chore: update translations

Co-authored-by: Crowdin Bot <support+bot@crowdin.com>

.design-sync/NOTES.md

@@ -0,0 +1,55 @@
+# design-sync notes — @reactive-resume/ui
+
+Syncs to Claude Design project **Reactive Resume** (`3c0f6556-050a-41e5-9886-c3f1ea950517`).
+
+## Repo shape / build
+
+- `@reactive-resume/ui` is **source-consumed** (pnpm workspace, no `dist`, exports point at `src/components/*.tsx`). Runs in the converter's **synth-entry mode** (no `--entry`).
+- `buildCmd` = `node .design-sync/build-css.mjs`. That one script does three things, all required before every converter run:
+  1. Creates the workspace **self-symlink** `packages/ui/node_modules/@reactive-resume/ui -> ../../../ui` (pnpm doesn't self-install it; the converter resolves the DS as `node_modules/<pkg>` and esbuild needs it for `@reactive-resume/ui/components/*` self-imports).
+  2. Emits real **`.d.ts`** to `packages/ui/dist/types` via `tsc -p packages/ui/tsconfig.emit.json`. Without this, synth-entry mode gives weak `{[key]: unknown}` prop contracts; with it the converter's `findTypesRoot` picks up `dist/types` and every component gets real props (variant/size unions, inherited Base UI props).
+  3. Compiles Tailwind v4 `globals.css` → self-contained `packages/ui/.ds-compiled.css` (`cfg.cssEntry`): inlines the IBM Plex Sans latin variable woff2 as a data-URI and strips all other `@font-face` (extra scripts + the Phosphor icon web font, which previews don't use — components render Phosphor as inline React SVGs). This is why previews are fully styled with tokens + brand font and there are zero dangling font URLs.
+- CSS entry scans `.design-sync/tw-entry.css` which `@import`s globals.css and adds `@source "./previews/*.tsx"` so utility classes used in authored previews are compiled. **Preview layout wrappers use inline styles** anyway (so subagents needn't recompile the shared CSS); only component-level utility classes need the recompile.
+
+## Card scope
+
+- The package exports **202 symbols** (39 primary components + 163 compound sub-parts). User chose **~40 primary cards**: `cfg.componentSrcMap` nulls the 163 sub-parts. All 202 stay importable from `window.RRUI` (the bundle exports everything regardless of the card list), so previews compose sub-parts (`RRUI.DialogContent`, etc.) freely.
+- Multi-primary files represented by one card: `combobox.tsx`→ComboboxRoot, `form.tsx`→FormItem, `resizable.tsx`→ResizableGroup, `sonner.tsx`→Toaster.
+
+## Preview authoring conventions (calibrated on Button / Alert / Dialog)
+
+- Import naturally: `import { Button } from "@reactive-resume/ui/components/button"` — converter rule 2 redirects any exported-component module to `window.RRUI`, and sub-parts resolve too.
+- Icons: `@phosphor-icons/react` with the `*Icon` suffix (e.g. `PlusIcon`, `TrashIcon`, `WarningIcon`). Bundles into the preview.
+- Base UI compose pattern: `render={<Button variant="outline" />}` on `*.Trigger` / `*.Close` etc.
+- Layout wrappers: inline `style={{ display:"flex", gap, padding }}` — not Tailwind (keeps fan-out from needing CSS recompiles).
+- **Overlays** (Dialog, and expect the same for AlertDialog/Sheet/Popover/HoverCard/DropdownMenu/ContextMenu/Tooltip/Command-dialog): render open via `defaultOpen`, and set `cfg.overrides.<Name> = {cardMode:"single", primaryStory:"<export>", viewport:"WxH"}`. Use viewport width ≥ 640 so `sm:` breakpoint styles (e.g. horizontal dialog footer) engage — Dialog uses `760x440`.
+- Realistic resume-app content (resumes, sections, publish/export/share), never foo/bar.
+
+## Component composition notes (from the authoring wave)
+
+- **Real `.d.ts` contracts require the barrel** (see build step 2 + `publishConfig.types`). Base UI prop names differ from Radix/native: Switch `defaultChecked`+`size`; Toggle `defaultPressed`+`variant`+`size`; Slider `defaultValue` array (`[n]` single / `[a,b]` range). Use uncontrolled `default*` props in previews to avoid controlled-without-onChange warnings.
+- **BrandIcon renders the app's own logo/icon** (`variant="logo"|"icon"`), NOT a social/brand-slug icon. It `<img src>`s `/logo/*.svg` + `/icon/*.svg`, which the preview server (serving `ds-bundle/`) 404s. The BrandIcon preview inlines the real `apps/web/public/{logo,icon}/light.svg` as base64 `src` overrides (component spreads `{...props}` after its own `src`, so the override wins).
+- **Overlays** handled by the orchestrator with `cfg.overrides` (cardMode single + primaryStory Open + viewport): Dialog, AlertDialog, Sheet, Popover, Tooltip, HoverCard, DropdownMenu, ContextMenu, ComboboxRoot. Command renders **inline** (cmdk, no overlay); Sidebar uses `collapsible="none"` to render inline (default offcanvas is fixed-positioned); Toaster fires a `duration:Infinity` toast on mount.
+- **Providers composed in-preview** (no cfg.provider): Tooltip→TooltipProvider, Sidebar→SidebarProvider, MessageScroller→MessageScrollerProvider (+ explicit container height — Root is `size-full min-h-0` and collapses otherwise), FormItem carries its own context.
+- **Accordion** opens statically via `defaultValue={[...itemValues]}` (the `--accordion-panel-height` warn is a non-issue — panels measure fine). **Tabs** via `defaultValue`. **ScrollArea/ResizableGroup/InputGroup** need an inline container height/width. **Separator** vertical needs an explicit height.
+- Chat/attachment components (Attachment, Bubble, Message, MessageScroller, Marker) are all used only in `apps/web/src/routes/agent/-components/agent-chat.tsx` — the canonical composition source.
+
+## Build/verify gotchas (learned the hard way)
+
+- **A full `package-build` takes ~3-4 minutes** — not a hang. `@phosphor-icons/react` is a giant barrel, so each icon-importing preview costs ~10-20s of esbuild parse, and 30+ authored previews compile serially. Always run it in a real background task (not a 120s-capped foreground shell) and wait for completion.
+- **Do NOT add a barrel `index.d.ts` + `publishConfig.types`** to get rich props for inline-param-typed components: it makes ts-morph resolve all 200+ inline Base UI param types and hangs the build for many minutes. Tried and reverted. Result: components with a named `<Name>Props` source type (Button) get real props; the rest get honest `{[key]: unknown}`.
+- **Base UI menu Labels must be inside a Group**: `DropdownMenuLabel`/`ContextMenuLabel` throw `MenuGroupContext is missing` unless wrapped in `DropdownMenuGroup`/`ContextMenuGroup`. Same likely for other `*Label`/`*GroupLabel` menu parts.
+- **`[RENDER_THIN]` (height 0px) is benign for fixed-position overlays** (Dialog, AlertDialog, Sheet): the content is `position:fixed` so it measures 0 in normal flow, but `rootEmpty:false` and the screenshot is correct. Confirmed via review sheets — not a failure.
+- **`[GRID_OVERFLOW]` wide** → `cfg.overrides.<Name> = {cardMode:"column"}` applied to: Accordion, Attachment, Bubble, FormItem, InputGroup, Marker, Message, ResizableGroup, Tabs, Textarea. Toaster (portal escape) → `{cardMode:"single", primaryStory:"Notification"}`.
+
+## Known render warns (triaged, not failures)
+
+- `[TOKENS_MISSING]`: `--active-tab-{top,left,height,width}` (Base UI tab indicator sets these at runtime), `--accordion-panel-height` (Base UI accordion runtime), `--tw` (Tailwind internal), plus app-level `--resume-preview-page-gap` / `--page-primary-color` (defined by apps/web, not this package). All expected absent from the shipped stylesheet — components set them at runtime. Do not chase.
+- `--font-heading` is referenced (DialogTitle `font-heading`) but not defined in the UI package tokens (app-level). Falls back to `--font-body` (IBM Plex). Cosmetic only.
+- Unauthored primitives render near-empty floor cards (`[RENDER_BLANK]` for empty Button/Input/etc.) — resolved once authored.
+
+## Re-sync risks
+
+- `packages/ui/dist/types`, `packages/ui/.ds-compiled.css`, `packages/ui/.ds-tw-raw.css`, and the self-symlink are all gitignored build artifacts regenerated by `buildCmd` — always run `node .design-sync/build-css.mjs` before the converter/driver.
+- The inlined IBM Plex font path in `build-css.mjs` is pinned to `@fontsource-variable/ibm-plex-sans/files/ibm-plex-sans-latin-wght-normal.woff2`; if that dep moves, the font inline breaks (previews fall back to system sans).
+- `tsconfig.emit.json` is committed; if the package adds a real build later, prefer pointing the converter at that dist and drop the emit step.

.design-sync/build-css.mjs

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+// design-sync CSS build: compile the UI package's Tailwind v4 globals.css to
+// static CSS, then make it self-contained for preview rendering by inlining the
+// IBM Plex Sans (latin) variable webfont as a data-URI and dropping the other
+// @font-face rules (extra scripts + the Phosphor icon font, which previews
+// don't use — components render Phosphor as inline React SVGs).
+//
+// Output: packages/ui/.ds-compiled.css  (cfg.cssEntry, bounded to the package)
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const repo = resolve(here, "..");
+
+// pnpm doesn't self-install the workspace package into its own node_modules,
+// but the design-sync converter resolves the DS as node_modules/<pkg>. Create
+// the self-symlink so PKG_DIR resolves and esbuild finds @reactive-resume/ui/*
+// self-imports. Mirrors the sibling symlinks pnpm already writes (utils, config).
+const selfLink = resolve(repo, "packages/ui/node_modules/@reactive-resume/ui");
+if (!existsSync(selfLink)) symlinkSync("../../../ui", selfLink);
+
+// Emit real .d.ts declarations (the package is source-consumed with no build).
+// The converter's findTypesRoot picks up dist/types, giving components real
+// prop contracts (variant/size unions, inherited Base UI props) instead of the
+// weak `{[key]: unknown}` synth-entry fallback.
+execFileSync(resolve(repo, "node_modules/.bin/tsc"), ["-p", "tsconfig.emit.json"], {
+	cwd: resolve(repo, "packages/ui"),
+	stdio: "inherit",
+});
+// NOTE: a barrel index.d.ts + publishConfig.types was tried to give the prop
+// extractor an entry for components with inline param types — but resolving all
+// 200+ inline Base UI param types through ts-morph's checker hangs the build
+// (many minutes). Reverted. Components with a named <Name>Props source type
+// (e.g. Button) still extract real props from dist/types; the rest fall back to
+// the honest `{[key]: unknown}` contract, with usage carried by the preview +
+// .prompt.md. See .design-sync/NOTES.md "Re-sync risks".
+const cli = resolve(repo, ".ds-sync/node_modules/.bin/tailwindcss");
+const entry = resolve(here, "tw-entry.css");
+const tmp = resolve(repo, "packages/ui/.ds-tw-raw.css");
+const out = resolve(repo, "packages/ui/.ds-compiled.css");
+const font = resolve(
+	repo,
+	"packages/ui/node_modules/@fontsource-variable/ibm-plex-sans/files/ibm-plex-sans-latin-wght-normal.woff2",
+);
+
+execFileSync(cli, ["-i", entry, "-o", tmp], { stdio: "inherit" });
+
+let css = readFileSync(tmp, "utf8");
+css = css.replace(/@font-face\s*\{[^}]*\}/g, ""); // drop all shipped @font-face
+const b64 = readFileSync(font).toString("base64");
+const face = `@font-face{font-family:"IBM Plex Sans Variable";font-style:normal;font-weight:100 700;font-display:swap;src:url(data:font/woff2;base64,${b64}) format("woff2-variations")}\n`;
+writeFileSync(out, face + css);
+console.error(`  build-css: wrote ${out} (${(Buffer.byteLength(face + css) / 1024).toFixed(0)} KB, font inlined)`);

.design-sync/config.json

@@ -0,0 +1,256 @@
+{
+	"projectId": "3c0f6556-050a-41e5-9886-c3f1ea950517",
+	"pkg": "@reactive-resume/ui",
+	"globalName": "RRUI",
+	"shape": "package",
+	"buildCmd": "node .design-sync/build-css.mjs",
+	"tsconfig": "tsconfig.json",
+	"cssEntry": ".ds-compiled.css",
+	"componentSrcMap": {
+		"AccordionContent": null,
+		"AccordionItem": null,
+		"AccordionTrigger": null,
+		"AlertAction": null,
+		"AlertDescription": null,
+		"AlertDialogAction": null,
+		"AlertDialogCancel": null,
+		"AlertDialogContent": null,
+		"AlertDialogDescription": null,
+		"AlertDialogFooter": null,
+		"AlertDialogHeader": null,
+		"AlertDialogMedia": null,
+		"AlertDialogOverlay": null,
+		"AlertDialogPortal": null,
+		"AlertDialogTitle": null,
+		"AlertDialogTrigger": null,
+		"AlertTitle": null,
+		"AttachmentAction": null,
+		"AttachmentActions": null,
+		"AttachmentContent": null,
+		"AttachmentDescription": null,
+		"AttachmentGroup": null,
+		"AttachmentMedia": null,
+		"AttachmentTitle": null,
+		"AttachmentTrigger": null,
+		"AvatarBadge": null,
+		"AvatarFallback": null,
+		"AvatarGroup": null,
+		"AvatarGroupCount": null,
+		"AvatarImage": null,
+		"BubbleContent": null,
+		"BubbleGroup": null,
+		"BubbleReactions": null,
+		"ButtonGroupSeparator": null,
+		"ButtonGroupText": null,
+		"ComboboxChip": null,
+		"ComboboxChips": null,
+		"ComboboxChipsInput": null,
+		"ComboboxClear": null,
+		"ComboboxCollection": null,
+		"ComboboxContent": null,
+		"ComboboxEmpty": null,
+		"ComboboxGroup": null,
+		"ComboboxInput": null,
+		"ComboboxItem": null,
+		"ComboboxLabel": null,
+		"ComboboxList": null,
+		"ComboboxSeparator": null,
+		"ComboboxTrigger": null,
+		"ComboboxValue": null,
+		"CommandDialog": null,
+		"CommandEmpty": null,
+		"CommandGroup": null,
+		"CommandInput": null,
+		"CommandItem": null,
+		"CommandList": null,
+		"CommandSeparator": null,
+		"CommandShortcut": null,
+		"ContextMenuCheckboxItem": null,
+		"ContextMenuContent": null,
+		"ContextMenuGroup": null,
+		"ContextMenuItem": null,
+		"ContextMenuLabel": null,
+		"ContextMenuPortal": null,
+		"ContextMenuRadioGroup": null,
+		"ContextMenuRadioItem": null,
+		"ContextMenuSeparator": null,
+		"ContextMenuShortcut": null,
+		"ContextMenuSub": null,
+		"ContextMenuSubContent": null,
+		"ContextMenuSubTrigger": null,
+		"ContextMenuTrigger": null,
+		"DialogClose": null,
+		"DialogContent": null,
+		"DialogDescription": null,
+		"DialogFooter": null,
+		"DialogHeader": null,
+		"DialogOverlay": null,
+		"DialogPortal": null,
+		"DialogTitle": null,
+		"DialogTrigger": null,
+		"DropdownMenuCheckboxItem": null,
+		"DropdownMenuContent": null,
+		"DropdownMenuGroup": null,
+		"DropdownMenuItem": null,
+		"DropdownMenuLabel": null,
+		"DropdownMenuPortal": null,
+		"DropdownMenuRadioGroup": null,
+		"DropdownMenuRadioItem": null,
+		"DropdownMenuSeparator": null,
+		"DropdownMenuShortcut": null,
+		"DropdownMenuSub": null,
+		"DropdownMenuSubContent": null,
+		"DropdownMenuSubTrigger": null,
+		"DropdownMenuTrigger": null,
+		"FormControl": null,
+		"FormDescription": null,
+		"FormLabel": null,
+		"FormMessage": null,
+		"HoverCardContent": null,
+		"HoverCardTrigger": null,
+		"InputGroupAddon": null,
+		"InputGroupButton": null,
+		"InputGroupInput": null,
+		"InputGroupText": null,
+		"InputGroupTextarea": null,
+		"KbdGroup": null,
+		"MarkerContent": null,
+		"MarkerIcon": null,
+		"MessageAvatar": null,
+		"MessageContent": null,
+		"MessageFooter": null,
+		"MessageGroup": null,
+		"MessageHeader": null,
+		"MessageScrollerButton": null,
+		"MessageScrollerContent": null,
+		"MessageScrollerItem": null,
+		"MessageScrollerProvider": null,
+		"MessageScrollerViewport": null,
+		"PopoverContent": null,
+		"PopoverDescription": null,
+		"PopoverHeader": null,
+		"PopoverTitle": null,
+		"PopoverTrigger": null,
+		"ResizablePanel": null,
+		"ResizableSeparator": null,
+		"ScrollBar": null,
+		"SheetClose": null,
+		"SheetContent": null,
+		"SheetDescription": null,
+		"SheetFooter": null,
+		"SheetHeader": null,
+		"SheetTitle": null,
+		"SheetTrigger": null,
+		"SidebarContent": null,
+		"SidebarFooter": null,
+		"SidebarGroup": null,
+		"SidebarGroupAction": null,
+		"SidebarGroupContent": null,
+		"SidebarGroupLabel": null,
+		"SidebarHeader": null,
+		"SidebarInput": null,
+		"SidebarInset": null,
+		"SidebarMenu": null,
+		"SidebarMenuAction": null,
+		"SidebarMenuBadge": null,
+		"SidebarMenuButton": null,
+		"SidebarMenuItem": null,
+		"SidebarMenuSkeleton": null,
+		"SidebarMenuSub": null,
+		"SidebarMenuSubButton": null,
+		"SidebarMenuSubItem": null,
+		"SidebarProvider": null,
+		"SidebarRail": null,
+		"SidebarSeparator": null,
+		"SidebarTrigger": null,
+		"TabsContent": null,
+		"TabsIndicator": null,
+		"TabsList": null,
+		"TabsTrigger": null,
+		"TooltipContent": null,
+		"TooltipProvider": null,
+		"TooltipTrigger": null
+	},
+	"overrides": {
+		"Dialog": {
+			"cardMode": "single",
+			"primaryStory": "Open",
+			"viewport": "760x440"
+		},
+		"AlertDialog": {
+			"cardMode": "single",
+			"primaryStory": "Open",
+			"viewport": "640x460"
+		},
+		"Sheet": {
+			"cardMode": "single",
+			"primaryStory": "Open",
+			"viewport": "760x480"
+		},
+		"Popover": {
+			"cardMode": "single",
+			"primaryStory": "Open",
+			"viewport": "420x340"
+		},
+		"Tooltip": {
+			"cardMode": "single",
+			"primaryStory": "Open",
+			"viewport": "360x260"
+		},
+		"HoverCard": {
+			"cardMode": "single",
+			"primaryStory": "Open",
+			"viewport": "440x320"
+		},
+		"DropdownMenu": {
+			"cardMode": "single",
+			"primaryStory": "Open",
+			"viewport": "440x360"
+		},
+		"ContextMenu": {
+			"cardMode": "single",
+			"primaryStory": "Open",
+			"viewport": "440x340"
+		},
+		"ComboboxRoot": {
+			"cardMode": "single",
+			"primaryStory": "Open",
+			"viewport": "420x360"
+		},
+		"Accordion": {
+			"cardMode": "column"
+		},
+		"Attachment": {
+			"cardMode": "column"
+		},
+		"Bubble": {
+			"cardMode": "column"
+		},
+		"FormItem": {
+			"cardMode": "column"
+		},
+		"InputGroup": {
+			"cardMode": "column"
+		},
+		"Marker": {
+			"cardMode": "column"
+		},
+		"Message": {
+			"cardMode": "column"
+		},
+		"ResizableGroup": {
+			"cardMode": "column"
+		},
+		"Tabs": {
+			"cardMode": "column"
+		},
+		"Textarea": {
+			"cardMode": "column"
+		},
+		"Toaster": {
+			"cardMode": "single",
+			"primaryStory": "Notification"
+		}
+	},
+	"readmeHeader": ".design-sync/conventions.md"
+}

.design-sync/conventions.md

@@ -0,0 +1,60 @@
+# Reactive Resume UI — how to build with it
+
+This is `@reactive-resume/ui`: a shadcn-style React component library built on **Base UI**
+primitives and **Tailwind CSS v4**. Every component is real upstream code, bundled to the
+`window.RRUI` global; the 39 cards are the primary components, but all their compound
+sub-parts (e.g. `DialogContent`, `AccordionItem`, `SidebarMenuButton`) are also on `RRUI`.
+
+## Setup & wrapping
+
+- **No global provider is required.** All design tokens live on `:root` in `styles.css` (loaded
+  for you), so components are styled out of the box. For dark mode, add `class="dark"` to a
+  wrapping element — the same tokens flip to their dark values.
+- **A few components need their own provider — wrap only where you use them:**
+  - `Tooltip*` → wrap in `RRUI.TooltipProvider`.
+  - `Sidebar*` → wrap in `RRUI.SidebarProvider`.
+  - `MessageScroller*` → wrap in `RRUI.MessageScrollerProvider` and give it a bounded height.
+  - Form fields → `RRUI.FormItem` provides the field context for `FormLabel`/`FormControl`/`FormMessage`.
+- **Compose compound components** from their parts, e.g. `Dialog` = `DialogTrigger` + `DialogContent`
+  (+ `DialogHeader`/`DialogTitle`/`DialogDescription`/`DialogFooter`). Overlay parts (Dialog, Sheet,
+  Popover, DropdownMenu, ContextMenu, Tooltip, HoverCard) render into a portal. Menu labels must sit
+  inside a `*Group` (`DropdownMenuGroup`, `ContextMenuGroup`).
+- Icons come from `@phosphor-icons/react` (the `*Icon` suffix, e.g. `PlusIcon`).
+
+## Styling idiom — Tailwind utilities on semantic tokens
+
+Components style themselves; for **your own** layout and surfaces, use Tailwind utility classes
+bound to the design system's **semantic color tokens** (never raw hex — these adapt to light/dark):
+
+| Purpose | Utilities |
+|---|---|
+| Surfaces | `bg-background`, `bg-card`, `bg-popover`, `bg-muted`, `bg-sidebar` |
+| Brand / actions | `bg-primary` + `text-primary-foreground`, `bg-secondary` + `text-secondary-foreground` |
+| Accents / hover | `bg-accent` + `text-accent-foreground`, `hover:bg-muted` |
+| Danger | `bg-destructive`, `text-destructive` |
+| Text | `text-foreground` (primary), `text-muted-foreground` (secondary) |
+| Borders / focus | `border`, `border-input`, `ring-ring`, `outline-ring` |
+| Radius | `rounded-md`, `rounded-lg` (driven by `--radius`) |
+
+Each token is also a CSS variable (`var(--primary)`, `var(--muted-foreground)`, `var(--border)`,
+`var(--radius)`, `--font-body` = IBM Plex Sans) if you need it in inline styles.
+
+## Where the truth lives
+
+- **Styling:** `styles.css` and its `@import` closure (`_ds_bundle.css` = component styles; the
+  token definitions on `:root`/`.dark`). Read these before inventing a class or color.
+- **Per component:** `components/<group>/<Name>/<Name>.prompt.md` (usage) and `<Name>.d.ts` (props —
+  variant/size unions where a named type exists; some fall back to a permissive shape).
+
+## Idiomatic snippet
+
+```jsx
+// A confirm action, styled with the DS's own tokens for the surrounding layout.
+<div className="flex flex-col gap-3 rounded-lg border bg-card p-4">
+  <p className="text-sm text-muted-foreground">Publish this resume to your public profile?</p>
+  <div className="flex justify-end gap-2">
+    <RRUI.Button variant="outline">Cancel</RRUI.Button>
+    <RRUI.Button>Publish</RRUI.Button>
+  </div>
+</div>
+```

.design-sync/previews/Accordion.tsx

@@ -0,0 +1,52 @@
+import type * as React from "react";
+import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from "@reactive-resume/ui/components/accordion";
+
+const wrap: React.CSSProperties = { width: 420, padding: 16 };
+
+// Open by default so the panel content is visible in the card (Base UI accordion
+// is uncontrolled via defaultValue, matching item `value` props).
+export const Sections = () => (
+	<div style={wrap}>
+		<Accordion defaultValue={["experience"]}>
+			<AccordionItem value="experience">
+				<AccordionTrigger>Work Experience</AccordionTrigger>
+				<AccordionContent>
+					<p>Senior Product Designer · Framer — 2021 to Present</p>
+					<p>Led the redesign of the onboarding flow, lifting activation by 24% across web and mobile.</p>
+				</AccordionContent>
+			</AccordionItem>
+			<AccordionItem value="education">
+				<AccordionTrigger>Education</AccordionTrigger>
+				<AccordionContent>
+					<p>B.Des in Interaction Design · Rhode Island School of Design</p>
+				</AccordionContent>
+			</AccordionItem>
+			<AccordionItem value="skills">
+				<AccordionTrigger>Skills</AccordionTrigger>
+				<AccordionContent>
+					<p>Figma, prototyping, design systems, user research, and front-end handoff.</p>
+				</AccordionContent>
+			</AccordionItem>
+		</Accordion>
+	</div>
+);
+
+export const MultipleOpen = () => (
+	<div style={wrap}>
+		<Accordion multiple defaultValue={["summary", "certifications"]}>
+			<AccordionItem value="summary">
+				<AccordionTrigger>Professional Summary</AccordionTrigger>
+				<AccordionContent>
+					<p>Full-stack engineer with eight years shipping resilient TypeScript services and design systems.</p>
+				</AccordionContent>
+			</AccordionItem>
+			<AccordionItem value="certifications">
+				<AccordionTrigger>Certifications</AccordionTrigger>
+				<AccordionContent>
+					<p>AWS Solutions Architect · Professional</p>
+					<p>Certified Kubernetes Administrator</p>
+				</AccordionContent>
+			</AccordionItem>
+		</Accordion>
+	</div>
+);

.design-sync/previews/Alert.tsx

@@ -0,0 +1,38 @@
+import type * as React from "react";
+import { InfoIcon, WarningIcon } from "@phosphor-icons/react";
+import { Alert, AlertAction, AlertDescription, AlertTitle } from "@reactive-resume/ui/components/alert";
+import { Button } from "@reactive-resume/ui/components/button";
+
+const wrap: React.CSSProperties = { display: "flex", flexDirection: "column", gap: 16, padding: 16, maxWidth: 540 };
+
+export const Default = () => (
+	<div style={wrap}>
+		<Alert>
+			<InfoIcon />
+			<AlertTitle>Resume saved</AlertTitle>
+			<AlertDescription>Your changes were saved automatically and synced to your account.</AlertDescription>
+		</Alert>
+	</div>
+);
+
+export const Destructive = () => (
+	<div style={wrap}>
+		<Alert variant="destructive">
+			<WarningIcon />
+			<AlertTitle>Export failed</AlertTitle>
+			<AlertDescription>We couldn't generate your PDF. Check your connection and try again.</AlertDescription>
+		</Alert>
+	</div>
+);
+
+export const WithAction = () => (
+	<div style={wrap}>
+		<Alert>
+			<AlertTitle>Unsaved changes</AlertTitle>
+			<AlertDescription>You have edits that haven't been published to your public resume yet.</AlertDescription>
+			<AlertAction>
+				<Button size="sm">Publish</Button>
+			</AlertAction>
+		</Alert>
+	</div>
+);

.design-sync/previews/AlertDialog.tsx

@@ -0,0 +1,34 @@
+import { WarningIcon } from "@phosphor-icons/react";
+import {
+	AlertDialog,
+	AlertDialogAction,
+	AlertDialogCancel,
+	AlertDialogContent,
+	AlertDialogDescription,
+	AlertDialogFooter,
+	AlertDialogHeader,
+	AlertDialogMedia,
+	AlertDialogTitle,
+} from "@reactive-resume/ui/components/alert-dialog";
+
+// Overlay — rendered open (defaultOpen). cfg.overrides.AlertDialog pins
+// cardMode: single + viewport (content is fixed-positioned, centred).
+export const Open = () => (
+	<AlertDialog defaultOpen>
+		<AlertDialogContent>
+			<AlertDialogHeader>
+				<AlertDialogMedia>
+					<WarningIcon />
+				</AlertDialogMedia>
+				<AlertDialogTitle>Delete this resume?</AlertDialogTitle>
+				<AlertDialogDescription>
+					“Software Engineer” and its entire version history will be permanently removed. This action can’t be undone.
+				</AlertDialogDescription>
+			</AlertDialogHeader>
+			<AlertDialogFooter>
+				<AlertDialogCancel>Cancel</AlertDialogCancel>
+				<AlertDialogAction variant="destructive">Delete resume</AlertDialogAction>
+			</AlertDialogFooter>
+		</AlertDialogContent>
+	</AlertDialog>
+);

.design-sync/previews/Attachment.tsx

@@ -0,0 +1,84 @@
+import type * as React from "react";
+import { DownloadSimpleIcon, FileDocIcon, FilePdfIcon, TrashIcon, WarningIcon } from "@phosphor-icons/react";
+import {
+	Attachment,
+	AttachmentAction,
+	AttachmentActions,
+	AttachmentContent,
+	AttachmentDescription,
+	AttachmentGroup,
+	AttachmentMedia,
+	AttachmentTitle,
+} from "@reactive-resume/ui/components/attachment";
+
+const wrap: React.CSSProperties = { display: "flex", flexDirection: "column", gap: 12, padding: 16, width: 360 };
+
+export const WithActions = () => (
+	<div style={wrap}>
+		<Attachment>
+			<AttachmentMedia>
+				<FilePdfIcon />
+			</AttachmentMedia>
+			<AttachmentContent>
+				<AttachmentTitle>Ansel_Bradford_Resume.pdf</AttachmentTitle>
+				<AttachmentDescription>248 KB · PDF</AttachmentDescription>
+			</AttachmentContent>
+			<AttachmentActions>
+				<AttachmentAction aria-label="Download">
+					<DownloadSimpleIcon />
+				</AttachmentAction>
+				<AttachmentAction aria-label="Remove">
+					<TrashIcon />
+				</AttachmentAction>
+			</AttachmentActions>
+		</Attachment>
+	</div>
+);
+
+export const States = () => (
+	<div style={wrap}>
+		<Attachment size="sm" state="uploading">
+			<AttachmentMedia>
+				<FileDocIcon />
+			</AttachmentMedia>
+			<AttachmentContent>
+				<AttachmentTitle>cover-letter.docx</AttachmentTitle>
+				<AttachmentDescription>Uploading…</AttachmentDescription>
+			</AttachmentContent>
+		</Attachment>
+		<Attachment size="sm" state="error">
+			<AttachmentMedia>
+				<WarningIcon />
+			</AttachmentMedia>
+			<AttachmentContent>
+				<AttachmentTitle>portfolio-2024.zip</AttachmentTitle>
+				<AttachmentDescription>Upload failed · file too large</AttachmentDescription>
+			</AttachmentContent>
+		</Attachment>
+	</div>
+);
+
+export const Group = () => (
+	<div style={{ padding: 16, width: 360 }}>
+		<AttachmentGroup>
+			<Attachment orientation="vertical" size="sm">
+				<AttachmentMedia>
+					<FilePdfIcon />
+				</AttachmentMedia>
+				<AttachmentContent>
+					<AttachmentTitle>Resume.pdf</AttachmentTitle>
+					<AttachmentDescription>248 KB</AttachmentDescription>
+				</AttachmentContent>
+			</Attachment>
+			<Attachment orientation="vertical" size="sm">
+				<AttachmentMedia>
+					<FileDocIcon />
+				</AttachmentMedia>
+				<AttachmentContent>
+					<AttachmentTitle>cover-letter.docx</AttachmentTitle>
+					<AttachmentDescription>19 KB</AttachmentDescription>
+				</AttachmentContent>
+			</Attachment>
+		</AttachmentGroup>
+	</div>
+);

.design-sync/previews/Avatar.tsx

@@ -0,0 +1,71 @@
+import type * as React from "react";
+import { CheckIcon } from "@phosphor-icons/react";
+import {
+	Avatar,
+	AvatarBadge,
+	AvatarFallback,
+	AvatarGroup,
+	AvatarGroupCount,
+} from "@reactive-resume/ui/components/avatar";
+
+const row: React.CSSProperties = { display: "flex", alignItems: "center", gap: 16, padding: 20 };
+
+export const Fallback = () => (
+	<div style={row}>
+		<Avatar>
+			<AvatarFallback>AP</AvatarFallback>
+		</Avatar>
+		<Avatar>
+			<AvatarFallback>JD</AvatarFallback>
+		</Avatar>
+		<Avatar>
+			<AvatarFallback>MK</AvatarFallback>
+		</Avatar>
+	</div>
+);
+
+export const WithStatus = () => (
+	<div style={row}>
+		<Avatar>
+			<AvatarFallback>AP</AvatarFallback>
+			<AvatarBadge>
+				<CheckIcon weight="bold" />
+			</AvatarBadge>
+		</Avatar>
+		<Avatar size="lg">
+			<AvatarFallback>SR</AvatarFallback>
+			<AvatarBadge />
+		</Avatar>
+	</div>
+);
+
+export const Sizes = () => (
+	<div style={row}>
+		<Avatar size="sm">
+			<AvatarFallback>AP</AvatarFallback>
+		</Avatar>
+		<Avatar size="default">
+			<AvatarFallback>AP</AvatarFallback>
+		</Avatar>
+		<Avatar size="lg">
+			<AvatarFallback>AP</AvatarFallback>
+		</Avatar>
+	</div>
+);
+
+export const Group = () => (
+	<div style={row}>
+		<AvatarGroup>
+			<Avatar>
+				<AvatarFallback>AP</AvatarFallback>
+			</Avatar>
+			<Avatar>
+				<AvatarFallback>JD</AvatarFallback>
+			</Avatar>
+			<Avatar>
+				<AvatarFallback>MK</AvatarFallback>
+			</Avatar>
+			<AvatarGroupCount>+5</AvatarGroupCount>
+		</AvatarGroup>
+	</div>
+);

.design-sync/previews/Badge.tsx

@@ -0,0 +1,40 @@
+import type * as React from "react";
+import { CheckCircleIcon, PencilSimpleIcon, SparkleIcon } from "@phosphor-icons/react";
+import { Badge } from "@reactive-resume/ui/components/badge";
+
+const row: React.CSSProperties = { display: "flex", flexWrap: "wrap", alignItems: "center", gap: 10, padding: 20 };
+
+export const Variants = () => (
+	<div style={row}>
+		<Badge>Default</Badge>
+		<Badge variant="secondary">Secondary</Badge>
+		<Badge variant="destructive">Destructive</Badge>
+		<Badge variant="outline">Outline</Badge>
+	</div>
+);
+
+export const StatusLabels = () => (
+	<div style={row}>
+		<Badge variant="secondary">
+			<CheckCircleIcon weight="fill" data-icon="inline-start" />
+			Published
+		</Badge>
+		<Badge variant="outline">
+			<PencilSimpleIcon data-icon="inline-start" />
+			Draft
+		</Badge>
+		<Badge>
+			<SparkleIcon weight="fill" data-icon="inline-start" />
+			Pro
+		</Badge>
+		<Badge variant="destructive">Expired</Badge>
+	</div>
+);
+
+export const Counts = () => (
+	<div style={row}>
+		<Badge>12</Badge>
+		<Badge variant="secondary">New</Badge>
+		<Badge variant="outline">v5.2</Badge>
+	</div>
+);

.design-sync/previews/Bubble.tsx

@@ -0,0 +1,48 @@
+import type * as React from "react";
+import { Bubble, BubbleContent, BubbleGroup, BubbleReactions } from "@reactive-resume/ui/components/bubble";
+
+const wrap: React.CSSProperties = { display: "flex", flexDirection: "column", gap: 8, padding: 16, width: 420 };
+
+export const Conversation = () => (
+	<div style={wrap}>
+		<BubbleGroup>
+			<Bubble align="end">
+				<BubbleContent>Can you make my summary sound more senior without exaggerating?</BubbleContent>
+			</Bubble>
+			<Bubble variant="muted" align="start">
+				<BubbleContent>
+					I tightened it to lead with scope and outcomes. Want me to mirror that tone in your experience bullets too?
+				</BubbleContent>
+			</Bubble>
+			<Bubble align="end">
+				<BubbleContent>Yes, keep it concise.</BubbleContent>
+			</Bubble>
+		</BubbleGroup>
+	</div>
+);
+
+export const Variants = () => (
+	<div style={wrap}>
+		<Bubble variant="default" align="end">
+			<BubbleContent>Applied 3 edits to your resume.</BubbleContent>
+		</Bubble>
+		<Bubble variant="tinted" align="start">
+			<BubbleContent>I emphasized measurable launch outcomes in your last role.</BubbleContent>
+		</Bubble>
+		<Bubble variant="outline" align="start">
+			<BubbleContent>Draft saved — publish when you're ready.</BubbleContent>
+		</Bubble>
+		<Bubble variant="destructive" align="start">
+			<BubbleContent>Couldn't reach the AI provider. Retry?</BubbleContent>
+		</Bubble>
+	</div>
+);
+
+export const WithReactions = () => (
+	<div style={{ padding: 24, width: 420 }}>
+		<Bubble variant="secondary" align="start">
+			<BubbleContent>Rewrote your headline to target a Senior Product Manager role.</BubbleContent>
+			<BubbleReactions>👍 2</BubbleReactions>
+		</Bubble>
+	</div>
+);

.design-sync/previews/Button.tsx

@@ -0,0 +1,51 @@
+import type * as React from "react";
+import { ArrowRightIcon, PlusIcon, TrashIcon } from "@phosphor-icons/react";
+import { Button } from "@reactive-resume/ui/components/button";
+
+const row: React.CSSProperties = { display: "flex", flexWrap: "wrap", alignItems: "center", gap: 12, padding: 16 };
+
+export const Variants = () => (
+	<div style={row}>
+		<Button>Save changes</Button>
+		<Button variant="secondary">Secondary</Button>
+		<Button variant="outline">Outline</Button>
+		<Button variant="ghost">Ghost</Button>
+		<Button variant="destructive">Delete</Button>
+		<Button variant="link">Learn more</Button>
+	</div>
+);
+
+export const Sizes = () => (
+	<div style={row}>
+		<Button size="xs">Extra small</Button>
+		<Button size="sm">Small</Button>
+		<Button size="default">Default</Button>
+		<Button size="lg">Large</Button>
+	</div>
+);
+
+export const WithIcons = () => (
+	<div style={row}>
+		<Button>
+			<PlusIcon /> Add section
+		</Button>
+		<Button variant="outline">
+			Continue <ArrowRightIcon />
+		</Button>
+		<Button variant="destructive">
+			<TrashIcon /> Remove
+		</Button>
+		<Button size="icon" variant="outline" aria-label="Add section">
+			<PlusIcon />
+		</Button>
+	</div>
+);
+
+export const Disabled = () => (
+	<div style={row}>
+		<Button disabled>Saving…</Button>
+		<Button variant="outline" disabled>
+			Disabled
+		</Button>
+	</div>
+);

.design-sync/previews/ButtonGroup.tsx

@@ -0,0 +1,67 @@
+import type * as React from "react";
+import {
+	AlignCenterHorizontalIcon,
+	AlignLeftIcon,
+	AlignRightIcon,
+	ArrowClockwiseIcon,
+	ArrowCounterClockwiseIcon,
+	TextBIcon,
+	TextItalicIcon,
+	TextUnderlineIcon,
+} from "@phosphor-icons/react";
+import { Button } from "@reactive-resume/ui/components/button";
+import { ButtonGroup, ButtonGroupSeparator, ButtonGroupText } from "@reactive-resume/ui/components/button-group";
+
+const wrap: React.CSSProperties = { display: "flex", flexDirection: "column", gap: 16, padding: 16 };
+
+export const Formatting = () => (
+	<div style={wrap}>
+		<ButtonGroup>
+			<Button variant="outline" size="icon" aria-label="Bold">
+				<TextBIcon />
+			</Button>
+			<Button variant="outline" size="icon" aria-label="Italic">
+				<TextItalicIcon />
+			</Button>
+			<Button variant="outline" size="icon" aria-label="Underline">
+				<TextUnderlineIcon />
+			</Button>
+			<ButtonGroupSeparator />
+			<Button variant="outline" size="icon" aria-label="Align left">
+				<AlignLeftIcon />
+			</Button>
+			<Button variant="outline" size="icon" aria-label="Align center">
+				<AlignCenterHorizontalIcon />
+			</Button>
+			<Button variant="outline" size="icon" aria-label="Align right">
+				<AlignRightIcon />
+			</Button>
+		</ButtonGroup>
+
+		<ButtonGroup>
+			<Button variant="outline">
+				<ArrowCounterClockwiseIcon /> Undo
+			</Button>
+			<Button variant="outline">
+				<ArrowClockwiseIcon /> Redo
+			</Button>
+		</ButtonGroup>
+	</div>
+);
+
+export const WithText = () => (
+	<div style={wrap}>
+		<ButtonGroup>
+			<ButtonGroupText>Zoom</ButtonGroupText>
+			<Button variant="outline">50%</Button>
+			<Button variant="outline">100%</Button>
+			<Button variant="outline">150%</Button>
+		</ButtonGroup>
+
+		<ButtonGroup orientation="vertical">
+			<Button variant="outline">Export PDF</Button>
+			<Button variant="outline">Export DOCX</Button>
+			<Button variant="outline">Copy link</Button>
+		</ButtonGroup>
+	</div>
+);

.design-sync/previews/ComboboxRoot.tsx

@@ -0,0 +1,30 @@
+import {
+	ComboboxContent,
+	ComboboxEmpty,
+	ComboboxInput,
+	ComboboxItem,
+	ComboboxList,
+	ComboboxRoot,
+} from "@reactive-resume/ui/components/combobox";
+
+const skills = ["TypeScript", "React", "Node.js", "GraphQL", "PostgreSQL", "Kubernetes"];
+
+// Base UI Combobox — items passed to Root, rendered open (defaultOpen).
+// cfg.overrides.ComboboxRoot pins cardMode: single + viewport with room below.
+export const Open = () => (
+	<div style={{ width: 320, padding: 16, paddingBottom: 200 }}>
+		<ComboboxRoot items={skills} defaultOpen>
+			<ComboboxInput placeholder="Add a skill…" />
+			<ComboboxContent>
+				<ComboboxEmpty>No skills found.</ComboboxEmpty>
+				<ComboboxList>
+					{(item: string) => (
+						<ComboboxItem key={item} value={item}>
+							{item}
+						</ComboboxItem>
+					)}
+				</ComboboxList>
+			</ComboboxContent>
+		</ComboboxRoot>
+	</div>
+);

.design-sync/previews/Command.tsx

@@ -0,0 +1,42 @@
+import { DownloadSimpleIcon, GearIcon, PlusIcon, UserIcon } from "@phosphor-icons/react";
+import {
+	Command,
+	CommandGroup,
+	CommandInput,
+	CommandItem,
+	CommandList,
+	CommandSeparator,
+	CommandShortcut,
+} from "@reactive-resume/ui/components/command";
+
+// Command renders inline (cmdk) — a searchable command palette. No overlay.
+export const Palette = () => (
+	<div style={{ width: 400, padding: 16 }}>
+		<div style={{ border: "1px solid var(--border)", borderRadius: 10, overflow: "hidden" }}>
+			<Command>
+				<CommandInput placeholder="Type a command or search…" />
+				<CommandList>
+					<CommandGroup heading="Actions">
+						<CommandItem>
+							<PlusIcon /> New resume
+							<CommandShortcut>⌘N</CommandShortcut>
+						</CommandItem>
+						<CommandItem>
+							<DownloadSimpleIcon /> Export as PDF
+						</CommandItem>
+					</CommandGroup>
+					<CommandSeparator />
+					<CommandGroup heading="Account">
+						<CommandItem>
+							<UserIcon /> Profile
+						</CommandItem>
+						<CommandItem>
+							<GearIcon /> Settings
+							<CommandShortcut>⌘,</CommandShortcut>
+						</CommandItem>
+					</CommandGroup>
+				</CommandList>
+			</Command>
+		</div>
+	</div>
+);

.design-sync/previews/ContextMenu.tsx

@@ -0,0 +1,48 @@
+import {
+	ContextMenu,
+	ContextMenuContent,
+	ContextMenuGroup,
+	ContextMenuItem,
+	ContextMenuLabel,
+	ContextMenuSeparator,
+	ContextMenuShortcut,
+	ContextMenuTrigger,
+} from "@reactive-resume/ui/components/context-menu";
+
+// Right-click menu — rendered open (defaultOpen) so the card shows the menu.
+// cfg.overrides.ContextMenu pins cardMode: single + viewport.
+export const Open = () => (
+	<div style={{ display: "flex", justifyContent: "center", padding: 24, paddingBottom: 160 }}>
+		<ContextMenu defaultOpen>
+			<ContextMenuTrigger>
+				<div
+					style={{
+						display: "grid",
+						placeItems: "center",
+						width: 240,
+						height: 96,
+						border: "1px dashed var(--border)",
+						borderRadius: 8,
+						color: "var(--muted-foreground)",
+						fontSize: 13,
+					}}
+				>
+					Right-click a resume card
+				</div>
+			</ContextMenuTrigger>
+			<ContextMenuContent>
+				<ContextMenuGroup>
+					<ContextMenuLabel>Software Engineer</ContextMenuLabel>
+					<ContextMenuItem>Open</ContextMenuItem>
+					<ContextMenuItem>
+						Rename
+						<ContextMenuShortcut>F2</ContextMenuShortcut>
+					</ContextMenuItem>
+					<ContextMenuItem>Duplicate</ContextMenuItem>
+				</ContextMenuGroup>
+				<ContextMenuSeparator />
+				<ContextMenuItem variant="destructive">Delete</ContextMenuItem>
+			</ContextMenuContent>
+		</ContextMenu>
+	</div>
+);

.design-sync/previews/Dialog.tsx

@@ -0,0 +1,30 @@
+import { Button } from "@reactive-resume/ui/components/button";
+import {
+	Dialog,
+	DialogClose,
+	DialogContent,
+	DialogDescription,
+	DialogFooter,
+	DialogHeader,
+	DialogTitle,
+} from "@reactive-resume/ui/components/dialog";
+
+// Overlay component — rendered open (defaultOpen) so the card shows the real
+// dialog surface. cfg.overrides.Dialog pins cardMode: single + a viewport for
+// the portal (content is fixed-positioned at the viewport centre).
+export const Open = () => (
+	<Dialog defaultOpen>
+		<DialogContent>
+			<DialogHeader>
+				<DialogTitle>Delete resume</DialogTitle>
+				<DialogDescription>
+					This permanently deletes “Software Engineer” along with its version history. This action cannot be undone.
+				</DialogDescription>
+			</DialogHeader>
+			<DialogFooter>
+				<DialogClose render={<Button variant="outline" />}>Cancel</DialogClose>
+				<DialogClose render={<Button variant="destructive" />}>Delete resume</DialogClose>
+			</DialogFooter>
+		</DialogContent>
+	</Dialog>
+);

.design-sync/previews/DropdownMenu.tsx

@@ -0,0 +1,41 @@
+import { CopyIcon, DownloadSimpleIcon, PencilIcon, TrashIcon } from "@phosphor-icons/react";
+import { Button } from "@reactive-resume/ui/components/button";
+import {
+	DropdownMenu,
+	DropdownMenuContent,
+	DropdownMenuGroup,
+	DropdownMenuItem,
+	DropdownMenuLabel,
+	DropdownMenuSeparator,
+	DropdownMenuShortcut,
+	DropdownMenuTrigger,
+} from "@reactive-resume/ui/components/dropdown-menu";
+
+// Anchored menu — rendered open (defaultOpen), positioned below its trigger.
+// cfg.overrides.DropdownMenu pins cardMode: single + viewport with room below.
+export const Open = () => (
+	<div style={{ display: "flex", justifyContent: "center", paddingTop: 16, paddingBottom: 220 }}>
+		<DropdownMenu defaultOpen>
+			<DropdownMenuTrigger render={<Button variant="outline" />}>Resume actions</DropdownMenuTrigger>
+			<DropdownMenuContent>
+				<DropdownMenuGroup>
+					<DropdownMenuLabel>Software Engineer</DropdownMenuLabel>
+					<DropdownMenuItem>
+						<PencilIcon /> Rename
+					</DropdownMenuItem>
+					<DropdownMenuItem>
+						<CopyIcon /> Duplicate
+						<DropdownMenuShortcut>⌘D</DropdownMenuShortcut>
+					</DropdownMenuItem>
+					<DropdownMenuItem>
+						<DownloadSimpleIcon /> Export PDF
+					</DropdownMenuItem>
+				</DropdownMenuGroup>
+				<DropdownMenuSeparator />
+				<DropdownMenuItem variant="destructive">
+					<TrashIcon /> Delete
+				</DropdownMenuItem>
+			</DropdownMenuContent>
+		</DropdownMenu>
+	</div>
+);

.design-sync/previews/FormItem.tsx

@@ -0,0 +1,27 @@
+import type * as React from "react";
+import { FormControl, FormDescription, FormItem, FormLabel, FormMessage } from "@reactive-resume/ui/components/form";
+import { Input } from "@reactive-resume/ui/components/input";
+
+// FormItem carries its own field context (id + error state) — FormLabel /
+// FormControl / FormDescription / FormMessage compose under it standalone.
+const wrap: React.CSSProperties = { display: "flex", flexDirection: "column", gap: 16, padding: 16, width: 340 };
+
+export const Default = () => (
+	<div style={wrap}>
+		<FormItem>
+			<FormLabel>Headline</FormLabel>
+			<FormControl render={<Input placeholder="Senior Software Engineer" />} />
+			<FormDescription>Shown under your name at the top of the resume.</FormDescription>
+		</FormItem>
+	</div>
+);
+
+export const WithError = () => (
+	<div style={wrap}>
+		<FormItem hasError>
+			<FormLabel>Email</FormLabel>
+			<FormControl render={<Input defaultValue="jane@" />} />
+			<FormMessage errors={["Enter a valid email address."]} />
+		</FormItem>
+	</div>
+);

.design-sync/previews/HoverCard.tsx

@@ -0,0 +1,19 @@
+import { Button } from "@reactive-resume/ui/components/button";
+import { HoverCard, HoverCardContent, HoverCardTrigger } from "@reactive-resume/ui/components/hover-card";
+
+// Anchored preview-card overlay — rendered open (defaultOpen).
+// cfg.overrides.HoverCard pins cardMode: single + viewport with room below the trigger.
+export const Open = () => (
+	<div style={{ display: "flex", justifyContent: "center", paddingTop: 24, paddingBottom: 180 }}>
+		<HoverCard defaultOpen>
+			<HoverCardTrigger render={<Button variant="link" />}>@jane-doe</HoverCardTrigger>
+			<HoverCardContent>
+				<div style={{ display: "flex", flexDirection: "column", gap: 6 }}>
+					<span style={{ fontWeight: 600 }}>Jane Doe</span>
+					<span style={{ color: "var(--muted-foreground)" }}>Senior Software Engineer · San Francisco</span>
+					<span style={{ color: "var(--muted-foreground)", fontSize: 12 }}>3 published resumes · joined 2023</span>
+				</div>
+			</HoverCardContent>
+		</HoverCard>
+	</div>
+);

.design-sync/previews/Input.tsx

@@ -0,0 +1,40 @@
+import type * as React from "react";
+import { Input } from "@reactive-resume/ui/components/input";
+import { Label } from "@reactive-resume/ui/components/label";
+
+const field: React.CSSProperties = { display: "flex", flexDirection: "column", gap: 6, padding: 16, width: 320 };
+
+export const Default = () => (
+	<div style={field}>
+		<Label htmlFor="full-name">Full name</Label>
+		<Input id="full-name" defaultValue="Ada Lovelace" />
+	</div>
+);
+
+export const Placeholder = () => (
+	<div style={field}>
+		<Label htmlFor="headline">Headline</Label>
+		<Input id="headline" placeholder="e.g. Senior Software Engineer" />
+	</div>
+);
+
+export const Email = () => (
+	<div style={field}>
+		<Label htmlFor="email">Email</Label>
+		<Input id="email" type="email" defaultValue="ada@analyticalengine.dev" />
+	</div>
+);
+
+export const Invalid = () => (
+	<div style={field}>
+		<Label htmlFor="website">Website</Label>
+		<Input id="website" aria-invalid defaultValue="not-a-valid-url" />
+	</div>
+);
+
+export const Disabled = () => (
+	<div style={field}>
+		<Label htmlFor="username">Username</Label>
+		<Input id="username" disabled defaultValue="ada.lovelace" />
+	</div>
+);

.design-sync/previews/InputGroup.tsx

@@ -0,0 +1,55 @@
+import type * as React from "react";
+import { CopyIcon, GlobeIcon, MagnifyingGlassIcon } from "@phosphor-icons/react";
+import {
+	InputGroup,
+	InputGroupAddon,
+	InputGroupButton,
+	InputGroupInput,
+	InputGroupText,
+	InputGroupTextarea,
+} from "@reactive-resume/ui/components/input-group";
+
+const wrap: React.CSSProperties = { display: "flex", flexDirection: "column", gap: 16, padding: 16, width: 380 };
+
+export const Addons = () => (
+	<div style={wrap}>
+		<InputGroup>
+			<InputGroupAddon>
+				<MagnifyingGlassIcon />
+			</InputGroupAddon>
+			<InputGroupInput placeholder="Search resumes" defaultValue="Product Designer" />
+		</InputGroup>
+
+		<InputGroup>
+			<InputGroupAddon>
+				<GlobeIcon />
+				<InputGroupText>rxresu.me/u/</InputGroupText>
+			</InputGroupAddon>
+			<InputGroupInput defaultValue="jordan-rivera" />
+		</InputGroup>
+
+		<InputGroup>
+			<InputGroupInput readOnly defaultValue="rxr_live_9f3c8a21bd47e50a" />
+			<InputGroupAddon align="inline-end">
+				<InputGroupButton size="icon-sm" aria-label="Copy API key">
+					<CopyIcon />
+				</InputGroupButton>
+			</InputGroupAddon>
+		</InputGroup>
+	</div>
+);
+
+export const WithTextarea = () => (
+	<div style={wrap}>
+		<InputGroup>
+			<InputGroupTextarea
+				rows={3}
+				defaultValue="Senior product designer focused on design systems, accessibility, and shipping polished interfaces."
+			/>
+			<InputGroupAddon align="block-end">
+				<InputGroupText>240 characters left</InputGroupText>
+				<InputGroupButton style={{ marginLeft: "auto" }}>Generate with AI</InputGroupButton>
+			</InputGroupAddon>
+		</InputGroup>
+	</div>
+);

.design-sync/previews/Kbd.tsx

@@ -0,0 +1,68 @@
+import type * as React from "react";
+import { Kbd, KbdGroup } from "@reactive-resume/ui/components/kbd";
+
+const row: React.CSSProperties = { display: "flex", flexWrap: "wrap", alignItems: "center", gap: 12, padding: 20 };
+const listRow: React.CSSProperties = {
+	display: "flex",
+	alignItems: "center",
+	justifyContent: "space-between",
+	gap: 24,
+	fontSize: 13,
+	color: "var(--foreground)",
+};
+const col: React.CSSProperties = { display: "flex", flexDirection: "column", gap: 10, padding: 20, minWidth: 260 };
+
+export const Keys = () => (
+	<div style={row}>
+		<Kbd>⌘</Kbd>
+		<Kbd>⇧</Kbd>
+		<Kbd>⌥</Kbd>
+		<Kbd>Esc</Kbd>
+		<Kbd>Enter</Kbd>
+		<Kbd>Tab</Kbd>
+	</div>
+);
+
+export const Combinations = () => (
+	<div style={row}>
+		<KbdGroup>
+			<Kbd>⌘</Kbd>
+			<Kbd>K</Kbd>
+		</KbdGroup>
+		<KbdGroup>
+			<Kbd>⌘</Kbd>
+			<Kbd>S</Kbd>
+		</KbdGroup>
+		<KbdGroup>
+			<Kbd>⌘</Kbd>
+			<Kbd>⇧</Kbd>
+			<Kbd>P</Kbd>
+		</KbdGroup>
+	</div>
+);
+
+export const ShortcutList = () => (
+	<div style={col}>
+		<div style={listRow}>
+			<span>Command palette</span>
+			<KbdGroup>
+				<Kbd>⌘</Kbd>
+				<Kbd>K</Kbd>
+			</KbdGroup>
+		</div>
+		<div style={listRow}>
+			<span>Save resume</span>
+			<KbdGroup>
+				<Kbd>⌘</Kbd>
+				<Kbd>S</Kbd>
+			</KbdGroup>
+		</div>
+		<div style={listRow}>
+			<span>Undo</span>
+			<KbdGroup>
+				<Kbd>⌘</Kbd>
+				<Kbd>Z</Kbd>
+			</KbdGroup>
+		</div>
+	</div>
+);

.design-sync/previews/Label.tsx

@@ -0,0 +1,39 @@
+import type * as React from "react";
+import { Input } from "@reactive-resume/ui/components/input";
+import { Label } from "@reactive-resume/ui/components/label";
+import { Switch } from "@reactive-resume/ui/components/switch";
+
+const field: React.CSSProperties = { display: "flex", flexDirection: "column", gap: 6, padding: 16, width: 320 };
+const row: React.CSSProperties = { display: "flex", alignItems: "center", gap: 10, padding: 16, width: 320 };
+
+export const WithInput = () => (
+	<div style={field}>
+		<Label htmlFor="company">Company</Label>
+		<Input id="company" defaultValue="Analytical Engine Co." />
+	</div>
+);
+
+export const Required = () => (
+	<div style={field}>
+		<Label htmlFor="job-title">
+			Job title <span style={{ color: "var(--destructive)" }}>*</span>
+		</Label>
+		<Input id="job-title" placeholder="e.g. Lead Engineer" />
+	</div>
+);
+
+export const WithSwitch = () => (
+	<div style={row}>
+		<Switch id="public-resume" defaultChecked />
+		<Label htmlFor="public-resume">Public resume</Label>
+	</div>
+);
+
+export const Disabled = () => (
+	<div style={field}>
+		<Label htmlFor="locked-field" data-disabled="true" style={{ opacity: 0.5 }}>
+			Locked field
+		</Label>
+		<Input id="locked-field" disabled defaultValue="Read only" />
+	</div>
+);

.design-sync/previews/Marker.tsx

@@ -0,0 +1,39 @@
+import type * as React from "react";
+import { CheckCircleIcon, SparkleIcon, WarningCircleIcon } from "@phosphor-icons/react";
+import { Marker, MarkerContent, MarkerIcon } from "@reactive-resume/ui/components/marker";
+
+const wrap: React.CSSProperties = { display: "flex", flexDirection: "column", gap: 12, padding: 16, width: 360 };
+
+export const Statuses = () => (
+	<div style={wrap}>
+		<Marker style={{ width: "fit-content", borderRadius: 8, padding: "12px 16px", background: "var(--muted)" }}>
+			<MarkerIcon>
+				<SparkleIcon />
+			</MarkerIcon>
+			<MarkerContent>Tailoring your resume…</MarkerContent>
+		</Marker>
+		<Marker style={{ width: "fit-content" }}>
+			<MarkerIcon>
+				<CheckCircleIcon />
+			</MarkerIcon>
+			<MarkerContent>Applied 4 edits to your resume</MarkerContent>
+		</Marker>
+		<Marker style={{ width: "fit-content" }}>
+			<MarkerIcon>
+				<WarningCircleIcon />
+			</MarkerIcon>
+			<MarkerContent>Couldn't reach the AI provider</MarkerContent>
+		</Marker>
+	</div>
+);
+
+export const Dividers = () => (
+	<div style={wrap}>
+		<Marker variant="separator">
+			<MarkerContent>Today</MarkerContent>
+		</Marker>
+		<Marker variant="border">
+			<MarkerContent>Conversation history</MarkerContent>
+		</Marker>
+	</div>
+);

.design-sync/previews/Message.tsx

@@ -0,0 +1,65 @@
+import type * as React from "react";
+import { SparkleIcon, UserIcon } from "@phosphor-icons/react";
+import { Bubble, BubbleContent } from "@reactive-resume/ui/components/bubble";
+import {
+	Message,
+	MessageAvatar,
+	MessageContent,
+	MessageFooter,
+	MessageGroup,
+	MessageHeader,
+} from "@reactive-resume/ui/components/message";
+
+const avatar: React.CSSProperties = { display: "flex", alignItems: "center", justifyContent: "center", padding: 8 };
+
+export const Conversation = () => (
+	<div style={{ display: "flex", padding: 16, width: 460 }}>
+		<MessageGroup style={{ width: "100%" }}>
+			<Message align="end">
+				<MessageAvatar>
+					<span style={avatar}>
+						<UserIcon />
+					</span>
+				</MessageAvatar>
+				<MessageContent>
+					<Bubble align="end">
+						<BubbleContent>Tailor my resume for a product manager role.</BubbleContent>
+					</Bubble>
+				</MessageContent>
+			</Message>
+			<Message align="start">
+				<MessageAvatar>
+					<span style={avatar}>
+						<SparkleIcon />
+					</span>
+				</MessageAvatar>
+				<MessageContent>
+					<Bubble variant="muted" align="start">
+						<BubbleContent>
+							Done — I emphasized roadmap ownership and stakeholder communication in your summary.
+						</BubbleContent>
+					</Bubble>
+				</MessageContent>
+			</Message>
+		</MessageGroup>
+	</div>
+);
+
+export const WithMeta = () => (
+	<div style={{ display: "flex", padding: 16, width: 460 }}>
+		<Message align="start">
+			<MessageAvatar>
+				<span style={avatar}>
+					<SparkleIcon />
+				</span>
+			</MessageAvatar>
+			<MessageContent>
+				<MessageHeader>Reactive AI</MessageHeader>
+				<Bubble variant="tinted" align="start">
+					<BubbleContent>I found 4 weak bullets and rewrote them with stronger verbs and metrics.</BubbleContent>
+				</Bubble>
+				<MessageFooter>Just now · applied 4 edits</MessageFooter>
+			</MessageContent>
+		</Message>
+	</div>
+);

.design-sync/previews/MessageScroller.tsx

@@ -0,0 +1,57 @@
+import type * as React from "react";
+import { SparkleIcon, UserIcon } from "@phosphor-icons/react";
+import { Bubble, BubbleContent } from "@reactive-resume/ui/components/bubble";
+import { Message, MessageAvatar, MessageContent } from "@reactive-resume/ui/components/message";
+import {
+	MessageScroller,
+	MessageScrollerButton,
+	MessageScrollerContent,
+	MessageScrollerItem,
+	MessageScrollerProvider,
+	MessageScrollerViewport,
+} from "@reactive-resume/ui/components/message-scroller";
+
+const avatar: React.CSSProperties = { display: "flex", alignItems: "center", justifyContent: "center", padding: 8 };
+
+const turns = [
+	{ role: "user", text: "Can you review my resume for a senior engineering role?" },
+	{ role: "assistant", text: "Sure — I'll focus on scope, impact, and leadership signals. Reading it now." },
+	{ role: "user", text: "Great, keep the tone concise." },
+	{
+		role: "assistant",
+		text: "I rewrote your summary and tightened three experience bullets with measurable outcomes.",
+	},
+	{ role: "user", text: "Perfect, publish the draft." },
+	{ role: "assistant", text: "Draft saved and published to your public resume. Anything else you'd like to refine?" },
+];
+
+export const Thread = () => (
+	<div style={{ height: 340, width: 460, padding: 12 }}>
+		<MessageScrollerProvider autoScroll defaultScrollPosition="end">
+			<MessageScroller>
+				<MessageScrollerViewport>
+					<MessageScrollerContent style={{ padding: 12 }}>
+						{turns.map((turn, index) => (
+							<MessageScrollerItem key={turn.text} messageId={`turn-${index}`}>
+								<Message align={turn.role === "user" ? "end" : "start"}>
+									<MessageAvatar>
+										<span style={avatar}>{turn.role === "user" ? <UserIcon /> : <SparkleIcon />}</span>
+									</MessageAvatar>
+									<MessageContent>
+										<Bubble
+											variant={turn.role === "user" ? "default" : "muted"}
+											align={turn.role === "user" ? "end" : "start"}
+										>
+											<BubbleContent>{turn.text}</BubbleContent>
+										</Bubble>
+									</MessageContent>
+								</Message>
+							</MessageScrollerItem>
+						))}
+					</MessageScrollerContent>
+				</MessageScrollerViewport>
+				<MessageScrollerButton />
+			</MessageScroller>
+		</MessageScrollerProvider>
+	</div>
+);

.design-sync/previews/Popover.tsx

@@ -0,0 +1,33 @@
+import { Button } from "@reactive-resume/ui/components/button";
+import {
+	Popover,
+	PopoverContent,
+	PopoverDescription,
+	PopoverHeader,
+	PopoverTitle,
+	PopoverTrigger,
+} from "@reactive-resume/ui/components/popover";
+
+// Anchored overlay — rendered open (defaultOpen), positioned below its trigger.
+// cfg.overrides.Popover pins cardMode: single + viewport with room for the popup.
+export const Open = () => (
+	<div style={{ display: "flex", justifyContent: "center", paddingTop: 24, paddingBottom: 220 }}>
+		<Popover defaultOpen>
+			<PopoverTrigger render={<Button variant="outline" />}>Share resume</PopoverTrigger>
+			<PopoverContent>
+				<PopoverHeader>
+					<PopoverTitle>Public link</PopoverTitle>
+					<PopoverDescription>Anyone with this link can view your published resume.</PopoverDescription>
+				</PopoverHeader>
+				<div style={{ display: "flex", gap: 8 }}>
+					<Button size="sm" variant="secondary">
+						Copy link
+					</Button>
+					<Button size="sm" variant="ghost">
+						Open
+					</Button>
+				</div>
+			</PopoverContent>
+		</Popover>
+	</div>
+);

.design-sync/previews/ResizableGroup.tsx

@@ -0,0 +1,57 @@
+import type * as React from "react";
+import { ResizableGroup, ResizablePanel, ResizableSeparator } from "@reactive-resume/ui/components/resizable";
+
+const panelStyle: React.CSSProperties = { height: "100%", padding: 16, fontSize: 14, lineHeight: 1.6 };
+const label: React.CSSProperties = {
+	fontSize: 11,
+	fontWeight: 600,
+	textTransform: "uppercase",
+	letterSpacing: "0.05em",
+	color: "var(--muted-foreground)",
+	marginBottom: 8,
+};
+
+export const BuilderLayout = () => (
+	<div style={{ height: 240, width: 460, border: "1px solid var(--border)", borderRadius: 8, overflow: "hidden" }}>
+		<ResizableGroup orientation="horizontal">
+			<ResizablePanel defaultSize={40}>
+				<div style={panelStyle}>
+					<div style={label}>Editor</div>
+					<div>Basics</div>
+					<div>Work Experience</div>
+					<div>Education</div>
+					<div>Skills</div>
+				</div>
+			</ResizablePanel>
+			<ResizableSeparator withHandle />
+			<ResizablePanel defaultSize={60}>
+				<div style={{ ...panelStyle, background: "var(--muted)" }}>
+					<div style={label}>Live Preview</div>
+					<div style={{ fontWeight: 600, fontSize: 16 }}>Jordan Rivera</div>
+					<div style={{ color: "var(--muted-foreground)" }}>Senior Product Designer</div>
+				</div>
+			</ResizablePanel>
+		</ResizableGroup>
+	</div>
+);
+
+export const VerticalSplit = () => (
+	<div style={{ height: 240, width: 300, border: "1px solid var(--border)", borderRadius: 8, overflow: "hidden" }}>
+		<ResizableGroup orientation="vertical">
+			<ResizablePanel defaultSize={50}>
+				<div style={panelStyle}>
+					<div style={label}>Summary</div>
+					<div>Eight years building design systems and shipping delightful product experiences.</div>
+				</div>
+			</ResizablePanel>
+			<ResizableSeparator withHandle />
+			<ResizablePanel defaultSize={50}>
+				<div style={{ ...panelStyle, background: "var(--muted)" }}>
+					<div style={label}>Contact</div>
+					<div>jordan.rivera@email.com</div>
+					<div>San Francisco, CA</div>
+				</div>
+			</ResizablePanel>
+		</ResizableGroup>
+	</div>
+);

.design-sync/previews/ScrollArea.tsx

@@ -0,0 +1,39 @@
+import type * as React from "react";
+import { ScrollArea } from "@reactive-resume/ui/components/scroll-area";
+
+const templates = [
+	{ name: "Azurill", tag: "Minimal" },
+	{ name: "Bronzor", tag: "Classic" },
+	{ name: "Chikorita", tag: "Modern" },
+	{ name: "Ditto", tag: "Compact" },
+	{ name: "Gengar", tag: "Bold" },
+	{ name: "Glalie", tag: "Elegant" },
+	{ name: "Kakuna", tag: "Timeless" },
+	{ name: "Leafish", tag: "Creative" },
+	{ name: "Nosepass", tag: "Formal" },
+	{ name: "Onyx", tag: "Technical" },
+	{ name: "Pikachu", tag: "Friendly" },
+	{ name: "Rhyhorn", tag: "Corporate" },
+];
+
+const rowStyle: React.CSSProperties = {
+	display: "flex",
+	alignItems: "center",
+	justifyContent: "space-between",
+	padding: "10px 14px",
+	borderBottom: "1px solid var(--border)",
+	fontSize: 14,
+};
+
+export const TemplateList = () => (
+	<ScrollArea style={{ height: 240, width: 320, border: "1px solid var(--border)", borderRadius: 8 }}>
+		<div style={{ padding: 4 }}>
+			{templates.map((template) => (
+				<div key={template.name} style={rowStyle}>
+					<span style={{ fontWeight: 500 }}>{template.name}</span>
+					<span style={{ color: "var(--muted-foreground)", fontSize: 12 }}>{template.tag}</span>
+				</div>
+			))}
+		</div>
+	</ScrollArea>
+);

.design-sync/previews/Separator.tsx

@@ -0,0 +1,45 @@
+import type * as React from "react";
+import { Separator } from "@reactive-resume/ui/components/separator";
+
+const block: React.CSSProperties = {
+	display: "flex",
+	flexDirection: "column",
+	gap: 12,
+	padding: 20,
+	maxWidth: 360,
+	fontSize: 13,
+	color: "var(--foreground)",
+};
+const inline: React.CSSProperties = {
+	display: "flex",
+	alignItems: "center",
+	gap: 12,
+	padding: 20,
+	fontSize: 13,
+	color: "var(--muted-foreground)",
+};
+
+export const Horizontal = () => (
+	<div style={block}>
+		<div>
+			<strong style={{ display: "block", fontSize: 14 }}>Amruth Pillai</strong>
+			<span style={{ color: "var(--muted-foreground)" }}>Senior Software Engineer</span>
+		</div>
+		<Separator />
+		<span style={{ color: "var(--muted-foreground)" }}>
+			Building resume tooling at Reactive Resume. Open-source enthusiast.
+		</span>
+	</div>
+);
+
+export const Vertical = () => (
+	<div style={inline}>
+		<span>Profile</span>
+		<Separator orientation="vertical" style={{ height: 16 }} />
+		<span>Experience</span>
+		<Separator orientation="vertical" style={{ height: 16 }} />
+		<span>Education</span>
+		<Separator orientation="vertical" style={{ height: 16 }} />
+		<span>Skills</span>
+	</div>
+);

.design-sync/previews/Sheet.tsx

@@ -0,0 +1,38 @@
+import { Button } from "@reactive-resume/ui/components/button";
+import { Label } from "@reactive-resume/ui/components/label";
+import {
+	Sheet,
+	SheetClose,
+	SheetContent,
+	SheetDescription,
+	SheetFooter,
+	SheetHeader,
+	SheetTitle,
+} from "@reactive-resume/ui/components/sheet";
+
+// Side drawer — rendered open (defaultOpen), anchored to the right edge.
+// cfg.overrides.Sheet pins cardMode: single + viewport.
+export const Open = () => (
+	<Sheet defaultOpen>
+		<SheetContent side="right">
+			<SheetHeader>
+				<SheetTitle>Resume settings</SheetTitle>
+				<SheetDescription>Control how “Software Engineer” appears when shared publicly.</SheetDescription>
+			</SheetHeader>
+			<div style={{ display: "flex", flexDirection: "column", gap: 14, padding: "0 16px" }}>
+				<div style={{ display: "flex", flexDirection: "column", gap: 6 }}>
+					<Label>Public slug</Label>
+					<span style={{ fontSize: 13, color: "var(--muted-foreground)" }}>rxresume.me/jane-doe</span>
+				</div>
+				<div style={{ display: "flex", flexDirection: "column", gap: 6 }}>
+					<Label>Visibility</Label>
+					<span style={{ fontSize: 13, color: "var(--muted-foreground)" }}>Anyone with the link can view</span>
+				</div>
+			</div>
+			<SheetFooter>
+				<SheetClose render={<Button variant="outline" />}>Cancel</SheetClose>
+				<SheetClose render={<Button />}>Save changes</SheetClose>
+			</SheetFooter>
+		</SheetContent>
+	</Sheet>
+);

.design-sync/previews/Sidebar.tsx

@@ -0,0 +1,61 @@
+import { FileTextIcon, GearIcon, HouseIcon, PlusIcon } from "@phosphor-icons/react";
+import {
+	Sidebar,
+	SidebarContent,
+	SidebarFooter,
+	SidebarGroup,
+	SidebarGroupLabel,
+	SidebarHeader,
+	SidebarMenu,
+	SidebarMenuButton,
+	SidebarMenuItem,
+	SidebarProvider,
+} from "@reactive-resume/ui/components/sidebar";
+
+// SidebarProvider supplies context + --sidebar-width. `collapsible="none"`
+// renders the sidebar inline (the default offcanvas variant is fixed-positioned
+// and would escape the card).
+export const Navigation = () => (
+	<SidebarProvider>
+		<div
+			style={{ height: 400, display: "flex", border: "1px solid var(--border)", borderRadius: 10, overflow: "hidden" }}
+		>
+			<Sidebar collapsible="none">
+				<SidebarHeader>
+					<div style={{ padding: 8, fontWeight: 600, fontSize: 14 }}>Reactive Resume</div>
+				</SidebarHeader>
+				<SidebarContent>
+					<SidebarGroup>
+						<SidebarGroupLabel>Workspace</SidebarGroupLabel>
+						<SidebarMenu>
+							<SidebarMenuItem>
+								<SidebarMenuButton isActive>
+									<HouseIcon /> Dashboard
+								</SidebarMenuButton>
+							</SidebarMenuItem>
+							<SidebarMenuItem>
+								<SidebarMenuButton>
+									<FileTextIcon /> Resumes
+								</SidebarMenuButton>
+							</SidebarMenuItem>
+							<SidebarMenuItem>
+								<SidebarMenuButton>
+									<PlusIcon /> New resume
+								</SidebarMenuButton>
+							</SidebarMenuItem>
+						</SidebarMenu>
+					</SidebarGroup>
+				</SidebarContent>
+				<SidebarFooter>
+					<SidebarMenu>
+						<SidebarMenuItem>
+							<SidebarMenuButton>
+								<GearIcon /> Settings
+							</SidebarMenuButton>
+						</SidebarMenuItem>
+					</SidebarMenu>
+				</SidebarFooter>
+			</Sidebar>
+		</div>
+	</SidebarProvider>
+);

.design-sync/previews/Skeleton.tsx

@@ -0,0 +1,41 @@
+import type * as React from "react";
+import { Skeleton } from "@reactive-resume/ui/components/skeleton";
+
+const pad: React.CSSProperties = { padding: 20 };
+
+export const TextLines = () => (
+	<div style={{ ...pad, display: "flex", flexDirection: "column", gap: 10, width: 320 }}>
+		<Skeleton style={{ height: 12, width: "70%" }} />
+		<Skeleton style={{ height: 12, width: "100%" }} />
+		<Skeleton style={{ height: 12, width: "90%" }} />
+		<Skeleton style={{ height: 12, width: "40%" }} />
+	</div>
+);
+
+export const ProfileHeader = () => (
+	<div style={{ ...pad, display: "flex", alignItems: "center", gap: 14 }}>
+		<Skeleton style={{ height: 48, width: 48, borderRadius: "9999px" }} />
+		<div style={{ display: "flex", flexDirection: "column", gap: 8 }}>
+			<Skeleton style={{ height: 14, width: 160 }} />
+			<Skeleton style={{ height: 12, width: 100 }} />
+		</div>
+	</div>
+);
+
+export const ResumeCard = () => (
+	<div
+		style={{
+			...pad,
+			display: "flex",
+			flexDirection: "column",
+			gap: 12,
+			width: 220,
+			border: "1px solid var(--border)",
+			borderRadius: 12,
+		}}
+	>
+		<Skeleton style={{ height: 140, width: "100%" }} />
+		<Skeleton style={{ height: 14, width: "60%" }} />
+		<Skeleton style={{ height: 12, width: "40%" }} />
+	</div>
+);

.design-sync/previews/Slider.tsx

@@ -0,0 +1,33 @@
+import type * as React from "react";
+import { Label } from "@reactive-resume/ui/components/label";
+import { Slider } from "@reactive-resume/ui/components/slider";
+
+const field: React.CSSProperties = { display: "flex", flexDirection: "column", gap: 10, padding: 16, width: 320 };
+
+export const Single = () => (
+	<div style={field}>
+		<Label>Skill level</Label>
+		<Slider defaultValue={[4]} min={0} max={5} step={1} />
+	</div>
+);
+
+export const Range = () => (
+	<div style={field}>
+		<Label>Experience (years)</Label>
+		<Slider defaultValue={[2, 8]} min={0} max={15} step={1} />
+	</div>
+);
+
+export const FontScale = () => (
+	<div style={field}>
+		<Label>Font size</Label>
+		<Slider defaultValue={[62]} min={0} max={100} />
+	</div>
+);
+
+export const Disabled = () => (
+	<div style={field}>
+		<Label style={{ opacity: 0.5 }}>Line height (locked)</Label>
+		<Slider defaultValue={[50]} min={0} max={100} disabled />
+	</div>
+);

.design-sync/previews/Spinner.tsx

@@ -0,0 +1,35 @@
+import type * as React from "react";
+import { Spinner } from "@reactive-resume/ui/components/spinner";
+
+const row: React.CSSProperties = { display: "flex", alignItems: "center", gap: 20, padding: 24 };
+
+export const Sizes = () => (
+	<div style={row}>
+		<Spinner style={{ width: 16, height: 16 }} />
+		<Spinner style={{ width: 24, height: 24 }} />
+		<Spinner style={{ width: 32, height: 32 }} />
+	</div>
+);
+
+export const Colors = () => (
+	<div style={row}>
+		<Spinner style={{ width: 28, height: 28, color: "var(--primary)" }} />
+		<Spinner style={{ width: 28, height: 28, color: "var(--muted-foreground)" }} />
+	</div>
+);
+
+export const LoadingRow = () => (
+	<div
+		style={{
+			display: "flex",
+			alignItems: "center",
+			gap: 10,
+			padding: 20,
+			fontSize: 13,
+			color: "var(--muted-foreground)",
+		}}
+	>
+		<Spinner style={{ width: 18, height: 18 }} />
+		<span>Generating your PDF…</span>
+	</div>
+);

.design-sync/previews/Switch.tsx

@@ -0,0 +1,40 @@
+import type * as React from "react";
+import { Label } from "@reactive-resume/ui/components/label";
+import { Switch } from "@reactive-resume/ui/components/switch";
+
+const row: React.CSSProperties = { display: "flex", alignItems: "center", gap: 10, padding: 16, width: 300 };
+const stack: React.CSSProperties = { display: "flex", flexDirection: "column", gap: 16, padding: 16, width: 300 };
+
+export const On = () => (
+	<div style={row}>
+		<Switch id="sw-public" defaultChecked />
+		<Label htmlFor="sw-public">Public resume</Label>
+	</div>
+);
+
+export const Off = () => (
+	<div style={row}>
+		<Switch id="sw-template" />
+		<Label htmlFor="sw-template">Show icons in template</Label>
+	</div>
+);
+
+export const Small = () => (
+	<div style={row}>
+		<Switch id="sw-page-numbers" size="sm" defaultChecked />
+		<Label htmlFor="sw-page-numbers">Show page numbers</Label>
+	</div>
+);
+
+export const Disabled = () => (
+	<div style={stack}>
+		<div style={{ display: "flex", alignItems: "center", gap: 10 }}>
+			<Switch id="sw-ai" disabled defaultChecked />
+			<Label htmlFor="sw-ai">AI suggestions</Label>
+		</div>
+		<div style={{ display: "flex", alignItems: "center", gap: 10 }}>
+			<Switch id="sw-index" disabled />
+			<Label htmlFor="sw-index">Index on search engines</Label>
+		</div>
+	</div>
+);

.design-sync/previews/Tabs.tsx

@@ -0,0 +1,57 @@
+import type * as React from "react";
+import { BriefcaseIcon, GraduationCapIcon, SparkleIcon } from "@phosphor-icons/react";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@reactive-resume/ui/components/tabs";
+
+const wrap: React.CSSProperties = { width: 460, padding: 16 };
+const panel: React.CSSProperties = { padding: "12px 4px", lineHeight: 1.6 };
+
+export const ResumeSections = () => (
+	<div style={wrap}>
+		<Tabs defaultValue="experience">
+			<TabsList>
+				<TabsTrigger value="experience">
+					<BriefcaseIcon /> Experience
+				</TabsTrigger>
+				<TabsTrigger value="education">
+					<GraduationCapIcon /> Education
+				</TabsTrigger>
+				<TabsTrigger value="skills">
+					<SparkleIcon /> Skills
+				</TabsTrigger>
+			</TabsList>
+			<TabsContent value="experience" style={panel}>
+				<strong>Staff Engineer · Vercel</strong>
+				<div>Owned the edge runtime rollout serving 2B requests per day.</div>
+			</TabsContent>
+			<TabsContent value="education" style={panel}>
+				<strong>M.S. Computer Science · Carnegie Mellon</strong>
+				<div>Focus on distributed systems and human-computer interaction.</div>
+			</TabsContent>
+			<TabsContent value="skills" style={panel}>
+				<strong>Core stack</strong>
+				<div>TypeScript, React, Go, PostgreSQL, and Kubernetes.</div>
+			</TabsContent>
+		</Tabs>
+	</div>
+);
+
+export const LineVariant = () => (
+	<div style={wrap}>
+		<Tabs defaultValue="preview">
+			<TabsList variant="line">
+				<TabsTrigger value="preview">Preview</TabsTrigger>
+				<TabsTrigger value="share">Share</TabsTrigger>
+				<TabsTrigger value="export">Export</TabsTrigger>
+			</TabsList>
+			<TabsContent value="preview" style={panel}>
+				Your resume renders live as you edit each section.
+			</TabsContent>
+			<TabsContent value="share" style={panel}>
+				Publish a public link at reactive-resume.app/u/your-name.
+			</TabsContent>
+			<TabsContent value="export" style={panel}>
+				Download a print-ready PDF or DOCX in one click.
+			</TabsContent>
+		</Tabs>
+	</div>
+);

.design-sync/previews/Textarea.tsx

@@ -0,0 +1,37 @@
+import type * as React from "react";
+import { Label } from "@reactive-resume/ui/components/label";
+import { Textarea } from "@reactive-resume/ui/components/textarea";
+
+const field: React.CSSProperties = { display: "flex", flexDirection: "column", gap: 6, padding: 16, width: 360 };
+
+export const Default = () => (
+	<div style={field}>
+		<Label htmlFor="summary">Summary</Label>
+		<Textarea id="summary" placeholder="Write a short professional summary…" rows={4} />
+	</div>
+);
+
+export const Filled = () => (
+	<div style={field}>
+		<Label htmlFor="about">About</Label>
+		<Textarea
+			id="about"
+			rows={4}
+			defaultValue="Mathematician and writer, known for early work on Charles Babbage's Analytical Engine and the first published algorithm intended for a machine."
+		/>
+	</div>
+);
+
+export const Invalid = () => (
+	<div style={field}>
+		<Label htmlFor="bio">Biography</Label>
+		<Textarea id="bio" aria-invalid rows={3} defaultValue="Too short." />
+	</div>
+);
+
+export const Disabled = () => (
+	<div style={field}>
+		<Label htmlFor="notes">Internal notes</Label>
+		<Textarea id="notes" disabled rows={3} defaultValue="Notes are locked while this resume is published." />
+	</div>
+);

.design-sync/previews/Toaster.tsx

@@ -0,0 +1,19 @@
+import { useEffect } from "react";
+import { toast } from "sonner";
+import { Toaster } from "@reactive-resume/ui/components/sonner";
+
+// Toaster is the toast host. Fire a persistent toast on mount so the card
+// shows a real notification instead of an empty portal.
+export const Notification = () => {
+	useEffect(() => {
+		toast.success("Resume published", {
+			description: "“Software Engineer” is now live at rxresume.me/jane-doe.",
+			duration: Number.POSITIVE_INFINITY,
+		});
+	}, []);
+	return (
+		<div style={{ minHeight: 140 }}>
+			<Toaster position="top-center" />
+		</div>
+	);
+};

.design-sync/previews/Toggle.tsx

@@ -0,0 +1,66 @@
+import type * as React from "react";
+import {
+	TextAlignCenterIcon,
+	TextAlignLeftIcon,
+	TextAlignRightIcon,
+	TextBolderIcon,
+	TextItalicIcon,
+	TextUnderlineIcon,
+} from "@phosphor-icons/react";
+import { Toggle } from "@reactive-resume/ui/components/toggle";
+
+const row: React.CSSProperties = { display: "flex", alignItems: "center", gap: 8, padding: 16 };
+const group: React.CSSProperties = { display: "flex", alignItems: "center", gap: 2, padding: 16 };
+
+export const States = () => (
+	<div style={row}>
+		<Toggle aria-label="Bold" defaultPressed>
+			<TextBolderIcon />
+		</Toggle>
+		<Toggle aria-label="Italic">
+			<TextItalicIcon />
+		</Toggle>
+		<Toggle aria-label="Underline" disabled>
+			<TextUnderlineIcon />
+		</Toggle>
+	</div>
+);
+
+export const Outline = () => (
+	<div style={row}>
+		<Toggle variant="outline" defaultPressed>
+			<TextBolderIcon /> Bold
+		</Toggle>
+		<Toggle variant="outline">
+			<TextItalicIcon /> Italic
+		</Toggle>
+	</div>
+);
+
+export const Sizes = () => (
+	<div style={row}>
+		<Toggle size="sm" aria-label="Bold small">
+			<TextBolderIcon />
+		</Toggle>
+		<Toggle size="default" aria-label="Bold default" defaultPressed>
+			<TextBolderIcon />
+		</Toggle>
+		<Toggle size="lg" aria-label="Bold large">
+			<TextBolderIcon />
+		</Toggle>
+	</div>
+);
+
+export const AlignmentGroup = () => (
+	<div style={group}>
+		<Toggle variant="outline" aria-label="Align left" defaultPressed>
+			<TextAlignLeftIcon />
+		</Toggle>
+		<Toggle variant="outline" aria-label="Align center">
+			<TextAlignCenterIcon />
+		</Toggle>
+		<Toggle variant="outline" aria-label="Align right">
+			<TextAlignRightIcon />
+		</Toggle>
+	</div>
+);

.design-sync/previews/Tooltip.tsx

@@ -0,0 +1,18 @@
+import { InfoIcon } from "@phosphor-icons/react";
+import { Button } from "@reactive-resume/ui/components/button";
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@reactive-resume/ui/components/tooltip";
+
+// Anchored overlay — needs TooltipProvider; rendered open (defaultOpen).
+// cfg.overrides.Tooltip pins cardMode: single + viewport with room above the trigger.
+export const Open = () => (
+	<TooltipProvider>
+		<div style={{ display: "flex", justifyContent: "center", paddingTop: 120, paddingBottom: 24 }}>
+			<Tooltip defaultOpen>
+				<TooltipTrigger render={<Button variant="outline" size="icon" aria-label="About visibility" />}>
+					<InfoIcon />
+				</TooltipTrigger>
+				<TooltipContent>Only you can see private resumes</TooltipContent>
+			</Tooltip>
+		</div>
+	</TooltipProvider>
+);

.design-sync/tw-entry.css

@@ -0,0 +1,4 @@
+/* design-sync Tailwind entry — compiles the UI package's globals.css to static CSS
+   for preview rendering, and also scans authored previews for used utilities. */
+@import "../packages/ui/src/styles/globals.css";
+@source "./previews/*.tsx";

.github/workflows/autofix.yml

@@ -19,6 +19,13 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@v6
 
+      - name: Check for merge conflict markers
+        run: |
+          if git grep -nEI '<{7} |>{7} |^={7}$' -- ':(exclude)*.md' ':(exclude)*.mdx'; then
+            echo "::error::Merge conflict markers found in tracked files"
+            exit 1
+          fi
+
       - name: Install pnpm
         uses: pnpm/action-setup@v6
 

.github/workflows/e2e.yml

@@ -0,0 +1,121 @@
+name: E2E Tests
+
+on:
+  pull_request:
+  push:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  APP_URL: http://localhost:3000
+  PORT: "3000"
+  DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
+  FLAG_DISABLE_SIGNUPS: "false"
+  FLAG_DISABLE_EMAIL_AUTH: "false"
+  FLAG_DISABLE_API_RATE_LIMIT: "true"
+  LOCAL_STORAGE_PATH: /tmp/reactive-resume-e2e-storage
+
+jobs:
+  e2e:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_DB: postgres
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d postgres"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: "pnpm"
+
+      - name: Install Dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run Server and Tooling Tests
+        run: pnpm exec turbo run test:ci --filter=server --filter=@reactive-resume/tooling
+
+      - name: Install Playwright Browser
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: Generate Test Secrets
+        run: |
+          echo "AUTH_SECRET=$(openssl rand -hex 32)" >> "$GITHUB_ENV"
+          echo "ENCRYPTION_SECRET=$(openssl rand -hex 32)" >> "$GITHUB_ENV"
+
+      - name: Prepare Storage
+        run: mkdir -p "$LOCAL_STORAGE_PATH"
+
+      - name: Run Database Migrations
+        run: pnpm db:migrate
+
+      - name: Build
+        run: pnpm build
+
+      - name: Run Baseline E2E Tests
+        env:
+          FLAG_SEMANTIC_CSS_AUTHORING: "false"
+          FLAG_SEMANTIC_CSS_DEFAULT: "false"
+        run: pnpm exec playwright test --grep-invert "@semantic-css"
+
+      - name: Run Semantic CSS Opt-In Acceptance
+        env:
+          FLAG_SEMANTIC_CSS_AUTHORING: "true"
+          FLAG_SEMANTIC_CSS_DEFAULT: "false"
+        run: |
+          pnpm exec playwright test \
+            tests/e2e/specs/semantic-css/legacy-conversion.spec.ts \
+            tests/e2e/specs/semantic-css/invalid-last-valid.spec.ts \
+            tests/e2e/specs/semantic-css/portable-stylesheet.spec.ts \
+            tests/e2e/specs/semantic-css/revision-conflict.spec.ts \
+            tests/e2e/specs/semantic-css/template-visual.spec.ts
+
+      - name: Run Semantic CSS Default-On Acceptance
+        env:
+          FLAG_SEMANTIC_CSS_AUTHORING: "true"
+          FLAG_SEMANTIC_CSS_DEFAULT: "true"
+        run: pnpm exec playwright test tests/e2e/specs/semantic-css/default-mode.spec.ts
+
+      - name: Run Semantic CSS Dormant Acceptance
+        env:
+          FLAG_SEMANTIC_CSS_AUTHORING: "false"
+          FLAG_SEMANTIC_CSS_DEFAULT: "false"
+        run: |
+          pnpm exec playwright test \
+            tests/e2e/specs/semantic-css/dormant-mode.spec.ts \
+            tests/e2e/specs/semantic-css/flag-off-semantic.spec.ts
+
+      - name: Upload Playwright Report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-report
+          path: |
+            playwright-report
+            test-results
+          if-no-files-found: ignore
+          retention-days: 7

.gitignore

@@ -36,6 +36,8 @@ logs
 # Testing
 coverage
 reports
+playwright-report
+test-results
 
 # Cache
 tmp
@@ -49,6 +51,8 @@ temp
 .cursor
 .codegraph
 .superpowers
+.worktrees
+.migration
 
 # Local Storage Data
 /data
@@ -56,3 +60,12 @@ temp
 
 # Git Hooks
 .vite-hooks/
+.ds-sync/
+ds-bundle/
+.design-sync/.cache/
+.design-sync/learnings/
+.design-sync/node_modules
+packages/ui/.ds-compiled.css
+packages/ui/.ds-tw-raw.css
+packages/ui/dist/
+i18n.cache

.markdownlint-cli2.yaml

@@ -0,0 +1,31 @@
+config:
+  default: true
+  MD007: false
+  MD009: false
+  MD010: false
+  MD012: false
+  MD013: false
+  MD001: false
+  MD022: false
+  MD024: false
+  MD025: false
+  MD028: false
+  MD031: false
+  MD032: false
+  MD033: false
+  MD034: false
+  MD036: false
+  MD040: false
+  MD041: false
+  MD046: false
+  MD060: false
+
+frontMatter: "^---[\\s\\S]*?---"
+gitignore: true
+globs:
+  - "**/*.{md,mdx}"
+ignores:
+  - ".design-sync/**"
+  - "node_modules/**"
+  - ".turbo/**"
+  - "dist/**"

.superpowers/sdd/pr-3274-review-followups-plan/task-1-report.md

@@ -0,0 +1,23 @@
+# Task 1: Harden public PDF response contract
+
+## Implemented
+
+- Pinned successful public PDF responses to `Content-Type: application/pdf` at the HTTP boundary.
+- Kept `Cache-Control: private, no-store` hardcoded at that boundary for successful, validation-error, and service-error responses.
+- Removed the unused `cacheControl` member from `createPublicResumePdf` and all affected tests/mocks.
+- Updated the route regression to return a `text/plain` file from the service mock while asserting the HTTP response remains `application/pdf`.
+
+## Verification
+
+- `pnpm --filter server test -- src/http/public-resume-pdf.test.ts` — 13 files / 71 tests passed.
+- `dotenvx run -f .env.local -- pnpm exec vitest run packages/api/src/features/resume/public-pdf.test.ts` — 1 file / 7 tests passed.
+- `pnpm exec biome check apps/server/src/http/public-resume-pdf.ts apps/server/src/http/public-resume-pdf.test.ts packages/api/src/features/resume/public-pdf.ts packages/api/src/features/resume/public-pdf.test.ts` — passed.
+- `pnpm --filter server typecheck` and `pnpm --filter @reactive-resume/api typecheck` — passed.
+
+## Note
+
+The API package test script did not scope to the supplied test path and initially ran the package suite, which has two unrelated baseline failures: `src/features/ai/url-policy.test.ts` and `src/features/resume/export.test.ts` (missing required env). The target test was then run directly with `.env.local` and passed.
+
+## Self-review
+
+`git diff --check` passed. The diff is restricted to the public PDF service contract, HTTP response header, and their focused tests.

.vscode/settings.json

@@ -27,5 +27,8 @@
 		["cn\\(([^)]*)\\)", "(?:'|\"|`)([^']*)(?:'|\"|`)"]
 	],
 	"tailwindCSS.experimental.configFile": "src/styles/globals.css",
-	"typescript.experimental.useTsgo": true
+	"typescript.experimental.useTsgo": true,
+	"[json]": {
+		"editor.defaultFormatter": "biomejs.biome"
+	}
 }

AGENTS.md

@@ -12,7 +12,7 @@ Internal packages are source-consumed through `package.json` export maps that po
 
 - **Node.js 24** (matches Dockerfile `ARG NODE_VERSION=24`). Use `nvm install 24 && nvm use 24` if needed.
 - **Docker** is required to run PostgreSQL. Start it with `sudo dockerd &` if the daemon isn't running.
-- **pnpm 11.1.2** is managed via corepack (`corepack enable`).
+- **pnpm 11.17.0** is managed via corepack (`corepack enable`).
 
 ### Codebase map
 

README.md

@@ -60,7 +60,7 @@ If your company would like to sponsor Reactive Resume, email [hello@amruthpillai
 - Professionally designed templates
 - A4 and Letter size support
 - Customizable colors, fonts, and spacing
-- Custom CSS for advanced styling
+- Structured Style Rules for section and text styling
 
 **Privacy & Control**
 
@@ -240,11 +240,11 @@ Other ways to support:
 
 ## Star History
 
-<a href="https://www.star-history.com/#amruthpillai/reactive-resume&type=date&legend=top-left">
+<a href="https://www.star-history.com/?repos=amruthpillai%2Freactive-resume&type=date&legend=top-left">
  <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=amruthpillai/reactive-resume&type=date&theme=dark&legend=top-left" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=amruthpillai/reactive-resume&type=date&legend=top-left" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=amruthpillai/reactive-resume&type=date&legend=top-left" />
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=amruthpillai/reactive-resume&type=date&theme=dark&legend=top-left&sealed_token=BF8sVMes0z5BhdkMhtFklhxeikeGUrSyW-CcY9E_RCQI5zqUHEbMRwcB075fUewbAtlNoCnDlWhDWjrDGhTcXMojsS2I0RCqcL-Y9p3Ez3H1A2QpRMthjFilP0YOCJEE9AZqRrqzlvj1uU2y5ixarXOuUXuuSw5DkLMViSMD8Ldl0H3BEgclnjWw4fI4" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=amruthpillai/reactive-resume&type=date&legend=top-left&sealed_token=BF8sVMes0z5BhdkMhtFklhxeikeGUrSyW-CcY9E_RCQI5zqUHEbMRwcB075fUewbAtlNoCnDlWhDWjrDGhTcXMojsS2I0RCqcL-Y9p3Ez3H1A2QpRMthjFilP0YOCJEE9AZqRrqzlvj1uU2y5ixarXOuUXuuSw5DkLMViSMD8Ldl0H3BEgclnjWw4fI4" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=amruthpillai/reactive-resume&type=date&legend=top-left&sealed_token=BF8sVMes0z5BhdkMhtFklhxeikeGUrSyW-CcY9E_RCQI5zqUHEbMRwcB075fUewbAtlNoCnDlWhDWjrDGhTcXMojsS2I0RCqcL-Y9p3Ez3H1A2QpRMthjFilP0YOCJEE9AZqRrqzlvj1uU2y5ixarXOuUXuuSw5DkLMViSMD8Ldl0H3BEgclnjWw4fI4" />
  </picture>
 </a>
 

apps/server/package.json

@@ -7,6 +7,7 @@
 		"dev": "tsx watch src/index.ts",
 		"build": "tsdown",
 		"start": "node dist/index.mjs",
+		"docs:gen": "tsx src/openapi/generate-spec.ts",
 		"typecheck": "tsgo --noEmit",
 		"test": "vitest run --passWithNoTests",
 		"test:coverage": "vitest run --coverage --passWithNoTests",
@@ -17,72 +18,84 @@
 		"#react-pdf-renderer": "@react-pdf/renderer"
 	},
 	"dependencies": {
-		"@ai-sdk/anthropic": "^3.0.85",
-		"@ai-sdk/google": "^3.0.83",
-		"@ai-sdk/openai": "^3.0.72",
-		"@ai-sdk/openai-compatible": "^2.0.51",
-		"@aws-sdk/client-s3": "^3.1070.0",
-		"@better-auth/api-key": "^1.6.19",
-		"@better-auth/drizzle-adapter": "^1.6.19",
-		"@better-auth/infra": "^0.2.14",
-		"@better-auth/oauth-provider": "^1.6.19",
-		"@better-auth/passkey": "^1.6.19",
-		"@hono/node-server": "^2.0.5",
-		"@modelcontextprotocol/sdk": "^1.29.0",
-		"@orpc/client": "^1.14.6",
-		"@orpc/experimental-ratelimit": "^1.14.6",
-		"@orpc/json-schema": "^1.14.6",
-		"@orpc/openapi": "^1.14.6",
-		"@orpc/server": "^1.14.6",
-		"@orpc/zod": "^1.14.6",
+		"@ai-sdk/anthropic": "^4.0.24",
+		"@ai-sdk/cerebras": "^3.0.17",
+		"@ai-sdk/cohere": "^4.0.15",
+		"@ai-sdk/deepseek": "^3.0.16",
+		"@ai-sdk/fireworks": "^3.0.18",
+		"@ai-sdk/google": "^4.0.28",
+		"@ai-sdk/groq": "^4.0.16",
+		"@ai-sdk/mistral": "^4.0.17",
+		"@ai-sdk/openai": "^4.0.24",
+		"@ai-sdk/openai-compatible": "^3.0.17",
+		"@ai-sdk/perplexity": "^4.0.17",
+		"@ai-sdk/togetherai": "^3.0.18",
+		"@ai-sdk/xai": "^4.0.22",
+		"@aws-sdk/client-s3": "^3.1098.0",
+		"@better-auth/api-key": "^1.6.25",
+		"@better-auth/drizzle-adapter": "^1.6.25",
+		"@better-auth/infra": "^0.3.7",
+		"@better-auth/oauth-provider": "^1.6.25",
+		"@better-auth/passkey": "^1.6.25",
+		"@bramus/specificity": "^2.4.2",
+		"@hono/node-server": "^2.0.12",
+		"@modelcontextprotocol/sdk": "^1.30.0",
+		"@orpc/client": "^1.14.13",
+		"@orpc/experimental-ratelimit": "^1.14.13",
+		"@orpc/json-schema": "^1.14.13",
+		"@orpc/openapi": "^1.14.13",
+		"@orpc/server": "^1.14.13",
+		"@orpc/zod": "^1.14.13",
 		"@react-pdf/renderer": "^4.5.1",
 		"@reactive-resume/api": "workspace:*",
 		"@reactive-resume/auth": "workspace:*",
 		"@reactive-resume/db": "workspace:*",
 		"@reactive-resume/env": "workspace:*",
 		"@reactive-resume/mcp": "workspace:*",
+		"@reactive-resume/pdf": "workspace:*",
 		"@reactive-resume/schema": "workspace:*",
 		"@reactive-resume/utils": "workspace:*",
 		"@sindresorhus/slugify": "^3.0.0",
 		"@t3-oss/env-core": "^0.13.11",
 		"@uiw/color-convert": "^2.10.3",
-		"ai": "^6.0.207",
+		"ai": "^7.0.42",
 		"bcrypt": "^6.0.0",
-		"better-auth": "1.6.19",
+		"better-auth": "1.6.25",
+		"canonicalize": "^3.0.0",
 		"cjk-regex": "^3.4.0",
+		"css-tree": "^3.2.1",
 		"deepmerge-ts": "^7.1.5",
-		"dompurify": "^3.4.10",
-		"dotenv": "^17.4.2",
-		"drizzle-orm": "1.0.0-rc.3",
+		"drizzle-orm": "1.0.0-rc.4",
 		"drizzle-zod": "1.0.0-beta.14-a36c63d",
-		"es-toolkit": "^1.47.1",
+		"es-toolkit": "^1.50.0",
 		"fast-json-patch": "^3.1.1",
-		"hono": "^4.12.25",
-		"jsonrepair": "^3.14.0",
-		"node-html-parser": "^7.1.0",
-		"nodemailer": "^9.0.0",
-		"ollama-ai-provider-v2": "^3.6.0",
-		"pg": "^8.21.0",
+		"hono": "^4.12.32",
+		"jsonrepair": "^3.15.0",
+		"node-html-parser": "^9.0.1",
+		"nodemailer": "^9.0.3",
+		"ollama-ai-provider-v2": "^4.0.1",
+		"pdfjs-dist": "^6.2.108",
+		"pg": "^8.22.0",
 		"phosphor-icons-react-pdf": "^0.1.3",
-		"react": "^19.2.7",
-		"react-email": "^6.6.3",
+		"react": "^19.2.8",
+		"react-email": "^6.9.1",
 		"react-pdf-html": "^2.1.5",
 		"resumable-stream": "^2.2.12",
-		"sharp": "^0.35.1",
+		"sharp": "^0.35.3",
 		"ts-pattern": "^5.9.0",
 		"unique-names-generator": "^4.7.1",
-		"uuid": "^14.0.0",
+		"uuid": "^14.0.1",
 		"zod": "^4.4.3"
 	},
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
-		"@types/node": "^25.9.3",
+		"@types/node": "^26.1.2",
 		"@types/pg": "^8.20.0",
 		"@types/react": "^19.2.17",
-		"@typescript/native-preview": "7.0.0-dev.20260617.2",
-		"tsdown": "^0.22.3",
-		"tsx": "^4.22.4",
-		"typescript": "^6.0.3",
-		"vitest": "^4.1.9"
+		"@typescript/native-preview": "7.0.0-dev.20260707.2",
+		"tsdown": "^0.22.14",
+		"tsx": "^4.23.1",
+		"typescript": "^7.0.2",
+		"vitest": "^4.1.10"
 	}
 }

apps/server/src/http/app.test.ts

@@ -9,6 +9,7 @@ const mocks = vi.hoisted(() => ({
 	handleUpload: vi.fn(),
 	handleMcp: vi.fn(),
 	handleResumePdfDownload: vi.fn(),
+	handlePublicResumePdf: vi.fn(),
 	handleMcpServerCard: vi.fn(),
 	handleOAuthAuthorizationServer: vi.fn(),
 	handleOAuthProtectedResource: vi.fn(),
@@ -19,7 +20,6 @@ const mocks = vi.hoisted(() => ({
 	handleLlms: vi.fn(),
 	serveWebDistStatic: vi.fn(),
 	handleWebApp: vi.fn(),
-	handleWebAppHead: vi.fn(),
 }));
 
 vi.mock("./auth", () => ({
@@ -60,7 +60,6 @@ vi.mock("../static/seo", () => ({
 vi.mock("../static/web", () => ({
 	serveWebDistStatic: mocks.serveWebDistStatic,
 	handleWebApp: mocks.handleWebApp,
-	handleWebAppHead: mocks.handleWebAppHead,
 }));
 
 vi.mock("../mcp/handler", () => ({
@@ -71,6 +70,15 @@ vi.mock("./resume-pdf", () => ({
 	handleResumePdfDownload: mocks.handleResumePdfDownload,
 }));
 
+vi.mock("./public-resume-pdf", () => ({
+	handlePublicResumePdf: mocks.handlePublicResumePdf,
+}));
+
+const transportEnv = (remoteAddress: string) =>
+	({
+		incoming: { socket: { remoteAddress } },
+	}) as never;
+
 beforeEach(() => {
 	vi.clearAllMocks();
 	mocks.handleAuth.mockResolvedValue(new Response("auth"));
@@ -81,6 +89,7 @@ beforeEach(() => {
 	mocks.handleUpload.mockResolvedValue(new Response("upload"));
 	mocks.handleMcp.mockResolvedValue(new Response("mcp"));
 	mocks.handleResumePdfDownload.mockResolvedValue(new Response("pdf"));
+	mocks.handlePublicResumePdf.mockResolvedValue(new Response("public-pdf"));
 	mocks.handleMcpServerCard.mockReturnValue(new Response("server-card"));
 	mocks.handleOAuthAuthorizationServer.mockReturnValue(new Response("oauth-authorization-server"));
 	mocks.handleOAuthProtectedResource.mockReturnValue(new Response("oauth-protected-resource"));
@@ -91,7 +100,6 @@ beforeEach(() => {
 	mocks.handleLlms.mockReturnValue(new Response("llms"));
 	mocks.serveWebDistStatic.mockResolvedValue(undefined);
 	mocks.handleWebApp.mockResolvedValue(new Response("web"));
-	mocks.handleWebAppHead.mockReturnValue(new Response(null));
 });
 
 describe("createApp", () => {
@@ -120,6 +128,51 @@ describe("createApp", () => {
 		expect(mocks.handleWebApp).not.toHaveBeenCalled();
 	});
 
+	it("uses the transport address for public PDF fallback despite rotated forwarding headers", async () => {
+		const { createApp } = await import("./app");
+		const app = createApp();
+		const first = new Request("http://localhost:3001/api/resumes/jane/resume/pdf?reason=render-data-hash", {
+			headers: { "x-forwarded-for": "198.51.100.1" },
+		});
+		const rotated = new Request("http://localhost:3001/api/resumes/jane/resume/pdf?reason=render-data-hash", {
+			headers: { "x-forwarded-for": "198.51.100.2" },
+		});
+		const env = transportEnv("203.0.113.9");
+
+		const response = await app.fetch(first, env);
+		await app.fetch(rotated, env);
+
+		await expect(response.text()).resolves.toBe("public-pdf");
+		expect(mocks.handlePublicResumePdf).toHaveBeenNthCalledWith(1, first, "jane", "resume", "203.0.113.9");
+		expect(mocks.handlePublicResumePdf).toHaveBeenNthCalledWith(2, rotated, "jane", "resume", "203.0.113.9");
+		expect(mocks.handleResumePdfDownload).not.toHaveBeenCalled();
+		expect(mocks.serveWebDistStatic).not.toHaveBeenCalled();
+		expect(mocks.handleWebApp).not.toHaveBeenCalled();
+	});
+
+	it("passes the transport address to RPC and OpenAPI and fails closed when it is unavailable", async () => {
+		const { createApp } = await import("./app");
+		const app = createApp();
+		const trustedRpcRequest = new Request("http://localhost:3001/api/rpc", {
+			headers: { "cf-connecting-ip": "198.51.100.1" },
+		});
+		const unknownRpcRequest = new Request("http://localhost:3001/api/rpc", {
+			headers: { "cf-connecting-ip": "198.51.100.2" },
+		});
+		const trustedOpenApiRequest = new Request("http://localhost:3001/api/openapi/resumes/jane/resume/style-projection");
+		const unknownOpenApiRequest = new Request("http://localhost:3001/api/openapi/resumes/jane/resume/style-projection");
+
+		await app.fetch(trustedRpcRequest, transportEnv("203.0.113.9"));
+		await app.fetch(unknownRpcRequest);
+		await app.fetch(trustedOpenApiRequest, transportEnv("203.0.113.9"));
+		await app.fetch(unknownOpenApiRequest);
+
+		expect(mocks.handleRpc).toHaveBeenNthCalledWith(1, trustedRpcRequest, "203.0.113.9");
+		expect(mocks.handleRpc).toHaveBeenNthCalledWith(2, unknownRpcRequest, "unknown");
+		expect(mocks.handleOpenApi).toHaveBeenNthCalledWith(1, trustedOpenApiRequest, "203.0.113.9");
+		expect(mocks.handleOpenApi).toHaveBeenNthCalledWith(2, unknownOpenApiRequest, "unknown");
+	});
+
 	it.each([
 		["GET", "/robots.txt", "robots", mocks.handleRobots],
 		["HEAD", "/robots.txt", "", mocks.handleRobots],
@@ -138,6 +191,5 @@ describe("createApp", () => {
 		expect(handler).toHaveBeenCalledWith({ head: method === "HEAD" });
 		expect(mocks.serveWebDistStatic).not.toHaveBeenCalled();
 		expect(mocks.handleWebApp).not.toHaveBeenCalled();
-		expect(mocks.handleWebAppHead).not.toHaveBeenCalled();
 	});
 });

apps/server/src/http/app.ts

@@ -1,3 +1,7 @@
+import type { Http2Bindings, HttpBindings } from "@hono/node-server";
+import type { Context } from "hono";
+import { isIP } from "node:net";
+import { getConnInfo } from "@hono/node-server/conninfo";
 import { Hono } from "hono";
 import { handleMcp } from "../mcp/handler";
 import { handleOpenApi } from "../openapi/handler";
@@ -12,21 +16,36 @@ import { handleRpc } from "../rpc/handler";
 import { handleSchemaJson } from "../static/schema";
 import { handleLlms, handleRobots, handleSitemap } from "../static/seo";
 import { handleUpload } from "../static/uploads";
-import { handleWebApp, handleWebAppHead, serveWebDistStatic } from "../static/web";
+import { handleWebApp, serveWebDistStatic } from "../static/web";
 import { handleAuth, handleOAuth } from "./auth";
 import { handleHealth } from "./health";
+import { handlePublicResumePdf } from "./public-resume-pdf";
 import { handleResumePdfDownload } from "./resume-pdf";
 
-export function createApp() {
-	const app = new Hono();
+type ServerEnvironment = { Bindings: HttpBindings | Http2Bindings };
 
-	app.all("/api/rpc", (c) => handleRpc(c.req.raw));
-	app.all("/api/rpc/*", (c) => handleRpc(c.req.raw));
-	app.all("/api/openapi", (c) => handleOpenApi(c.req.raw));
-	app.all("/api/openapi/*", (c) => handleOpenApi(c.req.raw));
+const getTrustedClient = (context: Context<ServerEnvironment>): string => {
+	try {
+		const address = getConnInfo(context).remote.address?.trim();
+		return address && isIP(address) ? address : "unknown";
+	} catch {
+		return "unknown";
+	}
+};
+
+export function createApp() {
+	const app = new Hono<ServerEnvironment>();
+
+	app.all("/api/rpc", (c) => handleRpc(c.req.raw, getTrustedClient(c)));
+	app.all("/api/rpc/*", (c) => handleRpc(c.req.raw, getTrustedClient(c)));
+	app.all("/api/openapi", (c) => handleOpenApi(c.req.raw, getTrustedClient(c)));
+	app.all("/api/openapi/*", (c) => handleOpenApi(c.req.raw, getTrustedClient(c)));
 	app.get("/api/auth/oauth", (c) => handleOAuth(c.req.raw));
 	app.all("/api/auth/*", (c) => handleAuth(c.req.raw));
 	app.get("/api/health", () => handleHealth());
+	app.get("/api/resumes/:username/:slug/pdf", (c) =>
+		handlePublicResumePdf(c.req.raw, c.req.param("username"), c.req.param("slug"), getTrustedClient(c)),
+	);
 	app.get("/api/resumes/:id/pdf", (c) => handleResumePdfDownload(c.req.raw, c.req.param("id")));
 	app.get("/api/uploads/*", (c) => handleUpload(c.req.raw));
 	app.get("/uploads/*", (c) => handleUpload(c.req.raw));
@@ -47,8 +66,7 @@ export function createApp() {
 	app.on(["GET", "HEAD"], "/llms.txt", (c) => handleLlms({ head: c.req.method === "HEAD" }));
 
 	app.use("/*", serveWebDistStatic);
-	app.on(["GET"], "/*", (c) => handleWebApp(c.req.raw));
-	app.on(["HEAD"], "/*", (c) => handleWebAppHead(c.req.raw));
+	app.on(["GET", "HEAD"], "/*", (c) => handleWebApp(c.req.raw));
 
 	return app;
 }

apps/server/src/http/health.ts

@@ -1,4 +1,5 @@
 import { sql } from "drizzle-orm";
+import { withTimeout } from "es-toolkit";
 import { getStorageService } from "@reactive-resume/api/features/storage";
 import { db } from "@reactive-resume/db/client";
 
@@ -11,30 +12,12 @@ type CheckResult = {
 	[key: string]: unknown;
 };
 
-function getErrorMessage(error: unknown): string {
-	if (error instanceof Error) return error.message;
-	return "Unknown error";
-}
-
-async function withTimeout<T>(promise: Promise<T>, timeoutMs: number): Promise<T> {
-	let timeoutId: NodeJS.Timeout | undefined;
-
-	const timeout = new Promise<never>((_, reject) => {
-		timeoutId = setTimeout(() => reject(new Error(`Timed out after ${timeoutMs}ms`)), timeoutMs);
-	});
-
-	try {
-		return await Promise.race([promise, timeout]);
-	} finally {
-		if (timeoutId) clearTimeout(timeoutId);
-	}
-}
-
+// ponytail: es-toolkit withTimeout takes a fn, not a promise — call site passes check (not check())
 async function runCheck(check: () => Promise<object>): Promise<CheckResult> {
 	const startedAt = performance.now();
 
 	try {
-		const data = await withTimeout(check(), HEALTHCHECK_TIMEOUT_MS);
+		const data = await withTimeout(check, HEALTHCHECK_TIMEOUT_MS);
 		const latencyMs = Math.round(performance.now() - startedAt);
 		const result = data as { status?: string };
 		if (result.status === "unhealthy") return { ...(data as object), status: "unhealthy", latencyMs };
@@ -42,35 +25,19 @@ async function runCheck(check: () => Promise<object>): Promise<CheckResult> {
 	} catch (error) {
 		return {
 			status: "unhealthy",
-			error: getErrorMessage(error),
+			error: error instanceof Error ? error.message : "Unknown error",
 			latencyMs: Math.round(performance.now() - startedAt),
 		};
 	}
 }
 
+// ponytail: inner try/catches removed; runCheck's outer catch handles all errors
 async function checkDatabase() {
-	try {
-		await db.execute(sql`SELECT 1`);
-		return { status: "healthy" };
-	} catch (error) {
-		return {
-			status: "unhealthy",
-			error: error instanceof Error ? error.message : "Unknown error",
-		};
-	}
+	await db.execute(sql`SELECT 1`);
+	return { status: "healthy" };
 }
 
-async function checkStorage() {
-	try {
-		const storageService = getStorageService();
-		return await storageService.healthcheck();
-	} catch (error) {
-		return {
-			status: "unhealthy",
-			error: error instanceof Error ? error.message : "Unknown error",
-		};
-	}
-}
+const checkStorage = () => getStorageService().healthcheck();
 
 export async function handleHealth() {
 	const [database, storage] = await Promise.all([runCheck(checkDatabase), runCheck(checkStorage)]);

apps/server/src/http/public-resume-pdf.test.ts

@@ -0,0 +1,109 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+	createPublicResumePdf: vi.fn(),
+}));
+
+vi.mock("@reactive-resume/api/features/resume/public-pdf", () => ({
+	createPublicResumePdf: mocks.createPublicResumePdf,
+	PUBLIC_RESUME_PDF_MISMATCH_REASONS: [
+		"missing-projection",
+		"format-version",
+		"language-version",
+		"semantic-tree-version",
+		"registry-fingerprint",
+		"adapter-fingerprint",
+		"render-data-hash",
+		"invalid-projection",
+	],
+}));
+
+const { handlePublicResumePdf } = await import("./public-resume-pdf");
+const trustedClient = "203.0.113.9";
+
+describe("handlePublicResumePdf", () => {
+	beforeEach(() => vi.clearAllMocks());
+
+	it("returns the authorized fallback PDF with strict mismatch metadata and cache policy", async () => {
+		const body = new File(["%PDF"], "Ada_Lovelace.pdf", { type: "text/plain" });
+		mocks.createPublicResumePdf.mockResolvedValueOnce({
+			body,
+			filename: "Ada_Lovelace.pdf",
+		});
+		const registry = "0".repeat(64);
+		const adapter = "1".repeat(64);
+		const request = new Request(
+			`https://example.com/api/resumes/jane/resume/pdf?reason=render-data-hash&registryFingerprint=${registry}&adapterFingerprint=${adapter}`,
+			{ headers: { "x-forwarded-for": "203.0.113.7" } },
+		);
+
+		const response = await handlePublicResumePdf(request, "jane", "resume", trustedClient);
+
+		expect(response.status).toBe(200);
+		expect(response.headers.get("Content-Type")).toBe("application/pdf");
+		expect(response.headers.get("Content-Disposition")).toBe('inline; filename="Ada_Lovelace.pdf"');
+		expect(response.headers.get("Cache-Control")).toBe("private, no-store");
+		expect(response.headers.get("X-Content-Type-Options")).toBe("nosniff");
+		expect(await response.text()).toBe("%PDF");
+		expect(mocks.createPublicResumePdf).toHaveBeenCalledWith({
+			username: "jane",
+			slug: "resume",
+			requestHeaders: request.headers,
+			trustedClient,
+			mismatchReason: "render-data-hash",
+			clientRegistryFingerprint: registry,
+			clientAdapterFingerprint: adapter,
+		});
+	});
+
+	it("defaults a missing mismatch reason and keeps password/private responses uncacheable", async () => {
+		mocks.createPublicResumePdf.mockResolvedValueOnce({
+			body: new File(["%PDF"], "resume.pdf", { type: "application/pdf" }),
+			filename: "resume.pdf",
+		});
+		const request = new Request("https://example.com/api/resumes/jane/resume/pdf");
+
+		const response = await handlePublicResumePdf(request, "jane", "resume", trustedClient);
+
+		expect(response.headers.get("Cache-Control")).toBe("private, no-store");
+		expect(mocks.createPublicResumePdf).toHaveBeenCalledWith(
+			expect.objectContaining({ mismatchReason: "missing-projection" }),
+		);
+	});
+
+	it.each([
+		[{ code: "BAD_REQUEST" }, 400],
+		[{ code: "NEED_PASSWORD" }, 401],
+		[{ code: "NOT_FOUND" }, 404],
+		[{ code: "RATE_LIMIT_EXCEEDED" }, 429],
+		[{ code: "INTERNAL_SERVER_ERROR" }, 500],
+	])("maps controlled API errors without caching the response", async (error, status) => {
+		mocks.createPublicResumePdf.mockRejectedValueOnce(error);
+
+		const response = await handlePublicResumePdf(
+			new Request("https://example.com/api/resumes/jane/resume/pdf"),
+			"jane",
+			"resume",
+			trustedClient,
+		);
+
+		expect(response.status).toBe(status);
+		expect(response.headers.get("Cache-Control")).toBe("private, no-store");
+	});
+
+	it.each(["?reason=private-source", "?registryFingerprint=unsafe", "?adapterFingerprint=unsafe"])(
+		"rejects invalid fallback metadata before the API service",
+		async (search) => {
+			const response = await handlePublicResumePdf(
+				new Request(`https://example.com/api/resumes/jane/resume/pdf${search}`),
+				"jane",
+				"resume",
+				trustedClient,
+			);
+
+			expect(response.status).toBe(400);
+			expect(response.headers.get("Cache-Control")).toBe("private, no-store");
+			expect(mocks.createPublicResumePdf).not.toHaveBeenCalled();
+		},
+	);
+});

apps/server/src/http/public-resume-pdf.ts

@@ -0,0 +1,72 @@
+import type { PublicResumePdfMismatchReason } from "@reactive-resume/api/features/resume/public-pdf";
+import {
+	createPublicResumePdf,
+	PUBLIC_RESUME_PDF_MISMATCH_REASONS,
+} from "@reactive-resume/api/features/resume/public-pdf";
+
+const noStoreResponse = (body: string, status: number) =>
+	new Response(body, { status, headers: { "Cache-Control": "private, no-store" } });
+
+const errorStatus = (error: unknown): number => {
+	const code = typeof error === "object" && error && "code" in error ? (error as { code?: unknown }).code : undefined;
+	if (code === "BAD_REQUEST") return 400;
+	if (code === "NEED_PASSWORD") return 401;
+	if (code === "NOT_FOUND") return 404;
+	if (code === "RATE_LIMIT_EXCEEDED") return 429;
+	return 500;
+};
+
+const fingerprint = (value: string | null): string | undefined => {
+	if (value === null) return;
+	return /^[a-f0-9]{64}$/.test(value) ? value : undefined;
+};
+
+export async function handlePublicResumePdf(
+	request: Request,
+	username: string,
+	slug: string,
+	trustedClient = "unknown",
+): Promise<Response> {
+	const searchParams = new URL(request.url).searchParams;
+	const rawReason = searchParams.get("reason") ?? "missing-projection";
+	if (!PUBLIC_RESUME_PDF_MISMATCH_REASONS.includes(rawReason as PublicResumePdfMismatchReason)) {
+		return noStoreResponse("Invalid fallback metadata", 400);
+	}
+	const rawRegistryFingerprint = searchParams.get("registryFingerprint");
+	const rawAdapterFingerprint = searchParams.get("adapterFingerprint");
+	const clientRegistryFingerprint = fingerprint(rawRegistryFingerprint);
+	const clientAdapterFingerprint = fingerprint(rawAdapterFingerprint);
+	if (
+		(rawRegistryFingerprint !== null && clientRegistryFingerprint === undefined) ||
+		(rawAdapterFingerprint !== null && clientAdapterFingerprint === undefined)
+	) {
+		return noStoreResponse("Invalid fallback metadata", 400);
+	}
+
+	try {
+		const result = await createPublicResumePdf({
+			username,
+			slug,
+			requestHeaders: request.headers,
+			trustedClient,
+			mismatchReason: rawReason as PublicResumePdfMismatchReason,
+			...(clientRegistryFingerprint ? { clientRegistryFingerprint } : {}),
+			...(clientAdapterFingerprint ? { clientAdapterFingerprint } : {}),
+		});
+
+		return new Response(result.body, {
+			headers: {
+				"Content-Type": "application/pdf",
+				"Content-Disposition": `inline; filename="${result.filename.replaceAll('"', "")}"`,
+				"Cache-Control": "private, no-store",
+				"X-Content-Type-Options": "nosniff",
+			},
+		});
+	} catch (error) {
+		const status = errorStatus(error);
+		return noStoreResponse(
+			status === 500 ? "Failed to generate public resume PDF" : "Public resume PDF unavailable",
+			status,
+		);
+	}
+}

apps/server/src/http/resume-pdf.test.ts

@@ -40,7 +40,32 @@ describe("handleResumePdfDownload", () => {
 		expect(response.headers.get("Content-Disposition")).toBe('attachment; filename="Scizor.pdf"');
 		expect(response.headers.get("Cache-Control")).toBe("private, no-store");
 		expect(await response.text()).toBe("%PDF");
-		expect(mocks.createResumePdfDownload).toHaveBeenCalledWith({ id: "resume-1", userId: "user-1" });
+		expect(mocks.createResumePdfDownload).toHaveBeenCalledWith({ id: "resume-1", userId: "user-1", target: "resume" });
+	});
+
+	it("passes the cover letter target through to PDF rendering", async () => {
+		const pdf = new File([new Uint8Array([37, 80, 68, 70])], "Cover Letter.pdf", { type: "application/pdf" });
+		mocks.verifyResumePdfDownloadToken.mockReturnValueOnce({
+			ok: true,
+			resumeId: "resume-1",
+			userId: "user-1",
+			expiresAt: "2026-06-01T10:10:00.000Z",
+		});
+		mocks.createResumePdfDownload.mockResolvedValueOnce({
+			headers: { "content-disposition": 'attachment; filename="Cover Letter.pdf"' },
+			body: pdf,
+		});
+
+		await handleResumePdfDownload(
+			new Request("https://example.com/api/resumes/resume-1/pdf?token=signed&target=cover-letter"),
+			"resume-1",
+		);
+
+		expect(mocks.createResumePdfDownload).toHaveBeenCalledWith({
+			id: "resume-1",
+			userId: "user-1",
+			target: "cover-letter",
+		});
 	});
 
 	it("rejects missing, invalid, and expired tokens before rendering", async () => {

apps/server/src/http/resume-pdf.ts

@@ -24,14 +24,16 @@ function errorStatus(error: unknown) {
 }
 
 export async function handleResumePdfDownload(request: Request, id: string) {
-	const token = new URL(request.url).searchParams.get("token");
+	const searchParams = new URL(request.url).searchParams;
+	const token = searchParams.get("token");
 	if (!token) return unauthorizedResponse();
 
 	const verification = verifyResumePdfDownloadToken({ resumeId: id, token });
 	if (!verification.ok) return verification.reason === "expired" ? expiredResponse() : unauthorizedResponse();
 
 	try {
-		const download = await createResumePdfDownload({ id, userId: verification.userId });
+		const target = searchParams.get("target") === "cover-letter" ? "cover-letter" : "resume";
+		const download = await createResumePdfDownload({ id, userId: verification.userId, target });
 
 		return new Response(download.body, {
 			headers: {

apps/server/src/mcp/handler.ts

@@ -7,7 +7,7 @@ export async function handleMcp(request: Request) {
 	try {
 		await authenticateRequest(request);
 
-		const server = await createMcpServer(request);
+		const server = createMcpServer(request);
 		const transport = new WebStandardStreamableHTTPServerTransport({
 			enableJsonResponse: true,
 		});

apps/server/src/mcp/server.ts

@@ -22,7 +22,7 @@ function createRequestClient(request: Request): RouterClient<typeof router> {
 	});
 }
 
-export async function createMcpServer(request: Request) {
+export function createMcpServer(request: Request) {
 	const server = new McpServer(
 		{
 			name: "reactive-resume",

apps/server/src/openapi/generate-spec.test.ts

@@ -0,0 +1,27 @@
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, expect, it } from "vitest";
+import { generateOpenApiDocumentation } from "./generate-spec";
+
+const temporaryDirectories: string[] = [];
+const committedSpec = new URL("../../../../docs/spec.json", import.meta.url);
+
+afterEach(async () => {
+	await Promise.all(temporaryDirectories.splice(0).map((path) => rm(path, { recursive: true, force: true })));
+});
+
+it("keeps the committed OpenAPI specification synchronized without rewriting it", async () => {
+	const directory = await mkdtemp(join(tmpdir(), "openapi-documentation-"));
+	temporaryDirectories.push(directory);
+	const firstTarget = join(directory, "first.json");
+	const secondTarget = join(directory, "second.json");
+	const before = await readFile(committedSpec, "utf8");
+
+	await generateOpenApiDocumentation(firstTarget);
+	await generateOpenApiDocumentation(secondTarget);
+
+	expect(await readFile(firstTarget, "utf8")).toBe(before);
+	expect(await readFile(secondTarget, "utf8")).toBe(before);
+	expect(await readFile(committedSpec, "utf8")).toBe(before);
+});

apps/server/src/openapi/generate-spec.ts

@@ -0,0 +1,20 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+
+export async function generateOpenApiDocumentation(
+	target = fileURLToPath(new URL("../../../../docs/spec.json", import.meta.url)),
+) {
+	const packageJson = JSON.parse(await readFile(new URL("../../../../package.json", import.meta.url), "utf8")) as {
+		version: string;
+	};
+	process.env.APP_URL ??= "https://rxresu.me";
+	process.env.DATABASE_URL ??= "postgresql://localhost/reactive_resume_docs";
+	process.env.AUTH_SECRET ??= "documentation-generation-isolated-process-only";
+	const { generateOpenApiSpec } = await import("./generator");
+	const spec = await generateOpenApiSpec({ appUrl: "https://rxresu.me", version: packageJson.version });
+	await writeFile(target, `${JSON.stringify(spec, null, "\t")}\n`);
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+	await generateOpenApiDocumentation(process.argv[2]);
+}

apps/server/src/openapi/generator.test.ts

@@ -0,0 +1,147 @@
+import { describe, expect, it } from "vitest";
+import z from "zod";
+import { defaultResumeData } from "@reactive-resume/schema/resume/default";
+import { createResumeDataJsonSchema } from "@reactive-resume/schema/resume/json-schema";
+
+type GeneratedSpecView = {
+	components?: { schemas?: Record<string, unknown> };
+	paths?: Record<
+		string,
+		Record<
+			string,
+			{
+				requestBody?: {
+					content?: Record<string, { schema?: unknown }>;
+				};
+			}
+		>
+	>;
+};
+
+async function generateSpec() {
+	process.env.APP_URL ??= "https://rxresu.me";
+	process.env.DATABASE_URL ??= "postgresql://localhost/reactive_resume_test";
+	process.env.AUTH_SECRET ??= "openapi-generator-test-process-only";
+	const { generateOpenApiSpec } = await import("./generator");
+	return generateOpenApiSpec({
+		appUrl: "https://rxresu.me",
+		version: "9.8.7",
+	});
+}
+
+function getRequestSchema(spec: GeneratedSpecView, path: string, method: string) {
+	return spec.paths?.[path]?.[method]?.requestBody?.content?.["application/json"]?.schema;
+}
+
+function containsImpossibleSchema(value: unknown): boolean {
+	if (Array.isArray(value)) return value.some(containsImpossibleSchema);
+	if (typeof value !== "object" || value === null) return false;
+	const object = value as Record<string, unknown>;
+	const negated = object.not;
+	if (typeof negated === "object" && negated !== null && Object.keys(negated).length === 0) {
+		return true;
+	}
+	return Object.values(object).some(containsImpossibleSchema);
+}
+
+function findImpossibleRequestSchemas(spec: GeneratedSpecView) {
+	const impossibleRequests: string[] = [];
+	for (const [path, operations] of Object.entries(spec.paths ?? {})) {
+		for (const [method, operation] of Object.entries(operations)) {
+			for (const [mediaType, content] of Object.entries(operation.requestBody?.content ?? {})) {
+				if (containsImpossibleSchema(content.schema)) {
+					impossibleRequests.push(`${method.toUpperCase()} ${path} (${mediaType})`);
+				}
+			}
+		}
+	}
+	return impossibleRequests;
+}
+
+describe("generateOpenApiSpec", () => {
+	it("uses caller-provided application URL and version", async () => {
+		const spec = await generateSpec();
+
+		expect(spec.info).toMatchObject({
+			title: "Reactive Resume",
+			version: "9.8.7",
+		});
+		expect(spec.servers).toEqual([{ url: "https://rxresu.me/api/openapi" }]);
+		expect(spec.externalDocs).toEqual({
+			url: "https://docs.rxresu.me",
+			description: "Reactive Resume Documentation",
+		});
+	}, 15_000);
+
+	it("uses the canonical input-side ResumeData schema in update requests", async () => {
+		const spec = (await generateSpec()) as GeneratedSpecView;
+		const { $schema: _dialect, ...canonicalInputSchema } = createResumeDataJsonSchema();
+
+		expect(spec.components?.schemas?.ResumeData).toEqual(canonicalInputSchema);
+		expect(getRequestSchema(spec, "/resumes/{id}", "put")).toMatchObject({
+			properties: {
+				data: { $ref: "#/components/schemas/ResumeData" },
+			},
+		});
+	});
+
+	it("publishes the custom-section type and item correlation", async () => {
+		const spec = (await generateSpec()) as GeneratedSpecView;
+		const schema = z.fromJSONSchema(spec.components?.schemas?.ResumeData as Parameters<typeof z.fromJSONSchema>[0]);
+		const mismatched = {
+			...defaultResumeData,
+			customSections: [
+				{
+					id: "custom-experience",
+					type: "experience",
+					title: "Experience",
+					icon: "",
+					columns: 1,
+					hidden: false,
+					keepTogether: false,
+					startOnNewPage: false,
+					items: [{ id: "summary-item", hidden: false, content: "<p>Not an experience item</p>" }],
+				},
+			],
+		};
+
+		expect(schema.safeParse(mismatched).success).toBe(false);
+	});
+
+	it("does not publish impossible request schemas", async () => {
+		const spec = (await generateSpec()) as GeneratedSpecView;
+
+		expect(findImpossibleRequestSchemas(spec)).toEqual([]);
+	});
+
+	it("checks every request body media type for impossible schemas", () => {
+		const spec: GeneratedSpecView = {
+			paths: {
+				"/documents": {
+					post: {
+						requestBody: {
+							content: {
+								"application/json": { schema: { type: "object" } },
+								"multipart/form-data": { schema: { not: {} } },
+							},
+						},
+					},
+				},
+			},
+		};
+
+		expect(findImpossibleRequestSchemas(spec)).toEqual(["POST /documents (multipart/form-data)"]);
+	});
+
+	it("documents imported data as an accepted ResumeData input", async () => {
+		const spec = (await generateSpec()) as GeneratedSpecView;
+
+		expect(getRequestSchema(spec, "/resumes/import", "post")).toEqual({
+			type: "object",
+			properties: {
+				data: { $ref: "#/components/schemas/ResumeData" },
+			},
+			required: ["data"],
+		});
+	});
+});

apps/server/src/openapi/generator.ts

@@ -0,0 +1,80 @@
+import { OpenAPIGenerator } from "@orpc/openapi";
+import { JSON_SCHEMA_INPUT_REGISTRY, ZodToJsonSchemaConverter } from "@orpc/zod/zod4";
+import { downloadResumePdfProcedure } from "@reactive-resume/api/features/resume/export";
+import router from "@reactive-resume/api/routers";
+import { resumeDataSchema } from "@reactive-resume/schema/resume/data";
+import { createResumeDataJsonSchema } from "@reactive-resume/schema/resume/json-schema";
+
+export const openAPIRouter = {
+	...router,
+	resume: {
+		...router.resume,
+		downloadPdf: downloadResumePdfProcedure,
+	},
+};
+
+const { $schema: _dialect, ...resumeDataInputSchema } = createResumeDataJsonSchema();
+type ResumeDataInputJsonSchema = Parameters<typeof JSON_SCHEMA_INPUT_REGISTRY.add<typeof resumeDataSchema>>[1];
+JSON_SCHEMA_INPUT_REGISTRY.add(resumeDataSchema, resumeDataInputSchema as unknown as ResumeDataInputJsonSchema);
+const importResumeInputSchema = openAPIRouter.resume.import["~orpc"].inputSchema;
+if (importResumeInputSchema) {
+	JSON_SCHEMA_INPUT_REGISTRY.add(importResumeInputSchema, {
+		type: "object",
+		properties: {
+			data: { $ref: "#/components/schemas/ResumeData" },
+		},
+		required: ["data"],
+	});
+}
+
+const openAPIGenerator = new OpenAPIGenerator({
+	schemaConverters: [
+		new ZodToJsonSchemaConverter({
+			interceptors: [
+				({ options, next }) => {
+					const [required, schema] = next();
+					const impossible =
+						Object.keys(schema).length === 1 &&
+						typeof schema.not === "object" &&
+						schema.not !== null &&
+						Object.keys(schema.not).length === 0;
+					return options.strategy === "input" && impossible ? [required, {}] : [required, schema];
+				},
+			],
+		}),
+	],
+});
+
+type GenerateOpenApiSpecOptions = {
+	appUrl: string;
+	version: string;
+};
+
+export async function generateOpenApiSpec({ appUrl, version }: GenerateOpenApiSpecOptions) {
+	return await openAPIGenerator.generate(openAPIRouter, {
+		info: {
+			title: "Reactive Resume",
+			version,
+			description: "Reactive Resume API",
+			license: { name: "MIT", url: "https://github.com/amruthpillai/reactive-resume/blob/main/LICENSE" },
+			contact: { name: "Amruth Pillai", email: "hello@amruthpillai.com", url: "https://amruthpillai.com" },
+		},
+		servers: [{ url: `${appUrl}/api/openapi` }],
+		externalDocs: { url: "https://docs.rxresu.me", description: "Reactive Resume Documentation" },
+		commonSchemas: {
+			ResumeData: { schema: resumeDataSchema, strategy: "input" },
+		},
+		components: {
+			securitySchemes: {
+				apiKey: {
+					type: "apiKey",
+					name: "x-api-key",
+					in: "header",
+					description: "The API key to authenticate requests.",
+				},
+			},
+		},
+		security: [{ apiKey: [] }],
+		filter: ({ contract }) => !contract["~orpc"].route.tags?.includes("Internal"),
+	});
+}

apps/server/src/openapi/handler.ts

@@ -1,24 +1,13 @@
 import { SmartCoercionPlugin } from "@orpc/json-schema";
-import { OpenAPIGenerator } from "@orpc/openapi";
 import { OpenAPIHandler } from "@orpc/openapi/fetch";
 import { onError } from "@orpc/server";
 import { BatchHandlerPlugin, RequestHeadersPlugin, StrictGetMethodPlugin } from "@orpc/server/plugins";
 import { ZodToJsonSchemaConverter } from "@orpc/zod/zod4";
-import { downloadResumePdfProcedure } from "@reactive-resume/api/features/resume/export";
-import router from "@reactive-resume/api/routers";
 import { env } from "@reactive-resume/env/server";
-import { resumeDataSchema } from "@reactive-resume/schema/resume/data";
 import { appVersion } from "../app-version";
 import { mergeResponseHeaders } from "../http/headers";
 import { getRequestLocale } from "../rpc/locale";
-
-const openAPIRouter = {
-	...router,
-	resume: {
-		...router.resume,
-		downloadPdf: downloadResumePdfProcedure,
-	},
-};
+import { generateOpenApiSpec, openAPIRouter } from "./generator";
 
 const openAPIHandler = new OpenAPIHandler(openAPIRouter, {
 	plugins: [
@@ -36,46 +25,15 @@ const openAPIHandler = new OpenAPIHandler(openAPIRouter, {
 	],
 });
 
-const openAPIGenerator = new OpenAPIGenerator({
-	schemaConverters: [new ZodToJsonSchemaConverter()],
-});
-
-export async function handleOpenApi(request: Request) {
+export async function handleOpenApi(request: Request, trustedClient = "unknown") {
 	if (request.method === "GET" && (request.url.endsWith("/spec.json") || request.url.endsWith("/spec"))) {
-		const spec = await openAPIGenerator.generate(openAPIRouter, {
-			info: {
-				title: "Reactive Resume",
-				version: appVersion,
-				description: "Reactive Resume API",
-				license: { name: "MIT", url: "https://github.com/amruthpillai/reactive-resume/blob/main/LICENSE" },
-				contact: { name: "Amruth Pillai", email: "hello@amruthpillai.com", url: "https://amruthpillai.com" },
-			},
-			servers: [{ url: `${env.APP_URL}/api/openapi` }],
-			externalDocs: { url: "https://docs.rxresu.me", description: "Reactive Resume Documentation" },
-			commonSchemas: {
-				ResumeData: { schema: resumeDataSchema },
-			},
-			components: {
-				securitySchemes: {
-					apiKey: {
-						type: "apiKey",
-						name: "x-api-key",
-						in: "header",
-						description: "The API key to authenticate requests.",
-					},
-				},
-			},
-			security: [{ apiKey: [] }],
-			filter: ({ contract }) => !contract["~orpc"].route.tags?.includes("Internal"),
-		});
-
-		return Response.json(spec);
+		return Response.json(await generateOpenApiSpec({ appUrl: env.APP_URL, version: appVersion }));
 	}
 
 	const resHeaders = new Headers();
 	const { response } = await openAPIHandler.handle(request, {
 		prefix: "/api/openapi",
-		context: { locale: getRequestLocale(request), reqHeaders: request.headers, resHeaders },
+		context: { locale: getRequestLocale(request), reqHeaders: request.headers, resHeaders, trustedClient },
 	});
 
 	if (!response) return new Response("NOT_FOUND", { status: 404 });

apps/server/src/openapi/metadata.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+	auth: {},
+	env: {
+		APP_URL: "https://rxresu.me",
+	},
+}));
+
+vi.mock("@better-auth/oauth-provider", () => ({
+	oauthProviderAuthServerMetadata: vi.fn(() => vi.fn(() => Response.json({}))),
+	oauthProviderOpenIdConfigMetadata: vi.fn(() => vi.fn(() => Response.json({}))),
+}));
+
+vi.mock("@reactive-resume/auth/config", () => ({
+	auth: mocks.auth,
+}));
+
+vi.mock("@reactive-resume/env/server", () => ({
+	env: mocks.env,
+}));
+
+vi.mock("@reactive-resume/mcp/server-card", () => ({
+	buildMcpServerCard: vi.fn(() => ({})),
+}));
+
+vi.mock("../app-version", () => ({
+	appVersion: "test",
+}));
+
+describe("handleOAuthProtectedResource", () => {
+	it("advertises the mounted auth issuer as the authorization server", async () => {
+		const { handleOAuthProtectedResource } = await import("./metadata");
+
+		const response = await handleOAuthProtectedResource();
+
+		await expect(response.json()).resolves.toMatchObject({
+			resource: "https://rxresu.me",
+			authorization_servers: ["https://rxresu.me/api/auth"],
+		});
+	});
+});

apps/server/src/openapi/metadata.ts

@@ -4,8 +4,8 @@ import { env } from "@reactive-resume/env/server";
 import { buildMcpServerCard } from "@reactive-resume/mcp/server-card";
 import { appVersion } from "../app-version";
 
-const oauthAuthorizationServerHandler = oauthProviderAuthServerMetadata(auth);
-const openIdConfigurationHandler = oauthProviderOpenIdConfigMetadata(auth);
+export const handleOAuthAuthorizationServer = oauthProviderAuthServerMetadata(auth);
+export const handleOpenIdConfiguration = oauthProviderOpenIdConfigMetadata(auth);
 
 export function handleWellKnownFallback() {
 	return new Response("OK", { status: 200 });
@@ -20,19 +20,11 @@ export function handleMcpServerCard() {
 	});
 }
 
-export function handleOAuthAuthorizationServer(request: Request) {
-	return oauthAuthorizationServerHandler(request);
-}
-
-export function handleOpenIdConfiguration(request: Request) {
-	return openIdConfigurationHandler(request);
-}
-
-export async function handleOAuthProtectedResource() {
+export function handleOAuthProtectedResource() {
 	const metadata = {
 		resource: env.APP_URL,
 		bearer_methods_supported: ["header"],
-		authorization_servers: [env.APP_URL, `${env.APP_URL}/api/auth`],
+		authorization_servers: [`${env.APP_URL}/api/auth`],
 	};
 
 	return Response.json(metadata, {

apps/server/src/rpc/handler.ts

@@ -3,6 +3,7 @@ import { RPCHandler } from "@orpc/server/fetch";
 import { BatchHandlerPlugin, RequestHeadersPlugin, StrictGetMethodPlugin } from "@orpc/server/plugins";
 import router from "@reactive-resume/api/routers";
 import { mergeResponseHeaders } from "../http/headers";
+import { stylesheetPreflightRunner } from "../services/stylesheet-preflight";
 import { getRequestLocale } from "./locale";
 
 const rpcHandler = new RPCHandler(router, {
@@ -14,11 +15,17 @@ const rpcHandler = new RPCHandler(router, {
 	],
 });
 
-export async function handleRpc(request: Request) {
+export async function handleRpc(request: Request, trustedClient = "unknown") {
 	const resHeaders = new Headers();
 	const { response } = await rpcHandler.handle(request, {
 		prefix: "/api/rpc",
-		context: { locale: getRequestLocale(request), reqHeaders: request.headers, resHeaders },
+		context: {
+			locale: getRequestLocale(request),
+			reqHeaders: request.headers,
+			resHeaders,
+			trustedClient,
+			stylesheetPreflightRunner,
+		},
 	});
 
 	if (!response) return new Response("NOT_FOUND", { status: 404 });

apps/server/src/services/stylesheet-preflight.test.ts

@@ -0,0 +1,248 @@
+import { describe, expect, it } from "vitest";
+import { defaultResumeData } from "@reactive-resume/schema/resume/default";
+import { createStylesheetPreflightRunner, STYLESHEET_PREFLIGHT_LIMITS } from "./stylesheet-preflight";
+
+const validStylesheet = {
+	languageVersion: 1,
+	text: "@version 1;",
+} as const;
+
+const input = {
+	data: defaultResumeData,
+	template: defaultResumeData.metadata.template,
+	stylesheet: validStylesheet,
+} as const;
+
+const memoryExhaustionWorker = new URL(
+	`data:text/javascript,${encodeURIComponent(`
+		const retained = [];
+		while (true) {
+			const batch = Array.from({ length: 100_000 }, (_, index) => ({ batch: retained.length, index }));
+			retained.push(batch);
+		}
+	`)}`,
+);
+
+const failedWorker = new URL(
+	`data:text/javascript,${encodeURIComponent('throw new Error("sensitive worker details");')}`,
+);
+
+const delayedSuccessfulWorker = new URL(
+	`data:text/javascript,${encodeURIComponent(`
+		import { parentPort, workerData } from "node:worker_threads";
+		parentPort.postMessage({ type: "ready" });
+		setTimeout(() => {
+			parentPort.postMessage({
+				ok: true,
+				pageCount: 1,
+				byteCount: Number(workerData.input.data.basics.name),
+				diagnostics: [],
+			});
+		}, 300);
+	`)}`,
+);
+
+const delayedReadyWorker = new URL(
+	`data:text/javascript,${encodeURIComponent(`
+		import { parentPort } from "node:worker_threads";
+		setTimeout(() => {
+			parentPort.postMessage({ type: "ready" });
+			setTimeout(() => {
+				parentPort.postMessage({
+					ok: true,
+					pageCount: 1,
+					byteCount: 1,
+					diagnostics: [],
+				});
+			}, 10);
+		}, 50);
+	`)}`,
+);
+
+const neverCompletesWorker = new URL(
+	`data:text/javascript,${encodeURIComponent(`
+		import { parentPort } from "node:worker_threads";
+		parentPort.postMessage({ type: "ready" });
+		setInterval(() => {}, 1_000);
+	`)}`,
+);
+
+const synchronousFailureWorker = new URL("https://example.com/stylesheet-preflight.mjs");
+
+const numberedInput = (number: number) => ({
+	...input,
+	data: {
+		...input.data,
+		basics: {
+			...input.data.basics,
+			name: String(number),
+		},
+	},
+});
+
+const invalidInput = () => {
+	const data = structuredClone(defaultResumeData);
+	data.customSections = [
+		{
+			id: "custom-experience",
+			type: "experience",
+			title: "Experience",
+			icon: "",
+			columns: 1,
+			hidden: false,
+			keepTogether: false,
+			startOnNewPage: false,
+			items: [{ id: "summary-shaped-item", hidden: false, content: "<p>Missing company</p>" }],
+		} as never,
+	];
+	return { ...input, data };
+};
+
+describe("stylesheet PDF preflight worker", () => {
+	it("keeps the production resource policy fixed and immutable", () => {
+		expect(STYLESHEET_PREFLIGHT_LIMITS).toEqual({
+			timeoutMs: 5_000,
+			maxPages: 20,
+			maxBytes: 10_000_000,
+			maxPageWidthPt: 2_000,
+			maxPageHeightPt: 20_000,
+			maxPageAreaPt2: 20_000_000,
+			maxOldGenerationMb: 256,
+			maxConcurrentWorkers: 1,
+			maxQueuedRequests: 32,
+		});
+		expect(Object.isFrozen(STYLESHEET_PREFLIGHT_LIMITS)).toBe(true);
+	});
+
+	it("accepts a bounded candidate render in an isolated worker", async () => {
+		const runner = createStylesheetPreflightRunner({ timeoutMs: 15_000 });
+
+		const result = await runner.run(input);
+
+		expect(result).toEqual(
+			expect.objectContaining({
+				ok: true,
+				pageCount: 1,
+				byteCount: expect.any(Number),
+			}),
+		);
+		if (!result.ok) throw new Error(`Expected successful preflight, received ${result.code}.`);
+		expect(result.byteCount).toBeGreaterThan(0);
+		expect(runner.activeWorkerCount).toBe(0);
+	}, 45_000);
+
+	it("preserves structured resume-data failures across the worker boundary", async () => {
+		const runner = createStylesheetPreflightRunner({ timeoutMs: 15_000 });
+
+		const result = runner.run(invalidInput());
+
+		await expect(result).rejects.toMatchObject({
+			name: "ZodError",
+			issues: expect.arrayContaining([expect.objectContaining({ path: ["customSections", 0, "items", 0, "company"] })]),
+		});
+		expect(runner.activeWorkerCount).toBe(0);
+		expect(runner.queuedPreflightCount).toBe(0);
+	}, 20_000);
+
+	it("terminates a worker when the render exceeds its deadline", async () => {
+		const runner = createStylesheetPreflightRunner({ timeoutMs: 1 }, neverCompletesWorker);
+
+		const result = await runner.run(input);
+
+		expect(result).toEqual(expect.objectContaining({ ok: false, code: "STYLESHEET_PREFLIGHT_TIMEOUT" }));
+		expect(runner.activeWorkerCount).toBe(0);
+		expect(runner.queuedPreflightCount).toBe(0);
+	});
+
+	it("starts the authored render deadline after the worker runtime is ready", async () => {
+		const runner = createStylesheetPreflightRunner({ timeoutMs: 20 }, delayedReadyWorker);
+
+		await expect(runner.run(input)).resolves.toEqual(expect.objectContaining({ ok: true, pageCount: 1 }));
+		expect(runner.activeWorkerCount).toBe(0);
+	});
+
+	it("returns deterministic output byte and page limit codes", async () => {
+		const byteRunner = createStylesheetPreflightRunner({ maxBytes: 16 });
+		const pageRunner = createStylesheetPreflightRunner({ maxPages: 0 });
+
+		await expect(byteRunner.run(input)).resolves.toEqual(
+			expect.objectContaining({ ok: false, code: "STYLESHEET_PREFLIGHT_BYTE_LIMIT" }),
+		);
+		await expect(pageRunner.run(input)).resolves.toEqual(
+			expect.objectContaining({ ok: false, code: "STYLESHEET_PREFLIGHT_PAGE_LIMIT" }),
+		);
+		expect(byteRunner.activeWorkerCount).toBe(0);
+		expect(pageRunner.activeWorkerCount).toBe(0);
+	}, 30_000);
+
+	it("maps worker heap exhaustion to a controlled memory-limit result", async () => {
+		const runner = createStylesheetPreflightRunner(
+			{ maxOldGenerationMb: 8, timeoutMs: 10_000 },
+			memoryExhaustionWorker,
+		);
+
+		const result = await runner.run(input);
+
+		expect(result).toEqual(expect.objectContaining({ ok: false, code: "STYLESHEET_PREFLIGHT_MEMORY_LIMIT" }));
+		expect(runner.activeWorkerCount).toBe(0);
+	}, 15_000);
+
+	it("does not expose internal errors from a failed worker", async () => {
+		const runner = createStylesheetPreflightRunner({}, failedWorker);
+
+		const result = await runner.run(input);
+
+		expect(result).toEqual({
+			ok: false,
+			code: "STYLESHEET_PREFLIGHT_WORKER_FAILED",
+			message: "The PDF preflight worker failed.",
+			diagnostics: [],
+		});
+		expect(runner.activeWorkerCount).toBe(0);
+		expect(runner.queuedPreflightCount).toBe(0);
+	});
+
+	it("bounds concurrent workers and queued requests without charging queue time to the worker deadline", async () => {
+		const runner = createStylesheetPreflightRunner(
+			{
+				timeoutMs: 500,
+				maxConcurrentWorkers: 1,
+				maxQueuedRequests: 2,
+			},
+			delayedSuccessfulWorker,
+		);
+		const completionOrder: number[] = [];
+		const accepted = [1, 2, 3].map((number) =>
+			runner.run(numberedInput(number)).then((result) => {
+				if (result.ok) completionOrder.push(result.byteCount);
+				return result;
+			}),
+		);
+		const rejected = runner.run(numberedInput(4));
+
+		expect(runner.activeWorkerCount).toBe(1);
+		expect(runner.queuedPreflightCount).toBe(2);
+		await expect(rejected).resolves.toEqual(
+			expect.objectContaining({
+				code: "STYLESHEET_PREFLIGHT_WORKER_FAILED",
+				message: "The PDF preflight queue is full.",
+			}),
+		);
+		const results = await Promise.all(accepted);
+
+		expect(results.every((result) => result.ok)).toBe(true);
+		expect(completionOrder).toEqual([1, 2, 3]);
+		expect(runner.activeWorkerCount).toBe(0);
+		expect(runner.queuedPreflightCount).toBe(0);
+	}, 5_000);
+
+	it("does not leak a slot when the worker constructor throws synchronously", async () => {
+		const runner = createStylesheetPreflightRunner({}, synchronousFailureWorker);
+
+		await expect(runner.run(input)).resolves.toEqual(
+			expect.objectContaining({ ok: false, code: "STYLESHEET_PREFLIGHT_WORKER_FAILED" }),
+		);
+		expect(runner.activeWorkerCount).toBe(0);
+		expect(runner.queuedPreflightCount).toBe(0);
+	});
+});

apps/server/src/services/stylesheet-preflight.ts

@@ -0,0 +1,225 @@
+import type {
+	PdfPreflightFailure,
+	PdfPreflightResult,
+	StylesheetPreflightInput,
+	StylesheetPreflightRunner,
+} from "@reactive-resume/pdf/server";
+import { fileURLToPath } from "node:url";
+import { Worker } from "node:worker_threads";
+import { STYLESHEET_PREFLIGHT_LIMITS } from "@reactive-resume/pdf/preflight-reference";
+
+export { STYLESHEET_PREFLIGHT_LIMITS } from "@reactive-resume/pdf/preflight-reference";
+
+type StylesheetPreflightLimits = {
+	timeoutMs: number;
+	maxPages: number;
+	maxBytes: number;
+	maxPageWidthPt: number;
+	maxPageHeightPt: number;
+	maxPageAreaPt2: number;
+	maxOldGenerationMb: number;
+	maxConcurrentWorkers: number;
+	maxQueuedRequests: number;
+};
+
+const SOURCE_WORKER_LOADER_HEAP_MB = 256;
+const SOURCE_WORKER_STARTUP_TIMEOUT_MS = 30_000;
+const WORKER_STARTUP_TIMEOUT_MS = 15_000;
+
+type SerializedPreflightCause = {
+	name: string;
+	message: string;
+	issues: readonly unknown[];
+};
+
+type StylesheetPreflightWorkerMessage =
+	| PdfPreflightResult
+	| { type: "ready" }
+	| { type: "preflight_error"; cause: SerializedPreflightCause };
+
+export type NodeStylesheetPreflightRunner = StylesheetPreflightRunner & {
+	readonly activeWorkerCount: number;
+	readonly queuedPreflightCount: number;
+};
+
+const failure = (code: PdfPreflightFailure["code"], message: string): PdfPreflightFailure => ({
+	ok: false,
+	code,
+	message,
+	diagnostics: [],
+});
+
+const workerFailure = (error: Error): PdfPreflightFailure => {
+	const code = (error as NodeJS.ErrnoException).code;
+	return code === "ERR_WORKER_OUT_OF_MEMORY" || /heap out of memory/i.test(error.message)
+		? failure("STYLESHEET_PREFLIGHT_MEMORY_LIMIT", "The PDF preflight worker exceeded its memory limit.")
+		: failure("STYLESHEET_PREFLIGHT_WORKER_FAILED", "The PDF preflight worker failed.");
+};
+
+const sourceWorkerExecArgv = () => {
+	const importIndex = process.execArgv.findIndex(
+		(argument, index, arguments_) =>
+			(argument === "--import" && arguments_[index + 1]?.includes("tsx")) ||
+			(argument.startsWith("--import=") && argument.includes("tsx")),
+	);
+	const inherited = process.execArgv[importIndex];
+	if (inherited?.startsWith("--import=")) return [inherited];
+	if (inherited === "--import") return [inherited, process.execArgv[importIndex + 1] as string];
+	return ["--import", import.meta.resolve("tsx")];
+};
+
+const workerLocation = () => {
+	const source = import.meta.url.endsWith(".ts");
+	return {
+		source,
+		url: source
+			? new URL("../workers/stylesheet-preflight.ts", import.meta.url)
+			: new URL("./stylesheet-preflight-worker.mjs", import.meta.url),
+		...(source
+			? {
+					execArgv: sourceWorkerExecArgv(),
+					env: {
+						...process.env,
+						TSX_TSCONFIG_PATH: fileURLToPath(new URL("../../tsconfig.json", import.meta.url)),
+					},
+				}
+			: {}),
+	};
+};
+
+export function createStylesheetPreflightRunner(
+	overrides: Partial<StylesheetPreflightLimits> = {},
+	testWorkerUrl?: URL,
+): NodeStylesheetPreflightRunner {
+	const limits = Object.freeze({ ...STYLESHEET_PREFLIGHT_LIMITS, ...overrides });
+	let activeWorkerCount = 0;
+	// ponytail: Keep admission process-local and bounded; upgrade to a distributed/pooled queue only for multi-process coordination.
+	const queue: Array<{
+		input: StylesheetPreflightInput;
+		resolve: (result: PdfPreflightResult) => void;
+		reject: (cause: unknown) => void;
+	}> = [];
+
+	const runWorker = (
+		input: StylesheetPreflightInput,
+		resolve: (result: PdfPreflightResult) => void,
+		reject: (cause: unknown) => void,
+	): boolean => {
+		// The URL seam is internal to the server package and keeps worker failure tests independent from the PDF renderer.
+		const location = testWorkerUrl ? { source: false, url: testWorkerUrl } : workerLocation();
+		let worker: Worker;
+		try {
+			worker = new Worker(location.url, {
+				name: "stylesheet-preflight",
+				workerData: { input, limits },
+				resourceLimits: {
+					// The source-only tsx compiler heap is outside the production render budget.
+					maxOldGenerationSizeMb: limits.maxOldGenerationMb + (location.source ? SOURCE_WORKER_LOADER_HEAP_MB : 0),
+				},
+				...("execArgv" in location ? { execArgv: location.execArgv } : {}),
+				...("env" in location ? { env: location.env } : {}),
+			});
+		} catch (error) {
+			resolve(workerFailure(error instanceof Error ? error : new Error("Failed to start PDF preflight worker.")));
+			return false;
+		}
+
+		activeWorkerCount += 1;
+		let settled = false;
+		let renderTimer: ReturnType<typeof setTimeout> | undefined;
+		let startupTimer: ReturnType<typeof setTimeout> | undefined;
+
+		const cleanup = () => {
+			if (renderTimer) clearTimeout(renderTimer);
+			if (startupTimer) clearTimeout(startupTimer);
+			worker.off("message", onMessage);
+			worker.off("error", onError);
+			worker.off("exit", onExit);
+			activeWorkerCount -= 1;
+		};
+
+		const finish = async (result: PdfPreflightResult) => {
+			if (settled) return;
+			settled = true;
+			await worker.terminate().catch(() => undefined);
+			cleanup();
+			resolve(result);
+			drainQueue();
+		};
+		const fail = async (cause: SerializedPreflightCause) => {
+			if (settled) return;
+			settled = true;
+			await worker.terminate().catch(() => undefined);
+			cleanup();
+			reject(Object.assign(new Error(cause.message), { name: cause.name, issues: cause.issues }));
+			drainQueue();
+		};
+
+		const onMessage = (message: StylesheetPreflightWorkerMessage) => {
+			if ("type" in message) {
+				if (message.type === "preflight_error") {
+					void fail(message.cause);
+					return;
+				}
+				if (startupTimer) clearTimeout(startupTimer);
+				renderTimer = setTimeout(() => {
+					void finish(failure("STYLESHEET_PREFLIGHT_TIMEOUT", "The PDF preflight exceeded its deadline."));
+				}, limits.timeoutMs);
+				return;
+			}
+			void finish(message);
+		};
+		const onError = (error: Error) => {
+			void finish(workerFailure(error));
+		};
+		const onExit = () => {
+			if (!settled) {
+				void finish(failure("STYLESHEET_PREFLIGHT_WORKER_FAILED", "The PDF preflight worker failed."));
+			}
+		};
+
+		worker.on("message", onMessage);
+		worker.once("error", onError);
+		worker.once("exit", onExit);
+		startupTimer = setTimeout(
+			() => {
+				void finish(failure("STYLESHEET_PREFLIGHT_WORKER_FAILED", "The PDF preflight worker failed."));
+			},
+			location.source ? SOURCE_WORKER_STARTUP_TIMEOUT_MS : WORKER_STARTUP_TIMEOUT_MS,
+		);
+		return true;
+	};
+
+	function drainQueue() {
+		while (activeWorkerCount < limits.maxConcurrentWorkers && queue.length > 0) {
+			const next = queue.shift();
+			if (!next) return;
+			runWorker(next.input, next.resolve, next.reject);
+		}
+	}
+
+	return {
+		get activeWorkerCount() {
+			return activeWorkerCount;
+		},
+		get queuedPreflightCount() {
+			return queue.length;
+		},
+
+		run(input: StylesheetPreflightInput): Promise<PdfPreflightResult> {
+			return new Promise<PdfPreflightResult>((resolve, reject) => {
+				if (activeWorkerCount < limits.maxConcurrentWorkers) {
+					runWorker(input, resolve, reject);
+					return;
+				}
+				if (queue.length >= limits.maxQueuedRequests) {
+					resolve(failure("STYLESHEET_PREFLIGHT_WORKER_FAILED", "The PDF preflight queue is full."));
+					return;
+				}
+				queue.push({ input, resolve, reject });
+			});
+		},
+	};
+}
+
+export const stylesheetPreflightRunner = createStylesheetPreflightRunner();

apps/server/src/static/schema.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import z from "zod";
+import { defaultResumeData } from "@reactive-resume/schema/resume/default";
+import { handleSchemaJson } from "./schema";
+
+describe("handleSchemaJson", () => {
+	it("publishes the custom-section type and item correlation", async () => {
+		const response = handleSchemaJson();
+		const schema = z.fromJSONSchema((await response.json()) as Parameters<typeof z.fromJSONSchema>[0]);
+		const mismatched = {
+			...defaultResumeData,
+			customSections: [
+				{
+					id: "custom-experience",
+					type: "experience",
+					title: "Experience",
+					icon: "",
+					columns: 1,
+					hidden: false,
+					keepTogether: false,
+					startOnNewPage: false,
+					items: [{ id: "summary-item", hidden: false, content: "<p>Not an experience item</p>" }],
+				},
+			],
+		};
+
+		expect(schema.safeParse(mismatched).success).toBe(false);
+	});
+});

apps/server/src/static/schema.ts

@@ -1,11 +1,8 @@
-import z from "zod";
-import { resumeDataSchema } from "@reactive-resume/schema/resume/data";
+import { createResumeDataJsonSchema } from "@reactive-resume/schema/resume/json-schema";
 import { appVersion } from "../app-version";
 
 export function handleSchemaJson() {
-	const resumeDataJSONSchema = z.toJSONSchema(resumeDataSchema);
-
-	return Response.json(resumeDataJSONSchema, {
+	return Response.json(createResumeDataJsonSchema(), {
 		status: 200,
 		headers: {
 			"Content-Type": "application/schema+json; charset=utf-8",

apps/server/src/static/uploads.test.ts

@@ -33,6 +33,8 @@ describe("handleUpload", () => {
 		expect(response.status).toBe(200);
 		expect(readMock).toHaveBeenCalledWith("uploads/user-1/pictures/photo.jpeg");
 		expect(response.headers.get("Content-Type")).toBe("image/jpeg");
+		expect(response.headers.get("Cross-Origin-Resource-Policy")).toBe("same-site");
+		expect(response.headers.get("Access-Control-Allow-Origin")).toBeNull();
 	});
 
 	it("does not serve private agent attachment keys through the public uploads route", async () => {

apps/server/src/static/uploads.ts

@@ -1,7 +1,6 @@
 import { createHash } from "node:crypto";
 import { basename, extname, normalize } from "node:path";
-import { getStorageService } from "@reactive-resume/api/features/storage";
-import { env } from "@reactive-resume/env/server";
+import { getStorageService, inferContentType } from "@reactive-resume/api/features/storage";
 
 export async function handleUpload(request: Request) {
 	const { userId, filePath } = parseRouteParams(request.url);
@@ -18,41 +17,31 @@ export async function handleUpload(request: Request) {
 
 	const filename = filePath.split("/").pop() ?? filePath;
 	const ext = extname(filename).toLowerCase();
-	const contentType = storedFile.contentType ?? inferContentTypeFromExtension(ext);
+	const contentType = storedFile.contentType ?? inferContentType(filename);
 	const etag = createEtag(storedFile);
 
 	if (isNotModified(request.headers, etag)) return makeNotModifiedResponse(etag);
 
 	const shouldForceDownload = [".pdf"].includes(ext);
-	const headers = buildResponseHeaders({
-		filename,
-		storedFile,
-		contentType,
-		etag,
-		shouldForceDownload,
-	});
 
-	const buffer = toArrayBuffer(storedFile.data);
+	const headers = new Headers();
+	headers.set("Content-Type", shouldForceDownload ? "application/octet-stream" : contentType);
+	headers.set("Content-Length", storedFile.size.toString());
 
-	return new Response(buffer, { headers });
-}
-
-function inferContentTypeFromExtension(ext: string): string {
-	switch (ext) {
-		case ".webp":
-			return "image/webp";
-		case ".png":
-			return "image/png";
-		case ".jpg":
-		case ".jpeg":
-			return "image/jpeg";
-		case ".gif":
-			return "image/gif";
-		case ".pdf":
-			return "application/pdf";
-		default:
-			return "application/octet-stream";
+	if (shouldForceDownload) {
+		headers.set("Content-Disposition", `attachment; filename="${encodeURIComponent(basename(filename))}"`);
 	}
+
+	headers.set("Cache-Control", "public, max-age=31536000, immutable");
+	headers.set("ETag", etag);
+	headers.set("X-Content-Type-Options", "nosniff");
+	headers.set("X-Robots-Tag", "noindex, nofollow");
+	headers.set("Cross-Origin-Resource-Policy", "same-site");
+	headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+	headers.set("X-Frame-Options", "DENY");
+	headers.set("X-Download-Options", "noopen");
+
+	return new Response(toArrayBuffer(storedFile.data), { headers });
 }
 
 function parseRouteParams(url: string): { userId: string | undefined; filePath: string | undefined } {
@@ -101,43 +90,6 @@ function makeNotModifiedResponse(etag: string): Response {
 	});
 }
 
-type BuildResponseHeaderArgs = {
-	filename: string;
-	storedFile: { size: number };
-	contentType: string;
-	etag: string;
-	shouldForceDownload: boolean;
-};
-
-function buildResponseHeaders({
-	filename,
-	storedFile,
-	contentType,
-	etag,
-	shouldForceDownload,
-}: BuildResponseHeaderArgs): Headers {
-	const headers = new Headers();
-
-	headers.set("Content-Type", shouldForceDownload ? "application/octet-stream" : contentType);
-	headers.set("Content-Length", storedFile.size.toString());
-
-	if (shouldForceDownload) {
-		headers.set("Content-Disposition", `attachment; filename="${encodeURIComponent(basename(filename))}"`);
-	}
-
-	headers.set("Cache-Control", "public, max-age=31536000, immutable");
-	headers.set("ETag", etag);
-	headers.set("X-Content-Type-Options", "nosniff");
-	headers.set("X-Robots-Tag", "noindex, nofollow");
-	headers.set("Cross-Origin-Resource-Policy", "same-site");
-	headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-	headers.set("X-Frame-Options", "DENY");
-	headers.set("X-Download-Options", "noopen");
-	headers.set("Access-Control-Allow-Origin", env.APP_URL);
-
-	return headers;
-}
-
 function toArrayBuffer(data: Uint8Array): ArrayBuffer {
 	return data.byteOffset === 0 && data.byteLength === data.buffer.byteLength
 		? (data.buffer as ArrayBuffer)

apps/server/src/static/web.test.ts

@@ -1,6 +1,11 @@
 import fs from "node:fs/promises";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
+const mocks = vi.hoisted(() => ({
+	env: { APP_URL: "https://rxresu.me" },
+	serveStatic: vi.fn((_options?: unknown) => vi.fn()),
+}));
+
 vi.mock("node:fs", () => ({
 	existsSync: vi.fn(() => true),
 }));
@@ -12,10 +17,25 @@ vi.mock("node:fs/promises", () => ({
 }));
 
 vi.mock("@hono/node-server/serve-static", () => ({
-	serveStatic: vi.fn(() => vi.fn()),
+	serveStatic: mocks.serveStatic,
 }));
 
-const { handleWebApp, handleWebAppHead } = await import("./web");
+vi.mock("@reactive-resume/env/server", () => ({
+	env: mocks.env,
+}));
+
+type StaticOptions = {
+	onFound?: (
+		path: string,
+		context: {
+			req: { path: string };
+			header: (name: string, value: string) => void;
+		},
+	) => void | Promise<void>;
+};
+
+const { handleWebApp } = await import("./web");
+const staticOptions = mocks.serveStatic.mock.calls[0]?.[0] as StaticOptions | undefined;
 
 describe("web app fallback classification", () => {
 	beforeEach(() => {
@@ -32,22 +52,77 @@ describe("web app fallback classification", () => {
 		expect(await response.text()).toBe("<html>app</html>");
 	});
 
-	it.each([
-		"/auth/login",
-		"/dashboard",
-		"/builder/resume-1",
-		"/agent",
-		"/templates",
-		"/templates/azurill.pdf",
-	])("serves noindex shell for known app prefix %s", async (pathname) => {
+	it("injects canonical metadata and structured data into tracking-parameter root requests only", async () => {
+		vi.mocked(fs.readFile).mockResolvedValue(`
+			<!doctype html>
+			<html>
+				<head>
+					<title>Reactive Resume — A free and open-source resume builder</title>
+					<meta
+						name="description"
+						content="Reactive Resume is a free and open-source resume builder that simplifies the process of creating, updating, and sharing your resume."
+					>
+				</head>
+				<body><div id="app"></div></body>
+			</html>
+		`);
+
+		const response = await handleWebApp(new Request("http://server.internal/?utm_source=search"));
+		const html = await response.text();
+
+		expect(html).toContain('<link rel="canonical" href="https://rxresu.me/">');
+		expect(html).toContain('<link rel="preload" href="/videos/timelapse-v1.webp" as="image" fetchpriority="high">');
+		expect(html).toContain('<meta property="og:url" content="https://rxresu.me/">');
+		expect(html).toContain('<meta property="og:image" content="https://rxresu.me/opengraph/banner.jpg">');
+		expect(html).toContain('id="reactive-resume-structured-data"');
+		expect(html).toContain('"@type":["SoftwareApplication","WebApplication"]');
+		expect(html).toContain('"url":"https://rxresu.me/"');
+		expect(html).not.toContain("utm_source");
+
+		const dashboardResponse = await handleWebApp(new Request("https://example.com/dashboard"));
+		expect(await dashboardResponse.text()).not.toContain('rel="canonical"');
+	});
+
+	it("caches versioned homepage media immutably", async () => {
+		const headers = new Headers();
+
+		await staticOptions?.onFound?.("", {
+			req: { path: "/videos/timelapse-v1.mp4" },
+			header: (name, value) => headers.set(name, value),
+		});
+
+		expect(headers.get("Cache-Control")).toBe("public, max-age=31536000, immutable");
+
+		const unversionedHeaders = new Headers();
+		await staticOptions?.onFound?.("", {
+			req: { path: "/videos/timelapse.mp4" },
+			header: (name, value) => unversionedHeaders.set(name, value),
+		});
+
+		expect(unversionedHeaders.get("Cache-Control")).toBeNull();
+	});
+
+	it.each(["/", "/alice/resume"])("sets framing and report-only CSP security headers on %s", async (pathname) => {
 		const response = await handleWebApp(new Request(`https://example.com${pathname}`));
 
 		expect(response.status).toBe(200);
-		expect(response.headers.get("Content-Type")).toBe("text/html; charset=UTF-8");
-		expect(response.headers.get("X-Robots-Tag")).toBe("noindex, follow");
-		expect(await response.text()).toBe("<html>app</html>");
+		expect(response.headers.get("X-Frame-Options")).toBe("DENY");
+		expect(response.headers.get("X-Content-Type-Options")).toBe("nosniff");
+		expect(response.headers.get("Content-Security-Policy-Report-Only")).toContain("frame-ancestors 'none'");
 	});
 
+	it.each(["/auth/login", "/dashboard", "/builder/resume-1", "/agent", "/templates", "/templates/azurill.pdf"])(
+		"serves noindex shell for known app prefix %s",
+		async (pathname) => {
+			const response = await handleWebApp(new Request(`https://example.com${pathname}`));
+
+			expect(response.status).toBe(200);
+			expect(response.headers.get("Content-Type")).toBe("text/html; charset=UTF-8");
+			expect(response.headers.get("X-Robots-Tag")).toBe("noindex, follow");
+			expect(await response.text()).toBe("<html>app</html>");
+		},
+	);
+
 	it("serves noindex shell for public resume shaped routes", async () => {
 		const response = await handleWebApp(new Request("https://example.com/alice/resume"));
 
@@ -66,19 +141,18 @@ describe("web app fallback classification", () => {
 		expect(fs.readFile).not.toHaveBeenCalled();
 	});
 
-	it.each([
-		"/api/foo",
-		"/mcp/foo",
-		"/uploads/foo",
-	])("does not treat reserved two-segment path %s as a public resume", async (pathname) => {
-		const response = await handleWebApp(new Request(`https://example.com${pathname}`));
+	it.each(["/api/foo", "/mcp/foo", "/uploads/foo"])(
+		"does not treat reserved two-segment path %s as a public resume",
+		async (pathname) => {
+			const response = await handleWebApp(new Request(`https://example.com${pathname}`));
 
-		expect(response.status).toBe(404);
-		expect(response.headers.get("Content-Type")).toBe("text/plain; charset=UTF-8");
-		expect(response.headers.get("X-Robots-Tag")).toBe("noindex, nofollow");
-		expect(await response.text()).toBe("Not Found");
-		expect(fs.readFile).not.toHaveBeenCalled();
-	});
+			expect(response.status).toBe(404);
+			expect(response.headers.get("Content-Type")).toBe("text/plain; charset=UTF-8");
+			expect(response.headers.get("X-Robots-Tag")).toBe("noindex, nofollow");
+			expect(await response.text()).toBe("Not Found");
+			expect(fs.readFile).not.toHaveBeenCalled();
+		},
+	);
 
 	it("returns plain 404 for missing asset-looking paths", async () => {
 		const response = await handleWebApp(new Request("https://example.com/assets/missing.css"));
@@ -90,8 +164,10 @@ describe("web app fallback classification", () => {
 	});
 
 	it("mirrors fallback status and headers for HEAD without a body", async () => {
-		const knownResponse = handleWebAppHead(new Request("https://example.com/dashboard"));
-		const unknownResponse = handleWebAppHead(new Request("https://example.com/unknown/extra/path"));
+		const knownResponse = await handleWebApp(new Request("https://example.com/dashboard", { method: "HEAD" }));
+		const unknownResponse = await handleWebApp(
+			new Request("https://example.com/unknown/extra/path", { method: "HEAD" }),
+		);
 
 		expect(knownResponse.status).toBe(200);
 		expect(knownResponse.headers.get("Content-Type")).toBe("text/html; charset=UTF-8");

apps/server/src/static/web.ts

@@ -2,6 +2,7 @@ import { existsSync } from "node:fs";
 import fs from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { serveStatic } from "@hono/node-server/serve-static";
+import { env } from "@reactive-resume/env/server";
 
 function resolveWebDistPath() {
 	const candidates = [
@@ -31,8 +32,6 @@ const reservedPublicResumeSegments = new Set([
 	"templates",
 ]);
 
-export const serveWebDistStatic = serveStatic({ root: staticRoot });
-
 function isAssetPath(pathname: string): boolean {
 	return pathname.split("/").pop()?.includes(".") ?? false;
 }
@@ -52,12 +51,130 @@ function isPublicResumePath(pathname: string): boolean {
 	return segments.length === 2 && firstSegment !== undefined && !reservedPublicResumeSegments.has(firstSegment);
 }
 
+const BASE_SECURITY_HEADERS = {
+	"X-Frame-Options": "DENY",
+	"X-Content-Type-Options": "nosniff",
+	"Referrer-Policy": "strict-origin-when-cross-origin",
+	"Content-Security-Policy-Report-Only":
+		"default-src 'self'; img-src 'self' data: blob:; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'",
+};
+
+const ROOT_TITLE = "Reactive Resume — A free and open-source resume builder";
+const ROOT_DESCRIPTION =
+	"Reactive Resume is a free and open-source resume builder that simplifies the process of creating, updating, and sharing your resume.";
+const ROOT_POSTER_PATH = "/videos/timelapse-v1.webp";
+const ROOT_FAQ_ITEMS = [
+	{
+		question: "Is Reactive Resume really free?",
+		answer:
+			"Yes! Reactive Resume is completely free to use, with no hidden costs, premium tiers, or subscription fees. It's open-source and will always remain free.",
+	},
+	{
+		question: "How is my data protected?",
+		answer:
+			"Your data is stored securely and is never shared with third parties. You can also self-host Reactive Resume on your own servers for complete control over your data.",
+	},
+	{
+		question: "Can I export my resume to PDF?",
+		answer:
+			"Absolutely! You can export your resume to PDF with a single click. The exported PDF maintains all your formatting and styling perfectly.",
+	},
+	{
+		question: "Is Reactive Resume available in multiple languages?",
+		answer:
+			"Yes, Reactive Resume is available in multiple languages. You can choose your preferred language in the settings page, or using the language switcher in the top right corner. If you don't see your language, or you would like to improve the existing translations, you can contribute to the translations on Crowdin.",
+	},
+	{
+		question: "What makes Reactive Resume different from other resume builders?",
+		answer:
+			"Reactive Resume is open-source, privacy-focused, and completely free. Unlike other resume builders, it doesn't show ads, track your data, or limit your features behind a paywall.",
+	},
+	{
+		question: "How do I share my resume?",
+		answer:
+			"You can share your resume via a unique public URL, protect it with a password, or download it as a PDF to share directly. The choice is yours!",
+	},
+] as const;
+
+function createRootSeoMarkup(canonicalUrl: string) {
+	const origin = new URL(canonicalUrl).origin;
+	const imageUrl = `${origin}/opengraph/banner.jpg`;
+	const structuredData = {
+		"@context": "https://schema.org",
+		"@graph": [
+			{
+				"@type": "WebSite",
+				name: "Reactive Resume",
+				url: canonicalUrl,
+			},
+			{
+				"@type": ["SoftwareApplication", "WebApplication"],
+				name: "Reactive Resume",
+				url: canonicalUrl,
+				description: ROOT_DESCRIPTION,
+				applicationCategory: "BusinessApplication",
+				operatingSystem: "Web",
+				isAccessibleForFree: true,
+				offers: {
+					"@type": "Offer",
+					price: "0",
+					priceCurrency: "USD",
+				},
+				codeRepository: "https://github.com/amruthpillai/reactive-resume",
+			},
+			{
+				"@type": "Project",
+				name: "Reactive Resume",
+				url: canonicalUrl,
+				sameAs: ["https://github.com/amruthpillai/reactive-resume"],
+			},
+			{
+				"@type": "FAQPage",
+				mainEntity: ROOT_FAQ_ITEMS.map((item) => ({
+					"@type": "Question",
+					name: item.question,
+					acceptedAnswer: {
+						"@type": "Answer",
+						text: item.answer,
+					},
+				})),
+			},
+		],
+	};
+
+	return `
+		<link rel="canonical" href="${canonicalUrl}">
+		<link rel="preload" href="${ROOT_POSTER_PATH}" as="image" fetchpriority="high">
+		<meta property="og:type" content="website">
+		<meta property="og:site_name" content="Reactive Resume">
+		<meta property="og:title" content="${ROOT_TITLE}">
+		<meta property="og:description" content="${ROOT_DESCRIPTION}">
+		<meta property="og:url" content="${canonicalUrl}">
+		<meta property="og:image" content="${imageUrl}">
+		<meta name="twitter:card" content="summary_large_image">
+		<meta name="twitter:title" content="${ROOT_TITLE}">
+		<meta name="twitter:description" content="${ROOT_DESCRIPTION}">
+		<meta name="twitter:image" content="${imageUrl}">
+		<script id="reactive-resume-structured-data" type="application/ld+json">${JSON.stringify(structuredData)}</script>
+	`;
+}
+
+export const serveWebDistStatic = serveStatic({
+	root: staticRoot,
+	onFound: (_path, context) => {
+		if (/^\/videos\/.*-v\d+\.(?:mp4|webp)$/.test(context.req.path)) {
+			context.header("Cache-Control", "public, max-age=31536000, immutable");
+		}
+	},
+});
+
 function getFallbackResponseHeaders(pathname: string) {
-	if (pathname === "/") return { "Content-Type": "text/html; charset=UTF-8" };
+	if (pathname === "/") return { "Content-Type": "text/html; charset=UTF-8", ...BASE_SECURITY_HEADERS };
 	if (isNoindexShellPath(pathname) || isPublicResumePath(pathname)) {
 		return {
 			"Content-Type": "text/html; charset=UTF-8",
 			"X-Robots-Tag": "noindex, follow",
+			...BASE_SECURITY_HEADERS,
 		};
 	}
 
@@ -74,23 +191,23 @@ function notFoundResponse(options: { head?: boolean; noindex?: boolean } = {}) {
 	});
 }
 
+// ponytail: GET and HEAD share the same routing logic; method determines body presence
 export async function handleWebApp(request: Request) {
+	const isHead = request.method === "HEAD";
 	const pathname = new URL(request.url).pathname;
-	if (!isNoindexShellPath(pathname) && isAssetPath(pathname)) return new Response("Not Found", { status: 404 });
+
+	if (!isNoindexShellPath(pathname) && isAssetPath(pathname)) {
+		return new Response(isHead ? null : "Not Found", { status: 404 });
+	}
 
 	const headers = getFallbackResponseHeaders(pathname);
-	if (!headers) return notFoundResponse({ noindex: true });
+	if (!headers) return notFoundResponse({ head: isHead, noindex: true });
+
+	if (isHead) return new Response(null, { status: 200, headers });
 
 	const html = await fs.readFile(indexHtmlPath, "utf-8");
-	return new Response(html, { headers });
-}
+	const canonicalUrl = new URL("/", env.APP_URL).toString();
+	const responseHtml = pathname === "/" ? html.replace("</head>", `${createRootSeoMarkup(canonicalUrl)}</head>`) : html;
 
-export function handleWebAppHead(request: Request) {
-	const pathname = new URL(request.url).pathname;
-	if (!isNoindexShellPath(pathname) && isAssetPath(pathname)) return new Response(null, { status: 404 });
-
-	const headers = getFallbackResponseHeaders(pathname);
-	if (!headers) return notFoundResponse({ head: true, noindex: true });
-
-	return new Response(null, { status: 200, headers });
+	return new Response(responseHtml, { headers });
 }

apps/server/src/workers/stylesheet-preflight-inspection.ts

@@ -0,0 +1,74 @@
+import type { PdfPreflightPageLimits, PdfPreflightResult, RenderPreflightPdfResult } from "@reactive-resume/pdf/server";
+import { getDocument } from "pdfjs-dist/legacy/build/pdf.mjs";
+
+type StylesheetPreflightInspectionLimits = PdfPreflightPageLimits & {
+	maxPages: number;
+	maxBytes: number;
+};
+
+type PdfLoadingTask = {
+	promise: PromiseLike<{ numPages: number }>;
+	destroy(): Promise<void>;
+};
+
+type LoadPdf = (options: { data: Uint8Array }) => PdfLoadingTask;
+
+export async function inspectPreflightPdf(
+	rendered: Extract<RenderPreflightPdfResult, { ok: true }>,
+	limits: StylesheetPreflightInspectionLimits,
+	loadPdf: LoadPdf = getDocument,
+): Promise<PdfPreflightResult> {
+	if (rendered.bytes.byteLength > limits.maxBytes) {
+		return {
+			ok: false,
+			code: "STYLESHEET_PREFLIGHT_BYTE_LIMIT",
+			message: "The rendered PDF exceeds the preflight byte limit.",
+			diagnostics: rendered.diagnostics,
+		};
+	}
+
+	const byteCount = rendered.bytes.byteLength;
+	let loadingTask: PdfLoadingTask;
+	try {
+		loadingTask = loadPdf({ data: rendered.bytes });
+	} catch {
+		return {
+			ok: false,
+			code: "STYLESHEET_PREFLIGHT_PARSE_FAILED",
+			message: "PDF inspection failed.",
+			diagnostics: rendered.diagnostics,
+		};
+	}
+
+	try {
+		let document: { numPages: number };
+		try {
+			document = await loadingTask.promise;
+		} catch {
+			return {
+				ok: false,
+				code: "STYLESHEET_PREFLIGHT_PARSE_FAILED",
+				message: "PDF inspection failed.",
+				diagnostics: rendered.diagnostics,
+			};
+		}
+
+		if (document.numPages > limits.maxPages) {
+			return {
+				ok: false,
+				code: "STYLESHEET_PREFLIGHT_PAGE_LIMIT",
+				message: "The rendered PDF exceeds the preflight page limit.",
+				diagnostics: rendered.diagnostics,
+			};
+		}
+
+		return {
+			ok: true,
+			pageCount: document.numPages,
+			byteCount,
+			diagnostics: rendered.diagnostics,
+		};
+	} finally {
+		await loadingTask.destroy().catch(() => undefined);
+	}
+}

apps/server/src/workers/stylesheet-preflight.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it, vi } from "vitest";
+import { inspectPreflightPdf } from "./stylesheet-preflight-inspection";
+
+const warning = {
+	code: "EXTREME_VALUE",
+	severity: "warning",
+	message: "The authored value is unusually large.",
+	range: {
+		start: { line: 1, column: 1, offset: 0 },
+		end: { line: 1, column: 10, offset: 9 },
+	},
+} as const;
+
+const rendered = {
+	ok: true as const,
+	bytes: new TextEncoder().encode("%PDF-1.7"),
+	diagnostics: [warning],
+};
+
+const limits = {
+	maxPages: 20,
+	maxBytes: 10_000_000,
+	maxPageWidthPt: 2_000,
+	maxPageHeightPt: 20_000,
+	maxPageAreaPt2: 20_000_000,
+};
+
+describe("stylesheet preflight PDF inspection", () => {
+	it("preserves compiler warnings and hides parser exceptions", async () => {
+		const destroy = vi.fn(async () => undefined);
+
+		const result = await inspectPreflightPdf(rendered, limits, () => ({
+			promise: Promise.reject(new Error("sensitive parser details")),
+			destroy,
+		}));
+
+		expect(result).toEqual({
+			ok: false,
+			code: "STYLESHEET_PREFLIGHT_PARSE_FAILED",
+			message: "PDF inspection failed.",
+			diagnostics: [warning],
+		});
+		expect(destroy).toHaveBeenCalledOnce();
+	});
+
+	it("preserves compiler warnings when PDF.js fails before returning a loading task", async () => {
+		const result = await inspectPreflightPdf(rendered, limits, () => {
+			throw new Error("sensitive parser setup details");
+		});
+
+		expect(result).toEqual({
+			ok: false,
+			code: "STYLESHEET_PREFLIGHT_PARSE_FAILED",
+			message: "PDF inspection failed.",
+			diagnostics: [warning],
+		});
+	});
+});

apps/server/src/workers/stylesheet-preflight.ts

@@ -0,0 +1,60 @@
+import type { PdfPreflightPageLimits, PdfPreflightResult, StylesheetPreflightInput } from "@reactive-resume/pdf/server";
+import { parentPort, workerData } from "node:worker_threads";
+import * as React from "react";
+import { renderPreflightPdf } from "@reactive-resume/pdf/server";
+import { inspectPreflightPdf } from "./stylesheet-preflight-inspection";
+
+(globalThis as typeof globalThis & { React: typeof React }).React = React;
+
+type StylesheetPreflightWorkerLimits = PdfPreflightPageLimits & {
+	maxPages: number;
+	maxBytes: number;
+};
+
+type StylesheetPreflightWorkerData = {
+	input: StylesheetPreflightInput;
+	limits: StylesheetPreflightWorkerLimits;
+};
+
+type SerializedPreflightCause = {
+	name: string;
+	message: string;
+	issues: readonly unknown[];
+};
+
+const send = (result: PdfPreflightResult) => {
+	parentPort?.postMessage(result);
+};
+
+const serializeZodCause = (cause: unknown): SerializedPreflightCause | undefined => {
+	if (!(cause instanceof Error) || cause.name !== "ZodError" || !("issues" in cause) || !Array.isArray(cause.issues)) {
+		return;
+	}
+	return { name: cause.name, message: cause.message, issues: cause.issues };
+};
+
+parentPort?.postMessage({ type: "ready" });
+
+async function run(): Promise<PdfPreflightResult> {
+	const { input, limits } = workerData as StylesheetPreflightWorkerData;
+	const rendered = await renderPreflightPdf(input, limits);
+	return rendered.ok ? inspectPreflightPdf(rendered, limits) : rendered;
+}
+
+if (parentPort) {
+	void run()
+		.then(send)
+		.catch((cause: unknown) => {
+			const serializedCause = serializeZodCause(cause);
+			if (serializedCause) {
+				parentPort?.postMessage({ type: "preflight_error", cause: serializedCause });
+				return;
+			}
+			send({
+				ok: false,
+				code: "STYLESHEET_PREFLIGHT_WORKER_FAILED",
+				message: "The PDF preflight worker failed.",
+				diagnostics: [],
+			});
+		});
+}

apps/server/tsdown.config.ts

@@ -33,7 +33,10 @@ const promptAssetsPlugin: TsdownPlugin = {
 };
 
 export default defineConfig({
-	entry: { index: "src/index.ts" },
+	entry: {
+		index: "src/index.ts",
+		"stylesheet-preflight-worker": "src/workers/stylesheet-preflight.ts",
+	},
 	format: "esm",
 	platform: "node",
 	target: "node24",

apps/server/turbo.json

@@ -1,4 +1,9 @@
 {
 	"extends": ["//"],
-	"tags": ["app:server", "runtime:server", "role:adapter"]
+	"tags": ["app:server", "runtime:server", "role:adapter"],
+	"tasks": {
+		"test:ci": {
+			"cache": false
+		}
+	}
 }

apps/web/index.html

@@ -16,10 +16,46 @@
 		<link rel="apple-touch-icon" href="/apple-touch-icon-180x180.png" type="image/png" sizes="180x180 any" />
 		<link rel="manifest" href="/manifest.webmanifest" crossorigin="use-credentials" />
 
-		<title>Reactive Resume</title>
+		<title>Reactive Resume — A free and open-source resume builder</title>
 	</head>
 	<body>
+		<!-- Keep #app empty: main.tsx only mounts React when rootElement has no children. -->
 		<div id="app"></div>
-		<script type="module" src="/src/main.tsx"></script>
+		<!-- Branded first paint; hidden once React populates #app (higher-specificity rule below). -->
+		<div id="initial-loader">
+			<img src="/icon/dark.svg" width="48" height="48" alt="Reactive Resume" />
+			<div class="initial-loader__spinner"></div>
+			<span class="initial-loader__sr-only">Loading</span>
+		</div>
+		<style>
+			@keyframes app-spin { to { transform: rotate(360deg) } }
+			#initial-loader {
+				position: fixed;
+				inset: 0;
+				display: flex;
+				flex-direction: column;
+				align-items: center;
+				justify-content: center;
+				gap: 24px;
+				background: #09090b;
+			}
+			#app:not(:empty) ~ #initial-loader { display: none; }
+			.initial-loader__spinner {
+				width: 24px;
+				height: 24px;
+				border: 2px solid rgba(250, 250, 250, 0.2);
+				border-top-color: #fafafa;
+				border-radius: 9999px;
+				animation: app-spin 0.7s linear infinite;
+			}
+			.initial-loader__sr-only {
+				position: absolute;
+				width: 1px;
+				height: 1px;
+				overflow: hidden;
+				clip: rect(0 0 0 0);
+			}
+		</style>
+		<script type="module" data-cfasync="false" src="/src/main.tsx"></script>
 	</body>
 </html>