bitbaum · github-actions · Sep 4, 2026 · Sep 4, 2026
diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
@@ -85,7 +85,7 @@ revampit/
 |-------|------------|------|
 | Frontend | Next.js 16, TypeScript, Tailwind | 3000 |
 | **Prod DB** | **Self-hosted Postgres on Hetzner** (Supabase stack, `localhost:5432/revampit`) | On the app box |
-| **Dev DB** | PostgreSQL in Docker (`npm run services:up`, port 5433) | localhost:5433 |
+| **Dev DB** | PostgreSQL in Docker (`pnpm run services:up`, port 5433) | localhost:5433 |
 | Search | Meilisearch | 7700 |
 | Payments | Payrexx (mock in dev) | — |
 
@@ -113,7 +113,7 @@ revampit/
 2. **Schema reaches ANY shared database ONLY via `scripts/db/migrations/`.**
    `drizzle-kit push` is FORBIDDEN against dev/prod — push-created tables are
    invisible to from-scratch replays and broke CI for days (see 101b/109
-   baselines). Local ad-hoc DBs: `npm run db:migrate`. The CI Migration Drift
+   baselines). Local ad-hoc DBs: `pnpm run db:migrate`. The CI Migration Drift
    job replays every migration from zero; before pushing a new migration,
    replay locally in a throwaway pgvector container.
 3. **App-level enums live in `src/config/*` + zod at the write boundary — NOT
@@ -191,10 +191,10 @@ Community P2P (individuals + staff posting privately)
 ## Quick Start
 
 ```bash
-npm run d              # Start everything (recommended)
-npm run dev            # Frontend only
-npm run services:up    # Start Docker services
-npm run setup-admins   # Create admin users
+pnpm run d              # Start everything (recommended)
+pnpm run dev            # Frontend only
+pnpm run services:up    # Start Docker services
+pnpm run setup-admins   # Create admin users
 ```
 
 **Full commands**: See `docs/COMMANDS.md`
@@ -275,7 +275,7 @@ This is the #1 most common mistake. EVERY German word with ä, ö, ü MUST use t
 "Billett" ✓   "Ticket" ✗
 ```
 
-**Run `npm run lint:umlauts` to catch ASCII umlaut violations.**
+**Run `pnpm run lint:umlauts` to catch ASCII umlaut violations.**
 **ALWAYS run this before committing German text changes.**
 
 ### 4b. Translation (i18n) SSOT — messages hold STRINGS ONLY
@@ -301,7 +301,7 @@ Anything language-independent must NEVER live in a message file:
   length + per-element keys) — keep it green.
 
 DE is canonical; other locales deep-merge over it. Don't hardcode user-facing
-strings in components — add a key. Run `npm run compliance:i18n` for parity.
+strings in components — add a key. Run `pnpm run compliance:i18n` for parity.
 
 ### 6. Protected Files - NEVER Delete
 - `scripts/db/migrations/*`
@@ -473,8 +473,8 @@ Run `scripts/db/migrations/002b-simplified-auth.sql` to add:
 
 ## Pre-Commit Checklist
 
-- [ ] `npm run typecheck` passes
-- [ ] `npm run lint` passes
+- [ ] `pnpm run typecheck` passes
+- [ ] `pnpm run lint` passes
 - [ ] No `console.log` statements
 - [ ] Using `logger` from `@/lib/logger`
 - [ ] Using `TABLE_NAMES` from `@/config/database`
@@ -486,7 +486,7 @@ Run `scripts/db/migrations/002b-simplified-auth.sql` to add:
 | Document | Purpose |
 |----------|---------|
 | `docs/SHARED_CONTEXT.md` | Tech stack, database, file structure |
-| `docs/COMMANDS.md` | All npm scripts |
+| `docs/COMMANDS.md` | All package scripts |
 | `docs/MISSION_STATEMENT.md` | Organization mission |
 | `docs/CODE_AUDIT.md` | Current issues to fix |
 
@@ -502,4 +502,4 @@ Run `scripts/db/migrations/002b-simplified-auth.sql` to add:
 
 ---
 
-**Last Updated**: 2026-07-17
+**Last Updated**: 2026-09-04
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -91,7 +91,7 @@ hold the line on all of it by default:
 
 | Layer | Technology |
 |-------|-----------|
-| Framework | Next.js 16, TypeScript 5.3 |
+| Framework | Next.js 16, TypeScript 6 |
 | Styling | Tailwind CSS 4 (CSS-first, no tailwind.config) |
 | Database | PostgreSQL (prod: self-hosted on Hetzner; dev: Docker on 5433), Drizzle ORM |
 | Auth | NextAuth v5 (Auth.js) + @auth/pg-adapter |
@@ -307,7 +307,7 @@ grep -rn 'bg-gradient-to' src/app/[locale]/ src/components/ | grep -v 'from-blac
 grep -rnE '(bg|text|border|ring)-primary-[0-9]' src/components src/app
 
 # Hand-rolled card shells — should be <Card>/<Panel> (resolve to card-shell).
-# Enforced as a ratchet: scripts/ci/card-shell-ratchet.sh (runs in `npm run
+# Enforced as a ratchet: scripts/ci/card-shell-ratchet.sh (runs in `pnpm run
 # verify`) pins the count — it may fall or hold, never rise. When you reduce
 # it, lower scripts/ci/card-shell-baseline.txt in the same PR.
 grep -rnE 'bg-surface-base rounded-(lg|xl) border' src/components src/app

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -14,7 +14,7 @@ Thanks for the interest. This document covers the practical workflow for shippin
 ## Prerequisites
 
 - Node.js **20+**
-- A Postgres instance — start local Docker with `npm run services:up` (port 5433). Production runs on self-hosted Postgres 17 on Hetzner.
+- A Postgres instance — start local Docker with `pnpm run services:up` (port 5433). Production runs on self-hosted Postgres 17 on Hetzner.
 - (Optional, for full feature coverage) Meilisearch, Redis (upstash), Listmonk
 
 ## Local setup
@@ -23,14 +23,14 @@ Thanks for the interest. This document covers the practical workflow for shippin
 git clone https://github.com/bitbaum/evig.git
 cd evig
 cp .env.example .env.local         # fill in DATABASE_URL, AUTH_SECRET, payment + email keys
-npm install
-npm run db:migrate                  # apply scripts/db/migrations/*.sql
-npm run dev                         # Next.js on :3000
+pnpm install
+pnpm run db:migrate                  # apply scripts/db/migrations/*.sql
+pnpm run dev                         # Next.js on :3000
 ```
 
 The app is a **single Next.js 16 application**. There is no separate API server, CMS server, or microservice — everything (pages, API routes, admin surface) lives in `src/app/`. Earlier iterations had a `cms-api/` subproject; it is no longer maintained and its files are not part of the dev loop.
 
-Full architecture orientation: [`docs/ARCHITECTURE_QUICK_START.md`](./docs/ARCHITECTURE_QUICK_START.md). Every npm script: [`docs/COMMANDS.md`](./docs/COMMANDS.md).
+Full architecture orientation: [`docs/ARCHITECTURE_QUICK_START.md`](./docs/ARCHITECTURE_QUICK_START.md). Every package script: [`docs/COMMANDS.md`](./docs/COMMANDS.md).
 
 ## Workflow
 
@@ -51,10 +51,10 @@ Lead the body with **why**, not what — the diff already shows what.
 ### Before opening a PR
 
 ```bash
-npm test               # Jest (7,500+ tests across 500+ suites)
-npm run lint           # ESLint
-npm run typecheck      # tsc --noEmit
-npm run lint:umlauts   # catches ASCII umlaut substitutes in German strings
+pnpm test               # Vitest (7,500+ tests across 500+ suites)
+pnpm run lint           # ESLint
+pnpm run typecheck      # tsc --noEmit
+pnpm run lint:umlauts   # catches ASCII umlaut substitutes in German strings
 ```
 
 CI re-runs all of these. PRs blocked by failing CI will not be merged.
@@ -69,7 +69,7 @@ These are the rules the codebase actually relies on. Violations either fail CI o
 | Use `TABLE_NAMES` from `@/config/database` — never hardcode table strings | One source of truth; renaming a table is one diff |
 | Parameterized queries only — never string-concatenate user input | SQL injection |
 | Use `CONTACT` / `ORG` / `LOCATIONS` from `@/config/org` — never hardcode addresses, phones, emails | Same SSOT principle, applied to org-level data |
-| Swiss German: `ss` (not `ß`), proper `ä/ö/ü` (never `ae/oe/ue`) | Project locale standard; `npm run lint:umlauts` enforces it |
+| Swiss German: `ss` (not `ß`), proper `ä/ö/ü` (never `ae/oe/ue`) | Project locale standard; `pnpm run lint:umlauts` enforces it |
 | Wrap multi-statement writes in `db.transaction(...)` with explicit `FOR UPDATE` when needed | Concurrency safety — TOCTOU races cost us real bugs in 2026-Q1 |
 | Mobile-first responsive Tailwind, 44×44 minimum tap targets | Most users land on phones |
 

diff --git a/README.md b/README.md
@@ -89,13 +89,13 @@ These are enforced, not suggested:
 - **Logger** -- `import { logger } from '@/lib/logger'`. Never `console.log`.
 - **TABLE_NAMES** -- never hardcoded table strings. Import from `src/config/database.ts`.
 - **Parameterized queries** -- never string concatenation. No exceptions.
-- **Swiss German** -- user-facing text uses `ss` (not `ß`), proper `ä/ö/ü` (never `ae/oe/ue`). `npm run lint:umlauts` catches violations.
+- **Swiss German** -- user-facing text uses `ss` (not `ß`), proper `ä/ö/ü` (never `ae/oe/ue`). `pnpm run lint:umlauts` catches violations.
 
 ## Tech Stack
 
 | Layer | Technology |
 |-------|------------|
-| Framework | Next.js 16 (App Router), React 19, TypeScript 5, Tailwind 4 |
+| Framework | Next.js 16 (App Router), React 19, TypeScript 6, Tailwind 4 |
 | Database | PostgreSQL (prod: Hetzner self-hosted; dev: Docker 5433), Drizzle ORM |
 | Auth | NextAuth v5 (Auth.js) + @auth/pg-adapter (shares the app `DATABASE_URL` pool) |
 | Search | Meilisearch |
@@ -104,16 +104,16 @@ These are enforced, not suggested:
 | Storage | Cloudflare R2 (S3-compatible) for product/listing images |
 | Rate limiting | Redis (upstash) |
 | AI | HIRN (in-house provider stack: Groq → OpenRouter → Ollama cascade) |
-| Testing | Jest (7,500+ tests), Playwright (E2E) |
+| Testing | Vitest (7,500+ tests), Playwright (E2E) |
 | CI/CD | GitHub Actions → self-hosted Hetzner deploy (systemd `revampit-app`) |
 
 <details>
 <summary><strong>Quick Start</strong></summary>
 
 ### Prerequisites
 
-- Node.js 20+
-- A PostgreSQL database — local Docker via `npm run services:up` (port 5433)
+- Node.js 22.13+ (CI and deploy run Node 24)
+- A PostgreSQL database — local Docker via `pnpm run services:up` (port 5433)
 - Optional: Meilisearch, Redis, Listmonk for full feature coverage
 
 ### Setup
@@ -122,9 +122,9 @@ These are enforced, not suggested:
 git clone https://github.com/bitbaum/evig.git
 cd evig
 cp .env.example .env.local    # fill in DATABASE_URL, AUTH_SECRET, payment keys, etc.
-npm install
-npm run db:migrate
-npm run dev                    # Next.js on :3000
+pnpm install
+pnpm run db:migrate
+pnpm run dev                    # Next.js on :3000
 ```
 
 ### Environment Variables
@@ -143,7 +143,7 @@ See `.env.example` for the full list.
 
 ## Testing
 
-7,500+ tests across 500+ Jest suites, plus a Playwright E2E layer.
+7,500+ tests across 500+ Vitest suites, plus a Playwright E2E layer.
 
 | Category | Coverage |
 |----------|----------|
@@ -155,8 +155,8 @@ See `.env.example` for the full list.
 | E2E (Playwright) | Auth smoke, marketplace, IT-Hilfe, security |
 
 ```bash
-npm test              # run all Jest tests
-npm run test:e2e      # run Playwright E2E suite
+pnpm test              # run all Vitest tests
+pnpm run test:e2e      # run Playwright E2E suite
 ```
 
 ### CI Pipeline
@@ -165,7 +165,7 @@ Defined in `.github/workflows/ci.yml`:
 
 1. **Code Quality** -- ESLint + TypeScript type check + Next.js build
 2. **Auth Smoke Test** -- Playwright, runs conditionally
-3. **Unit Tests** -- Jest, PR only
+3. **Unit Tests** -- Vitest, PR only
 
 On merge to `main`, the `.github/workflows/deploy-selfhost.yml` workflow lints, type-checks, builds the Next standalone bundle, rsyncs it to the Hetzner box, and restarts the systemd `revampit-app` service (with a page-render rollback gate). Vercel is not used for production.
 
@@ -192,15 +192,15 @@ src/
   db/schema/        # Drizzle schemas
 scripts/
   db/migrations/    # Sequential SQL migrations (072 ADD COLUMN token_version, etc.)
-tests/              # Jest test suites
+tests/              # Vitest test suites
 e2e/                # Playwright E2E tests
 ```
 
 ## Contributing
 
 1. Fork and create a feature branch
 2. Follow the development standards (TABLE_NAMES, logger, parameterized queries, Swiss German rules)
-3. Run `npm test` and `npm run lint:umlauts` before pushing
+3. Run `pnpm test` and `pnpm run lint:umlauts` before pushing
 4. Open a PR against `main` -- CI will validate code quality and tests
 
 ## License

diff --git a/docs/ADMIN_QUICK_REFERENCE.md b/docs/ADMIN_QUICK_REFERENCE.md
@@ -4,8 +4,8 @@
 
 ### One-Command Setup
 ```bash
-npm run d              # Start all services
-npm run setup-admins   # Create admin users
+pnpm run d              # Start all services
+pnpm run setup-admins   # Create admin users
 ```
 
 ### Access Points
@@ -20,8 +20,8 @@ npm run setup-admins   # Create admin users
 
 ### Start/Stop Services
 ```bash
-npm run d              # Start everything
-npm run stop:all       # Stop all services
+pnpm run d              # Start everything
+pnpm run stop:all       # Stop all services
 ```
 
 ### Monitor System
@@ -68,12 +68,12 @@ Click any button to copy the command to clipboard:
 ```bash
 docker ps                    # Check if containers are running
 docker compose down         # Clean restart
-npm run d                   # Restart all
+pnpm run d                   # Restart all
 ```
 
 ### Can't Access Admin
 ```bash
-npm run setup-admins        # Recreate admin users
+pnpm run setup-admins        # Recreate admin users
 # Check credentials above
 ```
 
@@ -85,7 +85,7 @@ npm run setup-admins        # Recreate admin users
 ### Database Issues
 ```bash
 docker compose down -v      # Remove volumes (⚠️ loses data)
-npm run reset              # Full system reset
+pnpm run reset              # Full system reset
 ```
 
 ## 📞 Support

diff --git a/docs/AI_BOT_SYSTEM_PROMPT.md b/docs/AI_BOT_SYSTEM_PROMPT.md
@@ -69,7 +69,7 @@
 **Beschreibung**: Professionelle Webentwicklung mit modernen Open-Source-Technologien.
 
 **Technologie-Stack**:
-- Frontend: Next.js 14+, React 18, TypeScript, Tailwind CSS
+- Frontend: Next.js 16, React 19, TypeScript, Tailwind CSS
 - CMS: Headless CMS (Strapi, Payload, Tina)
 - E-Commerce: WooCommerce, Shopware 6 Integration
 

diff --git a/docs/BEST_PRACTICES.md b/docs/BEST_PRACTICES.md
@@ -133,10 +133,10 @@ grep -r "function.*name" src/ | sort | uniq -d
 find src/ -type f -name "*.tsx" | sort
 
 # Find unused imports (requires tools like ts-prune)
-npx ts-prune
+pnpm dlx ts-prune
 
 # Find duplicate code blocks
-npx jscpd src/
+pnpm dlx jscpd src/
 
 # Check for conflicting exports
 grep -r "export.*from" src/ | sort

diff --git a/docs/BLOG_SYSTEM.md b/docs/BLOG_SYSTEM.md
@@ -11,7 +11,7 @@ The RevampIt blog is a **git-based, TinaCMS-powered blogging system** with user-
 - **Content Format**: Markdown with frontmatter
 - **Storage**: File system (no database needed)
 - **Styling**: Tailwind CSS (Medium-inspired)
-- **Framework**: Next.js 14 (App Router)
+- **Framework**: Next.js 16 (App Router)
 
 ## File Structure
 
@@ -72,7 +72,7 @@ Each component has a single responsibility:
 
 1. **Using TinaCMS**:
    ```bash
-   npm run dev
+   pnpm run dev
    # Visit http://localhost:3000/admin
    # Click "Posts" → "Create new post"
    ```