feat(pages): add pages and navigation builder baseline

.env.example

@@ -10,6 +10,18 @@ CMS_SUPPORT_EMAIL="support@cms.local"
 CMS_SUPPORT_PASSWORD="change-me-support-password"
 CMS_SUPPORT_NAME="Technical Support"
 CMS_SUPPORT_LOGIN_KEY="support-access-change-me"
+CMS_MEDIA_STORAGE_PROVIDER="s3"
+CMS_MEDIA_STORAGE_TENANT_ID="default"
+CMS_MEDIA_UPLOAD_MAX_BYTES="26214400"
+# Optional: override local media storage directory for admin upload adapter.
+# CMS_MEDIA_LOCAL_STORAGE_DIR="/absolute/path/to/media-storage"
+# S3/object-storage config (default provider). If unavailable, upload falls back to local storage.
+# CMS_MEDIA_S3_BUCKET="cms-media"
+# CMS_MEDIA_S3_REGION="eu-central-1"
+# CMS_MEDIA_S3_ACCESS_KEY_ID=""
+# CMS_MEDIA_S3_SECRET_ACCESS_KEY=""
+# CMS_MEDIA_S3_ENDPOINT="" # optional (e.g. MinIO, R2)
+# CMS_MEDIA_S3_FORCE_PATH_STYLE="false"
 NEXT_PUBLIC_APP_VERSION="0.1.0-dev"
 NEXT_PUBLIC_GIT_SHA="local"
 # Optional dev bypass role for admin middleware. Leave empty to require auth login.

.gitea/scripts/extract-release-notes.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env sh
+set -eu
+
+tag="${1:-}"
+
+if [ -z "$tag" ]; then
+  echo "Missing release tag argument (expected vX.Y.Z)."
+  exit 1
+fi
+
+if [ ! -f CHANGELOG.md ]; then
+  echo "CHANGELOG.md not found."
+  exit 1
+fi
+
+version="${tag#v}"
+
+awk -v version="$version" '
+BEGIN {
+  in_section = 0
+  started = 0
+}
+/^## / {
+  if (in_section == 1) {
+    exit
+  }
+
+  if (index($0, version) > 0) {
+    in_section = 1
+    started = 1
+    print $0
+    next
+  }
+}
+{
+  if (in_section == 1) {
+    print $0
+  }
+}
+END {
+  if (started == 0) {
+    exit 2
+  }
+}
+' CHANGELOG.md

.gitea/scripts/publish-gitea-release.mjs

@@ -0,0 +1,80 @@
+import { readFileSync } from "node:fs"
+
+const tag = process.env.RELEASE_TAG?.trim()
+const releaseName = process.env.RELEASE_NAME?.trim() || tag
+const bodyFile = process.env.RELEASE_BODY_FILE?.trim() || ".gitea-release-notes.md"
+const serverUrl = process.env.GITHUB_SERVER_URL?.trim()
+const repository = process.env.GITHUB_REPOSITORY?.trim()
+const token = process.env.GITEA_RELEASE_TOKEN?.trim()
+
+if (!tag) {
+  throw new Error("RELEASE_TAG is required")
+}
+
+if (!serverUrl || !repository) {
+  throw new Error("GITHUB_SERVER_URL and GITHUB_REPOSITORY are required")
+}
+
+if (!token) {
+  throw new Error("GITEA_RELEASE_TOKEN is required")
+}
+
+const body = readFileSync(bodyFile, "utf8")
+const baseApi = `${serverUrl.replace(/\/$/, "")}/api/v1/repos/${repository}`
+
+async function request(path, options = {}) {
+  const response = await fetch(`${baseApi}${path}`, {
+    ...options,
+    headers: {
+      "content-type": "application/json",
+      authorization: `token ${token}`,
+      ...(options.headers ?? {}),
+    },
+  })
+
+  return response
+}
+
+const payload = {
+  tag_name: tag,
+  target_commitish: "main",
+  name: releaseName,
+  body,
+  draft: false,
+  prerelease: false,
+}
+
+const existingResponse = await request(`/releases/tags/${encodeURIComponent(tag)}`)
+
+if (existingResponse.ok) {
+  const existing = await existingResponse.json()
+  const updateResponse = await request(`/releases/${existing.id}`, {
+    method: "PATCH",
+    body: JSON.stringify({
+      ...payload,
+      target_commitish: existing.target_commitish ?? payload.target_commitish,
+    }),
+  })
+
+  if (!updateResponse.ok) {
+    const message = await updateResponse.text()
+    throw new Error(`Failed to update release: ${updateResponse.status} ${message}`)
+  }
+
+  console.log(`Updated release for tag ${tag}`)
+} else if (existingResponse.status === 404) {
+  const createResponse = await request("/releases", {
+    method: "POST",
+    body: JSON.stringify(payload),
+  })
+
+  if (!createResponse.ok) {
+    const message = await createResponse.text()
+    throw new Error(`Failed to create release: ${createResponse.status} ${message}`)
+  }
+
+  console.log(`Created release for tag ${tag}`)
+} else {
+  const message = await existingResponse.text()
+  throw new Error(`Failed to query existing release: ${existingResponse.status} ${message}`)
+}

.gitea/workflows/ci.yml

@@ -84,6 +84,12 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      - name: Resolve build metadata
+        run: |
+          version=$(bun -e 'const pkg = JSON.parse(await Bun.file("package.json").text()); console.log(pkg.version)')
+          echo "NEXT_PUBLIC_APP_VERSION=$version" >> "$GITHUB_ENV"
+          echo "NEXT_PUBLIC_GIT_SHA=${GITHUB_SHA}" >> "$GITHUB_ENV"
+
       - name: Install Playwright browser deps
         run: bunx playwright install --with-deps chromium
 

.gitea/workflows/release.yml

@@ -8,7 +8,7 @@ on:
     inputs:
       release_tag:
         description: "Release tag in vX.Y.Z format"
-        required: true
+        required: false
       rollback_image_tag:
         description: "Optional rollback image tag"
         required: false
@@ -21,6 +21,7 @@ env:
 jobs:
   release:
     name: Build Push Changelog
+    if: github.event_name == 'push' || github.event.inputs.rollback_image_tag == ''
     runs-on: node22-bun
     steps:
       - name: Checkout
@@ -38,6 +39,10 @@ jobs:
         id: tag
         run: |
           if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
+            if [ -z "${{ github.event.inputs.release_tag }}" ]; then
+              echo "release_tag input is required when publishing a release manually."
+              exit 1
+            fi
             echo "value=${{ github.event.inputs.release_tag }}" >> "$GITHUB_OUTPUT"
           else
             echo "value=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
@@ -49,6 +54,13 @@ jobs:
       - name: Generate changelog
         run: bun run changelog:release
 
+      - name: Build release notes payload
+        run: |
+          if ! sh .gitea/scripts/extract-release-notes.sh "${{ steps.tag.outputs.value }}" > .gitea-release-notes.md; then
+            echo "Could not isolate section for tag ${{ steps.tag.outputs.value }}. Falling back to full CHANGELOG.md."
+            cp CHANGELOG.md .gitea-release-notes.md
+          fi
+
       - name: Login to image registry
         run: |
           echo "${{ secrets.CMS_IMAGE_REGISTRY_PASSWORD }}" | docker login "${{ env.REGISTRY }}" -u "${{ secrets.CMS_IMAGE_REGISTRY_USER }}" --password-stdin
@@ -65,18 +77,27 @@ jobs:
           docker build -f apps/admin/Dockerfile -t "$image" .
           docker push "$image"
 
-      - name: Release notes placeholder
+      - name: Publish release notes to Gitea
-        run: |
+        env:
-          echo "Release tag: ${{ steps.tag.outputs.value }}"
+          RELEASE_TAG: ${{ steps.tag.outputs.value }}
-          echo "TODO: publish CHANGELOG.md content to release notes in Gitea."
+          RELEASE_NAME: ${{ steps.tag.outputs.value }}
+          RELEASE_BODY_FILE: ".gitea-release-notes.md"
+          GITEA_RELEASE_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
+        run: bun .gitea/scripts/publish-gitea-release.mjs
 
   rollback:
-    name: Rollback (Manual)
+    name: Rollback Production (Manual)
     if: github.event_name == 'workflow_dispatch' && github.event.inputs.rollback_image_tag != ''
-    runs-on: ubuntu-latest
+    runs-on: node22-bun
-    needs: release
     steps:
-      - name: Rollback placeholder
+      - name: Setup SSH
         run: |
-          echo "Rollback to image tag: ${{ github.event.inputs.rollback_image_tag }}"
+          mkdir -p ~/.ssh
-          echo "TODO: apply compose update with rollback image tags on production host."
+          echo "${{ secrets.CMS_DEPLOY_KEY }}" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          ssh-keyscan -H "${{ secrets.CMS_PRODUCTION_HOST }}" >> ~/.ssh/known_hosts
+
+      - name: Apply rollback image tag on production
+        run: |
+          ssh "${{ secrets.CMS_PRODUCTION_USER }}@${{ secrets.CMS_PRODUCTION_HOST }}" \
+            "cd ${{ secrets.CMS_REMOTE_DEPLOY_PATH }} && CMS_IMAGE_TAG=${{ github.event.inputs.rollback_image_tag }} docker compose -f docker-compose.production.yml pull && CMS_IMAGE_TAG=${{ github.event.inputs.rollback_image_tag }} docker compose -f docker-compose.production.yml up -d"

.gitignore

@@ -32,3 +32,7 @@ packages/db/prisma/generated/
 
 # misc
 .DS_Store
+
+# local media storage
+.data/
+apps/admin/.data/

TODO.md

@@ -101,51 +101,88 @@ This file is the single source of truth for roadmap and delivery progress.
 - [x] [P1] Source of truth for version (`package.json` root) and release tagging rules (`vX.Y.Z`)
 - [x] [P1] Build metadata policy for git hash (`+sha.<short>`) in app runtime footer
 - [x] [P1] App footer implementation plan for version + commit hash (admin + web)
-- [~] [P2] Automated version injection in CI (stamping build from tag + commit hash)
+- [x] [P2] Automated version injection in CI (stamping build from tag + commit hash)
-- [ ] [P2] Validation tests for displayed version/hash consistency per deployment
+- [x] [P2] Validation tests for displayed version/hash consistency per deployment
 - [x] [P1] Release tagging and changelog publication policy in CI
 
 ### MVP0 Close-Out Checklist
 
-- [ ] [P1] Verify and document protected branch rules in Gitea (`main`, `staging`)
+- [~] [P1] Verify and document protected branch rules in Gitea (`main`, `staging`)
-- [ ] [P1] Run first staging deployment against a real host with deploy workflow and document result
+- [~] [P1] Run first staging deployment against a real host with deploy workflow and document result
-- [ ] [P1] Replace release workflow placeholders with real release-notes and rollback execution steps
+- [x] [P1] Replace release workflow placeholders with real release-notes and rollback execution steps
 - [x] [P1] Expose runtime version + short git hash in admin and public app footer
-- [ ] [P2] Add CI build stamping for version/hash values consumed by app footers
+- [x] [P2] Add CI build stamping for version/hash values consumed by app footers
-- [ ] [P2] Add automated tests validating displayed version/hash format and consistency
+- [x] [P2] Add automated tests validating displayed version/hash format and consistency
 
 ## MVP 1: Core CMS Business Features
 
+### MVP1 Suggested Branch Order
+
+- [x] [P1] `todo/mvp1-media-foundation`:
+  media model, artwork entity, grouping primitives (gallery/album/category/tag), rendition slots
+- [~] [P1] `todo/mvp1-media-upload-pipeline`:
+  S3/local upload adapter, media processing presets, metadata input flows, admin media CRUD UI
+- [~] [P1] `todo/mvp1-pages-navigation-builder`:
+  page CRUD, navigation tree, reusable page blocks (forms/price cards/gallery embeds)
+- [ ] [P1] `todo/mvp1-commissions-customers`:
+  commission request intake + admin CRUD + kanban + customer entity/linking
+- [ ] [P1] `todo/mvp1-announcements-news`:
+  announcement management/rendering + news/blog CRUD and public rendering
+- [ ] [P1] `todo/mvp1-public-rendering-integration`:
+  public rendering for pages/navigation/media/portfolio/announcements and commissioning entrypoints
+- [ ] [P1] `todo/mvp1-e2e-happy-paths`:
+  end-to-end scenarios for page publish, media flow, announcement display, commission flow
+
+### Separate Product Ideas Backlog (Non-Blocking)
+
+- [ ] [P2] Smart homepage section presets for artists (featured artwork, latest news, open commissions)
+- [ ] [P2] Portfolio narrative mode (series story + process notes + ordered media sequence)
+- [ ] [P2] Reusable CTA/form snippets with per-page override tokens
+- [ ] [P2] Lightweight CRM timeline per customer (requests, replies, outcomes)
+- [ ] [P3] AI-assisted alt text and metadata suggestion workflow (human approval required)
+- [ ] [P3] Auto-generated social crops/promo packs from selected artworks
+
 ### Admin App (Primary Focus)
 
-- [ ] [P1] Page management (create/edit/publish/unpublish/schedule)
+- [~] [P1] Page management (create/edit/publish/unpublish/schedule)
-- [ ] [P1] Navigation management (menus, nested items, order, visibility)
+- [ ] [P1] Page builder with reusable content blocks (hero, rich text, gallery, CTA, forms, price cards)
-- [ ] [P1] Media library (upload, browse, replace, delete)
+- [~] [P1] Navigation management (menus, nested items, order, visibility)
-- [ ] [P1] Media enrichment metadata (alt text, copyright, author, source, tags)
+- [~] [P1] Media library (upload, browse, replace, delete) with media-type classification (artwork, banner, promo, generic, video/gif)
-- [ ] [P1] Media refinement for artworks (medium, dimensions, year, framing, availability)
+- [ ] [P1] Media enrichment metadata (alt text, copyright, author, source, tags, licensing, usage context)
+- [ ] [P1] Portfolio grouping primitives (galleries, albums, categories, tags) with ordering/visibility controls
+- [ ] [P1] Artwork refinement fields (medium, dimensions, year, framing, availability, price visibility)
+- [ ] [P1] Artwork rendition management (thumbnail, card, full, retina/custom sizes)
+- [ ] [P1] Type-specific processing presets (artwork/banner/promo/video/gif) with validation rules
 - [ ] [P1] Users management (invite, roles, status)
 - [ ] [P1] Disable/ban user function and enforcement in auth/session checks
 - [~] [P1] Owner/support protection rules in user management actions (cannot delete/demote)
-- [ ] [P1] Commissions management (request intake, owner, due date, notes)
+- [ ] [P1] Commissions management (request intake, owner, due date, notes, linked customer, linked artworks)
+- [ ] [P1] Customer records (contact profile, notes, consent flags, recurrence marker)
+- [ ] [P1] Customer-to-commission linkage and reuse workflow (no re-entry for recurring customers)
 - [ ] [P1] Kanban workflow for commissions (new, scoped, in-progress, review, done)
 - [ ] [P1] Header banner management (message, CTA, active window)
+- [ ] [P1] Announcements management (prominent site notices with schedule, priority, and audience targeting)
+- [ ] [P2] News/blog editorial workflow (draft/review/publish, authoring metadata)
 
 ### Public App
 
 - [ ] [P1] Dynamic page rendering from CMS page entities
 - [ ] [P1] Navigation rendering from managed menu structure
 - [ ] [P1] Media entity rendering with enrichment data
+- [ ] [P1] Portfolio views (gallery/album/category/tag) for artworks with filter and sort controls
+- [ ] [P1] Rendition-aware media delivery (thumbnail/card/full) per template slot
 - [ ] [P1] Translation-ready content model for public entities (pages/news/navigation labels)
 - [ ] [P2] Artwork views and listing filters
 - [ ] [P1] Commission request submission flow
 - [ ] [P1] Header banner render logic and fallbacks
+- [ ] [P1] Announcement render slots (homepage + optional global/top banner position)
 
 ### News / Blog (Secondary Track)
 
-- [ ] [P2] News/blog content type (not primary CMS domain)
+- [ ] [P1] News/blog content type (editorial content for artist updates and process posts)
-- [ ] [P2] Admin list/editor for news posts
+- [ ] [P1] Admin list/editor for news posts
-- [ ] [P2] Public news index + detail pages
+- [ ] [P1] Public news index + detail pages
-- [ ] [P3] Tag/category and basic archive support
+- [ ] [P2] Tag/category and basic archive support
 
 ### Testing
 
@@ -165,6 +202,12 @@ This file is the single source of truth for roadmap and delivery progress.
 - [ ] [P1] Audit log for key content operations
 - [ ] [P2] Revision history for pages/navigation/media metadata
 - [ ] [P1] Permission matrix refinement with granular scopes
+- [ ] [P2] Media processing orchestration UI (queue status, retries, processing diagnostics)
+- [ ] [P2] Automatic color palette extraction from artworks (stored for theming/filtering)
+- [ ] [P2] Watermark pipeline for artwork renditions with configurable watermark asset/position/opacity
+- [ ] [P2] Advanced media transforms by type (video transcode profiles, gif optimization, banner safe-area presets)
+- [ ] [P2] Announcement targeting refinement (locale/segment targeting rules)
+- [ ] [P2] Customer lifecycle tooling (status stages, communication history, export)
 - [ ] [P1] Verify email pipeline and operational templates (welcome/verify/resend)
 - [ ] [P1] Forgot password/reset password pipeline and support tooling
 - [ ] [P2] GUI page to edit role-permission mappings with safety guardrails
@@ -179,6 +222,7 @@ This file is the single source of truth for roadmap and delivery progress.
 - [ ] [P2] Performance budget checks (Core Web Vitals)
 - [ ] [P1] 404/500 content-aware error pages
 - [ ] [P1] Accessibility review and fixes
+- [ ] [P2] Theme assistance from extracted artwork palettes (opt-in per page/section)
 
 ### Platform
 
@@ -218,6 +262,19 @@ This file is the single source of truth for roadmap and delivery progress.
 - [2026-02-10] i18n conventions are now documented as an engineering standard (`docs/product-engineering/i18n-conventions.md`).
 - [2026-02-10] Docs now include a domain glossary, public API glossary, and ADR baseline with initial accepted decision (`ADR 0001`).
 - [2026-02-10] Delivery and release governance now include branch/PR policy checks, deploy/release workflows, and explicit versioning policy (`VERSIONING.md`).
+- [2026-02-11] Release workflow now publishes changelog-derived notes to Gitea releases and supports executable production rollback via SSH + compose tag switch.
+- [2026-02-11] Branch protection verification checklist is now documented; final UI-level verification remains environment-specific.
+- [2026-02-11] Added a staging deployment execution checklist and deployment-record template to capture first real-host rollout evidence.
+- [2026-02-11] Artist-focused feature map refined: MVP1 covers portfolio media/domain CRUD + announcements + customer/commission linking; MVP2 covers advanced automation (watermark, palette extraction, media transform pipelines).
+- [2026-02-11] `gaertan` inspiration to reuse: S3 object strategy with signed delivery, commission type/options/extras/custom-input modeling, request-status kanban mapping, and gallery rendition/color extraction patterns.
+- [2026-02-11] MVP1 media foundation started: portfolio domain models (`MediaAsset`, `Artwork`, galleries/albums/categories/tags, rendition links) plus initial admin `/media` and `/portfolio` data views.
+- [2026-02-11] `prisma migrate dev --name media_foundation` can fail when DB endpoint is unreachable; apply this named migration once `DATABASE_URL` host is reachable again.
+- [2026-02-11] MVP1 media foundation now includes baseline create/link workflows in admin (`/media`, `/portfolio`), seeded sample portfolio entities, and schema/service test coverage.
+- [2026-02-12] MVP1 media upload pipeline started: admin `/api/media/upload` accepts metadata + file upload with permission checks, stores files via local adapter (`.data/media`), and persists upload metadata to `MediaAsset`.
+- [2026-02-12] Upload storage is now provider-based (`local` + `s3`) via `CMS_MEDIA_STORAGE_PROVIDER`; admin-side GUI toggle remains a later MVP item.
+- [2026-02-12] Media storage keys now use asset-centric layout (`tenant/<id>/asset/<assetId>/<fileRole>/<assetId>__<variant>.<ext>`) with DB-managed media taxonomy.
+- [2026-02-12] Admin media CRUD now includes list-to-detail flow (`/media/:id`) with metadata edit and delete actions.
+- [2026-02-12] MVP1 pages/navigation baseline started: `Page`, `NavigationMenu`, and `NavigationItem` models plus admin CRUD routes (`/pages`, `/pages/:id`, `/navigation`).
 
 ## How We Use This File
 

apps/admin/package.json

@@ -12,6 +12,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "3.988.0",
     "@cms/content": "workspace:*",
     "@cms/db": "workspace:*",
     "@cms/i18n": "workspace:*",

apps/admin/src/app/api/media/file/[id]/route.ts

@@ -0,0 +1,120 @@
+import { readFile } from "node:fs/promises"
+import path from "node:path"
+import { GetObjectCommand } from "@aws-sdk/client-s3"
+import { hasPermission } from "@cms/content/rbac"
+import { getMediaAssetById } from "@cms/db"
+
+import { auth, resolveRoleFromAuthSession } from "@/lib/auth/server"
+import { resolveLocalMediaBaseDirectory } from "@/lib/media/local-storage"
+import { createS3Client, resolveS3Config } from "@/lib/media/s3-storage"
+import { resolveMediaStorageProvider } from "@/lib/media/storage"
+
+export const runtime = "nodejs"
+
+type RouteContext = {
+  params: Promise<{ id: string }>
+}
+
+async function readFromLocalStorage(storageKey: string): Promise<Uint8Array> {
+  const baseDirectory = resolveLocalMediaBaseDirectory()
+  const outputPath = path.join(baseDirectory, storageKey)
+
+  return readFile(outputPath)
+}
+
+async function readFromS3Storage(storageKey: string): Promise<Uint8Array> {
+  const config = resolveS3Config()
+  const client = createS3Client(config)
+
+  const response = await client.send(
+    new GetObjectCommand({
+      Bucket: config.bucket,
+      Key: storageKey,
+    }),
+  )
+
+  if (!response.Body) {
+    throw new Error("S3 object body is empty")
+  }
+
+  return response.Body.transformToByteArray()
+}
+
+function toBody(data: Uint8Array): BodyInit {
+  const bytes = new Uint8Array(data.byteLength)
+  bytes.set(data)
+  return bytes
+}
+
+export async function GET(request: Request, context: RouteContext): Promise<Response> {
+  const session = await auth.api
+    .getSession({
+      headers: request.headers,
+    })
+    .catch(() => null)
+  const role = resolveRoleFromAuthSession(session)
+
+  if (!role) {
+    return Response.json(
+      {
+        message: "Unauthorized",
+      },
+      { status: 401 },
+    )
+  }
+
+  if (!hasPermission(role, "media:read", "team")) {
+    return Response.json(
+      {
+        message: "Missing permission: media:read",
+      },
+      { status: 403 },
+    )
+  }
+
+  const { id } = await context.params
+  const asset = await getMediaAssetById(id)
+
+  if (!asset || !asset.storageKey) {
+    return Response.json(
+      {
+        message: "Media file not found",
+      },
+      { status: 404 },
+    )
+  }
+
+  const preferred = resolveMediaStorageProvider(process.env.CMS_MEDIA_STORAGE_PROVIDER)
+  const reads =
+    preferred === "s3"
+      ? [
+          () => readFromS3Storage(asset.storageKey as string),
+          () => readFromLocalStorage(asset.storageKey as string),
+        ]
+      : [
+          () => readFromLocalStorage(asset.storageKey as string),
+          () => readFromS3Storage(asset.storageKey as string),
+        ]
+
+  for (const read of reads) {
+    try {
+      const data = await read()
+      return new Response(toBody(data), {
+        status: 200,
+        headers: {
+          "content-type": asset.mimeType || "application/octet-stream",
+          "cache-control": "private, max-age=0, no-store",
+        },
+      })
+    } catch {
+      // Try next backend.
+    }
+  }
+
+  return Response.json(
+    {
+      message: "Unable to read media file from configured storage backends",
+    },
+    { status: 404 },
+  )
+}

apps/admin/src/app/api/media/upload/route.ts

@@ -0,0 +1,207 @@
+import { randomUUID } from "node:crypto"
+import { hasPermission } from "@cms/content/rbac"
+import { createMediaAsset } from "@cms/db"
+
+import { auth, resolveRoleFromAuthSession } from "@/lib/auth/server"
+import { storeUpload } from "@/lib/media/storage"
+
+export const runtime = "nodejs"
+
+const MAX_UPLOAD_BYTES = Number(process.env.CMS_MEDIA_UPLOAD_MAX_BYTES ?? 25 * 1024 * 1024)
+
+type AllowedRule = {
+  mimePrefix?: string
+  mimeExact?: string[]
+}
+
+const ALLOWED_MIME_BY_TYPE: Record<string, AllowedRule> = {
+  artwork: {
+    mimePrefix: "image/",
+  },
+  banner: {
+    mimePrefix: "image/",
+  },
+  promotion: {
+    mimePrefix: "image/",
+  },
+  video: {
+    mimePrefix: "video/",
+  },
+  gif: {
+    mimeExact: ["image/gif"],
+  },
+  generic: {
+    mimePrefix: "",
+  },
+}
+
+function parseTextField(formData: FormData, field: string): string {
+  const value = formData.get(field)
+  return typeof value === "string" ? value.trim() : ""
+}
+
+function parseOptionalField(formData: FormData, field: string): string | undefined {
+  const value = parseTextField(formData, field)
+  return value.length > 0 ? value : undefined
+}
+
+function parseTags(formData: FormData): string[] {
+  const value = parseTextField(formData, "tags")
+
+  if (!value) {
+    return []
+  }
+
+  return value
+    .split(",")
+    .map((item) => item.trim())
+    .filter((item) => item.length > 0)
+}
+
+function deriveTitleFromFilename(fileName: string): string {
+  const trimmed = fileName.trim()
+
+  if (!trimmed) {
+    return "Untitled media"
+  }
+
+  const dotIndex = trimmed.lastIndexOf(".")
+  const base = dotIndex > 0 ? trimmed.slice(0, dotIndex) : trimmed
+  const normalized = base.trim()
+
+  return normalized.length > 0 ? normalized : "Untitled media"
+}
+
+function isMimeAllowed(mediaType: string, mimeType: string): boolean {
+  const rule = ALLOWED_MIME_BY_TYPE[mediaType]
+
+  if (!rule) {
+    return false
+  }
+
+  if (rule.mimeExact?.includes(mimeType)) {
+    return true
+  }
+
+  if (rule.mimePrefix === "") {
+    return true
+  }
+
+  return rule.mimePrefix ? mimeType.startsWith(rule.mimePrefix) : false
+}
+
+function badRequest(message: string): Response {
+  return Response.json(
+    {
+      message,
+    },
+    { status: 400 },
+  )
+}
+
+export async function POST(request: Request): Promise<Response> {
+  const session = await auth.api
+    .getSession({
+      headers: request.headers,
+    })
+    .catch(() => null)
+  const role = resolveRoleFromAuthSession(session)
+
+  if (!role) {
+    return Response.json(
+      {
+        message: "Unauthorized",
+      },
+      { status: 401 },
+    )
+  }
+
+  if (!hasPermission(role, "media:write", "team")) {
+    return Response.json(
+      {
+        message: "Missing permission: media:write",
+      },
+      { status: 403 },
+    )
+  }
+
+  const formData = await request.formData().catch(() => null)
+
+  if (!formData) {
+    return badRequest("Invalid form payload.")
+  }
+
+  const type = parseTextField(formData, "type")
+  const fileEntry = formData.get("file")
+
+  if (!type) {
+    return badRequest("Type is required.")
+  }
+
+  if (!(fileEntry instanceof File)) {
+    return badRequest("File is required.")
+  }
+
+  if (fileEntry.size === 0) {
+    return badRequest("File is empty.")
+  }
+
+  if (fileEntry.size > MAX_UPLOAD_BYTES) {
+    return badRequest(
+      `File is too large. Maximum upload is ${Math.floor(MAX_UPLOAD_BYTES / 1024 / 1024)} MB.`,
+    )
+  }
+
+  if (!isMimeAllowed(type, fileEntry.type)) {
+    return badRequest(`File type ${fileEntry.type || "unknown"} is not allowed for ${type}.`)
+  }
+
+  const title = parseTextField(formData, "title") || deriveTitleFromFilename(fileEntry.name)
+  const mediaAssetId = randomUUID()
+  const variant = "original"
+  const fileRole = "original"
+
+  try {
+    const stored = await storeUpload({
+      file: fileEntry,
+      assetId: mediaAssetId,
+      variant,
+      fileRole,
+    })
+
+    const created = await createMediaAsset({
+      id: mediaAssetId,
+      title,
+      type,
+      description: parseOptionalField(formData, "description"),
+      altText: parseOptionalField(formData, "altText"),
+      source: parseOptionalField(formData, "source"),
+      copyright: parseOptionalField(formData, "copyright"),
+      author: parseOptionalField(formData, "author"),
+      tags: parseTags(formData),
+      storageKey: stored.storageKey,
+      mimeType: fileEntry.type || undefined,
+      sizeBytes: fileEntry.size,
+      isPublished: parseTextField(formData, "isPublished") === "true",
+    })
+
+    return Response.json(
+      {
+        id: created.id,
+        provider: stored.provider,
+        warning: stored.fallbackReason,
+        notice: "Media uploaded successfully.",
+      },
+      { status: 201 },
+    )
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Upload failed. Please try again."
+
+    return Response.json(
+      {
+        message,
+      },
+      { status: 500 },
+    )
+  }
+}

apps/admin/src/app/media/[id]/page.tsx

@@ -0,0 +1,423 @@
+import { deleteMediaAsset, getMediaAssetById, updateMediaAsset } from "@cms/db"
+import { Button } from "@cms/ui/button"
+import Link from "next/link"
+import { redirect } from "next/navigation"
+
+import { AdminShell } from "@/components/admin-shell"
+import { deleteStoredMediaObject } from "@/lib/media/storage"
+import { requirePermissionForRoute } from "@/lib/route-guards"
+
+export const dynamic = "force-dynamic"
+
+type SearchParamsInput = Record<string, string | string[] | undefined>
+
+type PageProps = {
+  params: Promise<{ id: string }>
+  searchParams: Promise<SearchParamsInput>
+}
+
+function readFirstValue(value: string | string[] | undefined): string | null {
+  if (Array.isArray(value)) {
+    return value[0] ?? null
+  }
+
+  return value ?? null
+}
+
+function readInputString(formData: FormData, field: string): string {
+  const value = formData.get(field)
+  return typeof value === "string" ? value.trim() : ""
+}
+
+function readNullableString(formData: FormData, field: string): string | null {
+  const value = readInputString(formData, field)
+  return value.length > 0 ? value : null
+}
+
+function readNullableInt(formData: FormData, field: string): number | null {
+  const value = readInputString(formData, field)
+
+  if (!value) {
+    return null
+  }
+
+  const parsed = Number.parseInt(value, 10)
+
+  if (!Number.isFinite(parsed)) {
+    return null
+  }
+
+  return parsed
+}
+
+function readTags(formData: FormData): string[] {
+  const raw = readInputString(formData, "tags")
+
+  if (!raw) {
+    return []
+  }
+
+  return raw
+    .split(",")
+    .map((item) => item.trim())
+    .filter((item) => item.length > 0)
+}
+
+function redirectWithState(mediaAssetId: string, params: { notice?: string; error?: string }) {
+  const query = new URLSearchParams()
+
+  if (params.notice) {
+    query.set("notice", params.notice)
+  }
+
+  if (params.error) {
+    query.set("error", params.error)
+  }
+
+  const value = query.toString()
+  redirect(value ? `/media/${mediaAssetId}?${value}` : `/media/${mediaAssetId}`)
+}
+
+function toLocalDateTimeInputValue(date: Date): string {
+  const offset = date.getTimezoneOffset() * 60_000
+  return new Date(date.getTime() - offset).toISOString().slice(0, 16)
+}
+
+export default async function MediaAssetEditorPage({ params, searchParams }: PageProps) {
+  const role = await requirePermissionForRoute({
+    nextPath: "/media",
+    permission: "media:read",
+    scope: "team",
+  })
+  const resolvedParams = await params
+  const mediaAssetId = resolvedParams.id
+
+  const [resolvedSearchParams, asset] = await Promise.all([
+    searchParams,
+    getMediaAssetById(mediaAssetId),
+  ])
+
+  if (!asset) {
+    redirect("/media?error=Media+asset+not+found")
+  }
+  const mediaAsset = asset
+
+  const notice = readFirstValue(resolvedSearchParams.notice)
+  const error = readFirstValue(resolvedSearchParams.error)
+  const previewUrl = mediaAsset.storageKey ? `/api/media/file/${mediaAsset.id}` : null
+  const isImage = Boolean(mediaAsset.mimeType?.startsWith("image/"))
+  const isVideo = Boolean(mediaAsset.mimeType?.startsWith("video/"))
+
+  async function updateMediaAssetAction(formData: FormData) {
+    "use server"
+
+    await requirePermissionForRoute({
+      nextPath: "/media",
+      permission: "media:write",
+      scope: "team",
+    })
+
+    try {
+      await updateMediaAsset({
+        id: mediaAssetId,
+        title: readInputString(formData, "title"),
+        type: readInputString(formData, "type"),
+        description: readNullableString(formData, "description"),
+        altText: readNullableString(formData, "altText"),
+        source: readNullableString(formData, "source"),
+        copyright: readNullableString(formData, "copyright"),
+        author: readNullableString(formData, "author"),
+        tags: readTags(formData),
+        mimeType: readNullableString(formData, "mimeType"),
+        width: readNullableInt(formData, "width"),
+        height: readNullableInt(formData, "height"),
+        sizeBytes: readNullableInt(formData, "sizeBytes"),
+        isPublished: readInputString(formData, "isPublished") === "true",
+      })
+    } catch {
+      redirectWithState(mediaAssetId, {
+        error: "Failed to update media asset. Validate values and try again.",
+      })
+    }
+
+    redirectWithState(mediaAssetId, { notice: "Media asset updated." })
+  }
+
+  async function deleteMediaAssetAction() {
+    "use server"
+
+    await requirePermissionForRoute({
+      nextPath: "/media",
+      permission: "media:write",
+      scope: "team",
+    })
+
+    try {
+      if (mediaAsset.storageKey) {
+        await deleteStoredMediaObject(mediaAsset.storageKey)
+      }
+
+      await deleteMediaAsset(mediaAssetId)
+    } catch {
+      redirectWithState(mediaAssetId, {
+        error:
+          "Failed to delete media asset and file from storage. Check storage config and links.",
+      })
+    }
+
+    redirect("/media?notice=Media+asset+deleted")
+  }
+
+  return (
+    <AdminShell
+      role={role}
+      activePath="/media"
+      badge="Admin App"
+      title="Media Asset"
+      description="View, edit, and delete uploaded media metadata."
+    >
+      {notice ? (
+        <section className="rounded-xl border border-emerald-300 bg-emerald-50 px-4 py-3 text-sm text-emerald-800">
+          {notice}
+        </section>
+      ) : null}
+
+      {error ? (
+        <section className="rounded-xl border border-red-300 bg-red-50 px-4 py-3 text-sm text-red-800">
+          {error}
+        </section>
+      ) : null}
+
+      <section className="rounded-xl border border-neutral-200 p-6">
+        <h3 className="text-lg font-medium">Preview</h3>
+        <p className="mt-1 text-sm text-neutral-600">
+          {mediaAsset.mimeType ? `MIME: ${mediaAsset.mimeType}` : "MIME: unknown"}
+        </p>
+
+        <div className="mt-4 rounded-lg border border-neutral-200 bg-neutral-50 p-3">
+          {!previewUrl ? (
+            <p className="text-sm text-neutral-600">
+              No stored file is linked for this media asset.
+            </p>
+          ) : isImage ? (
+            // biome-ignore lint/performance/noImgElement: Auth-protected media preview requires direct browser request with session cookies.
+            <img
+              src={previewUrl}
+              alt={mediaAsset.altText || mediaAsset.title}
+              className="max-h-[26rem] w-auto rounded border border-neutral-200 bg-white"
+            />
+          ) : isVideo ? (
+            // biome-ignore lint/a11y/useMediaCaption: Preview uses source assets without guaranteed caption tracks.
+            <video
+              src={previewUrl}
+              controls
+              preload="metadata"
+              className="max-h-[26rem] w-full rounded border border-neutral-200 bg-black"
+            />
+          ) : (
+            <p className="text-sm text-neutral-700">
+              Inline preview is not available for this media type.
+            </p>
+          )}
+        </div>
+
+        {previewUrl ? (
+          <a
+            href={previewUrl}
+            target="_blank"
+            rel="noreferrer"
+            className="mt-3 inline-block text-sm text-neutral-700 underline underline-offset-2"
+          >
+            Open raw media file
+          </a>
+        ) : null}
+      </section>
+
+      <section className="rounded-xl border border-neutral-200 p-6">
+        <div className="flex flex-wrap items-center justify-between gap-3">
+          <div>
+            <h2 className="text-xl font-medium">{mediaAsset.title}</h2>
+            <p className="mt-1 text-xs text-neutral-600">ID: {mediaAsset.id}</p>
+          </div>
+          <Link href="/media" className="text-sm text-neutral-700 underline underline-offset-2">
+            Back to media list
+          </Link>
+        </div>
+
+        <form action={updateMediaAssetAction} className="mt-6 space-y-3">
+          <div className="grid gap-3 md:grid-cols-2">
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Title</span>
+              <input
+                name="title"
+                defaultValue={mediaAsset.title}
+                required
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Type</span>
+              <select
+                name="type"
+                defaultValue={mediaAsset.type}
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              >
+                <option value="artwork">artwork</option>
+                <option value="banner">banner</option>
+                <option value="promotion">promotion</option>
+                <option value="video">video</option>
+                <option value="gif">gif</option>
+                <option value="generic">generic</option>
+              </select>
+            </label>
+          </div>
+
+          <label className="space-y-1">
+            <span className="text-xs text-neutral-600">Description</span>
+            <textarea
+              name="description"
+              rows={3}
+              defaultValue={mediaAsset.description ?? ""}
+              className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+          </label>
+
+          <div className="grid gap-3 md:grid-cols-2">
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Alt text</span>
+              <input
+                name="altText"
+                defaultValue={mediaAsset.altText ?? ""}
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Author</span>
+              <input
+                name="author"
+                defaultValue={mediaAsset.author ?? ""}
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+          </div>
+
+          <div className="grid gap-3 md:grid-cols-2">
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Source</span>
+              <input
+                name="source"
+                defaultValue={mediaAsset.source ?? ""}
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Copyright</span>
+              <input
+                name="copyright"
+                defaultValue={mediaAsset.copyright ?? ""}
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+          </div>
+
+          <div className="grid gap-3 md:grid-cols-3">
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">MIME type</span>
+              <input
+                name="mimeType"
+                defaultValue={mediaAsset.mimeType ?? ""}
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Width</span>
+              <input
+                name="width"
+                type="number"
+                min={1}
+                defaultValue={mediaAsset.width ?? ""}
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Height</span>
+              <input
+                name="height"
+                type="number"
+                min={1}
+                defaultValue={mediaAsset.height ?? ""}
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+          </div>
+
+          <div className="grid gap-3 md:grid-cols-2">
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Size (bytes)</span>
+              <input
+                name="sizeBytes"
+                type="number"
+                min={0}
+                defaultValue={mediaAsset.sizeBytes ?? ""}
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Tags (comma-separated)</span>
+              <input
+                name="tags"
+                defaultValue={mediaAsset.tags.join(", ")}
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+          </div>
+
+          <label className="inline-flex items-center gap-2 text-sm text-neutral-700">
+            <input
+              type="checkbox"
+              name="isPublished"
+              value="true"
+              defaultChecked={mediaAsset.isPublished}
+              className="size-4"
+            />
+            Published
+          </label>
+
+          <div className="grid gap-3 md:grid-cols-2">
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Storage key</span>
+              <input
+                value={mediaAsset.storageKey ?? "-"}
+                readOnly
+                className="w-full rounded border border-neutral-200 bg-neutral-50 px-3 py-2 text-xs text-neutral-600"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Last updated</span>
+              <input
+                value={toLocalDateTimeInputValue(mediaAsset.updatedAt)}
+                readOnly
+                className="w-full rounded border border-neutral-200 bg-neutral-50 px-3 py-2 text-xs text-neutral-600"
+              />
+            </label>
+          </div>
+
+          <Button type="submit">Save changes</Button>
+        </form>
+      </section>
+
+      <section className="rounded-xl border border-red-300 bg-red-50 p-6">
+        <h3 className="text-lg font-medium text-red-800">Danger Zone</h3>
+        <p className="mt-1 text-sm text-red-700">
+          Deleting this media asset is permanent. Any linked artwork rendition references will also
+          be removed.
+        </p>
+        <form action={deleteMediaAssetAction} className="mt-4">
+          <Button type="submit" variant="secondary" className="border border-red-300 text-red-800">
+            Delete media asset
+          </Button>
+        </form>
+      </section>
+    </AdminShell>
+  )
+}

apps/admin/src/app/media/page.tsx

@@ -1,15 +1,45 @@
-import { AdminSectionPlaceholder } from "@/components/admin-section-placeholder"
+import { getMediaFoundationSummary, listMediaAssets } from "@cms/db"
+import Link from "next/link"
+
 import { AdminShell } from "@/components/admin-shell"
+import { FlashQueryCleanup } from "@/components/media/flash-query-cleanup"
+import { MediaUploadForm } from "@/components/media/media-upload-form"
+import { resolveMediaStorageProvider } from "@/lib/media/storage"
 import { requirePermissionForRoute } from "@/lib/route-guards"
 
 export const dynamic = "force-dynamic"
 
-export default async function MediaManagementPage() {
+type SearchParamsInput = Record<string, string | string[] | undefined>
+
+function readFirstValue(value: string | string[] | undefined): string | null {
+  if (Array.isArray(value)) {
+    return value[0] ?? null
+  }
+
+  return value ?? null
+}
+
+export default async function MediaManagementPage({
+  searchParams,
+}: {
+  searchParams: Promise<SearchParamsInput>
+}) {
   const role = await requirePermissionForRoute({
     nextPath: "/media",
     permission: "media:read",
     scope: "team",
   })
+  const [resolvedSearchParams, summary, assets] = await Promise.all([
+    searchParams,
+    getMediaFoundationSummary(),
+    listMediaAssets(20),
+  ])
+  const notice = readFirstValue(resolvedSearchParams.notice)
+  const error = readFirstValue(resolvedSearchParams.error)
+  const uploadedVia = readFirstValue(resolvedSearchParams.uploadedVia)
+  const warning = readFirstValue(resolvedSearchParams.warning)
+  const activeStorageProvider = resolveMediaStorageProvider(process.env.CMS_MEDIA_STORAGE_PROVIDER)
+  const hasFlashQuery = Boolean(notice || error || warning || uploadedVia)
 
   return (
     <AdminShell
@@ -17,18 +47,123 @@ export default async function MediaManagementPage() {
       activePath="/media"
       badge="Admin App"
       title="Media"
-      description="Prepare media library and enrichment workflows."
+      description="Media foundation baseline for assets, artwork renditions, and grouping metadata."
     >
-      <AdminSectionPlaceholder
+      <FlashQueryCleanup enabled={hasFlashQuery} />
-        feature="Media Library"
+
-        summary="This route is ready for media browsing, upload, and metadata refinement features."
+      {notice ? (
-        requiredPermission="media:read (team)"
+        <section className="rounded-xl border border-emerald-300 bg-emerald-50 px-4 py-3 text-sm text-emerald-800">
-        nextSteps={[
+          <div className="flex flex-wrap items-center gap-2">
-          "Add media upload and asset listing.",
+            <span>{notice}</span>
-          "Add enrichment fields (alt text, source, tags).",
+            {uploadedVia ? (
-          "Add artwork-specific refinement fields.",
+              <span className="rounded border border-emerald-300 bg-white px-2 py-0.5 text-xs font-medium uppercase tracking-wide text-emerald-700">
-        ]}
+                Stored via: {uploadedVia}
-      />
+              </span>
+            ) : null}
+          </div>
+        </section>
+      ) : null}
+
+      {error ? (
+        <section className="rounded-xl border border-red-300 bg-red-50 px-4 py-3 text-sm text-red-800">
+          {error}
+        </section>
+      ) : null}
+
+      {warning ? (
+        <section className="rounded-xl border border-amber-300 bg-amber-50 px-4 py-3 text-sm text-amber-900">
+          {warning}
+        </section>
+      ) : null}
+
+      <section className="grid gap-3 sm:grid-cols-2 xl:grid-cols-3">
+        <article className="rounded-xl border border-neutral-200 p-4">
+          <p className="text-xs uppercase tracking-[0.2em] text-neutral-500">Media Assets</p>
+          <p className="mt-2 text-3xl font-semibold">{summary.mediaAssets}</p>
+        </article>
+        <article className="rounded-xl border border-neutral-200 p-4">
+          <p className="text-xs uppercase tracking-[0.2em] text-neutral-500">Artworks</p>
+          <p className="mt-2 text-3xl font-semibold">{summary.artworks}</p>
+        </article>
+        <article className="rounded-xl border border-neutral-200 p-4">
+          <p className="text-xs uppercase tracking-[0.2em] text-neutral-500">Groups</p>
+          <p className="mt-2 text-3xl font-semibold">
+            {summary.galleries + summary.albums + summary.categories + summary.tags}
+          </p>
+          <p className="mt-1 text-xs text-neutral-500">
+            {summary.galleries} galleries · {summary.albums} albums · {summary.categories}{" "}
+            categories · {summary.tags} tags
+          </p>
+        </article>
+      </section>
+
+      <section className="rounded-xl border border-neutral-200 p-6">
+        <h2 className="text-xl font-medium">Upload Media Asset</h2>
+        <p className="mt-1 text-sm text-neutral-600">
+          Upload storage provider: <strong>{activeStorageProvider}</strong>. You can switch via
+          `CMS_MEDIA_STORAGE_PROVIDER` (`s3` default, `local` fallback) until the admin settings
+          toggle lands.
+        </p>
+        <MediaUploadForm />
+      </section>
+
+      <section className="rounded-xl border border-neutral-200 p-6">
+        <div className="flex items-center justify-between gap-2">
+          <h2 className="text-xl font-medium">Recent Media Assets</h2>
+          <span className="text-xs uppercase tracking-[0.2em] text-neutral-500">
+            MVP1 Upload Pipeline
+          </span>
+        </div>
+        <div className="mt-4 overflow-x-auto">
+          <table className="min-w-full text-left text-sm">
+            <thead className="text-xs uppercase tracking-wide text-neutral-500">
+              <tr>
+                <th className="py-2 pr-4">Title</th>
+                <th className="py-2 pr-4">Type</th>
+                <th className="py-2 pr-4">MIME</th>
+                <th className="py-2 pr-4">Size</th>
+                <th className="py-2 pr-4">Published</th>
+                <th className="py-2 pr-4">Updated</th>
+                <th className="py-2 pr-4">Actions</th>
+              </tr>
+            </thead>
+            <tbody>
+              {assets.length === 0 ? (
+                <tr>
+                  <td className="py-3 text-neutral-500" colSpan={7}>
+                    No media assets yet. Upload your first asset above.
+                  </td>
+                </tr>
+              ) : (
+                assets.map((asset) => (
+                  <tr key={asset.id} className="border-t border-neutral-200">
+                    <td className="py-3 pr-4">{asset.title}</td>
+                    <td className="py-3 pr-4">{asset.type}</td>
+                    <td className="py-3 pr-4 text-neutral-600">{asset.mimeType ?? "-"}</td>
+                    <td className="py-3 pr-4 text-neutral-600">
+                      {typeof asset.sizeBytes === "number"
+                        ? `${Math.max(1, Math.round(asset.sizeBytes / 1024))} KB`
+                        : "-"}
+                    </td>
+                    <td className="py-3 pr-4">{asset.isPublished ? "yes" : "no"}</td>
+                    <td className="py-3 pr-4 text-neutral-600">
+                      {asset.updatedAt.toLocaleDateString("en-US")}
+                    </td>
+                    <td className="py-3 pr-4">
+                      <Link
+                        href={`/media/${asset.id}`}
+                        className="text-xs font-medium text-neutral-700 underline underline-offset-2"
+                      >
+                        Open
+                      </Link>
+                    </td>
+                  </tr>
+                ))
+              )}
+            </tbody>
+          </table>
+        </div>
+      </section>
     </AdminShell>
   )
 }

apps/admin/src/app/navigation/page.tsx

@@ -0,0 +1,446 @@
+import {
+  createNavigationItem,
+  createNavigationMenu,
+  deleteNavigationItem,
+  listNavigationMenus,
+  listPages,
+  updateNavigationItem,
+} from "@cms/db"
+import { Button } from "@cms/ui/button"
+import { revalidatePath } from "next/cache"
+import { redirect } from "next/navigation"
+
+import { AdminShell } from "@/components/admin-shell"
+import { requirePermissionForRoute } from "@/lib/route-guards"
+
+export const dynamic = "force-dynamic"
+
+type SearchParamsInput = Record<string, string | string[] | undefined>
+
+function readFirstValue(value: string | string[] | undefined): string | null {
+  if (Array.isArray(value)) {
+    return value[0] ?? null
+  }
+
+  return value ?? null
+}
+
+function readInputString(formData: FormData, field: string): string {
+  const value = formData.get(field)
+  return typeof value === "string" ? value.trim() : ""
+}
+
+function readNullableString(formData: FormData, field: string): string | null {
+  const value = readInputString(formData, field)
+  return value.length > 0 ? value : null
+}
+
+function readInt(formData: FormData, field: string, fallback = 0): number {
+  const value = readInputString(formData, field)
+
+  if (!value) {
+    return fallback
+  }
+
+  const parsed = Number.parseInt(value, 10)
+
+  if (!Number.isFinite(parsed)) {
+    return fallback
+  }
+
+  return parsed
+}
+
+function redirectWithState(params: { notice?: string; error?: string }) {
+  const query = new URLSearchParams()
+
+  if (params.notice) {
+    query.set("notice", params.notice)
+  }
+
+  if (params.error) {
+    query.set("error", params.error)
+  }
+
+  const value = query.toString()
+  redirect(value ? `/navigation?${value}` : "/navigation")
+}
+
+async function createMenuAction(formData: FormData) {
+  "use server"
+
+  await requirePermissionForRoute({
+    nextPath: "/navigation",
+    permission: "navigation:write",
+    scope: "team",
+  })
+
+  try {
+    await createNavigationMenu({
+      name: readInputString(formData, "name"),
+      slug: readInputString(formData, "slug"),
+      location: readInputString(formData, "location"),
+      isVisible: readInputString(formData, "isVisible") === "true",
+    })
+  } catch {
+    redirectWithState({ error: "Failed to create navigation menu." })
+  }
+
+  revalidatePath("/navigation")
+  redirectWithState({ notice: "Navigation menu created." })
+}
+
+async function createItemAction(formData: FormData) {
+  "use server"
+
+  await requirePermissionForRoute({
+    nextPath: "/navigation",
+    permission: "navigation:write",
+    scope: "team",
+  })
+
+  try {
+    await createNavigationItem({
+      menuId: readInputString(formData, "menuId"),
+      label: readInputString(formData, "label"),
+      href: readNullableString(formData, "href"),
+      pageId: readNullableString(formData, "pageId"),
+      parentId: readNullableString(formData, "parentId"),
+      sortOrder: readInt(formData, "sortOrder", 0),
+      isVisible: readInputString(formData, "isVisible") === "true",
+    })
+  } catch {
+    redirectWithState({ error: "Failed to create navigation item." })
+  }
+
+  revalidatePath("/navigation")
+  redirectWithState({ notice: "Navigation item created." })
+}
+
+async function updateItemAction(formData: FormData) {
+  "use server"
+
+  await requirePermissionForRoute({
+    nextPath: "/navigation",
+    permission: "navigation:write",
+    scope: "team",
+  })
+
+  try {
+    await updateNavigationItem({
+      id: readInputString(formData, "id"),
+      label: readInputString(formData, "label"),
+      href: readNullableString(formData, "href"),
+      pageId: readNullableString(formData, "pageId"),
+      parentId: readNullableString(formData, "parentId"),
+      sortOrder: readInt(formData, "sortOrder", 0),
+      isVisible: readInputString(formData, "isVisible") === "true",
+    })
+  } catch {
+    redirectWithState({ error: "Failed to update navigation item." })
+  }
+
+  revalidatePath("/navigation")
+  redirectWithState({ notice: "Navigation item updated." })
+}
+
+async function deleteItemAction(formData: FormData) {
+  "use server"
+
+  await requirePermissionForRoute({
+    nextPath: "/navigation",
+    permission: "navigation:write",
+    scope: "team",
+  })
+
+  try {
+    await deleteNavigationItem(readInputString(formData, "id"))
+  } catch {
+    redirectWithState({ error: "Failed to delete navigation item." })
+  }
+
+  revalidatePath("/navigation")
+  redirectWithState({ notice: "Navigation item deleted." })
+}
+
+export default async function NavigationManagementPage({
+  searchParams,
+}: {
+  searchParams: Promise<SearchParamsInput>
+}) {
+  const role = await requirePermissionForRoute({
+    nextPath: "/navigation",
+    permission: "navigation:read",
+    scope: "team",
+  })
+
+  const [resolvedSearchParams, menus, pages] = await Promise.all([
+    searchParams,
+    listNavigationMenus(),
+    listPages(200),
+  ])
+
+  const notice = readFirstValue(resolvedSearchParams.notice)
+  const error = readFirstValue(resolvedSearchParams.error)
+
+  return (
+    <AdminShell
+      role={role}
+      activePath="/navigation"
+      badge="Admin App"
+      title="Navigation"
+      description="Manage menus and navigation entries linked to pages or custom routes."
+    >
+      {notice ? (
+        <section className="rounded-xl border border-emerald-300 bg-emerald-50 px-4 py-3 text-sm text-emerald-800">
+          {notice}
+        </section>
+      ) : null}
+
+      {error ? (
+        <section className="rounded-xl border border-red-300 bg-red-50 px-4 py-3 text-sm text-red-800">
+          {error}
+        </section>
+      ) : null}
+
+      <section className="grid gap-4 lg:grid-cols-2">
+        <article className="rounded-xl border border-neutral-200 p-6">
+          <h2 className="text-xl font-medium">Create Menu</h2>
+          <form action={createMenuAction} className="mt-4 space-y-3">
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Name</span>
+              <input
+                name="name"
+                required
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Slug</span>
+              <input
+                name="slug"
+                required
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Location</span>
+              <input
+                name="location"
+                defaultValue="primary"
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="inline-flex items-center gap-2 text-sm text-neutral-700">
+              <input
+                name="isVisible"
+                type="checkbox"
+                value="true"
+                defaultChecked
+                className="size-4"
+              />
+              Visible
+            </label>
+            <Button type="submit">Create menu</Button>
+          </form>
+        </article>
+
+        <article className="rounded-xl border border-neutral-200 p-6">
+          <h2 className="text-xl font-medium">Create Navigation Item</h2>
+          <form action={createItemAction} className="mt-4 space-y-3">
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Menu</span>
+              <select
+                name="menuId"
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              >
+                {menus.map((menu) => (
+                  <option key={menu.id} value={menu.id}>
+                    {menu.name} ({menu.location})
+                  </option>
+                ))}
+              </select>
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Label</span>
+              <input
+                name="label"
+                required
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <div className="grid gap-3 md:grid-cols-2">
+              <label className="space-y-1">
+                <span className="text-xs text-neutral-600">Custom href</span>
+                <input
+                  name="href"
+                  className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+                />
+              </label>
+              <label className="space-y-1">
+                <span className="text-xs text-neutral-600">Linked page</span>
+                <select
+                  name="pageId"
+                  className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+                >
+                  <option value="">(none)</option>
+                  {pages.map((page) => (
+                    <option key={page.id} value={page.id}>
+                      {page.title} (/{page.slug})
+                    </option>
+                  ))}
+                </select>
+              </label>
+            </div>
+            <div className="grid gap-3 md:grid-cols-2">
+              <label className="space-y-1">
+                <span className="text-xs text-neutral-600">Parent item id</span>
+                <input
+                  name="parentId"
+                  className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+                />
+              </label>
+              <label className="space-y-1">
+                <span className="text-xs text-neutral-600">Sort order</span>
+                <input
+                  name="sortOrder"
+                  defaultValue="0"
+                  type="number"
+                  min={0}
+                  className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+                />
+              </label>
+            </div>
+            <label className="inline-flex items-center gap-2 text-sm text-neutral-700">
+              <input
+                name="isVisible"
+                type="checkbox"
+                value="true"
+                defaultChecked
+                className="size-4"
+              />
+              Visible
+            </label>
+            <Button type="submit">Create item</Button>
+          </form>
+        </article>
+      </section>
+
+      <section className="space-y-4">
+        {menus.length === 0 ? (
+          <article className="rounded-xl border border-neutral-200 p-6 text-sm text-neutral-600">
+            No navigation menus yet.
+          </article>
+        ) : (
+          menus.map((menu) => (
+            <article key={menu.id} className="rounded-xl border border-neutral-200 p-6">
+              <div className="flex flex-wrap items-center justify-between gap-2">
+                <h3 className="text-lg font-medium">
+                  {menu.name} <span className="text-sm text-neutral-500">({menu.location})</span>
+                </h3>
+                <span className="text-xs text-neutral-500">
+                  {menu.isVisible ? "visible" : "hidden"}
+                </span>
+              </div>
+
+              <div className="mt-4 space-y-3">
+                {menu.items.length === 0 ? (
+                  <p className="text-sm text-neutral-600">No items in this menu.</p>
+                ) : (
+                  menu.items.map((item) => (
+                    <form
+                      key={item.id}
+                      action={updateItemAction}
+                      className="rounded-lg border border-neutral-200 p-3"
+                    >
+                      <input type="hidden" name="id" value={item.id} />
+                      <div className="grid gap-3 md:grid-cols-5">
+                        <label className="space-y-1 md:col-span-2">
+                          <span className="text-xs text-neutral-600">Label</span>
+                          <input
+                            name="label"
+                            defaultValue={item.label}
+                            className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+                          />
+                        </label>
+                        <label className="space-y-1 md:col-span-2">
+                          <span className="text-xs text-neutral-600">Href</span>
+                          <input
+                            name="href"
+                            defaultValue={item.href ?? ""}
+                            className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+                          />
+                        </label>
+                        <label className="space-y-1">
+                          <span className="text-xs text-neutral-600">Sort</span>
+                          <input
+                            name="sortOrder"
+                            type="number"
+                            min={0}
+                            defaultValue={item.sortOrder}
+                            className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+                          />
+                        </label>
+                      </div>
+
+                      <div className="mt-3 grid gap-3 md:grid-cols-2">
+                        <label className="space-y-1">
+                          <span className="text-xs text-neutral-600">Linked page</span>
+                          <select
+                            name="pageId"
+                            defaultValue={item.pageId ?? ""}
+                            className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+                          >
+                            <option value="">(none)</option>
+                            {pages.map((page) => (
+                              <option key={page.id} value={page.id}>
+                                {page.title} (/{page.slug})
+                              </option>
+                            ))}
+                          </select>
+                        </label>
+                        <label className="space-y-1">
+                          <span className="text-xs text-neutral-600">Parent id</span>
+                          <input
+                            name="parentId"
+                            defaultValue={item.parentId ?? ""}
+                            className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+                          />
+                        </label>
+                      </div>
+
+                      <div className="mt-3 flex flex-wrap items-center justify-between gap-3">
+                        <label className="inline-flex items-center gap-2 text-sm text-neutral-700">
+                          <input
+                            type="checkbox"
+                            name="isVisible"
+                            value="true"
+                            defaultChecked={item.isVisible}
+                            className="size-4"
+                          />
+                          Visible
+                        </label>
+                        <div className="flex items-center gap-2">
+                          <Button type="submit" size="sm">
+                            Save item
+                          </Button>
+                          <button
+                            type="submit"
+                            formAction={deleteItemAction}
+                            className="rounded-md border border-red-300 px-3 py-2 text-sm text-red-700"
+                          >
+                            Delete
+                          </button>
+                        </div>
+                      </div>
+                    </form>
+                  ))
+                )}
+              </div>
+            </article>
+          ))
+        )}
+      </section>
+    </AdminShell>
+  )
+}

apps/admin/src/app/pages/[id]/page.tsx

@@ -0,0 +1,242 @@
+import { deletePage, getPageById, updatePage } from "@cms/db"
+import { Button } from "@cms/ui/button"
+import Link from "next/link"
+import { redirect } from "next/navigation"
+
+import { AdminShell } from "@/components/admin-shell"
+import { requirePermissionForRoute } from "@/lib/route-guards"
+
+export const dynamic = "force-dynamic"
+
+type SearchParamsInput = Record<string, string | string[] | undefined>
+
+type PageProps = {
+  params: Promise<{ id: string }>
+  searchParams: Promise<SearchParamsInput>
+}
+
+function readFirstValue(value: string | string[] | undefined): string | null {
+  if (Array.isArray(value)) {
+    return value[0] ?? null
+  }
+
+  return value ?? null
+}
+
+function readInputString(formData: FormData, field: string): string {
+  const value = formData.get(field)
+  return typeof value === "string" ? value.trim() : ""
+}
+
+function readNullableString(formData: FormData, field: string): string | null {
+  const value = readInputString(formData, field)
+  return value.length > 0 ? value : null
+}
+
+function redirectWithState(pageId: string, params: { notice?: string; error?: string }) {
+  const query = new URLSearchParams()
+
+  if (params.notice) {
+    query.set("notice", params.notice)
+  }
+
+  if (params.error) {
+    query.set("error", params.error)
+  }
+
+  const value = query.toString()
+  redirect(value ? `/pages/${pageId}?${value}` : `/pages/${pageId}`)
+}
+
+export default async function PageEditorPage({ params, searchParams }: PageProps) {
+  const role = await requirePermissionForRoute({
+    nextPath: "/pages",
+    permission: "pages:read",
+    scope: "team",
+  })
+  const resolvedParams = await params
+  const pageId = resolvedParams.id
+
+  const [resolvedSearchParams, pageRecord] = await Promise.all([searchParams, getPageById(pageId)])
+
+  if (!pageRecord) {
+    redirect("/pages?error=Page+not+found")
+  }
+
+  const page = pageRecord
+  const notice = readFirstValue(resolvedSearchParams.notice)
+  const error = readFirstValue(resolvedSearchParams.error)
+
+  async function updatePageAction(formData: FormData) {
+    "use server"
+
+    await requirePermissionForRoute({
+      nextPath: "/pages",
+      permission: "pages:write",
+      scope: "team",
+    })
+
+    try {
+      await updatePage({
+        id: pageId,
+        title: readInputString(formData, "title"),
+        slug: readInputString(formData, "slug"),
+        status: readInputString(formData, "status"),
+        summary: readNullableString(formData, "summary"),
+        content: readInputString(formData, "content"),
+        seoTitle: readNullableString(formData, "seoTitle"),
+        seoDescription: readNullableString(formData, "seoDescription"),
+      })
+    } catch {
+      redirectWithState(pageId, {
+        error: "Failed to update page. Validate values and try again.",
+      })
+    }
+
+    redirectWithState(pageId, {
+      notice: "Page updated.",
+    })
+  }
+
+  async function deletePageAction() {
+    "use server"
+
+    await requirePermissionForRoute({
+      nextPath: "/pages",
+      permission: "pages:write",
+      scope: "team",
+    })
+
+    try {
+      await deletePage(pageId)
+    } catch {
+      redirectWithState(pageId, {
+        error: "Failed to delete page. Remove linked navigation references first.",
+      })
+    }
+
+    redirect("/pages?notice=Page+deleted")
+  }
+
+  return (
+    <AdminShell
+      role={role}
+      activePath="/pages"
+      badge="Admin App"
+      title="Page Editor"
+      description="Edit page metadata, content, and publication status."
+    >
+      {notice ? (
+        <section className="rounded-xl border border-emerald-300 bg-emerald-50 px-4 py-3 text-sm text-emerald-800">
+          {notice}
+        </section>
+      ) : null}
+
+      {error ? (
+        <section className="rounded-xl border border-red-300 bg-red-50 px-4 py-3 text-sm text-red-800">
+          {error}
+        </section>
+      ) : null}
+
+      <section className="rounded-xl border border-neutral-200 p-6">
+        <div className="flex flex-wrap items-center justify-between gap-3">
+          <div>
+            <h2 className="text-xl font-medium">{page.title}</h2>
+            <p className="mt-1 text-xs text-neutral-600">ID: {page.id}</p>
+          </div>
+          <Link href="/pages" className="text-sm text-neutral-700 underline underline-offset-2">
+            Back to pages
+          </Link>
+        </div>
+
+        <form action={updatePageAction} className="mt-6 space-y-3">
+          <div className="grid gap-3 md:grid-cols-3">
+            <label className="space-y-1 md:col-span-2">
+              <span className="text-xs text-neutral-600">Title</span>
+              <input
+                name="title"
+                defaultValue={page.title}
+                required
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Status</span>
+              <select
+                name="status"
+                defaultValue={page.status}
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              >
+                <option value="draft">draft</option>
+                <option value="published">published</option>
+              </select>
+            </label>
+          </div>
+
+          <label className="space-y-1">
+            <span className="text-xs text-neutral-600">Slug</span>
+            <input
+              name="slug"
+              defaultValue={page.slug}
+              required
+              className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+          </label>
+
+          <label className="space-y-1">
+            <span className="text-xs text-neutral-600">Summary</span>
+            <input
+              name="summary"
+              defaultValue={page.summary ?? ""}
+              className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+          </label>
+
+          <label className="space-y-1">
+            <span className="text-xs text-neutral-600">Content</span>
+            <textarea
+              name="content"
+              rows={10}
+              defaultValue={page.content}
+              required
+              className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+          </label>
+
+          <div className="grid gap-3 md:grid-cols-2">
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">SEO title</span>
+              <input
+                name="seoTitle"
+                defaultValue={page.seoTitle ?? ""}
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">SEO description</span>
+              <input
+                name="seoDescription"
+                defaultValue={page.seoDescription ?? ""}
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+          </div>
+
+          <Button type="submit">Save page</Button>
+        </form>
+      </section>
+
+      <section className="rounded-xl border border-red-300 bg-red-50 p-6">
+        <h3 className="text-lg font-medium text-red-800">Danger Zone</h3>
+        <p className="mt-1 text-sm text-red-700">
+          Deleting this page is permanent and may break linked navigation items.
+        </p>
+        <form action={deletePageAction} className="mt-4">
+          <Button type="submit" variant="secondary" className="border border-red-300 text-red-800">
+            Delete page
+          </Button>
+        </form>
+      </section>
+    </AdminShell>
+  )
+}

apps/admin/src/app/pages/page.tsx

@@ -1,15 +1,92 @@
-import { AdminSectionPlaceholder } from "@/components/admin-section-placeholder"
+import { createPage, listPages } from "@cms/db"
+import { Button } from "@cms/ui/button"
+import { revalidatePath } from "next/cache"
+import Link from "next/link"
+import { redirect } from "next/navigation"
+
 import { AdminShell } from "@/components/admin-shell"
 import { requirePermissionForRoute } from "@/lib/route-guards"
 
 export const dynamic = "force-dynamic"
 
-export default async function PagesManagementPage() {
+type SearchParamsInput = Record<string, string | string[] | undefined>
+
+function readFirstValue(value: string | string[] | undefined): string | null {
+  if (Array.isArray(value)) {
+    return value[0] ?? null
+  }
+
+  return value ?? null
+}
+
+function readInputString(formData: FormData, field: string): string {
+  const value = formData.get(field)
+  return typeof value === "string" ? value.trim() : ""
+}
+
+function readNullableString(formData: FormData, field: string): string | null {
+  const value = readInputString(formData, field)
+  return value.length > 0 ? value : null
+}
+
+function redirectWithState(params: { notice?: string; error?: string }) {
+  const query = new URLSearchParams()
+
+  if (params.notice) {
+    query.set("notice", params.notice)
+  }
+
+  if (params.error) {
+    query.set("error", params.error)
+  }
+
+  const value = query.toString()
+  redirect(value ? `/pages?${value}` : "/pages")
+}
+
+async function createPageAction(formData: FormData) {
+  "use server"
+
+  await requirePermissionForRoute({
+    nextPath: "/pages",
+    permission: "pages:write",
+    scope: "team",
+  })
+
+  try {
+    await createPage({
+      title: readInputString(formData, "title"),
+      slug: readInputString(formData, "slug"),
+      status: readInputString(formData, "status"),
+      summary: readNullableString(formData, "summary"),
+      content: readInputString(formData, "content"),
+      seoTitle: readNullableString(formData, "seoTitle"),
+      seoDescription: readNullableString(formData, "seoDescription"),
+    })
+  } catch {
+    redirectWithState({
+      error: "Failed to create page. Validate slug/title/content and try again.",
+    })
+  }
+
+  revalidatePath("/pages")
+  revalidatePath("/navigation")
+  redirectWithState({ notice: "Page created." })
+}
+
+export default async function PagesManagementPage({
+  searchParams,
+}: {
+  searchParams: Promise<SearchParamsInput>
+}) {
   const role = await requirePermissionForRoute({
     nextPath: "/pages",
     permission: "pages:read",
     scope: "team",
   })
+  const [resolvedSearchParams, pages] = await Promise.all([searchParams, listPages(100)])
+  const notice = readFirstValue(resolvedSearchParams.notice)
+  const error = readFirstValue(resolvedSearchParams.error)
 
   return (
     <AdminShell
@@ -17,18 +94,137 @@ export default async function PagesManagementPage() {
       activePath="/pages"
       badge="Admin App"
       title="Pages"
-      description="Manage page entities and publication workflows."
+      description="Create, update, and manage published page entities."
     >
-      <AdminSectionPlaceholder
+      {notice ? (
-        feature="Page Management"
+        <section className="rounded-xl border border-emerald-300 bg-emerald-50 px-4 py-3 text-sm text-emerald-800">
-        summary="This MVP0 scaffold defines information architecture and access boundaries for future page CRUD."
+          {notice}
-        requiredPermission="pages:read (team)"
+        </section>
-        nextSteps={[
+      ) : null}
-          "Add page entity list and search.",
+
-          "Add create/edit draft flows with validation.",
+      {error ? (
-          "Add publish/unpublish scheduling controls.",
+        <section className="rounded-xl border border-red-300 bg-red-50 px-4 py-3 text-sm text-red-800">
-        ]}
+          {error}
-      />
+        </section>
+      ) : null}
+
+      <section className="rounded-xl border border-neutral-200 p-6">
+        <h2 className="text-xl font-medium">Create Page</h2>
+        <form action={createPageAction} className="mt-4 space-y-3">
+          <div className="grid gap-3 md:grid-cols-3">
+            <label className="space-y-1 md:col-span-2">
+              <span className="text-xs text-neutral-600">Title</span>
+              <input
+                name="title"
+                required
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Status</span>
+              <select
+                name="status"
+                defaultValue="draft"
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              >
+                <option value="draft">draft</option>
+                <option value="published">published</option>
+              </select>
+            </label>
+          </div>
+
+          <label className="space-y-1">
+            <span className="text-xs text-neutral-600">Slug</span>
+            <input
+              name="slug"
+              required
+              className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+          </label>
+
+          <label className="space-y-1">
+            <span className="text-xs text-neutral-600">Summary</span>
+            <input
+              name="summary"
+              className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+          </label>
+
+          <label className="space-y-1">
+            <span className="text-xs text-neutral-600">Content</span>
+            <textarea
+              name="content"
+              rows={6}
+              required
+              className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+          </label>
+
+          <div className="grid gap-3 md:grid-cols-2">
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">SEO title</span>
+              <input
+                name="seoTitle"
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">SEO description</span>
+              <input
+                name="seoDescription"
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+          </div>
+
+          <Button type="submit">Create page</Button>
+        </form>
+      </section>
+
+      <section className="rounded-xl border border-neutral-200 p-6">
+        <h2 className="text-xl font-medium">Pages</h2>
+        <div className="mt-4 overflow-x-auto">
+          <table className="min-w-full text-left text-sm">
+            <thead className="text-xs uppercase tracking-wide text-neutral-500">
+              <tr>
+                <th className="py-2 pr-4">Title</th>
+                <th className="py-2 pr-4">Slug</th>
+                <th className="py-2 pr-4">Status</th>
+                <th className="py-2 pr-4">Updated</th>
+                <th className="py-2 pr-4">Action</th>
+              </tr>
+            </thead>
+            <tbody>
+              {pages.length === 0 ? (
+                <tr>
+                  <td className="py-3 text-neutral-500" colSpan={5}>
+                    No pages yet.
+                  </td>
+                </tr>
+              ) : (
+                pages.map((page) => (
+                  <tr key={page.id} className="border-t border-neutral-200">
+                    <td className="py-3 pr-4">{page.title}</td>
+                    <td className="py-3 pr-4 text-neutral-600">/{page.slug}</td>
+                    <td className="py-3 pr-4">{page.status}</td>
+                    <td className="py-3 pr-4 text-neutral-600">
+                      {page.updatedAt.toLocaleDateString("en-US")}
+                    </td>
+                    <td className="py-3 pr-4">
+                      <Link
+                        href={`/pages/${page.id}`}
+                        className="text-xs font-medium text-neutral-700 underline underline-offset-2"
+                      >
+                        Open
+                      </Link>
+                    </td>
+                  </tr>
+                ))
+              )}
+            </tbody>
+          </table>
+        </div>
+      </section>
     </AdminShell>
   )
 }

apps/admin/src/app/portfolio/page.tsx

@@ -0,0 +1,481 @@
+import {
+  attachArtworkRendition,
+  createAlbum,
+  createArtwork,
+  createCategory,
+  createGallery,
+  createTag,
+  linkArtworkToGrouping,
+  listArtworks,
+  listMediaAssets,
+  listMediaFoundationGroups,
+} from "@cms/db"
+import { Button } from "@cms/ui/button"
+import { revalidatePath } from "next/cache"
+import { redirect } from "next/navigation"
+
+import { AdminShell } from "@/components/admin-shell"
+import { requirePermissionForRoute } from "@/lib/route-guards"
+
+export const dynamic = "force-dynamic"
+
+type SearchParamsInput = Record<string, string | string[] | undefined>
+type GroupType = "gallery" | "album" | "category" | "tag"
+
+function readField(formData: FormData, key: string): string {
+  const value = formData.get(key)
+  return typeof value === "string" ? value.trim() : ""
+}
+
+function readOptionalField(formData: FormData, key: string): string | undefined {
+  const value = readField(formData, key)
+  return value.length > 0 ? value : undefined
+}
+
+function readFirstValue(value: string | string[] | undefined): string | null {
+  if (Array.isArray(value)) {
+    return value[0] ?? null
+  }
+
+  return value ?? null
+}
+
+function slugify(input: string): string {
+  return input
+    .toLowerCase()
+    .trim()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 180)
+}
+
+function redirectWithState(params: { notice?: string; error?: string }) {
+  const query = new URLSearchParams()
+
+  if (params.notice) {
+    query.set("notice", params.notice)
+  }
+
+  if (params.error) {
+    query.set("error", params.error)
+  }
+
+  const value = query.toString()
+  redirect(value ? `/portfolio?${value}` : "/portfolio")
+}
+
+async function requireWritePermission() {
+  await requirePermissionForRoute({
+    nextPath: "/portfolio",
+    permission: "media:write",
+    scope: "team",
+  })
+}
+
+async function createArtworkAction(formData: FormData) {
+  "use server"
+
+  await requireWritePermission()
+
+  const title = readField(formData, "title")
+  const slug = slugify(readField(formData, "slug") || title)
+
+  try {
+    await createArtwork({
+      title,
+      slug,
+      description: readOptionalField(formData, "description"),
+      medium: readOptionalField(formData, "medium"),
+      dimensions: readOptionalField(formData, "dimensions"),
+      framing: readOptionalField(formData, "framing"),
+      availability: readOptionalField(formData, "availability"),
+      year: (() => {
+        const raw = readField(formData, "year")
+        return raw ? Number(raw) : undefined
+      })(),
+    })
+  } catch {
+    redirectWithState({ error: "Failed to create artwork." })
+  }
+
+  revalidatePath("/portfolio")
+  redirectWithState({ notice: "Artwork created." })
+}
+
+async function createGroupAction(formData: FormData) {
+  "use server"
+
+  await requireWritePermission()
+
+  const type = readField(formData, "groupType") as GroupType
+  const name = readField(formData, "name")
+  const slug = slugify(readField(formData, "slug") || name)
+
+  try {
+    if (type === "gallery") {
+      await createGallery({
+        name,
+        slug,
+        description: readOptionalField(formData, "description"),
+      })
+    } else if (type === "album") {
+      await createAlbum({
+        name,
+        slug,
+        description: readOptionalField(formData, "description"),
+      })
+    } else if (type === "category") {
+      await createCategory({
+        name,
+        slug,
+        description: readOptionalField(formData, "description"),
+      })
+    } else {
+      await createTag({
+        name,
+        slug,
+      })
+    }
+  } catch {
+    redirectWithState({ error: "Failed to create grouping entity." })
+  }
+
+  revalidatePath("/portfolio")
+  redirectWithState({ notice: `${type} created.` })
+}
+
+async function linkArtworkGroupAction(formData: FormData) {
+  "use server"
+
+  await requireWritePermission()
+
+  const artworkId = readField(formData, "artworkId")
+  const groupType = readField(formData, "groupType") as GroupType
+  const groupId = readField(formData, "groupId")
+
+  try {
+    await linkArtworkToGrouping({
+      artworkId,
+      groupType,
+      groupId,
+    })
+  } catch {
+    redirectWithState({ error: "Failed to link artwork to grouping." })
+  }
+
+  revalidatePath("/portfolio")
+  redirectWithState({ notice: "Artwork linked to grouping." })
+}
+
+async function attachRenditionAction(formData: FormData) {
+  "use server"
+
+  await requireWritePermission()
+
+  try {
+    await attachArtworkRendition({
+      artworkId: readField(formData, "artworkId"),
+      mediaAssetId: readField(formData, "mediaAssetId"),
+      slot: readField(formData, "slot"),
+      width: (() => {
+        const raw = readField(formData, "width")
+        return raw ? Number(raw) : undefined
+      })(),
+      height: (() => {
+        const raw = readField(formData, "height")
+        return raw ? Number(raw) : undefined
+      })(),
+      isPrimary: readField(formData, "isPrimary") === "true",
+    })
+  } catch {
+    redirectWithState({ error: "Failed to attach artwork rendition." })
+  }
+
+  revalidatePath("/portfolio")
+  redirectWithState({ notice: "Rendition attached." })
+}
+
+export default async function PortfolioPage({
+  searchParams,
+}: {
+  searchParams: Promise<SearchParamsInput>
+}) {
+  const role = await requirePermissionForRoute({
+    nextPath: "/portfolio",
+    permission: "media:read",
+    scope: "team",
+  })
+  const [resolvedSearchParams, artworks, mediaAssets, groups] = await Promise.all([
+    searchParams,
+    listArtworks(30),
+    listMediaAssets(200),
+    listMediaFoundationGroups(),
+  ])
+  const notice = readFirstValue(resolvedSearchParams.notice)
+  const error = readFirstValue(resolvedSearchParams.error)
+
+  return (
+    <AdminShell
+      role={role}
+      activePath="/portfolio"
+      badge="Admin App"
+      title="Portfolio"
+      description="Artwork foundation with rendition slots and grouping relations."
+    >
+      {notice ? (
+        <section className="rounded-xl border border-emerald-300 bg-emerald-50 px-4 py-3 text-sm text-emerald-800">
+          {notice}
+        </section>
+      ) : null}
+
+      {error ? (
+        <section className="rounded-xl border border-red-300 bg-red-50 px-4 py-3 text-sm text-red-800">
+          {error}
+        </section>
+      ) : null}
+
+      <section className="rounded-xl border border-neutral-200 p-6">
+        <h2 className="text-xl font-medium">Create Artwork</h2>
+        <form action={createArtworkAction} className="mt-4 space-y-3">
+          <div className="grid gap-3 md:grid-cols-2">
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Title</span>
+              <input
+                name="title"
+                required
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+            <label className="space-y-1">
+              <span className="text-xs text-neutral-600">Slug (optional)</span>
+              <input
+                name="slug"
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              />
+            </label>
+          </div>
+          <label className="space-y-1">
+            <span className="text-xs text-neutral-600">Description</span>
+            <textarea
+              name="description"
+              rows={3}
+              className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+          </label>
+          <div className="grid gap-3 md:grid-cols-2 xl:grid-cols-4">
+            <input
+              name="medium"
+              placeholder="Medium"
+              className="rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+            <input
+              name="dimensions"
+              placeholder="Dimensions"
+              className="rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+            <input
+              name="year"
+              type="number"
+              placeholder="Year"
+              className="rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+            <input
+              name="framing"
+              placeholder="Framing"
+              className="rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+          </div>
+          <input
+            name="availability"
+            placeholder="Availability"
+            className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+          />
+          <Button type="submit">Create artwork</Button>
+        </form>
+      </section>
+
+      <section className="rounded-xl border border-neutral-200 p-6">
+        <h2 className="text-xl font-medium">Create Group Entity</h2>
+        <form action={createGroupAction} className="mt-4 space-y-3">
+          <div className="grid gap-3 md:grid-cols-3">
+            <select
+              name="groupType"
+              defaultValue="gallery"
+              className="rounded border border-neutral-300 px-3 py-2 text-sm"
+            >
+              <option value="gallery">gallery</option>
+              <option value="album">album</option>
+              <option value="category">category</option>
+              <option value="tag">tag</option>
+            </select>
+            <input
+              name="name"
+              required
+              placeholder="Name"
+              className="rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+            <input
+              name="slug"
+              placeholder="Slug (optional)"
+              className="rounded border border-neutral-300 px-3 py-2 text-sm"
+            />
+          </div>
+          <textarea
+            name="description"
+            rows={2}
+            placeholder="Description (optional)"
+            className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+          />
+          <Button type="submit">Create group</Button>
+        </form>
+      </section>
+
+      <section className="rounded-xl border border-neutral-200 p-6">
+        <h2 className="text-xl font-medium">Link Artwork To Group</h2>
+        <div className="mt-4 grid gap-4 lg:grid-cols-2">
+          {(
+            [
+              { type: "gallery" as const, label: "Gallery", items: groups.galleries },
+              { type: "album" as const, label: "Album", items: groups.albums },
+              { type: "category" as const, label: "Category", items: groups.categories },
+              { type: "tag" as const, label: "Tag", items: groups.tags },
+            ] as const
+          ).map((groupConfig) => (
+            <form
+              key={groupConfig.type}
+              action={linkArtworkGroupAction}
+              className="space-y-3 rounded border border-neutral-200 p-4"
+            >
+              <h3 className="text-sm font-semibold">{groupConfig.label} Link</h3>
+              <input type="hidden" name="groupType" value={groupConfig.type} />
+              <select
+                name="artworkId"
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              >
+                {artworks.map((artwork) => (
+                  <option key={`${groupConfig.type}-${artwork.id}`} value={artwork.id}>
+                    {artwork.title}
+                  </option>
+                ))}
+              </select>
+              <select
+                name="groupId"
+                className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+              >
+                {groupConfig.items.map((group) => (
+                  <option key={`${groupConfig.type}-${group.id}`} value={group.id}>
+                    {group.name}
+                  </option>
+                ))}
+              </select>
+              <Button type="submit">Link artwork</Button>
+            </form>
+          ))}
+        </div>
+      </section>
+
+      <section className="rounded-xl border border-neutral-200 p-6">
+        <h2 className="text-xl font-medium">Attach Artwork Rendition Slot</h2>
+        <form
+          action={attachRenditionAction}
+          className="mt-4 grid gap-3 md:grid-cols-3 xl:grid-cols-6"
+        >
+          <select name="artworkId" className="rounded border border-neutral-300 px-3 py-2 text-sm">
+            {artworks.map((artwork) => (
+              <option key={artwork.id} value={artwork.id}>
+                {artwork.title}
+              </option>
+            ))}
+          </select>
+          <select
+            name="mediaAssetId"
+            className="rounded border border-neutral-300 px-3 py-2 text-sm"
+          >
+            {mediaAssets.map((asset) => (
+              <option key={asset.id} value={asset.id}>
+                {asset.title}
+              </option>
+            ))}
+          </select>
+          <select
+            name="slot"
+            defaultValue="thumbnail"
+            className="rounded border border-neutral-300 px-3 py-2 text-sm"
+          >
+            <option value="thumbnail">thumbnail</option>
+            <option value="card">card</option>
+            <option value="full">full</option>
+            <option value="custom">custom</option>
+          </select>
+          <input
+            name="width"
+            type="number"
+            placeholder="width"
+            className="rounded border border-neutral-300 px-3 py-2 text-sm"
+          />
+          <input
+            name="height"
+            type="number"
+            placeholder="height"
+            className="rounded border border-neutral-300 px-3 py-2 text-sm"
+          />
+          <select
+            name="isPrimary"
+            defaultValue="false"
+            className="rounded border border-neutral-300 px-3 py-2 text-sm"
+          >
+            <option value="false">not primary</option>
+            <option value="true">primary</option>
+          </select>
+          <div className="md:col-span-3 xl:col-span-6">
+            <Button type="submit">Attach rendition</Button>
+          </div>
+        </form>
+      </section>
+
+      <section className="rounded-xl border border-neutral-200 p-6">
+        <div className="flex items-center justify-between gap-2">
+          <h2 className="text-xl font-medium">Artworks</h2>
+          <span className="text-xs uppercase tracking-[0.2em] text-neutral-500">
+            MVP1 Foundation
+          </span>
+        </div>
+        <div className="mt-4 overflow-x-auto">
+          <table className="min-w-full text-left text-sm">
+            <thead className="text-xs uppercase tracking-wide text-neutral-500">
+              <tr>
+                <th className="py-2 pr-4">Title</th>
+                <th className="py-2 pr-4">Slug</th>
+                <th className="py-2 pr-4">Published</th>
+                <th className="py-2 pr-4">Renditions</th>
+                <th className="py-2 pr-4">Groups</th>
+              </tr>
+            </thead>
+            <tbody>
+              {artworks.length === 0 ? (
+                <tr>
+                  <td className="py-3 text-neutral-500" colSpan={5}>
+                    No artworks yet. Add creation flows after media upload pipeline lands.
+                  </td>
+                </tr>
+              ) : (
+                artworks.map((artwork) => (
+                  <tr key={artwork.id} className="border-t border-neutral-200">
+                    <td className="py-3 pr-4">{artwork.title}</td>
+                    <td className="py-3 pr-4 font-mono text-xs">{artwork.slug}</td>
+                    <td className="py-3 pr-4">{artwork.isPublished ? "yes" : "no"}</td>
+                    <td className="py-3 pr-4">{artwork.renditions.length}</td>
+                    <td className="py-3 pr-4 text-neutral-600">
+                      g:{artwork.galleryLinks.length} a:{artwork.albumLinks.length} c:
+                      {artwork.categoryLinks.length} t:{artwork.tagLinks.length}
+                    </td>
+                  </tr>
+                ))
+              )}
+            </tbody>
+          </table>
+        </div>
+      </section>
+    </AdminShell>
+  )
+}

apps/admin/src/components/admin-shell.tsx

@@ -26,7 +26,9 @@ type NavItem = {
 const navItems: NavItem[] = [
   { href: "/", label: "Dashboard", permission: "dashboard:read", scope: "global" },
   { href: "/pages", label: "Pages", permission: "pages:read", scope: "team" },
+  { href: "/navigation", label: "Navigation", permission: "navigation:read", scope: "team" },
   { href: "/media", label: "Media", permission: "media:read", scope: "team" },
+  { href: "/portfolio", label: "Portfolio", permission: "media:read", scope: "team" },
   { href: "/users", label: "Users", permission: "users:read", scope: "own" },
   { href: "/commissions", label: "Commissions", permission: "commissions:read", scope: "own" },
   { href: "/settings", label: "Settings", permission: "users:manage_roles", scope: "global" },

apps/admin/src/components/media/flash-query-cleanup.tsx

@@ -0,0 +1,19 @@
+"use client"
+
+import { useEffect } from "react"
+
+type FlashQueryCleanupProps = {
+  enabled: boolean
+}
+
+export function FlashQueryCleanup({ enabled }: FlashQueryCleanupProps) {
+  useEffect(() => {
+    if (!enabled) {
+      return
+    }
+
+    window.history.replaceState(window.history.state, "", "/media")
+  }, [enabled])
+
+  return null
+}

apps/admin/src/components/media/media-upload-form.tsx

@@ -0,0 +1,167 @@
+"use client"
+
+import { Button } from "@cms/ui/button"
+import { type FormEvent, useState } from "react"
+
+type MediaType = "artwork" | "banner" | "promotion" | "video" | "gif" | "generic"
+
+const ACCEPT_BY_TYPE: Record<MediaType, string> = {
+  artwork: "image/jpeg,image/png,image/webp,image/avif,image/gif",
+  banner: "image/jpeg,image/png,image/webp,image/avif",
+  promotion: "image/jpeg,image/png,image/webp,image/avif,image/gif,video/mp4,video/webm",
+  video: "video/mp4,video/webm,video/quicktime",
+  gif: "image/gif",
+  generic: "image/*,video/*",
+}
+
+export function MediaUploadForm() {
+  const [isSubmitting, setIsSubmitting] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [mediaType, setMediaType] = useState<MediaType>("artwork")
+
+  async function handleSubmit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault()
+    const form = event.currentTarget
+    const formData = new FormData(form)
+
+    setError(null)
+    setIsSubmitting(true)
+
+    try {
+      const response = await fetch("/api/media/upload", {
+        method: "POST",
+        body: formData,
+      })
+
+      if (!response.ok) {
+        const payload = (await response.json().catch(() => null)) as {
+          message?: string
+        } | null
+
+        setError(payload?.message ?? "Upload failed. Please verify file and metadata.")
+        return
+      }
+
+      const payload = (await response.json().catch(() => null)) as {
+        notice?: string
+        provider?: "s3" | "local"
+        warning?: string
+      } | null
+
+      const notice = payload?.notice ?? "Media uploaded."
+      const provider = payload?.provider ?? "local"
+      const warning = payload?.warning
+      const warningQuery = warning ? `&warning=${encodeURIComponent(warning)}` : ""
+      window.location.href = `/media?notice=${encodeURIComponent(notice)}&uploadedVia=${encodeURIComponent(provider)}${warningQuery}`
+    } catch {
+      setError("Upload request failed. Please retry.")
+    } finally {
+      setIsSubmitting(false)
+    }
+  }
+
+  return (
+    <form onSubmit={handleSubmit} className="mt-4 space-y-3">
+      {error ? (
+        <p className="rounded border border-red-300 bg-red-50 px-3 py-2 text-sm text-red-700">
+          {error}
+        </p>
+      ) : null}
+
+      <div className="grid gap-3 md:grid-cols-2">
+        <label className="space-y-1">
+          <span className="text-xs text-neutral-600">Title</span>
+          <input
+            name="title"
+            placeholder="Optional (defaults to file name)"
+            className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+          />
+        </label>
+        <label className="space-y-1">
+          <span className="text-xs text-neutral-600">Type</span>
+          <select
+            name="type"
+            value={mediaType}
+            onChange={(event) => setMediaType(event.target.value as MediaType)}
+            className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+          >
+            <option value="artwork">artwork</option>
+            <option value="banner">banner</option>
+            <option value="promotion">promotion</option>
+            <option value="video">video</option>
+            <option value="gif">gif</option>
+            <option value="generic">generic</option>
+          </select>
+        </label>
+      </div>
+
+      <label className="space-y-1">
+        <span className="text-xs text-neutral-600">File</span>
+        <input
+          name="file"
+          type="file"
+          required
+          accept={ACCEPT_BY_TYPE[mediaType]}
+          className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+        />
+      </label>
+
+      <label className="space-y-1">
+        <span className="text-xs text-neutral-600">Description</span>
+        <textarea
+          name="description"
+          rows={3}
+          className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+        />
+      </label>
+
+      <div className="grid gap-3 md:grid-cols-2">
+        <label className="space-y-1">
+          <span className="text-xs text-neutral-600">Alt text</span>
+          <input
+            name="altText"
+            className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+          />
+        </label>
+        <label className="space-y-1">
+          <span className="text-xs text-neutral-600">Author</span>
+          <input
+            name="author"
+            className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+          />
+        </label>
+      </div>
+
+      <div className="grid gap-3 md:grid-cols-2">
+        <label className="space-y-1">
+          <span className="text-xs text-neutral-600">Source</span>
+          <input
+            name="source"
+            className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+          />
+        </label>
+        <label className="space-y-1">
+          <span className="text-xs text-neutral-600">Copyright</span>
+          <input
+            name="copyright"
+            className="w-full rounded border border-neutral-300 px-3 py-2 text-sm"
+          />
+        </label>
+      </div>
+
+      <label className="space-y-1">
+        <span className="text-xs text-neutral-600">Tags (comma-separated)</span>
+        <input name="tags" className="w-full rounded border border-neutral-300 px-3 py-2 text-sm" />
+      </label>
+
+      <label className="inline-flex items-center gap-2 text-sm text-neutral-700">
+        <input name="isPublished" type="checkbox" value="true" className="size-4" />
+        Publish immediately
+      </label>
+
+      <Button type="submit" disabled={isSubmitting}>
+        {isSubmitting ? "Uploading..." : "Upload media"}
+      </Button>
+    </form>
+  )
+}

apps/admin/src/lib/access.test.ts

@@ -27,10 +27,18 @@ describe("admin route access rules", () => {
       permission: "pages:read",
       scope: "team",
     })
+    expect(getRequiredPermission("/navigation")).toEqual({
+      permission: "navigation:read",
+      scope: "team",
+    })
     expect(getRequiredPermission("/media")).toEqual({
       permission: "media:read",
       scope: "team",
     })
+    expect(getRequiredPermission("/portfolio")).toEqual({
+      permission: "media:read",
+      scope: "team",
+    })
     expect(getRequiredPermission("/users")).toEqual({
       permission: "users:read",
       scope: "own",

apps/admin/src/lib/access.ts

@@ -50,6 +50,13 @@ const guardRules: GuardRule[] = [
       scope: "team",
     },
   },
+  {
+    route: /^\/navigation(?:\/|$)/,
+    requirement: {
+      permission: "navigation:read",
+      scope: "team",
+    },
+  },
   {
     route: /^\/media(?:\/|$)/,
     requirement: {
@@ -57,6 +64,13 @@ const guardRules: GuardRule[] = [
       scope: "team",
     },
   },
+  {
+    route: /^\/portfolio(?:\/|$)/,
+    requirement: {
+      permission: "media:read",
+      scope: "team",
+    },
+  },
   {
     route: /^\/users(?:\/|$)/,
     requirement: {

apps/admin/src/lib/build-info.test.ts

@@ -0,0 +1,29 @@
+import { afterEach, describe, expect, it, vi } from "vitest"
+
+import { getBuildInfo } from "./build-info"
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+})
+
+describe("getBuildInfo (admin)", () => {
+  it("returns fallback values when env is missing", () => {
+    vi.stubEnv("NEXT_PUBLIC_APP_VERSION", "")
+    vi.stubEnv("NEXT_PUBLIC_GIT_SHA", "")
+
+    expect(getBuildInfo()).toEqual({
+      version: "0.0.1-dev",
+      sha: "local",
+    })
+  })
+
+  it("uses env values and truncates git sha", () => {
+    vi.stubEnv("NEXT_PUBLIC_APP_VERSION", "0.2.0")
+    vi.stubEnv("NEXT_PUBLIC_GIT_SHA", "abcdef123456")
+
+    expect(getBuildInfo()).toEqual({
+      version: "0.2.0",
+      sha: "abcdef1",
+    })
+  })
+})

apps/admin/src/lib/media/local-storage.ts

@@ -0,0 +1,66 @@
+import { mkdir, rm, writeFile } from "node:fs/promises"
+import path from "node:path"
+
+import { buildMediaStorageKey } from "@/lib/media/storage-key"
+
+type StoreLocalUploadParams = {
+  file: File
+  tenantId: string
+  assetId: string
+  fileRole: string
+  variant: string
+}
+
+type StoredUpload = {
+  storageKey: string
+}
+
+export function resolveLocalMediaBaseDirectory(): string {
+  const configured = process.env.CMS_MEDIA_LOCAL_STORAGE_DIR?.trim()
+
+  if (configured) {
+    return path.resolve(configured)
+  }
+
+  return path.resolve(process.cwd(), ".data", "media")
+}
+
+export async function storeUploadLocally(params: StoreLocalUploadParams): Promise<StoredUpload> {
+  const storageKey = buildMediaStorageKey({
+    tenantId: params.tenantId,
+    assetId: params.assetId,
+    fileRole: params.fileRole,
+    variant: params.variant,
+    fileName: params.file.name,
+  })
+  const baseDirectory = resolveLocalMediaBaseDirectory()
+  const outputPath = path.join(baseDirectory, storageKey)
+
+  await mkdir(path.dirname(outputPath), { recursive: true })
+
+  const bytes = new Uint8Array(await params.file.arrayBuffer())
+  await writeFile(outputPath, bytes)
+
+  return { storageKey }
+}
+
+export async function deleteLocalStorageObject(storageKey: string): Promise<boolean> {
+  const baseDirectory = resolveLocalMediaBaseDirectory()
+  const outputPath = path.join(baseDirectory, storageKey)
+
+  try {
+    await rm(outputPath)
+    return true
+  } catch (error) {
+    const code =
+      typeof error === "object" && error !== null && "code" in error
+        ? String((error as { code?: unknown }).code)
+        : ""
+
+    if (code === "ENOENT") {
+      return false
+    }
+
+    throw error
+  }
+}

apps/admin/src/lib/media/s3-storage.ts

@@ -0,0 +1,103 @@
+import { DeleteObjectCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3"
+
+import { buildMediaStorageKey } from "@/lib/media/storage-key"
+
+type StoreS3UploadParams = {
+  file: File
+  tenantId: string
+  assetId: string
+  fileRole: string
+  variant: string
+}
+
+type StoredUpload = {
+  storageKey: string
+}
+
+type S3Config = {
+  bucket: string
+  region: string
+  endpoint?: string
+  accessKeyId: string
+  secretAccessKey: string
+  forcePathStyle?: boolean
+}
+
+function parseBoolean(value: string | undefined): boolean {
+  return value?.toLowerCase() === "true"
+}
+
+export function resolveS3Config(): S3Config {
+  const bucket = process.env.CMS_MEDIA_S3_BUCKET?.trim()
+  const region = process.env.CMS_MEDIA_S3_REGION?.trim()
+  const accessKeyId = process.env.CMS_MEDIA_S3_ACCESS_KEY_ID?.trim()
+  const secretAccessKey = process.env.CMS_MEDIA_S3_SECRET_ACCESS_KEY?.trim()
+  const endpoint = process.env.CMS_MEDIA_S3_ENDPOINT?.trim() || undefined
+
+  if (!bucket || !region || !accessKeyId || !secretAccessKey) {
+    throw new Error(
+      "S3 storage selected but required env vars are missing: CMS_MEDIA_S3_BUCKET, CMS_MEDIA_S3_REGION, CMS_MEDIA_S3_ACCESS_KEY_ID, CMS_MEDIA_S3_SECRET_ACCESS_KEY",
+    )
+  }
+
+  return {
+    bucket,
+    region,
+    endpoint,
+    accessKeyId,
+    secretAccessKey,
+    forcePathStyle: parseBoolean(process.env.CMS_MEDIA_S3_FORCE_PATH_STYLE),
+  }
+}
+
+export function createS3Client(config: S3Config): S3Client {
+  return new S3Client({
+    region: config.region,
+    endpoint: config.endpoint,
+    forcePathStyle: config.forcePathStyle,
+    credentials: {
+      accessKeyId: config.accessKeyId,
+      secretAccessKey: config.secretAccessKey,
+    },
+  })
+}
+
+export async function storeUploadToS3(params: StoreS3UploadParams): Promise<StoredUpload> {
+  const config = resolveS3Config()
+  const client = createS3Client(config)
+  const storageKey = buildMediaStorageKey({
+    tenantId: params.tenantId,
+    assetId: params.assetId,
+    fileRole: params.fileRole,
+    variant: params.variant,
+    fileName: params.file.name,
+  })
+  const payload = new Uint8Array(await params.file.arrayBuffer())
+
+  await client.send(
+    new PutObjectCommand({
+      Bucket: config.bucket,
+      Key: storageKey,
+      Body: payload,
+      ContentType: params.file.type || undefined,
+      ContentLength: params.file.size,
+      CacheControl: "public, max-age=31536000, immutable",
+    }),
+  )
+
+  return { storageKey }
+}
+
+export async function deleteS3Object(storageKey: string): Promise<boolean> {
+  const config = resolveS3Config()
+  const client = createS3Client(config)
+
+  await client.send(
+    new DeleteObjectCommand({
+      Bucket: config.bucket,
+      Key: storageKey,
+    }),
+  )
+
+  return true
+}

apps/admin/src/lib/media/storage-key.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest"
+
+import { buildMediaStorageKey } from "@/lib/media/storage-key"
+
+describe("buildMediaStorageKey", () => {
+  it("builds asset-centric key with fileRole and variant", () => {
+    const key = buildMediaStorageKey({
+      tenantId: "default",
+      assetId: "550e8400-e29b-41d4-a716-446655440000",
+      fileRole: "original",
+      variant: "thumb",
+      fileName: "My File.PNG",
+    })
+
+    expect(key).toBe(
+      "tenant/default/asset/550e8400-e29b-41d4-a716-446655440000/original/550e8400-e29b-41d4-a716-446655440000__thumb.png",
+    )
+  })
+})

apps/admin/src/lib/media/storage-key.ts

@@ -0,0 +1,49 @@
+import path from "node:path"
+
+const FALLBACK_EXTENSION = "bin"
+const DEFAULT_VARIANT = "original"
+
+type BuildMediaStorageKeyParams = {
+  tenantId: string
+  assetId: string
+  fileRole: string
+  variant?: string
+  fileName: string
+}
+
+function normalizeSegment(value: string): string {
+  return value
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+}
+
+function extensionFromFilename(fileName: string): string {
+  const extension = path.extname(fileName).slice(1)
+
+  if (!extension) {
+    return FALLBACK_EXTENSION
+  }
+
+  const normalized = normalizeSegment(extension)
+
+  return normalized.length > 0 ? normalized : FALLBACK_EXTENSION
+}
+
+export function buildMediaStorageKey(params: BuildMediaStorageKeyParams): string {
+  const normalizedTenantId = normalizeSegment(params.tenantId) || "default"
+  const normalizedAssetId = normalizeSegment(params.assetId)
+  const normalizedFileRole = normalizeSegment(params.fileRole) || "original"
+  const normalizedVariant = normalizeSegment(params.variant ?? DEFAULT_VARIANT) || DEFAULT_VARIANT
+  const extension = extensionFromFilename(params.fileName)
+  const fileName = `${normalizedAssetId}__${normalizedVariant}.${extension}`
+
+  return [
+    "tenant",
+    normalizedTenantId,
+    "asset",
+    normalizedAssetId,
+    normalizedFileRole,
+    fileName,
+  ].join("/")
+}

apps/admin/src/lib/media/storage.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest"
+
+import { resolveMediaStorageProvider } from "@/lib/media/storage"
+
+describe("resolveMediaStorageProvider", () => {
+  it("defaults to s3 when unset", () => {
+    expect(resolveMediaStorageProvider(undefined)).toBe("s3")
+  })
+
+  it("resolves s3", () => {
+    expect(resolveMediaStorageProvider("s3")).toBe("s3")
+    expect(resolveMediaStorageProvider("S3")).toBe("s3")
+  })
+
+  it("resolves local explicitly", () => {
+    expect(resolveMediaStorageProvider("local")).toBe("local")
+    expect(resolveMediaStorageProvider("LOCAL")).toBe("local")
+  })
+
+  it("falls back to s3 for unknown values", () => {
+    expect(resolveMediaStorageProvider("foo")).toBe("s3")
+  })
+})

apps/admin/src/lib/media/storage.ts

@@ -0,0 +1,149 @@
+import { deleteLocalStorageObject, storeUploadLocally } from "@/lib/media/local-storage"
+import { deleteS3Object, storeUploadToS3 } from "@/lib/media/s3-storage"
+
+export type MediaStorageProvider = "local" | "s3"
+
+type StoreUploadParams = {
+  file: File
+  assetId: string
+  variant: string
+  fileRole: string
+}
+
+type StoredUpload = {
+  storageKey: string
+  provider: MediaStorageProvider
+  fallbackReason?: string
+}
+
+type S3LikeError = {
+  name?: unknown
+  message?: unknown
+  Code?: unknown
+  code?: unknown
+  $metadata?: {
+    httpStatusCode?: unknown
+    requestId?: unknown
+  }
+}
+
+function resolveTenantId(): string {
+  return process.env.CMS_MEDIA_STORAGE_TENANT_ID?.trim() || "default"
+}
+
+function describeS3Error(error: unknown): string {
+  if (!error || typeof error !== "object") {
+    return "Unknown S3 error"
+  }
+
+  const err = error as S3LikeError
+  const details: string[] = []
+
+  if (typeof err.name === "string" && err.name.length > 0) {
+    details.push(`name=${err.name}`)
+  }
+
+  if (typeof err.message === "string" && err.message.length > 0) {
+    details.push(`message=${err.message}`)
+  }
+
+  if (typeof err.Code === "string" && err.Code.length > 0) {
+    details.push(`code=${err.Code}`)
+  } else if (typeof err.code === "string" && err.code.length > 0) {
+    details.push(`code=${err.code}`)
+  }
+
+  const status = err.$metadata?.httpStatusCode
+  if (typeof status === "number") {
+    details.push(`status=${status}`)
+  }
+
+  const requestId = err.$metadata?.requestId
+  if (typeof requestId === "string" && requestId.length > 0) {
+    details.push(`requestId=${requestId}`)
+  }
+
+  return details.length > 0 ? details.join(", ") : "Unknown S3 error"
+}
+
+export function resolveMediaStorageProvider(raw: string | undefined): MediaStorageProvider {
+  if (raw?.toLowerCase() === "local") {
+    return "local"
+  }
+
+  return "s3"
+}
+
+export async function storeUpload(params: StoreUploadParams): Promise<StoredUpload> {
+  const provider = resolveMediaStorageProvider(process.env.CMS_MEDIA_STORAGE_PROVIDER)
+  const tenantId = resolveTenantId()
+
+  if (provider === "s3") {
+    try {
+      const stored = await storeUploadToS3({
+        file: params.file,
+        tenantId,
+        assetId: params.assetId,
+        fileRole: params.fileRole,
+        variant: params.variant,
+      })
+      return {
+        ...stored,
+        provider,
+      }
+    } catch (error) {
+      const detail = describeS3Error(error)
+      const fallbackStored = await storeUploadLocally({
+        file: params.file,
+        tenantId,
+        assetId: params.assetId,
+        fileRole: params.fileRole,
+        variant: params.variant,
+      })
+      return {
+        ...fallbackStored,
+        provider: "local",
+        fallbackReason: `S3 upload failed; file stored locally instead. ${detail}`,
+      }
+    }
+  }
+
+  const stored = await storeUploadLocally({
+    file: params.file,
+    tenantId,
+    assetId: params.assetId,
+    fileRole: params.fileRole,
+    variant: params.variant,
+  })
+
+  return {
+    ...stored,
+    provider,
+  }
+}
+
+export async function deleteStoredMediaObject(storageKey: string): Promise<void> {
+  const preferred = resolveMediaStorageProvider(process.env.CMS_MEDIA_STORAGE_PROVIDER)
+  const deleteOperations =
+    preferred === "s3"
+      ? [() => deleteS3Object(storageKey), () => deleteLocalStorageObject(storageKey)]
+      : [() => deleteLocalStorageObject(storageKey), () => deleteS3Object(storageKey)]
+  const errors: string[] = []
+
+  for (const performDelete of deleteOperations) {
+    try {
+      const deleted = await performDelete()
+
+      if (deleted) {
+        return
+      }
+    } catch (error) {
+      const detail = describeS3Error(error)
+      errors.push(detail)
+    }
+  }
+
+  if (errors.length > 0) {
+    throw new Error(`Storage object deletion failed for key "${storageKey}": ${errors.join(" | ")}`)
+  }
+}

apps/web/src/lib/build-info.test.ts

@@ -0,0 +1,29 @@
+import { afterEach, describe, expect, it, vi } from "vitest"
+
+import { getBuildInfo } from "./build-info"
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+})
+
+describe("getBuildInfo (web)", () => {
+  it("returns fallback values when env is missing", () => {
+    vi.stubEnv("NEXT_PUBLIC_APP_VERSION", "")
+    vi.stubEnv("NEXT_PUBLIC_GIT_SHA", "")
+
+    expect(getBuildInfo()).toEqual({
+      version: "0.0.1-dev",
+      sha: "local",
+    })
+  })
+
+  it("uses env values and truncates git sha", () => {
+    vi.stubEnv("NEXT_PUBLIC_APP_VERSION", "0.2.0")
+    vi.stubEnv("NEXT_PUBLIC_GIT_SHA", "123456789abc")
+
+    expect(getBuildInfo()).toEqual({
+      version: "0.2.0",
+      sha: "1234567",
+    })
+  })
+})

bun.lock

@@ -17,7 +17,7 @@
         "conventional-changelog-cli": "5.0.0",
         "jsdom": "28.0.0",
         "msw": "2.12.9",
-        "turbo": "2.8.3",
+        "turbo": "^2.8.6",
         "typescript": "5.9.3",
         "vite-tsconfig-paths": "6.1.0",
         "vitepress": "1.6.4",
@@ -28,6 +28,7 @@
       "name": "@cms/admin",
       "version": "0.0.1",
       "dependencies": {
+        "@aws-sdk/client-s3": "^3.988.0",
         "@cms/content": "workspace:*",
         "@cms/db": "workspace:*",
         "@cms/i18n": "workspace:*",
@@ -207,6 +208,88 @@
 
     "@asamuzakjp/nwsapi": ["@asamuzakjp/nwsapi@2.3.9", "", {}, "sha512-n8GuYSrI9bF7FFZ/SjhwevlHc8xaVlb/7HmHelnc/PZXBD2ZR49NnN9sMMuDdEGPeeRQ5d0hqlSlEpgCX3Wl0Q=="],
 
+    "@aws-crypto/crc32": ["@aws-crypto/crc32@5.2.0", "", { "dependencies": { "@aws-crypto/util": "^5.2.0", "@aws-sdk/types": "^3.222.0", "tslib": "^2.6.2" } }, "sha512-nLbCWqQNgUiwwtFsen1AdzAtvuLRsQS8rYgMuxCrdKf9kOssamGLuPwyTY9wyYblNr9+1XM8v6zoDTPPSIeANg=="],
+
+    "@aws-crypto/crc32c": ["@aws-crypto/crc32c@5.2.0", "", { "dependencies": { "@aws-crypto/util": "^5.2.0", "@aws-sdk/types": "^3.222.0", "tslib": "^2.6.2" } }, "sha512-+iWb8qaHLYKrNvGRbiYRHSdKRWhto5XlZUEBwDjYNf+ly5SVYG6zEoYIdxvf5R3zyeP16w4PLBn3rH1xc74Rag=="],
+
+    "@aws-crypto/sha1-browser": ["@aws-crypto/sha1-browser@5.2.0", "", { "dependencies": { "@aws-crypto/supports-web-crypto": "^5.2.0", "@aws-crypto/util": "^5.2.0", "@aws-sdk/types": "^3.222.0", "@aws-sdk/util-locate-window": "^3.0.0", "@smithy/util-utf8": "^2.0.0", "tslib": "^2.6.2" } }, "sha512-OH6lveCFfcDjX4dbAvCFSYUjJZjDr/3XJ3xHtjn3Oj5b9RjojQo8npoLeA/bNwkOkrSQ0wgrHzXk4tDRxGKJeg=="],
+
+    "@aws-crypto/sha256-browser": ["@aws-crypto/sha256-browser@5.2.0", "", { "dependencies": { "@aws-crypto/sha256-js": "^5.2.0", "@aws-crypto/supports-web-crypto": "^5.2.0", "@aws-crypto/util": "^5.2.0", "@aws-sdk/types": "^3.222.0", "@aws-sdk/util-locate-window": "^3.0.0", "@smithy/util-utf8": "^2.0.0", "tslib": "^2.6.2" } }, "sha512-AXfN/lGotSQwu6HNcEsIASo7kWXZ5HYWvfOmSNKDsEqC4OashTp8alTmaz+F7TC2L083SFv5RdB+qU3Vs1kZqw=="],
+
+    "@aws-crypto/sha256-js": ["@aws-crypto/sha256-js@5.2.0", "", { "dependencies": { "@aws-crypto/util": "^5.2.0", "@aws-sdk/types": "^3.222.0", "tslib": "^2.6.2" } }, "sha512-FFQQyu7edu4ufvIZ+OadFpHHOt+eSTBaYaki44c+akjg7qZg9oOQeLlk77F6tSYqjDAFClrHJk9tMf0HdVyOvA=="],
+
+    "@aws-crypto/supports-web-crypto": ["@aws-crypto/supports-web-crypto@5.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-iAvUotm021kM33eCdNfwIN//F77/IADDSs58i+MDaOqFrVjZo9bAal0NK7HurRuWLLpF1iLX7gbWrjHjeo+YFg=="],
+
+    "@aws-crypto/util": ["@aws-crypto/util@5.2.0", "", { "dependencies": { "@aws-sdk/types": "^3.222.0", "@smithy/util-utf8": "^2.0.0", "tslib": "^2.6.2" } }, "sha512-4RkU9EsI6ZpBve5fseQlGNUWKMa1RLPQ1dnjnQoe07ldfIzcsGb5hC5W0Dm7u423KWzawlrpbjXBrXCEv9zazQ=="],
+
+    "@aws-sdk/client-s3": ["@aws-sdk/client-s3@3.988.0", "", { "dependencies": { "@aws-crypto/sha1-browser": "5.2.0", "@aws-crypto/sha256-browser": "5.2.0", "@aws-crypto/sha256-js": "5.2.0", "@aws-sdk/core": "^3.973.8", "@aws-sdk/credential-provider-node": "^3.972.7", "@aws-sdk/middleware-bucket-endpoint": "^3.972.3", "@aws-sdk/middleware-expect-continue": "^3.972.3", "@aws-sdk/middleware-flexible-checksums": "^3.972.6", "@aws-sdk/middleware-host-header": "^3.972.3", "@aws-sdk/middleware-location-constraint": "^3.972.3", "@aws-sdk/middleware-logger": "^3.972.3", "@aws-sdk/middleware-recursion-detection": "^3.972.3", "@aws-sdk/middleware-sdk-s3": "^3.972.8", "@aws-sdk/middleware-ssec": "^3.972.3", "@aws-sdk/middleware-user-agent": "^3.972.8", "@aws-sdk/region-config-resolver": "^3.972.3", "@aws-sdk/signature-v4-multi-region": "3.988.0", "@aws-sdk/types": "^3.973.1", "@aws-sdk/util-endpoints": "3.988.0", "@aws-sdk/util-user-agent-browser": "^3.972.3", "@aws-sdk/util-user-agent-node": "^3.972.6", "@smithy/config-resolver": "^4.4.6", "@smithy/core": "^3.23.0", "@smithy/eventstream-serde-browser": "^4.2.8", "@smithy/eventstream-serde-config-resolver": "^4.3.8", "@smithy/eventstream-serde-node": "^4.2.8", "@smithy/fetch-http-handler": "^5.3.9", "@smithy/hash-blob-browser": "^4.2.9", "@smithy/hash-node": "^4.2.8", "@smithy/hash-stream-node": "^4.2.8", "@smithy/invalid-dependency": "^4.2.8", "@smithy/md5-js": "^4.2.8", "@smithy/middleware-content-length": "^4.2.8", "@smithy/middleware-endpoint": "^4.4.14", "@smithy/middleware-retry": "^4.4.31", "@smithy/middleware-serde": "^4.2.9", "@smithy/middleware-stack": "^4.2.8", "@smithy/node-config-provider": "^4.3.8", "@smithy/node-http-handler": "^4.4.10", "@smithy/protocol-http": "^5.3.8", "@smithy/smithy-client": "^4.11.3", "@smithy/types": "^4.12.0", "@smithy/url-parser": "^4.2.8", "@smithy/util-base64": "^4.3.0", "@smithy/util-body-length-browser": "^4.2.0", "@smithy/util-body-length-node": "^4.2.1", "@smithy/util-defaults-mode-browser": "^4.3.30", "@smithy/util-defaults-mode-node": "^4.2.33", "@smithy/util-endpoints": "^3.2.8", "@smithy/util-middleware": "^4.2.8", "@smithy/util-retry": "^4.2.8", "@smithy/util-stream": "^4.5.12", "@smithy/util-utf8": "^4.2.0", "@smithy/util-waiter": "^4.2.8", "tslib": "^2.6.2" } }, "sha512-mt7AdkieJJ5hEKeCxH4sdTTd679shUjo/cUvNY0fUHgQIPZa1jRuekTXnRytRrEwdrZWJDx56n1S8ism2uX7jg=="],
+
+    "@aws-sdk/client-sso": ["@aws-sdk/client-sso@3.988.0", "", { "dependencies": { "@aws-crypto/sha256-browser": "5.2.0", "@aws-crypto/sha256-js": "5.2.0", "@aws-sdk/core": "^3.973.8", "@aws-sdk/middleware-host-header": "^3.972.3", "@aws-sdk/middleware-logger": "^3.972.3", "@aws-sdk/middleware-recursion-detection": "^3.972.3", "@aws-sdk/middleware-user-agent": "^3.972.8", "@aws-sdk/region-config-resolver": "^3.972.3", "@aws-sdk/types": "^3.973.1", "@aws-sdk/util-endpoints": "3.988.0", "@aws-sdk/util-user-agent-browser": "^3.972.3", "@aws-sdk/util-user-agent-node": "^3.972.6", "@smithy/config-resolver": "^4.4.6", "@smithy/core": "^3.23.0", "@smithy/fetch-http-handler": "^5.3.9", "@smithy/hash-node": "^4.2.8", "@smithy/invalid-dependency": "^4.2.8", "@smithy/middleware-content-length": "^4.2.8", "@smithy/middleware-endpoint": "^4.4.14", "@smithy/middleware-retry": "^4.4.31", "@smithy/middleware-serde": "^4.2.9", "@smithy/middleware-stack": "^4.2.8", "@smithy/node-config-provider": "^4.3.8", "@smithy/node-http-handler": "^4.4.10", "@smithy/protocol-http": "^5.3.8", "@smithy/smithy-client": "^4.11.3", "@smithy/types": "^4.12.0", "@smithy/url-parser": "^4.2.8", "@smithy/util-base64": "^4.3.0", "@smithy/util-body-length-browser": "^4.2.0", "@smithy/util-body-length-node": "^4.2.1", "@smithy/util-defaults-mode-browser": "^4.3.30", "@smithy/util-defaults-mode-node": "^4.2.33", "@smithy/util-endpoints": "^3.2.8", "@smithy/util-middleware": "^4.2.8", "@smithy/util-retry": "^4.2.8", "@smithy/util-utf8": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-ThqQ7aF1k0Zz4yJRwegHw+T1rM3a7ZPvvEUSEdvn5Z8zTeWgJAbtqW/6ejPsMLmFOlHgNcwDQN/e69OvtEOoIQ=="],
+
+    "@aws-sdk/core": ["@aws-sdk/core@3.973.8", "", { "dependencies": { "@aws-sdk/types": "^3.973.1", "@aws-sdk/xml-builder": "^3.972.4", "@smithy/core": "^3.23.0", "@smithy/node-config-provider": "^4.3.8", "@smithy/property-provider": "^4.2.8", "@smithy/protocol-http": "^5.3.8", "@smithy/signature-v4": "^5.3.8", "@smithy/smithy-client": "^4.11.3", "@smithy/types": "^4.12.0", "@smithy/util-base64": "^4.3.0", "@smithy/util-middleware": "^4.2.8", "@smithy/util-utf8": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-WeYJ2sfvRLbbUIrjGMUXcEHGu5SJk53jz3K9F8vFP42zWyROzPJ2NB6lMu9vWl5hnMwzwabX7pJc9Euh3JyMGw=="],
+
+    "@aws-sdk/crc64-nvme": ["@aws-sdk/crc64-nvme@3.972.0", "", { "dependencies": { "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-ThlLhTqX68jvoIVv+pryOdb5coP1cX1/MaTbB9xkGDCbWbsqQcLqzPxuSoW1DCnAAIacmXCWpzUNOB9pv+xXQw=="],
+
+    "@aws-sdk/credential-provider-env": ["@aws-sdk/credential-provider-env@3.972.6", "", { "dependencies": { "@aws-sdk/core": "^3.973.8", "@aws-sdk/types": "^3.973.1", "@smithy/property-provider": "^4.2.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-+dYEBWgTqkQQHFUllvBL8SLyXyLKWdxLMD1LmKJRvmb0NMJuaJFG/qg78C+LE67eeGbipYcE+gJ48VlLBGHlMw=="],
+
+    "@aws-sdk/credential-provider-http": ["@aws-sdk/credential-provider-http@3.972.8", "", { "dependencies": { "@aws-sdk/core": "^3.973.8", "@aws-sdk/types": "^3.973.1", "@smithy/fetch-http-handler": "^5.3.9", "@smithy/node-http-handler": "^4.4.10", "@smithy/property-provider": "^4.2.8", "@smithy/protocol-http": "^5.3.8", "@smithy/smithy-client": "^4.11.3", "@smithy/types": "^4.12.0", "@smithy/util-stream": "^4.5.12", "tslib": "^2.6.2" } }, "sha512-z3QkozMV8kOFisN2pgRag/f0zPDrw96mY+ejAM0xssV/+YQ2kklbylRNI/TcTQUDnGg0yPxNjyV6F2EM2zPTwg=="],
+
+    "@aws-sdk/credential-provider-ini": ["@aws-sdk/credential-provider-ini@3.972.6", "", { "dependencies": { "@aws-sdk/core": "^3.973.8", "@aws-sdk/credential-provider-env": "^3.972.6", "@aws-sdk/credential-provider-http": "^3.972.8", "@aws-sdk/credential-provider-login": "^3.972.6", "@aws-sdk/credential-provider-process": "^3.972.6", "@aws-sdk/credential-provider-sso": "^3.972.6", "@aws-sdk/credential-provider-web-identity": "^3.972.6", "@aws-sdk/nested-clients": "3.988.0", "@aws-sdk/types": "^3.973.1", "@smithy/credential-provider-imds": "^4.2.8", "@smithy/property-provider": "^4.2.8", "@smithy/shared-ini-file-loader": "^4.4.3", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-6tkIYFv3sZH1XsjQq+veOmx8XWRnyqTZ5zx/sMtdu/xFRIzrJM1Y2wAXeCJL1rhYSB7uJSZ1PgALI2WVTj78ow=="],
+
+    "@aws-sdk/credential-provider-login": ["@aws-sdk/credential-provider-login@3.972.6", "", { "dependencies": { "@aws-sdk/core": "^3.973.8", "@aws-sdk/nested-clients": "3.988.0", "@aws-sdk/types": "^3.973.1", "@smithy/property-provider": "^4.2.8", "@smithy/protocol-http": "^5.3.8", "@smithy/shared-ini-file-loader": "^4.4.3", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-LXsoBoaTSGHdRCQXlWSA0CHHh05KWncb592h9ElklnPus++8kYn1Ic6acBR4LKFQ0RjjMVgwe5ypUpmTSUOjPA=="],
+
+    "@aws-sdk/credential-provider-node": ["@aws-sdk/credential-provider-node@3.972.7", "", { "dependencies": { "@aws-sdk/credential-provider-env": "^3.972.6", "@aws-sdk/credential-provider-http": "^3.972.8", "@aws-sdk/credential-provider-ini": "^3.972.6", "@aws-sdk/credential-provider-process": "^3.972.6", "@aws-sdk/credential-provider-sso": "^3.972.6", "@aws-sdk/credential-provider-web-identity": "^3.972.6", "@aws-sdk/types": "^3.973.1", "@smithy/credential-provider-imds": "^4.2.8", "@smithy/property-provider": "^4.2.8", "@smithy/shared-ini-file-loader": "^4.4.3", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-PuJ1IkISG7ZDpBFYpGotaay6dYtmriBYuHJ/Oko4VHxh8YN5vfoWnMNYFEWuzOfyLmP7o9kDVW0BlYIpb3skvw=="],
+
+    "@aws-sdk/credential-provider-process": ["@aws-sdk/credential-provider-process@3.972.6", "", { "dependencies": { "@aws-sdk/core": "^3.973.8", "@aws-sdk/types": "^3.973.1", "@smithy/property-provider": "^4.2.8", "@smithy/shared-ini-file-loader": "^4.4.3", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-Yf34cjIZJHVnD92jnVYy3tNjM+Q4WJtffLK2Ehn0nKpZfqd1m7SI0ra22Lym4C53ED76oZENVSS2wimoXJtChQ=="],
+
+    "@aws-sdk/credential-provider-sso": ["@aws-sdk/credential-provider-sso@3.972.6", "", { "dependencies": { "@aws-sdk/client-sso": "3.988.0", "@aws-sdk/core": "^3.973.8", "@aws-sdk/token-providers": "3.988.0", "@aws-sdk/types": "^3.973.1", "@smithy/property-provider": "^4.2.8", "@smithy/shared-ini-file-loader": "^4.4.3", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-2+5UVwUYdD4BBOkLpKJ11MQ8wQeyJGDVMDRH5eWOULAh9d6HJq07R69M/mNNMC9NTjr3mB1T0KGDn4qyQh5jzg=="],
+
+    "@aws-sdk/credential-provider-web-identity": ["@aws-sdk/credential-provider-web-identity@3.972.6", "", { "dependencies": { "@aws-sdk/core": "^3.973.8", "@aws-sdk/nested-clients": "3.988.0", "@aws-sdk/types": "^3.973.1", "@smithy/property-provider": "^4.2.8", "@smithy/shared-ini-file-loader": "^4.4.3", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-pdJzwKtlDxBnvZ04pWMqttijmkUIlwOsS0GcxCjzEVyUMpARysl0S0ks74+gs2Pdev3Ujz+BTAjOc1tQgAxGqA=="],
+
+    "@aws-sdk/middleware-bucket-endpoint": ["@aws-sdk/middleware-bucket-endpoint@3.972.3", "", { "dependencies": { "@aws-sdk/types": "^3.973.1", "@aws-sdk/util-arn-parser": "^3.972.2", "@smithy/node-config-provider": "^4.3.8", "@smithy/protocol-http": "^5.3.8", "@smithy/types": "^4.12.0", "@smithy/util-config-provider": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-fmbgWYirF67YF1GfD7cg5N6HHQ96EyRNx/rDIrTF277/zTWVuPI2qS/ZHgofwR1NZPe/NWvoppflQY01LrbVLg=="],
+
+    "@aws-sdk/middleware-expect-continue": ["@aws-sdk/middleware-expect-continue@3.972.3", "", { "dependencies": { "@aws-sdk/types": "^3.973.1", "@smithy/protocol-http": "^5.3.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-4msC33RZsXQpUKR5QR4HnvBSNCPLGHmB55oDiROqqgyOc+TOfVu2xgi5goA7ms6MdZLeEh2905UfWMnMMF4mRg=="],
+
+    "@aws-sdk/middleware-flexible-checksums": ["@aws-sdk/middleware-flexible-checksums@3.972.6", "", { "dependencies": { "@aws-crypto/crc32": "5.2.0", "@aws-crypto/crc32c": "5.2.0", "@aws-crypto/util": "5.2.0", "@aws-sdk/core": "^3.973.8", "@aws-sdk/crc64-nvme": "3.972.0", "@aws-sdk/types": "^3.973.1", "@smithy/is-array-buffer": "^4.2.0", "@smithy/node-config-provider": "^4.3.8", "@smithy/protocol-http": "^5.3.8", "@smithy/types": "^4.12.0", "@smithy/util-middleware": "^4.2.8", "@smithy/util-stream": "^4.5.12", "@smithy/util-utf8": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-g5DadWO58IgQKuq+uLL3pLohOwLiA67gB49xj8694BW+LpHLNu/tjCqwLfIaWvZyABbv0LXeNiiTuTnjdgkZWw=="],
+
+    "@aws-sdk/middleware-host-header": ["@aws-sdk/middleware-host-header@3.972.3", "", { "dependencies": { "@aws-sdk/types": "^3.973.1", "@smithy/protocol-http": "^5.3.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-aknPTb2M+G3s+0qLCx4Li/qGZH8IIYjugHMv15JTYMe6mgZO8VBpYgeGYsNMGCqCZOcWzuf900jFBG5bopfzmA=="],
+
+    "@aws-sdk/middleware-location-constraint": ["@aws-sdk/middleware-location-constraint@3.972.3", "", { "dependencies": { "@aws-sdk/types": "^3.973.1", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-nIg64CVrsXp67vbK0U1/Is8rik3huS3QkRHn2DRDx4NldrEFMgdkZGI/+cZMKD9k4YOS110Dfu21KZLHrFA/1g=="],
+
+    "@aws-sdk/middleware-logger": ["@aws-sdk/middleware-logger@3.972.3", "", { "dependencies": { "@aws-sdk/types": "^3.973.1", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-Ftg09xNNRqaz9QNzlfdQWfpqMCJbsQdnZVJP55jfhbKi1+FTWxGuvfPoBhDHIovqWKjqbuiew3HuhxbJ0+OjgA=="],
+
+    "@aws-sdk/middleware-recursion-detection": ["@aws-sdk/middleware-recursion-detection@3.972.3", "", { "dependencies": { "@aws-sdk/types": "^3.973.1", "@aws/lambda-invoke-store": "^0.2.2", "@smithy/protocol-http": "^5.3.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-PY57QhzNuXHnwbJgbWYTrqIDHYSeOlhfYERTAuc16LKZpTZRJUjzBFokp9hF7u1fuGeE3D70ERXzdbMBOqQz7Q=="],
+
+    "@aws-sdk/middleware-sdk-s3": ["@aws-sdk/middleware-sdk-s3@3.972.8", "", { "dependencies": { "@aws-sdk/core": "^3.973.8", "@aws-sdk/types": "^3.973.1", "@aws-sdk/util-arn-parser": "^3.972.2", "@smithy/core": "^3.23.0", "@smithy/node-config-provider": "^4.3.8", "@smithy/protocol-http": "^5.3.8", "@smithy/signature-v4": "^5.3.8", "@smithy/smithy-client": "^4.11.3", "@smithy/types": "^4.12.0", "@smithy/util-config-provider": "^4.2.0", "@smithy/util-middleware": "^4.2.8", "@smithy/util-stream": "^4.5.12", "@smithy/util-utf8": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-/yJdahpN/q3Dc88qXBTQVZfnXryLnxfCoP4hGClbKjuF0VCMxrz3il7sj0GhIkEQt5OM5+lA88XrvbjjuwSxIg=="],
+
+    "@aws-sdk/middleware-ssec": ["@aws-sdk/middleware-ssec@3.972.3", "", { "dependencies": { "@aws-sdk/types": "^3.973.1", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-dU6kDuULN3o3jEHcjm0c4zWJlY1zWVkjG9NPe9qxYLLpcbdj5kRYBS2DdWYD+1B9f910DezRuws7xDEqKkHQIg=="],
+
+    "@aws-sdk/middleware-user-agent": ["@aws-sdk/middleware-user-agent@3.972.8", "", { "dependencies": { "@aws-sdk/core": "^3.973.8", "@aws-sdk/types": "^3.973.1", "@aws-sdk/util-endpoints": "3.988.0", "@smithy/core": "^3.23.0", "@smithy/protocol-http": "^5.3.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-3PGL+Kvh1PhB0EeJeqNqOWQgipdqFheO4OUKc6aYiFwEpM5t9AyE5hjjxZ5X6iSj8JiduWFZLPwASzF6wQRgFg=="],
+
+    "@aws-sdk/nested-clients": ["@aws-sdk/nested-clients@3.988.0", "", { "dependencies": { "@aws-crypto/sha256-browser": "5.2.0", "@aws-crypto/sha256-js": "5.2.0", "@aws-sdk/core": "^3.973.8", "@aws-sdk/middleware-host-header": "^3.972.3", "@aws-sdk/middleware-logger": "^3.972.3", "@aws-sdk/middleware-recursion-detection": "^3.972.3", "@aws-sdk/middleware-user-agent": "^3.972.8", "@aws-sdk/region-config-resolver": "^3.972.3", "@aws-sdk/types": "^3.973.1", "@aws-sdk/util-endpoints": "3.988.0", "@aws-sdk/util-user-agent-browser": "^3.972.3", "@aws-sdk/util-user-agent-node": "^3.972.6", "@smithy/config-resolver": "^4.4.6", "@smithy/core": "^3.23.0", "@smithy/fetch-http-handler": "^5.3.9", "@smithy/hash-node": "^4.2.8", "@smithy/invalid-dependency": "^4.2.8", "@smithy/middleware-content-length": "^4.2.8", "@smithy/middleware-endpoint": "^4.4.14", "@smithy/middleware-retry": "^4.4.31", "@smithy/middleware-serde": "^4.2.9", "@smithy/middleware-stack": "^4.2.8", "@smithy/node-config-provider": "^4.3.8", "@smithy/node-http-handler": "^4.4.10", "@smithy/protocol-http": "^5.3.8", "@smithy/smithy-client": "^4.11.3", "@smithy/types": "^4.12.0", "@smithy/url-parser": "^4.2.8", "@smithy/util-base64": "^4.3.0", "@smithy/util-body-length-browser": "^4.2.0", "@smithy/util-body-length-node": "^4.2.1", "@smithy/util-defaults-mode-browser": "^4.3.30", "@smithy/util-defaults-mode-node": "^4.2.33", "@smithy/util-endpoints": "^3.2.8", "@smithy/util-middleware": "^4.2.8", "@smithy/util-retry": "^4.2.8", "@smithy/util-utf8": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-OgYV9k1oBCQ6dOM+wWAMNNehXA8L4iwr7ydFV+JDHyuuu0Ko7tDXnLEtEmeQGYRcAFU3MGasmlBkMB8vf4POrg=="],
+
+    "@aws-sdk/region-config-resolver": ["@aws-sdk/region-config-resolver@3.972.3", "", { "dependencies": { "@aws-sdk/types": "^3.973.1", "@smithy/config-resolver": "^4.4.6", "@smithy/node-config-provider": "^4.3.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-v4J8qYAWfOMcZ4MJUyatntOicTzEMaU7j3OpkRCGGFSL2NgXQ5VbxauIyORA+pxdKZ0qQG2tCQjQjZDlXEC3Ow=="],
+
+    "@aws-sdk/signature-v4-multi-region": ["@aws-sdk/signature-v4-multi-region@3.988.0", "", { "dependencies": { "@aws-sdk/middleware-sdk-s3": "^3.972.8", "@aws-sdk/types": "^3.973.1", "@smithy/protocol-http": "^5.3.8", "@smithy/signature-v4": "^5.3.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-SXwhbe2v0Jno7QLIBmZWAL2eVzGmXkfLLy0WkM6ZJVhE0SFUcnymDwMUA1oMDUvyArzvKBiU8khQ2ImheCKOHQ=="],
+
+    "@aws-sdk/token-providers": ["@aws-sdk/token-providers@3.988.0", "", { "dependencies": { "@aws-sdk/core": "^3.973.8", "@aws-sdk/nested-clients": "3.988.0", "@aws-sdk/types": "^3.973.1", "@smithy/property-provider": "^4.2.8", "@smithy/shared-ini-file-loader": "^4.4.3", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-xvXVlRVKHnF2h6fgWBm64aPP5J+58aJyGfRrQa/uFh8a9mcK68mLfJOYq+ZSxQy/UN3McafJ2ILAy7IWzT9kRw=="],
+
+    "@aws-sdk/types": ["@aws-sdk/types@3.973.1", "", { "dependencies": { "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-DwHBiMNOB468JiX6+i34c+THsKHErYUdNQ3HexeXZvVn4zouLjgaS4FejiGSi2HyBuzuyHg7SuOPmjSvoU9NRg=="],
+
+    "@aws-sdk/util-arn-parser": ["@aws-sdk/util-arn-parser@3.972.2", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-VkykWbqMjlSgBFDyrY3nOSqupMc6ivXuGmvci6Q3NnLq5kC+mKQe2QBZ4nrWRE/jqOxeFP2uYzLtwncYYcvQDg=="],
+
+    "@aws-sdk/util-endpoints": ["@aws-sdk/util-endpoints@3.988.0", "", { "dependencies": { "@aws-sdk/types": "^3.973.1", "@smithy/types": "^4.12.0", "@smithy/url-parser": "^4.2.8", "@smithy/util-endpoints": "^3.2.8", "tslib": "^2.6.2" } }, "sha512-HuXu4boeUWU0DQiLslbgdvuQ4ZMCo4Lsk97w8BIUokql2o9MvjE5dwqI5pzGt0K7afO1FybjidUQVTMLuZNTOA=="],
+
+    "@aws-sdk/util-locate-window": ["@aws-sdk/util-locate-window@3.965.4", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-H1onv5SkgPBK2P6JR2MjGgbOnttoNzSPIRoeZTNPZYyaplwGg50zS3amXvXqF0/qfXpWEC9rLWU564QTB9bSog=="],
+
+    "@aws-sdk/util-user-agent-browser": ["@aws-sdk/util-user-agent-browser@3.972.3", "", { "dependencies": { "@aws-sdk/types": "^3.973.1", "@smithy/types": "^4.12.0", "bowser": "^2.11.0", "tslib": "^2.6.2" } }, "sha512-JurOwkRUcXD/5MTDBcqdyQ9eVedtAsZgw5rBwktsPTN7QtPiS2Ld1jkJepNgYoCufz1Wcut9iup7GJDoIHp8Fw=="],
+
+    "@aws-sdk/util-user-agent-node": ["@aws-sdk/util-user-agent-node@3.972.6", "", { "dependencies": { "@aws-sdk/middleware-user-agent": "^3.972.8", "@aws-sdk/types": "^3.973.1", "@smithy/node-config-provider": "^4.3.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" }, "peerDependencies": { "aws-crt": ">=1.0.0" }, "optionalPeers": ["aws-crt"] }, "sha512-966xH8TPqkqOXP7EwnEThcKKz0SNP9kVJBKd9M8bNXE4GSqVouMKKnFBwYnzbWVKuLXubzX5seokcX4a0JLJIA=="],
+
+    "@aws-sdk/xml-builder": ["@aws-sdk/xml-builder@3.972.4", "", { "dependencies": { "@smithy/types": "^4.12.0", "fast-xml-parser": "5.3.4", "tslib": "^2.6.2" } }, "sha512-0zJ05ANfYqI6+rGqj8samZBFod0dPPousBjLEqg8WdxSgbMAkRgLyn81lP215Do0rFJ/17LIXwr7q0yK24mP6Q=="],
+
+    "@aws/lambda-invoke-store": ["@aws/lambda-invoke-store@0.2.3", "", {}, "sha512-oLvsaPMTBejkkmHhjf09xTgk71mOqyr/409NKhRIL08If7AhVfUsJhVsx386uJaqNd42v9kWamQ9lFbkoC2dYw=="],
+
     "@babel/code-frame": ["@babel/code-frame@7.29.0", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.28.5", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw=="],
 
     "@babel/compat-data": ["@babel/compat-data@7.29.0", "", {}, "sha512-T1NCJqT/j9+cn8fvkt7jtwbLBfLC/1y1c7NtCeXFRgzGTsafi68MRv8yzkYSapBnFA6L3U2VSc02ciDzoAJhJg=="],
@@ -633,6 +716,108 @@
 
     "@shikijs/vscode-textmate": ["@shikijs/vscode-textmate@10.0.2", "", {}, "sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg=="],
 
+    "@smithy/abort-controller": ["@smithy/abort-controller@4.2.8", "", { "dependencies": { "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-peuVfkYHAmS5ybKxWcfraK7WBBP0J+rkfUcbHJJKQ4ir3UAUNQI+Y4Vt/PqSzGqgloJ5O1dk7+WzNL8wcCSXbw=="],
+
+    "@smithy/chunked-blob-reader": ["@smithy/chunked-blob-reader@5.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-WmU0TnhEAJLWvfSeMxBNe5xtbselEO8+4wG0NtZeL8oR21WgH1xiO37El+/Y+H/Ie4SCwBy3MxYWmOYaGgZueA=="],
+
+    "@smithy/chunked-blob-reader-native": ["@smithy/chunked-blob-reader-native@4.2.1", "", { "dependencies": { "@smithy/util-base64": "^4.3.0", "tslib": "^2.6.2" } }, "sha512-lX9Ay+6LisTfpLid2zZtIhSEjHMZoAR5hHCR4H7tBz/Zkfr5ea8RcQ7Tk4mi0P76p4cN+Btz16Ffno7YHpKXnQ=="],
+
+    "@smithy/config-resolver": ["@smithy/config-resolver@4.4.6", "", { "dependencies": { "@smithy/node-config-provider": "^4.3.8", "@smithy/types": "^4.12.0", "@smithy/util-config-provider": "^4.2.0", "@smithy/util-endpoints": "^3.2.8", "@smithy/util-middleware": "^4.2.8", "tslib": "^2.6.2" } }, "sha512-qJpzYC64kaj3S0fueiu3kXm8xPrR3PcXDPEgnaNMRn0EjNSZFoFjvbUp0YUDsRhN1CB90EnHJtbxWKevnH99UQ=="],
+
+    "@smithy/core": ["@smithy/core@3.23.0", "", { "dependencies": { "@smithy/middleware-serde": "^4.2.9", "@smithy/protocol-http": "^5.3.8", "@smithy/types": "^4.12.0", "@smithy/util-base64": "^4.3.0", "@smithy/util-body-length-browser": "^4.2.0", "@smithy/util-middleware": "^4.2.8", "@smithy/util-stream": "^4.5.12", "@smithy/util-utf8": "^4.2.0", "@smithy/uuid": "^1.1.0", "tslib": "^2.6.2" } }, "sha512-Yq4UPVoQICM9zHnByLmG8632t2M0+yap4T7ANVw482J0W7HW0pOuxwVmeOwzJqX2Q89fkXz0Vybz55Wj2Xzrsg=="],
+
+    "@smithy/credential-provider-imds": ["@smithy/credential-provider-imds@4.2.8", "", { "dependencies": { "@smithy/node-config-provider": "^4.3.8", "@smithy/property-provider": "^4.2.8", "@smithy/types": "^4.12.0", "@smithy/url-parser": "^4.2.8", "tslib": "^2.6.2" } }, "sha512-FNT0xHS1c/CPN8upqbMFP83+ul5YgdisfCfkZ86Jh2NSmnqw/AJ6x5pEogVCTVvSm7j9MopRU89bmDelxuDMYw=="],
+
+    "@smithy/eventstream-codec": ["@smithy/eventstream-codec@4.2.8", "", { "dependencies": { "@aws-crypto/crc32": "5.2.0", "@smithy/types": "^4.12.0", "@smithy/util-hex-encoding": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-jS/O5Q14UsufqoGhov7dHLOPCzkYJl9QDzusI2Psh4wyYx/izhzvX9P4D69aTxcdfVhEPhjK+wYyn/PzLjKbbw=="],
+
+    "@smithy/eventstream-serde-browser": ["@smithy/eventstream-serde-browser@4.2.8", "", { "dependencies": { "@smithy/eventstream-serde-universal": "^4.2.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-MTfQT/CRQz5g24ayXdjg53V0mhucZth4PESoA5IhvaWVDTOQLfo8qI9vzqHcPsdd2v6sqfTYqF5L/l+pea5Uyw=="],
+
+    "@smithy/eventstream-serde-config-resolver": ["@smithy/eventstream-serde-config-resolver@4.3.8", "", { "dependencies": { "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-ah12+luBiDGzBruhu3efNy1IlbwSEdNiw8fOZksoKoWW1ZHvO/04MQsdnws/9Aj+5b0YXSSN2JXKy/ClIsW8MQ=="],
+
+    "@smithy/eventstream-serde-node": ["@smithy/eventstream-serde-node@4.2.8", "", { "dependencies": { "@smithy/eventstream-serde-universal": "^4.2.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-cYpCpp29z6EJHa5T9WL0KAlq3SOKUQkcgSoeRfRVwjGgSFl7Uh32eYGt7IDYCX20skiEdRffyDpvF2efEZPC0A=="],
+
+    "@smithy/eventstream-serde-universal": ["@smithy/eventstream-serde-universal@4.2.8", "", { "dependencies": { "@smithy/eventstream-codec": "^4.2.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-iJ6YNJd0bntJYnX6s52NC4WFYcZeKrPUr1Kmmr5AwZcwCSzVpS7oavAmxMR7pMq7V+D1G4s9F5NJK0xwOsKAlQ=="],
+
+    "@smithy/fetch-http-handler": ["@smithy/fetch-http-handler@5.3.9", "", { "dependencies": { "@smithy/protocol-http": "^5.3.8", "@smithy/querystring-builder": "^4.2.8", "@smithy/types": "^4.12.0", "@smithy/util-base64": "^4.3.0", "tslib": "^2.6.2" } }, "sha512-I4UhmcTYXBrct03rwzQX1Y/iqQlzVQaPxWjCjula++5EmWq9YGBrx6bbGqluGc1f0XEfhSkiY4jhLgbsJUMKRA=="],
+
+    "@smithy/hash-blob-browser": ["@smithy/hash-blob-browser@4.2.9", "", { "dependencies": { "@smithy/chunked-blob-reader": "^5.2.0", "@smithy/chunked-blob-reader-native": "^4.2.1", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-m80d/iicI7DlBDxyQP6Th7BW/ejDGiF0bgI754+tiwK0lgMkcaIBgvwwVc7OFbY4eUzpGtnig52MhPAEJ7iNYg=="],
+
+    "@smithy/hash-node": ["@smithy/hash-node@4.2.8", "", { "dependencies": { "@smithy/types": "^4.12.0", "@smithy/util-buffer-from": "^4.2.0", "@smithy/util-utf8": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-7ZIlPbmaDGxVoxErDZnuFG18WekhbA/g2/i97wGj+wUBeS6pcUeAym8u4BXh/75RXWhgIJhyC11hBzig6MljwA=="],
+
+    "@smithy/hash-stream-node": ["@smithy/hash-stream-node@4.2.8", "", { "dependencies": { "@smithy/types": "^4.12.0", "@smithy/util-utf8": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-v0FLTXgHrTeheYZFGhR+ehX5qUm4IQsjAiL9qehad2cyjMWcN2QG6/4mSwbSgEQzI7jwfoXj7z4fxZUx/Mhj2w=="],
+
+    "@smithy/invalid-dependency": ["@smithy/invalid-dependency@4.2.8", "", { "dependencies": { "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-N9iozRybwAQ2dn9Fot9kI6/w9vos2oTXLhtK7ovGqwZjlOcxu6XhPlpLpC+INsxktqHinn5gS2DXDjDF2kG5sQ=="],
+
+    "@smithy/is-array-buffer": ["@smithy/is-array-buffer@4.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-DZZZBvC7sjcYh4MazJSGiWMI2L7E0oCiRHREDzIxi/M2LY79/21iXt6aPLHge82wi5LsuRF5A06Ds3+0mlh6CQ=="],
+
+    "@smithy/md5-js": ["@smithy/md5-js@4.2.8", "", { "dependencies": { "@smithy/types": "^4.12.0", "@smithy/util-utf8": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-oGMaLj4tVZzLi3itBa9TCswgMBr7k9b+qKYowQ6x1rTyTuO1IU2YHdHUa+891OsOH+wCsH7aTPRsTJO3RMQmjQ=="],
+
+    "@smithy/middleware-content-length": ["@smithy/middleware-content-length@4.2.8", "", { "dependencies": { "@smithy/protocol-http": "^5.3.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-RO0jeoaYAB1qBRhfVyq0pMgBoUK34YEJxVxyjOWYZiOKOq2yMZ4MnVXMZCUDenpozHue207+9P5ilTV1zeda0A=="],
+
+    "@smithy/middleware-endpoint": ["@smithy/middleware-endpoint@4.4.14", "", { "dependencies": { "@smithy/core": "^3.23.0", "@smithy/middleware-serde": "^4.2.9", "@smithy/node-config-provider": "^4.3.8", "@smithy/shared-ini-file-loader": "^4.4.3", "@smithy/types": "^4.12.0", "@smithy/url-parser": "^4.2.8", "@smithy/util-middleware": "^4.2.8", "tslib": "^2.6.2" } }, "sha512-FUFNE5KVeaY6U/GL0nzAAHkaCHzXLZcY1EhtQnsAqhD8Du13oPKtMB9/0WK4/LK6a/T5OZ24wPoSShff5iI6Ag=="],
+
+    "@smithy/middleware-retry": ["@smithy/middleware-retry@4.4.31", "", { "dependencies": { "@smithy/node-config-provider": "^4.3.8", "@smithy/protocol-http": "^5.3.8", "@smithy/service-error-classification": "^4.2.8", "@smithy/smithy-client": "^4.11.3", "@smithy/types": "^4.12.0", "@smithy/util-middleware": "^4.2.8", "@smithy/util-retry": "^4.2.8", "@smithy/uuid": "^1.1.0", "tslib": "^2.6.2" } }, "sha512-RXBzLpMkIrxBPe4C8OmEOHvS8aH9RUuCOH++Acb5jZDEblxDjyg6un72X9IcbrGTJoiUwmI7hLypNfuDACypbg=="],
+
+    "@smithy/middleware-serde": ["@smithy/middleware-serde@4.2.9", "", { "dependencies": { "@smithy/protocol-http": "^5.3.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-eMNiej0u/snzDvlqRGSN3Vl0ESn3838+nKyVfF2FKNXFbi4SERYT6PR392D39iczngbqqGG0Jl1DlCnp7tBbXQ=="],
+
+    "@smithy/middleware-stack": ["@smithy/middleware-stack@4.2.8", "", { "dependencies": { "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-w6LCfOviTYQjBctOKSwy6A8FIkQy7ICvglrZFl6Bw4FmcQ1Z420fUtIhxaUZZshRe0VCq4kvDiPiXrPZAe8oRA=="],
+
+    "@smithy/node-config-provider": ["@smithy/node-config-provider@4.3.8", "", { "dependencies": { "@smithy/property-provider": "^4.2.8", "@smithy/shared-ini-file-loader": "^4.4.3", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-aFP1ai4lrbVlWjfpAfRSL8KFcnJQYfTl5QxLJXY32vghJrDuFyPZ6LtUL+JEGYiFRG1PfPLHLoxj107ulncLIg=="],
+
+    "@smithy/node-http-handler": ["@smithy/node-http-handler@4.4.10", "", { "dependencies": { "@smithy/abort-controller": "^4.2.8", "@smithy/protocol-http": "^5.3.8", "@smithy/querystring-builder": "^4.2.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-u4YeUwOWRZaHbWaebvrs3UhwQwj+2VNmcVCwXcYTvPIuVyM7Ex1ftAj+fdbG/P4AkBwLq/+SKn+ydOI4ZJE9PA=="],
+
+    "@smithy/property-provider": ["@smithy/property-provider@4.2.8", "", { "dependencies": { "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-EtCTbyIveCKeOXDSWSdze3k612yCPq1YbXsbqX3UHhkOSW8zKsM9NOJG5gTIya0vbY2DIaieG8pKo1rITHYL0w=="],
+
+    "@smithy/protocol-http": ["@smithy/protocol-http@5.3.8", "", { "dependencies": { "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-QNINVDhxpZ5QnP3aviNHQFlRogQZDfYlCkQT+7tJnErPQbDhysondEjhikuANxgMsZrkGeiAxXy4jguEGsDrWQ=="],
+
+    "@smithy/querystring-builder": ["@smithy/querystring-builder@4.2.8", "", { "dependencies": { "@smithy/types": "^4.12.0", "@smithy/util-uri-escape": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-Xr83r31+DrE8CP3MqPgMJl+pQlLLmOfiEUnoyAlGzzJIrEsbKsPy1hqH0qySaQm4oWrCBlUqRt+idEgunKB+iw=="],
+
+    "@smithy/querystring-parser": ["@smithy/querystring-parser@4.2.8", "", { "dependencies": { "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-vUurovluVy50CUlazOiXkPq40KGvGWSdmusa3130MwrR1UNnNgKAlj58wlOe61XSHRpUfIIh6cE0zZ8mzKaDPA=="],
+
+    "@smithy/service-error-classification": ["@smithy/service-error-classification@4.2.8", "", { "dependencies": { "@smithy/types": "^4.12.0" } }, "sha512-mZ5xddodpJhEt3RkCjbmUQuXUOaPNTkbMGR0bcS8FE0bJDLMZlhmpgrvPNCYglVw5rsYTpSnv19womw9WWXKQQ=="],
+
+    "@smithy/shared-ini-file-loader": ["@smithy/shared-ini-file-loader@4.4.3", "", { "dependencies": { "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-DfQjxXQnzC5UbCUPeC3Ie8u+rIWZTvuDPAGU/BxzrOGhRvgUanaP68kDZA+jaT3ZI+djOf+4dERGlm9mWfFDrg=="],
+
+    "@smithy/signature-v4": ["@smithy/signature-v4@5.3.8", "", { "dependencies": { "@smithy/is-array-buffer": "^4.2.0", "@smithy/protocol-http": "^5.3.8", "@smithy/types": "^4.12.0", "@smithy/util-hex-encoding": "^4.2.0", "@smithy/util-middleware": "^4.2.8", "@smithy/util-uri-escape": "^4.2.0", "@smithy/util-utf8": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-6A4vdGj7qKNRF16UIcO8HhHjKW27thsxYci+5r/uVRkdcBEkOEiY8OMPuydLX4QHSrJqGHPJzPRwwVTqbLZJhg=="],
+
+    "@smithy/smithy-client": ["@smithy/smithy-client@4.11.3", "", { "dependencies": { "@smithy/core": "^3.23.0", "@smithy/middleware-endpoint": "^4.4.14", "@smithy/middleware-stack": "^4.2.8", "@smithy/protocol-http": "^5.3.8", "@smithy/types": "^4.12.0", "@smithy/util-stream": "^4.5.12", "tslib": "^2.6.2" } }, "sha512-Q7kY5sDau8OoE6Y9zJoRGgje8P4/UY0WzH8R2ok0PDh+iJ+ZnEKowhjEqYafVcubkbYxQVaqwm3iufktzhprGg=="],
+
+    "@smithy/types": ["@smithy/types@4.12.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-9YcuJVTOBDjg9LWo23Qp0lTQ3D7fQsQtwle0jVfpbUHy9qBwCEgKuVH4FqFB3VYu0nwdHKiEMA+oXz7oV8X1kw=="],
+
+    "@smithy/url-parser": ["@smithy/url-parser@4.2.8", "", { "dependencies": { "@smithy/querystring-parser": "^4.2.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-NQho9U68TGMEU639YkXnVMV3GEFFULmmaWdlu1E9qzyIePOHsoSnagTGSDv1Zi8DCNN6btxOSdgmy5E/hsZwhA=="],
+
+    "@smithy/util-base64": ["@smithy/util-base64@4.3.0", "", { "dependencies": { "@smithy/util-buffer-from": "^4.2.0", "@smithy/util-utf8": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-GkXZ59JfyxsIwNTWFnjmFEI8kZpRNIBfxKjv09+nkAWPt/4aGaEWMM04m4sxgNVWkbt2MdSvE3KF/PfX4nFedQ=="],
+
+    "@smithy/util-body-length-browser": ["@smithy/util-body-length-browser@4.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-Fkoh/I76szMKJnBXWPdFkQJl2r9SjPt3cMzLdOB6eJ4Pnpas8hVoWPYemX/peO0yrrvldgCUVJqOAjUrOLjbxg=="],
+
+    "@smithy/util-body-length-node": ["@smithy/util-body-length-node@4.2.1", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-h53dz/pISVrVrfxV1iqXlx5pRg3V2YWFcSQyPyXZRrZoZj4R4DeWRDo1a7dd3CPTcFi3kE+98tuNyD2axyZReA=="],
+
+    "@smithy/util-buffer-from": ["@smithy/util-buffer-from@4.2.0", "", { "dependencies": { "@smithy/is-array-buffer": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-kAY9hTKulTNevM2nlRtxAG2FQ3B2OR6QIrPY3zE5LqJy1oxzmgBGsHLWTcNhWXKchgA0WHW+mZkQrng/pgcCew=="],
+
+    "@smithy/util-config-provider": ["@smithy/util-config-provider@4.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-YEjpl6XJ36FTKmD+kRJJWYvrHeUvm5ykaUS5xK+6oXffQPHeEM4/nXlZPe+Wu0lsgRUcNZiliYNh/y7q9c2y6Q=="],
+
+    "@smithy/util-defaults-mode-browser": ["@smithy/util-defaults-mode-browser@4.3.30", "", { "dependencies": { "@smithy/property-provider": "^4.2.8", "@smithy/smithy-client": "^4.11.3", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-cMni0uVU27zxOiU8TuC8pQLC1pYeZ/xEMxvchSK/ILwleRd1ugobOcIRr5vXtcRqKd4aBLWlpeBoDPJJ91LQng=="],
+
+    "@smithy/util-defaults-mode-node": ["@smithy/util-defaults-mode-node@4.2.33", "", { "dependencies": { "@smithy/config-resolver": "^4.4.6", "@smithy/credential-provider-imds": "^4.2.8", "@smithy/node-config-provider": "^4.3.8", "@smithy/property-provider": "^4.2.8", "@smithy/smithy-client": "^4.11.3", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-LEb2aq5F4oZUSzWBG7S53d4UytZSkOEJPXcBq/xbG2/TmK9EW5naUZ8lKu1BEyWMzdHIzEVN16M3k8oxDq+DJA=="],
+
+    "@smithy/util-endpoints": ["@smithy/util-endpoints@3.2.8", "", { "dependencies": { "@smithy/node-config-provider": "^4.3.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-8JaVTn3pBDkhZgHQ8R0epwWt+BqPSLCjdjXXusK1onwJlRuN69fbvSK66aIKKO7SwVFM6x2J2ox5X8pOaWcUEw=="],
+
+    "@smithy/util-hex-encoding": ["@smithy/util-hex-encoding@4.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-CCQBwJIvXMLKxVbO88IukazJD9a4kQ9ZN7/UMGBjBcJYvatpWk+9g870El4cB8/EJxfe+k+y0GmR9CAzkF+Nbw=="],
+
+    "@smithy/util-middleware": ["@smithy/util-middleware@4.2.8", "", { "dependencies": { "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-PMqfeJxLcNPMDgvPbbLl/2Vpin+luxqTGPpW3NAQVLbRrFRzTa4rNAASYeIGjRV9Ytuhzny39SpyU04EQreF+A=="],
+
+    "@smithy/util-retry": ["@smithy/util-retry@4.2.8", "", { "dependencies": { "@smithy/service-error-classification": "^4.2.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-CfJqwvoRY0kTGe5AkQokpURNCT1u/MkRzMTASWMPPo2hNSnKtF1D45dQl3DE2LKLr4m+PW9mCeBMJr5mCAVThg=="],
+
+    "@smithy/util-stream": ["@smithy/util-stream@4.5.12", "", { "dependencies": { "@smithy/fetch-http-handler": "^5.3.9", "@smithy/node-http-handler": "^4.4.10", "@smithy/types": "^4.12.0", "@smithy/util-base64": "^4.3.0", "@smithy/util-buffer-from": "^4.2.0", "@smithy/util-hex-encoding": "^4.2.0", "@smithy/util-utf8": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-D8tgkrmhAX/UNeCZbqbEO3uqyghUnEmmoO9YEvRuwxjlkKKUE7FOgCJnqpTlQPe9MApdWPky58mNQQHbnCzoNg=="],
+
+    "@smithy/util-uri-escape": ["@smithy/util-uri-escape@4.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-igZpCKV9+E/Mzrpq6YacdTQ0qTiLm85gD6N/IrmyDvQFA4UnU3d5g3m8tMT/6zG/vVkWSU+VxeUyGonL62DuxA=="],
+
+    "@smithy/util-utf8": ["@smithy/util-utf8@4.2.0", "", { "dependencies": { "@smithy/util-buffer-from": "^4.2.0", "tslib": "^2.6.2" } }, "sha512-zBPfuzoI8xyBtR2P6WQj63Rz8i3AmfAaJLuNG8dWsfvPe8lO4aCPYLn879mEgHndZH1zQ2oXmG8O1GGzzaoZiw=="],
+
+    "@smithy/util-waiter": ["@smithy/util-waiter@4.2.8", "", { "dependencies": { "@smithy/abort-controller": "^4.2.8", "@smithy/types": "^4.12.0", "tslib": "^2.6.2" } }, "sha512-n+lahlMWk+aejGuax7DPWtqav8HYnWxQwR+LCG2BgCUmaGcTe9qZCFsmw8TMg9iG75HOwhrJCX9TCJRLH+Yzqg=="],
+
+    "@smithy/uuid": ["@smithy/uuid@1.1.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-4aUIteuyxtBUhVdiQqcDhKFitwfd9hqoSDYY2KRXiWtgoWJ9Bmise+KfEPDiVHWeJepvF8xJO9/9+WDIciMFFw=="],
+
     "@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
 
     "@swc/helpers": ["@swc/helpers@0.5.15", "", { "dependencies": { "tslib": "^2.8.0" } }, "sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g=="],
@@ -829,6 +1014,8 @@
 
     "birpc": ["birpc@2.9.0", "", {}, "sha512-KrayHS5pBi69Xi9JmvoqrIgYGDkD6mcSe/i6YKi3w5kekCLzrX4+nawcXqrj2tIp50Kw/mT/s3p+GVK0A0sKxw=="],
 
+    "bowser": ["bowser@2.14.1", "", {}, "sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg=="],
+
     "browserslist": ["browserslist@4.28.1", "", { "dependencies": { "baseline-browser-mapping": "^2.9.0", "caniuse-lite": "^1.0.30001759", "electron-to-chromium": "^1.5.263", "node-releases": "^2.0.27", "update-browserslist-db": "^1.2.0" }, "bin": { "browserslist": "cli.js" } }, "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA=="],
 
     "c12": ["c12@3.1.0", "", { "dependencies": { "chokidar": "^4.0.3", "confbox": "^0.2.2", "defu": "^6.1.4", "dotenv": "^16.6.1", "exsolve": "^1.0.7", "giget": "^2.0.0", "jiti": "^2.4.2", "ohash": "^2.0.11", "pathe": "^2.0.3", "perfect-debounce": "^1.0.0", "pkg-types": "^2.2.0", "rc9": "^2.1.2" }, "peerDependencies": { "magicast": "^0.3.5" }, "optionalPeers": ["magicast"] }, "sha512-uWoS8OU1MEIsOv8p/5a82c3H31LsWVR5qiyXVfBNOzfffjUWtPnhAb4BYI2uG2HfGmZmFjCtui5XNWaps+iFuw=="],
@@ -989,6 +1176,8 @@
 
     "fast-uri": ["fast-uri@3.1.0", "", {}, "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA=="],
 
+    "fast-xml-parser": ["fast-xml-parser@5.3.4", "", { "dependencies": { "strnum": "^2.1.0" }, "bin": { "fxparser": "src/cli/cli.js" } }, "sha512-EFd6afGmXlCx8H8WTZHhAoDaWaGyuIBoZJ2mknrNxug+aZKjkp0a0dlars9Izl+jF+7Gu1/5f/2h68cQpe0IiA=="],
+
     "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="],
 
     "find-up-simple": ["find-up-simple@1.0.1", "", {}, "sha512-afd4O7zpqHeRyg4PfDQsXmlDe2PfdHtJt6Akt8jOWaApLOZk5JXs6VMR29lz03pRe9mpykrRCYIYxaJYcfpncQ=="],
@@ -1407,6 +1596,8 @@
 
     "strip-indent": ["strip-indent@3.0.0", "", { "dependencies": { "min-indent": "^1.0.0" } }, "sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ=="],
 
+    "strnum": ["strnum@2.1.2", "", {}, "sha512-l63NF9y/cLROq/yqKXSLtcMeeyOfnSQlfMSlzFt/K73oIaD8DGaQWd7Z34X9GPiKqP5rbSh84Hl4bOlLcjiSrQ=="],
+
     "styled-jsx": ["styled-jsx@5.1.6", "", { "dependencies": { "client-only": "0.0.1" }, "peerDependencies": { "react": ">= 16.8.0 || 17.x.x || ^18.0.0-0 || ^19.0.0-0" } }, "sha512-qSVyDTeMotdvQYoHWLNGwRFJHC+i+ZvdBRYosOFgC+Wg1vx4frN2/RG/NA7SYqqvKNLf39P2LSRA2pu6n0XYZA=="],
 
     "superjson": ["superjson@2.2.6", "", { "dependencies": { "copy-anything": "^4" } }, "sha512-H+ue8Zo4vJmV2nRjpx86P35lzwDT3nItnIsocgumgr0hHMQ+ZGq5vrERg9kJBo5AWGmxZDhzDo+WVIJqkB0cGA=="],
@@ -1451,19 +1642,19 @@
 
     "tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
 
-    "turbo": ["turbo@2.8.3", "", { "optionalDependencies": { "turbo-darwin-64": "2.8.3", "turbo-darwin-arm64": "2.8.3", "turbo-linux-64": "2.8.3", "turbo-linux-arm64": "2.8.3", "turbo-windows-64": "2.8.3", "turbo-windows-arm64": "2.8.3" }, "bin": { "turbo": "bin/turbo" } }, "sha512-8Osxz5Tu/Dw2kb31EAY+nhq/YZ3wzmQSmYa1nIArqxgCAldxv9TPlrAiaBUDVnKA4aiPn0OFBD1ACcpc5VFOAQ=="],
+    "turbo": ["turbo@2.8.6", "", { "optionalDependencies": { "turbo-darwin-64": "2.8.6", "turbo-darwin-arm64": "2.8.6", "turbo-linux-64": "2.8.6", "turbo-linux-arm64": "2.8.6", "turbo-windows-64": "2.8.6", "turbo-windows-arm64": "2.8.6" }, "bin": { "turbo": "bin/turbo" } }, "sha512-QMj1SQwUYehc+xJ9SxXn56UO43hfKN64/NFetVW1BwzysRqn+q0FSgrmk+IbJ+djfd8j8zXGKGeqsnUcXwQSUQ=="],
 
-    "turbo-darwin-64": ["turbo-darwin-64@2.8.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-4kXRLfcygLOeNcP6JquqRLmGB/ATjjfehiojL2dJkL7GFm3SPSXbq7oNj8UbD8XriYQ5hPaSuz59iF1ijPHkTw=="],
+    "turbo-darwin-64": ["turbo-darwin-64@2.8.6", "", { "os": "darwin", "cpu": "x64" }, "sha512-6QeZ/aLZizekiI6tKZN0IGP1a1WYZ9c/qDKPa0rSmj2X0O0Iw/ES4rKZV40S5n8SUJdiU01EFLygHJ2oWaYKXg=="],
 
-    "turbo-darwin-arm64": ["turbo-darwin-arm64@2.8.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-xF7uCeC0UY0Hrv/tqax0BMbFlVP1J/aRyeGQPZT4NjvIPj8gSPDgFhfkfz06DhUwDg5NgMo04uiSkAWE8WB/QQ=="],
+    "turbo-darwin-arm64": ["turbo-darwin-arm64@2.8.6", "", { "os": "darwin", "cpu": "arm64" }, "sha512-RS4Z902vB93cQD3PJS/1IMmS0HefrB5ZXuw4ECOrxhOGz5jJVmYFJ6weDzedjoTDeYHHXGo1NoiCSHg69ngWKA=="],
 
-    "turbo-linux-64": ["turbo-linux-64@2.8.3", "", { "os": "linux", "cpu": "x64" }, "sha512-vxMDXwaOjweW/4etY7BxrXCSkvtwh0PbwVafyfT1Ww659SedUxd5rM3V2ZCmbwG8NiCfY7d6VtxyHx3Wh1GoZA=="],
+    "turbo-linux-64": ["turbo-linux-64@2.8.6", "", { "os": "linux", "cpu": "x64" }, "sha512-hCWDnDepYbrSJdByuryKFoHAGFkvgBYXr6qdaGsYhX1Wgq8isqXCQBKOo99Y/9tXDwKGEeQ7xnkdFvSL7AQ4iQ=="],
 
-    "turbo-linux-arm64": ["turbo-linux-arm64@2.8.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-mQX7uYBZFkuPLLlKaNe9IjR1JIef4YvY8f21xFocvttXvdPebnq3PK1Zjzl9A1zun2BEuWNUwQIL8lgvN9Pm3Q=="],
+    "turbo-linux-arm64": ["turbo-linux-arm64@2.8.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-oS15aCYEpynG/l69xs/ZnQ0dnz0pHhfHg70Zf5J+j5Cam0/RA0MpcryjneN/9G0PmP8a/6ZxnL5nZahX+wOBPA=="],
 
-    "turbo-windows-64": ["turbo-windows-64@2.8.3", "", { "os": "win32", "cpu": "x64" }, "sha512-YLGEfppGxZj3VWcNOVa08h6ISsVKiG85aCAWosOKNUjb6yErWEuydv6/qImRJUI+tDLvDvW7BxopAkujRnWCrw=="],
+    "turbo-windows-64": ["turbo-windows-64@2.8.6", "", { "os": "win32", "cpu": "x64" }, "sha512-eqBxqJD7H/uk9V0QO10VgwY9J2BUXejsGuzChln72Yl+o8GZwsvhOekndRxccR90J8ZO+LKO24+3VzHFh4Cu/g=="],
 
-    "turbo-windows-arm64": ["turbo-windows-arm64@2.8.3", "", { "os": "win32", "cpu": "arm64" }, "sha512-afTUGKBRmOJU1smQSBnFGcbq0iabAPwh1uXu2BVk7BREg30/1gMnJh9DFEQTah+UD3n3ru8V55J83RQNFfqoyw=="],
+    "turbo-windows-arm64": ["turbo-windows-arm64@2.8.6", "", { "os": "win32", "cpu": "arm64" }, "sha512-I3VEQyxIlNZ6XTg4fLKAkuhcwzIs/GD7Vs1yhelH2aUTjf08wprjBWknDqP7mjAHMpsosRrq4DtfSZEQm83Hxg=="],
 
     "type-fest": ["type-fest@5.4.4", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-JnTrzGu+zPV3aXIUhnyWJj4z/wigMsdYajGLIYakqyOW1nPllzXEJee0QQbHj+CTIQtXGlAjuK0UY+2xTyjVAw=="],
 
@@ -1553,6 +1744,12 @@
 
     "zwitch": ["zwitch@2.0.4", "", {}, "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A=="],
 
+    "@aws-crypto/sha1-browser/@smithy/util-utf8": ["@smithy/util-utf8@2.3.0", "", { "dependencies": { "@smithy/util-buffer-from": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A=="],
+
+    "@aws-crypto/sha256-browser/@smithy/util-utf8": ["@smithy/util-utf8@2.3.0", "", { "dependencies": { "@smithy/util-buffer-from": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A=="],
+
+    "@aws-crypto/util/@smithy/util-utf8": ["@smithy/util-utf8@2.3.0", "", { "dependencies": { "@smithy/util-buffer-from": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A=="],
+
     "@babel/helper-compilation-targets/lru-cache": ["lru-cache@5.1.1", "", { "dependencies": { "yallist": "^3.0.2" } }, "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w=="],
 
     "@commitlint/is-ignored/semver": ["semver@7.7.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA=="],
@@ -1637,6 +1834,12 @@
 
     "wrap-ansi/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
 
+    "@aws-crypto/sha1-browser/@smithy/util-utf8/@smithy/util-buffer-from": ["@smithy/util-buffer-from@2.2.0", "", { "dependencies": { "@smithy/is-array-buffer": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA=="],
+
+    "@aws-crypto/sha256-browser/@smithy/util-utf8/@smithy/util-buffer-from": ["@smithy/util-buffer-from@2.2.0", "", { "dependencies": { "@smithy/is-array-buffer": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA=="],
+
+    "@aws-crypto/util/@smithy/util-utf8/@smithy/util-buffer-from": ["@smithy/util-buffer-from@2.2.0", "", { "dependencies": { "@smithy/is-array-buffer": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA=="],
+
     "@inquirer/core/wrap-ansi/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
 
     "@vitejs/plugin-vue/vite/esbuild": ["esbuild@0.21.5", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.21.5", "@esbuild/android-arm": "0.21.5", "@esbuild/android-arm64": "0.21.5", "@esbuild/android-x64": "0.21.5", "@esbuild/darwin-arm64": "0.21.5", "@esbuild/darwin-x64": "0.21.5", "@esbuild/freebsd-arm64": "0.21.5", "@esbuild/freebsd-x64": "0.21.5", "@esbuild/linux-arm": "0.21.5", "@esbuild/linux-arm64": "0.21.5", "@esbuild/linux-ia32": "0.21.5", "@esbuild/linux-loong64": "0.21.5", "@esbuild/linux-mips64el": "0.21.5", "@esbuild/linux-ppc64": "0.21.5", "@esbuild/linux-riscv64": "0.21.5", "@esbuild/linux-s390x": "0.21.5", "@esbuild/linux-x64": "0.21.5", "@esbuild/netbsd-x64": "0.21.5", "@esbuild/openbsd-x64": "0.21.5", "@esbuild/sunos-x64": "0.21.5", "@esbuild/win32-arm64": "0.21.5", "@esbuild/win32-ia32": "0.21.5", "@esbuild/win32-x64": "0.21.5" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw=="],
@@ -1647,6 +1850,12 @@
 
     "vitepress/vite/fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="],
 
+    "@aws-crypto/sha1-browser/@smithy/util-utf8/@smithy/util-buffer-from/@smithy/is-array-buffer": ["@smithy/is-array-buffer@2.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA=="],
+
+    "@aws-crypto/sha256-browser/@smithy/util-utf8/@smithy/util-buffer-from/@smithy/is-array-buffer": ["@smithy/is-array-buffer@2.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA=="],
+
+    "@aws-crypto/util/@smithy/util-utf8/@smithy/util-buffer-from/@smithy/is-array-buffer": ["@smithy/is-array-buffer@2.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA=="],
+
     "@vitejs/plugin-vue/vite/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.21.5", "", { "os": "aix", "cpu": "ppc64" }, "sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ=="],
 
     "@vitejs/plugin-vue/vite/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.21.5", "", { "os": "android", "cpu": "arm" }, "sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg=="],

docs/product-engineering/artist-cms-inspiration.md

@@ -0,0 +1,52 @@
+# Artist CMS Inspiration Notes
+
+## Scope
+
+Inspiration-only notes for implementation direction.  
+These are not direct copy targets and do not override current CMS roadmap decisions.
+
+## Useful Patterns Observed in `gaertan`
+
+### Media and Delivery
+
+- S3-backed storage with signed URL/object access patterns.
+- Route-level image streaming/proxy from storage keys.
+- Multiple artwork variants/renditions for different view contexts.
+- Dedicated actions for generated gallery variants and missing-variant backfill.
+
+### Portfolio Domain
+
+- Artwork linked to galleries/albums/tags/categories.
+- Filterable portfolio pages (album/year/tag/search).
+- Gallery components designed for responsive/justified layouts.
+
+### Commissions Domain
+
+- Rich commission model:
+  - types
+  - options
+  - extras
+  - custom cards
+  - custom inputs
+- Public request form + admin request management.
+- Commission status/kanban-like mapping for intake/in-progress/completed.
+
+### Color and Processing
+
+- Artwork color extraction workflows (palette/tones) from stored image files.
+- Potential pipeline point for future theming and discovery filters.
+
+## How We Should Reuse These Ideas Here
+
+- Keep the domain approach, but normalize to current CMS architecture (`@cms/*` packages, Next app router, shared CRUD services).
+- Start with deterministic MVP1 primitives:
+  - media CRUD + rendition slots
+  - portfolio grouping entities
+  - commission/customer linking
+- Defer heavy media automation (advanced transforms/watermark/palette orchestration) to MVP2 after baseline reliability is proven.
+
+## Guardrails
+
+- No direct schema/code lift from `gaertan`; re-model explicitly for this repository.
+- Keep upload and processing abstraction pluggable (S3 now, alternative provider later).
+- Favor explicit auditability for media/commission mutations.

docs/product-engineering/cms-feature-topics.md

@@ -0,0 +1,244 @@
+# CMS Feature Topics (Domain-Centric)
+
+## Purpose
+
+Describe the CMS by feature domains/modules (not personas), so implementation and UI structure stay clear.
+
+## 1) Pages
+
+Scope:
+
+- create/edit/publish/unpublish/schedule pages
+- slug + SEO metadata
+- draft and publish states
+
+Core entities:
+
+- `Page`
+- `PageVersion` (later)
+- `SeoMeta`
+
+MVP fit:
+
+- MVP1 core
+
+## 2) Navigation
+
+Scope:
+
+- menus, nested items, ordering, visibility
+- route linking to pages or external URLs
+
+Core entities:
+
+- `NavigationMenu`
+- `NavigationItem`
+
+MVP fit:
+
+- MVP1 core
+
+## 3) Media
+
+Scope:
+
+- upload/browse/replace/delete media
+- media-type classification (artwork, banner, promo, generic, video/gif)
+- metadata management
+
+Core entities:
+
+- `MediaAsset`
+- `MediaMetadata`
+- `MediaVariant` (renditions)
+
+MVP fit:
+
+- MVP1 core
+
+## 4) Portfolio / Artworks
+
+Scope:
+
+- artworks with grouped structures
+- grouping by galleries/albums/categories/tags
+- ordering and visibility
+
+Core entities:
+
+- `Artwork`
+- `Gallery`
+- `Album`
+- `Category`
+- `Tag`
+
+MVP fit:
+
+- MVP1 core
+
+## 5) Cards and Reusable Blocks
+
+Scope:
+
+- reusable content blocks for pages
+- card-based sections (price cards, promo cards, feature cards)
+
+Core entities:
+
+- `BlockTemplate`
+- `BlockInstance`
+- `CardPreset`
+
+MVP fit:
+
+- MVP1 (baseline blocks), MVP2 (advanced builder UX)
+
+## 6) Forms
+
+Scope:
+
+- embeddable forms on pages
+- schema-driven field definitions
+- submission handling and moderation
+
+Core entities:
+
+- `FormDefinition`
+- `FormField`
+- `FormSubmission`
+
+MVP fit:
+
+- MVP1 for commission request path
+- MVP2 for generic form builder
+
+## 7) Announcements and Banners
+
+Scope:
+
+- prominent notices on public pages
+- schedule windows and priority
+
+Core entities:
+
+- `Announcement`
+- `HeaderBanner`
+
+MVP fit:
+
+- MVP1 core
+
+## 8) News / Blog
+
+Scope:
+
+- editorial posts and updates
+- author metadata, status flow
+
+Core entities:
+
+- `NewsPost`
+- `NewsCategory`
+
+MVP fit:
+
+- MVP1 secondary core
+
+## 9) Commissions
+
+Scope:
+
+- commission request intake
+- admin processing and kanban status transitions
+
+Core entities:
+
+- `CommissionRequest`
+- `CommissionStatus`
+- `CommissionType` (options/extras/custom fields)
+
+MVP fit:
+
+- MVP1 core
+
+## 10) Customers (CRM-Lite)
+
+Scope:
+
+- recurring customer records
+- customer-to-commission linking and reuse
+
+Core entities:
+
+- `Customer`
+- `CustomerContact`
+- `CustomerCommissionLink`
+
+MVP fit:
+
+- MVP1 core
+
+## 11) Users, Roles, and Permissions
+
+Scope:
+
+- users, role assignment, status (active/banned)
+- protected owner/support invariants
+
+Core entities:
+
+- `User`
+- `Role`
+- `Permission`
+
+MVP fit:
+
+- MVP0/MVP1 bridge; refinements in MVP2
+
+## 12) Settings
+
+Scope:
+
+- system settings and feature flags
+- registration policy and future locale toggles
+
+Core entities:
+
+- `SystemSetting`
+
+MVP fit:
+
+- MVP0 baseline, expanded in MVP1/MVP2
+
+## 13) Processing Pipelines (Later)
+
+Scope:
+
+- watermarking
+- color extraction
+- advanced media transforms
+- queue/retry visibility
+
+Core entities:
+
+- `MediaJob`
+- `MediaJobRun`
+- `ExtractedPalette`
+
+MVP fit:
+
+- MVP2
+
+## Suggested Admin IA Alignment
+
+- Dashboard
+- Pages
+- Navigation
+- Media
+- Portfolio
+- Announcements
+- News
+- Commissions
+- Customers
+- Users
+- Settings

docs/product-engineering/delivery-pipeline.md

@@ -28,8 +28,14 @@ Policy:
 - Steps:
   1. validate tag vs root `package.json` version
   2. generate changelog
-  3. docker login
+  3. extract release notes from `CHANGELOG.md`
-  4. build and push `cms-web` and `cms-admin` images
+  4. docker login
+  5. build and push `cms-web` and `cms-admin` images
+  6. publish/update Gitea release notes through API
+
+Additional required secret:
+
+- `GITEA_RELEASE_TOKEN`
 
 ## Staging Deployment Automation
 
@@ -57,10 +63,10 @@ Promotion:
 
 Rollback:
 
-- release workflow supports rollback placeholder by image tag
+- release workflow supports manual production rollback by `rollback_image_tag`
-- deploy workflow supports `rollback_tag` input
+- deploy workflow supports `rollback_tag` input for environment-specific rollback
 - recovery action:
-  - rerun deploy with previous known-good tag
+  - rerun deploy/rollback with previous known-good tag
 
 ## Deployment Verification
 

docs/product-engineering/git-flow-governance.md

@@ -23,6 +23,33 @@ Minimum policy:
 - required status checks
 - at least one reviewer approval
 
+## Branch Protection Verification Checklist
+
+Use this checklist in Gitea repository settings after applying policy:
+
+1. `main` protection exists and direct push is disabled.
+2. `staging` protection exists and direct push is disabled.
+3. Required checks include:
+   - `Governance Checks`
+   - `Lint Typecheck Unit E2E`
+4. Pull request approval is required.
+5. Branch must be up to date before merge (recommended in protected branches).
+
+API automation example:
+
+```bash
+sh .gitea/scripts/configure-branch-protection.sh \
+  "$GITEA_URL" \
+  "$GITEA_OWNER" \
+  "$GITEA_REPO" \
+  "$GITEA_ADMIN_TOKEN"
+```
+
+Notes:
+
+- The script applies baseline protection for `main` and `staging`.
+- Final verification is still required in the Gitea UI to confirm repository-specific policies.
+
 ## PR Gates
 
 Required checks are implemented in `.gitea/workflows/ci.yml`:

docs/product-engineering/index.md

@@ -10,8 +10,13 @@ This section covers platform and implementation documentation for engineers and
 - [RBAC And Permissions](/product-engineering/rbac-permission-model)
 - [i18n Conventions](/product-engineering/i18n-conventions)
 - [CRUD Examples](/product-engineering/crud-examples)
+- [Package Catalog And Decision Notes](/product-engineering/package-catalog)
+- [User Personas And Use-Case Topics](/product-engineering/user-personas-and-use-cases)
+- [CMS Feature Topics (Domain-Centric)](/product-engineering/cms-feature-topics)
 - [Domain Glossary](/product-engineering/domain-glossary)
+- [Artist CMS Inspiration Notes](/product-engineering/artist-cms-inspiration)
 - [Environment Runbook](/product-engineering/environment-runbook)
+- [Staging Deployment Checklist](/product-engineering/staging-deployment-checklist)
 - [Delivery Pipeline](/product-engineering/delivery-pipeline)
 - [Git Flow Governance](/product-engineering/git-flow-governance)
 - [Testing Strategy Baseline](/product-engineering/testing-strategy)

docs/product-engineering/package-catalog.md

@@ -0,0 +1,153 @@
+# Package Catalog And Decision Notes
+
+## Purpose
+
+Track package decisions in one place:
+
+- what is already used
+- why it is used
+- when to keep/remove/replace
+- which packages are candidates for later MVPs
+
+This file is decision support, not a lockfile replacement.
+
+## Current Core Stack (Used Now)
+
+### Runtime and App Foundation
+
+- `bun`:
+  workspace package manager + runtime for scripts and local dev.
+- `next` + `react` + `react-dom`:
+  app framework for `admin` and `web`.
+- `typescript`:
+  typed contracts across apps/packages.
+
+### Data and Validation
+
+- `prisma` + `@prisma/client` + `pg` + `@prisma/adapter-pg`:
+  DB schema/migrations + typed DB access on PostgreSQL.
+- `zod`:
+  shared runtime validation for domain schemas and CRUD inputs.
+
+### Auth, State, Data Fetching
+
+- `better-auth`:
+  admin auth/session + role metadata baseline.
+- `zustand`:
+  lightweight client state (e.g. locale/UI state).
+- `@tanstack/react-query`:
+  async state/query cache patterns for admin/public app data fetching.
+- `@tanstack/react-form` and `@tanstack/react-table`:
+  form/table primitives in admin workflows.
+
+### UI and Styling
+
+- `tailwindcss` + `@tailwindcss/postcss`:
+  utility-first styling baseline.
+- `class-variance-authority`, `clsx`, `tailwind-merge`:
+  component variant + class composition in `@cms/ui`.
+
+### Testing and Quality
+
+- `vitest`, `@testing-library/react`, `@testing-library/jest-dom`, `@testing-library/user-event`, `msw`, `jsdom`:
+  unit/integration tests + UI interaction + API mocking.
+- `@playwright/test`:
+  end-to-end tests.
+- `@biomejs/biome`:
+  lint/format/check baseline.
+- `turbo`:
+  monorepo task orchestration.
+
+### Docs and Release Governance
+
+- `vitepress`:
+  docs site.
+- `conventional-changelog-cli`:
+  changelog generation from conventional commits.
+- `@commitlint/cli` + `@commitlint/config-conventional`:
+  commit message schema enforcement.
+
+## Media and Color Processing Notes
+
+### Why `sharp` is typically the default choice
+
+`sharp` is usually the best baseline for server-side image processing because:
+
+- strong performance and memory behavior
+- reliable resize/crop/format conversion pipeline
+- robust support for production workloads
+- good integration in Node/Bun server contexts
+
+Use cases for this CMS:
+
+- generate artwork renditions (thumb/card/full/custom)
+- normalize uploads and output formats
+- create banner/promo safe-size outputs
+- optional watermark compositing pipeline
+
+### Color extraction package options
+
+1. `node-vibrant`
+- Best for: quick dominant palette extraction for UI accents and tagging.
+- Tradeoff: less control over advanced color science.
+
+2. `colorthief`
+- Best for: simple dominant-color extraction with minimal setup.
+- Tradeoff: more limited output and tuning compared to richer libraries.
+
+3. `culori` / `chroma-js` (supporting libs, often combined with extractor)
+- Best for: color manipulation, conversion, contrast checks, palette normalization.
+- Tradeoff: not a full image extractor by itself.
+
+Recommended approach:
+
+- MVP2 start with `sharp` + `node-vibrant` + `culori`
+- keep extraction pipeline behind an internal adapter so replacement is easy
+
+## Candidate Packages For Later (Not Installed Yet)
+
+### File Upload and Storage Abstraction
+
+- `@aws-sdk/client-s3` (+ presign utilities):
+  for S3/R2/object storage adapters and signed upload/download flows.
+- `uploadthing` or custom presigned-upload implementation:
+  faster admin upload UX with secure direct-to-storage path.
+
+### Rich Text / Page Builder
+
+- `tiptap`:
+  rich editorial experience for pages/news.
+- `@dnd-kit/core`:
+  drag-and-drop block ordering/page-builder interactions.
+
+### Media Pipelines / Jobs
+
+- `bullmq` + `ioredis`:
+  background job queue for heavy media transforms (watermark/video/etc).
+
+### Commissions and CRM Extensions
+
+- `@tanstack/react-virtual`:
+  large admin tables (requests/customers) without rendering bottlenecks.
+
+### Observability / Reliability
+
+- `@sentry/nextjs`:
+  app error monitoring.
+- `pino`:
+  structured logs for services/workflows.
+
+## Add/Remove Decision Rules
+
+When adding a package, document:
+
+1. problem it solves
+2. why existing stack is insufficient
+3. expected maintenance/runtime cost
+4. fallback/exit plan
+
+When removing/replacing:
+
+1. list impacted modules
+2. verify tests and migration path
+3. update this catalog and related ADR/docs

docs/product-engineering/staging-deployment-checklist.md

@@ -0,0 +1,100 @@
+# Staging Deployment Checklist
+
+## Purpose
+
+Operational checklist for the first real staging deployment using `.gitea/workflows/deploy.yml`.
+
+Use this once end-to-end, save the record, then mark MVP0 staging deployment as complete in `TODO.md`.
+
+## Preconditions
+
+- Docker host for staging is reachable via SSH.
+- Gitea repo secrets are configured:
+  - `CMS_STAGING_HOST`
+  - `CMS_STAGING_USER`
+  - `CMS_DEPLOY_KEY`
+  - `CMS_REMOTE_DEPLOY_PATH`
+  - `CMS_IMAGE_REGISTRY`
+  - `CMS_IMAGE_NAMESPACE`
+  - `CMS_IMAGE_REGISTRY_USER`
+  - `CMS_IMAGE_REGISTRY_PASSWORD`
+- Release image tag exists in registry (e.g. `v0.1.0`).
+- Remote deploy path contains:
+  - `docker-compose.staging.yml`
+  - staging env file(s) needed by compose
+
+## Step-by-Step Execution
+
+1. Verify release images exist:
+   - `cms-web:<tag>`
+   - `cms-admin:<tag>`
+2. In Gitea Actions, run `CMS Deploy` workflow.
+3. Inputs:
+   - `environment=staging`
+   - `image_tag=<tag>`
+   - `rollback_tag=` (empty for normal deploy)
+4. Confirm workflow success.
+5. Validate staging endpoints:
+   - web base route
+   - admin login route
+6. Run smoke checks on staging:
+   - auth login
+   - i18n route/switch baseline
+   - admin dashboard route access
+7. If failure:
+   - rerun `CMS Deploy` with `rollback_tag=<previous-tag>`
+   - capture root cause and remediation notes
+
+## Evidence To Capture
+
+- Workflow run URL
+- Deployed image tag
+- Timestamp (UTC)
+- Validation results (pass/fail)
+- Rollback performed or not
+
+## Deployment Record Template
+
+Copy the block below into a new file under `docs/product-engineering/staging-deployments/`.
+
+```md
+# Staging Deployment Record - <YYYY-MM-DD>
+
+- Date (UTC):
+- Operator:
+- Workflow run URL:
+- Target environment: staging
+- Image tag:
+- Previous tag:
+
+## Preconditions
+
+- [ ] Secrets configured in Gitea
+- [ ] Registry images available
+- [ ] Remote compose path verified
+
+## Execution
+
+1. Triggered `CMS Deploy` with `environment=staging`, `image_tag=<tag>`
+2. Workflow status: <!-- pass/fail -->
+
+## Validation
+
+- [ ] Web route check
+- [ ] Admin login route check
+- [ ] Auth smoke flow
+- [ ] i18n smoke flow
+- [ ] Admin dashboard access
+
+## Rollback
+
+- Performed: <!-- yes/no -->
+- Rollback tag:
+- Rollback workflow run URL:
+
+## Outcome
+
+- Result: <!-- success/failed -->
+- Notes:
+- Follow-up actions:
+```

docs/product-engineering/user-personas-and-use-cases.md

@@ -0,0 +1,116 @@
+# User Personas And Use-Case Topics
+
+## Purpose
+
+Define who uses this CMS and which feature topics matter for each role.  
+This keeps roadmap decisions grounded in real workflows instead of isolated features.
+
+## Primary Personas
+
+### 1. Owner Artist (Primary Operator)
+
+Main goals:
+
+- publish and maintain portfolio website content
+- manage artworks, grouped collections, and featured content
+- open/close commissions and track incoming requests
+
+Core topics:
+
+- pages + navigation builder
+- media library + artwork metadata + renditions
+- announcement/banner management
+- commissions + customer records
+- news/blog updates
+
+### 2. Studio Manager / Assistant
+
+Main goals:
+
+- handle operational content updates and commission administration
+- manage customer communication and request statuses
+
+Core topics:
+
+- commission kanban and request triage
+- customer profile maintenance
+- media organization and moderation
+- limited page edits under role constraints
+
+### 3. Content Editor / Social Manager
+
+Main goals:
+
+- publish updates, news posts, and campaign visuals
+- keep public-facing content fresh without deep admin privileges
+
+Core topics:
+
+- news/blog authoring
+- announcements/promotions
+- selected media uploads and metadata edits
+- landing page block updates (where permitted)
+
+### 4. Technical Support (Protected Role)
+
+Main goals:
+
+- break-glass access for incident support
+- diagnostics and recovery support without owning business content
+
+Core topics:
+
+- support access route/key flow
+- protected account safeguards
+- operational diagnostics and rollback awareness
+
+### 5. Returning Customer (Commission Client)
+
+Main goals:
+
+- submit repeat commission requests with reduced data re-entry
+- track active request state
+
+Core topics:
+
+- customer-linked commission intake
+- commission status visibility
+- communication and requirement updates
+
+### 6. Public Visitor / Collector / Fan
+
+Main goals:
+
+- discover artwork, updates, and commission availability
+- navigate pages and portfolio smoothly
+
+Core topics:
+
+- portfolio browsing (gallery/album/tag/category)
+- announcement visibility
+- news/blog consumption
+- commission request entry points
+
+## Role-to-Feature Responsibility Map
+
+- Owner Artist:
+  all core CMS domains
+- Studio Manager:
+  commissions/customers/media operations
+- Content Editor:
+  editorial/news/announcements + constrained page/media tasks
+- Technical Support:
+  operational support only, no business ownership transfer
+- Public personas:
+  consumption and request flows on public app
+
+## Planning Guidance
+
+When adding a roadmap item, always specify:
+
+1. target persona(s)
+2. primary user outcome
+3. permissions required
+4. public impact (if any)
+
+If an item cannot be mapped to at least one clear persona outcome, it should not be prioritized.

e2e/smoke.pw.ts

@@ -1,10 +1,13 @@
 import { expect, test } from "@playwright/test"
 
+const BUILD_INFO_PATTERN = /Build v\S+ \+sha\.[a-z0-9]{5,7}/i
+
 test("smoke", async ({ page }, testInfo) => {
   await page.goto("/")
 
   if (testInfo.project.name === "web-chromium") {
     await expect(page.getByRole("heading", { name: /your next\.js cms frontend/i })).toBeVisible()
+    await expect(page.getByText(BUILD_INFO_PATTERN)).toBeVisible()
     return
   }
 
@@ -12,6 +15,7 @@ test("smoke", async ({ page }, testInfo) => {
 
   if (await dashboardHeading.isVisible({ timeout: 2000 })) {
     await expect(dashboardHeading).toBeVisible()
+    await expect(page.getByText(BUILD_INFO_PATTERN)).toBeVisible()
     return
   }
 

package.json

@@ -44,22 +44,22 @@
     "docker:production:down": "docker compose -f docker-compose.production.yml down"
   },
   "devDependencies": {
-    "@playwright/test": "1.58.2",
+    "@biomejs/biome": "2.3.14",
     "@commitlint/cli": "20.4.1",
     "@commitlint/config-conventional": "20.4.1",
+    "@playwright/test": "1.58.2",
     "@testing-library/jest-dom": "6.9.1",
     "@testing-library/react": "16.3.2",
     "@testing-library/user-event": "14.6.1",
     "@vitejs/plugin-react": "5.1.3",
     "@vitest/coverage-istanbul": "4.0.18",
-    "@biomejs/biome": "2.3.14",
+    "conventional-changelog-cli": "5.0.0",
     "jsdom": "28.0.0",
     "msw": "2.12.9",
-    "conventional-changelog-cli": "5.0.0",
+    "turbo": "^2.8.6",
-    "turbo": "2.8.3",
     "typescript": "5.9.3",
-    "vitepress": "1.6.4",
     "vite-tsconfig-paths": "6.1.0",
+    "vitepress": "1.6.4",
     "vitest": "4.0.18"
   }
 }

packages/content/src/index.ts

@@ -1,5 +1,7 @@
 import { z } from "zod"
 
+export * from "./media"
+export * from "./pages-navigation"
 export * from "./rbac"
 
 export const postStatusSchema = z.enum(["draft", "published"])

packages/content/src/media.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from "vitest"
+
+import {
+  attachArtworkRenditionInputSchema,
+  createGroupingInputSchema,
+  createMediaAssetInputSchema,
+  linkArtworkGroupingInputSchema,
+} from "./media"
+
+describe("media schemas", () => {
+  it("accepts supported media asset type payload", () => {
+    const parsed = createMediaAssetInputSchema.parse({
+      type: "artwork",
+      title: "Artwork",
+      tags: ["tag-a"],
+    })
+
+    expect(parsed.type).toBe("artwork")
+    expect(parsed.tags).toEqual(["tag-a"])
+  })
+
+  it("validates grouping link payload", () => {
+    const parsed = linkArtworkGroupingInputSchema.parse({
+      artworkId: "f40f4bcc-7148-45d7-a19d-856f7146a47e",
+      groupType: "gallery",
+      groupId: "f4e094df-0edf-4d5a-8b7b-c51f09cae95e",
+    })
+
+    expect(parsed.groupType).toBe("gallery")
+  })
+
+  it("enforces rendition slot enum", () => {
+    const parsed = attachArtworkRenditionInputSchema.parse({
+      artworkId: "f40f4bcc-7148-45d7-a19d-856f7146a47e",
+      mediaAssetId: "f4e094df-0edf-4d5a-8b7b-c51f09cae95e",
+      slot: "thumbnail",
+    })
+
+    expect(parsed.slot).toBe("thumbnail")
+  })
+
+  it("supports grouping defaults", () => {
+    const parsed = createGroupingInputSchema.parse({
+      name: "Featured",
+      slug: "featured",
+    })
+
+    expect(parsed.sortOrder).toBe(0)
+    expect(parsed.isVisible).toBe(true)
+  })
+})

packages/content/src/media.ts

@@ -0,0 +1,90 @@
+import { z } from "zod"
+
+export const mediaAssetTypeSchema = z.enum([
+  "artwork",
+  "banner",
+  "promotion",
+  "video",
+  "gif",
+  "generic",
+])
+
+export const artworkRenditionSlotSchema = z.enum(["thumbnail", "card", "full", "custom"])
+
+export const createMediaAssetInputSchema = z.object({
+  id: z.string().uuid().optional(),
+  type: mediaAssetTypeSchema,
+  title: z.string().min(1).max(180),
+  description: z.string().max(5000).optional(),
+  altText: z.string().max(1000).optional(),
+  source: z.string().max(500).optional(),
+  copyright: z.string().max(500).optional(),
+  author: z.string().max(180).optional(),
+  tags: z.array(z.string().min(1).max(100)).default([]),
+  storageKey: z.string().max(500).optional(),
+  mimeType: z.string().max(180).optional(),
+  sizeBytes: z.number().int().min(0).optional(),
+  width: z.number().int().positive().optional(),
+  height: z.number().int().positive().optional(),
+  isPublished: z.boolean().optional(),
+})
+
+export const updateMediaAssetInputSchema = z.object({
+  id: z.string().uuid(),
+  type: mediaAssetTypeSchema.optional(),
+  title: z.string().min(1).max(180).optional(),
+  description: z.string().max(5000).nullable().optional(),
+  altText: z.string().max(1000).nullable().optional(),
+  source: z.string().max(500).nullable().optional(),
+  copyright: z.string().max(500).nullable().optional(),
+  author: z.string().max(180).nullable().optional(),
+  tags: z.array(z.string().min(1).max(100)).optional(),
+  mimeType: z.string().max(180).nullable().optional(),
+  width: z.number().int().positive().nullable().optional(),
+  height: z.number().int().positive().nullable().optional(),
+  sizeBytes: z.number().int().min(0).nullable().optional(),
+  isPublished: z.boolean().optional(),
+})
+
+export const createArtworkInputSchema = z.object({
+  title: z.string().min(1).max(180),
+  slug: z.string().min(1).max(180),
+  description: z.string().max(5000).optional(),
+  medium: z.string().max(180).optional(),
+  dimensions: z.string().max(180).optional(),
+  year: z.number().int().min(1000).max(9999).optional(),
+  framing: z.string().max(180).optional(),
+  availability: z.string().max(180).optional(),
+})
+
+export const createGroupingInputSchema = z.object({
+  name: z.string().min(1).max(180),
+  slug: z.string().min(1).max(180),
+  description: z.string().max(5000).optional(),
+  sortOrder: z.number().int().min(0).default(0),
+  isVisible: z.boolean().default(true),
+})
+
+export const linkArtworkGroupingInputSchema = z.object({
+  artworkId: z.string().uuid(),
+  groupType: z.enum(["gallery", "album", "category", "tag"]),
+  groupId: z.string().uuid(),
+})
+
+export const attachArtworkRenditionInputSchema = z.object({
+  artworkId: z.string().uuid(),
+  mediaAssetId: z.string().uuid(),
+  slot: artworkRenditionSlotSchema,
+  width: z.number().int().positive().optional(),
+  height: z.number().int().positive().optional(),
+  isPrimary: z.boolean().default(false),
+})
+
+export type MediaAssetType = z.infer<typeof mediaAssetTypeSchema>
+export type ArtworkRenditionSlot = z.infer<typeof artworkRenditionSlotSchema>
+export type CreateMediaAssetInput = z.infer<typeof createMediaAssetInputSchema>
+export type UpdateMediaAssetInput = z.infer<typeof updateMediaAssetInputSchema>
+export type CreateArtworkInput = z.infer<typeof createArtworkInputSchema>
+export type CreateGroupingInput = z.infer<typeof createGroupingInputSchema>
+export type LinkArtworkGroupingInput = z.infer<typeof linkArtworkGroupingInputSchema>
+export type AttachArtworkRenditionInput = z.infer<typeof attachArtworkRenditionInputSchema>

packages/content/src/pages-navigation.ts

@@ -0,0 +1,57 @@
+import { z } from "zod"
+
+export const pageStatusSchema = z.enum(["draft", "published"])
+
+export const createPageInputSchema = z.object({
+  title: z.string().min(1).max(180),
+  slug: z.string().min(1).max(180),
+  status: pageStatusSchema.default("draft"),
+  summary: z.string().max(500).nullable().optional(),
+  content: z.string().min(1),
+  seoTitle: z.string().max(180).nullable().optional(),
+  seoDescription: z.string().max(320).nullable().optional(),
+})
+
+export const updatePageInputSchema = z.object({
+  id: z.string().uuid(),
+  title: z.string().min(1).max(180).optional(),
+  slug: z.string().min(1).max(180).optional(),
+  status: pageStatusSchema.optional(),
+  summary: z.string().max(500).nullable().optional(),
+  content: z.string().min(1).optional(),
+  seoTitle: z.string().max(180).nullable().optional(),
+  seoDescription: z.string().max(320).nullable().optional(),
+})
+
+export const createNavigationMenuInputSchema = z.object({
+  name: z.string().min(1).max(180),
+  slug: z.string().min(1).max(180),
+  location: z.string().min(1).max(80).default("primary"),
+  isVisible: z.boolean().default(true),
+})
+
+export const createNavigationItemInputSchema = z.object({
+  menuId: z.string().uuid(),
+  label: z.string().min(1).max(180),
+  href: z.string().max(500).nullable().optional(),
+  pageId: z.string().uuid().nullable().optional(),
+  parentId: z.string().uuid().nullable().optional(),
+  sortOrder: z.number().int().min(0).default(0),
+  isVisible: z.boolean().default(true),
+})
+
+export const updateNavigationItemInputSchema = z.object({
+  id: z.string().uuid(),
+  label: z.string().min(1).max(180).optional(),
+  href: z.string().max(500).nullable().optional(),
+  pageId: z.string().uuid().nullable().optional(),
+  parentId: z.string().uuid().nullable().optional(),
+  sortOrder: z.number().int().min(0).optional(),
+  isVisible: z.boolean().optional(),
+})
+
+export type CreatePageInput = z.infer<typeof createPageInputSchema>
+export type UpdatePageInput = z.infer<typeof updatePageInputSchema>
+export type CreateNavigationMenuInput = z.infer<typeof createNavigationMenuInputSchema>
+export type CreateNavigationItemInput = z.infer<typeof createNavigationItemInputSchema>
+export type UpdateNavigationItemInput = z.infer<typeof updateNavigationItemInputSchema>

packages/db/prisma/migrations/20260211214457_media_foundation/migration.sql

@@ -0,0 +1,235 @@
+-- CreateTable
+CREATE TABLE "MediaAsset" (
+    "id" TEXT NOT NULL,
+    "type" TEXT NOT NULL,
+    "title" TEXT NOT NULL,
+    "description" TEXT,
+    "altText" TEXT,
+    "source" TEXT,
+    "copyright" TEXT,
+    "author" TEXT,
+    "tags" TEXT[],
+    "storageKey" TEXT,
+    "mimeType" TEXT,
+    "width" INTEGER,
+    "height" INTEGER,
+    "sizeBytes" INTEGER,
+    "isPublished" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "MediaAsset_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "Artwork" (
+    "id" TEXT NOT NULL,
+    "title" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "description" TEXT,
+    "medium" TEXT,
+    "dimensions" TEXT,
+    "year" INTEGER,
+    "framing" TEXT,
+    "availability" TEXT,
+    "isPublished" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "Artwork_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "ArtworkRendition" (
+    "id" TEXT NOT NULL,
+    "artworkId" TEXT NOT NULL,
+    "mediaAssetId" TEXT NOT NULL,
+    "slot" TEXT NOT NULL,
+    "width" INTEGER,
+    "height" INTEGER,
+    "isPrimary" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "ArtworkRendition_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "Gallery" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "description" TEXT,
+    "sortOrder" INTEGER NOT NULL DEFAULT 0,
+    "isVisible" BOOLEAN NOT NULL DEFAULT true,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "Gallery_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "Album" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "description" TEXT,
+    "sortOrder" INTEGER NOT NULL DEFAULT 0,
+    "isVisible" BOOLEAN NOT NULL DEFAULT true,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "Album_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "Category" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "description" TEXT,
+    "sortOrder" INTEGER NOT NULL DEFAULT 0,
+    "isVisible" BOOLEAN NOT NULL DEFAULT true,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "Category_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "Tag" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "Tag_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "ArtworkGallery" (
+    "id" TEXT NOT NULL,
+    "artworkId" TEXT NOT NULL,
+    "galleryId" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "ArtworkGallery_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "ArtworkAlbum" (
+    "id" TEXT NOT NULL,
+    "artworkId" TEXT NOT NULL,
+    "albumId" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "ArtworkAlbum_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "ArtworkCategory" (
+    "id" TEXT NOT NULL,
+    "artworkId" TEXT NOT NULL,
+    "categoryId" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "ArtworkCategory_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "ArtworkTag" (
+    "id" TEXT NOT NULL,
+    "artworkId" TEXT NOT NULL,
+    "tagId" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "ArtworkTag_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "MediaAsset_storageKey_key" ON "MediaAsset"("storageKey");
+
+-- CreateIndex
+CREATE INDEX "MediaAsset_type_idx" ON "MediaAsset"("type");
+
+-- CreateIndex
+CREATE INDEX "MediaAsset_isPublished_idx" ON "MediaAsset"("isPublished");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Artwork_slug_key" ON "Artwork"("slug");
+
+-- CreateIndex
+CREATE INDEX "Artwork_isPublished_idx" ON "Artwork"("isPublished");
+
+-- CreateIndex
+CREATE INDEX "ArtworkRendition_mediaAssetId_idx" ON "ArtworkRendition"("mediaAssetId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "ArtworkRendition_artworkId_slot_key" ON "ArtworkRendition"("artworkId", "slot");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Gallery_slug_key" ON "Gallery"("slug");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Album_slug_key" ON "Album"("slug");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Category_slug_key" ON "Category"("slug");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Tag_slug_key" ON "Tag"("slug");
+
+-- CreateIndex
+CREATE INDEX "ArtworkGallery_galleryId_idx" ON "ArtworkGallery"("galleryId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "ArtworkGallery_artworkId_galleryId_key" ON "ArtworkGallery"("artworkId", "galleryId");
+
+-- CreateIndex
+CREATE INDEX "ArtworkAlbum_albumId_idx" ON "ArtworkAlbum"("albumId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "ArtworkAlbum_artworkId_albumId_key" ON "ArtworkAlbum"("artworkId", "albumId");
+
+-- CreateIndex
+CREATE INDEX "ArtworkCategory_categoryId_idx" ON "ArtworkCategory"("categoryId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "ArtworkCategory_artworkId_categoryId_key" ON "ArtworkCategory"("artworkId", "categoryId");
+
+-- CreateIndex
+CREATE INDEX "ArtworkTag_tagId_idx" ON "ArtworkTag"("tagId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "ArtworkTag_artworkId_tagId_key" ON "ArtworkTag"("artworkId", "tagId");
+
+-- AddForeignKey
+ALTER TABLE "ArtworkRendition" ADD CONSTRAINT "ArtworkRendition_artworkId_fkey" FOREIGN KEY ("artworkId") REFERENCES "Artwork"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ArtworkRendition" ADD CONSTRAINT "ArtworkRendition_mediaAssetId_fkey" FOREIGN KEY ("mediaAssetId") REFERENCES "MediaAsset"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ArtworkGallery" ADD CONSTRAINT "ArtworkGallery_artworkId_fkey" FOREIGN KEY ("artworkId") REFERENCES "Artwork"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ArtworkGallery" ADD CONSTRAINT "ArtworkGallery_galleryId_fkey" FOREIGN KEY ("galleryId") REFERENCES "Gallery"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ArtworkAlbum" ADD CONSTRAINT "ArtworkAlbum_artworkId_fkey" FOREIGN KEY ("artworkId") REFERENCES "Artwork"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ArtworkAlbum" ADD CONSTRAINT "ArtworkAlbum_albumId_fkey" FOREIGN KEY ("albumId") REFERENCES "Album"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ArtworkCategory" ADD CONSTRAINT "ArtworkCategory_artworkId_fkey" FOREIGN KEY ("artworkId") REFERENCES "Artwork"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ArtworkCategory" ADD CONSTRAINT "ArtworkCategory_categoryId_fkey" FOREIGN KEY ("categoryId") REFERENCES "Category"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ArtworkTag" ADD CONSTRAINT "ArtworkTag_artworkId_fkey" FOREIGN KEY ("artworkId") REFERENCES "Artwork"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ArtworkTag" ADD CONSTRAINT "ArtworkTag_tagId_fkey" FOREIGN KEY ("tagId") REFERENCES "Tag"("id") ON DELETE CASCADE ON UPDATE CASCADE;

packages/db/prisma/migrations/20260212190000_pages_navigation_builder/migration.sql

@@ -0,0 +1,75 @@
+-- CreateTable
+CREATE TABLE "Page" (
+    "id" TEXT NOT NULL,
+    "title" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "status" TEXT NOT NULL,
+    "summary" TEXT,
+    "content" TEXT NOT NULL,
+    "seoTitle" TEXT,
+    "seoDescription" TEXT,
+    "publishedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "Page_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "NavigationMenu" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "location" TEXT NOT NULL,
+    "isVisible" BOOLEAN NOT NULL DEFAULT true,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "NavigationMenu_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "NavigationItem" (
+    "id" TEXT NOT NULL,
+    "menuId" TEXT NOT NULL,
+    "pageId" TEXT,
+    "label" TEXT NOT NULL,
+    "href" TEXT,
+    "parentId" TEXT,
+    "sortOrder" INTEGER NOT NULL DEFAULT 0,
+    "isVisible" BOOLEAN NOT NULL DEFAULT true,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "NavigationItem_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Page_slug_key" ON "Page"("slug");
+
+-- CreateIndex
+CREATE INDEX "Page_status_idx" ON "Page"("status");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "NavigationMenu_slug_key" ON "NavigationMenu"("slug");
+
+-- CreateIndex
+CREATE INDEX "NavigationItem_menuId_idx" ON "NavigationItem"("menuId");
+
+-- CreateIndex
+CREATE INDEX "NavigationItem_pageId_idx" ON "NavigationItem"("pageId");
+
+-- CreateIndex
+CREATE INDEX "NavigationItem_parentId_idx" ON "NavigationItem"("parentId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "NavigationItem_menuId_parentId_sortOrder_label_key" ON "NavigationItem"("menuId", "parentId", "sortOrder", "label");
+
+-- AddForeignKey
+ALTER TABLE "NavigationItem" ADD CONSTRAINT "NavigationItem_menuId_fkey" FOREIGN KEY ("menuId") REFERENCES "NavigationMenu"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "NavigationItem" ADD CONSTRAINT "NavigationItem_pageId_fkey" FOREIGN KEY ("pageId") REFERENCES "Page"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "NavigationItem" ADD CONSTRAINT "NavigationItem_parentId_fkey" FOREIGN KEY ("parentId") REFERENCES "NavigationItem"("id") ON DELETE CASCADE ON UPDATE CASCADE;

packages/db/prisma/schema.prisma

@@ -1,5 +1,6 @@
 generator client {
-  provider = "prisma-client-js"
+  provider = "prisma-client"
+  output   = "./generated/client"
 }
 
 datasource db {
@@ -95,3 +96,209 @@ model SystemSetting {
 
   @@map("system_setting")
 }
+
+model MediaAsset {
+  id              String            @id @default(uuid())
+  type            String
+  title           String
+  description     String?
+  altText         String?
+  source          String?
+  copyright       String?
+  author          String?
+  tags            String[]
+  storageKey      String?           @unique
+  mimeType        String?
+  width           Int?
+  height          Int?
+  sizeBytes       Int?
+  isPublished     Boolean           @default(false)
+  createdAt       DateTime          @default(now())
+  updatedAt       DateTime          @updatedAt
+  artworkLinks    ArtworkRendition[]
+
+  @@index([type])
+  @@index([isPublished])
+}
+
+model Artwork {
+  id             String            @id @default(uuid())
+  title          String
+  slug           String            @unique
+  description    String?
+  medium         String?
+  dimensions     String?
+  year           Int?
+  framing        String?
+  availability   String?
+  isPublished    Boolean           @default(false)
+  createdAt      DateTime          @default(now())
+  updatedAt      DateTime          @updatedAt
+  renditions     ArtworkRendition[]
+  galleryLinks   ArtworkGallery[]
+  albumLinks     ArtworkAlbum[]
+  categoryLinks  ArtworkCategory[]
+  tagLinks       ArtworkTag[]
+
+  @@index([isPublished])
+}
+
+model ArtworkRendition {
+  id           String     @id @default(uuid())
+  artworkId    String
+  mediaAssetId String
+  slot         String
+  width        Int?
+  height       Int?
+  isPrimary    Boolean    @default(false)
+  createdAt    DateTime   @default(now())
+  updatedAt    DateTime   @updatedAt
+  artwork      Artwork    @relation(fields: [artworkId], references: [id], onDelete: Cascade)
+  mediaAsset   MediaAsset @relation(fields: [mediaAssetId], references: [id], onDelete: Cascade)
+
+  @@unique([artworkId, slot])
+  @@index([mediaAssetId])
+}
+
+model Gallery {
+  id           String          @id @default(uuid())
+  name         String
+  slug         String          @unique
+  description  String?
+  sortOrder    Int             @default(0)
+  isVisible    Boolean         @default(true)
+  createdAt    DateTime        @default(now())
+  updatedAt    DateTime        @updatedAt
+  artworkLinks ArtworkGallery[]
+}
+
+model Album {
+  id           String        @id @default(uuid())
+  name         String
+  slug         String        @unique
+  description  String?
+  sortOrder    Int           @default(0)
+  isVisible    Boolean       @default(true)
+  createdAt    DateTime      @default(now())
+  updatedAt    DateTime      @updatedAt
+  artworkLinks ArtworkAlbum[]
+}
+
+model Category {
+  id           String            @id @default(uuid())
+  name         String
+  slug         String            @unique
+  description  String?
+  sortOrder    Int               @default(0)
+  isVisible    Boolean           @default(true)
+  createdAt    DateTime          @default(now())
+  updatedAt    DateTime          @updatedAt
+  artworkLinks ArtworkCategory[]
+}
+
+model Tag {
+  id           String       @id @default(uuid())
+  name         String
+  slug         String       @unique
+  createdAt    DateTime     @default(now())
+  updatedAt    DateTime     @updatedAt
+  artworkLinks ArtworkTag[]
+}
+
+model ArtworkGallery {
+  id        String   @id @default(uuid())
+  artworkId String
+  galleryId String
+  createdAt DateTime @default(now())
+  artwork   Artwork  @relation(fields: [artworkId], references: [id], onDelete: Cascade)
+  gallery   Gallery  @relation(fields: [galleryId], references: [id], onDelete: Cascade)
+
+  @@unique([artworkId, galleryId])
+  @@index([galleryId])
+}
+
+model ArtworkAlbum {
+  id        String   @id @default(uuid())
+  artworkId String
+  albumId   String
+  createdAt DateTime @default(now())
+  artwork   Artwork  @relation(fields: [artworkId], references: [id], onDelete: Cascade)
+  album     Album    @relation(fields: [albumId], references: [id], onDelete: Cascade)
+
+  @@unique([artworkId, albumId])
+  @@index([albumId])
+}
+
+model ArtworkCategory {
+  id         String   @id @default(uuid())
+  artworkId  String
+  categoryId String
+  createdAt  DateTime @default(now())
+  artwork    Artwork  @relation(fields: [artworkId], references: [id], onDelete: Cascade)
+  category   Category @relation(fields: [categoryId], references: [id], onDelete: Cascade)
+
+  @@unique([artworkId, categoryId])
+  @@index([categoryId])
+}
+
+model ArtworkTag {
+  id        String   @id @default(uuid())
+  artworkId String
+  tagId     String
+  createdAt DateTime @default(now())
+  artwork   Artwork  @relation(fields: [artworkId], references: [id], onDelete: Cascade)
+  tag       Tag      @relation(fields: [tagId], references: [id], onDelete: Cascade)
+
+  @@unique([artworkId, tagId])
+  @@index([tagId])
+}
+
+model Page {
+  id             String   @id @default(uuid())
+  title          String
+  slug           String   @unique
+  status         String
+  summary        String?
+  content        String
+  seoTitle       String?
+  seoDescription String?
+  publishedAt    DateTime?
+  createdAt      DateTime @default(now())
+  updatedAt      DateTime @updatedAt
+  navItems       NavigationItem[]
+
+  @@index([status])
+}
+
+model NavigationMenu {
+  id        String           @id @default(uuid())
+  name      String
+  slug      String           @unique
+  location  String
+  isVisible Boolean          @default(true)
+  createdAt DateTime         @default(now())
+  updatedAt DateTime         @updatedAt
+  items     NavigationItem[]
+}
+
+model NavigationItem {
+  id        String           @id @default(uuid())
+  menuId    String
+  pageId    String?
+  label     String
+  href      String?
+  parentId  String?
+  sortOrder Int              @default(0)
+  isVisible Boolean          @default(true)
+  createdAt DateTime         @default(now())
+  updatedAt DateTime         @updatedAt
+  menu      NavigationMenu   @relation(fields: [menuId], references: [id], onDelete: Cascade)
+  page      Page?            @relation(fields: [pageId], references: [id], onDelete: SetNull)
+  parent    NavigationItem?  @relation("NavigationItemParent", fields: [parentId], references: [id], onDelete: Cascade)
+  children  NavigationItem[] @relation("NavigationItemParent")
+
+  @@index([menuId])
+  @@index([pageId])
+  @@index([parentId])
+  @@unique([menuId, parentId, sortOrder, label])
+}

packages/db/prisma/seed.ts

@@ -13,6 +13,75 @@ async function main() {
     },
   })
 
+  const media = await db.mediaAsset.upsert({
+    where: { storageKey: "seed/artwork-welcome.jpg" },
+    update: {},
+    create: {
+      type: "artwork",
+      title: "Seed Artwork Image",
+      altText: "Seed artwork placeholder",
+      tags: ["seed", "portfolio"],
+      storageKey: "seed/artwork-welcome.jpg",
+      mimeType: "image/jpeg",
+      isPublished: true,
+    },
+  })
+
+  const artwork = await db.artwork.upsert({
+    where: { slug: "seed-artwork-welcome" },
+    update: {},
+    create: {
+      title: "Seed Artwork",
+      slug: "seed-artwork-welcome",
+      description: "Baseline seeded artwork for MVP1 media foundation.",
+      medium: "Digital",
+      year: 2026,
+      availability: "available",
+      isPublished: true,
+    },
+  })
+
+  const gallery = await db.gallery.upsert({
+    where: { slug: "featured" },
+    update: {},
+    create: {
+      name: "Featured",
+      slug: "featured",
+      description: "Featured artwork selection.",
+      isVisible: true,
+    },
+  })
+
+  await db.artworkGallery.upsert({
+    where: {
+      artworkId_galleryId: {
+        artworkId: artwork.id,
+        galleryId: gallery.id,
+      },
+    },
+    create: {
+      artworkId: artwork.id,
+      galleryId: gallery.id,
+    },
+    update: {},
+  })
+
+  await db.artworkRendition.upsert({
+    where: {
+      artworkId_slot: {
+        artworkId: artwork.id,
+        slot: "thumbnail",
+      },
+    },
+    create: {
+      artworkId: artwork.id,
+      mediaAssetId: media.id,
+      slot: "thumbnail",
+      isPrimary: true,
+    },
+    update: {},
+  })
+
   await db.systemSetting.upsert({
     where: { key: "public.header_banner" },
     update: {},
@@ -26,6 +95,69 @@ async function main() {
       }),
     },
   })
+
+  const homePage = await db.page.upsert({
+    where: { slug: "home" },
+    update: {},
+    create: {
+      title: "Home",
+      slug: "home",
+      status: "published",
+      summary: "Default homepage seeded for pages/navigation baseline.",
+      content: "Welcome to your new artist CMS homepage.",
+      seoTitle: "Home",
+      seoDescription: "Seeded homepage",
+      publishedAt: new Date(),
+    },
+  })
+
+  const primaryMenu = await db.navigationMenu.upsert({
+    where: { slug: "primary" },
+    update: {},
+    create: {
+      name: "Primary",
+      slug: "primary",
+      location: "header",
+      isVisible: true,
+    },
+  })
+
+  const existingHomeItem = await db.navigationItem.findFirst({
+    where: {
+      menuId: primaryMenu.id,
+      parentId: null,
+      sortOrder: 0,
+      label: "Home",
+    },
+    select: {
+      id: true,
+    },
+  })
+
+  if (existingHomeItem) {
+    await db.navigationItem.update({
+      where: {
+        id: existingHomeItem.id,
+      },
+      data: {
+        pageId: homePage.id,
+        href: "/",
+        isVisible: true,
+      },
+    })
+  } else {
+    await db.navigationItem.create({
+      data: {
+        menuId: primaryMenu.id,
+        label: "Home",
+        href: "/",
+        pageId: homePage.id,
+        parentId: null,
+        sortOrder: 0,
+        isVisible: true,
+      },
+    })
+  }
 }
 
 main()

packages/db/src/client.ts

@@ -1,6 +1,6 @@
 import { PrismaPg } from "@prisma/adapter-pg"
-import { PrismaClient } from "@prisma/client"
 import { Pool } from "pg"
+import { PrismaClient } from "../prisma/generated/client/client"
 
 const connectionString = process.env.DATABASE_URL
 

packages/db/src/index.ts

@@ -1,4 +1,33 @@
 export { db } from "./client"
+export {
+  attachArtworkRendition,
+  createAlbum,
+  createArtwork,
+  createCategory,
+  createGallery,
+  createMediaAsset,
+  createTag,
+  deleteMediaAsset,
+  getMediaAssetById,
+  getMediaFoundationSummary,
+  linkArtworkToGrouping,
+  listArtworks,
+  listMediaAssets,
+  listMediaFoundationGroups,
+  updateMediaAsset,
+} from "./media-foundation"
+export {
+  createNavigationItem,
+  createNavigationMenu,
+  createPage,
+  deleteNavigationItem,
+  deletePage,
+  getPageById,
+  listNavigationMenus,
+  listPages,
+  updateNavigationItem,
+  updatePage,
+} from "./pages-navigation"
 export {
   createPost,
   deletePost,

packages/db/src/media-foundation.test.ts

@@ -0,0 +1,123 @@
+import { beforeEach, describe, expect, it, vi } from "vitest"
+
+const { mockDb } = vi.hoisted(() => ({
+  mockDb: {
+    artworkGallery: { upsert: vi.fn() },
+    artworkAlbum: { upsert: vi.fn() },
+    artworkCategory: { upsert: vi.fn() },
+    artworkTag: { upsert: vi.fn() },
+    artworkRendition: { upsert: vi.fn() },
+    mediaAsset: { create: vi.fn(), findUnique: vi.fn(), update: vi.fn(), delete: vi.fn() },
+    artwork: { create: vi.fn() },
+    gallery: { create: vi.fn() },
+    album: { create: vi.fn() },
+    category: { create: vi.fn() },
+    tag: { create: vi.fn() },
+  },
+}))
+
+vi.mock("./client", () => ({
+  db: mockDb,
+}))
+
+import {
+  attachArtworkRendition,
+  createArtwork,
+  createMediaAsset,
+  deleteMediaAsset,
+  getMediaAssetById,
+  linkArtworkToGrouping,
+  updateMediaAsset,
+} from "./media-foundation"
+
+describe("media foundation service", () => {
+  beforeEach(() => {
+    for (const value of Object.values(mockDb)) {
+      if ("upsert" in value) {
+        value.upsert.mockReset()
+      }
+      if ("create" in value) {
+        value.create.mockReset()
+      }
+      if ("findUnique" in value) {
+        value.findUnique.mockReset()
+      }
+      if ("update" in value) {
+        value.update.mockReset()
+      }
+      if ("delete" in value) {
+        value.delete.mockReset()
+      }
+    }
+  })
+
+  it("routes grouping links to the correct link table", async () => {
+    mockDb.artworkAlbum.upsert.mockResolvedValue({ id: "link" })
+
+    await linkArtworkToGrouping({
+      artworkId: "f40f4bcc-7148-45d7-a19d-856f7146a47e",
+      groupType: "album",
+      groupId: "f4e094df-0edf-4d5a-8b7b-c51f09cae95e",
+    })
+
+    expect(mockDb.artworkAlbum.upsert).toHaveBeenCalledTimes(1)
+    expect(mockDb.artworkGallery.upsert).not.toHaveBeenCalled()
+  })
+
+  it("upserts rendition by artwork and slot", async () => {
+    mockDb.artworkRendition.upsert.mockResolvedValue({ id: "rendition" })
+
+    await attachArtworkRendition({
+      artworkId: "f40f4bcc-7148-45d7-a19d-856f7146a47e",
+      mediaAssetId: "f4e094df-0edf-4d5a-8b7b-c51f09cae95e",
+      slot: "thumbnail",
+      isPrimary: true,
+    })
+
+    expect(mockDb.artworkRendition.upsert).toHaveBeenCalledTimes(1)
+    expect(mockDb.artworkRendition.upsert.mock.calls[0]?.[0]).toMatchObject({
+      where: {
+        artworkId_slot: {
+          artworkId: "f40f4bcc-7148-45d7-a19d-856f7146a47e",
+          slot: "thumbnail",
+        },
+      },
+    })
+  })
+
+  it("parses and forwards media and artwork creation payloads", async () => {
+    mockDb.mediaAsset.create.mockResolvedValue({ id: "asset" })
+    mockDb.artwork.create.mockResolvedValue({ id: "artwork" })
+
+    await createMediaAsset({
+      type: "generic",
+      title: "Asset",
+      tags: [],
+    })
+    await createArtwork({
+      title: "Artwork",
+      slug: "artwork",
+    })
+
+    expect(mockDb.mediaAsset.create).toHaveBeenCalledTimes(1)
+    expect(mockDb.artwork.create).toHaveBeenCalledTimes(1)
+  })
+
+  it("handles media asset read/update/delete operations", async () => {
+    mockDb.mediaAsset.findUnique.mockResolvedValue({ id: "asset-1" })
+    mockDb.mediaAsset.update.mockResolvedValue({ id: "asset-1", title: "Updated" })
+    mockDb.mediaAsset.delete.mockResolvedValue({ id: "asset-1" })
+
+    await getMediaAssetById("asset-1")
+    await updateMediaAsset({
+      id: "c58f3aca-f958-4079-b2df-c9edf3a5fb0a",
+      title: "Updated",
+      tags: ["a", "b"],
+    })
+    await deleteMediaAsset("asset-1")
+
+    expect(mockDb.mediaAsset.findUnique).toHaveBeenCalledTimes(1)
+    expect(mockDb.mediaAsset.update).toHaveBeenCalledTimes(1)
+    expect(mockDb.mediaAsset.delete).toHaveBeenCalledTimes(1)
+  })
+})

packages/db/src/media-foundation.ts

@@ -0,0 +1,282 @@
+import {
+  attachArtworkRenditionInputSchema,
+  createArtworkInputSchema,
+  createGroupingInputSchema,
+  createMediaAssetInputSchema,
+  linkArtworkGroupingInputSchema,
+  updateMediaAssetInputSchema,
+} from "@cms/content"
+
+import { db } from "./client"
+
+export async function listMediaAssets(limit = 24) {
+  return db.mediaAsset.findMany({
+    orderBy: { updatedAt: "desc" },
+    take: limit,
+  })
+}
+
+export async function listArtworks(limit = 24) {
+  return db.artwork.findMany({
+    orderBy: { updatedAt: "desc" },
+    take: limit,
+    include: {
+      renditions: {
+        select: {
+          id: true,
+          slot: true,
+          mediaAssetId: true,
+        },
+      },
+      galleryLinks: {
+        include: {
+          gallery: {
+            select: {
+              id: true,
+              name: true,
+              slug: true,
+            },
+          },
+        },
+      },
+      albumLinks: {
+        include: {
+          album: {
+            select: {
+              id: true,
+              name: true,
+              slug: true,
+            },
+          },
+        },
+      },
+      categoryLinks: {
+        include: {
+          category: {
+            select: {
+              id: true,
+              name: true,
+              slug: true,
+            },
+          },
+        },
+      },
+      tagLinks: {
+        include: {
+          tag: {
+            select: {
+              id: true,
+              name: true,
+              slug: true,
+            },
+          },
+        },
+      },
+    },
+  })
+}
+
+export async function listMediaFoundationGroups() {
+  const [galleries, albums, categories, tags] = await Promise.all([
+    db.gallery.findMany({
+      orderBy: [{ sortOrder: "asc" }, { name: "asc" }],
+    }),
+    db.album.findMany({
+      orderBy: [{ sortOrder: "asc" }, { name: "asc" }],
+    }),
+    db.category.findMany({
+      orderBy: [{ sortOrder: "asc" }, { name: "asc" }],
+    }),
+    db.tag.findMany({
+      orderBy: { name: "asc" },
+    }),
+  ])
+
+  return {
+    galleries,
+    albums,
+    categories,
+    tags,
+  }
+}
+
+export async function createMediaAsset(input: unknown) {
+  const payload = createMediaAssetInputSchema.parse(input)
+
+  return db.mediaAsset.create({
+    data: payload,
+  })
+}
+
+export async function getMediaAssetById(id: string) {
+  return db.mediaAsset.findUnique({
+    where: { id },
+  })
+}
+
+export async function updateMediaAsset(input: unknown) {
+  const payload = updateMediaAssetInputSchema.parse(input)
+  const { id, ...data } = payload
+
+  return db.mediaAsset.update({
+    where: { id },
+    data,
+  })
+}
+
+export async function deleteMediaAsset(id: string) {
+  return db.mediaAsset.delete({
+    where: { id },
+  })
+}
+
+export async function createArtwork(input: unknown) {
+  const payload = createArtworkInputSchema.parse(input)
+
+  return db.artwork.create({
+    data: payload,
+  })
+}
+
+export async function createGallery(input: unknown) {
+  const payload = createGroupingInputSchema.parse(input)
+
+  return db.gallery.create({
+    data: payload,
+  })
+}
+
+export async function createAlbum(input: unknown) {
+  const payload = createGroupingInputSchema.parse(input)
+
+  return db.album.create({
+    data: payload,
+  })
+}
+
+export async function createCategory(input: unknown) {
+  const payload = createGroupingInputSchema.parse(input)
+
+  return db.category.create({
+    data: payload,
+  })
+}
+
+export async function createTag(input: unknown) {
+  const payload = createGroupingInputSchema
+    .pick({
+      name: true,
+      slug: true,
+    })
+    .parse(input)
+
+  return db.tag.create({
+    data: payload,
+  })
+}
+
+export async function linkArtworkToGrouping(input: unknown) {
+  const payload = linkArtworkGroupingInputSchema.parse(input)
+
+  if (payload.groupType === "gallery") {
+    return db.artworkGallery.upsert({
+      where: {
+        artworkId_galleryId: {
+          artworkId: payload.artworkId,
+          galleryId: payload.groupId,
+        },
+      },
+      create: {
+        artworkId: payload.artworkId,
+        galleryId: payload.groupId,
+      },
+      update: {},
+    })
+  }
+
+  if (payload.groupType === "album") {
+    return db.artworkAlbum.upsert({
+      where: {
+        artworkId_albumId: {
+          artworkId: payload.artworkId,
+          albumId: payload.groupId,
+        },
+      },
+      create: {
+        artworkId: payload.artworkId,
+        albumId: payload.groupId,
+      },
+      update: {},
+    })
+  }
+
+  if (payload.groupType === "category") {
+    return db.artworkCategory.upsert({
+      where: {
+        artworkId_categoryId: {
+          artworkId: payload.artworkId,
+          categoryId: payload.groupId,
+        },
+      },
+      create: {
+        artworkId: payload.artworkId,
+        categoryId: payload.groupId,
+      },
+      update: {},
+    })
+  }
+
+  return db.artworkTag.upsert({
+    where: {
+      artworkId_tagId: {
+        artworkId: payload.artworkId,
+        tagId: payload.groupId,
+      },
+    },
+    create: {
+      artworkId: payload.artworkId,
+      tagId: payload.groupId,
+    },
+    update: {},
+  })
+}
+
+export async function attachArtworkRendition(input: unknown) {
+  const payload = attachArtworkRenditionInputSchema.parse(input)
+
+  return db.artworkRendition.upsert({
+    where: {
+      artworkId_slot: {
+        artworkId: payload.artworkId,
+        slot: payload.slot,
+      },
+    },
+    create: payload,
+    update: {
+      mediaAssetId: payload.mediaAssetId,
+      width: payload.width,
+      height: payload.height,
+      isPrimary: payload.isPrimary,
+    },
+  })
+}
+
+export async function getMediaFoundationSummary() {
+  const [mediaAssets, artworks, galleries, albums, categories, tags] = await Promise.all([
+    db.mediaAsset.count(),
+    db.artwork.count(),
+    db.gallery.count(),
+    db.album.count(),
+    db.category.count(),
+    db.tag.count(),
+  ])
+
+  return {
+    mediaAssets,
+    artworks,
+    galleries,
+    albums,
+    categories,
+    tags,
+  }
+}

packages/db/src/pages-navigation.test.ts

@@ -0,0 +1,92 @@
+import { beforeEach, describe, expect, it, vi } from "vitest"
+
+const { mockDb } = vi.hoisted(() => ({
+  mockDb: {
+    page: {
+      create: vi.fn(),
+      update: vi.fn(),
+      delete: vi.fn(),
+      findUnique: vi.fn(),
+      findMany: vi.fn(),
+    },
+    navigationMenu: {
+      create: vi.fn(),
+      findMany: vi.fn(),
+    },
+    navigationItem: {
+      create: vi.fn(),
+      update: vi.fn(),
+      delete: vi.fn(),
+    },
+  },
+}))
+
+vi.mock("./client", () => ({
+  db: mockDb,
+}))
+
+import {
+  createNavigationItem,
+  createNavigationMenu,
+  createPage,
+  updatePage,
+} from "./pages-navigation"
+
+describe("pages-navigation service", () => {
+  beforeEach(() => {
+    for (const value of Object.values(mockDb)) {
+      for (const fn of Object.values(value)) {
+        if (typeof fn === "function") {
+          fn.mockReset()
+        }
+      }
+    }
+  })
+
+  it("creates published pages with publishedAt", async () => {
+    mockDb.page.create.mockResolvedValue({ id: "page-1" })
+
+    await createPage({
+      title: "About",
+      slug: "about",
+      status: "published",
+      content: "hello",
+    })
+
+    expect(mockDb.page.create).toHaveBeenCalledTimes(1)
+    expect(mockDb.page.create.mock.calls[0]?.[0].data.publishedAt).toBeInstanceOf(Date)
+  })
+
+  it("updates page status publication timestamp", async () => {
+    mockDb.page.update.mockResolvedValue({ id: "page-1" })
+
+    await updatePage({
+      id: "550e8400-e29b-41d4-a716-446655440000",
+      status: "draft",
+    })
+
+    expect(mockDb.page.update).toHaveBeenCalledTimes(1)
+    expect(mockDb.page.update.mock.calls[0]?.[0].data.publishedAt).toBeNull()
+  })
+
+  it("creates menus and items with schema parsing", async () => {
+    mockDb.navigationMenu.create.mockResolvedValue({ id: "menu-1" })
+    mockDb.navigationItem.create.mockResolvedValue({ id: "item-1" })
+
+    await createNavigationMenu({
+      name: "Primary",
+      slug: "primary",
+      location: "header",
+    })
+
+    await createNavigationItem({
+      menuId: "550e8400-e29b-41d4-a716-446655440001",
+      label: "Home",
+      href: "/",
+      sortOrder: 0,
+    })
+
+    expect(mockDb.navigationMenu.create).toHaveBeenCalledTimes(1)
+    expect(mockDb.navigationItem.create).toHaveBeenCalledTimes(1)
+  })
+})

packages/db/src/pages-navigation.ts

@@ -0,0 +1,109 @@
+import {
+  createNavigationItemInputSchema,
+  createNavigationMenuInputSchema,
+  createPageInputSchema,
+  updateNavigationItemInputSchema,
+  updatePageInputSchema,
+} from "@cms/content"
+
+import { db } from "./client"
+
+function resolvePublishedAt(status: string): Date | null {
+  return status === "published" ? new Date() : null
+}
+
+export async function listPages(limit = 50) {
+  return db.page.findMany({
+    orderBy: [{ updatedAt: "desc" }],
+    take: limit,
+  })
+}
+
+export async function getPageById(id: string) {
+  return db.page.findUnique({
+    where: { id },
+  })
+}
+
+export async function createPage(input: unknown) {
+  const payload = createPageInputSchema.parse(input)
+
+  return db.page.create({
+    data: {
+      ...payload,
+      publishedAt: resolvePublishedAt(payload.status),
+    },
+  })
+}
+
+export async function updatePage(input: unknown) {
+  const payload = updatePageInputSchema.parse(input)
+  const { id, ...data } = payload
+
+  return db.page.update({
+    where: { id },
+    data: {
+      ...data,
+      publishedAt:
+        data.status === undefined ? undefined : data.status === "published" ? new Date() : null,
+    },
+  })
+}
+
+export async function deletePage(id: string) {
+  return db.page.delete({
+    where: { id },
+  })
+}
+
+export async function listNavigationMenus() {
+  return db.navigationMenu.findMany({
+    orderBy: [{ location: "asc" }, { name: "asc" }],
+    include: {
+      items: {
+        orderBy: [{ sortOrder: "asc" }, { label: "asc" }],
+        include: {
+          page: {
+            select: {
+              id: true,
+              title: true,
+              slug: true,
+            },
+          },
+        },
+      },
+    },
+  })
+}
+
+export async function createNavigationMenu(input: unknown) {
+  const payload = createNavigationMenuInputSchema.parse(input)
+
+  return db.navigationMenu.create({
+    data: payload,
+  })
+}
+
+export async function createNavigationItem(input: unknown) {
+  const payload = createNavigationItemInputSchema.parse(input)
+
+  return db.navigationItem.create({
+    data: payload,
+  })
+}
+
+export async function updateNavigationItem(input: unknown) {
+  const payload = updateNavigationItemInputSchema.parse(input)
+  const { id, ...data } = payload
+
+  return db.navigationItem.update({
+    where: { id },
+    data,
+  })
+}
+
+export async function deleteNavigationItem(id: string) {
+  return db.navigationItem.delete({
+    where: { id },
+  })
+}

packages/db/src/posts.ts

@@ -5,7 +5,7 @@ import {
   updatePostInputSchema,
 } from "@cms/content"
 import { type CrudAuditHook, type CrudMutationContext, createCrudService } from "@cms/crud"
-import type { Post } from "@prisma/client"
+import type { Post } from "../prisma/generated/client/client"
 
 import { db } from "./client"