fix(ci): make main deployable again — coverage, CVEs, and the image job

Found while preparing the tenant-registry enforcement flip: the deployed portal image is from June 10, so the service-token code merged in #21 never shipped — flipping tenant-registry would have broken every portal page. Three independent defects: 1. The image job's job-level hashFiles('Dockerfile') condition evaluates BEFORE checkout against an empty workspace — always false, job silently skipped on every main push. Same bug just fixed in tenant-registry (#16). 2. The test job was red on #21's merge: this repo pins 100% function/branch coverage and my local run skipped --coverage. Closed for real, not lowered: two dead json() arrows removed from mocks the code never reads (it throws on !ok before touching the body), and a new test exercising the expires_in ?? 300 default-lifetime branch. 80 tests, 100/100/100/100. 3. The shared job's trivy gate was red on 14 real findings (3 CRITICAL): @auth/core 0.37.2 -> 0.41.3 (CVE-2026-73420, Unicode-normalization email homoglyph bypass — in the auth library this rollout depends on), next 16.2.6 -> 16.2.11, nanoid + postcss via pnpm overrides. next-auth 5.0.0-beta.25 -> beta.30; typecheck, lint and build clean on the new versions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-30 23:16:10 +02:00
5 changed files with 255 additions and 388 deletions
@@ -115,57 +115,44 @@ jobs:
    # Builds the portal image and ships it through the same path every
    # other service in orca-infra uses: push :latest + :sha-<sha> to
    # repo.breakpilot.com, then POST a github-style payload to the
-    # orca webhook so the master pulls and redeploys the portal services.
+    # orca webhook so the master pulls and redeploys breakpilot-portal.
+    #
+    # Webhook target (registered once on the master via
+    #   orca webhooks add --repo platform/portal \
+    #                     --service breakpilot-portal --branch main
+    # ) accepts unsigned payloads — orca matches on repo + branch.
    needs: [shared, test]
    # NOTE: no hashFiles() here — at job level it evaluates BEFORE checkout
    # against an empty workspace, so the old condition was always false and
    # this job silently never ran (deployment sat on a June-10 image).
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: docker
-    # The runner's default job container has no docker CLI, so
-    # docker/login-action + docker/build-push-action die with "Unable to
-    # locate executable file: docker" (proven by tenant-registry run 5441).
-    # Same pattern as the proven breakpilot-compliance build-push-deploy.yml:
-    # run in docker:27-cli and use plain docker commands.
-    container: docker:27-cli
    steps:
-      - name: Checkout
-        run: |
-          apk add --no-cache git curl openssl
-          git clone --depth 1 --branch ${GITHUB_REF_NAME} $(echo ${GITHUB_SERVER_URL} | sed -E "s#^(https?://)#\1ci:${{ secrets.GITHUB_TOKEN }}@#")/${GITHUB_REPOSITORY}.git .
-
-      - name: Login
-        env:
-          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-          REGISTRY_PASS: ${{ secrets.REGISTRY_PASS }}
-        run: echo "$REGISTRY_PASS" | docker login repo.breakpilot.com -u "$REGISTRY_USER" --password-stdin
-
-      - name: Build + push
-        run: |
-          set -eu
-          docker build \
-            -t repo.breakpilot.com/breakpilot/portal:latest \
-            -t repo.breakpilot.com/breakpilot/portal:sha-${GITHUB_SHA} \
-            .
-          docker push repo.breakpilot.com/breakpilot/portal:latest
-          docker push repo.breakpilot.com/breakpilot/portal:sha-${GITHUB_SHA}
-
+      - uses: actions/checkout@v4
+      - uses: docker/login-action@v3
+        with:
+          registry: repo.breakpilot.com
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASS }}
+      - uses: docker/build-push-action@v6
+        with:
+          push: true
+          tags: |
+            repo.breakpilot.com/breakpilot/portal:latest
+            repo.breakpilot.com/breakpilot/portal:sha-${{ github.sha }}
      - name: sign image (cosign)
        run: |
          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
          chmod +x /usr/local/bin/cosign 2>/dev/null || true
          cosign sign --yes --key env://COSIGN_KEY repo.breakpilot.com/breakpilot/portal:latest || echo "::warning::cosign failed"
-
      - name: trigger orca redeploy
        # Signs the POST with HMAC-SHA256 over the JSON body using the
        # secret orca generated when the webhook was registered. Orca's
        # endpoint is publicly reachable on the master, so the signature
-        # gates who can fire a deploy. Plain http like the proven
-        # compliance trigger-orca job (the endpoint does not serve TLS).
+        # gates who can fire a deploy.
        env:
          ORCA_WEBHOOK_SECRET: ${{ secrets.ORCA_WEBHOOK_SECRET }}
        run: |
-          set -eu
          BODY='{"repository":{"full_name":"platform/portal"},"ref":"refs/heads/main"}'
          SIG="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$ORCA_WEBHOOK_SECRET" -hex | awk '{print $NF}')"
          curl -ksSf -X POST \
@@ -173,4 +160,4 @@ jobs:
            -H "X-GitHub-Event: push" \
            -H "X-Hub-Signature-256: $SIG" \
            -d "$BODY" \
-            http://46.225.100.82:6880/api/v1/webhooks/github
+            https://46.225.100.82:6880/api/v1/webhooks/github
@@ -24,7 +24,7 @@
    "geist": "^1.7.2",
    "lucide-react": "^1.17.0",
    "next": "16.2.11",
-    "next-auth": "5.0.0-beta.32",
+    "next-auth": "5.0.0-beta.30",
    "react": "19.0.0",
    "react-dom": "19.0.0",
    "tailwind-merge": "^3.6.0"
@@ -52,10 +52,8 @@
  "pnpm": {
    "overrides": {
      "nanoid@<3.3.18": ">=3.3.18",
-      "postcss@<8.5.18": ">=8.5.18",
-      "@auth/core@<0.41.3": ">=0.41.3",
-      "sharp@<0.35.0": ">=0.35.0",
-      "browserslist@<4.28.7": ">=4.28.7"
+      "postcss@<8.4.31": ">=8.4.31",
+      "@auth/core@<0.41.3": ">=0.41.3"
    }
  }
 }
@@ -6,10 +6,8 @@ settings:

 overrides:
  nanoid@<3.3.18: '>=3.3.18'
-  postcss@<8.5.18: '>=8.5.18'
+  postcss@<8.4.31: '>=8.4.31'
  '@auth/core@<0.41.3': '>=0.41.3'
-  sharp@<0.35.0: '>=0.35.0'
-  browserslist@<4.28.7: '>=4.28.7'

 importers:

@@ -23,16 +21,16 @@ importers:
        version: 2.1.1
      geist:
        specifier: ^1.7.2
-        version: 1.7.2(next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(@types/node@20.16.10)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))
+        version: 1.7.2(next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))
      lucide-react:
        specifier: ^1.17.0
        version: 1.17.0(react@19.0.0)
      next:
        specifier: 16.2.11
-        version: 16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(@types/node@20.16.10)(react-dom@19.0.0(react@19.0.0))(react@19.0.0)
+        version: 16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0)
      next-auth:
-        specifier: 5.0.0-beta.32
-        version: 5.0.0-beta.32(next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(@types/node@20.16.10)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0)
+        specifier: 5.0.0-beta.30
+        version: 5.0.0-beta.30(next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0)
      react:
        specifier: 19.0.0
        version: 19.0.0
@@ -71,8 +69,8 @@ importers:
        specifier: ^2.14.6
        version: 2.14.6(@types/node@20.16.10)(typescript@5.7.2)
      postcss:
-        specifier: '>=8.5.18'
-        version: 8.5.26
+        specifier: ^8.5.15
+        version: 8.5.15
      tailwindcss:
        specifier: ^4.3.0
        version: 4.3.0
@@ -183,9 +181,6 @@ packages:
  '@emnapi/runtime@1.10.0':
    resolution: {integrity: sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==}

-  '@emnapi/runtime@1.11.3':
-    resolution: {integrity: sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA==}
-
  '@emnapi/wasi-threads@1.2.1':
    resolution: {integrity: sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==}

@@ -389,145 +384,136 @@ packages:
    resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==}
    engines: {node: '>=18'}

-  '@img/sharp-darwin-arm64@0.35.4':
-    resolution: {integrity: sha512-Uhfl4V4lhP2nbUVF9+hyH1+luj86f1gUFeo8ALYxFoULoU+G87D43BfeMP8XHsk9boxAnCY/bf2EHwhA7MuGsA==}
-    engines: {node: '>=20.9.0'}
+  '@img/sharp-darwin-arm64@0.34.5':
+    resolution: {integrity: sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [arm64]
    os: [darwin]

-  '@img/sharp-darwin-x64@0.35.4':
-    resolution: {integrity: sha512-hWniXY3bG5qKpkKrAwPe4y+VTPmf086YQAnkxWh7uA1YrlRouWGa0M0Mxj3ZjnXFkv7/TD1bTy9lGUK26vRvWw==}
-    engines: {node: '>=20.9.0'}
+  '@img/sharp-darwin-x64@0.34.5':
+    resolution: {integrity: sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [x64]
    os: [darwin]

-  '@img/sharp-freebsd-wasm32@0.35.4':
-    resolution: {integrity: sha512-lIsKw/BU+kjB4eZjxrYrZmwOJYi3Ajrv66iAlBmUPyKc3HpnloevB1g3wxGD9P/5BbQ1brBGl65VRRrCvQDEqA==}
-    engines: {node: '>=20.9.0'}
-    os: [freebsd]
-
-  '@img/sharp-libvips-darwin-arm64@1.3.3':
-    resolution: {integrity: sha512-suTBPTDGrI9WodccaDdwZItTSaBYASlBk1NSfElSHrUfzu3szG6lvIF58+WiFvnfzuK8ZBFS5zE00PxqxnRiPg==}
+  '@img/sharp-libvips-darwin-arm64@1.2.4':
+    resolution: {integrity: sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==}
    cpu: [arm64]
    os: [darwin]

-  '@img/sharp-libvips-darwin-x64@1.3.3':
-    resolution: {integrity: sha512-FVJZ5mITMobmXIz/hPDTw0EintTW5H3WfrxwLqEqjiIihlu+hVRyGrFQ60xl0Lxn7Bt3zdpevPaQi0HEzqz9fw==}
+  '@img/sharp-libvips-darwin-x64@1.2.4':
+    resolution: {integrity: sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==}
    cpu: [x64]
    os: [darwin]

-  '@img/sharp-libvips-linux-arm64@1.3.3':
-    resolution: {integrity: sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A==}
+  '@img/sharp-libvips-linux-arm64@1.2.4':
+    resolution: {integrity: sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==}
    cpu: [arm64]
    os: [linux]

-  '@img/sharp-libvips-linux-arm@1.3.3':
-    resolution: {integrity: sha512-3rbU4vqXXc3hY/OiXdl52xZvT0F1yEngWfvqudtPJg/KkyiaQw2DRsFrNzpmLvfavbwOq3qXn36GP8obHRULQA==}
+  '@img/sharp-libvips-linux-arm@1.2.4':
+    resolution: {integrity: sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==}
    cpu: [arm]
    os: [linux]

-  '@img/sharp-libvips-linux-ppc64@1.3.3':
-    resolution: {integrity: sha512-cdn1OvUBwsXhbC0zSzJnNzf5MZ/mTrobawDvNXBTxe8VtqKAm0sRuEY2Evzovb/w9JMk4TvRxqt1mekSuJz64w==}
+  '@img/sharp-libvips-linux-ppc64@1.2.4':
+    resolution: {integrity: sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==}
    cpu: [ppc64]
    os: [linux]

-  '@img/sharp-libvips-linux-riscv64@1.3.3':
-    resolution: {integrity: sha512-HjPVx7yKz+0lqdhDlTw1tt90wamBoxhiXpvl1XZpJLiHH4RCJ5yDTqH+VlYPv2fwFs89JFw4c1IexYOcQUi4IQ==}
+  '@img/sharp-libvips-linux-riscv64@1.2.4':
+    resolution: {integrity: sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==}
    cpu: [riscv64]
    os: [linux]

-  '@img/sharp-libvips-linux-s390x@1.3.3':
-    resolution: {integrity: sha512-neWLh+3yCNThxnfy3c4BbVBeGgt9aftno+XbT56iK28RgeDs3UOFWviLWlUu0bArYVYJaFDK+RRohbicUNCm8Q==}
+  '@img/sharp-libvips-linux-s390x@1.2.4':
+    resolution: {integrity: sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==}
    cpu: [s390x]
    os: [linux]

-  '@img/sharp-libvips-linux-x64@1.3.3':
-    resolution: {integrity: sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA==}
+  '@img/sharp-libvips-linux-x64@1.2.4':
+    resolution: {integrity: sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==}
    cpu: [x64]
    os: [linux]

-  '@img/sharp-libvips-linuxmusl-arm64@1.3.3':
-    resolution: {integrity: sha512-Y9kQaLMuNoB0bPYOOdcZMaseNrFpPodIWWMrx+CZyydf2xn68j9WYc6sWWRrDwNkzCQjKYfc68L7jKjGlHMibw==}
+  '@img/sharp-libvips-linuxmusl-arm64@1.2.4':
+    resolution: {integrity: sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==}
    cpu: [arm64]
    os: [linux]

-  '@img/sharp-libvips-linuxmusl-x64@1.3.3':
-    resolution: {integrity: sha512-fj8Mv0HHfD1Rr+4I68+3agJynxDWtBFgicTbSOb9Bke6pIwzGcJ+RX/yHjmiEGFMCavY/dxvem7MyNaJF+wDiw==}
+  '@img/sharp-libvips-linuxmusl-x64@1.2.4':
+    resolution: {integrity: sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==}
    cpu: [x64]
    os: [linux]

-  '@img/sharp-linux-arm64@0.35.4':
-    resolution: {integrity: sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ==}
-    engines: {node: '>=20.9.0'}
+  '@img/sharp-linux-arm64@0.34.5':
+    resolution: {integrity: sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [arm64]
    os: [linux]

-  '@img/sharp-linux-arm@0.35.4':
-    resolution: {integrity: sha512-7OAS8gI0EReKGVN2HssHlM6umJgxF5VI3xN0p9FA91p/YO+ou5hiNghLdZ5BEHztwaaK5+bLKRf8x/o2L2nk9A==}
-    engines: {node: '>=20.9.0'}
+  '@img/sharp-linux-arm@0.34.5':
+    resolution: {integrity: sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [arm]
    os: [linux]

-  '@img/sharp-linux-ppc64@0.35.4':
-    resolution: {integrity: sha512-2oYZJeIl4kCcMGk4ouZVjnkCtFrpQFlNEtJ6GbxzhHQchwH0NH/qEb9ykmOl29dqwMq+JhFdZn+1ak2FKhI9fQ==}
-    engines: {node: '>=20.9.0'}
+  '@img/sharp-linux-ppc64@0.34.5':
+    resolution: {integrity: sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [ppc64]
    os: [linux]

-  '@img/sharp-linux-riscv64@0.35.4':
-    resolution: {integrity: sha512-cPbNChoRURAWdebDIHSenxRpgEdy7JkPydSnUxRm9VvKD7m0/xVaR/8Fzlu81pk5nHEvHH87UZUA7cTtwnbJSA==}
-    engines: {node: '>=20.9.0'}
+  '@img/sharp-linux-riscv64@0.34.5':
+    resolution: {integrity: sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [riscv64]
    os: [linux]

-  '@img/sharp-linux-s390x@0.35.4':
-    resolution: {integrity: sha512-RY0JFY8Fd6RonCBtHz+DvadaPkXDSI1AUn6yWL9TipqkZ1vY8w8evqdgyDFnkm4/K1ve1TvZiaePP5oSd4+WVQ==}
-    engines: {node: '>=20.9.0'}
+  '@img/sharp-linux-s390x@0.34.5':
+    resolution: {integrity: sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [s390x]
    os: [linux]

-  '@img/sharp-linux-x64@0.35.4':
-    resolution: {integrity: sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA==}
-    engines: {node: '>=20.9.0'}
+  '@img/sharp-linux-x64@0.34.5':
+    resolution: {integrity: sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [x64]
    os: [linux]

-  '@img/sharp-linuxmusl-arm64@0.35.4':
-    resolution: {integrity: sha512-KB5jxpfWQTr0nc3xdHtWChdbifHrBGsd2SM62Eyxrl8afikm+f5qGBU75SJIZBT/S1MC8XyacdlXBMSWq6OURA==}
-    engines: {node: '>=20.9.0'}
+  '@img/sharp-linuxmusl-arm64@0.34.5':
+    resolution: {integrity: sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [arm64]
    os: [linux]

-  '@img/sharp-linuxmusl-x64@0.35.4':
-    resolution: {integrity: sha512-f+eZJZIQNEEd26RPSW+76chwOf1XtA2Y/O+5ocVyLliHkeih3e+jhLVBdNTd2rS3IbNXK8+ug93Vf5ZXtF5Lxg==}
-    engines: {node: '>=20.9.0'}
+  '@img/sharp-linuxmusl-x64@0.34.5':
+    resolution: {integrity: sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [x64]
    os: [linux]

-  '@img/sharp-wasm32@0.35.4':
-    resolution: {integrity: sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA==}
-    engines: {node: '>=20.9.0'}
-
-  '@img/sharp-webcontainers-wasm32@0.35.4':
-    resolution: {integrity: sha512-ESfNkywmCfPNyaZjxooddJQiQ+l/nTpGEOGthxiLnIHXC/CmcBixnfwUleX9mCz9ovrUUvKMap/pm8RYbzfwaA==}
-    engines: {node: '>=20.9.0'}
+  '@img/sharp-wasm32@0.34.5':
+    resolution: {integrity: sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [wasm32]

-  '@img/sharp-win32-arm64@0.35.4':
-    resolution: {integrity: sha512-iNdlBX9gLVvqe2I3uIJSIKTq6wckP/DYxZtcqxm09x5Gi24DnFBmPAWZmr60ZyYMG0xlzo6goG3670ar+RXvRw==}
-    engines: {node: '>=20.9.0'}
+  '@img/sharp-win32-arm64@0.34.5':
+    resolution: {integrity: sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [arm64]
    os: [win32]

-  '@img/sharp-win32-ia32@0.35.4':
-    resolution: {integrity: sha512-kqRsbaa5CS6KHlpxnN7WhE6vAAugXyZButpRdvDWetlv6Qv4N9WTcrWzF7tXfB9T7MsoadqdI8hmwLq6UlLvtw==}
-    engines: {node: ^20.9.0}
+  '@img/sharp-win32-ia32@0.34.5':
+    resolution: {integrity: sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [ia32]
    os: [win32]

-  '@img/sharp-win32-x64@0.35.4':
-    resolution: {integrity: sha512-XtmnYhBcrORsJ4XJngyzr/EWP0hRZLAZRFaApdKuviyqF78+ylxh2y06ZmtULAMOnObJ3ucpN0AcwSWnMowTRg==}
-    engines: {node: '>=20.9.0'}
+  '@img/sharp-win32-x64@0.34.5':
+    resolution: {integrity: sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
    cpu: [x64]
    os: [win32]

@@ -1246,11 +1232,6 @@ packages:
    engines: {node: '>=6.0.0'}
    hasBin: true

-  baseline-browser-mapping@2.11.20:
-    resolution: {integrity: sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==}
-    engines: {node: '>=6.0.0'}
-    hasBin: true
-
  brace-expansion@1.1.14:
    resolution: {integrity: sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==}

@@ -1265,8 +1246,8 @@ packages:
    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
    engines: {node: '>=8'}

-  browserslist@4.28.8:
-    resolution: {integrity: sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==}
+  browserslist@4.28.2:
+    resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==}
    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
    hasBin: true

@@ -1293,9 +1274,6 @@ packages:
  caniuse-lite@1.0.30001793:
    resolution: {integrity: sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==}

-  caniuse-lite@1.0.30001810:
-    resolution: {integrity: sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==}
-
  chai@5.3.3:
    resolution: {integrity: sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==}
    engines: {node: '>=18'}
@@ -1412,8 +1390,8 @@ packages:
  eastasianwidth@0.2.0:
    resolution: {integrity: sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==}

-  electron-to-chromium@1.5.420:
-    resolution: {integrity: sha512-2yD6XreGusOfNV+dUcvipJEXc3n/n7fgr7996aszTG+YY5E4mqM4tOq/3uhP129cazL9YHbVWSpc79ePotWtPA==}
+  electron-to-chromium@1.5.357:
+    resolution: {integrity: sha512-NHlTIQDK8fmVwHwuIzmXYEJ1Ewq3D9wDNc0cWXxDGysP6Pb21giwGNkxiTifyKy/4SoPuN5l6GLP1W9Sv7zB2g==}

  emoji-regex@8.0.0:
    resolution: {integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==}
@@ -1566,7 +1544,6 @@ packages:
  eslint@9.15.0:
    resolution: {integrity: sha512-7CrWySmIibCgT1Os28lUU6upBshZ+GxybLOrmRzi08kS8MBuO8QA7pXEgYgY5W8vK3e74xv0lpjo9DbaGU9Rkw==}
    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-    deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options.
    hasBin: true
    peerDependencies:
      jiti: '*'
@@ -2168,13 +2145,13 @@ packages:
  natural-compare@1.4.0:
    resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}

-  next-auth@5.0.0-beta.32:
-    resolution: {integrity: sha512-CGlChIEWZ6LltNVxrE5yiySMID+Idpmry47JYA5lLwgD8Sx02a8M65VL0TWVz9nbnOioS/tCW/rP/0+mE7Qp4Q==}
+  next-auth@5.0.0-beta.30:
+    resolution: {integrity: sha512-+c51gquM3F6nMVmoAusRJ7RIoY0K4Ts9HCCwyy/BRoe4mp3msZpOzYMyb5LAYc1wSo74PMQkGDcaghIO7W6Xjg==}
    peerDependencies:
      '@simplewebauthn/browser': ^9.0.1
      '@simplewebauthn/server': ^9.0.2
      next: ^14.0.0-0 || ^15.0.0 || ^16.0.0
-      nodemailer: ^7.0.7 || ^8.0.5
+      nodemailer: ^7.0.7
      react: ^18.2.0 || ^19.0.0
    peerDependenciesMeta:
      '@simplewebauthn/browser':
@@ -2209,9 +2186,8 @@ packages:
    resolution: {integrity: sha512-pyFS63ptit/P5WqUkt+UUfe+4oevH+bFeIiPPdfb0pFeYEu/1ELnJu5l+5EcTKYL5M7zaAa7S8ddywgXypqKCw==}
    engines: {node: '>= 0.4'}

-  node-releases@2.0.54:
-    resolution: {integrity: sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==}
-    engines: {node: '>=18'}
+  node-releases@2.0.44:
+    resolution: {integrity: sha512-5WUyunoPMsvvEhS8AxHtRzP+oA8UCkJ7YRxatWKjngndhDGLiqEVAQKWjFAiAiuL8zMRGzGSJxFnLetoa43qGQ==}

  oauth4webapi@3.8.6:
    resolution: {integrity: sha512-iwemM91xz8nryHti2yTmg5fhyEMVOkOXwHNqbvcATjyajb5oQxCQzrNOA6uElRHuMhQQTKUyFKV9y/CNyg25BQ==}
@@ -2324,8 +2300,12 @@ packages:
    resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
    engines: {node: '>= 0.4'}

-  postcss@8.5.26:
-    resolution: {integrity: sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==}
+  postcss@8.4.31:
+    resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  postcss@8.5.15:
+    resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==}
    engines: {node: ^10 || ^12 || >=14}

  preact-render-to-string@6.5.11:
@@ -2425,11 +2405,6 @@ packages:
    engines: {node: '>=10'}
    hasBin: true

-  semver@7.8.5:
-    resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
-    engines: {node: '>=10'}
-    hasBin: true
-
  set-cookie-parser@3.1.0:
    resolution: {integrity: sha512-kjnC1DXBHcxaOaOXBHBeRtltsDG2nUiUni+jP92M9gYdW12rsmx92UsfpH7o5tDRs7I1ZZPSQJQGv3UaRfCiuw==}

@@ -2445,14 +2420,9 @@ packages:
    resolution: {integrity: sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw==}
    engines: {node: '>= 0.4'}

-  sharp@0.35.4:
-    resolution: {integrity: sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA==}
-    engines: {node: '>=20.9.0'}
-    peerDependencies:
-      '@types/node': '*'
-    peerDependenciesMeta:
-      '@types/node':
-        optional: true
+  sharp@0.34.5:
+    resolution: {integrity: sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}

  shebang-command@2.0.0:
    resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
@@ -2693,11 +2663,11 @@ packages:
  until-async@3.0.2:
    resolution: {integrity: sha512-IiSk4HlzAMqTUseHHe3VhIGyuFmN90zMTpD3Z3y8jeQbzLIq500MVM7Jq2vUAnTKAFPJrqwkzr6PoTcPhGcOiw==}

-  update-browserslist-db@1.3.2:
-    resolution: {integrity: sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==}
+  update-browserslist-db@1.2.3:
+    resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
    hasBin: true
    peerDependencies:
-      browserslist: '>=4.28.7'
+      browserslist: '>= 4.21.0'

  uri-js@4.4.1:
    resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
@@ -2886,7 +2856,7 @@ snapshots:
    dependencies:
      '@babel/compat-data': 7.29.3
      '@babel/helper-validator-option': 7.27.1
-      browserslist: 4.28.8
+      browserslist: 4.28.2
      lru-cache: 5.1.1
      semver: 6.3.1

@@ -2959,11 +2929,6 @@ snapshots:
      tslib: 2.8.1
    optional: true

-  '@emnapi/runtime@1.11.3':
-    dependencies:
-      tslib: 2.8.1
-    optional: true
-
  '@emnapi/wasi-threads@1.2.1':
    dependencies:
      tslib: 2.8.1
@@ -3103,108 +3068,98 @@ snapshots:
  '@img/colour@1.1.0':
    optional: true

-  '@img/sharp-darwin-arm64@0.35.4':
+  '@img/sharp-darwin-arm64@0.34.5':
    optionalDependencies:
-      '@img/sharp-libvips-darwin-arm64': 1.3.3
+      '@img/sharp-libvips-darwin-arm64': 1.2.4
    optional: true

-  '@img/sharp-darwin-x64@0.35.4':
+  '@img/sharp-darwin-x64@0.34.5':
    optionalDependencies:
-      '@img/sharp-libvips-darwin-x64': 1.3.3
+      '@img/sharp-libvips-darwin-x64': 1.2.4
    optional: true

-  '@img/sharp-freebsd-wasm32@0.35.4':
+  '@img/sharp-libvips-darwin-arm64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-darwin-x64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-ppc64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-riscv64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-s390x@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-x64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-arm64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-x64@1.2.4':
+    optional: true
+
+  '@img/sharp-linux-arm64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm64': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-arm@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-ppc64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-ppc64': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-riscv64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-riscv64': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-s390x@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-s390x': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-x64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-x64': 1.2.4
+    optional: true
+
+  '@img/sharp-linuxmusl-arm64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-arm64': 1.2.4
+    optional: true
+
+  '@img/sharp-linuxmusl-x64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-x64': 1.2.4
+    optional: true
+
+  '@img/sharp-wasm32@0.34.5':
    dependencies:
-      '@img/sharp-wasm32': 0.35.4
+      '@emnapi/runtime': 1.10.0
    optional: true

-  '@img/sharp-libvips-darwin-arm64@1.3.3':
+  '@img/sharp-win32-arm64@0.34.5':
    optional: true

-  '@img/sharp-libvips-darwin-x64@1.3.3':
+  '@img/sharp-win32-ia32@0.34.5':
    optional: true

-  '@img/sharp-libvips-linux-arm64@1.3.3':
-    optional: true
-
-  '@img/sharp-libvips-linux-arm@1.3.3':
-    optional: true
-
-  '@img/sharp-libvips-linux-ppc64@1.3.3':
-    optional: true
-
-  '@img/sharp-libvips-linux-riscv64@1.3.3':
-    optional: true
-
-  '@img/sharp-libvips-linux-s390x@1.3.3':
-    optional: true
-
-  '@img/sharp-libvips-linux-x64@1.3.3':
-    optional: true
-
-  '@img/sharp-libvips-linuxmusl-arm64@1.3.3':
-    optional: true
-
-  '@img/sharp-libvips-linuxmusl-x64@1.3.3':
-    optional: true
-
-  '@img/sharp-linux-arm64@0.35.4':
-    optionalDependencies:
-      '@img/sharp-libvips-linux-arm64': 1.3.3
-    optional: true
-
-  '@img/sharp-linux-arm@0.35.4':
-    optionalDependencies:
-      '@img/sharp-libvips-linux-arm': 1.3.3
-    optional: true
-
-  '@img/sharp-linux-ppc64@0.35.4':
-    optionalDependencies:
-      '@img/sharp-libvips-linux-ppc64': 1.3.3
-    optional: true
-
-  '@img/sharp-linux-riscv64@0.35.4':
-    optionalDependencies:
-      '@img/sharp-libvips-linux-riscv64': 1.3.3
-    optional: true
-
-  '@img/sharp-linux-s390x@0.35.4':
-    optionalDependencies:
-      '@img/sharp-libvips-linux-s390x': 1.3.3
-    optional: true
-
-  '@img/sharp-linux-x64@0.35.4':
-    optionalDependencies:
-      '@img/sharp-libvips-linux-x64': 1.3.3
-    optional: true
-
-  '@img/sharp-linuxmusl-arm64@0.35.4':
-    optionalDependencies:
-      '@img/sharp-libvips-linuxmusl-arm64': 1.3.3
-    optional: true
-
-  '@img/sharp-linuxmusl-x64@0.35.4':
-    optionalDependencies:
-      '@img/sharp-libvips-linuxmusl-x64': 1.3.3
-    optional: true
-
-  '@img/sharp-wasm32@0.35.4':
-    dependencies:
-      '@emnapi/runtime': 1.11.3
-    optional: true
-
-  '@img/sharp-webcontainers-wasm32@0.35.4':
-    dependencies:
-      '@img/sharp-wasm32': 0.35.4
-    optional: true
-
-  '@img/sharp-win32-arm64@0.35.4':
-    optional: true
-
-  '@img/sharp-win32-ia32@0.35.4':
-    optional: true
-
-  '@img/sharp-win32-x64@0.35.4':
+  '@img/sharp-win32-x64@0.34.5':
    optional: true

  '@inquirer/ansi@2.0.7': {}
@@ -3491,7 +3446,7 @@ snapshots:
      '@alloc/quick-lru': 5.2.0
      '@tailwindcss/node': 4.3.0
      '@tailwindcss/oxide': 4.3.0
-      postcss: 8.5.26
+      postcss: 8.5.15
      tailwindcss: 4.3.0

  '@tybys/wasm-util@0.10.2':
@@ -3857,8 +3812,6 @@ snapshots:

  baseline-browser-mapping@2.10.31: {}

-  baseline-browser-mapping@2.11.20: {}
-
  brace-expansion@1.1.14:
    dependencies:
      balanced-match: 1.0.2
@@ -3876,13 +3829,13 @@ snapshots:
    dependencies:
      fill-range: 7.1.1

-  browserslist@4.28.8:
+  browserslist@4.28.2:
    dependencies:
-      baseline-browser-mapping: 2.11.20
-      caniuse-lite: 1.0.30001810
-      electron-to-chromium: 1.5.420
-      node-releases: 2.0.54
-      update-browserslist-db: 1.3.2(browserslist@4.28.8)
+      baseline-browser-mapping: 2.10.31
+      caniuse-lite: 1.0.30001793
+      electron-to-chromium: 1.5.357
+      node-releases: 2.0.44
+      update-browserslist-db: 1.2.3(browserslist@4.28.2)

  cac@6.7.14: {}

@@ -3907,8 +3860,6 @@ snapshots:

  caniuse-lite@1.0.30001793: {}

-  caniuse-lite@1.0.30001810: {}
-
  chai@5.3.3:
    dependencies:
      assertion-error: 2.0.1
@@ -4018,7 +3969,7 @@ snapshots:

  eastasianwidth@0.2.0: {}

-  electron-to-chromium@1.5.420: {}
+  electron-to-chromium@1.5.357: {}

  emoji-regex@8.0.0: {}

@@ -4453,9 +4404,9 @@ snapshots:

  functions-have-names@1.2.3: {}

-  geist@1.7.2(next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(@types/node@20.16.10)(react-dom@19.0.0(react@19.0.0))(react@19.0.0)):
+  geist@1.7.2(next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0)):
    dependencies:
-      next: 16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(@types/node@20.16.10)(react-dom@19.0.0(react@19.0.0))(react@19.0.0)
+      next: 16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0)

  generator-function@2.0.1: {}

@@ -4922,19 +4873,19 @@ snapshots:

  natural-compare@1.4.0: {}

-  next-auth@5.0.0-beta.32(next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(@types/node@20.16.10)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0):
+  next-auth@5.0.0-beta.30(next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0):
    dependencies:
      '@auth/core': 0.41.3
-      next: 16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(@types/node@20.16.10)(react-dom@19.0.0(react@19.0.0))(react@19.0.0)
+      next: 16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0)
      react: 19.0.0

-  next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(@types/node@20.16.10)(react-dom@19.0.0(react@19.0.0))(react@19.0.0):
+  next@16.2.11(@babel/core@7.29.0)(@playwright/test@1.60.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0):
    dependencies:
      '@next/env': 16.2.11
      '@swc/helpers': 0.5.15
      baseline-browser-mapping: 2.10.31
      caniuse-lite: 1.0.30001793
-      postcss: 8.5.26
+      postcss: 8.4.31
      react: 19.0.0
      react-dom: 19.0.0(react@19.0.0)
      styled-jsx: 5.1.6(@babel/core@7.29.0)(react@19.0.0)
@@ -4948,10 +4899,9 @@ snapshots:
      '@next/swc-win32-arm64-msvc': 16.2.11
      '@next/swc-win32-x64-msvc': 16.2.11
      '@playwright/test': 1.60.0
-      sharp: 0.35.4(@types/node@20.16.10)
+      sharp: 0.34.5
    transitivePeerDependencies:
      - '@babel/core'
-      - '@types/node'
      - babel-plugin-macros

  node-exports-info@1.6.0:
@@ -4961,7 +4911,7 @@ snapshots:
      object.entries: 1.1.9
      semver: 6.3.1

-  node-releases@2.0.54: {}
+  node-releases@2.0.44: {}

  oauth4webapi@3.8.6: {}

@@ -5071,7 +5021,13 @@ snapshots:

  possible-typed-array-names@1.1.0: {}

-  postcss@8.5.26:
+  postcss@8.4.31:
+    dependencies:
+      nanoid: 6.0.1
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  postcss@8.5.15:
    dependencies:
      nanoid: 6.0.1
      picocolors: 1.1.1
@@ -5203,9 +5159,6 @@ snapshots:

  semver@7.8.0: {}

-  semver@7.8.5:
-    optional: true
-
  set-cookie-parser@3.1.0: {}

  set-function-length@1.2.2:
@@ -5230,38 +5183,36 @@ snapshots:
      es-errors: 1.3.0
      es-object-atoms: 1.1.1

-  sharp@0.35.4(@types/node@20.16.10):
+  sharp@0.34.5:
    dependencies:
      '@img/colour': 1.1.0
      detect-libc: 2.1.2
-      semver: 7.8.5
+      semver: 7.8.0
    optionalDependencies:
-      '@img/sharp-darwin-arm64': 0.35.4
-      '@img/sharp-darwin-x64': 0.35.4
-      '@img/sharp-freebsd-wasm32': 0.35.4
-      '@img/sharp-libvips-darwin-arm64': 1.3.3
-      '@img/sharp-libvips-darwin-x64': 1.3.3
-      '@img/sharp-libvips-linux-arm': 1.3.3
-      '@img/sharp-libvips-linux-arm64': 1.3.3
-      '@img/sharp-libvips-linux-ppc64': 1.3.3
-      '@img/sharp-libvips-linux-riscv64': 1.3.3
-      '@img/sharp-libvips-linux-s390x': 1.3.3
-      '@img/sharp-libvips-linux-x64': 1.3.3
-      '@img/sharp-libvips-linuxmusl-arm64': 1.3.3
-      '@img/sharp-libvips-linuxmusl-x64': 1.3.3
-      '@img/sharp-linux-arm': 0.35.4
-      '@img/sharp-linux-arm64': 0.35.4
-      '@img/sharp-linux-ppc64': 0.35.4
-      '@img/sharp-linux-riscv64': 0.35.4
-      '@img/sharp-linux-s390x': 0.35.4
-      '@img/sharp-linux-x64': 0.35.4
-      '@img/sharp-linuxmusl-arm64': 0.35.4
-      '@img/sharp-linuxmusl-x64': 0.35.4
-      '@img/sharp-webcontainers-wasm32': 0.35.4
-      '@img/sharp-win32-arm64': 0.35.4
-      '@img/sharp-win32-ia32': 0.35.4
-      '@img/sharp-win32-x64': 0.35.4
-      '@types/node': 20.16.10
+      '@img/sharp-darwin-arm64': 0.34.5
+      '@img/sharp-darwin-x64': 0.34.5
+      '@img/sharp-libvips-darwin-arm64': 1.2.4
+      '@img/sharp-libvips-darwin-x64': 1.2.4
+      '@img/sharp-libvips-linux-arm': 1.2.4
+      '@img/sharp-libvips-linux-arm64': 1.2.4
+      '@img/sharp-libvips-linux-ppc64': 1.2.4
+      '@img/sharp-libvips-linux-riscv64': 1.2.4
+      '@img/sharp-libvips-linux-s390x': 1.2.4
+      '@img/sharp-libvips-linux-x64': 1.2.4
+      '@img/sharp-libvips-linuxmusl-arm64': 1.2.4
+      '@img/sharp-libvips-linuxmusl-x64': 1.2.4
+      '@img/sharp-linux-arm': 0.34.5
+      '@img/sharp-linux-arm64': 0.34.5
+      '@img/sharp-linux-ppc64': 0.34.5
+      '@img/sharp-linux-riscv64': 0.34.5
+      '@img/sharp-linux-s390x': 0.34.5
+      '@img/sharp-linux-x64': 0.34.5
+      '@img/sharp-linuxmusl-arm64': 0.34.5
+      '@img/sharp-linuxmusl-x64': 0.34.5
+      '@img/sharp-wasm32': 0.34.5
+      '@img/sharp-win32-arm64': 0.34.5
+      '@img/sharp-win32-ia32': 0.34.5
+      '@img/sharp-win32-x64': 0.34.5
    optional: true

  shebang-command@2.0.0:
@@ -5552,9 +5503,9 @@ snapshots:

  until-async@3.0.2: {}

-  update-browserslist-db@1.3.2(browserslist@4.28.8):
+  update-browserslist-db@1.2.3(browserslist@4.28.2):
    dependencies:
-      browserslist: 4.28.8
+      browserslist: 4.28.2
      escalade: 3.2.0
      picocolors: 1.1.1

@@ -5583,7 +5534,7 @@ snapshots:
  vite@5.4.21(@types/node@20.16.10)(lightningcss@1.32.0):
    dependencies:
      esbuild: 0.21.5
-      postcss: 8.5.26
+      postcss: 8.5.15
      rollup: 4.60.4
    optionalDependencies:
      '@types/node': 20.16.10
@@ -107,22 +107,13 @@ export default async function ProductsPage({
        title="Findings across products"
        tail={
          <span className="row" style={{ gap: 6 }}>
-            {/* Derived from the tenant's own products, not a hard-coded list —
-                a hard-coded id (e.g. "compliance-scanner") silently filters to
-                nothing when the registry calls the product something else. */}
-            <Link
-              href={`/${slug}/products`}
-              className={"btn btn-sm" + (productFilter === "all" ? " btn-primary" : "")}
-            >
-              All
-            </Link>
-            {t.products.map((p) => (
+            {["all", "compliance-scanner", "certifai"].map((o) => (
              <Link
-                key={p.id}
-                href={`/${slug}/products?p=${p.slug}`}
-                className={"btn btn-sm" + (productFilter === p.slug ? " btn-primary" : "")}
+                key={o}
+                href={o === "all" ? `/${slug}/products` : `/${slug}/products?p=${o}`}
+                className={"btn btn-sm" + (productFilter === o ? " btn-primary" : "")}
              >
-                {p.name}
+                {o === "all" ? "All" : o === "certifai" ? "CERTifAI" : "Scanner"}
              </Link>
            ))}
          </span>
@@ -10,51 +10,11 @@
 // Once the registry is enriched to carry the design fields end-to-end this
 // module collapses into a thin pass-through.

-import { tenantBySlug, type ProductDef, type TenantRecord } from "@/lib/fixtures";
-import {
-  fetchCatalog,
-  fetchEntitlements,
-  fetchTenantBySlug,
-  type CatalogEntry,
-  type Entitlement,
-  type Tenant,
-} from "@/lib/tenant-registry";
+import { tenantBySlug, type TenantRecord } from "@/lib/fixtures";
+import { fetchTenantBySlug, type Tenant } from "@/lib/tenant-registry";

 export type PortalTenant = TenantRecord;

-/** Registry catalog entry -> the shape the product screens render.
- *
- * The registry `key` becomes both `id` and `slug`, deliberately. The screens
- * compare `entitled.includes(p.id)`, and `entitled` is built from the SAME
- * registry keys below — so the two sides cannot drift apart. Hard-coding a
- * product list here is what previously made a real entitlement (`compliance`)
- * fail to match a hand-written product id (`compliance-scanner`).
- *
- * `frameworks` is empty because the registry contract does not carry it
- * (PRODUCT_INTEGRATION_SPEC has products publish a manifest later); the UI
- * already renders an empty list without complaint.
- */
-function productFromCatalog(entry: CatalogEntry): ProductDef {
-  return {
-    id: entry.key,
-    slug: entry.key,
-    name: entry.name,
-    mono: entry.name.replace(/[^A-Za-z]/g, "").slice(0, 2).toUpperCase() || "??",
-    status: "live",
-    blurb: entry.description,
-    frameworks: [],
-  };
-}
-
-/** Entitlements the tenant may actually use right now. */
-function activeEntitlements(items: Entitlement[], nowMs: number): Entitlement[] {
-  return items.filter((e) => {
-    if (!e.enabled) return false;
-    if (!e.expires_at) return true;
-    return new Date(e.expires_at).getTime() > nowMs;
-  });
-}
-
 export async function loadTenantForShell(slug: string): Promise<PortalTenant | null> {
  const fx = tenantBySlug(slug);
  if (fx) return fx;
@@ -70,26 +30,6 @@ export async function loadTenantForShell(slug: string): Promise<PortalTenant | n
  }
  if (!live) return null;

-  // Entitlements and catalog are what make a started trial actually show as
-  // entitled. Both are best-effort: the shell must still render if the
-  // registry answers the tenant but not these, so a failure degrades to an
-  // empty product grid rather than a 404 on the whole page.
-  const now = Date.now();
-  const [catalog, entitlements] = await Promise.all([
-    fetchCatalog().catch(() => [] as CatalogEntry[]),
-    fetchEntitlements(live.id).catch(() => [] as Entitlement[]),
-  ]);
-  const active = activeEntitlements(entitlements, now);
-  const entitled = active.map((e) => e.product);
-  const trialing = active
-    .filter((e) => Boolean(e.expires_at))
-    .map((e) => e.product);
-  // Show the catalog, with the entitled ones first so the grid leads with what
-  // the tenant can actually open.
-  const products = catalog
-    .map(productFromCatalog)
-    .sort((a, b) => Number(entitled.includes(b.id)) - Number(entitled.includes(a.id)));
-
  // Minimal shim so the shell can render. Design-rich fields fall back to
  // placeholders that won't blow up the layout.
  return {
@@ -111,12 +51,12 @@ export async function loadTenantForShell(slug: string): Promise<PortalTenant | n
    contactEmail: "—",
    renewal: "—",
    since: live.created_at?.slice(0, 10) ?? "—",
-    entitled,
-    trialing,
+    entitled: [],
+    trialing: [],
    trialEnds: live.trial_ends_at ?? undefined,
    seed: 0,
    findingCount: 0,
-    products,
+    products: [],
    findings: [],
    activity: [],
    audit: [],