diff --git a/AGENTS.md b/AGENTS.md
index 23ffa2b..e461944 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -13,7 +13,7 @@ This repo is a **one-page static** Linktree-style site for mifi.dev. It is **not
- **Critical CSS** via post-build script (`scripts/critical-css.mjs`); full build with critical CSS is `pnpm run build:full` (run `pnpm run critical-css:install` once to install Chromium)
- **CSP-safe scripts:** Post-build `scripts/externalize-inline-script.mjs` moves SvelteKit’s inline bootstrap script to `_app/immutable/bootstrap.[hash].js` so CSP can use `script-src 'self'` without `unsafe-inline`
- **Content:** JSON in `src/lib/data/` (e.g. `links.json`), loaded in `+page.server.ts` at build time
-- **CSP:** Set by Traefik middleware; do not add CSP in app code
+- **CSP:** Set by Traefik middleware; do not add CSP in app code. Middleware must not use `require-trusted-types-for 'script'` (Svelte hydration is incompatible).
## Conventions
diff --git a/README.md b/README.md
index ef34139..97bc727 100644
--- a/README.md
+++ b/README.md
@@ -155,3 +155,5 @@ pyftsubset ~/Downloads/Fraunces/fraunces-variable-opsz-wght.ttf \
## CSP
CSP is set via Traefik middleware, not in app code.
+
+**Trusted Types:** This app is not compatible with `require-trusted-types-for 'script'`. Svelte’s runtime assigns to DOM sinks (e.g. `innerHTML`) during hydration, which that directive blocks. The Traefik middleware used for mifi.dev/mifi.bio must not include `require-trusted-types-for 'script'` (or the site will break with "This assignment requires a TrustedHTML").
diff --git a/nginx/default.conf b/nginx/default.conf
index 2dc791e..ad06437 100644
--- a/nginx/default.conf
+++ b/nginx/default.conf
@@ -16,6 +16,15 @@ server {
alias /usr/share/nginx/html/dev/.well-known/dev.com.chrome.devtools.json;
add_header Cache-Control "public, max-age=86400";
}
+ location = /robots.txt {
+ alias /usr/share/nginx/html/dev/robots-dev.txt;
+ add_header Cache-Control "public, max-age=86400";
+ }
+ location = /sitemap.xml {
+ alias /usr/share/nginx/html/dev/sitemap-dev.xml;
+ add_header Cache-Control "public, max-age=86400";
+ add_header Content-Type "application/xml; charset=utf-8";
+ }
include /etc/nginx/snippets/cache-rules.conf;
@@ -41,6 +50,15 @@ server {
alias /usr/share/nginx/html/bio/.well-known/bio.com.chrome.devtools.json;
add_header Cache-Control "public, max-age=86400";
}
+ location = /robots.txt {
+ alias /usr/share/nginx/html/bio/robots-bio.txt;
+ add_header Cache-Control "public, max-age=86400";
+ }
+ location = /sitemap.xml {
+ alias /usr/share/nginx/html/bio/sitemap-bio.xml;
+ add_header Cache-Control "public, max-age=86400";
+ add_header Content-Type "application/xml; charset=utf-8";
+ }
include /etc/nginx/snippets/cache-rules.conf;
diff --git a/src/app.html b/src/app.html
index 7b757ff..e881bbf 100644
--- a/src/app.html
+++ b/src/app.html
@@ -3,7 +3,7 @@
-
+
%sveltekit.head%
diff --git a/src/lib/components/LinkGroup.svelte b/src/lib/components/LinkGroup.svelte
index 888fc56..4b6b1da 100644
--- a/src/lib/components/LinkGroup.svelte
+++ b/src/lib/components/LinkGroup.svelte
@@ -33,7 +33,7 @@