How do you forget the script?

.dockerignore

@@ -1,18 +1,41 @@
+# Dependencies and build output (installed/generated in image)
 node_modules
 build
+
+# Git and CI
 .git
 .gitignore
-*.md
+.woodpecker
+.woodpecker.yml
+
+# Dev / IDE / tooling (not needed at build time)
 .cursor
 .devcontainer
+.vscode
+*.md
+docs
+test.txt
+
+# Lint/format config (build does not need these)
 .eslintrc.cjs
+.eslintignore
 .prettierrc
 .prettierignore
-.eslintignore
+
+# Test and E2E (Dockerfile only runs build + critical-css)
 e2e
 playwright.config.ts
 vitest.config.ts
-test.txt
+playwright-report
-docs
+coverage
-.woodpecker.yml
+.nyc_output
-.woodpecker
+
+# Env and logs
+.env
+.env.*
+*.log
+
+# Local Docker (not needed inside image)
+docker-compose.yml
+Dockerfile
+.dockerignore

.woodpecker/ci.yml

@@ -7,75 +7,194 @@ when:
     - event: manual
 
 steps:
-    install:
+    - name: install
       image: node:22-bookworm-slim
       commands:
           - corepack enable
           - corepack prepare pnpm@latest --activate
           - pnpm install --frozen-lockfile
 
-    lint:
+    - name: lint
       image: node:22-bookworm-slim
       commands:
-            - corepack enable
+          - corepack enable && corepack prepare pnpm@latest --activate
-            - corepack prepare pnpm@latest --activate
-            - pnpm install --frozen-lockfile
           - pnpm run lint
       depends_on:
           - install
 
-    check:
+    - name: Send Lint Status Notification (failure)
+      image: curlimages/curl
+      environment:
+          MATTERMOST_BOT_ACCESS_TOKEN:
+              from_secret: mattermost_bot_access_token
+          MATTERMOST_CHANNEL_ID:
+              from_secret: mattermost_tests_channel_id
+          MATTERMOST_POST_API_URL:
+              from_secret: mattermost_post_api_url
+      commands:
+          - |
+              BODY=$(printf '{"channel_id":"%s","message":"[%s - Build #%s] Lint failure 💩"}' "$MATTERMOST_CHANNEL_ID" "$CI_REPO" "$CI_PIPELINE_NUMBER")
+              curl -sS -X POST -H "Content-Type: application/json" -d "$BODY" -H "Authorization: Bearer $MATTERMOST_BOT_ACCESS_TOKEN" $MATTERMOST_POST_API_URL
+      depends_on:
+          - lint
+      when:
+          - status: [failure]
+
+    - name: check
       image: node:22-bookworm-slim
       commands:
-            - corepack enable
+          - corepack enable && corepack prepare pnpm@latest --activate
-            - corepack prepare pnpm@latest --activate
-            - pnpm install --frozen-lockfile
           - pnpm run check
       depends_on:
-            - install
+          - lint
 
-    test:
+    - name: Send Svelte Check Status Notification (failure)
+      image: curlimages/curl
+      environment:
+          MATTERMOST_BOT_ACCESS_TOKEN:
+              from_secret: mattermost_bot_access_token
+          MATTERMOST_CHANNEL_ID:
+              from_secret: mattermost_tests_channel_id
+          MATTERMOST_POST_API_URL:
+              from_secret: mattermost_post_api_url
+      commands:
+          - |
+              BODY=$(printf '{"channel_id":"%s","message":"[%s - Build #%s] Svelte Check failure 💩"}' "$MATTERMOST_CHANNEL_ID" "$CI_REPO" "$CI_PIPELINE_NUMBER")
+              curl -sS -X POST -H "Content-Type: application/json" -d "$BODY" -H "Authorization: Bearer $MATTERMOST_BOT_ACCESS_TOKEN" $MATTERMOST_POST_API_URL
+      depends_on:
+          - check
+      when:
+          - status: [failure]
+
+    - name: Unit Tests
       image: node:22-bookworm-slim
       commands:
-            - corepack enable
+          - corepack enable && corepack prepare pnpm@latest --activate
-            - corepack prepare pnpm@latest --activate
-            - pnpm install --frozen-lockfile
           - pnpm run test:run
       depends_on:
-            - install
+          - check
 
-    build:
+    - name: Send Test Status Notification (failure)
+      image: curlimages/curl
+      environment:
+          MATTERMOST_BOT_ACCESS_TOKEN:
+              from_secret: mattermost_bot_access_token
+          MATTERMOST_CHANNEL_ID:
+              from_secret: mattermost_tests_channel_id
+          MATTERMOST_POST_API_URL:
+              from_secret: mattermost_post_api_url
+      commands:
+          - |
+              BODY=$(printf '{"channel_id":"%s","message":"[%s - Build #%s] Test failure 💩"}' "$MATTERMOST_CHANNEL_ID" "$CI_REPO" "$CI_PIPELINE_NUMBER")
+              curl -sS -X POST -H "Content-Type: application/json" -d "$BODY" -H "Authorization: Bearer $MATTERMOST_BOT_ACCESS_TOKEN" $MATTERMOST_POST_API_URL
+      depends_on:
+          - Unit Tests
+      when:
+          - status: [failure]
+
+    - name: build
       image: node:22-bookworm-slim
       commands:
-            - corepack enable
+          - corepack enable && corepack prepare pnpm@latest --activate
-            - corepack prepare pnpm@latest --activate
-            - pnpm install --frozen-lockfile
           - pnpm run build
       depends_on:
-            - install
+          - Unit Tests
 
-    build-full:
+    - name: Send Build Status Notification (failure)
+      image: curlimages/curl
+      environment:
+          MATTERMOST_BOT_ACCESS_TOKEN:
+              from_secret: mattermost_bot_access_token
+          MATTERMOST_CHANNEL_ID:
+              from_secret: mattermost_tests_channel_id
+          MATTERMOST_POST_API_URL:
+              from_secret: mattermost_post_api_url
+      commands:
+          - |
+              BODY=$(printf '{"channel_id":"%s","message":"[%s - Build #%s] Build failure 💩"}' "$MATTERMOST_CHANNEL_ID" "$CI_REPO" "$CI_PIPELINE_NUMBER")
+              curl -sS -X POST -H "Content-Type: application/json" -d "$BODY" -H "Authorization: Bearer $MATTERMOST_BOT_ACCESS_TOKEN" $MATTERMOST_POST_API_URL
+      depends_on:
+          - build
+      when:
+          - status: [failure]
+
+    - name: build-full
       image: node:22-bookworm-slim
       commands:
           - apt-get update
           - apt-get install -y --no-install-recommends ca-certificates libasound2 libatk-bridge2.0-0 libatk1.0-0 libcups2 libdrm2 libgbm1 libgtk-3-0 libnss3 libxcomposite1 libxdamage1 libxfixes3 libxkbcommon0 libxrandr2
           - rm -rf /var/lib/apt/lists/*
-            - corepack enable
+          - corepack enable && corepack prepare pnpm@latest --activate
-            - corepack prepare pnpm@latest --activate
-            - pnpm install --frozen-lockfile
           - pnpm run critical-css:install
           - pnpm run build:full
       depends_on:
-            - install
+          - build
 
-    e2e:
+    - name: Send Build Full Status Notification (failure)
+      image: curlimages/curl
+      environment:
+          MATTERMOST_BOT_ACCESS_TOKEN:
+              from_secret: mattermost_bot_access_token
+          MATTERMOST_CHANNEL_ID:
+              from_secret: mattermost_tests_channel_id
+          MATTERMOST_POST_API_URL:
+              from_secret: mattermost_post_api_url
+      commands:
+          - |
+              BODY=$(printf '{"channel_id":"%s","message":"[%s - Build #%s] Build Full failure 💩"}' "$MATTERMOST_CHANNEL_ID" "$CI_REPO" "$CI_PIPELINE_NUMBER")
+              curl -sS -X POST -H "Content-Type: application/json" -d "$BODY" -H "Authorization: Bearer $MATTERMOST_BOT_ACCESS_TOKEN" $MATTERMOST_POST_API_URL
+      depends_on:
+          - build-full
+      when:
+          - status: [failure]
+
+    - name: E2E Tests
       image: node:22-bookworm-slim
       commands:
-            - corepack enable
+          - corepack enable && corepack prepare pnpm@latest --activate
-            - corepack prepare pnpm@latest --activate
-            - pnpm install --frozen-lockfile
-            - pnpm run build
           - pnpm exec playwright install chromium --with-deps
           - pnpm run test:e2e
       depends_on:
           - build
+
+    - name: Send E2E Status Notification (failure)
+      image: curlimages/curl
+      environment:
+          MATTERMOST_BOT_ACCESS_TOKEN:
+              from_secret: mattermost_bot_access_token
+          MATTERMOST_CHANNEL_ID:
+              from_secret: mattermost_tests_channel_id
+          MATTERMOST_POST_API_URL:
+              from_secret: mattermost_post_api_url
+      commands:
+          - |
+              BODY=$(printf '{"channel_id":"%s","message":"[%s - Build #%s] E2E failure 💩"}' "$MATTERMOST_CHANNEL_ID" "$CI_REPO" "$CI_PIPELINE_NUMBER")
+              curl -sS -X POST -H "Content-Type: application/json" -d "$BODY" -H "Authorization: Bearer $MATTERMOST_BOT_ACCESS_TOKEN" $MATTERMOST_POST_API_URL
+      depends_on:
+          - E2E Tests
+      when:
+          - status: [failure]
+
+    - name: Send CI Pipeline Status Notification (success)
+      image: curlimages/curl
+      environment:
+          MATTERMOST_BOT_ACCESS_TOKEN:
+              from_secret: mattermost_bot_access_token
+          MATTERMOST_CHANNEL_ID:
+              from_secret: mattermost_tests_channel_id
+          MATTERMOST_POST_API_URL:
+              from_secret: mattermost_post_api_url
+      commands:
+          - |
+              BODY=$(printf '{"channel_id":"%s","message":"[%s - Build #%s] CI pipeline success 🎉"}' "$MATTERMOST_CHANNEL_ID" "$CI_REPO" "$CI_PIPELINE_NUMBER")
+              curl -sS -X POST -H "Content-Type: application/json" -d "$BODY" -H "Authorization: Bearer $MATTERMOST_BOT_ACCESS_TOKEN" $MATTERMOST_POST_API_URL
+      depends_on:
+          - install
+          - lint
+          - check
+          - Unit Tests
+          - build
+          - build-full
+          - E2E Tests
+      when:
+          - status: [success]

.woodpecker/deploy.yml

@@ -1,8 +1,10 @@
 # Deploy: build image, push to registry, trigger Portainer stack redeploy.
 # Runs on push/tag/manual to main only, after ci workflow succeeds.
 when:
-    branch: main
+    - branch: main
       event: [push, tag, manual]
+    - event: deployment
+      evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "production"'
 
 depends_on:
     - ci
@@ -12,25 +14,77 @@ steps:
       image: docker:latest
       environment:
           REGISTRY_REPO: git.mifi.dev/mifi-holdings/mifi-links
+          DOCKER_API_VERSION: '1.43'
+          DOCKER_BUILDKIT: '1'
       volumes:
           - /var/run/docker.sock:/var/run/docker.sock
       commands:
           - set -e
-          - echo "=== Building Docker image ==="
+          - echo "=== Building Docker image (BuildKit) ==="
           - 'echo "Commit SHA: ${CI_COMMIT_SHA:0:8}"'
           - 'echo "Registry repo: $REGISTRY_REPO"'
           - |
+              build() {
                 docker build \
+                  --progress=plain \
                   --tag $REGISTRY_REPO:${CI_COMMIT_SHA} \
                   --tag $REGISTRY_REPO:latest \
                   --label "git.commit=${CI_COMMIT_SHA}" \
                   --label "git.branch=${CI_COMMIT_BRANCH}" \
                   .
-          - echo "✓ Docker image built successfully"
+              }
+              for attempt in 1 2 3; do
+                echo "Build attempt $attempt/3"
+                if build; then
+                  echo "✓ Docker image built successfully"
+                  exit 0
+                fi
+                echo "Build attempt $attempt failed, retrying in 30s..."
+                sleep 30
+              done
+              echo "All build attempts failed"
+              exit 1
+
+    - name: Send Docker Image Build Status Notification (success)
+      image: curlimages/curl
+      environment:
+          MATTERMOST_BOT_ACCESS_TOKEN:
+              from_secret: mattermost_bot_access_token
+          MATTERMOST_CHANNEL_ID:
+              from_secret: mattermost_pushes_channel_id
+          MATTERMOST_POST_API_URL:
+              from_secret: mattermost_post_api_url
+      commands:
+          - |
+              BODY=$(printf '{"channel_id":"%s","message":"[%s - Build #%s] Docker image build success 🎉"}' "$MATTERMOST_CHANNEL_ID" "$CI_REPO" "$CI_PIPELINE_NUMBER")
+              curl -sS -X POST -H "Content-Type: application/json" -d "$BODY" -H "Authorization: Bearer $MATTERMOST_BOT_ACCESS_TOKEN" $MATTERMOST_POST_API_URL
+      depends_on:
+          - Docker image build
+      when:
+          - status: [success]
+
+    - name: Send Docker Image Build Status Notification (failure)
+      image: curlimages/curl
+      environment:
+          MATTERMOST_BOT_ACCESS_TOKEN:
+              from_secret: mattermost_bot_access_token
+          MATTERMOST_CHANNEL_ID:
+              from_secret: mattermost_pushes_channel_id
+          MATTERMOST_POST_API_URL:
+              from_secret: mattermost_post_api_url
+      commands:
+          - |
+              BODY=$(printf '{"channel_id":"%s","message":"[%s - Build #%s] Docker image build failure 💩"}' "$MATTERMOST_CHANNEL_ID" "$CI_REPO" "$CI_PIPELINE_NUMBER")
+              curl -sS -X POST -H "Content-Type: application/json" -d "$BODY" -H "Authorization: Bearer $MATTERMOST_BOT_ACCESS_TOKEN" $MATTERMOST_POST_API_URL
+      depends_on:
+          - Docker image build
+      when:
+          - status: [failure]
 
     - name: Push to registry
       image: docker:latest
       environment:
+          DOCKER_API_VERSION: '1.43'
           REGISTRY_URL: git.mifi.dev
           REGISTRY_REPO: git.mifi.dev/mifi-holdings/mifi-links
           REGISTRY_USERNAME:
@@ -54,6 +108,42 @@ steps:
       depends_on:
           - Docker image build
 
+    - name: Send Push to Registry Status Notification (success)
+      image: curlimages/curl
+      environment:
+          MATTERMOST_BOT_ACCESS_TOKEN:
+              from_secret: mattermost_bot_access_token
+          MATTERMOST_CHANNEL_ID:
+              from_secret: mattermost_pushes_channel_id
+          MATTERMOST_POST_API_URL:
+              from_secret: mattermost_post_api_url
+      commands:
+          - |
+              BODY=$(printf '{"channel_id":"%s","message":"[%s - Build #%s] Push to registry success 🎉"}' "$MATTERMOST_CHANNEL_ID" "$CI_REPO" "$CI_PIPELINE_NUMBER")
+              curl -sS -X POST -H "Content-Type: application/json" -d "$BODY" -H "Authorization: Bearer $MATTERMOST_BOT_ACCESS_TOKEN" $MATTERMOST_POST_API_URL
+      depends_on:
+          - Push to registry
+      when:
+          - status: [success]
+
+    - name: Send Push to Registry Status Notification (failure)
+      image: curlimages/curl
+      environment:
+          MATTERMOST_BOT_ACCESS_TOKEN:
+              from_secret: mattermost_bot_access_token
+          MATTERMOST_CHANNEL_ID:
+              from_secret: mattermost_pushes_channel_id
+          MATTERMOST_POST_API_URL:
+              from_secret: mattermost_post_api_url
+      commands:
+          - |
+              BODY=$(printf '{"channel_id":"%s","message":"[%s - Build #%s] Push to registry failure 💩"}' "$MATTERMOST_CHANNEL_ID" "$CI_REPO" "$CI_PIPELINE_NUMBER")
+              curl -sS -X POST -H "Content-Type: application/json" -d "$BODY" -H "Authorization: Bearer $MATTERMOST_BOT_ACCESS_TOKEN" $MATTERMOST_POST_API_URL
+      depends_on:
+          - Push to registry
+      when:
+          - status: [failure]
+
     - name: Trigger Portainer stack redeploy
       image: curlimages/curl:latest
       environment:
@@ -73,3 +163,39 @@ steps:
               echo "✓ Portainer redeploy triggered (HTTP $code)"
       depends_on:
           - Push to registry
+
+    - name: Send Deploy Status Notification (success)
+      image: curlimages/curl
+      environment:
+          MATTERMOST_BOT_ACCESS_TOKEN:
+              from_secret: mattermost_bot_access_token
+          MATTERMOST_CHANNEL_ID:
+              from_secret: mattermost_pushes_channel_id
+          MATTERMOST_POST_API_URL:
+              from_secret: mattermost_post_api_url
+      commands:
+          - |
+              BODY=$(printf '{"channel_id":"%s","message":"[%s - Build #%s] Production Deploy success 🎉"}' "$MATTERMOST_CHANNEL_ID" "$CI_REPO" "$CI_PIPELINE_NUMBER")
+              curl -sS -X POST -H "Content-Type: application/json" -d "$BODY" -H "Authorization: Bearer $MATTERMOST_BOT_ACCESS_TOKEN" $MATTERMOST_POST_API_URL
+      depends_on:
+          - Trigger Portainer stack redeploy
+      when:
+          - status: [success]
+
+    - name: Send Deploy Status Notification (failure)
+      image: curlimages/curl
+      environment:
+          MATTERMOST_BOT_ACCESS_TOKEN:
+              from_secret: mattermost_bot_access_token
+          MATTERMOST_CHANNEL_ID:
+              from_secret: mattermost_pushes_channel_id
+          MATTERMOST_POST_API_URL:
+              from_secret: mattermost_post_api_url
+      commands:
+          - |
+              BODY=$(printf '{"channel_id":"%s","message":"[%s - Build #%s] Production Deploy failure 💩"}' "$MATTERMOST_CHANNEL_ID" "$CI_REPO" "$CI_PIPELINE_NUMBER")
+              curl -sS -X POST -H "Content-Type: application/json" -d "$BODY" -H "Authorization: Bearer $MATTERMOST_BOT_ACCESS_TOKEN" $MATTERMOST_POST_API_URL
+      depends_on:
+          - Trigger Portainer stack redeploy
+      when:
+          - status: [failure]

AGENTS.md

@@ -13,7 +13,7 @@ This repo is a **one-page static** Linktree-style site for mifi.dev. It is **not
 - **Critical CSS** via post-build script (`scripts/critical-css.mjs`); full build with critical CSS is `pnpm run build:full` (run `pnpm run critical-css:install` once to install Chromium)
 - **CSP-safe scripts:** Post-build `scripts/externalize-inline-script.mjs` moves SvelteKit’s inline bootstrap script to `_app/immutable/bootstrap.[hash].js` so CSP can use `script-src 'self'` without `unsafe-inline`
 - **Content:** JSON in `src/lib/data/` (e.g. `links.json`), loaded in `+page.server.ts` at build time
-- **CSP:** Set by Traefik middleware; do not add CSP in app code
+- **CSP:** Set by Traefik middleware; do not add CSP in app code. Middleware must not use `require-trusted-types-for 'script'` (Svelte hydration is incompatible).
 
 ## Conventions
 

Dockerfile

@@ -33,6 +33,9 @@ RUN pnpm run critical-css:install
 
 COPY . .
 
+# Create output dirs and generate .svelte-kit so tsconfig.json extends resolves (avoids esbuild warning).
+RUN mkdir -p /out && pnpm exec svelte-kit sync
+
 # Build dev variant with critical CSS, move output, then build bio variant with critical CSS.
 RUN set -e && \
     CONTENT_VARIANT=dev pnpm run build && pnpm run critical-css && \
@@ -45,6 +48,7 @@ FROM nginx:alpine
 
 COPY --from=builder /out/dev /usr/share/nginx/html/dev
 COPY --from=builder /out/bio /usr/share/nginx/html/bio
+COPY nginx.conf /etc/nginx/nginx.conf
 COPY nginx/default.conf /etc/nginx/conf.d/default.conf
 COPY nginx/snippets/ /etc/nginx/snippets/
 

README.md

@@ -155,3 +155,5 @@ pyftsubset ~/Downloads/Fraunces/fraunces-variable-opsz-wght.ttf \
 ## CSP
 
 CSP is set via Traefik middleware, not in app code.
+
+**Trusted Types:** This app is not compatible with `require-trusted-types-for 'script'`. Svelte’s runtime assigns to DOM sinks (e.g. `innerHTML`) during hydration, which that directive blocks. The Traefik middleware used for mifi.dev/mifi.bio must not include `require-trusted-types-for 'script'` (or the site will break with "This assignment requires a TrustedHTML").

docker-compose.yml

@@ -13,18 +13,22 @@ services:
         labels:
             - 'traefik.enable=true'
             - 'traefik.docker.network=marina-net'
+            # Dev (mifi.dev)
             - 'traefik.http.routers.mifi-dev.rule=Host(`mifi.dev`) || Host(`www.mifi.dev`)'
             - 'traefik.http.routers.mifi-dev.entrypoints=websecure'
-            - 'traefik.http.services.mifi-dev.loadbalancer.server.port=80'
+            - 'traefik.http.routers.mifi-dev.service=mifi-dev'
-            - 'traefik.http.routers.mifi-dev.middlewares=security-supermax-with-analytics@file,redirect-www-to-non-www@file'
+            - 'traefik.http.routers.mifi-dev.middlewares=gzip@file,security-supermax-with-analytics@file,redirect-www-to-non-www@file'
             - 'traefik.http.routers.mifi-dev.tls=true'
             - 'traefik.http.routers.mifi-dev.tls.certresolver=letsencrypt'
+            - 'traefik.http.services.mifi-dev.loadbalancer.server.port=80'
+            # Bio (mifi.bio)
             - 'traefik.http.routers.mifi-bio.rule=Host(`mifi.bio`) || Host(`www.mifi.bio`)'
             - 'traefik.http.routers.mifi-bio.entrypoints=websecure'
-            - 'traefik.http.services.mifi-bio.loadbalancer.server.port=80'
+            - 'traefik.http.routers.mifi-bio.service=mifi-bio'
-            - 'traefik.http.routers.mifi-bio.middlewares=security-supermax-with-analytics@file,redirect-www-to-non-www@file'
+            - 'traefik.http.routers.mifi-bio.middlewares=gzip@file,security-supermax-with-analytics@file,redirect-www-to-non-www@file'
             - 'traefik.http.routers.mifi-bio.tls=true'
             - 'traefik.http.routers.mifi-bio.tls.certresolver=letsencrypt'
+            - 'traefik.http.services.mifi-bio.loadbalancer.server.port=80'
         networks:
             - marina-net
 

nginx.conf

@@ -0,0 +1,51 @@
+# Minimal nginx configuration for static site delivery
+# Security headers are handled upstream by Traefik
+
+user nginx;
+worker_processes auto;
+error_log /var/log/nginx/error.log warn;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    # Logging
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+    access_log /var/log/nginx/access.log main;
+
+    # Performance optimizations
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+    server_tokens off;
+
+    # Gzip compression for text-based assets
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_min_length 256;
+    # text/html is always gzipped by default; listing it again causes "duplicate MIME type" warning
+    gzip_types
+        text/plain
+        text/css
+        text/xml
+        text/javascript
+        application/json
+        application/javascript
+        application/xml+rss
+        application/rss+xml
+        application/atom+xml
+        image/svg+xml;
+
+    include /etc/nginx/conf.d/*.conf;
+}

nginx/default.conf

@@ -7,15 +7,24 @@ server {
     root /usr/share/nginx/html/dev;
     index index.html;
 
-    # Map canonical .well-known paths to variant-specific files
+    # Map canonical .well-known paths to variant-specific files (alias cannot use variables)
     location = /.well-known/security.txt {
-        alias $document_root/.well-known/dev.security.txt;
+        alias /usr/share/nginx/html/dev/.well-known/dev.security.txt;
         add_header Cache-Control "public, max-age=86400";
     }
     location = /.well-known/appspecific/com.chrome.devtools.json {
-        alias $document_root/.well-known/dev.com.chrome.devtools.json;
+        alias /usr/share/nginx/html/dev/.well-known/dev.com.chrome.devtools.json;
         add_header Cache-Control "public, max-age=86400";
     }
+    location = /robots.txt {
+        alias /usr/share/nginx/html/dev/robots-dev.txt;
+        add_header Cache-Control "public, max-age=86400";
+    }
+    location = /sitemap.xml {
+        alias /usr/share/nginx/html/dev/sitemap-dev.xml;
+        add_header Cache-Control "public, max-age=86400";
+        add_header Content-Type "application/xml; charset=utf-8";
+    }
 
     include /etc/nginx/snippets/cache-rules.conf;
 
@@ -32,15 +41,24 @@ server {
     root /usr/share/nginx/html/bio;
     index index.html;
 
-    # Map canonical .well-known paths to variant-specific files
+    # Map canonical .well-known paths to variant-specific files (alias cannot use variables)
     location = /.well-known/security.txt {
-        alias $document_root/.well-known/bio.security.txt;
+        alias /usr/share/nginx/html/bio/.well-known/bio.security.txt;
         add_header Cache-Control "public, max-age=86400";
     }
     location = /.well-known/appspecific/com.chrome.devtools.json {
-        alias $document_root/.well-known/bio.com.chrome.devtools.json;
+        alias /usr/share/nginx/html/bio/.well-known/bio.com.chrome.devtools.json;
         add_header Cache-Control "public, max-age=86400";
     }
+    location = /robots.txt {
+        alias /usr/share/nginx/html/bio/robots-bio.txt;
+        add_header Cache-Control "public, max-age=86400";
+    }
+    location = /sitemap.xml {
+        alias /usr/share/nginx/html/bio/sitemap-bio.xml;
+        add_header Cache-Control "public, max-age=86400";
+        add_header Content-Type "application/xml; charset=utf-8";
+    }
 
     include /etc/nginx/snippets/cache-rules.conf;
 

nginx/snippets/cache-rules.conf

@@ -38,11 +38,7 @@ location ~* \.(pdf|doc|docx)$ {
     access_log off;
 }
 
-# robots.txt: short cache (1 day)
+# robots.txt and sitemap.xml: handled in default.conf with alias (variant-specific)
-location = /robots.txt {
-    add_header Cache-Control "public, max-age=86400";
-    access_log off;
-}
 
 # favicon: long cache (30 days)
 location = /favicon.svg {

package.json

@@ -5,12 +5,12 @@
     "scripts": {
         "dev:bio": "CONTENT_VARIANT=bio vite dev",
         "dev:dev": "CONTENT_VARIANT=dev vite dev",
-        "build": "vite build && node scripts/externalize-inline-script.mjs",
+        "build": "vite build && node scripts/minify-static-assets.mjs && node scripts/externalize-inline-script.mjs",
-        "build:bio": "CONTENT_VARIANT=bio vite build && node scripts/externalize-inline-script.mjs",
+        "build:bio": "CONTENT_VARIANT=bio vite build && node scripts/minify-static-assets.mjs && node scripts/externalize-inline-script.mjs",
-        "build:dev": "CONTENT_VARIANT=dev vite build && node scripts/externalize-inline-script.mjs",
+        "build:dev": "CONTENT_VARIANT=dev vite build && node scripts/minify-static-assets.mjs && node scripts/externalize-inline-script.mjs",
-        "build:full": "vite build && pnpm run critical-css && node scripts/externalize-inline-script.mjs",
+        "build:full": "vite build && node scripts/minify-static-assets.mjs && node scripts/externalize-inline-script.mjs && pnpm run critical-css",
-        "build:full:bio": "CONTENT_VARIANT=bio vite build && pnpm run critical-css && node scripts/externalize-inline-script.mjs",
+        "build:full:bio": "CONTENT_VARIANT=bio vite build && node scripts/minify-static-assets.mjs && node scripts/externalize-inline-script.mjs && pnpm run critical-css",
-        "build:full:dev": "CONTENT_VARIANT=dev vite build && pnpm run critical-css && node scripts/externalize-inline-script.mjs",
+        "build:full:dev": "CONTENT_VARIANT=dev vite build && node scripts/minify-static-assets.mjs && node scripts/externalize-inline-script.mjs && pnpm run critical-css",
         "preview": "vite preview",
         "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
         "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
@@ -22,6 +22,7 @@
         "test:run": "vitest run",
         "test:coverage": "vitest run --coverage",
         "test:e2e": "playwright test",
+        "test:e2e:report": "playwright show-report --port 9324",
         "test:e2e:ui": "playwright test --ui",
         "test:e2e:snapshots:dev": "CONTENT_VARIANT=dev pnpm run build && CONTENT_VARIANT=dev pnpm exec playwright test --update-snapshots",
         "test:e2e:snapshots:bio": "CONTENT_VARIANT=bio pnpm run build && CONTENT_VARIANT=bio pnpm exec playwright test --update-snapshots",
@@ -39,6 +40,7 @@
         "@typescript-eslint/parser": "^8.16.0",
         "@vitest/coverage-v8": "^2.1.0",
         "critical": "^7.0.0",
+        "esbuild": "^0.27.3",
         "eslint": "^8.57.0",
         "eslint-config-prettier": "^9.1.0",
         "eslint-plugin-svelte": "^2.36.0",
@@ -63,7 +65,7 @@
     "dependencies": {
         "@lucide/svelte": "^0.563.1"
     },
-    "packageManager": "pnpm@10.28.2",
+    "packageManager": "pnpm@10.29.1+sha512.48dae233635a645768a3028d19545cacc1688639eeb1f3734e42d6d6b971afbf22aa1ac9af52a173d9c3a20c15857cfa400f19994d79a2f626fcc73fccda9bbc",
     "repository": {
         "type": "git",
         "url": "https://git.mifi.dev/mifi-holdings/mifi-links.git"

playwright.config.ts

@@ -22,5 +22,6 @@ export default defineConfig({
         command: 'pnpm run preview',
         url: 'http://localhost:4173',
         reuseExistingServer: !process.env.CI,
+        timeout: 120_000,
     },
 });

pnpm-lock.yaml

@@ -38,6 +38,9 @@ importers:
             critical:
                 specifier: ^7.0.0
                 version: 7.2.1
+            esbuild:
+                specifier: ^0.27.3
+                version: 0.27.3
             eslint:
                 specifier: ^8.57.0
                 version: 8.57.1
@@ -721,6 +724,15 @@ packages:
         cpu: [ppc64]
         os: [aix]
 
+    '@esbuild/aix-ppc64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==,
+            }
+        engines: { node: '>=18' }
+        cpu: [ppc64]
+        os: [aix]
+
     '@esbuild/android-arm64@0.21.5':
         resolution:
             {
@@ -739,6 +751,15 @@ packages:
         cpu: [arm64]
         os: [android]
 
+    '@esbuild/android-arm64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==,
+            }
+        engines: { node: '>=18' }
+        cpu: [arm64]
+        os: [android]
+
     '@esbuild/android-arm@0.21.5':
         resolution:
             {
@@ -757,6 +778,15 @@ packages:
         cpu: [arm]
         os: [android]
 
+    '@esbuild/android-arm@0.27.3':
+        resolution:
+            {
+                integrity: sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==,
+            }
+        engines: { node: '>=18' }
+        cpu: [arm]
+        os: [android]
+
     '@esbuild/android-x64@0.21.5':
         resolution:
             {
@@ -775,6 +805,15 @@ packages:
         cpu: [x64]
         os: [android]
 
+    '@esbuild/android-x64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==,
+            }
+        engines: { node: '>=18' }
+        cpu: [x64]
+        os: [android]
+
     '@esbuild/darwin-arm64@0.21.5':
         resolution:
             {
@@ -793,6 +832,15 @@ packages:
         cpu: [arm64]
         os: [darwin]
 
+    '@esbuild/darwin-arm64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==,
+            }
+        engines: { node: '>=18' }
+        cpu: [arm64]
+        os: [darwin]
+
     '@esbuild/darwin-x64@0.21.5':
         resolution:
             {
@@ -811,6 +859,15 @@ packages:
         cpu: [x64]
         os: [darwin]
 
+    '@esbuild/darwin-x64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==,
+            }
+        engines: { node: '>=18' }
+        cpu: [x64]
+        os: [darwin]
+
     '@esbuild/freebsd-arm64@0.21.5':
         resolution:
             {
@@ -829,6 +886,15 @@ packages:
         cpu: [arm64]
         os: [freebsd]
 
+    '@esbuild/freebsd-arm64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==,
+            }
+        engines: { node: '>=18' }
+        cpu: [arm64]
+        os: [freebsd]
+
     '@esbuild/freebsd-x64@0.21.5':
         resolution:
             {
@@ -847,6 +913,15 @@ packages:
         cpu: [x64]
         os: [freebsd]
 
+    '@esbuild/freebsd-x64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==,
+            }
+        engines: { node: '>=18' }
+        cpu: [x64]
+        os: [freebsd]
+
     '@esbuild/linux-arm64@0.21.5':
         resolution:
             {
@@ -865,6 +940,15 @@ packages:
         cpu: [arm64]
         os: [linux]
 
+    '@esbuild/linux-arm64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==,
+            }
+        engines: { node: '>=18' }
+        cpu: [arm64]
+        os: [linux]
+
     '@esbuild/linux-arm@0.21.5':
         resolution:
             {
@@ -883,6 +967,15 @@ packages:
         cpu: [arm]
         os: [linux]
 
+    '@esbuild/linux-arm@0.27.3':
+        resolution:
+            {
+                integrity: sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==,
+            }
+        engines: { node: '>=18' }
+        cpu: [arm]
+        os: [linux]
+
     '@esbuild/linux-ia32@0.21.5':
         resolution:
             {
@@ -901,6 +994,15 @@ packages:
         cpu: [ia32]
         os: [linux]
 
+    '@esbuild/linux-ia32@0.27.3':
+        resolution:
+            {
+                integrity: sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==,
+            }
+        engines: { node: '>=18' }
+        cpu: [ia32]
+        os: [linux]
+
     '@esbuild/linux-loong64@0.21.5':
         resolution:
             {
@@ -919,6 +1021,15 @@ packages:
         cpu: [loong64]
         os: [linux]
 
+    '@esbuild/linux-loong64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==,
+            }
+        engines: { node: '>=18' }
+        cpu: [loong64]
+        os: [linux]
+
     '@esbuild/linux-mips64el@0.21.5':
         resolution:
             {
@@ -937,6 +1048,15 @@ packages:
         cpu: [mips64el]
         os: [linux]
 
+    '@esbuild/linux-mips64el@0.27.3':
+        resolution:
+            {
+                integrity: sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==,
+            }
+        engines: { node: '>=18' }
+        cpu: [mips64el]
+        os: [linux]
+
     '@esbuild/linux-ppc64@0.21.5':
         resolution:
             {
@@ -955,6 +1075,15 @@ packages:
         cpu: [ppc64]
         os: [linux]
 
+    '@esbuild/linux-ppc64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==,
+            }
+        engines: { node: '>=18' }
+        cpu: [ppc64]
+        os: [linux]
+
     '@esbuild/linux-riscv64@0.21.5':
         resolution:
             {
@@ -973,6 +1102,15 @@ packages:
         cpu: [riscv64]
         os: [linux]
 
+    '@esbuild/linux-riscv64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==,
+            }
+        engines: { node: '>=18' }
+        cpu: [riscv64]
+        os: [linux]
+
     '@esbuild/linux-s390x@0.21.5':
         resolution:
             {
@@ -991,6 +1129,15 @@ packages:
         cpu: [s390x]
         os: [linux]
 
+    '@esbuild/linux-s390x@0.27.3':
+        resolution:
+            {
+                integrity: sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==,
+            }
+        engines: { node: '>=18' }
+        cpu: [s390x]
+        os: [linux]
+
     '@esbuild/linux-x64@0.21.5':
         resolution:
             {
@@ -1009,6 +1156,15 @@ packages:
         cpu: [x64]
         os: [linux]
 
+    '@esbuild/linux-x64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==,
+            }
+        engines: { node: '>=18' }
+        cpu: [x64]
+        os: [linux]
+
     '@esbuild/netbsd-arm64@0.25.12':
         resolution:
             {
@@ -1018,6 +1174,15 @@ packages:
         cpu: [arm64]
         os: [netbsd]
 
+    '@esbuild/netbsd-arm64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==,
+            }
+        engines: { node: '>=18' }
+        cpu: [arm64]
+        os: [netbsd]
+
     '@esbuild/netbsd-x64@0.21.5':
         resolution:
             {
@@ -1036,6 +1201,15 @@ packages:
         cpu: [x64]
         os: [netbsd]
 
+    '@esbuild/netbsd-x64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==,
+            }
+        engines: { node: '>=18' }
+        cpu: [x64]
+        os: [netbsd]
+
     '@esbuild/openbsd-arm64@0.25.12':
         resolution:
             {
@@ -1045,6 +1219,15 @@ packages:
         cpu: [arm64]
         os: [openbsd]
 
+    '@esbuild/openbsd-arm64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==,
+            }
+        engines: { node: '>=18' }
+        cpu: [arm64]
+        os: [openbsd]
+
     '@esbuild/openbsd-x64@0.21.5':
         resolution:
             {
@@ -1063,6 +1246,15 @@ packages:
         cpu: [x64]
         os: [openbsd]
 
+    '@esbuild/openbsd-x64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==,
+            }
+        engines: { node: '>=18' }
+        cpu: [x64]
+        os: [openbsd]
+
     '@esbuild/openharmony-arm64@0.25.12':
         resolution:
             {
@@ -1072,6 +1264,15 @@ packages:
         cpu: [arm64]
         os: [openharmony]
 
+    '@esbuild/openharmony-arm64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==,
+            }
+        engines: { node: '>=18' }
+        cpu: [arm64]
+        os: [openharmony]
+
     '@esbuild/sunos-x64@0.21.5':
         resolution:
             {
@@ -1090,6 +1291,15 @@ packages:
         cpu: [x64]
         os: [sunos]
 
+    '@esbuild/sunos-x64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==,
+            }
+        engines: { node: '>=18' }
+        cpu: [x64]
+        os: [sunos]
+
     '@esbuild/win32-arm64@0.21.5':
         resolution:
             {
@@ -1108,6 +1318,15 @@ packages:
         cpu: [arm64]
         os: [win32]
 
+    '@esbuild/win32-arm64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==,
+            }
+        engines: { node: '>=18' }
+        cpu: [arm64]
+        os: [win32]
+
     '@esbuild/win32-ia32@0.21.5':
         resolution:
             {
@@ -1126,6 +1345,15 @@ packages:
         cpu: [ia32]
         os: [win32]
 
+    '@esbuild/win32-ia32@0.27.3':
+        resolution:
+            {
+                integrity: sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==,
+            }
+        engines: { node: '>=18' }
+        cpu: [ia32]
+        os: [win32]
+
     '@esbuild/win32-x64@0.21.5':
         resolution:
             {
@@ -1144,6 +1372,15 @@ packages:
         cpu: [x64]
         os: [win32]
 
+    '@esbuild/win32-x64@0.27.3':
+        resolution:
+            {
+                integrity: sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==,
+            }
+        engines: { node: '>=18' }
+        cpu: [x64]
+        os: [win32]
+
     '@eslint-community/eslint-utils@4.9.1':
         resolution:
             {
@@ -2885,6 +3122,14 @@ packages:
         engines: { node: '>=18' }
         hasBin: true
 
+    esbuild@0.27.3:
+        resolution:
+            {
+                integrity: sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==,
+            }
+        engines: { node: '>=18' }
+        hasBin: true
+
     escalade@3.2.0:
         resolution:
             {
@@ -6678,147 +6923,225 @@ snapshots:
     '@esbuild/aix-ppc64@0.25.12':
         optional: true
 
+    '@esbuild/aix-ppc64@0.27.3':
+        optional: true
+
     '@esbuild/android-arm64@0.21.5':
         optional: true
 
     '@esbuild/android-arm64@0.25.12':
         optional: true
 
+    '@esbuild/android-arm64@0.27.3':
+        optional: true
+
     '@esbuild/android-arm@0.21.5':
         optional: true
 
     '@esbuild/android-arm@0.25.12':
         optional: true
 
+    '@esbuild/android-arm@0.27.3':
+        optional: true
+
     '@esbuild/android-x64@0.21.5':
         optional: true
 
     '@esbuild/android-x64@0.25.12':
         optional: true
 
+    '@esbuild/android-x64@0.27.3':
+        optional: true
+
     '@esbuild/darwin-arm64@0.21.5':
         optional: true
 
     '@esbuild/darwin-arm64@0.25.12':
         optional: true
 
+    '@esbuild/darwin-arm64@0.27.3':
+        optional: true
+
     '@esbuild/darwin-x64@0.21.5':
         optional: true
 
     '@esbuild/darwin-x64@0.25.12':
         optional: true
 
+    '@esbuild/darwin-x64@0.27.3':
+        optional: true
+
     '@esbuild/freebsd-arm64@0.21.5':
         optional: true
 
     '@esbuild/freebsd-arm64@0.25.12':
         optional: true
 
+    '@esbuild/freebsd-arm64@0.27.3':
+        optional: true
+
     '@esbuild/freebsd-x64@0.21.5':
         optional: true
 
     '@esbuild/freebsd-x64@0.25.12':
         optional: true
 
+    '@esbuild/freebsd-x64@0.27.3':
+        optional: true
+
     '@esbuild/linux-arm64@0.21.5':
         optional: true
 
     '@esbuild/linux-arm64@0.25.12':
         optional: true
 
+    '@esbuild/linux-arm64@0.27.3':
+        optional: true
+
     '@esbuild/linux-arm@0.21.5':
         optional: true
 
     '@esbuild/linux-arm@0.25.12':
         optional: true
 
+    '@esbuild/linux-arm@0.27.3':
+        optional: true
+
     '@esbuild/linux-ia32@0.21.5':
         optional: true
 
     '@esbuild/linux-ia32@0.25.12':
         optional: true
 
+    '@esbuild/linux-ia32@0.27.3':
+        optional: true
+
     '@esbuild/linux-loong64@0.21.5':
         optional: true
 
     '@esbuild/linux-loong64@0.25.12':
         optional: true
 
+    '@esbuild/linux-loong64@0.27.3':
+        optional: true
+
     '@esbuild/linux-mips64el@0.21.5':
         optional: true
 
     '@esbuild/linux-mips64el@0.25.12':
         optional: true
 
+    '@esbuild/linux-mips64el@0.27.3':
+        optional: true
+
     '@esbuild/linux-ppc64@0.21.5':
         optional: true
 
     '@esbuild/linux-ppc64@0.25.12':
         optional: true
 
+    '@esbuild/linux-ppc64@0.27.3':
+        optional: true
+
     '@esbuild/linux-riscv64@0.21.5':
         optional: true
 
     '@esbuild/linux-riscv64@0.25.12':
         optional: true
 
+    '@esbuild/linux-riscv64@0.27.3':
+        optional: true
+
     '@esbuild/linux-s390x@0.21.5':
         optional: true
 
     '@esbuild/linux-s390x@0.25.12':
         optional: true
 
+    '@esbuild/linux-s390x@0.27.3':
+        optional: true
+
     '@esbuild/linux-x64@0.21.5':
         optional: true
 
     '@esbuild/linux-x64@0.25.12':
         optional: true
 
+    '@esbuild/linux-x64@0.27.3':
+        optional: true
+
     '@esbuild/netbsd-arm64@0.25.12':
         optional: true
 
+    '@esbuild/netbsd-arm64@0.27.3':
+        optional: true
+
     '@esbuild/netbsd-x64@0.21.5':
         optional: true
 
     '@esbuild/netbsd-x64@0.25.12':
         optional: true
 
+    '@esbuild/netbsd-x64@0.27.3':
+        optional: true
+
     '@esbuild/openbsd-arm64@0.25.12':
         optional: true
 
+    '@esbuild/openbsd-arm64@0.27.3':
+        optional: true
+
     '@esbuild/openbsd-x64@0.21.5':
         optional: true
 
     '@esbuild/openbsd-x64@0.25.12':
         optional: true
 
+    '@esbuild/openbsd-x64@0.27.3':
+        optional: true
+
     '@esbuild/openharmony-arm64@0.25.12':
         optional: true
 
+    '@esbuild/openharmony-arm64@0.27.3':
+        optional: true
+
     '@esbuild/sunos-x64@0.21.5':
         optional: true
 
     '@esbuild/sunos-x64@0.25.12':
         optional: true
 
+    '@esbuild/sunos-x64@0.27.3':
+        optional: true
+
     '@esbuild/win32-arm64@0.21.5':
         optional: true
 
     '@esbuild/win32-arm64@0.25.12':
         optional: true
 
+    '@esbuild/win32-arm64@0.27.3':
+        optional: true
+
     '@esbuild/win32-ia32@0.21.5':
         optional: true
 
     '@esbuild/win32-ia32@0.25.12':
         optional: true
 
+    '@esbuild/win32-ia32@0.27.3':
+        optional: true
+
     '@esbuild/win32-x64@0.21.5':
         optional: true
 
     '@esbuild/win32-x64@0.25.12':
         optional: true
 
+    '@esbuild/win32-x64@0.27.3':
+        optional: true
+
     '@eslint-community/eslint-utils@4.9.1(eslint@8.57.1)':
         dependencies:
             eslint: 8.57.1
@@ -7904,6 +8227,35 @@ snapshots:
             '@esbuild/win32-ia32': 0.25.12
             '@esbuild/win32-x64': 0.25.12
 
+    esbuild@0.27.3:
+        optionalDependencies:
+            '@esbuild/aix-ppc64': 0.27.3
+            '@esbuild/android-arm': 0.27.3
+            '@esbuild/android-arm64': 0.27.3
+            '@esbuild/android-x64': 0.27.3
+            '@esbuild/darwin-arm64': 0.27.3
+            '@esbuild/darwin-x64': 0.27.3
+            '@esbuild/freebsd-arm64': 0.27.3
+            '@esbuild/freebsd-x64': 0.27.3
+            '@esbuild/linux-arm': 0.27.3
+            '@esbuild/linux-arm64': 0.27.3
+            '@esbuild/linux-ia32': 0.27.3
+            '@esbuild/linux-loong64': 0.27.3
+            '@esbuild/linux-mips64el': 0.27.3
+            '@esbuild/linux-ppc64': 0.27.3
+            '@esbuild/linux-riscv64': 0.27.3
+            '@esbuild/linux-s390x': 0.27.3
+            '@esbuild/linux-x64': 0.27.3
+            '@esbuild/netbsd-arm64': 0.27.3
+            '@esbuild/netbsd-x64': 0.27.3
+            '@esbuild/openbsd-arm64': 0.27.3
+            '@esbuild/openbsd-x64': 0.27.3
+            '@esbuild/openharmony-arm64': 0.27.3
+            '@esbuild/sunos-x64': 0.27.3
+            '@esbuild/win32-arm64': 0.27.3
+            '@esbuild/win32-ia32': 0.27.3
+            '@esbuild/win32-x64': 0.27.3
+
     escalade@3.2.0: {}
 
     escape-string-regexp@4.0.0: {}

scripts/critical-css.mjs

@@ -6,23 +6,57 @@
  * Usage: node scripts/critical-css.mjs [buildDir]
  *   buildDir: path to build output (default: "build"). Use from repo root.
  */
-import { readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir, platform } from 'node:os';
 import { join } from 'node:path';
 import { cwd } from 'node:process';
 
 const buildDir = join(cwd(), process.argv[2] || 'build');
 const htmlPath = join(buildDir, 'index.html');
 
-// critical/penthouse use a nested puppeteer; point it at our installed Chrome
+// critical/penthouse use a nested puppeteer; point at an installed Chrome/Chromium.
-try {
+// Only set PUPPETEER_EXECUTABLE_PATH if the path exists. Prefer Playwright's Chromium
-    const puppeteer = await import('puppeteer');
+// on arm64 so we use the native binary (Puppeteer's default can be x86 on ARM hosts e.g. OrbStack).
-    const executablePath = puppeteer.default?.executablePath?.();
+function getPlaywrightChromePath() {
-    if (executablePath) {
+    const cacheBase =
-        process.env.PUPPETEER_EXECUTABLE_PATH = executablePath;
+        process.env.PLAYWRIGHT_BROWSERS_PATH || join(homedir(), '.cache', 'ms-playwright');
+    if (!existsSync(cacheBase)) return null;
+    const dirs = readdirSync(cacheBase, { withFileTypes: true });
+    for (const d of dirs) {
+        if (!d.isDirectory() || !d.name.startsWith('chromium-')) continue;
+        const sub = join(cacheBase, d.name);
+        const rel =
+            platform() === 'win32'
+                ? 'chrome-win\\chrome.exe'
+                : platform() === 'darwin'
+                  ? 'chrome-mac/Chromium.app/Contents/MacOS/Chromium'
+                  : 'chrome-linux/chrome';
+        const candidate = join(sub, rel);
+        if (existsSync(candidate)) return candidate;
     }
-} catch {
+    return null;
-    // no top-level puppeteer or no executable; rely on env or default
 }
+async function resolveChromePath() {
+    const isArm64 = process.arch === 'arm64';
+    if (isArm64) {
+        const pw = getPlaywrightChromePath();
+        if (pw) return pw;
+    }
+    try {
+        const puppeteer = await import('puppeteer');
+        const path = puppeteer.default?.executablePath?.();
+        if (path && existsSync(path)) return path;
+    } catch {
+        // ignore
+    }
+    if (!isArm64) {
+        const pw = getPlaywrightChromePath();
+        if (pw) return pw;
+    }
+    return null;
+}
+const chromePath = await resolveChromePath();
+if (chromePath) process.env.PUPPETEER_EXECUTABLE_PATH = chromePath;
 
 try {
     const { generate } = await import('critical');
@@ -31,17 +65,30 @@ try {
         base: buildDir,
         html,
         inline: { strategy: 'default' }, // preload in head + link at end of body (no inline JS, CSP-safe)
-        dimensions: [{ width: 1280, height: 720 }],
+        dimensions: [
+            { width: 375, height: 667 }, // mobile (iPhone SE)
+            { width: 768, height: 1024 }, // tablet
+            { width: 1280, height: 720 }, // desktop
+        ],
         penthouse: { timeout: 30000 },
     });
-    writeFileSync(htmlPath, outHtml, 'utf-8');
+    // Ensure _app asset paths stay absolute (critical may rewrite; host-based routing needs /_app/...)
+    const normalized = outHtml.replace(/\.\/_app\//g, '/_app/');
+    writeFileSync(htmlPath, normalized, 'utf-8');
     console.log(`Critical CSS inlined in ${htmlPath}`);
 } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.error('Critical CSS step failed:', msg);
-    if (msg.includes('Browser is not downloaded')) {
+    if (
+        msg.includes('Browser is not downloaded') ||
+        msg.includes('did not find any executable') ||
+        msg.includes('Could not find Chrome')
+    ) {
         console.error('Install Chromium first: pnpm run critical-css:install');
-        console.error('Or run "pnpm run build" without critical CSS.');
+        console.error(
+            '(Dev container: Playwright Chromium is also used if present in ~/.cache/ms-playwright.)',
+        );
+        console.error('Or run "pnpm run build" (without critical CSS) for a working build.');
     }
     process.exit(1);
 }

scripts/externalize-inline-script.mjs

@@ -1,6 +1,7 @@
 /**
  * Post-build: extract SvelteKit's inline bootstrap script to an external file
  * and replace it with <script src="..."> so CSP can use script-src 'self' without unsafe-inline.
+ * Minifies the extracted JS.
  *
  * Usage: node scripts/externalize-inline-script.mjs [buildDir]
  *   buildDir: path to build output (default: "build"). Use from repo root.
@@ -9,6 +10,7 @@ import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 import { cwd } from 'node:process';
+import * as esbuild from 'esbuild';
 
 const buildDir = join(cwd(), process.argv[2] || 'build');
 const htmlPath = join(buildDir, 'index.html');
@@ -66,28 +68,40 @@ function extractScriptContent(html, scriptStart) {
     return null;
 }
 
-try {
+async function main() {
+    try {
         let html = readFileSync(htmlPath, 'utf-8');
         const found = findSvelteKitInlineScript(html);
         if (!found) {
             console.log('No SvelteKit inline bootstrap script found in', htmlPath);
             process.exit(0);
         }
-    const content = found.content;
+        let content = found.content;
+        // Bootstrap runs from /_app/immutable/bootstrap.xxx.js; imports like "./_app/immutable/entry/..."
+        // would resolve to /_app/immutable/_app/immutable/entry/... (duplicate). Use directory-relative paths.
+        content = content.replace(/\.\/_app\/immutable\//g, './');
+        // Minify
+        const minified = await esbuild.transform(content, { minify: true, loader: 'js' });
+        content = minified.code;
         const hash = createHash('sha256').update(content).digest('hex').slice(0, 8);
         const filename = `bootstrap.${hash}.js`;
         const immutableDir = join(buildDir, '_app', 'immutable');
         mkdirSync(immutableDir, { recursive: true });
         const scriptPath = join(immutableDir, filename);
-    writeFileSync(scriptPath, content.trimStart(), 'utf-8');
+        writeFileSync(scriptPath, content, 'utf-8');
-    const scriptTag = `<script src="./_app/immutable/${filename}"></script>`;
+        const scriptTag = `<script src="/_app/immutable/${filename}"></script>`;
         html = html.slice(0, found.start) + scriptTag + html.slice(found.end);
+        // Use absolute paths for _app assets so they resolve correctly (host-based routing, redirects)
+        html = html.replace(/\.\/_app\//g, '/_app/');
         writeFileSync(htmlPath, html, 'utf-8');
         console.log('Externalized SvelteKit bootstrap to', scriptPath);
-} catch (err) {
+    } catch (err) {
         console.error(
             'externalize-inline-script failed:',
             err instanceof Error ? err.message : String(err),
         );
         process.exit(1);
+    }
 }
+
+main();

scripts/minify-static-assets.mjs

@@ -0,0 +1,42 @@
+/**
+ * Post-build: minify JS and CSS under build/assets (files copied from static/).
+ * Includes static/assets/js/*.js (e.g. ga-init.js, bootstrap.js) and assets/*.css.
+ * Usage: node scripts/minify-static-assets.mjs [buildDir]
+ */
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { cwd } from 'node:process';
+import * as esbuild from 'esbuild';
+
+const buildDir = join(cwd(), process.argv[2] || 'build');
+const assetsDir = join(buildDir, 'assets');
+
+function* walk(dir, base = '') {
+    for (const name of readdirSync(dir, { withFileTypes: true })) {
+        const rel = join(base, name.name);
+        if (name.isDirectory()) yield* walk(join(dir, name.name), rel);
+        else yield rel;
+    }
+}
+
+async function minifyAll() {
+    if (!existsSync(assetsDir)) return;
+    for (const rel of walk(assetsDir, '')) {
+        const path = join(assetsDir, rel);
+        const ext = rel.slice(rel.lastIndexOf('.'));
+        if (ext === '.js') {
+            const code = readFileSync(path, 'utf-8');
+            const out = await esbuild.transform(code, { minify: true, loader: 'js' });
+            writeFileSync(path, out.code);
+        } else if (ext === '.css') {
+            const code = readFileSync(path, 'utf-8');
+            const out = await esbuild.transform(code, { minify: true, loader: 'css' });
+            writeFileSync(path, out.code);
+        }
+    }
+}
+
+minifyAll().catch((e) => {
+    console.error(e);
+    process.exit(1);
+});

src/app.html

@@ -3,7 +3,8 @@
     <head>
         <meta charset="utf-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1" />
-        <script src="/assets/js/theme-store.js"></script>
+
+        <script src="/assets/js/bootstrap.js"></script>
         %sveltekit.head%
     </head>
     <body data-sveltekit-preload-data="hover">

src/lib/components/ContactPanel.svelte

@@ -34,6 +34,8 @@
                         target="_blank"
                         rel="noopener noreferrer"
                         aria-describedby={link.description ? descriptionId : undefined}
+                        data-umami-event="contact panel item"
+                        data-umami-event-label={link.label}
                     >
                         {#if link.icon}
                             <LinkIcon href={link.href} icon={link.icon} label={link.label} />
@@ -65,7 +67,7 @@
         color: var(--color-secondary-muted);
         display: block;
         font-size: 0.875rem;
-        margin-bottom: 0.5rem;
+        margin-bottom: 1rem;
         text-align: center;
     }
 </style>

src/lib/components/Hero.svelte

@@ -35,6 +35,8 @@
                     contactOpen = true;
                     shareOpen = false;
                 }}
+                data-umami-event="header button"
+                data-umami-event-label="contact"
             >
                 <IconContact size={20} />
             </button>
@@ -47,6 +49,8 @@
                 shareOpen = true;
                 contactOpen = false;
             }}
+            data-umami-event="header button"
+            data-umami-event-label="share"
         >
             <IconShare size={20} />
         </button>
@@ -98,6 +102,8 @@
                         contactOpen = true;
                         shareOpen = false;
                     }}
+                    data-umami-event="hero card button"
+                    data-umami-event-label="contact"
                 >
                     <IconContact size={20} />
                     <span>Contact</span>
@@ -111,6 +117,8 @@
                     shareOpen = true;
                     contactOpen = false;
                 }}
+                data-umami-event="hero card button"
+                data-umami-event-label="share"
             >
                 <IconShare size={20} />
                 <span>Share</span>

src/lib/components/Link.svelte

@@ -5,7 +5,14 @@
     let { href, icon, label, description }: ProcessedLink = $props();
 </script>
 
-<a {href} rel="noopener noreferrer" target="_blank" class="link">
+<a
+    {href}
+    rel="noopener noreferrer"
+    target="_blank"
+    class="link"
+    data-umami-event={`link click`}
+    data-umami-event-label={label}
+>
     <span class="icon" aria-hidden="true">
         <LinkIcon {href} {icon} {label} />
     </span>

src/lib/components/LinkGroup.svelte

@@ -33,7 +33,7 @@
 
 <style>
     .link-section-heading {
-        color: var(--color-primary);
+        color: var(--color-primary-muted);
         font-family: var(--font-heading, var(--font-sans));
         font-size: 1.125rem;
         font-weight: 500;

src/lib/components/Panel.svelte

@@ -1,4 +1,5 @@
 <script lang="ts">
+    import type { Snippet } from 'svelte';
     import type { Component } from 'svelte';
     import { tick } from 'svelte';
 
@@ -9,7 +10,7 @@
         open = false,
         title = '',
     }: {
-        children: import('svelte').Snippet;
+        children: Snippet;
         icon?: Component<{ size?: number }>;
         onclose: () => void;
         open: boolean;
@@ -41,6 +42,9 @@
     aria-labelledby="panel-title"
     aria-modal="true"
     onclose={handleDialogClose}
+    onclick={(e) => {
+        if (e.target === dialogEl) onclose();
+    }}
     oncancel={(e) => {
         e.preventDefault();
         onclose();
@@ -60,6 +64,8 @@
                 aria-label="Close"
                 bind:this={closeBtnEl}
                 onclick={onclose}
+                data-umami-event="panel button"
+                data-umami-event-label="close"
             >
                 <span aria-hidden="true">×</span>
             </button>
@@ -105,7 +111,7 @@
         flex-direction: column;
         display: flex;
         max-height: 70vh;
-        padding-bottom: 2rem;
+        padding-bottom: 1rem;
         overflow: hidden;
         width: 100%;
 

src/lib/components/SharePanel.svelte

@@ -50,14 +50,20 @@
             {#if qrCodeImage}
                 <div class="share-qr">
                     <img
-                        src="/assets/images/{qrCodeImage}.png"
+                        src="/assets/images/{qrCodeImage}.svg"
                         alt="QR code for this page"
                         width="160"
                         height="160"
                     />
                 </div>
             {/if}
-            <button type="button" class="panel-btn" onclick={copyLink}>
+            <button
+                type="button"
+                class="panel-btn"
+                onclick={copyLink}
+                data-umami-event="share panel item"
+                data-umami-event-label="copy"
+            >
                 <IconCopy size={20} />
                 {copied ? 'Copied!' : 'Copy link'}
             </button>
@@ -67,12 +73,20 @@
                 onclick={onclose}
                 target="_blank"
                 rel="noopener noreferrer"
+                data-umami-event="share panel item"
+                data-umami-event-label="email"
             >
                 <IconEmail size={20} />
                 Email link
             </a>
             {#if canShare}
-                <button type="button" class="panel-btn" onclick={share}>
+                <button
+                    type="button"
+                    class="panel-btn"
+                    onclick={share}
+                    data-umami-event="share panel item"
+                    data-umami-event-label="device share"
+                >
                     <IconShare size={20} />
                     Share…
                 </button>

src/lib/components/ThemeToggle.svelte

@@ -45,6 +45,8 @@
         aria-label="Close theme menu"
         tabindex="-1"
         onclick={() => (expanded = false)}
+        data-umami-event="theme toggle button"
+        data-umami-event-label="close"
     ></button>
 {/if}
 
@@ -64,6 +66,8 @@
             aria-current={current === 'light' ? 'true' : undefined}
             title="Light"
             onclick={() => handleClick('light')}
+            data-umami-event="theme toggle button"
+            data-umami-event-label="light"
         >
             <Sun size={24} />
         </button>
@@ -75,6 +79,8 @@
             aria-current={current === 'dark' ? 'true' : undefined}
             title="Dark"
             onclick={() => handleClick('dark')}
+            data-umami-event="theme toggle button"
+            data-umami-event-label="dark"
         >
             <Moon size={24} />
         </button>
@@ -86,6 +92,8 @@
             aria-current={current === 'auto' ? 'true' : undefined}
             title="Auto (system)"
             onclick={() => handleClick('auto')}
+            data-umami-event="theme toggle button"
+            data-umami-event-label="auto"
         >
             <SunMoon size={24} />
         </button>

src/lib/config.ts

@@ -2,6 +2,8 @@
  * App config: own-property hostnames for UTM attribution, variant hostnames, GA IDs.
  */
 
+import { ContentVariant } from './data/constants';
+
 export const OWN_PROPERTY_HOSTS = [
     'mifi.ventures',
     'cal.mifi.ventures',
@@ -9,20 +11,25 @@ export const OWN_PROPERTY_HOSTS = [
     'mifi.bio',
 ] as const;
 
-export const VARIANT_HOSTS: Record<'dev' | 'bio', string> = {
+export const VARIANT_HOSTS: Record<ContentVariant, string> = {
-    dev: 'mifi.dev',
+    [ContentVariant.DEV]: 'mifi.dev',
-    bio: 'mifi.bio',
+    [ContentVariant.BIO]: 'mifi.bio',
 };
 
-export const GA_MEASUREMENT_IDS: Record<'dev' | 'bio', string> = {
+export const GA_MEASUREMENT_IDS: Record<ContentVariant, string> = {
-    dev: 'G-P8V832WDM8',
+    [ContentVariant.DEV]: 'G-P8V832WDM8',
-    bio: 'G-885B0KYWZ1',
+    [ContentVariant.BIO]: 'G-885B0KYWZ1',
+};
+
+export const UMAMI_MEASUREMENT_IDS: Record<ContentVariant, string> = {
+    [ContentVariant.DEV]: 'ac7e751b-4ce3-49f2-80e0-f430b292b72a',
+    [ContentVariant.BIO]: 'cf44669d-10c1-4982-ad79-282aed4237e5',
 };
 
 /** theme-color meta values per variant (match tokens-{variant}.css --color-bg) */
-export const THEME_COLORS: Record<'dev' | 'bio', { light: string; dark: string }> = {
+export const THEME_COLORS: Record<ContentVariant, { light: string; dark: string }> = {
-    dev: { light: '#f5f4f8', dark: '#131118' }, // hsl(260 20% 98%) / hsl(260 18% 8%)
+    [ContentVariant.DEV]: { light: '#f5f4f8', dark: '#131118' }, // hsl(260 20% 98%) / hsl(260 18% 8%)
-    bio: { light: '#f4f6f9', dark: '#111318' }, // hsl(220 22% 98%) / hsl(220 18% 8%)
+    [ContentVariant.BIO]: { light: '#f4f6f9', dark: '#111318' }, // hsl(220 22% 98%) / hsl(220 18% 8%)
 };
 
 export const UTM_MEDIUM = 'link';

src/lib/data/links.json

@@ -20,8 +20,7 @@
                 ]
             },
             "linksHeading": "Professional Links and Profiles",
-            "showContact": true,
+            "qrCodeImage": "qr-mifi-dev"
-            "qrCodeImage": null
         },
         "bio": {
             "title": "mifi.bio — the homepage of the human Mike Fitzpatrick",
@@ -51,8 +50,7 @@
                 ]
             },
             "linksHeading": "Links and Profiles",
-            "showContact": false,
+            "qrCodeImage": "qr-mifi-bio"
-            "qrCodeImage": null
         }
     },
     "contactLinks": [
@@ -124,6 +122,14 @@
                 "dev": 1
             },
             "links": [
+                {
+                    "href": "https://mifi.dev/downloads/resume-2026lf.pdf",
+                    "icon": "Resume",
+                    "label": "Long-form CV",
+                    "description": "My full resume, including all my work experience, education, and skills.",
+                    "utmContent": "resume-lf",
+                    "variants": ["dev", "bio"]
+                },
                 {
                     "href": "https://mifi.dev/downloads/resume-2026c.pdf",
                     "icon": "Resume",

src/lib/data/types.ts

@@ -29,11 +29,7 @@ export interface Site {
         sameAs: string[];
     };
     linksHeading?: string;
-    /** If false, hide Contact button and panel for this variant. Default true. */
-    showContact?: boolean;
-    /** Contact panel links; if omitted, first section links are used. */
     contactLinks?: ContactLink[];
-    /** Optional QR code image path (e.g. /assets/images/qr-mifi-dev.png) for Share panel. */
     qrCodeImage?: string | null;
 }
 

src/routes/+layout.server.ts

@@ -1,5 +1,10 @@
 import contentData from '$lib/data/links.json';
-import { VARIANT_HOSTS, GA_MEASUREMENT_IDS, THEME_COLORS } from '$lib/config';
+import {
+    VARIANT_HOSTS,
+    GA_MEASUREMENT_IDS,
+    THEME_COLORS,
+    UMAMI_MEASUREMENT_IDS,
+} from '$lib/config';
 import type { Site, ContentData, ProcessedLink } from '$lib/data/types';
 import type { LayoutServerLoad } from './$types';
 import { ContentVariant, HeroLayout } from '$lib/data/constants';
@@ -18,6 +23,7 @@ export type LayoutServerDataOut = {
     };
     variant: string;
     gaMeasurementId: string;
+    umamiMeasurementId: string;
     /** theme-color meta values for current variant */
     themeColorLight: string;
     themeColorDark: string;
@@ -57,7 +63,6 @@ export const load: LayoutServerLoad<LayoutServerDataOut> = (): LayoutServerDataO
         location: siteDef?.location,
         person: siteDef?.person,
         linksHeading: siteDef?.linksHeading,
-        showContact: siteDef?.showContact,
         contactLinks: siteDef?.contactLinks,
         qrCodeImage: siteDef?.qrCodeImage ?? undefined,
     };
@@ -68,6 +73,7 @@ export const load: LayoutServerLoad<LayoutServerDataOut> = (): LayoutServerDataO
         links: { sections },
         variant,
         gaMeasurementId: GA_MEASUREMENT_IDS[variant],
+        umamiMeasurementId: UMAMI_MEASUREMENT_IDS[variant],
         themeColorLight: themeColors.light,
         themeColorDark: themeColors.dark,
     };

src/routes/+layout.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
     import type { Snippet } from 'svelte';
 
+    import Footer from '$lib/components/Footer.svelte';
     import ThemeToggle from '$lib/components/ThemeToggle.svelte';
     import type { LayoutData } from './$types';
 
@@ -36,6 +37,15 @@
 </script>
 
 <svelte:head>
+    <!-- Google tag (gtag.js): ID passed via data-ga-id for CSP (no inline script) -->
+    <script async src="https://www.googletagmanager.com/gtag/js?id={data.gaMeasurementId}"></script>
+    <script defer src="/assets/js/ga-init.js" data-ga-id={data.gaMeasurementId}></script>
+    <script
+        defer
+        src="https://analytics.mifi.holdings/script.js"
+        data-website-id={data.umamiMeasurementId}
+    ></script>
+
     <link rel="stylesheet" href="/assets/tokens-{data.variant}.css" />
 
     <link
@@ -88,3 +98,12 @@
     <ThemeToggle />
 </header>
 {@render children()}
+<Footer />
+<img
+    src="https://analytics.mifi.holdings/p/wQ9GYnLIg"
+    alt=""
+    width="1"
+    height="1"
+    role="presentation"
+    loading="eager"
+/>

src/routes/+page.svelte

@@ -1,6 +1,5 @@
 <script lang="ts">
     import ContactPanel from '$lib/components/ContactPanel.svelte';
-    import Footer from '$lib/components/Footer.svelte';
     import Hero from '$lib/components/Hero.svelte';
     import LinkGroup from '$lib/components/LinkGroup.svelte';
     import SharePanel from '$lib/components/SharePanel.svelte';
@@ -67,7 +66,6 @@
             />
         {/each}
     </div>
-    <Footer />
     <SharePanel
         open={shareOpen}
         url={shareUrl}

src/routes/__tests__/layout.server.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect, vi, afterEach } from 'vitest';
 import { load } from '../+layout.server';
+import { UMAMI_MEASUREMENT_IDS } from '$lib/config';
 import { ContentVariant } from '$lib/data/constants';
 import type { ContentData } from '$lib/data/types';
 
@@ -95,7 +96,9 @@ describe('+layout.server', () => {
     it('gaMeasurementId matches variant', () => {
         process.env.CONTENT_VARIANT = ContentVariant.DEV;
         expect(load().gaMeasurementId).toMatch(/^G-/);
+        expect(load().umamiMeasurementId).toBe(UMAMI_MEASUREMENT_IDS[ContentVariant.DEV]);
         process.env.CONTENT_VARIANT = ContentVariant.BIO;
         expect(load().gaMeasurementId).toMatch(/^G-/);
+        expect(load().umamiMeasurementId).toBe(UMAMI_MEASUREMENT_IDS[ContentVariant.BIO]);
     });
 });

src/routes/__tests__/layout.test.ts

@@ -15,9 +15,12 @@ describe('+layout (LayoutData)', () => {
             links: { sections: [] },
             variant: 'dev',
             gaMeasurementId: 'G-xxx',
+            umamiMeasurementId: 'UM-xxx',
         };
         expect(mockData.site).toHaveProperty('title');
         expect(mockData.site).toHaveProperty('url');
+        expect(mockData).toHaveProperty('umamiMeasurementId');
+        expect(mockData).toHaveProperty('gaMeasurementId');
         expect(mockData).toHaveProperty('variant');
         expect(mockData.links).toHaveProperty('sections');
     });

static/assets/js/bootstrap.js

@@ -0,0 +1,18 @@
+(function () {
+    // Default Trusted Type policy so Svelte hydration can assign to innerHTML under CSP require-trusted-types-for 'script'.
+    if (typeof window.trustedTypes !== 'undefined' && window.trustedTypes.createPolicy) {
+        try {
+            window.trustedTypes.createPolicy('default', {
+                createHTML: function (input) {
+                    return input;
+                },
+            });
+        } catch {
+            /* policy already exists */
+        }
+    }
+
+    var t = localStorage.getItem('mifi-theme');
+    if (t === 'light' || t === 'dark') document.documentElement.setAttribute('data-theme', t);
+    else document.documentElement.removeAttribute('data-theme');
+})();

static/assets/js/ga-init.js

@@ -0,0 +1,11 @@
+(function () {
+    var script = document.currentScript;
+    var id = script && script.getAttribute('data-ga-id');
+    if (!id) return;
+    window.dataLayer = window.dataLayer || [];
+    function gtag() {
+        window.dataLayer.push(arguments);
+    }
+    gtag('js', new Date());
+    gtag('config', id, { anonymize_ip: true });
+})();

static/assets/js/theme-store.js

@@ -1,5 +0,0 @@
-(function () {
-    var t = localStorage.getItem('mifi-theme');
-    if (t === 'light' || t === 'dark') document.documentElement.setAttribute('data-theme', t);
-    else document.documentElement.removeAttribute('data-theme');
-})();

static/assets/tokens-bio.css

@@ -50,7 +50,7 @@
         --color-border: hsl(220 14% 20%);
         --color-border-subtle: hsl(220 12% 16%);
         --color-primary: hsl(220 55% 62%);
-        --color-primary-muted: hsl(220 45% 55%);
+        --color-primary-muted: hsl(220 45% 62%);
         --color-secondary: hsl(330 50% 65%);
         --color-secondary-muted: hsl(330 42% 58%);
         --color-accent: hsl(220 55% 62%);
@@ -93,7 +93,7 @@
     --color-border: hsl(220 14% 20%);
     --color-border-subtle: hsl(220 12% 16%);
     --color-primary: hsl(220 55% 62%);
-    --color-primary-muted: hsl(220 45% 55%);
+    --color-primary-muted: hsl(220 45% 62%);
     --color-secondary: hsl(330 50% 65%);
     --color-secondary-muted: hsl(330 42% 58%);
     --color-accent: hsl(220 55% 62%);

static/assets/tokens-dev.css

@@ -42,7 +42,7 @@
         --color-border: hsl(260 15% 22%);
         --color-border-subtle: hsl(260 12% 18%);
         --color-primary: hsl(262 70% 65%);
-        --color-primary-muted: hsl(262 50% 58%);
+        --color-primary-muted: hsl(262 50% 65%);
         --color-secondary: hsl(220 25% 68%);
         --color-secondary-muted: hsl(220 20% 58%);
         --color-accent: hsl(262 70% 65%);
@@ -85,7 +85,7 @@
     --color-border: hsl(260 15% 22%);
     --color-border-subtle: hsl(260 12% 18%);
     --color-primary: hsl(262 70% 65%);
-    --color-primary-muted: hsl(262 50% 58%);
+    --color-primary-muted: hsl(262 50% 65%);
     --color-secondary: hsl(220 25% 68%);
     --color-secondary-muted: hsl(220 20% 58%);
     --color-accent: hsl(262 70% 65%);

static/robots-bio.txt

@@ -0,0 +1,4 @@
+User-agent: *
+Allow: /
+
+Sitemap: https://mifi.bio/sitemap.xml

static/robots-dev.txt

@@ -0,0 +1,4 @@
+User-agent: *
+Allow: /
+
+Sitemap: https://mifi.dev/sitemap.xml

static/sitemap-bio.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+    <url>
+        <loc>https://mifi.bio/</loc>
+        <lastmod>2026-02-06</lastmod>
+        <changefreq>weekly</changefreq>
+        <priority>1.0</priority>
+    </url>
+</urlset>

static/sitemap-dev.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+    <url>
+        <loc>https://mifi.dev/</loc>
+        <lastmod>2026-02-06</lastmod>
+        <changefreq>weekly</changefreq>
+        <priority>1.0</priority>
+    </url>
+</urlset>

test.txt

@@ -1 +0,0 @@
-hello

vite.config.ts

@@ -3,4 +3,7 @@ import { defineConfig } from 'vite';
 
 export default defineConfig({
     plugins: [sveltekit()],
+    build: {
+        cssMinify: true,
+    },
 });