| Export content at build time |
No editorial CMS read on public page requests. Production builds read live CMS content; a merge to main publishes saved editorial content when its build succeeds |
export-fallbacks.ts, catalog/index.ts |
| Production-only live-content build |
CI and Vercel previews use fixtures without CMS credentials; explicit local operator live export is available |
Exporter source policy |
| One production CMS |
One editorial truth; configuration writes require exact review and live readback |
apps/cms/README.md |
| Manual Publish with delayed feedback |
One build request per editing session; two version reads, ten-minute wait and one notice. Changed version is observation, not deployment attribution |
flows.json, operations.json; ‣ |
| Owner-browser configuration writes |
Admin uses two-factor auth and is not stored in .env. Confirmed packets use the owner's authenticated session; GitHub's token runs the read-only diff |
‣ |
| Keep sync identities with manual configuration creates |
New operations, permissions and translations need map rows; logical tables are operations, permissions, translations, policies |
apps/cms/ops/impact-proof.md |
| Keep broad production policy/permission sync refused |
Snapshot alignment and exact browser grants do not authorize global access repair |
sync-push.ts; ‣ |
| Released design packages, one version |
v0.40.0 from yesid-dev/yesid.design supplies shared UI, pointer policy, station tabs, first-visit expanded content and the remembered bulk section choice; consumers use released packages. API/migration changes require an rc.N rehearsal in a draft adoption PR in each of the three consumers |
Root/web manifests, bun.lock; connect release/adoption slices |
| Shared static security policy except apex HSTS |
Drift test compares installed SECURITY_HEADERS; apex HSTS is provider-owned max-age only, without includeSubDomains/preload. Adding either needs Yesito's answer |
security-headers.test.ts, vercel.json |
| One content catalog and availability policy |
Routes, prerender, sitemap, OG and LLM text use site-page, entity-status and locale rules; public and wip projects are available, private ones are excluded |
catalog/index.ts, catalog/availability.ts, agreement tests |
| App owns header and language copy |
EN/FR/ES locale files own header, language and control labels |
apps/web/src/lib/locales/, CMS snapshot |
| Retain real hero data through one failed check |
The displayed real reading keeps ageing; a second consecutive failure switches to labelled DEMO. Manual and automatic checks share the budget and one in-flight request |
HeroBanner.svelte, HeroBanner.polling.test.ts |
| Optional metric evidence in CMS |
Project/Service metrics show a value and label. The CMS holds optional source and measurement-date fields; the site and llms-full.txt do not display those fields. Editor validation, export schema and two narrow Human Editor grants apply to this data |
Shared metric schema, CMS fields/grants, fetchers and server/llms.ts; ‣ |
| Eight events, four measuring tools |
Plausible owns eight named custom events; Vercel Web Analytics, Speed Insights and Cloudflare beacon are separate measuring tools |
analytics/preset.ts, analytics/client.ts; Cloudflare injection is provider-owned |
| No automated contact send |
Web3Forms blocks headless signatures. Keep provider delivery as an owner-browser check; failure copy offers email and emits contact_form_error |
‣ and connect Handoff |
| Preserve reading position |
Back and locale restoration reveal the target chain before restoring position. Expanded history uses the click-time offset. Diagram anchoring is bounded until layout settles or reader input |
reading-position-plan.ts, reading-session.ts, detail-reading.ts, detail-reading-position.ts |
| Remember one bulk section choice |
On eligible pages with at least two collapsible content sections, a first visit or a malformed stored choice starts with every section expanded and a neutral bulk control labelled Collapse all. Bulk actions store collapsed or expanded in origin-wide localStorage['sections-choice']; that choice applies across pages and visits, so a stored Collapse all collapses content on later pages. Individual toggles, TOC/fragment jumps and restoration do not write it. The TOC and independent panels keep their own state; pages below the threshold use their declared defaults. |
@yesid/ui v0.40.0 (expanded default since design v0.37.0, #647), tests/remembered-sections.spec.ts; cookies policy |
| Upload-only images, optional mirrors |
Each live build publishes referenced raster uploads under /images/cms/, trading per-image code review for editorial review at Publish site. Committed mirrors are optional reviewed pinning and win for their UUID; new SVGs still need one. One article media controller serves inline images and galleries. Café Arona has four source mirrors: Home desktop/mobile, Product desktop and Team desktop, with responsive variants |
build-media.ts, apps/cms/README.md, asset manifest, article-media.svelte.ts (#677) |
| CMS owns project share copy |
Card subtitle and metadata description derive from the localized one_liner and overview sentences, not code. Export fails a one-liner the card cannot render in full |
og/project-copy.ts, validate-project-lines.ts (#678) |
| Wrap, don't replace, the Directus block editor |
The Article Block Editor interface keeps Directus's built-in editor and adds image layout, light-version and show-both-themes controls, preserving image extras by block ID |
apps/cms/extensions/article-editor (#693) |
| Hosting plans |
Keep the paid Neon Launch plan and the build-time content export, which lets Neon sleep. A Directus cache or Neon materialized views don't replace the export. Stay on Vercel Hobby until Vercel enforces its non-commercial rule |
Yesito's cost decisions, October 30, 2026 |
| Public but proprietary source |
Inspectable portfolio source; external code contributions are not accepted |
LICENSE, CONTRIBUTING.md |