/apps/web/src/components/landing/dashboard-section.tsx b/apps/web/src/components/landing/dashboard-section.tsx
index 8ecd4897..c182352a 100644
--- a/apps/web/src/components/landing/dashboard-section.tsx
+++ b/apps/web/src/components/landing/dashboard-section.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { useEffect, useState, useRef } from "react";
+import { useEffect, useRef, useState } from "react";
 
 const dashboardCards = [
   {
@@ -47,7 +47,7 @@ function AnimatedNumber({
           const animate = (currentTime: number) => {
             const elapsed = currentTime - startTime;
             const progress = Math.min(elapsed / duration, 1);
-            const eased = 1 - Math.pow(1 - progress, 4);
+            const eased = 1 - (1 - progress) ** 4;
             setCount(Math.floor(eased * end));
             setIsScrambling(progress < 0.8);
             if (progress < 1) requestAnimationFrame(animate);
diff --git a/apps/web/src/components/landing/database-section.tsx b/apps/web/src/components/landing/database-section.tsx
index 0a2fc006..6d4b7e26 100644
--- a/apps/web/src/components/landing/database-section.tsx
+++ b/apps/web/src/components/landing/database-section.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { useEffect, useState, useRef } from "react";
+import { useEffect, useRef, useState } from "react";
 
 const regions = [
   { name: "SQLite", nodes: 0, status: "supported" },
diff --git a/apps/web/src/components/landing/footer-section.tsx b/apps/web/src/components/landing/footer-section.tsx
index f6384af8..ff435835 100644
--- a/apps/web/src/components/landing/footer-section.tsx
+++ b/apps/web/src/components/landing/footer-section.tsx
@@ -141,6 +141,7 @@ export function FooterSection() {
                     href={link.href}
                     target="_blank"
                     className="text-sm text-white/40 hover:text-white transition-colors flex items-center gap-1 group"
+                    rel="noopener"
                   >
                     {link.name}
                     <ArrowUpRight className="w-3 h-3 opacity-0 -translate-x-1 group-hover:opacity-100 group-hover:translate-x-0 transition-all" />
diff --git a/apps/web/src/components/landing/hero-section.tsx b/apps/web/src/components/landing/hero-section.tsx
index a7a1aaa7..ffee26f4 100644
--- a/apps/web/src/components/landing/hero-section.tsx
+++ b/apps/web/src/components/landing/hero-section.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { useEffect, useState, useRef } from "react";
+import { useEffect, useRef, useState } from "react";
 
 const words = ["website", "blog", "app", "business", "portfolio", "platform"];
 
@@ -33,7 +33,7 @@ function BlurWord({ word, trigger }: { word: string; trigger: number }) {
         const start = performance.now();
         const tick = (now: number) => {
           const progress = Math.min((now - start) / DURATION, 1);
-          const eased = 1 - Math.pow(1 - progress, 3);
+          const eased = 1 - (1 - progress) ** 3;
           setLetterStates((prev) => {
             const next = [...prev];
             next[i] = { opacity: eased, blur: 20 * (1 - eased) };
diff --git a/apps/web/src/components/landing/integrations-section.tsx b/apps/web/src/components/landing/integrations-section.tsx
index 8ff8cb06..6f10fa00 100644
--- a/apps/web/src/components/landing/integrations-section.tsx
+++ b/apps/web/src/components/landing/integrations-section.tsx
@@ -1,8 +1,8 @@
 "use client";
 
-import { useEffect, useState, useRef } from "react";
 import { Icon } from "@iconify-icon/react";
 import { LucideArrowRight } from "lucide-react";
+import { useEffect, useRef, useState } from "react";
 
 const frameworks = [
   { name: "Next.js", icon: "logos:nextjs-icon" },
diff --git a/apps/web/src/components/landing/navigation.tsx b/apps/web/src/components/landing/navigation.tsx
index 7810be08..76e90054 100644
--- a/apps/web/src/components/landing/navigation.tsx
+++ b/apps/web/src/components/landing/navigation.tsx
@@ -1,9 +1,9 @@
 "use client";
 
-import { useState, useEffect } from "react";
-import { Button } from "@/components/ui/button";
 import { Menu, X } from "lucide-react";
 import Link from "next/link";
+import { useEffect, useState } from "react";
+import { Button } from "@/components/ui/button";
 
 const navLinks = [
   { name: "Features", href: "#features" },
diff --git a/apps/web/src/components/landing/security-section.tsx b/apps/web/src/components/landing/security-section.tsx
index c806091a..156399a9 100644
--- a/apps/web/src/components/landing/security-section.tsx
+++ b/apps/web/src/components/landing/security-section.tsx
@@ -1,7 +1,7 @@
 "use client";
 
-import { useEffect, useState, useRef } from "react";
-import { Shield, Lock, Eye, FileCheck } from "lucide-react";
+import { Eye, FileCheck, Lock, Shield } from "lucide-react";
+import { useEffect, useRef, useState } from "react";
 
 const securityFeatures = [
   {
diff --git a/apps/web/src/components/landing/testimonials-section.tsx b/apps/web/src/components/landing/testimonials-section.tsx
index 728bf32a..b3c45116 100644
--- a/apps/web/src/components/landing/testimonials-section.tsx
+++ b/apps/web/src/components/landing/testimonials-section.tsx
@@ -1,7 +1,7 @@
 "use client";
 
-import { useEffect, useState, useRef } from "react";
 import { ArrowLeft, ArrowRight } from "lucide-react";
+import { useEffect, useRef, useState } from "react";
 
 const testimonials = [
   {
diff --git a/apps/web/src/components/landing/use-cases.tsx b/apps/web/src/components/landing/use-cases.tsx
index 86db896e..54702723 100644
--- a/apps/web/src/components/landing/use-cases.tsx
+++ b/apps/web/src/components/landing/use-cases.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { useState, useEffect, useRef } from "react";
+import { useEffect, useRef, useState } from "react";
 
 const useCases = [
   {
diff --git a/apps/web/src/components/provider.tsx b/apps/web/src/components/provider.tsx
index 6f92c0c4..de8ad125 100644
--- a/apps/web/src/components/provider.tsx
+++ b/apps/web/src/components/provider.tsx
@@ -1,7 +1,7 @@
 "use client";
-import SearchDialog from "@/components/search";
 import { RootProvider } from "fumadocs-ui/provider/next";
-import { type ReactNode } from "react";
+import type { ReactNode } from "react";
+import SearchDialog from "@/components/search";
 
 export function Provider({ children }: { children: ReactNode }) {
   return <RootProvider search={{ SearchDialog }}>{children}</RootProvider>;
diff --git a/apps/web/src/components/search.tsx b/apps/web/src/components/search.tsx
index a88ce513..c46e11ef 100644
--- a/apps/web/src/components/search.tsx
+++ b/apps/web/src/components/search.tsx
@@ -1,4 +1,6 @@
 "use client";
+import { create } from "@orama/orama";
+import { useDocsSearch } from "fumadocs-core/search/client";
 import {
   SearchDialog,
   SearchDialogClose,
@@ -10,8 +12,6 @@ import {
   SearchDialogOverlay,
   type SharedProps,
 } from "fumadocs-ui/components/dialog/search";
-import { useDocsSearch } from "fumadocs-core/search/client";
-import { create } from "@orama/orama";
 import { useI18n } from "fumadocs-ui/contexts/i18n";
 
 function initOrama() {
diff --git a/apps/web/src/lib/utils.ts b/apps/web/src/lib/utils.ts
index a5ef1935..365058ce 100644
--- a/apps/web/src/lib/utils.ts
+++ b/apps/web/src/lib/utils.ts
@@ -1,4 +1,4 @@
-import { clsx, type ClassValue } from "clsx";
+import { type ClassValue, clsx } from "clsx";
 import { twMerge } from "tailwind-merge";
 
 export function cn(...inputs: ClassValue[]) {

From 67382ff0c98c61c34ad30de076c2958ac783d05b Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 09:31:50 +0530
Subject: [PATCH 33/43] fix(ci): replace Biome lint with Biome CI for dashboard
 and web jobs

---
 .github/workflows/ci.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d8f5b359..495e823a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -239,8 +239,9 @@ jobs:
           key: nx-${{ runner.os }}-${{ hashFiles('apps/dashboard/**', 'bun.lock', 'package.json', 'nx.json') }}
           restore-keys: |
             nx-${{ runner.os }}-
-      - name: Biome lint
-        run: bunx nx run dashboard:lint
+      - name: Biome CI
+        run: bunx biome ci
+        working-directory: apps/dashboard
       - name: Typecheck
         run: bunx nx run dashboard:typecheck
       - name: Build
@@ -263,8 +264,9 @@ jobs:
           key: nx-${{ runner.os }}-${{ hashFiles('apps/web/**', 'bun.lock', 'package.json', 'nx.json') }}
           restore-keys: |
             nx-${{ runner.os }}-
-      - name: Biome lint
-        run: bunx nx run web:lint
+      - name: Biome CI
+        run: bunx biome ci
+        working-directory: apps/web
       - name: Typecheck
         run: bunx nx run web:typecheck
       - name: Build

From e382e3e671fcbe2f9786ee926e08e9e0946761d4 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 09:33:27 +0530
Subject: [PATCH 34/43] style(dashboard): formatting

---
 .../src/components/app-breadcrumb.tsx         |  70 +++-
 .../components/backups/backups-section.tsx    | 209 +++++++++---
 .../src/components/dashboard-header.tsx       |   6 +-
 .../dashboard/src/components/dynamic-form.tsx |  42 ++-
 .../src/components/file-picker-dialog.tsx     | 300 +++++++++---------
 .../src/components/revisions-panel.tsx        |  17 +-
 .../src/components/sidebar/site-switcher.tsx  |   6 +-
 apps/dashboard/src/components/site-avatar.tsx |  86 ++---
 .../site-settings/members-section.tsx         |   4 +-
 .../site-settings/user-combobox.tsx           |   9 +-
 .../src/components/tiptap-editor.tsx          |   7 +-
 apps/dashboard/src/contexts/auth-context.tsx  |   4 +-
 apps/dashboard/src/lib/api.ts                 |  89 ++++--
 .../src/routes/_admin/_shell/index.tsx        |   4 +-
 .../src/routes/_admin/_shell/settings.tsx     |  42 +--
 .../src/routes/_admin/sites.$siteId.tsx       |   6 +-
 .../_admin/sites.$siteId/collections.tsx      |   5 +-
 .../routes/_admin/sites.$siteId/settings.tsx  |  99 +++---
 apps/dashboard/src/styles.css                 |   4 +-
 19 files changed, 606 insertions(+), 403 deletions(-)

diff --git a/apps/dashboard/src/components/app-breadcrumb.tsx b/apps/dashboard/src/components/app-breadcrumb.tsx
index 1006304a..4977fcd5 100644
--- a/apps/dashboard/src/components/app-breadcrumb.tsx
+++ b/apps/dashboard/src/components/app-breadcrumb.tsx
@@ -1,6 +1,6 @@
-import { Fragment } from "react";
-import { useMatches, useParams, Link } from "@tanstack/react-router";
 import { useQuery } from "@tanstack/react-query";
+import { Link, useMatches, useParams } from "@tanstack/react-router";
+import { Fragment } from "react";
 import {
   Breadcrumb,
   BreadcrumbItem,
@@ -27,11 +27,19 @@ interface BreadcrumbConfig {
 const breadcrumbConfigs: BreadcrumbConfig[] = [
   {
     routeId: "/_admin/sites/$siteId/entries/$collectionSlug/$id/edit",
-    crumbs: [{ labelFrom: "site" }, { labelFrom: "collection" }, { labelFrom: "entrySlug" }],
+    crumbs: [
+      { labelFrom: "site" },
+      { labelFrom: "collection" },
+      { labelFrom: "entrySlug" },
+    ],
   },
   {
     routeId: "/_admin/sites/$siteId/entries/$collectionSlug/new",
-    crumbs: [{ labelFrom: "site" }, { labelFrom: "collection" }, { label: "New" }],
+    crumbs: [
+      { labelFrom: "site" },
+      { labelFrom: "collection" },
+      { label: "New" },
+    ],
   },
   {
     routeId: "/_admin/sites/$siteId/entries/$collectionSlug/",
@@ -77,27 +85,40 @@ function useSiteName(siteId: string | undefined) {
   return siteFromList?.name ?? site?.name;
 }
 
-function useCollectionName(siteId: string | undefined, collectionSlug: string | undefined) {
+function useCollectionName(
+  siteId: string | undefined,
+  collectionSlug: string | undefined,
+) {
   const { data: collections } = useQuery({
     queryKey: ["collections", siteId],
     queryFn: () => getCollections(siteId as string),
     enabled: !!siteId && !!collectionSlug,
   });
 
-  return collections?.find((c) => c.slug === collectionSlug)?.name ?? collectionSlug;
+  return (
+    collections?.find((c) => c.slug === collectionSlug)?.name ?? collectionSlug
+  );
 }
 
-function useSingletonName(siteId: string | undefined, slug: string | undefined) {
+function useSingletonName(
+  siteId: string | undefined,
+  slug: string | undefined,
+) {
   const { data: collections } = useQuery({
     queryKey: ["collections", siteId],
     queryFn: () => getCollections(siteId as string),
     enabled: !!siteId && !!slug,
   });
 
-  return collections?.find((c) => c.is_singleton && c.slug === slug)?.name ?? slug;
+  return (
+    collections?.find((c) => c.is_singleton && c.slug === slug)?.name ?? slug
+  );
 }
 
-function useEntrySlugLabel(siteId: string | undefined, entryId: string | undefined) {
+function useEntrySlugLabel(
+  siteId: string | undefined,
+  entryId: string | undefined,
+) {
   const { data: entry } = useQuery({
     queryKey: ["entry", siteId, entryId],
     queryFn: () => getEntryById(siteId as string, entryId as string),
@@ -107,7 +128,10 @@ function useEntrySlugLabel(siteId: string | undefined, entryId: string | undefin
   return entry?.slug ?? entryId?.slice(0, 8);
 }
 
-function useBreadcrumbLabels(defs: BreadcrumbDef[], params: Record<string, string>) {
+function useBreadcrumbLabels(
+  defs: BreadcrumbDef[],
+  params: Record<string, string>,
+) {
   const siteId = params.siteId;
   const siteName = useSiteName(siteId);
   const collectionName = useCollectionName(siteId, params.collectionSlug);
@@ -131,7 +155,11 @@ function useBreadcrumbLabels(defs: BreadcrumbDef[], params: Record<string, strin
   });
 }
 
-function buildHref(routeId: string, params: Record<string, string>, crumbIndex: number): string | undefined {
+function buildHref(
+  routeId: string,
+  params: Record<string, string>,
+  crumbIndex: number,
+): string | undefined {
   const siteId = params.siteId;
   if (!siteId) return undefined;
 
@@ -157,7 +185,9 @@ export function AppBreadcrumb() {
   let config: BreadcrumbConfig | undefined;
   let routeId: string | undefined;
   for (let i = matches.length - 1; i >= 0; i--) {
-    const found = breadcrumbConfigs.find((c) => c.routeId === matches[i].routeId);
+    const found = breadcrumbConfigs.find(
+      (c) => c.routeId === matches[i].routeId,
+    );
     if (found) {
       config = found;
       routeId = matches[i].routeId;
@@ -188,8 +218,10 @@ export function AppBreadcrumb() {
     return (
       <Breadcrumb>
         <BreadcrumbList>
-            {config.crumbs.map((def, i) => (
-            <Fragment key={`crumb-${"label" in def ? def.label : def.labelFrom}`}>
+          {config.crumbs.map((def, i) => (
+            <Fragment
+              key={`crumb-${"label" in def ? def.label : def.labelFrom}`}
+            >
               {i > 0 && <BreadcrumbSeparator />}
               <BreadcrumbItem>
                 <Skeleton className="h-4 w-20" />
@@ -210,13 +242,17 @@ export function AppBreadcrumb() {
           const href = buildHref(routeId, params, i);
 
           return (
-            <Fragment key={`crumb-${"label" in def ? def.label : def.labelFrom}`}>
+            <Fragment
+              key={`crumb-${"label" in def ? def.label : def.labelFrom}`}
+            >
               {i > 0 && <BreadcrumbSeparator />}
               <BreadcrumbItem>
                 {isLast ? (
                   <BreadcrumbPage>{label}</BreadcrumbPage>
                 ) : href ? (
-                  <BreadcrumbLink render={<Link to={href} />}>{label}</BreadcrumbLink>
+                  <BreadcrumbLink render={<Link to={href} />}>
+                    {label}
+                  </BreadcrumbLink>
                 ) : (
                   <BreadcrumbPage>{label}</BreadcrumbPage>
                 )}
@@ -227,4 +263,4 @@ export function AppBreadcrumb() {
       </BreadcrumbList>
     </Breadcrumb>
   );
-}
\ No newline at end of file
+}
diff --git a/apps/dashboard/src/components/backups/backups-section.tsx b/apps/dashboard/src/components/backups/backups-section.tsx
index 65506932..86a406f4 100644
--- a/apps/dashboard/src/components/backups/backups-section.tsx
+++ b/apps/dashboard/src/components/backups/backups-section.tsx
@@ -21,7 +21,6 @@ import {
   CardTitle,
 } from "@/components/ui/card";
 import { Checkbox } from "@/components/ui/checkbox";
-import { Field, FieldLabel } from "@/components/ui/field";
 import {
   Dialog,
   DialogContent,
@@ -30,6 +29,7 @@ import {
   DialogHeader,
   DialogTitle,
 } from "@/components/ui/dialog";
+import { Field, FieldLabel } from "@/components/ui/field";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import { ScrollArea } from "@/components/ui/scroll-area";
@@ -91,13 +91,17 @@ function formatBytes(bytes: number): string {
   return `${value.toFixed(1)} ${units[i]}`;
 }
 
-function statusVariant(status: string): "default" | "secondary" | "destructive" {
+function statusVariant(
+  status: string,
+): "default" | "secondary" | "destructive" {
   if (status === "success") return "default";
   if (status === "failed") return "destructive";
   return "secondary";
 }
 
-type RestoreSource = { type: "backup"; backup: BackupInfo } | { type: "upload"; file: File };
+type RestoreSource =
+  | { type: "backup"; backup: BackupInfo }
+  | { type: "upload"; file: File };
 
 export function BackupsSection({ scope }: { scope: BackupScope }) {
   const queryClient = useQueryClient();
@@ -107,8 +111,12 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
   const [includeFiles, setIncludeFiles] = useState(true);
   const [encrypt, setEncrypt] = useState(false);
 
-  const [restoreSource, setRestoreSource] = useState<RestoreSource | null>(null);
-  const [restoreMode, setRestoreMode] = useState<"instance" | "site">(isInstance ? "instance" : "site");
+  const [restoreSource, setRestoreSource] = useState<RestoreSource | null>(
+    null,
+  );
+  const [restoreMode, setRestoreMode] = useState<"instance" | "site">(
+    isInstance ? "instance" : "site",
+  );
   const [selectedSiteIds, setSelectedSiteIds] = useState<string[]>([]);
   const [importAsNew, setImportAsNew] = useState(false);
   const [confirmText, setConfirmText] = useState("");
@@ -132,7 +140,8 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
     queryClient.invalidateQueries({ queryKey: ["backup-schedules", scopeKey] });
 
   const createMutation = useMutation({
-    mutationFn: () => createBackup(scope, { include_files: includeFiles, encrypt }),
+    mutationFn: () =>
+      createBackup(scope, { include_files: includeFiles, encrypt }),
     onSuccess: () => {
       invalidateBackups();
       toast.success("Backup created");
@@ -154,11 +163,18 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
       if (!restoreSource) return;
       // Site-settings scope: always restores into the current site (id from URL).
       if (!isInstance) {
-        const opts = { mode: "site" as const, import_as_new: importAsNew, confirm: RESTORE_WORD };
+        const opts = {
+          mode: "site" as const,
+          import_as_new: importAsNew,
+          confirm: RESTORE_WORD,
+        };
         if (restoreSource.type === "upload") {
           await restoreBackupUpload(scope, restoreSource.file, opts);
         } else {
-          await restoreBackup(scope, { backup_id: restoreSource.backup.id, ...opts });
+          await restoreBackup(scope, {
+            backup_id: restoreSource.backup.id,
+            ...opts,
+          });
         }
         return;
       }
@@ -223,13 +239,16 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
   }
 
   function toggleSite(id: string) {
-    setSelectedSiteIds((prev) => (prev.includes(id) ? prev.filter((s) => s !== id) : [...prev, id]));
+    setSelectedSiteIds((prev) =>
+      prev.includes(id) ? prev.filter((s) => s !== id) : [...prev, id],
+    );
   }
 
   const backups = backupsQuery.data ?? [];
   const schedules = schedulesQuery.data ?? [];
   // For an instance backup picking sites, at least one site must be selected.
-  const needsSitePick = isInstance && inspect?.scope === "instance" && restoreMode === "site";
+  const needsSitePick =
+    isInstance && inspect?.scope === "instance" && restoreMode === "site";
   const confirmReady =
     confirmText === RESTORE_WORD &&
     !inspecting &&
@@ -260,10 +279,16 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
                   checked={includeFiles}
                   onCheckedChange={(v) => setIncludeFiles(Boolean(v))}
                 />
-                <FieldLabel htmlFor="backup-include-files">Include uploaded files</FieldLabel>
+                <FieldLabel htmlFor="backup-include-files">
+                  Include uploaded files
+                </FieldLabel>
               </Field>
               <Field orientation="horizontal">
-                <Checkbox id="backup-encrypt" checked={encrypt} onCheckedChange={(v) => setEncrypt(Boolean(v))} />
+                <Checkbox
+                  id="backup-encrypt"
+                  checked={encrypt}
+                  onCheckedChange={(v) => setEncrypt(Boolean(v))}
+                />
                 <FieldLabel htmlFor="backup-encrypt">Encrypt</FieldLabel>
               </Field>
             </div>
@@ -283,7 +308,10 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
                   <RotateCcw className="size-4" /> Restore from file
                 </Button>
               </label>
-              <Button onClick={() => createMutation.mutate()} disabled={createMutation.isPending}>
+              <Button
+                onClick={() => createMutation.mutate()}
+                disabled={createMutation.isPending}
+              >
                 <Plus className="size-4" />
                 {createMutation.isPending ? "Backing up…" : "Back up now"}
               </Button>
@@ -302,7 +330,9 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
                     <TableHead>Created</TableHead>
                     <TableHead>Status</TableHead>
                     <TableHead>Size</TableHead>
-                    <TableHead className="hidden sm:table-cell">Files</TableHead>
+                    <TableHead className="hidden sm:table-cell">
+                      Files
+                    </TableHead>
                     <TableHead className="text-right">Actions</TableHead>
                   </TableRow>
                 </TableHeader>
@@ -314,11 +344,17 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
                       </TableCell>
                       <TableCell>
                         <div className="flex items-center gap-1.5">
-                          <Badge variant={statusVariant(b.status)}>{b.status}</Badge>
-                          {b.encrypted && <Lock className="size-3.5 text-muted-foreground" />}
+                          <Badge variant={statusVariant(b.status)}>
+                            {b.status}
+                          </Badge>
+                          {b.encrypted && (
+                            <Lock className="size-3.5 text-muted-foreground" />
+                          )}
                         </div>
                       </TableCell>
-                      <TableCell className="whitespace-nowrap">{formatBytes(b.size_bytes)}</TableCell>
+                      <TableCell className="whitespace-nowrap">
+                        {formatBytes(b.size_bytes)}
+                      </TableCell>
                       <TableCell className="hidden sm:table-cell">
                         {b.includes_files ? b.file_count : "—"}
                       </TableCell>
@@ -330,13 +366,19 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
                                 variant="ghost"
                                 size="icon"
                                 title="Download"
-                                render={<a href={backupDownloadUrl(scope, b.id)}><Download className="size-4" /></a>}
+                                render={
+                                  <a href={backupDownloadUrl(scope, b.id)}>
+                                    <Download className="size-4" />
+                                  </a>
+                                }
                               />
                               <Button
                                 variant="ghost"
                                 size="icon"
                                 title="Restore"
-                                onClick={() => openRestore({ type: "backup", backup: b })}
+                                onClick={() =>
+                                  openRestore({ type: "backup", backup: b })
+                                }
                               >
                                 <RotateCcw className="size-4" />
                               </Button>
@@ -391,14 +433,18 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
       />
 
       {/* Restore confirmation */}
-      <Dialog open={!!restoreSource} onOpenChange={(open) => !open && closeRestore()}>
+      <Dialog
+        open={!!restoreSource}
+        onOpenChange={(open) => !open && closeRestore()}
+      >
         <DialogContent className="sm:max-w-lg">
           <DialogHeader>
             <DialogTitle className="flex items-center gap-2 text-destructive">
               <AlertTriangle className="size-5" /> Confirm restore
             </DialogTitle>
             <DialogDescription>
-              Restoring replaces all data within the chosen scope. This cannot be undone.
+              Restoring replaces all data within the chosen scope. This cannot
+              be undone.
             </DialogDescription>
           </DialogHeader>
 
@@ -409,7 +455,9 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
               </div>
             )}
             {isInstance && inspectError && (
-              <p className="text-sm text-destructive">Could not read this backup: {inspectError}</p>
+              <p className="text-sm text-destructive">
+                Could not read this backup: {inspectError}
+              </p>
             )}
 
             {/* A single-site backup: no picker, just name the site being restored. */}
@@ -417,7 +465,9 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
               <p className="text-sm text-muted-foreground">
                 Restores the site{" "}
                 <span className="font-medium text-foreground">
-                  {inspect.sites[0]?.name ?? inspect.sites[0]?.id ?? "in this backup"}
+                  {inspect.sites[0]?.name ??
+                    inspect.sites[0]?.id ??
+                    "in this backup"}
                 </span>
                 .
               </p>
@@ -427,7 +477,12 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
             {isInstance && inspect?.scope === "instance" && (
               <div className="flex flex-col gap-2">
                 <Label>What to restore</Label>
-                <Select value={restoreMode} onValueChange={(v) => setRestoreMode(v as "instance" | "site")}>
+                <Select
+                  value={restoreMode}
+                  onValueChange={(v) =>
+                    setRestoreMode(v as "instance" | "site")
+                  }
+                >
                   <SelectTrigger>
                     <SelectValue />
                   </SelectTrigger>
@@ -441,7 +496,11 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
                     sites={inspect.sites}
                     selected={selectedSiteIds}
                     onToggle={toggleSite}
-                    onToggleAll={(all) => setSelectedSiteIds(all ? inspect.sites.map((s) => s.id) : [])}
+                    onToggleAll={(all) =>
+                      setSelectedSiteIds(
+                        all ? inspect.sites.map((s) => s.id) : [],
+                      )
+                    }
                   />
                 )}
               </div>
@@ -449,14 +508,22 @@ export function BackupsSection({ scope }: { scope: BackupScope }) {
 
             {((isInstance && restoreMode === "site") || !isInstance) && (
               <Field orientation="horizontal">
-                <Checkbox id="restore-import-as-new" checked={importAsNew} onCheckedChange={(v) => setImportAsNew(Boolean(v))} />
-                <FieldLabel htmlFor="restore-import-as-new">Import as a new site (keep the existing one)</FieldLabel>
+                <Checkbox
+                  id="restore-import-as-new"
+                  checked={importAsNew}
+                  onCheckedChange={(v) => setImportAsNew(Boolean(v))}
+                />
+                <FieldLabel htmlFor="restore-import-as-new">
+                  Import as a new site (keep the existing one)
+                </FieldLabel>
               </Field>
             )}
 
             <div className="flex flex-col gap-2">
               <Label htmlFor="restore-confirm">
-                Type <span className="font-mono font-semibold">{RESTORE_WORD}</span> to confirm
+                Type{" "}
+                <span className="font-mono font-semibold">{RESTORE_WORD}</span>{" "}
+                to confirm
               </Label>
               <Input
                 id="restore-confirm"
@@ -498,24 +565,49 @@ function SitePicker({
   onToggleAll: (all: boolean) => void;
 }) {
   if (sites.length === 0) {
-    return <p className="text-sm text-muted-foreground">This backup contains no sites.</p>;
+    return (
+      <p className="text-sm text-muted-foreground">
+        This backup contains no sites.
+      </p>
+    );
   }
   const allSelected = selected.length === sites.length;
   return (
     <div className="rounded-md border">
-      <Field orientation="horizontal" className="border-b px-3 py-2 text-sm font-medium">
-        <Checkbox id="site-picker-select-all" checked={allSelected} onCheckedChange={(v) => onToggleAll(Boolean(v))} />
-        <FieldLabel htmlFor="site-picker-select-all">Select all ({selected.length}/{sites.length})</FieldLabel>
+      <Field
+        orientation="horizontal"
+        className="border-b px-3 py-2 text-sm font-medium"
+      >
+        <Checkbox
+          id="site-picker-select-all"
+          checked={allSelected}
+          onCheckedChange={(v) => onToggleAll(Boolean(v))}
+        />
+        <FieldLabel htmlFor="site-picker-select-all">
+          Select all ({selected.length}/{sites.length})
+        </FieldLabel>
       </Field>
       <ScrollArea className="max-h-48">
         <div className="flex flex-col">
           {sites.map((s) => (
-            <Field key={s.id} orientation="horizontal" className="px-3 py-2 text-sm hover:bg-muted/50">
-              <Checkbox id={`site-picker-${s.id}`} checked={selected.includes(s.id)} onCheckedChange={() => onToggle(s.id)} />
+            <Field
+              key={s.id}
+              orientation="horizontal"
+              className="px-3 py-2 text-sm hover:bg-muted/50"
+            >
+              <Checkbox
+                id={`site-picker-${s.id}`}
+                checked={selected.includes(s.id)}
+                onCheckedChange={() => onToggle(s.id)}
+              />
               <FieldLabel htmlFor={`site-picker-${s.id}`}>
                 <span className="flex flex-col">
-                  <span className="font-medium">{s.name ?? "(unnamed site)"}</span>
-                  <span className="font-mono text-xs text-muted-foreground">{s.id}</span>
+                  <span className="font-medium">
+                    {s.name ?? "(unnamed site)"}
+                  </span>
+                  <span className="font-mono text-xs text-muted-foreground">
+                    {s.id}
+                  </span>
                 </span>
               </FieldLabel>
             </Field>
@@ -535,7 +627,14 @@ interface SchedulesCardProps {
   onDelete: (id: string) => Promise<void>;
 }
 
-function SchedulesCard({ schedules, loading, onCreate, onToggle, onRun, onDelete }: SchedulesCardProps) {
+function SchedulesCard({
+  schedules,
+  loading,
+  onCreate,
+  onToggle,
+  onRun,
+  onDelete,
+}: SchedulesCardProps) {
   const [preset, setPreset] = useState(CRON_PRESETS[0].value);
   const [customCron, setCustomCron] = useState("0 2 * * *");
   const [retention, setRetention] = useState(7);
@@ -608,11 +707,19 @@ function SchedulesCard({ schedules, loading, onCreate, onToggle, onRun, onDelete
           </div>
           <div className="flex flex-col gap-2 sm:col-span-2 lg:col-span-1 lg:flex-row lg:items-center lg:gap-4 lg:pb-2">
             <Field orientation="horizontal">
-              <Checkbox id="schedule-files" checked={includeFiles} onCheckedChange={(v) => setIncludeFiles(Boolean(v))} />
+              <Checkbox
+                id="schedule-files"
+                checked={includeFiles}
+                onCheckedChange={(v) => setIncludeFiles(Boolean(v))}
+              />
               <FieldLabel htmlFor="schedule-files">Files</FieldLabel>
             </Field>
             <Field orientation="horizontal">
-              <Checkbox id="schedule-encrypt" checked={encrypt} onCheckedChange={(v) => setEncrypt(Boolean(v))} />
+              <Checkbox
+                id="schedule-encrypt"
+                checked={encrypt}
+                onCheckedChange={(v) => setEncrypt(Boolean(v))}
+              />
               <FieldLabel htmlFor="schedule-encrypt">Encrypt</FieldLabel>
             </Field>
           </div>
@@ -624,7 +731,9 @@ function SchedulesCard({ schedules, loading, onCreate, onToggle, onRun, onDelete
         {loading ? (
           <Skeleton className="h-16 w-full" />
         ) : schedules.length === 0 ? (
-          <p className="text-sm text-muted-foreground">No schedules configured.</p>
+          <p className="text-sm text-muted-foreground">
+            No schedules configured.
+          </p>
         ) : (
           <div className="flex flex-col gap-2">
             {schedules.map((s) => (
@@ -640,19 +749,31 @@ function SchedulesCard({ schedules, loading, onCreate, onToggle, onRun, onDelete
                     </Badge>
                   </div>
                   <p className="text-xs text-muted-foreground">
-                    Keep {s.retention_n} · {s.include_files ? "with files" : "no files"} ·{" "}
+                    Keep {s.retention_n} ·{" "}
+                    {s.include_files ? "with files" : "no files"} ·{" "}
                     {s.encrypt ? "encrypted" : "plaintext"}
-                    {s.next_run_at && ` · next ${new Date(s.next_run_at).toLocaleString()}`}
+                    {s.next_run_at &&
+                      ` · next ${new Date(s.next_run_at).toLocaleString()}`}
                   </p>
                 </div>
                 <div className="flex items-center gap-1">
-                  <Button variant="ghost" size="icon" title="Run now" onClick={() => onRun(s.id)}>
+                  <Button
+                    variant="ghost"
+                    size="icon"
+                    title="Run now"
+                    onClick={() => onRun(s.id)}
+                  >
                     <Play className="size-4" />
                   </Button>
                   <Button variant="ghost" size="sm" onClick={() => onToggle(s)}>
                     {s.enabled ? "Pause" : "Resume"}
                   </Button>
-                  <Button variant="ghost" size="icon" title="Delete" onClick={() => onDelete(s.id)}>
+                  <Button
+                    variant="ghost"
+                    size="icon"
+                    title="Delete"
+                    onClick={() => onDelete(s.id)}
+                  >
                     <Trash2 className="size-4" />
                   </Button>
                 </div>
diff --git a/apps/dashboard/src/components/dashboard-header.tsx b/apps/dashboard/src/components/dashboard-header.tsx
index a318d063..35c6f670 100644
--- a/apps/dashboard/src/components/dashboard-header.tsx
+++ b/apps/dashboard/src/components/dashboard-header.tsx
@@ -54,7 +54,11 @@ export function DashboardHeader() {
         <DropdownMenu>
           <DropdownMenuTrigger
             render={
-              <Button variant="ghost" size={"icon-lg"} className="rounded-full" />
+              <Button
+                variant="ghost"
+                size={"icon-lg"}
+                className="rounded-full"
+              />
             }
           >
             <UserAvatar username={name} />
diff --git a/apps/dashboard/src/components/dynamic-form.tsx b/apps/dashboard/src/components/dynamic-form.tsx
index 86e1563d..1973fc38 100644
--- a/apps/dashboard/src/components/dynamic-form.tsx
+++ b/apps/dashboard/src/components/dynamic-form.tsx
@@ -1,5 +1,5 @@
-import { Archive, FileText, Music } from "lucide-react";
 import type { AnyFieldApi } from "@tanstack/react-form";
+import { Archive, FileText, Music } from "lucide-react";
 import type React from "react";
 import {
   Component,
@@ -257,10 +257,7 @@ const DynamicField = memo(function DynamicField({
             <FieldLabel htmlFor={fieldName}>
               {label}
               {field.required && (
-                <span
-                  className="ml-1 text-destructive"
-                  aria-hidden="true"
-                >
+                <span className="ml-1 text-destructive" aria-hidden="true">
                   *
                 </span>
               )}
@@ -277,10 +274,7 @@ const DynamicField = memo(function DynamicField({
               readOnly={readOnly}
             />
             {isInvalid && (
-              <FieldError
-                id={errorId}
-                errors={f.state.meta.errors}
-              />
+              <FieldError id={errorId} errors={f.state.meta.errors} />
             )}
           </Field>
         );
@@ -414,11 +408,7 @@ const FieldInput = memo(function FieldInput({
 
     case "select":
       return (
-        <Select
-          value={strValue}
-          onValueChange={onChange}
-          disabled={readOnly}
-        >
+        <Select value={strValue} onValueChange={onChange} disabled={readOnly}>
           <SelectTrigger
             id={fieldName}
             aria-invalid={isInvalid || undefined}
@@ -494,7 +484,9 @@ const FieldInput = memo(function FieldInput({
 // Stable input-event extractors (avoid inline arrow fns in render)
 // ---------------------------------------------------------------------------
 
-function extractString(e: React.ChangeEvent<HTMLInputElement | HTMLTextAreaElement>) {
+function extractString(
+  e: React.ChangeEvent<HTMLInputElement | HTMLTextAreaElement>,
+) {
   return e.target.value;
 }
 
@@ -553,8 +545,7 @@ const FileField = memo(function FileField({
 
   const filterAccept = useMemo(
     () =>
-      accept?.join(", ") ??
-      (category ? CATEGORY_ACCEPT[category] : undefined),
+      accept?.join(", ") ?? (category ? CATEGORY_ACCEPT[category] : undefined),
     [accept, category],
   );
 
@@ -638,8 +629,7 @@ const FilePreview = memo(function FilePreview({
   const mime = fileInfo?.mime_type ?? "";
   const isVideo = mime.startsWith("video/");
   const isAudio = mime.startsWith("audio/");
-  const isImage =
-    mime.startsWith("image/") || (!fileInfo && isExternalUrl);
+  const isImage = mime.startsWith("image/") || (!fileInfo && isExternalUrl);
   const isDocument =
     mime.startsWith("application/pdf") ||
     mime.startsWith("application/msword") ||
@@ -647,7 +637,7 @@ const FilePreview = memo(function FilePreview({
     mime.startsWith("text/");
 
   const thumbnailSrc = isVideo
-    ? fileInfo?.thumbnail_url ?? null
+    ? (fileInfo?.thumbnail_url ?? null)
     : fileId && isImage
       ? `/api/files/${fileId}/thumbnail`
       : isExternalUrl && isImage
@@ -670,11 +660,17 @@ const FilePreview = memo(function FilePreview({
             }}
           />
         ) : isAudio ? (
-          <FileTypeIcon icon={<Music className="size-6 text-muted-foreground" />} />
+          <FileTypeIcon
+            icon={<Music className="size-6 text-muted-foreground" />}
+          />
         ) : isDocument ? (
-          <FileTypeIcon icon={<FileText className="size-6 text-muted-foreground" />} />
+          <FileTypeIcon
+            icon={<FileText className="size-6 text-muted-foreground" />}
+          />
         ) : (
-          <FileTypeIcon icon={<Archive className="size-6 text-muted-foreground" />} />
+          <FileTypeIcon
+            icon={<Archive className="size-6 text-muted-foreground" />}
+          />
         )}
 
         {/* File metadata */}
diff --git a/apps/dashboard/src/components/file-picker-dialog.tsx b/apps/dashboard/src/components/file-picker-dialog.tsx
index 0a907893..76bc7879 100644
--- a/apps/dashboard/src/components/file-picker-dialog.tsx
+++ b/apps/dashboard/src/components/file-picker-dialog.tsx
@@ -25,11 +25,7 @@ import { Input } from "@/components/ui/input";
 import { ScrollArea } from "@/components/ui/scroll-area";
 import { Skeleton } from "@/components/ui/skeleton";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
-import {
-  type FileItem,
-  getFiles,
-  uploadFile,
-} from "@/lib/api";
+import { type FileItem, getFiles, uploadFile } from "@/lib/api";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -133,7 +129,10 @@ export function FilePickerDialog({
 
   // Derived values – memoised so they don't recalculate on every render.
   const fileType = useMemo(() => deriveFileType(accept), [accept]);
-  const skeletonKeys = useMemo(() => Array.from({ length: 8 }, (_, i) => i), []);
+  const skeletonKeys = useMemo(
+    () => Array.from({ length: 8 }, (_, i) => i),
+    [],
+  );
 
   const { data, isLoading, isError } = useQuery({
     queryKey: ["files", siteId, page, search, fileType],
@@ -243,167 +242,164 @@ export function FilePickerDialog({
 
   return (
     <Dialog open={open} onOpenChange={handleOpenChange}>
-        <DialogContent className="flex h-[80vh] flex-col overflow-hidden sm:max-w-3xl">
-          <DialogHeader>
-            <DialogTitle>File Library</DialogTitle>
-            <DialogDescription>
-              Select an existing file or upload a new one.
-            </DialogDescription>
-          </DialogHeader>
-
-          <Tabs
-            value={tab}
-            onValueChange={setTab}
-            className="flex min-h-0 flex-1 flex-col overflow-hidden"
-          >
-            <TabsList>
-              <TabsTrigger value="library">Library</TabsTrigger>
-              <TabsTrigger value="upload">Upload</TabsTrigger>
-            </TabsList>
-
-            {/* ----------------------------------------------------------------
+      <DialogContent className="flex h-[80vh] flex-col overflow-hidden sm:max-w-3xl">
+        <DialogHeader>
+          <DialogTitle>File Library</DialogTitle>
+          <DialogDescription>
+            Select an existing file or upload a new one.
+          </DialogDescription>
+        </DialogHeader>
+
+        <Tabs
+          value={tab}
+          onValueChange={setTab}
+          className="flex min-h-0 flex-1 flex-col overflow-hidden"
+        >
+          <TabsList>
+            <TabsTrigger value="library">Library</TabsTrigger>
+            <TabsTrigger value="upload">Upload</TabsTrigger>
+          </TabsList>
+
+          {/* ----------------------------------------------------------------
                 Library tab
             ---------------------------------------------------------------- */}
-            <TabsContent
-              value="library"
-              className="flex min-h-0 flex-1 flex-col gap-3 overflow-hidden"
-            >
-              <div className="relative">
-                <Search className="absolute left-2.5 top-2.5 size-4 text-muted-foreground" />
-                <Input
-                  placeholder="Search files…"
-                  value={search}
-                  onChange={handleSearchChange}
-                  className="pl-8"
-                />
+          <TabsContent
+            value="library"
+            className="flex min-h-0 flex-1 flex-col gap-3 overflow-hidden"
+          >
+            <div className="relative">
+              <Search className="absolute left-2.5 top-2.5 size-4 text-muted-foreground" />
+              <Input
+                placeholder="Search files…"
+                value={search}
+                onChange={handleSearchChange}
+                className="pl-8"
+              />
+            </div>
+
+            {isLoading ? (
+              <div className="grid grid-cols-3 gap-3 sm:grid-cols-4">
+                {skeletonKeys.map((k) => (
+                  <Skeleton key={k} className="aspect-square rounded-lg" />
+                ))}
               </div>
-
-              {isLoading ? (
-                <div className="grid grid-cols-3 gap-3 sm:grid-cols-4">
-                  {skeletonKeys.map((k) => (
-                    <Skeleton key={k} className="aspect-square rounded-lg" />
+            ) : isError ? (
+              <div className="flex flex-1 items-center justify-center text-destructive text-sm">
+                Failed to load files. Please try again.
+              </div>
+            ) : filteredItems.length === 0 ? (
+              <div className="flex flex-1 items-center justify-center text-muted-foreground text-sm">
+                No files found.
+              </div>
+            ) : (
+              <ScrollArea className="min-h-0 flex-1">
+                <div className="grid grid-cols-3 gap-3 pr-3 sm:grid-cols-4">
+                  {filteredItems.map((file) => (
+                    <FileGridItem
+                      key={file.id}
+                      file={file}
+                      onSelect={() => {
+                        onSelect(file);
+                        handleOpenChange(false);
+                      }}
+                    />
                   ))}
                 </div>
-              ) : isError ? (
-                <div className="flex flex-1 items-center justify-center text-destructive text-sm">
-                  Failed to load files. Please try again.
-                </div>
-              ) : filteredItems.length === 0 ? (
-                <div className="flex flex-1 items-center justify-center text-muted-foreground text-sm">
-                  No files found.
-                </div>
-              ) : (
-                <ScrollArea className="min-h-0 flex-1">
-                  <div className="grid grid-cols-3 gap-3 pr-3 sm:grid-cols-4">
-                    {filteredItems.map((file) => (
-                      <FileGridItem
-                        key={file.id}
-                        file={file}
-                        onSelect={() => {
-                          onSelect(file);
-                          handleOpenChange(false);
-                        }}
-                      />
-                    ))}
-                  </div>
-                </ScrollArea>
-              )}
-
-              {data && data.total > data.per_page && (
-                <div className="flex items-center justify-between text-sm text-muted-foreground">
-                  <span>
-                    {filteredItems.length} of {data.total} files
-                  </span>
-                  <div className="flex gap-2">
-                    <Button
-                      variant="outline"
-                      size="sm"
-                      disabled={page <= 1}
-                      onClick={() => setPage((p) => p - 1)}
-                    >
-                      Previous
-                    </Button>
-                    <Button
-                      variant="outline"
-                      size="sm"
-                      disabled={isLastPage}
-                      onClick={() => setPage((p) => p + 1)}
-                    >
-                      Next
-                    </Button>
-                  </div>
+              </ScrollArea>
+            )}
+
+            {data && data.total > data.per_page && (
+              <div className="flex items-center justify-between text-sm text-muted-foreground">
+                <span>
+                  {filteredItems.length} of {data.total} files
+                </span>
+                <div className="flex gap-2">
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    disabled={page <= 1}
+                    onClick={() => setPage((p) => p - 1)}
+                  >
+                    Previous
+                  </Button>
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    disabled={isLastPage}
+                    onClick={() => setPage((p) => p + 1)}
+                  >
+                    Next
+                  </Button>
                 </div>
-              )}
-            </TabsContent>
+              </div>
+            )}
+          </TabsContent>
 
-            {/* ----------------------------------------------------------------
+          {/* ----------------------------------------------------------------
                 Upload tab — using a <label> as the drop zone so the hidden
                 <input> receives clicks without needing an imperative ref call,
                 and biome's a11y/noStaticElementInteractions lint is satisfied.
             ---------------------------------------------------------------- */}
-            <TabsContent
-              value="upload"
-              className="flex min-h-0 flex-1 flex-col"
+          <TabsContent value="upload" className="flex min-h-0 flex-1 flex-col">
+            <label
+              htmlFor="file-picker-input"
+              className={[
+                "flex flex-1 flex-col items-center justify-center gap-4 rounded-lg border-2 border-dashed p-12 transition-colors cursor-pointer",
+                dragOver
+                  ? "border-primary bg-primary/5"
+                  : "border-muted-foreground/25 hover:border-muted-foreground/50",
+              ].join(" ")}
+              onDragOver={(e) => {
+                e.preventDefault();
+                setDragOver(true);
+              }}
+              onDragLeave={() => setDragOver(false)}
+              onDrop={handleDrop}
             >
-              <label
-                htmlFor="file-picker-input"
-                className={[
-                  "flex flex-1 flex-col items-center justify-center gap-4 rounded-lg border-2 border-dashed p-12 transition-colors cursor-pointer",
-                  dragOver
-                    ? "border-primary bg-primary/5"
-                    : "border-muted-foreground/25 hover:border-muted-foreground/50",
-                ].join(" ")}
-                onDragOver={(e) => {
+              <Upload className="size-10 text-muted-foreground" />
+              <div className="text-center">
+                <p className="font-medium">
+                  Drag and drop a file here, or click to browse
+                </p>
+                <p className="text-sm text-muted-foreground">
+                  {accept ?? "Images, videos, PDFs, and more"}
+                </p>
+              </div>
+              <Button
+                type="button"
+                variant="outline"
+                onClick={(e) => {
                   e.preventDefault();
-                  setDragOver(true);
+                  e.stopPropagation();
+                  fileInputRef.current?.click();
                 }}
-                onDragLeave={() => setDragOver(false)}
-                onDrop={handleDrop}
+                disabled={uploadMutation.isPending}
               >
-                <Upload className="size-10 text-muted-foreground" />
-                <div className="text-center">
-                  <p className="font-medium">
-                    Drag and drop a file here, or click to browse
-                  </p>
-                  <p className="text-sm text-muted-foreground">
-                    {accept ?? "Images, videos, PDFs, and more"}
-                  </p>
-                </div>
-                <Button
-                  type="button"
-                  variant="outline"
-                  onClick={(e) => {
-                    e.preventDefault();
-                    e.stopPropagation();
-                    fileInputRef.current?.click();
-                  }}
-                  disabled={uploadMutation.isPending}
-                >
-                  {uploadIcon}
-                  {uploadMutation.isPending ? "Uploading…" : "Choose File"}
-                </Button>
-                <input
-                  id="file-picker-input"
-                  ref={fileInputRef}
-                  type="file"
-                  className="sr-only"
-                  accept={accept}
-                  onChange={(e) => handleFileSelect(e.target.files)}
-                  // Reset value so the same file can be re-uploaded if needed.
-                  onClick={(e) => {
-                    (e.target as HTMLInputElement).value = "";
-                  }}
-                />
-              </label>
-            </TabsContent>
-          </Tabs>
-
-          <DialogFooter>
-            <Button variant="outline" onClick={() => handleOpenChange(false)}>
-              Cancel
-            </Button>
-          </DialogFooter>
-        </DialogContent>
+                {uploadIcon}
+                {uploadMutation.isPending ? "Uploading…" : "Choose File"}
+              </Button>
+              <input
+                id="file-picker-input"
+                ref={fileInputRef}
+                type="file"
+                className="sr-only"
+                accept={accept}
+                onChange={(e) => handleFileSelect(e.target.files)}
+                // Reset value so the same file can be re-uploaded if needed.
+                onClick={(e) => {
+                  (e.target as HTMLInputElement).value = "";
+                }}
+              />
+            </label>
+          </TabsContent>
+        </Tabs>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={() => handleOpenChange(false)}>
+            Cancel
+          </Button>
+        </DialogFooter>
+      </DialogContent>
     </Dialog>
   );
 }
diff --git a/apps/dashboard/src/components/revisions-panel.tsx b/apps/dashboard/src/components/revisions-panel.tsx
index e499cefa..e59a49fe 100644
--- a/apps/dashboard/src/components/revisions-panel.tsx
+++ b/apps/dashboard/src/components/revisions-panel.tsx
@@ -1,5 +1,6 @@
-import { useCallback, useMemo, useState } from "react";
+import { useForm } from "@tanstack/react-form";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { formatDistanceToNow } from "date-fns";
 import {
   AlertTriangle,
   ChevronDown,
@@ -10,11 +11,10 @@ import {
   RotateCcw,
   User,
 } from "lucide-react";
-import { formatDistanceToNow } from "date-fns";
+import { useCallback, useMemo, useState } from "react";
 import { toast } from "sonner";
-import { useForm } from "@tanstack/react-form";
 import { z } from "zod";
-
+import { DynamicForm } from "@/components/dynamic-form";
 import {
   AlertDialog,
   AlertDialogAction,
@@ -36,10 +36,8 @@ import {
   DialogHeader,
   DialogTitle,
 } from "@/components/ui/dialog";
-import { cn } from "@/lib/utils";
 import { ScrollArea } from "@/components/ui/scroll-area";
 import { Separator } from "@/components/ui/separator";
-import { Skeleton } from "@/components/ui/skeleton";
 import {
   Sheet,
   SheetContent,
@@ -47,20 +45,21 @@ import {
   SheetHeader,
   SheetTitle,
 } from "@/components/ui/sheet";
+import { Skeleton } from "@/components/ui/skeleton";
 import {
   Tooltip,
   TooltipContent,
   TooltipProvider,
   TooltipTrigger,
 } from "@/components/ui/tooltip";
-import { DynamicForm } from "@/components/dynamic-form";
 import {
-  getEntryRevisions,
-  restoreEntryRevision,
   type Entry,
   type EntryRevision,
+  getEntryRevisions,
+  restoreEntryRevision,
   type SchemaDefinition,
 } from "@/lib/api";
+import { cn } from "@/lib/utils";
 
 // ---------------------------------------------------------------------------
 // Constants
diff --git a/apps/dashboard/src/components/sidebar/site-switcher.tsx b/apps/dashboard/src/components/sidebar/site-switcher.tsx
index df252a40..7f293078 100644
--- a/apps/dashboard/src/components/sidebar/site-switcher.tsx
+++ b/apps/dashboard/src/components/sidebar/site-switcher.tsx
@@ -120,7 +120,11 @@ export function SiteSwitcher({
                   className="gap-3 px-3 py-2.5"
                 >
                   <div className="flex size-6 items-center justify-center rounded-md border">
-                    <SiteAvatar siteName={team.name} className="size-4" animate={hoveredSiteId === team.id} />
+                    <SiteAvatar
+                      siteName={team.name}
+                      className="size-4"
+                      animate={hoveredSiteId === team.id}
+                    />
                   </div>
                   {team.name}
                 </DropdownMenuItem>
diff --git a/apps/dashboard/src/components/site-avatar.tsx b/apps/dashboard/src/components/site-avatar.tsx
index 02c77904..e782665d 100644
--- a/apps/dashboard/src/components/site-avatar.tsx
+++ b/apps/dashboard/src/components/site-avatar.tsx
@@ -1,43 +1,43 @@
-import { Hashvatar } from "hashvatar/react";
-import { Avatar, AvatarImage, AvatarFallback } from "@/components/ui/avatar";
-import { cn } from "@/lib/utils";
-import { useState } from "react";
-
-type SiteAvatarProps = {
-  siteName: string;
-  size?: number;
-  siteLogo?: string | null;
-  className?: string | undefined;
-  animate?: boolean;
-};
-
-export function SiteAvatar({
-  siteName,
-  size = 32,
-  siteLogo,
-  className,
-  animate,
-}: SiteAvatarProps) {
-  const [isHovered, setIsHovered] = useState(false);
-  const shouldAnimate = animate !== undefined ? animate : isHovered;
-
-  return (
-    <Avatar
-      className={cn(["size-8 rounded-lg!", className])}
-      onMouseEnter={() => setIsHovered(true)}
-      onMouseLeave={() => setIsHovered(false)}
-    >
-      <AvatarImage src={siteLogo ?? undefined} alt={siteName} />
-      <AvatarFallback className="p-0">
-        <Hashvatar
-          size={size}
-          hash={siteName}
-          mode="dither"
-          animated={shouldAnimate}
-          className="rounded-lg!"
-          dotScale={2.5}
-        />
-      </AvatarFallback>
-    </Avatar>
-  );
-}
+import { Hashvatar } from "hashvatar/react";
+import { useState } from "react";
+import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
+import { cn } from "@/lib/utils";
+
+type SiteAvatarProps = {
+  siteName: string;
+  size?: number;
+  siteLogo?: string | null;
+  className?: string | undefined;
+  animate?: boolean;
+};
+
+export function SiteAvatar({
+  siteName,
+  size = 32,
+  siteLogo,
+  className,
+  animate,
+}: SiteAvatarProps) {
+  const [isHovered, setIsHovered] = useState(false);
+  const shouldAnimate = animate !== undefined ? animate : isHovered;
+
+  return (
+    <Avatar
+      className={cn(["size-8 rounded-lg!", className])}
+      onMouseEnter={() => setIsHovered(true)}
+      onMouseLeave={() => setIsHovered(false)}
+    >
+      <AvatarImage src={siteLogo ?? undefined} alt={siteName} />
+      <AvatarFallback className="p-0">
+        <Hashvatar
+          size={size}
+          hash={siteName}
+          mode="dither"
+          animated={shouldAnimate}
+          className="rounded-lg!"
+          dotScale={2.5}
+        />
+      </AvatarFallback>
+    </Avatar>
+  );
+}
diff --git a/apps/dashboard/src/components/site-settings/members-section.tsx b/apps/dashboard/src/components/site-settings/members-section.tsx
index df25a162..2eb70123 100644
--- a/apps/dashboard/src/components/site-settings/members-section.tsx
+++ b/apps/dashboard/src/components/site-settings/members-section.tsx
@@ -97,7 +97,9 @@ export function MembersSection({
   });
 
   const handleAdd = () => {
-    const user = candidates.find((candidate) => candidate.id === selectedUserId);
+    const user = candidates.find(
+      (candidate) => candidate.id === selectedUserId,
+    );
     if (user) inviteMutation.mutate(user.username);
   };
 
diff --git a/apps/dashboard/src/components/site-settings/user-combobox.tsx b/apps/dashboard/src/components/site-settings/user-combobox.tsx
index 4e3f44d8..ae7358e5 100644
--- a/apps/dashboard/src/components/site-settings/user-combobox.tsx
+++ b/apps/dashboard/src/components/site-settings/user-combobox.tsx
@@ -48,14 +48,19 @@ export function UserCombobox({
             aria-expanded={open}
             className="w-full justify-between font-normal"
           >
-            <span className={cn("truncate", !selected && "text-muted-foreground")}>
+            <span
+              className={cn("truncate", !selected && "text-muted-foreground")}
+            >
               {selected ? selected.username : placeholder}
             </span>
             <ChevronsUpDown className="size-4 shrink-0 opacity-50" />
           </Button>
         }
       />
-      <PopoverContent align="start" className="w-[var(--anchor-width)] min-w-60 p-0">
+      <PopoverContent
+        align="start"
+        className="w-[var(--anchor-width)] min-w-60 p-0"
+      >
         <Command>
           <CommandInput placeholder="Search users…" />
           <CommandList>
diff --git a/apps/dashboard/src/components/tiptap-editor.tsx b/apps/dashboard/src/components/tiptap-editor.tsx
index 47f6b68f..7abfe117 100644
--- a/apps/dashboard/src/components/tiptap-editor.tsx
+++ b/apps/dashboard/src/components/tiptap-editor.tsx
@@ -248,7 +248,12 @@ export function TiptapEditor({
           >
             <LinkIcon />
           </Button>
-          <Button variant="ghost" size="icon-sm" onClick={addImage} title="Image">
+          <Button
+            variant="ghost"
+            size="icon-sm"
+            onClick={addImage}
+            title="Image"
+          >
             <ImageIcon />
           </Button>
 
diff --git a/apps/dashboard/src/contexts/auth-context.tsx b/apps/dashboard/src/contexts/auth-context.tsx
index 7cddf374..c21482f7 100644
--- a/apps/dashboard/src/contexts/auth-context.tsx
+++ b/apps/dashboard/src/contexts/auth-context.tsx
@@ -1,6 +1,6 @@
-import { createContext, type ReactNode, useContext } from "react";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
-import { logoutApi, getMe, type UserPublic } from "@/lib/api";
+import { createContext, type ReactNode, useContext } from "react";
+import { getMe, logoutApi, type UserPublic } from "@/lib/api";
 
 interface AuthContextValue {
   user: UserPublic | null;
diff --git a/apps/dashboard/src/lib/api.ts b/apps/dashboard/src/lib/api.ts
index 3ace12d3..017356c9 100644
--- a/apps/dashboard/src/lib/api.ts
+++ b/apps/dashboard/src/lib/api.ts
@@ -5,7 +5,11 @@ export class ApiError extends Error {
   status: number;
   body?: Record<string, unknown>;
 
-  constructor(status: number, message?: string, body?: Record<string, unknown>) {
+  constructor(
+    status: number,
+    message?: string,
+    body?: Record<string, unknown>,
+  ) {
     super(message);
     this.status = status;
     this.body = body;
@@ -89,7 +93,9 @@ export function isOperator(role: InstanceRole | null | undefined): boolean {
 }
 
 /** Human label for an instance role, used in settings/user lists. */
-export function instanceRoleLabel(role: InstanceRole | null | undefined): string {
+export function instanceRoleLabel(
+  role: InstanceRole | null | undefined,
+): string {
   if (role === "instance_owner") return "Instance owner";
   if (role === "instance_admin") return "Instance admin";
   return "User";
@@ -597,7 +603,10 @@ export async function listBackups(scope: BackupScope) {
   return api<BackupInfo[]>(`${backupScopePrefix(scope)}/backups`);
 }
 
-export async function createBackup(scope: BackupScope, input: CreateBackupInput) {
+export async function createBackup(
+  scope: BackupScope,
+  input: CreateBackupInput,
+) {
   return api<BackupInfo>(`${backupScopePrefix(scope)}/backups`, {
     method: "POST",
     body: JSON.stringify(input),
@@ -611,7 +620,10 @@ export async function deleteBackup(scope: BackupScope, backupId: string) {
 }
 
 /** Same-origin URL for downloading a backup artifact (auth via cookie). */
-export function backupDownloadUrl(scope: BackupScope, backupId: string): string {
+export function backupDownloadUrl(
+  scope: BackupScope,
+  backupId: string,
+): string {
   return `${BASE_URL}${backupScopePrefix(scope)}/backups/${backupId}/download`;
 }
 
@@ -625,7 +637,12 @@ export async function restoreBackup(scope: BackupScope, input: RestoreInput) {
 export async function restoreBackupUpload(
   scope: BackupScope,
   file: File,
-  opts: { mode?: "instance" | "site"; site_id?: string; import_as_new?: boolean; confirm: string },
+  opts: {
+    mode?: "instance" | "site";
+    site_id?: string;
+    import_as_new?: boolean;
+    confirm: string;
+  },
 ) {
   const formData = new FormData();
   formData.append("file", file);
@@ -634,15 +651,22 @@ export async function restoreBackupUpload(
   formData.append("import_as_new", opts.import_as_new ? "true" : "false");
   formData.append("confirm", opts.confirm);
   const csrfToken = getCsrfToken();
-  const res = await fetch(`${BASE_URL}${backupScopePrefix(scope)}/restore/upload`, {
-    method: "POST",
-    credentials: "include",
-    body: formData,
-    headers: csrfToken ? { "X-CSRF-Token": csrfToken } : undefined,
-  });
+  const res = await fetch(
+    `${BASE_URL}${backupScopePrefix(scope)}/restore/upload`,
+    {
+      method: "POST",
+      credentials: "include",
+      body: formData,
+      headers: csrfToken ? { "X-CSRF-Token": csrfToken } : undefined,
+    },
+  );
   if (!res.ok) {
     const body = await res.json().catch(() => ({}));
-    throw new ApiError(res.status, body.message || body.error || "Restore failed", body);
+    throw new ApiError(
+      res.status,
+      body.message || body.error || "Restore failed",
+      body,
+    );
   }
 }
 
@@ -666,15 +690,22 @@ export async function inspectBackupUpload(scope: BackupScope, file: File) {
   const formData = new FormData();
   formData.append("file", file);
   const csrfToken = getCsrfToken();
-  const res = await fetch(`${BASE_URL}${backupScopePrefix(scope)}/restore/inspect/upload`, {
-    method: "POST",
-    credentials: "include",
-    body: formData,
-    headers: csrfToken ? { "X-CSRF-Token": csrfToken } : undefined,
-  });
+  const res = await fetch(
+    `${BASE_URL}${backupScopePrefix(scope)}/restore/inspect/upload`,
+    {
+      method: "POST",
+      credentials: "include",
+      body: formData,
+      headers: csrfToken ? { "X-CSRF-Token": csrfToken } : undefined,
+    },
+  );
   if (!res.ok) {
     const body = await res.json().catch(() => ({}));
-    throw new ApiError(res.status, body.message || body.error || "Could not read backup file", body);
+    throw new ApiError(
+      res.status,
+      body.message || body.error || "Could not read backup file",
+      body,
+    );
   }
   return (await res.json()) as InspectResult;
 }
@@ -683,14 +714,21 @@ export async function listBackupSchedules(scope: BackupScope) {
   return api<BackupSchedule[]>(`${backupScopePrefix(scope)}/backup-schedules`);
 }
 
-export async function createBackupSchedule(scope: BackupScope, input: ScheduleInput) {
+export async function createBackupSchedule(
+  scope: BackupScope,
+  input: ScheduleInput,
+) {
   return api<BackupSchedule>(`${backupScopePrefix(scope)}/backup-schedules`, {
     method: "POST",
     body: JSON.stringify(input),
   });
 }
 
-export async function updateBackupSchedule(scope: BackupScope, id: string, input: ScheduleInput) {
+export async function updateBackupSchedule(
+  scope: BackupScope,
+  id: string,
+  input: ScheduleInput,
+) {
   return api<void>(`${backupScopePrefix(scope)}/backup-schedules/${id}`, {
     method: "PUT",
     body: JSON.stringify(input),
@@ -704,9 +742,12 @@ export async function deleteBackupSchedule(scope: BackupScope, id: string) {
 }
 
 export async function runBackupSchedule(scope: BackupScope, id: string) {
-  return api<BackupInfo>(`${backupScopePrefix(scope)}/backup-schedules/${id}/run`, {
-    method: "POST",
-  });
+  return api<BackupInfo>(
+    `${backupScopePrefix(scope)}/backup-schedules/${id}/run`,
+    {
+      method: "POST",
+    },
+  );
 }
 
 // --- Sites API ---
diff --git a/apps/dashboard/src/routes/_admin/_shell/index.tsx b/apps/dashboard/src/routes/_admin/_shell/index.tsx
index f5881c35..e2506d4d 100644
--- a/apps/dashboard/src/routes/_admin/_shell/index.tsx
+++ b/apps/dashboard/src/routes/_admin/_shell/index.tsx
@@ -9,6 +9,7 @@ import { Cloud, Globe, HardDrive, Plus } from "lucide-react";
 import { useEffect, useState } from "react";
 import { toast } from "sonner";
 import { z } from "zod";
+import { SiteAvatar } from "@/components/site-avatar";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import {
@@ -45,10 +46,9 @@ import {
   createSite,
   getSites,
   isOperator,
-  siteRoleLabel,
   type SiteWithRole,
+  siteRoleLabel,
 } from "@/lib/api";
-import { SiteAvatar } from "@/components/site-avatar";
 
 export const Route = createFileRoute("/_admin/_shell/")({
   validateSearch: z.object({
diff --git a/apps/dashboard/src/routes/_admin/_shell/settings.tsx b/apps/dashboard/src/routes/_admin/_shell/settings.tsx
index 14dfda88..dd269cc6 100644
--- a/apps/dashboard/src/routes/_admin/_shell/settings.tsx
+++ b/apps/dashboard/src/routes/_admin/_shell/settings.tsx
@@ -42,31 +42,31 @@ function InstanceSettingsLayout() {
       </div>
 
       <Tabs value={active}>
-          <TabsList>
+        <TabsList>
+          <TabsTrigger
+            value="general"
+            nativeButton={false}
+            render={<Link to="/settings" />}
+          >
+            General
+          </TabsTrigger>
+          <TabsTrigger
+            value="users"
+            nativeButton={false}
+            render={<Link to="/settings/users" />}
+          >
+            Users
+          </TabsTrigger>
+          {isOwner && (
             <TabsTrigger
-              value="general"
+              value="backups"
               nativeButton={false}
-              render={<Link to="/settings" />}
+              render={<Link to="/settings/backups" />}
             >
-              General
+              Backups
             </TabsTrigger>
-            <TabsTrigger
-              value="users"
-              nativeButton={false}
-              render={<Link to="/settings/users" />}
-            >
-              Users
-            </TabsTrigger>
-            {isOwner && (
-              <TabsTrigger
-                value="backups"
-                nativeButton={false}
-                render={<Link to="/settings/backups" />}
-              >
-                Backups
-              </TabsTrigger>
-            )}
-          </TabsList>
+          )}
+        </TabsList>
       </Tabs>
 
       <Outlet />
diff --git a/apps/dashboard/src/routes/_admin/sites.$siteId.tsx b/apps/dashboard/src/routes/_admin/sites.$siteId.tsx
index ecb46e34..b02aaff1 100644
--- a/apps/dashboard/src/routes/_admin/sites.$siteId.tsx
+++ b/apps/dashboard/src/routes/_admin/sites.$siteId.tsx
@@ -1,13 +1,13 @@
 import { createFileRoute, Outlet } from "@tanstack/react-router";
-import { AppSidebar } from "@/components/sidebar/app-sidebar";
 import { AppBreadcrumb } from "@/components/app-breadcrumb";
+import { AppSidebar } from "@/components/sidebar/app-sidebar";
+import { ModeToggle } from "@/components/theme-toggle";
 import { Separator } from "@/components/ui/separator";
 import {
   SidebarInset,
   SidebarProvider,
   SidebarTrigger,
 } from "@/components/ui/sidebar";
-import { ModeToggle } from "@/components/theme-toggle";
 
 export const Route = createFileRoute("/_admin/sites/$siteId")({
   component: SiteLayout,
@@ -33,4 +33,4 @@ function SiteLayout() {
       </SidebarInset>
     </SidebarProvider>
   );
-}
\ No newline at end of file
+}
diff --git a/apps/dashboard/src/routes/_admin/sites.$siteId/collections.tsx b/apps/dashboard/src/routes/_admin/sites.$siteId/collections.tsx
index feed21bb..78e4aef7 100644
--- a/apps/dashboard/src/routes/_admin/sites.$siteId/collections.tsx
+++ b/apps/dashboard/src/routes/_admin/sites.$siteId/collections.tsx
@@ -491,10 +491,7 @@ function SortableFieldItem({
                       const newOpts = (field.options ?? []).filter(
                         (_, i) => i !== optIdx,
                       );
-                      form.setFieldValue(
-                        `fields[${index}].options`,
-                        newOpts,
-                      );
+                      form.setFieldValue(`fields[${index}].options`, newOpts);
                     }}
                   >
                     ×
diff --git a/apps/dashboard/src/routes/_admin/sites.$siteId/settings.tsx b/apps/dashboard/src/routes/_admin/sites.$siteId/settings.tsx
index 44b06595..0ca45444 100644
--- a/apps/dashboard/src/routes/_admin/sites.$siteId/settings.tsx
+++ b/apps/dashboard/src/routes/_admin/sites.$siteId/settings.tsx
@@ -4,8 +4,8 @@ import {
   Outlet,
   useRouterState,
 } from "@tanstack/react-router";
-import { Tabs, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { useSiteRole } from "@/components/site-settings/use-site-role";
+import { Tabs, TabsList, TabsTrigger } from "@/components/ui/tabs";
 
 export const Route = createFileRoute("/_admin/sites/$siteId/settings")({
   component: SettingsLayout,
@@ -31,69 +31,66 @@ function SettingsLayout() {
       </div>
 
       <Tabs value={active}>
-          <TabsList>
+        <TabsList>
+          <TabsTrigger
+            value="general"
+            nativeButton={false}
+            render={<Link to="/sites/$siteId/settings" params={{ siteId }} />}
+          >
+            General
+          </TabsTrigger>
+          <TabsTrigger
+            value="members"
+            nativeButton={false}
+            render={
+              <Link to="/sites/$siteId/settings/members" params={{ siteId }} />
+            }
+          >
+            Members
+          </TabsTrigger>
+          {canManage && (
+            <TabsTrigger
+              value="api-keys"
+              nativeButton={false}
+              render={
+                <Link
+                  to="/sites/$siteId/settings/api-keys"
+                  params={{ siteId }}
+                />
+              }
+            >
+              API Keys
+            </TabsTrigger>
+          )}
+          {canManage && (
             <TabsTrigger
-              value="general"
+              value="webhooks"
               nativeButton={false}
-              render={<Link to="/sites/$siteId/settings" params={{ siteId }} />}
+              render={
+                <Link
+                  to="/sites/$siteId/settings/webhooks"
+                  params={{ siteId }}
+                />
+              }
             >
-              General
+              Webhooks
             </TabsTrigger>
+          )}
+          {canManage && (
             <TabsTrigger
-              value="members"
+              value="backups"
               nativeButton={false}
               render={
                 <Link
-                  to="/sites/$siteId/settings/members"
+                  to="/sites/$siteId/settings/backups"
                   params={{ siteId }}
                 />
               }
             >
-              Members
+              Backups
             </TabsTrigger>
-            {canManage && (
-              <TabsTrigger
-                value="api-keys"
-                nativeButton={false}
-                render={
-                  <Link
-                    to="/sites/$siteId/settings/api-keys"
-                    params={{ siteId }}
-                  />
-                }
-              >
-                API Keys
-              </TabsTrigger>
-            )}
-            {canManage && (
-              <TabsTrigger
-                value="webhooks"
-                nativeButton={false}
-                render={
-                  <Link
-                    to="/sites/$siteId/settings/webhooks"
-                    params={{ siteId }}
-                  />
-                }
-              >
-                Webhooks
-              </TabsTrigger>
-            )}
-            {canManage && (
-              <TabsTrigger
-                value="backups"
-                nativeButton={false}
-                render={
-                  <Link
-                    to="/sites/$siteId/settings/backups"
-                    params={{ siteId }}
-                  />
-                }
-              >
-                Backups
-              </TabsTrigger>
-            )}
-          </TabsList>
+          )}
+        </TabsList>
       </Tabs>
 
       <Outlet />
diff --git a/apps/dashboard/src/styles.css b/apps/dashboard/src/styles.css
index abcdb6fb..349e876b 100644
--- a/apps/dashboard/src/styles.css
+++ b/apps/dashboard/src/styles.css
@@ -117,7 +117,7 @@
   --color-sidebar-border: var(--sidebar-border);
   --color-sidebar-ring: var(--sidebar-ring);
   --font-heading: var(--font-sans);
-  --font-sans: 'Geist Variable', sans-serif;
+  --font-sans: "Geist Variable", sans-serif;
   --radius-2xl: calc(var(--radius) * 1.8);
   --radius-3xl: calc(var(--radius) * 2.2);
   --radius-4xl: calc(var(--radius) * 2.6);
@@ -133,4 +133,4 @@
   html {
     @apply font-sans;
   }
-}
\ No newline at end of file
+}

From 235cc61bf18c3afe52eec5206fb1ad59a96b3e18 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 10:02:47 +0530
Subject: [PATCH 35/43] chore: formatting and biome ci fixes

---
 apps/web/biome.json                           | 10 +-
 apps/web/src/app/(home)/_download/page.tsx    | 32 +++---
 apps/web/src/app/(home)/page.tsx              |  2 -
 apps/web/src/app/docs/docs.css                |  4 +-
 .../src/components/landing/backup-section.tsx |  1 +
 .../src/components/landing/cta-section.tsx    |  1 +
 .../components/landing/dashboard-section.tsx  | 60 ------------
 .../components/landing/database-section.tsx   | 53 +++++-----
 .../components/landing/features-section.tsx   |  3 +-
 .../src/components/landing/footer-section.tsx | 57 -----------
 .../src/components/landing/hero-section.tsx   | 98 ++++++++++---------
 .../landing/integrations-section.tsx          |  1 +
 .../web/src/components/landing/navigation.tsx |  1 +
 .../components/landing/security-section.tsx   |  7 +-
 .../landing/testimonials-section.tsx          | 10 +-
 apps/web/src/components/landing/use-cases.tsx |  1 +
 16 files changed, 129 insertions(+), 212 deletions(-)

diff --git a/apps/web/biome.json b/apps/web/biome.json
index 1d3a073a..a2cf8bc3 100644
--- a/apps/web/biome.json
+++ b/apps/web/biome.json
@@ -7,7 +7,15 @@
   },
   "files": {
     "ignoreUnknown": true,
-    "includes": ["**", "!node_modules", "!.next", "!dist", "!build", "!.source"]
+    "includes": [
+      "**",
+      "!node_modules",
+      "!.next",
+      "!dist",
+      "!build",
+      "!.source",
+      "!src/components/ui"
+    ]
   },
   "formatter": {
     "enabled": true,
diff --git a/apps/web/src/app/(home)/_download/page.tsx b/apps/web/src/app/(home)/_download/page.tsx
index e6b2d57c..d8686bd7 100644
--- a/apps/web/src/app/(home)/_download/page.tsx
+++ b/apps/web/src/app/(home)/_download/page.tsx
@@ -2,18 +2,10 @@
 
 import { Icon } from "@iconify-icon/react";
 import { Check, Code2, Download } from "lucide-react";
-import Image from "next/image";
 import { useState } from "react";
 import { FooterSection } from "@/components/landing/footer-section";
 import { Navigation } from "@/components/landing/navigation";
 import { Button } from "@/components/ui/button";
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "@/components/ui/select";
 
 type OS = "linux" | "macos" | "windows";
 type Architecture = "x86_64" | "aarch64" | "arm64";
@@ -195,12 +187,13 @@ export default function DownloadPage() {
             <div className="space-y-8 mb-12">
               {/* OS Selection */}
               <div>
-                <label className="block text-sm font-medium mb-4">
+                <span className="block text-sm font-medium mb-4">
                   Operating System
-                </label>
+                </span>
                 <div className="grid grid-cols-1 sm:grid-cols-3 gap-3">
                   {osOptions.map((option) => (
                     <button
+                      type="button"
                       key={option.value}
                       onClick={() => setSelectedOS(option.value)}
                       className={`relative p-4 rounded-lg border-2 transition-all duration-200 text-left ${
@@ -232,12 +225,13 @@ export default function DownloadPage() {
 
               {/* Architecture Selection */}
               <div>
-                <label className="block text-sm font-medium mb-4">
+                <span className="block text-sm font-medium mb-4">
                   Architecture
-                </label>
+                </span>
                 <div className="grid grid-cols-1 sm:grid-cols-2 gap-3 max-w-lg">
                   {currentArchOptions.map((option) => (
                     <button
+                      type="button"
                       key={option.value}
                       onClick={() => setSelectedArch(option.value)}
                       className={`relative p-4 rounded-lg border-2 transition-all duration-200 text-left ${
@@ -319,14 +313,20 @@ export default function DownloadPage() {
                 <div className="bg-muted/30 rounded-lg p-4 border border-foreground/5">
                   <p className="text-xs text-muted-foreground leading-relaxed">
                     By downloading, you agree to the{" "}
-                    <a href="#" className="text-foreground hover:underline">
+                    <button
+                      type="button"
+                      className="text-foreground hover:underline inline"
+                    >
                       AGPL v3 License
-                    </a>
+                    </button>
                     . All downloads are verified with SHA256 checksums. Need
                     help? Check our{" "}
-                    <a href="#" className="text-foreground hover:underline">
+                    <button
+                      type="button"
+                      className="text-foreground hover:underline inline"
+                    >
                       installation guide
-                    </a>
+                    </button>
                     .
                   </p>
                 </div>
diff --git a/apps/web/src/app/(home)/page.tsx b/apps/web/src/app/(home)/page.tsx
index 308aef62..7719e99e 100644
--- a/apps/web/src/app/(home)/page.tsx
+++ b/apps/web/src/app/(home)/page.tsx
@@ -7,9 +7,7 @@ import { FooterSection } from "@/components/landing/footer-section";
 import { HeroSection } from "@/components/landing/hero-section";
 import { HowItWorksSection } from "@/components/landing/how-it-works-section";
 import { IntegrationsSection } from "@/components/landing/integrations-section";
-import { Navigation } from "@/components/landing/navigation";
 import { SecuritySection } from "@/components/landing/security-section";
-import { TestimonialsSection } from "@/components/landing/testimonials-section";
 import { UseCasesSection } from "@/components/landing/use-cases";
 
 export default function Home() {
diff --git a/apps/web/src/app/docs/docs.css b/apps/web/src/app/docs/docs.css
index 488ce0ee..da1cd2f0 100644
--- a/apps/web/src/app/docs/docs.css
+++ b/apps/web/src/app/docs/docs.css
@@ -7,6 +7,6 @@ html {
 }
 
 html > body[data-scroll-locked] {
-  margin-right: 0px !important;
-  --removed-body-scroll-bar-size: 0px !important;
+  margin-right: 0px;
+  --removed-body-scroll-bar-size: 0px;
 }
diff --git a/apps/web/src/components/landing/backup-section.tsx b/apps/web/src/components/landing/backup-section.tsx
index eca26f21..0b0523bc 100644
--- a/apps/web/src/components/landing/backup-section.tsx
+++ b/apps/web/src/components/landing/backup-section.tsx
@@ -117,6 +117,7 @@ export function BackupSection() {
             return (
               <div
                 key={feature.title}
+                role="none"
                 className={`group relative overflow-hidden p-6 lg:p-8 border transition-all duration-500 cursor-default ${
                   hoveredIndex === index
                     ? "border-foreground bg-foreground/4"
diff --git a/apps/web/src/components/landing/cta-section.tsx b/apps/web/src/components/landing/cta-section.tsx
index 21aca4ed..0973d23f 100644
--- a/apps/web/src/components/landing/cta-section.tsx
+++ b/apps/web/src/components/landing/cta-section.tsx
@@ -36,6 +36,7 @@ export function CtaSection() {
     >
       <div className="max-w-350 mx-auto px-6 lg:px-12">
         <div
+          role="none"
           className={`relative border border-foreground transition-all duration-1000 ${
             isVisible ? "opacity-100 translate-y-0" : "opacity-0 translate-y-8"
           }`}
diff --git a/apps/web/src/components/landing/dashboard-section.tsx b/apps/web/src/components/landing/dashboard-section.tsx
index c182352a..b8904ed4 100644
--- a/apps/web/src/components/landing/dashboard-section.tsx
+++ b/apps/web/src/components/landing/dashboard-section.tsx
@@ -23,66 +23,6 @@ const dashboardCards = [
   },
 ];
 
-function AnimatedNumber({
-  end,
-  suffix = "",
-  prefix = "",
-}: {
-  end: number;
-  suffix?: string;
-  prefix?: string;
-}) {
-  const [count, setCount] = useState(0);
-  const [isScrambling, setIsScrambling] = useState(true);
-  const ref = useRef<HTMLDivElement>(null);
-  const [hasAnimated, setHasAnimated] = useState(false);
-
-  useEffect(() => {
-    const observer = new IntersectionObserver(
-      ([entry]) => {
-        if (entry.isIntersecting && !hasAnimated) {
-          setHasAnimated(true);
-          const duration = 2500;
-          const startTime = performance.now();
-          const animate = (currentTime: number) => {
-            const elapsed = currentTime - startTime;
-            const progress = Math.min(elapsed / duration, 1);
-            const eased = 1 - (1 - progress) ** 4;
-            setCount(Math.floor(eased * end));
-            setIsScrambling(progress < 0.8);
-            if (progress < 1) requestAnimationFrame(animate);
-          };
-          requestAnimationFrame(animate);
-        }
-      },
-      { threshold: 0.5 },
-    );
-    if (ref.current) observer.observe(ref.current);
-    return () => observer.disconnect();
-  }, [end, hasAnimated]);
-
-  const displayValue = count.toLocaleString();
-
-  return (
-    <div ref={ref} className="inline-flex items-baseline">
-      <span className="text-muted-foreground mr-1">{prefix}</span>
-      <span className="tabular-nums">
-        {displayValue.split("").map((char, i) => (
-          <span
-            key={i}
-            className={`inline-block transition-all duration-150 ${
-              isScrambling && char !== "," ? "blur-[1px]" : ""
-            }`}
-          >
-            {char}
-          </span>
-        ))}
-      </span>
-      <span className="text-muted-foreground">{suffix}</span>
-    </div>
-  );
-}
-
 function GridBackground() {
   const canvasRef = useRef<HTMLCanvasElement>(null);
   const timeRef = useRef(0);
diff --git a/apps/web/src/components/landing/database-section.tsx b/apps/web/src/components/landing/database-section.tsx
index 6d4b7e26..d94ae5a2 100644
--- a/apps/web/src/components/landing/database-section.tsx
+++ b/apps/web/src/components/landing/database-section.tsx
@@ -33,6 +33,20 @@ export function DatabaseSection() {
     return () => clearInterval(interval);
   }, []);
 
+  const lineConfigs = Array.from({ length: 19 }, (_, i) => ({
+    x1: 10 + (i % 5) * 20,
+    y1: 10 + Math.floor(i / 5) * 25,
+    x2: 10 + ((i + 1) % 5) * 20,
+    y2: 10 + Math.floor((i + 1) / 5) * 25,
+    delay: i * 0.15,
+  }));
+
+  const dotConfigs = Array.from({ length: 20 }, (_, i) => ({
+    left: 10 + (i % 5) * 20,
+    top: 10 + Math.floor(i / 5) * 25,
+    delay: i * 0.1,
+  }));
+
   return (
     <section
       id="infra"
@@ -109,6 +123,7 @@ export function DatabaseSection() {
             <div className="absolute inset-0 opacity-70">
               {/* SVG for connecting lines */}
               <svg
+                aria-hidden="true"
                 className="absolute inset-0 w-full h-full"
                 style={{ pointerEvents: "none" }}
               >
@@ -129,34 +144,28 @@ export function DatabaseSection() {
                     }
                   `}</style>
                 </defs>
-                {[...Array(19)].map((_, i) => {
-                  const x1 = 10 + (i % 5) * 20;
-                  const y1 = 10 + Math.floor(i / 5) * 25;
-                  const x2 = 10 + ((i + 1) % 5) * 20;
-                  const y2 = 10 + Math.floor((i + 1) / 5) * 25;
-                  return (
-                    <line
-                      key={`line-${i}`}
-                      x1={`${x1}%`}
-                      y1={`${y1}%`}
-                      x2={`${x2}%`}
-                      y2={`${y2}%`}
-                      className="connecting-line"
-                      style={{ animationDelay: `${i * 0.15}s` }}
-                    />
-                  );
-                })}
+                {lineConfigs.map((cfg) => (
+                  <line
+                    key={`${cfg.x1}-${cfg.y1}`}
+                    x1={`${cfg.x1}%`}
+                    y1={`${cfg.y1}%`}
+                    x2={`${cfg.x2}%`}
+                    y2={`${cfg.y2}%`}
+                    className="connecting-line"
+                    style={{ animationDelay: `${cfg.delay}s` }}
+                  />
+                ))}
               </svg>
 
               {/* Dots */}
-              {[...Array(20)].map((_, i) => (
+              {dotConfigs.map((dot) => (
                 <div
-                  key={i}
+                  key={`${dot.left}-${dot.top}`}
                   className="absolute w-1.5 h-1.5 rounded-full bg-[#eca8d6]"
                   style={{
-                    left: `${10 + (i % 5) * 20}%`,
-                    top: `${10 + Math.floor(i / 5) * 25}%`,
-                    animation: `pulse 2s ease-in-out ${i * 0.1}s infinite`,
+                    left: `${dot.left}%`,
+                    top: `${dot.top}%`,
+                    animation: `pulse 2s ease-in-out ${dot.delay}s infinite`,
                   }}
                 />
               ))}
diff --git a/apps/web/src/components/landing/features-section.tsx b/apps/web/src/components/landing/features-section.tsx
index aaa88554..6e3bee12 100644
--- a/apps/web/src/components/landing/features-section.tsx
+++ b/apps/web/src/components/landing/features-section.tsx
@@ -134,7 +134,7 @@ function ParticleVisualization() {
 
 export function FeaturesSection() {
   const [isVisible, setIsVisible] = useState(false);
-  const [activeFeature, setActiveFeature] = useState(0);
+  const [_activeFeature, setActiveFeature] = useState(0);
   const sectionRef = useRef<HTMLDivElement>(null);
 
   useEffect(() => {
@@ -201,6 +201,7 @@ export function FeaturesSection() {
                 ? "opacity-100 translate-y-0"
                 : "opacity-0 translate-y-12"
             }`}
+            role="none"
             onMouseEnter={() => setActiveFeature(0)}
           >
             {/* Left: text content */}
diff --git a/apps/web/src/components/landing/footer-section.tsx b/apps/web/src/components/landing/footer-section.tsx
index ff435835..a25f9bde 100644
--- a/apps/web/src/components/landing/footer-section.tsx
+++ b/apps/web/src/components/landing/footer-section.tsx
@@ -2,7 +2,6 @@
 
 import { ArrowUpRight } from "lucide-react";
 import Link from "next/link";
-import { useEffect, useRef } from "react";
 
 const footerLinks = {
   Product: [
@@ -42,62 +41,6 @@ const socialLinks = [
   { name: "Youtube", href: "https://youtube.com/@velopulent" },
 ];
 
-function AnimatedWaveCanvas() {
-  const canvasRef = useRef<HTMLCanvasElement>(null);
-
-  useEffect(() => {
-    const canvas = canvasRef.current;
-    if (!canvas) return;
-
-    const ctx = canvas.getContext("2d");
-    if (!ctx) return;
-
-    let animationId: number;
-    let time = 0;
-
-    const resize = () => {
-      canvas.width = canvas.offsetWidth * window.devicePixelRatio;
-      canvas.height = canvas.offsetHeight * window.devicePixelRatio;
-      ctx.scale(window.devicePixelRatio, window.devicePixelRatio);
-    };
-    resize();
-    window.addEventListener("resize", resize);
-
-    const animate = () => {
-      const width = canvas.offsetWidth;
-      const height = canvas.offsetHeight;
-      ctx.clearRect(0, 0, width, height);
-
-      ctx.strokeStyle = "rgba(100, 200, 150, 0.3)";
-      ctx.lineWidth = 1;
-
-      for (let wave = 0; wave < 3; wave++) {
-        ctx.beginPath();
-        for (let x = 0; x <= width; x += 5) {
-          const y =
-            height * 0.5 +
-            Math.sin(x * 0.01 + time + wave * 0.5) * 30 +
-            Math.sin(x * 0.02 + time * 1.5 + wave) * 20;
-          if (x === 0) ctx.moveTo(x, y);
-          else ctx.lineTo(x, y);
-        }
-        ctx.stroke();
-      }
-
-      time += 0.02;
-      animationId = requestAnimationFrame(animate);
-    };
-    animate();
-
-    return () => {
-      window.removeEventListener("resize", resize);
-      cancelAnimationFrame(animationId);
-    };
-  }, []);
-
-  return <canvas ref={canvasRef} className="w-full h-full" />;
-}
-
 export function FooterSection() {
   return (
     <footer className="relative bg-black">
diff --git a/apps/web/src/components/landing/hero-section.tsx b/apps/web/src/components/landing/hero-section.tsx
index ffee26f4..c0ae4479 100644
--- a/apps/web/src/components/landing/hero-section.tsx
+++ b/apps/web/src/components/landing/hero-section.tsx
@@ -4,7 +4,7 @@ import { useEffect, useRef, useState } from "react";
 
 const words = ["website", "blog", "app", "business", "portfolio", "platform"];
 
-function BlurWord({ word, trigger }: { word: string; trigger: number }) {
+function BlurWord({ word }: { word: string }) {
   const letters = word.split("");
   const STAGGER = 45; // ms between each letter
   const DURATION = 500; // blur+opacity fade duration per letter
@@ -59,7 +59,11 @@ function BlurWord({ word, trigger }: { word: string; trigger: number }) {
       timersRef.current.forEach(clearTimeout);
     };
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [trigger]);
+  }, [
+    letters.map, // stagger each letter
+    letters.forEach,
+    GRADIENT_HOLD,
+  ]);
 
   // gradient colours cycling across letter positions
   const gradientColors = [
@@ -70,43 +74,43 @@ function BlurWord({ word, trigger }: { word: string; trigger: number }) {
     "#eca8d6",
   ];
 
+  const hex2rgb = (hex: string): [number, number, number] => {
+    const r = parseInt(hex.slice(1, 3), 16);
+    const g = parseInt(hex.slice(3, 5), 16);
+    const b = parseInt(hex.slice(5, 7), 16);
+    return [r, g, b];
+  };
+
+  const charColors = letters.map((char, i) => {
+    const colorIndex =
+      (i / Math.max(letters.length - 1, 1)) * (gradientColors.length - 1);
+    const lower = Math.floor(colorIndex);
+    const upper = Math.min(lower + 1, gradientColors.length - 1);
+    const t = colorIndex - lower;
+    const [r1, g1, b1] = hex2rgb(gradientColors[lower]);
+    const [r2, g2, b2] = hex2rgb(gradientColors[upper]);
+    return {
+      char,
+      color: `rgb(${Math.round(r1 + (r2 - r1) * t)},${Math.round(g1 + (g2 - g1) * t)},${Math.round(b1 + (b2 - b1) * t)}`,
+    };
+  });
+
   return (
     <>
-      {letters.map((char, i) => {
-        const colorIndex =
-          (i / Math.max(letters.length - 1, 1)) * (gradientColors.length - 1);
-        const lower = Math.floor(colorIndex);
-        const upper = Math.min(lower + 1, gradientColors.length - 1);
-        const t = colorIndex - lower;
-
-        // lerp hex colours
-        const hex2rgb = (hex: string) => {
-          const r = parseInt(hex.slice(1, 3), 16);
-          const g = parseInt(hex.slice(3, 5), 16);
-          const b = parseInt(hex.slice(5, 7), 16);
-          return [r, g, b];
-        };
-        const [r1, g1, b1] = hex2rgb(gradientColors[lower]);
-        const [r2, g2, b2] = hex2rgb(gradientColors[upper]);
-        const r = Math.round(r1 + (r2 - r1) * t);
-        const g = Math.round(g1 + (g2 - g1) * t);
-        const b = Math.round(b1 + (b2 - b1) * t);
-
-        return (
-          <span
-            key={i}
-            style={{
-              display: "inline-block",
-              opacity: letterStates[i]?.opacity ?? 0,
-              filter: `blur(${letterStates[i]?.blur ?? 20}px)`,
-              color: showGradient ? `rgb(${r},${g},${b})` : "white",
-              transition: "color 0.4s ease",
-            }}
-          >
-            {char}
-          </span>
-        );
-      })}
+      {charColors.map((data, idx) => (
+        <span
+          key={`${data.char}-${data.color}`}
+          style={{
+            display: "inline-block",
+            opacity: letterStates[idx]?.opacity ?? 0,
+            filter: `blur(${letterStates[idx]?.blur ?? 20}px)`,
+            color: showGradient ? data.color : "white",
+            transition: "color 0.4s ease",
+          }}
+        >
+          {data.char}
+        </span>
+      ))}
     </>
   );
 }
@@ -126,6 +130,11 @@ export function HeroSection() {
     return () => clearInterval(interval);
   }, []);
 
+  const hLines = Array.from({ length: 8 }, (_, i) => ({ top: 12.5 * (i + 1) }));
+  const vLines = Array.from({ length: 12 }, (_, i) => ({
+    left: 8.33 * (i + 1),
+  }));
+
   return (
     <section className="relative min-h-screen flex flex-col justify-center items-start overflow-hidden bg-black">
       {/* Background video */}
@@ -135,7 +144,6 @@ export function HeroSection() {
           muted
           loop
           playsInline
-          aria-hidden="true"
           className="w-full h-full object-cover object-center opacity-80"
         >
           <source src="/assets/bg-hero.mp4" type="video/mp4" />
@@ -147,23 +155,23 @@ export function HeroSection() {
 
       {/* Subtle grid lines */}
       <div className="absolute inset-0 z-2 overflow-hidden pointer-events-none opacity-20">
-        {[...Array(8)].map((_, i) => (
+        {hLines.map((line) => (
           <div
-            key={`h-${i}`}
+            key={`h-${line.top}`}
             className="absolute h-px bg-white/10"
             style={{
-              top: `${12.5 * (i + 1)}%`,
+              top: `${line.top}%`,
               left: 0,
               right: 0,
             }}
           />
         ))}
-        {[...Array(12)].map((_, i) => (
+        {vLines.map((line) => (
           <div
-            key={`v-${i}`}
+            key={`v-${line.left}`}
             className="absolute w-px bg-white/10"
             style={{
-              left: `${8.33 * (i + 1)}%`,
+              left: `${line.left}%`,
               top: 0,
               bottom: 0,
             }}
@@ -202,7 +210,7 @@ export function HeroSection() {
               <span className="block whitespace-nowrap">
                 Build your{" "}
                 <span className="relative inline-block">
-                  <BlurWord word={words[wordIndex]} trigger={wordIndex} />
+                  <BlurWord word={words[wordIndex]} />
                 </span>
               </span>
             </h1>
diff --git a/apps/web/src/components/landing/integrations-section.tsx b/apps/web/src/components/landing/integrations-section.tsx
index 6f10fa00..e0d8663a 100644
--- a/apps/web/src/components/landing/integrations-section.tsx
+++ b/apps/web/src/components/landing/integrations-section.tsx
@@ -97,6 +97,7 @@ export function IntegrationsSection() {
           {frameworks.map((framework, index) => (
             <div
               key={framework.name}
+              role="none"
               className={`group relative overflow-hidden p-6 lg:p-8 border transition-all duration-500 cursor-default ${
                 hoveredIndex === index
                   ? "border-foreground bg-foreground/4 scale-[1.02]"
diff --git a/apps/web/src/components/landing/navigation.tsx b/apps/web/src/components/landing/navigation.tsx
index 76e90054..389e287b 100644
--- a/apps/web/src/components/landing/navigation.tsx
+++ b/apps/web/src/components/landing/navigation.tsx
@@ -92,6 +92,7 @@ export function Navigation() {
 
           {/* Mobile Menu Button */}
           <button
+            type="button"
             onClick={() => setIsMobileMenuOpen(!isMobileMenuOpen)}
             className={`z-50 xl:hidden p-2 transition-colors duration-500 ${isScrolled || isMobileMenuOpen ? "text-foreground" : "text-white"}`}
             aria-label="Toggle menu"
diff --git a/apps/web/src/components/landing/security-section.tsx b/apps/web/src/components/landing/security-section.tsx
index 156399a9..0b390528 100644
--- a/apps/web/src/components/landing/security-section.tsx
+++ b/apps/web/src/components/landing/security-section.tsx
@@ -158,9 +158,10 @@ export function SecuritySection() {
           {/* Feature cards stack */}
           <div className="lg:col-span-5 flex flex-col gap-4">
             {securityFeatures.map((feature, index) => (
-              <div
+              <button
+                type="button"
                 key={feature.title}
-                className={`p-6 border transition-all duration-500 cursor-default ${
+                className={`p-6 border transition-all duration-500 cursor-default text-left w-full ${
                   activeFeature === index
                     ? "border-foreground/30 bg-foreground/4"
                     : "border-foreground/10"
@@ -186,7 +187,7 @@ export function SecuritySection() {
                     </p>
                   </div>
                 </div>
-              </div>
+              </button>
             ))}
           </div>
         </div>
diff --git a/apps/web/src/components/landing/testimonials-section.tsx b/apps/web/src/components/landing/testimonials-section.tsx
index b3c45116..2defabdc 100644
--- a/apps/web/src/components/landing/testimonials-section.tsx
+++ b/apps/web/src/components/landing/testimonials-section.tsx
@@ -41,7 +41,7 @@ const testimonials = [
 export function TestimonialsSection() {
   const [activeIndex, setActiveIndex] = useState(0);
   const [isVisible, setIsVisible] = useState(false);
-  const [direction, setDirection] = useState<"left" | "right">("right");
+  const [_direction, setDirection] = useState<"left" | "right">("right");
   const sectionRef = useRef<HTMLElement>(null);
 
   const [pattern, setPattern] = useState("");
@@ -128,12 +128,14 @@ export function TestimonialsSection() {
           {/* Navigation arrows */}
           <div className="hidden lg:flex items-center gap-2">
             <button
+              type="button"
               onClick={goPrev}
               className="p-4 border border-background/20 hover:bg-background/10 transition-colors"
             >
               <ArrowLeft className="w-5 h-5" />
             </button>
             <button
+              type="button"
               onClick={goNext}
               className="p-4 border border-background/20 hover:bg-background/10 transition-colors"
             >
@@ -195,9 +197,10 @@ export function TestimonialsSection() {
 
             {/* Progress indicators */}
             <div className="flex gap-2">
-              {testimonials.map((_, idx) => (
+              {testimonials.map((t, idx) => (
                 <button
-                  key={idx}
+                  type="button"
+                  key={t.company}
                   onClick={() => goTo(idx)}
                   className="flex-1 h-1 bg-background/20 overflow-hidden"
                 >
@@ -227,6 +230,7 @@ export function TestimonialsSection() {
               <div className="flex flex-wrap gap-3">
                 {testimonials.map((t, idx) => (
                   <button
+                    type="button"
                     key={t.company}
                     onClick={() => goTo(idx)}
                     className={`px-4 py-2 text-sm border transition-all ${
diff --git a/apps/web/src/components/landing/use-cases.tsx b/apps/web/src/components/landing/use-cases.tsx
index 54702723..c645928c 100644
--- a/apps/web/src/components/landing/use-cases.tsx
+++ b/apps/web/src/components/landing/use-cases.tsx
@@ -70,6 +70,7 @@ export function UseCasesSection() {
       >
         <img
           src="/assets/tree-house-2x.png"
+          alt=""
           aria-hidden="true"
           className={`
             w-full h-full object-cover

From 515cc48f36c3ad5bc7c05c27cdaf5bdf412bb749 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 10:12:56 +0530
Subject: [PATCH 36/43] rm bun.lockb

---
 apps/web/bun.lockb | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 apps/web/bun.lockb

diff --git a/apps/web/bun.lockb b/apps/web/bun.lockb
deleted file mode 100644
index e69de29b..00000000

From 99e1808f925a72459fc1bb32fdb1bd016cef690b Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 10:13:33 +0530
Subject: [PATCH 37/43] chore(web): allow unoptimized images

---
 apps/web/next.config.mjs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/web/next.config.mjs b/apps/web/next.config.mjs
index 52f509d7..ff8f13b0 100644
--- a/apps/web/next.config.mjs
+++ b/apps/web/next.config.mjs
@@ -6,6 +6,7 @@ const withMDX = createMDX();
 const config = {
   output: "export",
   reactStrictMode: true,
+  images: { unoptimized: true },
 };
 
 export default withMDX(config);

From 49cd3d388ce3fd21da804eb74aaa8c8891274027 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 10:13:53 +0530
Subject: [PATCH 38/43] fix: replace img with Image from next

---
 apps/web/src/app/(home)/_download/page.tsx         | 11 ++++++-----
 apps/web/src/components/landing/backup-section.tsx |  8 +++++---
 apps/web/src/components/landing/cta-section.tsx    |  9 +++++----
 .../src/components/landing/dashboard-section.tsx   |  9 ++++++---
 .../src/components/landing/database-section.tsx    |  8 +++++---
 .../src/components/landing/features-section.tsx    |  6 ++++--
 apps/web/src/components/landing/footer-section.tsx |  6 ++++--
 .../components/landing/how-it-works-section.tsx    |  6 ++++--
 .../components/landing/integrations-section.tsx    |  7 +++++--
 .../src/components/landing/security-section.tsx    |  5 ++++-
 apps/web/src/components/landing/use-cases.tsx      | 14 ++++----------
 11 files changed, 52 insertions(+), 37 deletions(-)

diff --git a/apps/web/src/app/(home)/_download/page.tsx b/apps/web/src/app/(home)/_download/page.tsx
index d8686bd7..839a9ba4 100644
--- a/apps/web/src/app/(home)/_download/page.tsx
+++ b/apps/web/src/app/(home)/_download/page.tsx
@@ -2,6 +2,7 @@
 
 import { Icon } from "@iconify-icon/react";
 import { Check, Code2, Download } from "lucide-react";
+import Image from "next/image";
 import { useState } from "react";
 import { FooterSection } from "@/components/landing/footer-section";
 import { Navigation } from "@/components/landing/navigation";
@@ -159,12 +160,12 @@ export default function DownloadPage() {
                 </div>
               </div>
 
-              <img
-                src={"/assets/logo.webp"}
+              <Image
+                src="/assets/logo.webp"
                 alt="Velopulent CMS Logo"
-                width={620}
-                height={420}
-                className="relative"
+                width={1024}
+                height={701}
+                priority
               />
             </div>
           </div>
diff --git a/apps/web/src/components/landing/backup-section.tsx b/apps/web/src/components/landing/backup-section.tsx
index 0b0523bc..d352007b 100644
--- a/apps/web/src/components/landing/backup-section.tsx
+++ b/apps/web/src/components/landing/backup-section.tsx
@@ -1,6 +1,7 @@
 "use client";
 
 import { Cloud, HardDrive, RotateCcw, Shield } from "lucide-react";
+import Image from "next/image";
 import { useEffect, useRef, useState } from "react";
 
 const backupFeatures = [
@@ -70,16 +71,17 @@ export function BackupSection() {
           <div className="grid lg:grid-cols-[auto_1fr] gap-8 lg:gap-16 items-stretch">
             {/* Image — left column */}
             <div
-              className={`w-48 lg:w-72 xl:w-80 shrink-0 transition-all duration-1000 ${
+              className={`w-48 lg:w-72 xl:w-80 shrink-0 relative transition-all duration-1000 ${
                 isVisible
                   ? "opacity-100 translate-y-0"
                   : "opacity-0 translate-y-8"
               }`}
             >
-              <img
+              <Image
+                fill
                 src="/assets/backup.png"
                 alt="Backup and restore"
-                className="w-full h-full object-contain"
+                className="object-contain"
               />
             </div>
 
diff --git a/apps/web/src/components/landing/cta-section.tsx b/apps/web/src/components/landing/cta-section.tsx
index 0973d23f..f35cba76 100644
--- a/apps/web/src/components/landing/cta-section.tsx
+++ b/apps/web/src/components/landing/cta-section.tsx
@@ -3,6 +3,7 @@
 import { ArrowRight } from "lucide-react";
 import { useEffect, useRef, useState } from "react";
 import { Button } from "@/components/ui/button";
+import Image from "next/image";
 
 export function CtaSection() {
   const [isVisible, setIsVisible] = useState(false);
@@ -96,13 +97,13 @@ export function CtaSection() {
                   Open source, self-hosted
                 </p>
               </div>
-
               {/* Right image */}
-              <div className="hidden lg:flex items-end justify-center w-150 h-162.5 -mr-16">
-                <img
+              <div className="hidden lg:flex items-end justify-center w-150 h-162.5 -mr-16 relative">
+                <Image
+                  fill
                   src="/assets/bridge.png"
                   alt="Two trees connected by glowing arcs"
-                  className="w-full h-full object-contain object-bottom"
+                  className="object-contain object-bottom"
                 />
               </div>
             </div>
diff --git a/apps/web/src/components/landing/dashboard-section.tsx b/apps/web/src/components/landing/dashboard-section.tsx
index b8904ed4..7ac72e68 100644
--- a/apps/web/src/components/landing/dashboard-section.tsx
+++ b/apps/web/src/components/landing/dashboard-section.tsx
@@ -1,5 +1,6 @@
 "use client";
 
+import Image from "next/image";
 import { useEffect, useRef, useState } from "react";
 
 const dashboardCards = [
@@ -223,15 +224,17 @@ export function DashboardSection() {
 
         {/* Organic graph image */}
         <div
-          className={`w-full mb-0 transition-all duration-1000 delay-200 ${
+          className={`w-full mb-0 relative transition-all duration-1000 delay-200 ${
             isVisible ? "opacity-100" : "opacity-0"
           }`}
+          style={{ aspectRatio: "2492 / 824" }}
         >
-          <img
+          <Image
+            fill
             src="/assets/real-time-graph.png"
             alt=""
             aria-hidden="true"
-            className="w-full h-auto object-cover"
+            className="object-cover"
           />
         </div>
 
diff --git a/apps/web/src/components/landing/database-section.tsx b/apps/web/src/components/landing/database-section.tsx
index d94ae5a2..15dcf321 100644
--- a/apps/web/src/components/landing/database-section.tsx
+++ b/apps/web/src/components/landing/database-section.tsx
@@ -1,5 +1,6 @@
 "use client";
 
+import Image from "next/image";
 import { useEffect, useRef, useState } from "react";
 
 const regions = [
@@ -70,16 +71,17 @@ export function DatabaseSection() {
           <div className="grid lg:grid-cols-[auto_1fr] gap-8 lg:gap-16 items-stretch">
             {/* Image globe — colonne gauche, pleine hauteur */}
             <div
-              className={`w-48 lg:w-72 xl:w-80 shrink-0 transition-all duration-1000 ${
+              className={`w-48 lg:w-72 xl:w-80 shrink-0 relative transition-all duration-1000 ${
                 isVisible
                   ? "opacity-100 translate-y-0"
                   : "opacity-0 translate-y-8"
               }`}
             >
-              <img
+              <Image
+                fill
                 src="/assets/database.png"
                 alt="Global network sphere"
-                className="w-full h-full object-contain object-center"
+                className="object-contain object-center"
               />
             </div>
 
diff --git a/apps/web/src/components/landing/features-section.tsx b/apps/web/src/components/landing/features-section.tsx
index 6e3bee12..b82b217f 100644
--- a/apps/web/src/components/landing/features-section.tsx
+++ b/apps/web/src/components/landing/features-section.tsx
@@ -1,5 +1,6 @@
 "use client";
 
+import Image from "next/image";
 import { useEffect, useRef, useState } from "react";
 
 const features = [
@@ -230,11 +231,12 @@ export function FeaturesSection() {
 
             {/* Right: mirrored image, full height */}
             <div className="hidden lg:block relative w-[42%] shrink-0 overflow-hidden">
-              <img
+              <Image
+                fill
                 src="/assets/ridge.png"
                 alt=""
                 aria-hidden="true"
-                className="absolute inset-0 w-full h-full object-cover object-center"
+                className="object-cover object-center"
                 style={{ transform: "scaleX(-1)" }}
               />
               {/* Fade left edge into black */}
diff --git a/apps/web/src/components/landing/footer-section.tsx b/apps/web/src/components/landing/footer-section.tsx
index a25f9bde..b68f0b2c 100644
--- a/apps/web/src/components/landing/footer-section.tsx
+++ b/apps/web/src/components/landing/footer-section.tsx
@@ -1,6 +1,7 @@
 "use client";
 
 import { ArrowUpRight } from "lucide-react";
+import Image from "next/image";
 import Link from "next/link";
 
 const footerLinks = {
@@ -46,10 +47,11 @@ export function FooterSection() {
     <footer className="relative bg-black">
       {/* Panoramic banner image */}
       <div className="relative w-full h-85 md:h-105 overflow-hidden">
-        <img
+        <Image
+          fill
           src="/assets/footer.png"
           alt="Bioluminescent landscape"
-          className="w-full h-full object-cover object-center"
+          className="object-cover object-center"
         />
         {/* Gradient fade to black at bottom */}
         <div className="absolute inset-0 bg-linear-to-b from-transparent via-transparent to-black" />
diff --git a/apps/web/src/components/landing/how-it-works-section.tsx b/apps/web/src/components/landing/how-it-works-section.tsx
index 76748b6b..37d5b53c 100644
--- a/apps/web/src/components/landing/how-it-works-section.tsx
+++ b/apps/web/src/components/landing/how-it-works-section.tsx
@@ -1,5 +1,6 @@
 "use client";
 
+import Image from "next/image";
 import { useEffect, useRef, useState } from "react";
 
 const steps = [
@@ -91,11 +92,12 @@ export function HowItWorksSection() {
               isVisible ? "opacity-100" : "opacity-0"
             }`}
           >
-            <img
+            <Image
+              fill
               src="/assets/tree.png"
               alt=""
               aria-hidden="true"
-              className="absolute bottom-0 left-0 w-full h-full object-contain object-bottom"
+              className="object-contain object-bottom"
             />
             {/* Fade sur le bord gauche */}
             <div className="absolute inset-0 bg-linear-to-r from-[oklch(0.09_0.01_260)] via-transparent to-transparent pointer-events-none" />
diff --git a/apps/web/src/components/landing/integrations-section.tsx b/apps/web/src/components/landing/integrations-section.tsx
index e0d8663a..1e3b557b 100644
--- a/apps/web/src/components/landing/integrations-section.tsx
+++ b/apps/web/src/components/landing/integrations-section.tsx
@@ -2,6 +2,7 @@
 
 import { Icon } from "@iconify-icon/react";
 import { LucideArrowRight } from "lucide-react";
+import Image from "next/image";
 import { useEffect, useRef, useState } from "react";
 
 const frameworks = [
@@ -82,12 +83,14 @@ export function IntegrationsSection() {
         className={`relative left-1/2 -translate-x-1/2 w-screen -mt-16 transition-all duration-1000 delay-200 ${
           isVisible ? "opacity-100" : "opacity-0"
         }`}
+        style={{ aspectRatio: "2494 / 1199" }}
       >
-        <img
+        <Image
+          fill
           src="/assets/connection.png"
           alt=""
           aria-hidden="true"
-          className="w-full h-auto object-cover"
+          className="object-cover"
         />
       </div>
 
diff --git a/apps/web/src/components/landing/security-section.tsx b/apps/web/src/components/landing/security-section.tsx
index 0b390528..fe76d7d5 100644
--- a/apps/web/src/components/landing/security-section.tsx
+++ b/apps/web/src/components/landing/security-section.tsx
@@ -1,6 +1,7 @@
 "use client";
 
 import { Eye, FileCheck, Lock, Shield } from "lucide-react";
+import Image from "next/image";
 import { useEffect, useRef, useState } from "react";
 
 const securityFeatures = [
@@ -115,10 +116,12 @@ export function SecuritySection() {
             {/* Dynamic feature image with cross-fade — desktop only */}
             <div className="absolute inset-0 pointer-events-none items-center justify-end hidden lg:flex">
               {securityFeatures.map((feature, index) => (
-                <img
+                <Image
                   key={feature.image}
                   src={feature.image}
                   alt={feature.title}
+                  width={840}
+                  height={840}
                   className="absolute h-3/4 w-3/4 object-contain object-right transition-opacity duration-500"
                   style={{ opacity: activeFeature === index ? 0.85 : 0 }}
                 />
diff --git a/apps/web/src/components/landing/use-cases.tsx b/apps/web/src/components/landing/use-cases.tsx
index c645928c..825ed725 100644
--- a/apps/web/src/components/landing/use-cases.tsx
+++ b/apps/web/src/components/landing/use-cases.tsx
@@ -1,5 +1,6 @@
 "use client";
 
+import Image from "next/image";
 import { useEffect, useRef, useState } from "react";
 
 const useCases = [
@@ -68,19 +69,12 @@ export function UseCasesSection() {
           lg:w-[55%] lg:h-[85%]
         `}
       >
-        <img
+        <Image
+          fill
           src="/assets/tree-house-2x.png"
           alt=""
           aria-hidden="true"
-          className={`
-            w-full h-full object-cover
-            
-            /* MOBILE: centered bg */
-            object-center
-            
-            /* DESKTOP: original alignment */
-            lg:object-top-left
-          `}
+          className="object-cover object-center lg:object-top-left"
         />
 
         {/* MOBILE overlay (strong for readability) */}

From b1407b502317d19275ba6d33b9ec8fbf871d7684 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 10:14:34 +0530
Subject: [PATCH 39/43] style(web): sort imports

---
 apps/web/src/components/landing/cta-section.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/web/src/components/landing/cta-section.tsx b/apps/web/src/components/landing/cta-section.tsx
index f35cba76..ceb7f2b0 100644
--- a/apps/web/src/components/landing/cta-section.tsx
+++ b/apps/web/src/components/landing/cta-section.tsx
@@ -1,9 +1,9 @@
 "use client";
 
 import { ArrowRight } from "lucide-react";
+import Image from "next/image";
 import { useEffect, useRef, useState } from "react";
 import { Button } from "@/components/ui/button";
-import Image from "next/image";
 
 export function CtaSection() {
   const [isVisible, setIsVisible] = useState(false);

From ea3871248f72ce1421da86d1eb8fc79dc0b44952 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 10:28:05 +0530
Subject: [PATCH 40/43] Revert "rm bun.lockb"

This reverts commit 515cc48f36c3ad5bc7c05c27cdaf5bdf412bb749.
---
 apps/web/bun.lockb | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 apps/web/bun.lockb

diff --git a/apps/web/bun.lockb b/apps/web/bun.lockb
new file mode 100644
index 00000000..e69de29b

From ce42d714f279b3f1bbd784e17d2c9f2cc3bd71e7 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 11:43:29 +0530
Subject: [PATCH 41/43] ci: update macOS runner versions in release workflow to
 26

---
 .github/workflows/release.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 936be0ef..68f65a9e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -64,12 +64,12 @@ jobs:
             asset: cms-${{ github.ref_name }}-linux-arm64
           - os: macos
             arch: amd64
-            runner: macos-13
+            runner: macos-26-intel
             bin: cms
             asset: cms-${{ github.ref_name }}-macos-amd64
           - os: macos
             arch: arm64
-            runner: macos-14
+            runner: macos-26
             bin: cms
             asset: cms-${{ github.ref_name }}-macos-arm64
           - os: windows

From 26441044644ee89a6c7b249fca1ac8251223c5d9 Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 12:15:15 +0530
Subject: [PATCH 42/43] ci: optimize caching and update test command to use
 nextest

---
 .github/workflows/ci.yml | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 495e823a..a65cbbb4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -92,6 +92,11 @@ jobs:
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: apps/backend
+          # Share the dependency cache with the linux test lanes (deps are
+          # identical; clippy's final artifacts differ but the heavy 3rd-party
+          # layer is reused). Only main writes the cache.
+          shared-key: linux
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo fmt --all -- --check
       # --no-default-features drops `embed-dashboard`, whose RustEmbed derive needs
       # apps/dashboard/dist at compile time (not built in CI).
@@ -133,11 +138,11 @@ jobs:
           - db: postgres
             test_database: postgres
             test_database_url: postgres://postgres:postgres@localhost:5432/postgres
-            test_args: "-- --test-threads=4"
+            test_args: "--test-threads=4"
           - db: mysql
             test_database: mysql
             test_database_url: mysql://root:root@localhost:3306/mysql
-            test_args: "-- --test-threads=4"
+            test_args: "--test-threads=4"
     env:
       TEST_DATABASE: ${{ matrix.test_database }}
       TEST_DATABASE_URL: ${{ matrix.test_database_url }}
@@ -181,11 +186,18 @@ jobs:
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: apps/backend
-          key: linux-${{ matrix.db }}
+          # All 3 db lanes compile an identical binary (db is chosen at runtime
+          # via TEST_DATABASE), so one shared cache lets lanes 2 & 3 restore
+          # fully warm. Only main writes the cache.
+          shared-key: linux
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2
+        with:
+          tool: nextest
       # --no-default-features drops `embed-dashboard` (RustEmbed needs a built
       # apps/dashboard/dist at compile time, which CI doesn't produce).
-      - name: cargo test
-        run: cargo test --no-default-features --locked ${{ matrix.test_args }}
+      - name: cargo nextest
+        run: cargo nextest run --no-default-features --locked ${{ matrix.test_args }}
 
   # Cross-platform coverage. The binary ships on Windows/macOS/Linux, so the suite
   # must run off Linux too. Service containers don't run on these runners, so only
@@ -217,10 +229,14 @@ jobs:
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: apps/backend
-          key: ${{ matrix.os }}-sqlite
+          shared-key: ${{ matrix.os }}
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2
+        with:
+          tool: nextest
       # --no-default-features drops `embed-dashboard` (no built dashboard/dist in CI).
-      - name: cargo test
-        run: cargo test --no-default-features --locked
+      - name: cargo nextest
+        run: cargo nextest run --no-default-features --locked
 
   frontend:
     name: Frontend (dashboard)

From 8b572fa3e9ca9d81c51333c065e13e62d339826a Mon Sep 17 00:00:00 2001
From: Krishna Santosh <75202541+krishna-santosh@users.noreply.github.com>
Date: Sun, 21 Jun 2026 13:05:59 +0530
Subject: [PATCH 43/43] ci: replace nextest with cargo test for improved
 testing consistency

---
 .github/workflows/ci.yml | 26 +++++++++-----------------
 1 file changed, 9 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a65cbbb4..2f171539 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -94,9 +94,9 @@ jobs:
           workspaces: apps/backend
           # Share the dependency cache with the linux test lanes (deps are
           # identical; clippy's final artifacts differ but the heavy 3rd-party
-          # layer is reused). Only main writes the cache.
+          # layer is reused). rust-cache prunes to deps before saving, so a
+          # single shared cache serves lint + all 3 db lanes.
           shared-key: linux
-          save-if: ${{ github.ref == 'refs/heads/main' }}
       - run: cargo fmt --all -- --check
       # --no-default-features drops `embed-dashboard`, whose RustEmbed derive needs
       # apps/dashboard/dist at compile time (not built in CI).
@@ -138,11 +138,11 @@ jobs:
           - db: postgres
             test_database: postgres
             test_database_url: postgres://postgres:postgres@localhost:5432/postgres
-            test_args: "--test-threads=4"
+            test_args: "-- --test-threads=4"
           - db: mysql
             test_database: mysql
             test_database_url: mysql://root:root@localhost:3306/mysql
-            test_args: "--test-threads=4"
+            test_args: "-- --test-threads=4"
     env:
       TEST_DATABASE: ${{ matrix.test_database }}
       TEST_DATABASE_URL: ${{ matrix.test_database_url }}
@@ -188,16 +188,12 @@ jobs:
           workspaces: apps/backend
           # All 3 db lanes compile an identical binary (db is chosen at runtime
           # via TEST_DATABASE), so one shared cache lets lanes 2 & 3 restore
-          # fully warm. Only main writes the cache.
+          # fully warm. Shared with the lint job too (deps are identical).
           shared-key: linux
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-      - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2
-        with:
-          tool: nextest
       # --no-default-features drops `embed-dashboard` (RustEmbed needs a built
       # apps/dashboard/dist at compile time, which CI doesn't produce).
-      - name: cargo nextest
-        run: cargo nextest run --no-default-features --locked ${{ matrix.test_args }}
+      - name: cargo test
+        run: cargo test --no-default-features --locked ${{ matrix.test_args }}
 
   # Cross-platform coverage. The binary ships on Windows/macOS/Linux, so the suite
   # must run off Linux too. Service containers don't run on these runners, so only
@@ -230,13 +226,9 @@ jobs:
         with:
           workspaces: apps/backend
           shared-key: ${{ matrix.os }}
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-      - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2
-        with:
-          tool: nextest
       # --no-default-features drops `embed-dashboard` (no built dashboard/dist in CI).
-      - name: cargo nextest
-        run: cargo nextest run --no-default-features --locked
+      - name: cargo test
+        run: cargo test --no-default-features --locked
 
   frontend:
     name: Frontend (dashboard)