Feature/marketing website

.dockerignore

@@ -3,7 +3,6 @@
 __pycache__/
 *.py[cod]
 .pytest_cache/
-.mypy_cache/
 .ruff_cache/
 .venv/
 venv/

.env.example

@@ -83,6 +83,6 @@ NEWSLETTER_API_PASSWORD=adminpass
 
 DEBUG=True
 
-ALLOWED_HOSTS=localhost,127.0.0.1,nginx,newslettermaker.tech
+ALLOWED_HOSTS=localhost,127.0.0.1,nginx,digest-engine.tech
 
 FRONTEND_URL=http://localhost:3000

.github/dependabot.yml

@@ -5,6 +5,13 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 5
+    ignore:
+      - dependency-name: "cryptography"
+        versions:
+          - ">=47"
+      - dependency-name: "websockets"
+        versions:
+          - ">=16"
     groups:
       python-dependencies:
         patterns:
@@ -16,6 +23,7 @@ updates:
       interval: "weekly"
     open-pull-requests-limit: 5
     ignore:
+      # eslint 10 is blocked until eslint-config-next adds support for it.
       - dependency-name: "eslint"
         update-types:
           - "version-update:semver-major"

.github/instructions/dev-server-workflow.instructions.md

@@ -0,0 +1,14 @@
+---
+name: "Local Dev Server Workflow"
+description: "Use for all tasks. Covers local development server handling: do not start dev servers yourself by default, because the user usually has one running already. Ask the user to start the relevant server or confirm that none is running unless they explicitly request that you start it."
+applyTo:
+  - "**/*"
+---
+
+# Local Dev Server Workflow
+
+- Do not start local development servers by default.
+- Assume the user usually already has the relevant dev server running.
+- Before running commands such as `pnpm dev`, `next dev`, `vite`, `npm run dev`, `just <app>-dev`, or similar long-lived local servers, ask the user to start the server or confirm that no server is already running.
+- Only start a dev server yourself when the user explicitly asks you to do that.
+- When you need runtime verification and no server is available, prefer asking the user to start the correct app server instead of launching one on their behalf.

.github/instructions/frontend-app.instructions.md

@@ -1,6 +1,6 @@
 ---
 name: "Frontend App Router Guidelines"
-description: "Use when editing Next.js App Router pages, route handlers, shared frontend API helpers, or TypeScript UI code in frontend/src/. Covers file placement, backend contract preservation, typing, and frontend validation."
+description: "Use when editing Next.js App Router pages, route handlers, shared frontend API helpers, or TypeScript UI code in frontend/src/. Covers file placement, backend contract preservation, typing, Tailwind token usage, and frontend validation."
 applyTo:
   - "frontend/src/**/*.ts"
   - "frontend/src/**/*.tsx"
@@ -12,8 +12,23 @@ applyTo:
 - Keep backend-facing types in `frontend/src/lib/types.ts` and shared server-side API access in `frontend/src/lib/api.ts` unless a route handler in `frontend/src/app/api/` is the correct boundary.
 - Reuse the existing backend contract. This repo currently consumes `snake_case` fields from Django; do not silently rename payload keys in the frontend.
 - Keep reusable components in `frontend/src/components/`, provider-style wrappers in `frontend/src/providers/`, and page composition in `frontend/src/app/`.
+- Use `lucide-react` for icons in `frontend` unless the task requires a non-Lucene brand logo, product illustration, or another explicit exception.
+- Use Tailwind's built-in size utilities for text size, radius, width and max-width, spacing, tracking, aspect ratio, and line-height. Do not introduce or keep custom size alias classes such as `text-2xs`, `text-button`, `rounded-panel`, `rounded-display`, `tracking-overline`, `max-w-marketing`, or `min-h-half-screen`.
+- Do not use text sizes smaller than `text-xs`; if an old alias maps below `0.75rem`, replace it with `text-xs`.
+- Prefer semantic Tailwind theme utility classes such as `bg-background`, `bg-page-base`, `bg-primary`, `text-content-active`, `text-content-offset`, `text-primary-foreground`, or `border-trim-offset` when the color should change with the active light or dark theme.
+- Use fixed palette utility classes such as `bg-blue-50`, `text-emerald-500`, or `border-amber-400` only when the value should stay fixed across theme changes, such as data visualization, status legends, or decorative washes.
+- Do not use direct CSS-variable utility syntax such as `text-[var(--color-primary)]`, `bg-(--theme-color-primary)`, `border-(--brand-border-bright)`, `text-(--font-primary)`, `rounded-[1.65rem]`, or `tracking-[0.24em]` when an existing utility class fits the need.
+- Do not use slash-opacity color utilities such as `bg-primary/50`, `border-trim-offset/10`, `text-content-active/80`, or `ring-ring/40`; choose the closest existing semantic or fixed palette class instead.
+- Do not add new aliases in `frontend/src/styles/theme.css` or new theme variables just to create a JSX-friendly Tailwind class. Ask the user before introducing new theme variables.
+- Apply Tailwind utility classes directly on the JSX or HTML element that owns the styling. Do not add semantic helper selectors in shared CSS for combinations Tailwind can already express. Keep CSS selectors only when utilities cannot represent the behavior cleanly, such as global element rules, third-party overrides, vendor pseudos, or keyframe definitions.
 - Keep Vitest files beside the route page, route-local component, or shared component they exercise instead of creating separate `__tests__/` folders.
 - Add or update a colocated `*.test.ts` or `*.test.tsx` file in the same change when introducing or modifying a route handler, page, or component. If the file is only a framework passthrough, document why dedicated coverage is omitted.
+- Prefer React Testing Library for frontend component tests. Test through accessible roles, labels, text alternatives, and user-visible behavior instead of implementation details or serialized markup.
+- Follow React Testing Library best practices: render components like a user would experience them, prefer `screen` queries, use `user-event` for interactions, and avoid manual DOM traversal unless there is no accessible query that fits.
+- Do not test product copy that is likely to change during iteration. Prefer assertions about structure, semantics, links, visibility, state, and behavior over exact headline, paragraph, button, or tagline text.
+- Do not assert Tailwind or other presentational style classes in tests just to verify visual styling. Prefer behavior, accessible output, text, attributes, and state.
+- Class assertions are acceptable only when the class itself carries semantic or functional meaning, such as `hidden`, stateful visibility, or another class-based contract consumed by behavior rather than presentation.
+- Do not assert spacing, sizing, positioning, color, typography, radius, or shadow classes in tests. Avoid checks for classes such as `px-4`, `gap-4`, `top-4`, `inset-x-4`, `rounded-full`, or `shadow-card-strong` unless the class is part of a functional contract.
 - Prefer strong explicit types over loose `Record<string, unknown>` shapes when the contract is known.
 - Add JSDoc for exported utilities, route handlers, hooks, and non-trivial components when behavior is not obvious from the signature.
 - For React components, providers, and App Router pages, keep the component JSDoc to a short summary paragraph and put prop descriptions on the props type or interface fields. Avoid `@param` and `@returns` tags on React components because Storybook Autodocs flattens them into a single block.

.github/workflows/build-release.yml

@@ -52,16 +52,20 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: 11.1.2
+
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "22"
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
+          node-version: "24"
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
 
       - name: Install frontend dependencies
-        working-directory: frontend
-        run: npm ci
+        run: pnpm install --filter=@digestengine/frontend --frozen-lockfile
 
       - name: Prepare frontend env
         working-directory: frontend
@@ -70,12 +74,11 @@ jobs:
           echo "NEXTAUTH_SECRET=ci-build-secret" >> .env.local
 
       - name: Build frontend
-        working-directory: frontend
         env:
           NEXT_PUBLIC_API_URL: http://localhost:8000
           NEXTAUTH_URL: http://localhost:3000
           NEXTAUTH_SECRET: ci-build-secret
-        run: npm run build
+        run: pnpm --filter=@digestengine/frontend run build
 
   build-backend:
     name: Build and scan backend image
@@ -96,6 +99,7 @@ jobs:
         with:
           image-ref: digest-engine-ci:${{ github.sha }}
           scan-type: image
+          scanners: vuln
           severity: HIGH,CRITICAL
           ignore-unfixed: true
           exit-code: "1"

.github/workflows/lint.yml

@@ -1,4 +1,4 @@
-name: Lint
+name: Lint And Typecheck
 
 on:
   pull_request:
@@ -14,26 +14,40 @@ concurrency:
 
 jobs:
   lint:
-    name: Run lint suite
+    name: Run lint and pyright suite
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
+      - name: Set up uv
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
         with:
-          python-version: "3.13"
-          cache: pip
-          cache-dependency-path: requirements.txt
+          version: "0.8.17"
+          enable-cache: true
+
+      - name: Install Python 3.13
+        run: uv python install 3.13
+
+      - name: Initialize Pants
+        uses: pantsbuild/actions/init-pants@ab362158088bb31685015e7f5728a4c1df3c0e6e # v10
+        with:
+          gha-cache-key: cache0-py313
+          named-caches-hash: ${{ hashFiles('3rdparty/python/default.lock', 'pants.toml') }}
+          pants-ci-config: ""
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: 11.1.2
 
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
           node-version: "22"
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
 
       - name: Install just
         uses: extractions/setup-crate@7577c1bdf2d95e6d65d532788f35ed79d4b1dda2 # v2
@@ -44,8 +58,8 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
 
-      - name: Install dependencies
+      - name: Bootstrap dependencies
         run: just install
 
-      - name: Run lint and type checks
+      - name: Run lint and Pants checks
         run: just lint

.github/workflows/test.yml

@@ -21,27 +21,41 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
+      - name: Set up uv
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
         with:
-          python-version: "3.13"
-          cache: pip
-          cache-dependency-path: requirements.txt
+          version: "0.8.17"
+          enable-cache: true
+
+      - name: Install Python 3.13
+        run: uv python install 3.13
+
+      - name: Initialize Pants
+        uses: pantsbuild/actions/init-pants@ab362158088bb31685015e7f5728a4c1df3c0e6e # v10
+        with:
+          gha-cache-key: cache0-py313
+          named-caches-hash: ${{ hashFiles('3rdparty/python/default.lock', 'pants.toml') }}
+          pants-ci-config: ""
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: 11.1.2
 
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
           node-version: "22"
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
 
       - name: Install just
         uses: extractions/setup-crate@7577c1bdf2d95e6d65d532788f35ed79d4b1dda2 # v2
         with:
           repo: casey/just@1.50.0
           github-token: ${{ github.token }}
 
-      - name: Install dependencies
+      - name: Bootstrap dependencies
         run: just install
 
       - name: Run tests

.gitignore

@@ -1,23 +1,32 @@
 __pycache__/
-*.py[cod]
-.pytest_cache/
-.mypy_cache/
-.ruff_cache/
 .cache/
-.venv/
-venv/
 .coverage
 .env
-frontend/.env.local
+.pytest_cache/
+.ruff_cache/
+.turbo/
+.venv/
+.pants.d/
+
+*.py[cod]
+**/.turbo/
+*storybook.log
+
 celerybeat-schedule*
+coverage/
 db.sqlite3
-htmlcov/
-staticfiles/
+docs/_internal_only/
+
+frontend/.env.local
 frontend/.next/
 frontend/coverage/
 frontend/node_modules/
+frontend/out/
 
-docs/_internal_only/
+htmlcov/
+dist/
 
-*storybook.log
+node_modules/
+
+staticfiles/
 storybook-static

.python-version

@@ -0,0 +1 @@
+3.13

.vscode/extensions.json

@@ -0,0 +1,6 @@
+{
+  "recommendations": [
+    "astral-sh.uv-vscode",
+    "ms-pyright.pyright"
+  ]
+}

.vscode/settings.json

@@ -1,13 +1,18 @@
 {
+  "python.defaultInterpreterPath": "${workspaceFolder}/.venv/bin/python",
+  "python.terminal.activateEnvironment": true,
+  "python.terminal.activateEnvInCurrentTerminal": true,
   "cSpell.words": [
     "abangser",
+    "Aptos",
     "ASGI",
     "botocore",
     "bsky",
     "buildx",
     "cbor",
     "cbranch",
     "cfgv",
+    "Consolas",
     "cstat",
     "dabde",
     "dateutil",
@@ -40,10 +45,13 @@
     "membe",
     "mipsytipsy",
     "mitchellh",
+    "Neue",
     "newsle",
+    "nextra",
     "nodeenv",
     "noinput",
     "nomic",
+    "oklab",
     "oklch",
     "OLLAMA",
     "ormsgpack",
@@ -64,13 +72,16 @@
     "reposts",
     "rollup",
     "scaffolder",
+    "Segoe",
     "simplejwt",
     "skillr",
     "solomonstre",
+    "srgb",
     "svix",
     "topicv",
     "txaio",
     "ujson",
+    "unlayered",
     "Unparseable",
     "unstub",
     "upserted",
@@ -80,6 +91,8 @@
     "Vercel",
     "vfarcic",
     "Viktor",
+    "wght",
+    "xlink",
     "xrpc",
     "xxhash",
     "zope"