Five things that were each one line of wrong and are cheap to hold shut.
Turnstile failed OPEN. `lib/turnstile.ts` returned true whenever
TURNSTILE_SECRET_KEY was unset, and logged the visitor's token while doing it.
Lose that variable in a deploy and the contact form quietly stops checking
anything, the only trace a warning nobody reads. Missing configuration is now a
refusal; the dev bypass survives as an explicit TURNSTILE_DEV_BYPASS=1 that a
production build ignores, rather than as a side effect of an empty variable. The
caller now distinguishes "you failed the check" from "we cannot run the check",
because telling a real visitor to refresh, when the server has no key, sends them
round a loop that cannot succeed.
The social card was being dropped by the pages that cared enough to write their
own. Next merges metadata shallowly, so a page exporting `openGraph: { title,
description }` replaces the parent's whole block, image included. Seventeen pages
did that; five had an opengraph-image.tsx to fall back on and twelve shared as a
bare grey rectangle. `pageMetadata()` takes the parts that differ and fills in
the parts that must not go missing. Built output goes from 23/51 pages carrying
og:image and 12/51 carrying twitter:image to 51/51 on both. Canonical was already
51/51 and stays there.
The sitemap was a hand-kept list and had drifted nine routes behind the site,
among them /products/{vegan-iq,suchoice,bauhaus-echo,such-moon-launch}/privacy,
which Apple and Google fetch during store review. It now walks the route tree, so
a page is advertised because it exists. Dynamic segments still come from their
data (blog posts, service pillars), and /contact is excluded WITH its reason: it
redirects, and a sitemap should name the destination rather than the door.
Result: 37 static routes, up from 28, nothing removed.
`vegan-iq-data-pipeline.mdx` was `draft: true`, which kept the most substantial
post on the site out of the index, the sitemap and generateStaticParams.
And /contact was unreachable on a first visit. It redirects to /#contact, but the
splash owns the first screen and entering it pins scroll to 0, so every inbound
contact link played the intro and dropped the visitor at the top of the homepage
with the hash discarded. A fragment that names something real on the page now
skips the splash and is honoured once, on arrival.
Verified: pnpm build green, lint clean (8 pre-existing no-img-element warnings,
none from this change), og/twitter/canonical counted in the built HTML.
The linter had two faults stacked on top of each other.
First, the global `ajv: ^8.17.1` override starved @eslint/eslintrc, which
needs ajv 6 and passes it `missingRefs`; ajv 8 rejects that option, so ESLint
died before loading a single rule. Scoped overrides give eslint and
@eslint/eslintrc ajv 6.12.6 and leave the audit override in place everywhere
else.
Second, underneath that, `extends: ["@repo/config/eslint-preset.js"]` could
never resolve: ESLint's shareable-config naming convention rewrites it to
`@repo/eslint-config-config/...`. require.resolve hands ESLint a real path.
With the linter running it reported 35 react/no-unescaped-entities errors
across 7 files. Those are escaped rather than silenced, using ESLint's own
coordinates so only flagged text nodes were touched. Lint now exits 0. Two
@next/next/no-img-element warnings remain on the splash logos, which are
deliberate: theme-paired and fetchPriority="high".
Em dashes are also gone from the six blog posts and the README (105
occurrences), same rules as the site copy: colons for definition labels,
commas for appositives, semicolons for independent clauses.
jwinterm