@rune-kit/rune 2.10.0 → 2.12.0

package/extensions/chrome-ext/skills/mv3-scaffold.md

@@ -1,164 +1,164 @@
----
-name: "mv3-scaffold"
-pack: "@rune/chrome-ext"
-description: "Manifest V3 project scaffolding — detect extension type, generate minimal-permission manifest, scaffold service worker with correct lifecycle patterns, scaffold content script, and generate build config."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# mv3-scaffold
-
-Manifest V3 project scaffolding — detect extension type, generate minimal-permission manifest, scaffold service worker with correct lifecycle patterns, scaffold content script, and generate build config. Prevents the #1 MV3 mistake: carrying MV2 mental models (background pages, remote scripts, setTimeout for keepalive) into an MV3 project.
-
-#### Workflow
-
-**Step 1 — Detect or clarify extension type**
-Use `Read` on any existing `manifest.json` or project description to classify the extension type:
-- **popup**: user-triggered UI (toolbar button → popup.html)
-- **sidebar**: persistent panel (chrome.sidePanel API, Chrome 114+)
-- **content-injector**: modifies host pages (content scripts + optional popup)
-- **background-only**: no visible UI, reacts to events (alarms, network, tabs)
-- **devtools**: extends Chrome DevTools panel
-
-If undetectable from files, ask the user. Extension type determines which APIs, permissions, and scaffold components are generated.
-
-**Step 2 — Generate minimal-permission manifest.json**
-Emit `manifest.json` with only the permissions required for the detected type. Flag over-permissioning immediately — requesting `<all_urls>` when only `activeTab` is needed is the #1 CWS rejection cause.
-
-Key MV3 manifest rules:
-- `"manifest_version": 3` — mandatory, MV2 deprecated Jan 2023
-- `"background"` uses `{ "service_worker": "background.js" }` — NOT `"scripts"` array
-- `"action"` replaces `"browser_action"` and `"page_action"`
-- No `"content_security_policy"` that relaxes `script-src` (blocks CWS review)
-- No `"web_accessible_resources"` with `matches: ["<all_urls>"]` unless justified
-- External URLs in `"host_permissions"` require justification in CWS dashboard
-
-**Step 3 — Scaffold service worker (CRITICAL lifecycle patterns)**
-Generate `background.ts` / `background.js` with the following non-negotiable patterns:
-
-CRITICAL: service workers terminate after 30 seconds of idle. Every assumption that breaks because of this:
-- JS variables reset on termination — use `chrome.storage.session` for ephemeral state
-- `setTimeout` / `setInterval` — NOT reliable across terminations, use `chrome.alarms`
-- Pending async operations mid-flight get killed — use alarm + storage to resume
-- `fetch()` initiated in a response to a non-event call may not complete
-
-All event listeners MUST be registered at the top level synchronously — NOT inside `async` functions, Promises, or conditionals. Chrome only registers listeners present during the initial synchronous execution of the service worker.
-
-**Step 4 — Scaffold content script**
-Generate `content.ts` with correct isolation model:
-- Runs in an **isolated world** — own JS context, cannot access page's JS variables
-- Has access to the DOM but NOT to `chrome.storage`, `chrome.tabs`, most `chrome.*` APIs (exceptions: `chrome.runtime`, `chrome.storage`, `chrome.i18n`)
-- Must message the service worker for privileged operations
-- Inject only when needed — prefer `"run_at": "document_idle"` over `"document_start"`
-
-**Step 5 — Scaffold popup/sidebar UI**
-For popup and sidebar types, generate `popup.html` + `popup.ts`:
-- Popup HTML MUST NOT load remote scripts (`<script src="https://...">`) — blocked by CSP
-- All scripts must be local and listed in `web_accessible_resources` if loaded from content scripts
-- Popup closes when user clicks away — don't depend on popup state for background operations
-- For sidebar: register `chrome.sidePanel.setPanelBehavior({ openPanelOnActionClick: true })`
-
-**Step 6 — Generate build config**
-Emit a build configuration based on detected tooling:
-- If `vite` in `package.json` → emit `vite.config.ts` using `@crxjs/vite-plugin` (hot-reload for extension dev)
-- Otherwise → emit vanilla TypeScript config with `tsc` + file copy script
-- Include `web-ext` config for local loading and reload
-
-#### Example
-
-```json
-// manifest.json — content-injector type, minimal permissions
-{
-  "manifest_version": 3,
-  "name": "Page Summarizer",
-  "version": "1.0.0",
-  "description": "Summarize any page using built-in AI or an external API.",
-  "permissions": ["activeTab", "storage", "sidePanel"],
-  "host_permissions": [],
-  "background": {
-    "service_worker": "background.js",
-    "type": "module"
-  },
-  "content_scripts": [
-    {
-      "matches": ["<all_urls>"],
-      "js": ["content.js"],
-      "run_at": "document_idle"
-    }
-  ],
-  "action": {
-    "default_title": "Summarize this page",
-    "default_icon": { "128": "icons/icon128.png" }
-  },
-  "side_panel": {
-    "default_path": "sidebar.html"
-  },
-  "icons": { "128": "icons/icon128.png" },
-  "content_security_policy": {
-    "extension_pages": "script-src 'self'; object-src 'self'"
-  }
-}
-```
-
-```typescript
-// background.ts — correct MV3 service worker patterns
-// CRITICAL: all listeners registered synchronously at top level
-
-chrome.runtime.onInstalled.addListener(({ reason }) => {
-  if (reason === 'install') {
-    console.log('[SW] Extension installed');
-  }
-});
-
-// Use chrome.alarms — NOT setTimeout (alarms survive service worker termination)
-chrome.runtime.onInstalled.addListener(() => {
-  chrome.alarms.create('heartbeat', { periodInMinutes: 1 });
-});
-
-chrome.alarms.onAlarm.addListener((alarm) => {
-  if (alarm.name === 'heartbeat') {
-    // periodic work here — service worker woke up for this
-  }
-});
-
-// Message handler — registered synchronously, NOT inside async function
-chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
-  if (message.type === 'SUMMARIZE_PAGE') {
-    // Return true to keep the message channel open for async response
-    handleSummarize(message.payload).then(sendResponse);
-    return true;
-  }
-});
-
-async function handleSummarize(payload: { text: string }): Promise<{ summary: string }> {
-  // Service worker is alive for the duration of this message handler
-  const summary = await callExternalApi(payload.text);
-  return { summary };
-}
-```
-
-```typescript
-// content.ts — isolated world, limited chrome.* access
-const selectedText = window.getSelection()?.toString() ?? '';
-
-if (selectedText.length > 0) {
-  // Content scripts can message service worker
-  chrome.runtime.sendMessage(
-    { type: 'SUMMARIZE_PAGE', payload: { text: selectedText } },
-    (response: { summary: string }) => {
-      if (chrome.runtime.lastError) {
-        console.error('[Content] Message failed:', chrome.runtime.lastError.message);
-        return;
-      }
-      displaySummary(response.summary);
-    }
-  );
-}
-
-function displaySummary(summary: string): void {
-  const panel = document.createElement('div');
-  panel.id = 'rune-summarizer-panel';
-  panel.textContent = summary;
-  document.body.appendChild(panel);
-}
-```
+---
+name: "mv3-scaffold"
+pack: "@rune/chrome-ext"
+description: "Manifest V3 project scaffolding — detect extension type, generate minimal-permission manifest, scaffold service worker with correct lifecycle patterns, scaffold content script, and generate build config."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# mv3-scaffold
+
+Manifest V3 project scaffolding — detect extension type, generate minimal-permission manifest, scaffold service worker with correct lifecycle patterns, scaffold content script, and generate build config. Prevents the #1 MV3 mistake: carrying MV2 mental models (background pages, remote scripts, setTimeout for keepalive) into an MV3 project.
+
+#### Workflow
+
+**Step 1 — Detect or clarify extension type**
+Use `Read` on any existing `manifest.json` or project description to classify the extension type:
+- **popup**: user-triggered UI (toolbar button → popup.html)
+- **sidebar**: persistent panel (chrome.sidePanel API, Chrome 114+)
+- **content-injector**: modifies host pages (content scripts + optional popup)
+- **background-only**: no visible UI, reacts to events (alarms, network, tabs)
+- **devtools**: extends Chrome DevTools panel
+
+If undetectable from files, ask the user. Extension type determines which APIs, permissions, and scaffold components are generated.
+
+**Step 2 — Generate minimal-permission manifest.json**
+Emit `manifest.json` with only the permissions required for the detected type. Flag over-permissioning immediately — requesting `<all_urls>` when only `activeTab` is needed is the #1 CWS rejection cause.
+
+Key MV3 manifest rules:
+- `"manifest_version": 3` — mandatory, MV2 deprecated Jan 2023
+- `"background"` uses `{ "service_worker": "background.js" }` — NOT `"scripts"` array
+- `"action"` replaces `"browser_action"` and `"page_action"`
+- No `"content_security_policy"` that relaxes `script-src` (blocks CWS review)
+- No `"web_accessible_resources"` with `matches: ["<all_urls>"]` unless justified
+- External URLs in `"host_permissions"` require justification in CWS dashboard
+
+**Step 3 — Scaffold service worker (CRITICAL lifecycle patterns)**
+Generate `background.ts` / `background.js` with the following non-negotiable patterns:
+
+CRITICAL: service workers terminate after 30 seconds of idle. Every assumption that breaks because of this:
+- JS variables reset on termination — use `chrome.storage.session` for ephemeral state
+- `setTimeout` / `setInterval` — NOT reliable across terminations, use `chrome.alarms`
+- Pending async operations mid-flight get killed — use alarm + storage to resume
+- `fetch()` initiated in a response to a non-event call may not complete
+
+All event listeners MUST be registered at the top level synchronously — NOT inside `async` functions, Promises, or conditionals. Chrome only registers listeners present during the initial synchronous execution of the service worker.
+
+**Step 4 — Scaffold content script**
+Generate `content.ts` with correct isolation model:
+- Runs in an **isolated world** — own JS context, cannot access page's JS variables
+- Has access to the DOM but NOT to `chrome.storage`, `chrome.tabs`, most `chrome.*` APIs (exceptions: `chrome.runtime`, `chrome.storage`, `chrome.i18n`)
+- Must message the service worker for privileged operations
+- Inject only when needed — prefer `"run_at": "document_idle"` over `"document_start"`
+
+**Step 5 — Scaffold popup/sidebar UI**
+For popup and sidebar types, generate `popup.html` + `popup.ts`:
+- Popup HTML MUST NOT load remote scripts (`<script src="https://...">`) — blocked by CSP
+- All scripts must be local and listed in `web_accessible_resources` if loaded from content scripts
+- Popup closes when user clicks away — don't depend on popup state for background operations
+- For sidebar: register `chrome.sidePanel.setPanelBehavior({ openPanelOnActionClick: true })`
+
+**Step 6 — Generate build config**
+Emit a build configuration based on detected tooling:
+- If `vite` in `package.json` → emit `vite.config.ts` using `@crxjs/vite-plugin` (hot-reload for extension dev)
+- Otherwise → emit vanilla TypeScript config with `tsc` + file copy script
+- Include `web-ext` config for local loading and reload
+
+#### Example
+
+```json
+// manifest.json — content-injector type, minimal permissions
+{
+  "manifest_version": 3,
+  "name": "Page Summarizer",
+  "version": "1.0.0",
+  "description": "Summarize any page using built-in AI or an external API.",
+  "permissions": ["activeTab", "storage", "sidePanel"],
+  "host_permissions": [],
+  "background": {
+    "service_worker": "background.js",
+    "type": "module"
+  },
+  "content_scripts": [
+    {
+      "matches": ["<all_urls>"],
+      "js": ["content.js"],
+      "run_at": "document_idle"
+    }
+  ],
+  "action": {
+    "default_title": "Summarize this page",
+    "default_icon": { "128": "icons/icon128.png" }
+  },
+  "side_panel": {
+    "default_path": "sidebar.html"
+  },
+  "icons": { "128": "icons/icon128.png" },
+  "content_security_policy": {
+    "extension_pages": "script-src 'self'; object-src 'self'"
+  }
+}
+```
+
+```typescript
+// background.ts — correct MV3 service worker patterns
+// CRITICAL: all listeners registered synchronously at top level
+
+chrome.runtime.onInstalled.addListener(({ reason }) => {
+  if (reason === 'install') {
+    console.log('[SW] Extension installed');
+  }
+});
+
+// Use chrome.alarms — NOT setTimeout (alarms survive service worker termination)
+chrome.runtime.onInstalled.addListener(() => {
+  chrome.alarms.create('heartbeat', { periodInMinutes: 1 });
+});
+
+chrome.alarms.onAlarm.addListener((alarm) => {
+  if (alarm.name === 'heartbeat') {
+    // periodic work here — service worker woke up for this
+  }
+});
+
+// Message handler — registered synchronously, NOT inside async function
+chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
+  if (message.type === 'SUMMARIZE_PAGE') {
+    // Return true to keep the message channel open for async response
+    handleSummarize(message.payload).then(sendResponse);
+    return true;
+  }
+});
+
+async function handleSummarize(payload: { text: string }): Promise<{ summary: string }> {
+  // Service worker is alive for the duration of this message handler
+  const summary = await callExternalApi(payload.text);
+  return { summary };
+}
+```
+
+```typescript
+// content.ts — isolated world, limited chrome.* access
+const selectedText = window.getSelection()?.toString() ?? '';
+
+if (selectedText.length > 0) {
+  // Content scripts can message service worker
+  chrome.runtime.sendMessage(
+    { type: 'SUMMARIZE_PAGE', payload: { text: selectedText } },
+    (response: { summary: string }) => {
+      if (chrome.runtime.lastError) {
+        console.error('[Content] Message failed:', chrome.runtime.lastError.message);
+        return;
+      }
+      displaySummary(response.summary);
+    }
+  );
+}
+
+function displaySummary(summary: string): void {
+  const panel = document.createElement('div');
+  panel.id = 'rune-summarizer-panel';
+  panel.textContent = summary;
+  document.body.appendChild(panel);
+}
+```

package/extensions/content/PACK.md

@@ -1,96 +1,96 @@
----
-name: "@rune/content"
-description: Content platform patterns — blog systems, CMS integration, MDX authoring, internationalization, SEO, video repurposing pipelines, and content scoring.
-metadata:
-  author: runedev
-  version: "0.3.0"
-  layer: L4
-  price: "$9"
-  target: Content creators
-  format: split
----
-
-# @rune/content
-
-## Purpose
-
-Content-driven sites break in ways that don't show up until production: blog pages that return 404 after a CMS slug change, MDX files that crash the build when a custom component is missing, translations that show raw keys because the fallback chain is misconfigured, and pages that rank poorly because structured data is malformed or canonical URLs point to the wrong locale. This pack covers the full content stack — authoring, management, localization, discovery, performance, and analytics — with patterns that keep content sites correct, fast, and findable.
-
-## Triggers
-
-- Auto-trigger: when `contentlayer`, `@sanity`, `contentful`, `strapi`, `mdx`, `next-intl`, `i18next`, `*.mdx` detected
-- `/rune blog-patterns` — build or audit blog architecture
-- `/rune cms-integration` — set up or audit headless CMS
-- `/rune mdx-authoring` — configure MDX pipeline with custom components
-- `/rune i18n` — implement or audit internationalization
-- `/rune seo-patterns` — audit SEO, structured data, and meta tags
-- `/rune video-repurpose` — build long-to-short video repurposing pipeline
-- `/rune content-scoring` — implement engagement/virality scoring for content
-- Called by `cook` (L1) when content project detected
-- Called by `marketing` (L2) when creating blog content
-
-## Skills Included
-
-| Skill | Model | Description |
-|-------|-------|-------------|
-| [blog-patterns](skills/blog-patterns.md) | sonnet | Post management, RSS, pagination, categories |
-| [cms-integration](skills/cms-integration.md) | sonnet | Sanity/Contentful/Strapi, preview, webhooks |
-| [mdx-authoring](skills/mdx-authoring.md) | sonnet | Custom components, TOC, syntax highlighting |
-| [i18n](skills/i18n.md) | sonnet | Locale routing, translations, hreflang, RTL |
-| [seo-patterns](skills/seo-patterns.md) | sonnet | JSON-LD, sitemap, meta tags, Core Web Vitals |
-| [video-repurpose](skills/video-repurpose.md) | sonnet | Long→short video pipeline, captions, face-crop |
-| [content-scoring](skills/content-scoring.md) | sonnet | Virality scoring, engagement metrics, hook analysis |
-| [reference](skills/reference.md) | — | Shared patterns: migration, search, email, perf, analytics, scheduling, a11y, rich media |
-
-## Workflows
-
-| Workflow | Skills Invoked | Trigger |
-|----------|----------------|---------|
-| New blog from scratch | blog-patterns → mdx-authoring → seo-patterns | `/rune blog-patterns` on empty project |
-| CMS migration | cms-integration → seo-patterns → blog-patterns | New CMS detected, old slugs present |
-| Launch-ready audit | seo-patterns + blog-patterns + i18n (parallel) | Pre-deploy checklist |
-| Multilingual blog | i18n → blog-patterns → seo-patterns | `next-intl` or i18next detected |
-| MDX component library | mdx-authoring → blog-patterns | `*.mdx` files without component registry |
-| Performance audit | seo-patterns (CWV check) + blog-patterns (images) | LCP > 2.5s detected |
-| Search setup | cms-integration + blog-patterns → search integration | Algolia/Meilisearch env vars detected |
-
-## Connections
-
-```
-Calls → research (L3): SEO data and competitor analysis
-Calls → marketing (L2): content promotion
-Calls → @rune/ui (L4): typography system, article layout patterns, palette for content sites
-Called By ← cook (L1): when content project detected
-Called By ← marketing (L2): when creating blog content
-```
-
-| Pack | Connection | When |
-|------|-----------|------|
-| `@rune/analytics` | Page views, scroll depth, read time events → analytics pipeline | Any content site with tracking |
-| `@rune/ui` | Article layout components, image galleries, typography system | Custom component-heavy MDX sites |
-| `@rune/saas` | Auth-gated content (members-only posts), subscription paywalls | Premium content model |
-| `@rune/ecommerce` | Product-linked blog posts, shoppable content, affiliate links | Commerce + content hybrid sites |
-
-## Sharp Edges
-
-| Failure Mode | Severity | Mitigation |
-|---|---|---|
-| CMS slug change breaks all inbound links (404 on old URLs) | HIGH | Implement redirect map in CMS; check for broken links on content publish webhook |
-| Missing translation key shows raw key string to users | HIGH | Configure fallback to default locale; run missing key detection in CI |
-| MDX build crashes because custom component removed but still referenced | HIGH | Register fallback component that renders warning in dev, empty div in prod |
-| Search index out of sync after CMS publish | HIGH | Trigger index update in CMS publish webhook, same endpoint as ISR revalidation |
-| Whisper large-v3 halluccinates on audio silence | HIGH | Preprocess audio: detect silence > 2s, split segments, skip silent chunks |
-| yt-dlp breaks on YouTube bot detection (HTTP 429) | HIGH | Use browser-mimicking headers, exponential backoff, rotate user agents |
-| Sitemap includes draft/unpublished pages | MEDIUM | Filter sitemap to `status === 'published'` only; add `noindex` to draft preview pages |
-| `hreflang` tags point to wrong locale | MEDIUM | Generate hreflang from route params, not hardcoded; test with hreflang validator |
-
-## Done When
-
-- Blog architecture set up with pagination, RSS feed, and canonical URLs all resolving correctly
-- CMS integration live with preview mode, publish webhooks triggering ISR revalidation and search index updates
-- All translation keys resolved with fallback locale — no raw keys visible in any locale
-- SEO audit passing: valid JSON-LD structured data, complete sitemap (published pages only), and hreflang tags verified
-
-## Cost Profile
-
-~16,000–28,000 tokens per full pack run (all 7 skills). Individual skill: ~2,000–5,000 tokens. Sonnet default. Use haiku for detection scans and alt-text audits; escalate to sonnet for CMS integration, SEO audit, video pipeline, and content scoring.
+---
+name: "@rune/content"
+description: Content platform patterns — blog systems, CMS integration, MDX authoring, internationalization, SEO, video repurposing pipelines, and content scoring.
+metadata:
+  author: runedev
+  version: "0.3.0"
+  layer: L4
+  price: "$9"
+  target: Content creators
+  format: split
+---
+
+# @rune/content
+
+## Purpose
+
+Content-driven sites break in ways that don't show up until production: blog pages that return 404 after a CMS slug change, MDX files that crash the build when a custom component is missing, translations that show raw keys because the fallback chain is misconfigured, and pages that rank poorly because structured data is malformed or canonical URLs point to the wrong locale. This pack covers the full content stack — authoring, management, localization, discovery, performance, and analytics — with patterns that keep content sites correct, fast, and findable.
+
+## Triggers
+
+- Auto-trigger: when `contentlayer`, `@sanity`, `contentful`, `strapi`, `mdx`, `next-intl`, `i18next`, `*.mdx` detected
+- `/rune blog-patterns` — build or audit blog architecture
+- `/rune cms-integration` — set up or audit headless CMS
+- `/rune mdx-authoring` — configure MDX pipeline with custom components
+- `/rune i18n` — implement or audit internationalization
+- `/rune seo-patterns` — audit SEO, structured data, and meta tags
+- `/rune video-repurpose` — build long-to-short video repurposing pipeline
+- `/rune content-scoring` — implement engagement/virality scoring for content
+- Called by `cook` (L1) when content project detected
+- Called by `marketing` (L2) when creating blog content
+
+## Skills Included
+
+| Skill | Model | Description |
+|-------|-------|-------------|
+| [blog-patterns](skills/blog-patterns.md) | sonnet | Post management, RSS, pagination, categories |
+| [cms-integration](skills/cms-integration.md) | sonnet | Sanity/Contentful/Strapi, preview, webhooks |
+| [mdx-authoring](skills/mdx-authoring.md) | sonnet | Custom components, TOC, syntax highlighting |
+| [i18n](skills/i18n.md) | sonnet | Locale routing, translations, hreflang, RTL |
+| [seo-patterns](skills/seo-patterns.md) | sonnet | JSON-LD, sitemap, meta tags, Core Web Vitals |
+| [video-repurpose](skills/video-repurpose.md) | sonnet | Long→short video pipeline, captions, face-crop |
+| [content-scoring](skills/content-scoring.md) | sonnet | Virality scoring, engagement metrics, hook analysis |
+| [reference](skills/reference.md) | — | Shared patterns: migration, search, email, perf, analytics, scheduling, a11y, rich media |
+
+## Workflows
+
+| Workflow | Skills Invoked | Trigger |
+|----------|----------------|---------|
+| New blog from scratch | blog-patterns → mdx-authoring → seo-patterns | `/rune blog-patterns` on empty project |
+| CMS migration | cms-integration → seo-patterns → blog-patterns | New CMS detected, old slugs present |
+| Launch-ready audit | seo-patterns + blog-patterns + i18n (parallel) | Pre-deploy checklist |
+| Multilingual blog | i18n → blog-patterns → seo-patterns | `next-intl` or i18next detected |
+| MDX component library | mdx-authoring → blog-patterns | `*.mdx` files without component registry |
+| Performance audit | seo-patterns (CWV check) + blog-patterns (images) | LCP > 2.5s detected |
+| Search setup | cms-integration + blog-patterns → search integration | Algolia/Meilisearch env vars detected |
+
+## Connections
+
+```
+Calls → research (L3): SEO data and competitor analysis
+Calls → marketing (L2): content promotion
+Calls → @rune/ui (L4): typography system, article layout patterns, palette for content sites
+Called By ← cook (L1): when content project detected
+Called By ← marketing (L2): when creating blog content
+```
+
+| Pack | Connection | When |
+|------|-----------|------|
+| `@rune/analytics` | Page views, scroll depth, read time events → analytics pipeline | Any content site with tracking |
+| `@rune/ui` | Article layout components, image galleries, typography system | Custom component-heavy MDX sites |
+| `@rune/saas` | Auth-gated content (members-only posts), subscription paywalls | Premium content model |
+| `@rune/ecommerce` | Product-linked blog posts, shoppable content, affiliate links | Commerce + content hybrid sites |
+
+## Sharp Edges
+
+| Failure Mode | Severity | Mitigation |
+|---|---|---|
+| CMS slug change breaks all inbound links (404 on old URLs) | HIGH | Implement redirect map in CMS; check for broken links on content publish webhook |
+| Missing translation key shows raw key string to users | HIGH | Configure fallback to default locale; run missing key detection in CI |
+| MDX build crashes because custom component removed but still referenced | HIGH | Register fallback component that renders warning in dev, empty div in prod |
+| Search index out of sync after CMS publish | HIGH | Trigger index update in CMS publish webhook, same endpoint as ISR revalidation |
+| Whisper large-v3 halluccinates on audio silence | HIGH | Preprocess audio: detect silence > 2s, split segments, skip silent chunks |
+| yt-dlp breaks on YouTube bot detection (HTTP 429) | HIGH | Use browser-mimicking headers, exponential backoff, rotate user agents |
+| Sitemap includes draft/unpublished pages | MEDIUM | Filter sitemap to `status === 'published'` only; add `noindex` to draft preview pages |
+| `hreflang` tags point to wrong locale | MEDIUM | Generate hreflang from route params, not hardcoded; test with hreflang validator |
+
+## Done When
+
+- Blog architecture set up with pagination, RSS feed, and canonical URLs all resolving correctly
+- CMS integration live with preview mode, publish webhooks triggering ISR revalidation and search index updates
+- All translation keys resolved with fallback locale — no raw keys visible in any locale
+- SEO audit passing: valid JSON-LD structured data, complete sitemap (published pages only), and hreflang tags verified
+
+## Cost Profile
+
+~16,000–28,000 tokens per full pack run (all 7 skills). Individual skill: ~2,000–5,000 tokens. Sonnet default. Use haiku for detection scans and alt-text audits; escalate to sonnet for CMS integration, SEO audit, video pipeline, and content scoring.