Zeigt 2km (indigo) und 5km (lila) Pufferringe für alle Gebiete gleichzeitig,
unabhängig von Selektion. Default versteckt, Klick auf Legendenitem ein-/ausblenden.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Klick auf Legendenitem blendet den Status aus (opacity 0, kein Klick,
kein Hover). Panel schließt sich wenn der Status des gewählten Gebiets
ausgeblendet wird. Visuell: opacity + line-through auf versteckten Items.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GeoJSON-Geometrie direkt in CMS-Einträgen gespeichert — kein separates
GeoJSON-File mehr. WindkarteMap baut FeatureCollection aus areas[].geometry.
WindArea-Typ bekommt geometry-Feld. geojsonUrl-Prop entfernt.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Keine hardcodierten Texte mehr — alle Strings über CMS translation_bundle
(app.json5). Keys in translations.ts registriert.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Polygon-Labels ab Zoom 13 mit zoom-proportionaler Schriftgröße
- Hover-Highlight, Deselect per Hintergrundklick
- Mobile Bottom-Sheet / Desktop Side-Panel (CSS-only)
- Share-Link via URL-Hash (#W-10), auto-select on load
- Share-Button + OSM-Link im Panel
- Reset-Button auf Karte
- Buffer-Spinner während Turf-Berechnung
- Leaflet-Attribution nach links (kollidierte mit Panel)
- fitBounds mit asymmetrischem Padding + maxZoom 14
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
areas-Feld im Schema + Block-Logik: referenzierte Slugs werden einzeln
gefetcht. Leer = alle published areas als Fallback. Ermöglicht verschiedene
Karten-Blöcke mit unterschiedlichen Gebiet-Subsets.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Neuer CMS-Block `wind_map` — platzierbar auf jeder Seite per Row-Content.
Fetcht wind_area-Einträge + GeoJSON-Asset client-side, rendert Leaflet-Karte
(CartoDB Light) mit farbcodierten Polygonen nach Planungsstatus. Klick auf
Gebiet öffnet Slide-in-Panel mit Kenndaten, Gemeinden, Stellungnahme-Link
und Puffer-Ringen (200/600/1000 m via Turf). Erweiterbar für 2. Entwurf 2026.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Energy-Charts /public_power now fetched via strommix_history_de CMS collection
(which uses ${time:day_start|iso}/${time:now|iso} in its source URL). When the
CMS returns null (old binary without env_subst support), falls back to a direct
EC call so charts keep working during the transition.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The strommix_history_de collection source URL 404s (Energy-Charts needs
start/end params), so the CMS history backend stays empty and todayHourly
was always null — making the Wind & Solar sparkline never appear.
Extend fetchEnergyChartsPublicPower to start at midnight (was: -2h) and
return the raw series alongside the snapshot values. Build todayHourly
from it when the history backend has no items. No extra API call.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- description field rendered as Markdown (marked.parse + prose)
- month label left/larger, nav arrows grouped right
- weekday headers colored (himmel/stein)
- day cells weekend/weekday coloring
- remove pl-[4.75rem] indent from accordion body
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- month label left + larger, prev/next arrows grouped right
- weekday headers colored (himmel/stein by weekday/weekend)
- day cells colored by weekday/weekend + event state
- event anchor IDs, onDestroy SSR fix, ImageModal component
- copy link button, action buttons always show text
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Hover tooltip on event cells (pointer:fine only, position:fixed bypasses overflow-hidden)
— shows title + right-aligned time, max 3 events, "+N weitere"
- Grid background changed to himmel-100 (light), all text tokens updated to dark
- Today cell: wald-200 green background + wald-400 outline
- Empty day cells: subtle bg-himmel-50/40 tint
- Event badge larger on desktop (sm:min-w-4.5 sm:h-4.5 sm:text-[10px])
- Weekday headers: font-semibold text-himmel-800
- Calendar takes full width inside widget (removed max-w-2xl cap)
- Web Share API per event (navigator.share / clipboard fallback, Kopiert\! toast)
- Subscribe bar: webcal:// on Apple, direct ICS download on other platforms
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- /api/kalender.ics SSR route: ICS feed of all calendar items (webcal-subscribable, Cache 1h)
- buildICSFeed() / downloadICSFeed() for multi-event ICS export
- googleCalUrl() deep-link pre-fills Google Calendar create form
- Web Share API per event (navigator.share on mobile, clipboard fallback on desktop)
— "Kopiert\!" toast per event for 2s after clipboard write
- Actions bar (subscribe + bulk export) only rendered after onMount
— Apple platforms: webcal:// link opens Calendar.app natively
— All others: direct ICS download via <a download>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Watchtower waits for container to be healthy before stopping the old
one. Grace period allows in-flight requests to drain on shutdown.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace `container mx-auto px-6` with `container-custom` so the
headline/subheadline block (no image case) matches the main content
padding and max-width.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds AnnouncementBanner component fed by a new top_banner CMS entry
(site-announcement). Extended top_banner schema and TS types with
optional link + linkLabel fields. Rendered inline-markdown text.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Calendar widget stays stacked (calendar above events list)
- Grid widens to max-w-2xl with fixed h-10 cells (no aspect-square height growth)
- Gap between cells: 0.5 → 1.5
- Button system extracted to shared btn-* utility classes in app.css
- Replaced Google Calendar link + Google Maps with OSM
- Removed google icon from iconify subset
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The 2-col grid forced the events list to share the calendar's square
height which cropped event details. Stack calendar over events instead,
cap the whole block at 1000px (centered), constrain the calendar grid to
480px so day cells don't grow oversized, and re-add a 600px max-height
with internal scroll on the events list so the page stays compact and
sticky day-group headers regain their scroll context.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Social-link entries with internal URLs (starting with /) used to open in a
new tab via target=_blank, which is wrong for internal navigation like the
new /kalender entry.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Replace direct post.isEvent/eventDate/eventLocation reads with
getPostEventInfo() helper that derives info from the resolved
calendarItem reference. Loaders now resolve "calendarItem" and request
that field instead of legacy flat properties.
Also regenerate iconify mdi subset (map-marker-outline, download,
google, calendar-search, refresh).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
daysLeft used Math.ceil(ms/24h) which counted partial 24h windows:
30h before a midnight event tomorrow showed "Noch 2 Tage" instead
of "Morgen". Compare midnight-to-midnight day-keys instead, same
approach as CalendarBlock relativeDays().
Also adds data-block="DeadlineBanner" identifier.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Right panel now shows all upcoming events as a card-style accordion
(date block + title + location/time chips visible, body collapsed).
Day-grouped with sticky headers + relative countdown.
- ICS download per event (RFC-5545, client-side blob)
- Google Calendar render-template link per event
- Maps link via location field (new schema field)
- Multi-day events via terminEnde (new schema field): grid spans,
range "Mai / 14–16 / 2026" date block, expanded eventsByDay map
- Tag filter chips (new schema field) above calendar
- Past events <details> at list end, expanded if no future
- Live status badge: "läuft gerade" / "beginnt in 45 min"
(60s tick interval)
- Today marker on calendar grid (outline + sr-only label)
- Auto-scroll next event into panel viewport on mount
- "Im Kalender anzeigen" jumps grid to event month
- Urgency-colored left border per event: now/today/tomorrow/week/
later in fire/erde/himmel/stein
- Zebra striping + 4px separator between day-groups
- ARIA: aria-current=date, aria-pressed on day/tag buttons
- Print CSS: details auto-open, day-group break-inside: avoid
- Timezone fix: dayKey uses local Y/M/D not ISO string slice
- Empty-title fallback to "Termin"
- Side-by-side layout from md+ (was always stacked)
Extends CalendarItemData with terminEnde, location, tags
inline until OpenAPI regen catches up.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- New "hero" variant between compact and full: pct + status +
sparkline + trend, no sub-cards or accordion
- 24h Wind+Solar sparkline below hero pct, accent-colored
- Trend arrow vs previous hour with delta percentage points
- Polling pauses on tab hidden, refetches on visibility return
if last fetch >5min old
- Skeleton loader replaces "Lade…" text (matches final layout)
- Retry button on error state (silent vs explicit fetch)
- Stale-flag now prominent red badge in header bar
- Stand-time wrapped in <time datetime title> for full-date hover
- loadMw=0 falls back to last hourly slot instead of red error
- Negative-price banner replaces standalone price card (dedup)
- Production breakdown grid: clean auto/1fr label-value alignment
- Print CSS: details auto-open, chevrons hidden
- All German strings moved to translation keys
- STROMMIX_DEFAULT_THRESHOLDS const as single source for buckets
Includes data-block="LiveStrommix" attribute for the new
identifier scheme + new RenewableSparkline.svelte component.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds data-block="PascalName" alongside existing data-block-type
snake_case so blocks can be located via [data-block="Calendar"] etc.
in DevTools. Snake-case attribute kept for backward compat.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
RustyCMS /api/transform decodes only the first frame of animated formats,
which silently kills GIF animation when markdown HTML images get rewritten
to /api/transform URLs. Skip the transform for `.gif` URLs so the original
asset URL flows through and animation survives.
Also picks up an arrow-right entry in the iconify mdi subset generated
during a UI build.
Aggregator route /api/strommix now reads three RustyCMS history-mode
collections in parallel — strommix_history_de, price_de_history,
crossborder_history_de — and projects derived metrics on top of the raw
upstream snapshots stored there:
- todayHourly: per-slot Last + Wind+Solar for the residual-load chart
- negPriceHoursYtd: count of YTD slots where DE-LU day-ahead < 0
- crossborderTodayGwh / netCrossborderGwhYtd / crossborderByCountryGwhYtd:
GW × slot-hours integrated into a per-country GWh balance
- lastDunkelflaute / worstDunkelflauten: contiguous runs where
(wind+solar)/load drops below 10 % for at least 1 h, top 5 by duration
All four are null-graceful — collections that the CMS hasn't backfilled
yet leave the corresponding panel hidden instead of breaking the widget.
Five new components in lib/components/blocks/strommix/:
- ResidualLoadChart.svelte — SVG line chart, no chart-lib dep
- CapacityFactorBars.svelte — live vs installed Wind/Wind-Off/Solar
- DunkelflauteCounter.svelte — last phase card + top-5 list
- NegPriceCounter.svelte — YTD hours + manual EinsMan compensation
- FlowBalanceTodayYtd.svelte — today + YTD saldo with per-country breakdown
Block schema additions (block-types.ts + strommix-default.json5 in
cms_content): installed_*_gw / installed_as_of for the capacity-factor
bars (BNetzA Marktstammdatenregister snapshot, manually maintained), and
einsman_costs_ytd_eur_mio / einsman_costs_as_of for the NegPrice panel
(BNetzA quarterly report figures, no API).
Lora -> Aleo dependency change in 4419742 left package-lock.json out of
sync, breaking `npm ci` in CI. Regenerated via `npm install --package-
lock-only`. Removed yarn.lock that came back with the same commit;
single source of truth is package-lock.json.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
(embed)/+layout@.svelte only resets intermediate layouts — root
+layout.svelte still wrapped every widget page with Header, Footer,
TopBanner, Breadcrumbs, Skip-Link, OG/JSON-LD/Analytics.
Root layout now derives isEmbed from $page.route.id (matches /(embed))
and renders just {@render children()} in that branch. svelte:head is
gated too: embed mode emits only the favicon, leaving the page free to
set its own <title> and noindex meta.
+layout.server.ts short-circuits the bootstrap batch (navigation,
footer, page_config, logo) for embed routes — saves one CMS roundtrip
+ logo transform per widget request, and avoids double-counting in
Umami/pm86 analytics when the widget is iframed elsewhere.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Renders a single CMS entry as a block in isolation — no header, footer, or
preview banner. Lets us share a deep link to a single widget (e.g. the live
strommix gauge) for embedding or quick previews without exposing the rest of
the page.
- New BlockRenderer.svelte: switch over `_type` shared with ContentRows.
- Generic `getEntryBySlug(collection, slug, options)` in cms.ts so any
collection (live_strommix, deadline_banner, image, ...) is fetchable.
- Route group `(embed)/+layout@.svelte` resets the layout chain so no
Header/Footer/TopBanner inherit. `x-robots-tag: noindex`.
- Optional `?preview=<token>` for drafts. Cache: short s-maxage for live,
no-store for preview.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Lead-paragraph rule matched footer MarkdownBlocks (copyright line)
and made it 1.25rem. Restrict to article descendants so footer +
sidebar Markdown stay at their natural size.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Palette: gray/zinc/slate/neutral → stein, red → fire, amber → erde,
sky → himmel, green → wald
- Footer: replaced raw rgb with stein tokens
- Radius: unified to rounded-xs across cards, buttons, inputs, pagination
- Buttons: .btn-primary/.btn-secondary now font-medium; added secondary
- Card hover: -translate-y-0.5 + shadow + wald-300 border
- Header active link: wald border-bottom + wald-700 text
- Mobile nav: bigger touch targets + wald active accent
- Pagination: prev/next text labels + wald-500 active state with
separated shape/color classes to avoid Tailwind conflicts
- Lead paragraph: scoped .markdown > p:first-child for top-level
MarkdownBlock only via [data-block-type="markdown"]
- Section dividers: subtle wald-200 gradient between content rows
- Global focus-visible ring (wald-500)
- Inline hex → palette tokens (Badge amber, Tag custom-color contrast)
- Font weights snapped to design system (300/400/500/600/700)
- transition-all → transition-colors where only color changes
- Removed em-dashes from user-visible templates
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add full/compact variants, prominent share, source badge, big
negative-price banner with conditional disclaimer, cards-style
context row, fade-in animation, and remove em-dashes from
visible strings.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Energy-Charts' /public_power endpoint started rejecting requests without
`start` + `end` query params ("HTTP 404: no content available"). The
CMS-cached `strommix_de` external schema cannot pass dynamic time
windows (external-collections v1 has no runtime-vars), so the per-field
fallback chain was effectively dead — when SMARD's load filter lagged
12+ h, both sources returned null and the widget surfaced "Lastwert
nicht verfügbar" with all zeros.
Aggregator now fetches /public_power directly with a 2-hour window,
picks the latest non-null per series, and feeds those values into the
existing per-field fallback. CMS strommix_de schema becomes obsolete
for the widget but stays available for admin debugging.
Same shape as the previous CMS payload, so the fallback merge is
unchanged. Picks `Wind onshore`, `Wind offshore`, `Solar`, `Biomass`,
`Hydro Run-of-River`, `Fossil brown coal / lignite`, `Fossil hard
coal`, `Fossil gas`, `Nuclear`, `Load` from production_types.
When SMARD's load filter (id 410) lags 12+ hours, the aligned-min
strategy in fetchSmardSnapshot produces a snapshot stamped with that
12-hour-old timestamp — and the widget surfaces it as the live "Stand
HH:MM" header. With Energy-Charts already returning fresher numbers
through the CMS path, falling back entirely is the right move.
Threshold is 90 min: tight enough to catch obvious lag, loose enough
to keep normal 30–60 min SMARD delay as the canonical source.
Two issues from the audit:
1. Hardcoded `lg:col-span-8 lg:col-start-3` collided with the layout
coming from `getBlockLayoutClasses(block.layout)`. Tailwind picked
`lg:col-start-3` from the hardcoded class (no opposing
`lg:col-start-1` in the layout output) so the widget started at
column 3 with span 12 → overflowed past the 12-col grid on
desktop, looking like it was "hanging right". Drop the hardcoded
constraints; the layout config from the CMS controls width
(mobile/tablet/desktop = 12 by default = full width).
2. Roughly 25 German strings were inline. Extracted them to
translation keys (T.strommix_*, registered in translations.ts) and
read via `useTranslate()` like ImageGalleryBlock /
PostOverviewBlock / YoutubeVideoBlock. Includes field labels for
the breakdown disclosure, source attribution variants, status
bucket markers, error / loading / fallback messages, and the
conventional formula text shown under the "Konventionell jetzt"
number.
Default DE strings live in cms_content/windwiderstand/translation_bundle/
app.json5 (separate CMS push).
The widget rendered "Keine gültigen Live-Werte" the moment SMARD's
load filter (id 410) lagged behind the production filters by even one
slot — the aggregator coalesced "filter unavailable" with "filter
returned 0" and the percent calculation refused to divide by zero.
Three changes:
1. SmardSnapshot.values now uses `number | null` so callers can tell
"filter genuinely missing" apart from "filter reported zero" (e.g.
solar at night, decommissioned nuclear).
2. Aggregator pulls Energy-Charts (CMS strommix_de) in parallel and
uses it as a per-field fallback for any SMARD null. New
`dataSource: "smard+energy-charts"` flag travels in the response so
the attribution stays honest. Pure SMARD when everything resolves;
pure Energy-Charts when SMARD is entirely down; the hybrid label
for the common case where only load drops out.
3. Widget renders the production breakdown + context row + price row
even when the percentage is unavailable, with a clear "Lastwert
von SMARD gerade nicht verfügbar" hint instead of going blank.
Audit at 22:15 MESZ flagged the conventional sum (lignite + hard coal
+ gas + nuclear) as 19.1 GW in the widget vs 15.65 GW in reality. The
breakdown showed the gap was Energy-Charts' `Fossil gas` (6.9 GW)
which bundles natural gas + GuD + similar, while SMARD's `Erdgas`
filter 4069 (3.8 GW) tracks just natural gas the way the widget label
implies. SMARD is the canonical German grid feed; switching the
primary source resolves the discrepancy directly.
- New `lib/smard.ts` fetches the 11 relevant filter IDs in parallel:
conventional (1223/4070/4069/1224), wind (4067/1225), solar (1226),
hydro (1228), biomass (4066), other-conventional + pumped storage
(1227/4071, surfaced separately), load (410). Two-step protocol
(index.json → archive.json) handled inside; output is MW (MWh × 4)
aligned to one common slot timestamp so every value on screen comes
from the same point in time.
- Aggregator route uses SMARD for production + load, Energy-Charts
only for cross-border saldo + day-ahead prices (where SMARD has no
convenient single-call endpoint). `dataSource: "smard" |
"energy-charts"` flag travels in the response so the widget can
attribute the numbers and fall back gracefully when SMARD is down.
- StrommixBlock gets a "Werte prüfen" disclosure that lists every
component (wind onshore + offshore, solar, the four conventional
buckets, biomass, hydro, load) with its MW value and the slot
timestamp + data source. Fact-check users can verify the addition
themselves now without asking.
Verified live: SMARD @ 21:00 UTC = lignite 8484 + hard coal 3480 +
gas 3811 + nuclear 0 = 15.78 GW conventional. Matches the user's
ground-truth 15.65 GW within sampling noise.
Audit against ground truth at 22:15 lokal exposed three real bugs:
1. Day-ahead price was wrong (widget 125, real 153 €/MWh). The CMS'
`last_non_null` transform always picks the last cell of the 96-slot
array — typically a slot in the future, not the slot covering "now".
Bypass the CMS for prices: aggregator fetches energy-charts /price
directly, walks unix_seconds, and picks the largest start ≤ now.
`priceMeasuredAtUnix` is surfaced so the widget can show the slot
timestamp as a sanity check.
2. Cross-border saldo (cbpf) typically lags 1.5–2 h. Widget labelled
it as "jetzt" even when the upstream's last datapoint was 90 min
old. Now the cross-border timestamp travels through the aggregator
and the widget renders "Stand 20:30 Uhr · verzögert" when the gap
to the production snapshot exceeds 30 min.
3. Bucket label "Dunkelflaute" misuses the term — the formal
definition needs ≥24 h history, not a single threshold crossing.
Updated the strommix-default content entry to use "Sehr niedrige
Einspeisung" / "Very low feed-in" instead, and explained the
reasoning in a comment so editors don't re-introduce the misnomer.
Aggregator response shape gained `crossborderMeasuredAtUnix` +
`priceMeasuredAtUnix`; the widget renders both as small timestamps
under their values, plus a "verzögert" hint when cross-border data is
older than the 30-min tolerance window.
Cache TTLs on the price external collections lowered from 30 min to
15 min so the admin-side cache flips at the same cadence as the
day-ahead slots (since 30.09.2025 prices come in 15-min buckets).
Editor-controlled live-strommix card that surfaces what share of
electricity demand is currently covered by weather-dependent
renewables (Wind+Solar / Load), plus the conventional generation that
fills the gap, the cross-border saldo, and the day-ahead price (DE/FR
side-by-side). Status bucket + label + argument come from the CMS so
editors can iterate copy without a deploy.
- LiveStrommixBlockData type next to the other block-types.
- New `/api/strommix` aggregator route bundles four CMS external
collections (strommix_de, crossborder_de, price_de, price_fr) into a
single payload, computes the renewable + conventional sums and the
cross-border saldo (Σ flow_xx_gw, sign convention: + = export from
DE), surfaces stale-on-error flags from the CMS response headers.
Cache-control 5min so a single node only hits energy-charts once
per window.
- StrommixBlock.svelte renders the card: percentage, bucket label,
bucket argument (markdown), context row (conventional + saldo with
↑/↓ arrow), price row with optional FR comparison + negative-price
badge, footer with disclaimer + "Wie wird das berechnet?" link +
stale-data hint when the CMS served fallback. Re-polls every 5min
client-side; bucket thresholds + labels + arguments come from the
block instance so multiple placements can carry different copy.
- ContentRows.svelte dispatcher branch on `_type === "live_strommix"`.
Wired against `cms_content/_types/core/live_strommix.json5` (added in
the rustycms repo today). content_layout.row{1,2,3}Content already
allow the new block-type via the same commit on the CMS side.
Security:
- cms-images / cms-files now share resolveCmsSource (cms-source.server.ts)
which enforces an allowlist: asset filename, absolute path on the CMS
host, or full URL exact-matching the configured CMS host+protocol.
Foreign hosts, protocol-relative URLs and path traversal return 400.
- markdown-safe.ts is the single configured marked entrypoint; it
disables raw HTML rendering globally (renderer.html() returns ''),
removing the inline script/iframe injection vector via markdown.
All 8 marked imports across components and loaders now go through it.
- sanitize-blocks.server.ts walks resolved page/post content and runs
HtmlBlock html fields through sanitize-html with a tight allowlist
(no script/style/on*, only youtube/vimeo/spotify iframes, mailto/tel
plus http(s) schemes, target=_blank gets rel=noopener).
- Webhook tokens (revalidate, cache/clear) compared via
crypto.timingSafeEqual through auth-token.server.ts.
- cms.ts wraps every fetch in cmsFetch(): 5 s default timeout via
AbortSignal.timeout, override per call or globally via
PUBLIC_CMS_FETCH_TIMEOUT_MS. Stops slow CMS responses from pinning
SSR workers indefinitely.
Observability:
- log.server.ts gives logWarn / logError / logInfo with scope + context;
swallowed catch {} blocks in hooks, layout.server, +page.server,
[...slug]/+page.server and sitemap now log instead of going silent.
Routing:
- Legacy /blog, /blog/page/:n, /blog/tag/:t and /p/:slug stub routes
deleted; their 301 redirects moved into hooks.server.ts so the
request never enters the SvelteKit page pipeline.
Tests (vitest, server-side):
- auth-token.server.test.ts (6 cases for constant-time compare)
- cms-source.server.test.ts (8 cases for SSRF allowlist)
- sanitize-blocks.server.test.ts (9 cases for sanitizer + walker)
All 23 green.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Peter Meier