Merge pull request #3761 from bluewave-labs/develop

develop -> master

charts/helm/checkmate/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: checkmate-chart
 description: A Helm chart for Checkmate App
 type: application
-version: 0.1.0
-appVersion: "2.3"
+version: 0.2.0
+appVersion: "v3.8.1" # "v" prefix: published image tags are v-prefixed (ghcr.io/.../checkmate-*:v3.8.1)

charts/helm/checkmate/INSTALLATION.md

@@ -19,12 +19,11 @@ cd checkmate/charts/helm/checkmate
 
 ### 2. Customize values.yaml
 Edit `values.yaml` to update:
-- `client.ingress.host` and `server.ingress.host` with your domain names
-- `server.protocol` (usually http or https)
+- `client.ingress.host` and `api.ingress.host` with your domain names
+- `api.protocol` (usually http or https)
 - **If upgrading**: Migrate persistence settings from flat structure to nested:
   - Old: `persistence.mongodbSize` → New: `persistence.mongo.size`
-  - Old: `persistence.redisSize` → New: `persistence.redis.size`
-  - Add: `persistence.mongo.storageClass` and `persistence.redis.storageClass` (leave empty for default)
+  - Add: `persistence.mongo.storageClass` (leave empty for default)
 - Secrets under the `secrets` section (`JWT_SECRET`, email credentials, API keys, etc.) — replace all change_me values
 - **For TLS/HTTPS**: Configure ingress TLS settings (see section below)
 
@@ -32,7 +31,7 @@ Edit `values.yaml` to update:
 ```bash
 helm install checkmate ./charts/helm/checkmate
 ```
-This will deploy the client, server, MongoDB, and Redis components.
+This will deploy the client, api, and MongoDB components.
 
 ### 4. Verify the deployment
 Check pods and services:
@@ -43,6 +42,137 @@ kubectl get svc
 
 Once all pods are `Running` and `Ready`, you can access Checkmate via the configured ingress hosts.
 
+## Upgrading from a previous release
+
+This release renames the `server.*` value block to `api.*` and drops the (unused) bundled Redis.
+Read this before running `helm upgrade` on an existing install.
+
+### `server.*` → `api.*` (values rename)
+
+The value block formerly named `server` is now `api` (`server.image` → `api.image`,
+`server.ingress.host` → `api.ingress.host`, `server.protocol` → `api.protocol`, `server.resources`,
+`server.affinity`, `server.tolerations`, `server.ingress.*`, etc.).
+
+**Your existing `server.*` overrides keep working** — the chart merges any legacy `server.*` values on
+top of the `api.*` defaults (legacy wins where set), so an unchanged values file upgrades cleanly. The
+shim is transitional; migrate your overrides to `api.*` at your convenience and drop the `server:`
+block. If you set **both** `server.*` and `api.*` for the same field, the legacy `server.*` value wins —
+don't mix them.
+
+### Resource renames cause a replace, not a rename
+
+The Kubernetes objects are renamed alongside the values:
+
+| Old object | New object |
+| --- | --- |
+| Deployment/Service `checkmate-server` | `checkmate-api` |
+| Ingress `checkmate-server-ingress` | `checkmate-api-ingress` |
+| ConfigMap `checkmate-server-nginx-cm` | `checkmate-client-nginx-cm` |
+
+Helm deletes the old objects and creates the new ones on upgrade. Expect a brief API restart and a
+**new ClusterIP** for the API Service — update anything outside the chart that referenced the
+`checkmate-server` Service by name. MongoDB data (its PVC) is untouched.
+
+### Redis removed
+
+The bundled Redis StatefulSet/Service and the `redis.*` / `persistence.redis.*` values are gone — the
+scheduler runs in-process and never used them. Default installs (`redis.enabled: false`) are
+unaffected. If you had explicitly set `redis.enabled: true`, **the Redis StatefulSet and its PVC are
+deleted on upgrade** — back up anything you stored there first. Leftover `redis:` / `persistence.redis:`
+keys in your values file are harmless (ignored).
+
+### New secret defaults
+
+`NODE_ENV: production`, `LOG_LEVEL: info`, and `TOKEN_TTL: 99d` are now part of the default `secrets`
+block and merge into your install unless you override them. Set them explicitly if you relied on
+different values (e.g. a non-production `NODE_ENV`).
+
+### Image tags follow the chart's `appVersion`
+
+Each tier's `image` value is now the repository **without a tag**; the tag defaults to the chart's
+`appVersion`, so the client, api, worker, and mongodb images all move together when you upgrade the
+chart. You can still pin per tier:
+
+```yaml
+api:
+  image: ghcr.io/bluewave-labs/checkmate-backend   # repo only
+  tag: ""            # empty → Chart.appVersion; set e.g. "v3.1.0" to pin, or "latest" for a dev tag
+```
+
+- `<tier>.tag` overrides the version for that tier. The `worker` tier inherits `api.tag` (and
+  `api.image`) unless you set `worker.tag` / `worker.image`.
+- If you put a **full `repo:tag`** in `image` (e.g. a legacy `server.image: …:v3.2.0` override), it is
+  used verbatim and the `tag` field is ignored — so existing pinned values keep working unchanged.
+
+**Prefer a pinned tag over `latest`.** With the default `imagePullPolicy: IfNotPresent`, `latest` is
+cached per node and never refreshed, and `helm rollback` can't move a floating tag — pin a version (or
+let it default to `appVersion`) for reproducible, rollback-able deploys.
+
+## Scaling: the worker tier & autoscaling
+
+By default the chart runs a single all-in-one API pod that both schedules **and** processes monitoring
+jobs (`worker.enabled: false`). For larger deployments you can split processing onto a dedicated,
+horizontally-scalable worker tier.
+
+### Topology
+
+| `worker.enabled` | API (`checkmate-api`) | Worker (`checkmate-worker`) |
+| --- | --- | --- |
+| `false` (default) | schedules **and** processes jobs (`QUEUE_PRIMARY_PROCESSES=true`) | not deployed |
+| `true` | schedules + serves the API only (`QUEUE_PRIMARY_PROCESSES=false`, derived) | processes all jobs |
+
+`QUEUE_PRIMARY_PROCESSES` is **derived** from `worker.enabled` — you never set it directly, so the API
+and worker tier can never both process (or both ignore) the queue.
+
+### Enabling the worker tier
+
+```yaml
+worker:
+  enabled: true
+  replicas: 2   # used only when autoscaling.enabled = false
+```
+
+The worker takes **no inbound traffic** (no Service): the kubelet probes pod IPs directly on
+`HEALTH_PORT` (`/livez`, `/readyz`), and graceful shutdown drains in-flight jobs before exit.
+
+> **Invariant:** `worker.terminationGracePeriodSeconds` (default `30`) **must stay greater than the
+> server drain timeout (25s)**. Lower it and Kubernetes SIGKILLs workers mid-drain, losing in-flight
+> checks.
+
+> **Caveat:** with the worker tier enabled the API no longer processes jobs, so if **all** workers are
+> down nothing processes. The `autoscaling.minReplicaCount: 1` floor plus liveness restarts mitigate
+> this; full failover to the API would need leader election (not supported).
+
+### Autoscaling with KEDA
+
+Backlog-driven autoscaling is **off by default** and requires the
+[KEDA operator](https://keda.sh/) installed in-cluster. Enable it with:
+
+```yaml
+worker:
+  enabled: true
+  autoscaling:
+    enabled: true
+    minReplicaCount: 1     # processing floor — never 0, or checks silently stall
+    maxReplicaCount: 10
+    backlogPerReplica: 50  # target due-job backlog per worker
+    mongo:
+      dbName: uptime_db    # MUST match the database in DB_CONNECTION_STRING
+```
+
+A KEDA `ScaledObject` queries MongoDB directly for the due-check backlog and scales the worker
+Deployment between `minReplicaCount` and `maxReplicaCount`. When autoscaling is on, the Deployment
+omits `replicas` so it doesn't fight the HPA KEDA creates. Make sure `autoscaling.mongo.dbName`
+matches the database name in your `DB_CONNECTION_STRING`, or the scaler counts the wrong DB (always 0
+backlog → never scales up).
+
+#### Fallback: Prometheus-adapter HPA (not shipped)
+
+If your KEDA/Mongo versions reject the `$$NOW`/`$toLong` query, or you already run Prometheus, scrape
+the worker's `/metrics` (`checkmate_worker_due_backlog`), expose it via prometheus-adapter, and target
+it with a standard `HorizontalPodAutoscaler`. The manifest is left to the operator; the app computes
+`now` in code on this path, so the query coercion is unnecessary.
+
 ## Enabling TLS/HTTPS with cert-manager
 
 If you have [cert-manager](https://cert-manager.io/) installed in your cluster, you can enable automatic TLS certificate provisioning using Let's Encrypt or other certificate issuers.
@@ -68,7 +198,7 @@ client:
       enabled: true
       secretName: checkmate-client-tls
 
-server:
+api:
   protocol: https
   ingress:
     enabled: true
@@ -78,7 +208,7 @@ server:
       cert-manager.io/cluster-issuer: "letsencrypt-prod"
     tls:
       enabled: true
-      secretName: checkmate-server-tls
+      secretName: checkmate-api-tls
 ```
 
 ### Alternative: Using --set flags
@@ -88,13 +218,13 @@ You can also enable TLS during installation using Helm's `--set` flags:
 ```bash
 helm install checkmate ./charts/helm/checkmate \
   --set client.protocol=https \
-  --set server.protocol=https \
+  --set api.protocol=https \
   --set client.ingress.annotations."cert-manager\.io/cluster-issuer"="letsencrypt-prod" \
   --set client.ingress.tls.enabled=true \
   --set client.ingress.tls.secretName=checkmate-client-tls \
-  --set server.ingress.annotations."cert-manager\.io/cluster-issuer"="letsencrypt-prod" \
-  --set server.ingress.tls.enabled=true \
-  --set server.ingress.tls.secretName=checkmate-server-tls
+  --set api.ingress.annotations."cert-manager\.io/cluster-issuer"="letsencrypt-prod" \
+  --set api.ingress.tls.enabled=true \
+  --set api.ingress.tls.secretName=checkmate-api-tls
 ```
 
 ### Verification
@@ -107,7 +237,7 @@ kubectl get certificates
 
 # Check certificate details
 kubectl describe certificate checkmate-client-tls
-kubectl describe certificate checkmate-server-tls
+kubectl describe certificate checkmate-api-tls
 
 # Verify the secrets were created
 kubectl get secrets | grep checkmate-tls

charts/helm/checkmate/templates/_helpers.tpl

@@ -0,0 +1,35 @@
+{{- /*
+Back-compat shim: the `server.*` value block was renamed to `api.*`. Existing installs that
+still pass a legacy `server:` block keep working — this returns the effective API values with any
+legacy `server.*` overrides merged on top of the `api.*` defaults (legacy wins where set).
+
+New installs have no `server:` key, so this is a no-op deepCopy of `.Values.api`. Consume it as:
+  {{- $api := include "checkmate.api" . | fromYaml -}}
+then reference `$api.*` instead of `.Values.api.*`.
+*/}}
+{{- define "checkmate.api" -}}
+{{- $api := deepCopy .Values.api -}}
+{{- with .Values.server -}}
+{{- $api = mergeOverwrite $api (deepCopy .) -}}
+{{- end -}}
+{{- $api | toYaml -}}
+{{- end -}}
+
+{{- /*
+Resolve a full image reference from a repo + optional tag. `appVersion` is the single source of
+truth for tags: bumping Chart.appVersion moves every tier at once. Call as:
+  {{ include "checkmate.image" (dict "image" $repo "tag" $tag "root" $) }}
+
+If `image` already carries a tag (a ":" in its final path segment) it is used verbatim — this keeps
+legacy `server.image: repo:tag` overrides working and lets anyone pin a full ref (e.g. tag "latest").
+A ":" only in the registry segment (a registry port like "reg:5000/x") is ignored, so a tag is still
+appended. Otherwise the tag is `tag` if set, else the chart's appVersion.
+*/}}
+{{- define "checkmate.image" -}}
+{{- $lastSegment := .image | splitList "/" | last -}}
+{{- if contains ":" $lastSegment -}}
+{{- .image -}}
+{{- else -}}
+{{- printf "%s:%s" .image (.tag | default .root.Chart.AppVersion) -}}
+{{- end -}}
+{{- end -}}

charts/helm/checkmate/templates/api/deployment.yaml

@@ -0,0 +1,65 @@
+{{- $api := include "checkmate.api" . | fromYaml -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: checkmate-api
+spec:
+  replicas: 1 # single scheduler — seeds/reconciles the jobs collection
+  selector:
+    matchLabels:
+      app: checkmate-api
+  template:
+    metadata:
+      labels:
+        app: checkmate-api
+    spec:
+    {{- with $api.affinity }}
+      affinity:
+        {{- tpl ( . | toYaml) $ | nindent 8 }}
+    {{- end }}
+    {{- with $api.tolerations }}
+      tolerations:
+        {{- tpl ( . | toYaml) $ | nindent 8 }}
+    {{- end }}
+      containers:
+        - name: api
+          image: {{ include "checkmate.image" (dict "image" $api.image "tag" $api.tag "root" $) }}
+          imagePullPolicy: {{ $api.imagePullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ $api.port }}
+          envFrom:
+            - secretRef:
+                name: checkmate-secrets
+          # Probes hit the Express /api/v1/health endpoint — proves the HTTP server is responsive.
+          # NOTE: this does NOT detect a wedged job loop when queuePrimaryProcesses=true (the API is
+          # also a worker). Worker-aware health for that mode is a follow-up — see worker-health-checks.md §7.5.
+          livenessProbe:
+            httpGet:
+              path: /api/v1/health
+              port: http
+            initialDelaySeconds: {{ $api.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ $api.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ $api.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ $api.probes.liveness.failureThreshold }}
+          readinessProbe:
+            httpGet:
+              path: /api/v1/health
+              port: http
+            initialDelaySeconds: {{ $api.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ $api.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ $api.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ $api.probes.readiness.failureThreshold }}
+          {{- with $api.resources }}
+          resources:
+              {{- tpl ( . | toYaml) $ | nindent 12 }}
+          {{- end }}
+          env:
+          - name: CLIENT_HOST
+            value: "{{ .Values.client.protocol }}://{{ .Values.client.ingress.host }}"
+          - name: QUEUE_MODE
+            value: "primary"
+          # Derived: when a worker tier is deployed the API only schedules (false); otherwise it is
+          # all-in-one and processes jobs itself (true). Keeps the two from ever competing for jobs.
+          - name: QUEUE_PRIMARY_PROCESSES
+            value: {{ not .Values.worker.enabled | quote }}

charts/helm/checkmate/templates/api/ingress.yaml

@@ -1,11 +1,12 @@
-{{- if .Values.server.ingress.enabled }}
+{{- $api := include "checkmate.api" . | fromYaml -}}
+{{- if $api.ingress.enabled }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: checkmate-server-ingress
-  {{- if .Values.server.ingress.annotations }}
+  name: checkmate-api-ingress
+  {{- if $api.ingress.annotations }}
   annotations:
-    {{- range $key, $value := .Values.server.ingress.annotations }}
+    {{- range $key, $value := $api.ingress.annotations }}
     {{ $key }}: {{ $value | quote }}
     {{- end }}
   {{- end }}
@@ -17,22 +18,22 @@ metadata:
     #nginx.ingress.kubernetes.io/cors-allow-headers: "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization"
     #nginx.ingress.kubernetes.io/cors-allow-credentials: "true"*/}}
 spec:
-  ingressClassName: {{ .Values.server.ingress.className }}
-  {{- if .Values.server.ingress.tls.enabled }}
+  ingressClassName: {{ $api.ingress.className }}
+  {{- if $api.ingress.tls.enabled }}
   tls:
     - hosts:
-        - {{ .Values.server.ingress.host }}
-      secretName: {{ default (printf "%s-server-tls" .Release.Name) .Values.server.ingress.tls.secretName }}
+        - {{ $api.ingress.host }}
+      secretName: {{ default (printf "%s-api-tls" .Release.Name) $api.ingress.tls.secretName }}
   {{- end }}
   rules:
-    - host: {{ .Values.server.ingress.host }}
+    - host: {{ $api.ingress.host }}
       http:
         paths:
           - path: /api/v1
             pathType: Prefix
             backend:
               service:
-                name: checkmate-server
+                name: checkmate-api
                 port:
-                  number: {{ .Values.server.port }}
+                  number: {{ $api.port }}
 {{- end }}

charts/helm/checkmate/templates/api/service.yaml

@@ -0,0 +1,10 @@
+{{- $api := include "checkmate.api" . | fromYaml -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: checkmate-api
+spec:
+  selector:
+    app: checkmate-api
+  ports:
+    - port: {{ $api.port }}

charts/helm/checkmate/templates/client/deployment.yaml

@@ -1,3 +1,4 @@
+{{- $api := include "checkmate.api" . | fromYaml -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -22,12 +23,13 @@ spec:
     {{- end }}
       containers:
         - name: client
-          image: {{ .Values.client.image }}
+          image: {{ include "checkmate.image" (dict "image" .Values.client.image "tag" .Values.client.tag "root" $) }}
+          imagePullPolicy: {{ .Values.client.imagePullPolicy }}
           ports:
             - containerPort: {{ .Values.client.port }}
           env:
             - name: UPTIME_APP_API_BASE_URL
-              value: "{{ .Values.server.protocol }}://{{ .Values.server.ingress.host }}/api/v1"
+              value: "{{ $api.protocol }}://{{ $api.ingress.host }}/api/v1"
             - name: UPTIME_APP_CLIENT_HOST
               value: "{{ .Values.client.protocol }}://{{ .Values.client.ingress.host }}"
           volumeMounts:
@@ -41,4 +43,4 @@ spec:
       volumes:
         - name: config-volume
           configMap:
-            name: checkmate-server-nginx-cm
+            name: checkmate-client-nginx-cm

charts/helm/checkmate/templates/client/nginx-cm.yaml

@@ -1,7 +1,8 @@
+{{- $api := include "checkmate.api" . | fromYaml -}}
 apiVersion: v1
-kind: ConfigMap 
+kind: ConfigMap
 metadata:
-  name: checkmate-server-nginx-cm
+  name: checkmate-client-nginx-cm
 data:
   default.conf: |
     server {
@@ -22,7 +23,7 @@ data:
       }
 
       # location /api/ {
-      #     proxy_pass http://{{ .Values.server.ingress.host }}:5000/api/;
+      #     proxy_pass http://{{ $api.ingress.host }}:5000/api/;
       #     proxy_http_version 1.1;
       #     proxy_set_header Host $host;
       #     proxy_set_header X-Real-IP $remote_addr;
@@ -31,7 +32,7 @@ data:
       # }
 
       location /api-docs/ {
-          proxy_pass http://{{ .Values.server.ingress.host }}:5000/api-docs/;
+          proxy_pass http://{{ $api.ingress.host }}:5000/api-docs/;
           proxy_http_version 1.1;
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;

charts/helm/checkmate/templates/db/mongodb-statefulsets.yaml

@@ -22,7 +22,8 @@ spec:
     {{- end }}
       containers:
         - name: mongodb
-          image: {{ .Values.mongodb.image }}
+          image: {{ include "checkmate.image" (dict "image" .Values.mongodb.image "tag" .Values.mongodb.tag "root" $) }}
+          imagePullPolicy: {{ .Values.mongodb.imagePullPolicy }}
           ports:
             - containerPort: {{ .Values.mongodb.port }}
           command: ["mongod", "--quiet", "--bind_ip_all"]
@@ -37,7 +38,9 @@ spec:
     - metadata:
         name: checkmate-mongo-persistent-storage
       spec:
-        storageClassName: {{ .Values.persistence.mongo.storageClass | quote }}
+        {{- with .Values.persistence.mongo.storageClass }}
+        storageClassName: {{ . | quote }} {{/* omitted when empty so the cluster's default StorageClass applies */}}
+        {{- end }}
         accessModes: ["ReadWriteOnce"]
         resources:
           requests:

charts/helm/checkmate/templates/prechecks.yaml

@@ -1,14 +1,15 @@
+{{- $api := include "checkmate.api" . | fromYaml -}}
 {{- if eq .Values.client.ingress.host "change_me" }}
   {{- fail "client.ingress.host must be overridden and not set to 'change_me'" }}
 {{- end }}
 
-{{- if eq .Values.server.ingress.host "change_me" }}
-  {{- fail "server.ingress.host must be overridden and not set to 'change_me'" }}
+{{- if eq $api.ingress.host "change_me" }}
+  {{- fail "api.ingress.host (or legacy server.ingress.host) must be overridden and not set to 'change_me'" }}
 {{- end }}
 
-{{- $serverProtocol := .Values.server.protocol }}
-{{- if not (or (eq $serverProtocol "http") (eq $serverProtocol "https")) }}
-  {{- fail "server.protocol must be either 'http' or 'https'" }}
+{{- $apiProtocol := $api.protocol }}
+{{- if not (or (eq $apiProtocol "http") (eq $apiProtocol "https")) }}
+  {{- fail "api.protocol must be either 'http' or 'https'" }}
 {{- end }}
 
 {{- $clientProtocol := .Values.client.protocol }}
@@ -21,28 +22,33 @@
   {{- fail "client.ingress.tls.enabled is true but client.protocol is not 'https'. Set client.protocol: https to avoid mixed content." }}
 {{- end }}
 
-{{- if and .Values.server.ingress.tls.enabled (ne $serverProtocol "https") }}
-  {{- fail "server.ingress.tls.enabled is true but server.protocol is not 'https'. Set server.protocol: https to ensure correct API base URL." }}
+{{- if and $api.ingress.tls.enabled (ne $apiProtocol "https") }}
+  {{- fail "api.ingress.tls.enabled is true but api.protocol is not 'https'. Set api.protocol: https to ensure correct API base URL." }}
 {{- end }}
 
 {{/* If client runs on https, API must also be https to avoid mixed content */}}
-{{- if and (eq $clientProtocol "https") (ne $serverProtocol "https") }}
-  {{- fail "client.protocol is 'https' but server.protocol is not. Set server.protocol: https to prevent browser mixed-content issues." }}
+{{- if and (eq $clientProtocol "https") (ne $apiProtocol "https") }}
+  {{- fail "client.protocol is 'https' but api.protocol is not. Set api.protocol: https to prevent browser mixed-content issues." }}
 {{- end }}
 
 {{/* Fail early if TLS enabled without cert-manager annotations (cluster-issuer or issuer) */}}
 {{- $cAnn := .Values.client.ingress.annotations | default dict }}
-{{- $sAnn := .Values.server.ingress.annotations | default dict }}
+{{- $aAnn := $api.ingress.annotations | default dict }}
 
 {{- $clientHasIssuer := or (hasKey $cAnn "cert-manager.io/cluster-issuer") (hasKey $cAnn "cert-manager.io/issuer") }}
-{{- $serverHasIssuer := or (hasKey $sAnn "cert-manager.io/cluster-issuer") (hasKey $sAnn "cert-manager.io/issuer") }}
+{{- $apiHasIssuer := or (hasKey $aAnn "cert-manager.io/cluster-issuer") (hasKey $aAnn "cert-manager.io/issuer") }}
 
 {{- if and .Values.client.ingress.tls.enabled (not $clientHasIssuer) }}
   {{- fail "client.ingress.tls.enabled is true but no cert-manager issuer annotation found. Add 'cert-manager.io/cluster-issuer' or 'cert-manager.io/issuer'." }}
 {{- end }}
 
-{{- if and .Values.server.ingress.tls.enabled (not $serverHasIssuer) }}
-  {{- fail "server.ingress.tls.enabled is true but no cert-manager issuer annotation found. Add 'cert-manager.io/cluster-issuer' or 'cert-manager.io/issuer'." }}
+{{- if and $api.ingress.tls.enabled (not $apiHasIssuer) }}
+  {{- fail "api.ingress.tls.enabled is true but no cert-manager issuer annotation found. Add 'cert-manager.io/cluster-issuer' or 'cert-manager.io/issuer'." }}
 {{- end }}
 
-{{/* Secret name can be omitted; we default to <release>-client|server-tls in templates */}}
+{{/* Worker grace period must exceed the server drain timeout (25s) or workers are SIGKILLed mid-drain */}}
+{{- if and .Values.worker.enabled (le (int .Values.worker.terminationGracePeriodSeconds) 25) }}
+  {{- fail "worker.terminationGracePeriodSeconds must be greater than 25 (the server drain timeout) or workers are killed mid-drain" }}
+{{- end }}
+
+{{/* Secret name can be omitted; we default to <release>-client|api-tls in templates */}}

charts/helm/checkmate/templates/redis-service.yaml

@@ -1,11 +0,0 @@
-{{- if .Values.redis.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: checkmate-redis
-spec:
-  selector:
-    app: checkmate-redis
-  ports:
-    - port: {{ .Values.redis.port }}
-{{- end }}

charts/helm/checkmate/templates/redis-statefulsets.yaml

@@ -1,33 +0,0 @@
-{{- if .Values.redis.enabled }}
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: checkmate-redis
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: checkmate-redis
-  template:
-    metadata:
-      labels:
-        app: checkmate-redis
-    spec:
-      containers:
-        - name: redis
-          image: {{ .Values.redis.image }}
-          ports:
-            - containerPort: {{ .Values.redis.port }}
-          volumeMounts:
-            - name: redis-data
-              mountPath: /data
-  volumeClaimTemplates:
-    - metadata:
-        name: checkmate-redis-persistent-storage
-      spec:
-        storageClassName: {{ .Values.persistence.redis.storageClass | quote }}
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: {{ .Values.persistence.redis.size | default "1Gi" | quote }}
-{{- end }}

charts/helm/checkmate/templates/secrets.yaml

@@ -4,6 +4,14 @@
   {{- fail "secrets.JWT_SECRET must be overridden and cannot be 'change_me'" }}
 {{- end }}
 
+{{- /*
+  The bundled Mongo service ("checkmate-mongodb") lives in .Release.Namespace. App pods reach it
+  by bare name, but the KEDA operator runs in its own namespace and a bare name is NXDOMAIN there,
+  so worker autoscaling fails to query the backlog. Qualify the in-cluster host to its FQDN here so
+  the one connection string resolves from every namespace. External/already-qualified hosts are not
+  matched (the char after the host name is "." for an FQDN, which the pattern excludes).
+*/}}
+{{- $mongoFqdn := printf "checkmate-mongodb.%s.svc.cluster.local" .Release.Namespace }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -11,5 +19,9 @@ metadata:
 type: Opaque
 stringData:
 {{- range $key, $value := $secrets }}
+{{- if eq $key "DB_CONNECTION_STRING" }}
+  {{ $key }}: {{ regexReplaceAll "(//|@)checkmate-mongodb([:/,]|$)" $value (printf "${1}%s${2}" $mongoFqdn) | quote }}
+{{- else }}
   {{ $key }}: {{ $value | quote }}
+{{- end }}
 {{- end }}

charts/helm/checkmate/templates/server-deployment.yaml

@@ -1,37 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: checkmate-server
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: checkmate-server
-  template:
-    metadata:
-      labels:
-        app: checkmate-server
-    spec:
-    {{- with .Values.server.affinity }}
-      affinity:
-        {{- tpl ( . | toYaml) $ | nindent 8 }}
-    {{- end }}
-    {{- with .Values.server.tolerations }}
-      tolerations:
-        {{- tpl ( . | toYaml) $ | nindent 8 }}
-    {{- end }}
-      containers:
-        - name: server
-          image: {{ .Values.server.image }}
-          ports:
-            - containerPort: {{ .Values.server.port }}
-          envFrom:
-            - secretRef:
-                name: checkmate-secrets
-          {{- with .Values.server.resources }}
-          resources:
-              {{- tpl ( . | toYaml) $ | nindent 12 }}
-          {{- end }}
-          env:
-          - name: CLIENT_HOST
-            value: "{{ .Values.client.protocol }}://{{ .Values.client.ingress.host }}"

charts/helm/checkmate/templates/server-service.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: checkmate-server
-spec:
-  selector:
-    app: checkmate-server
-  ports:
-    - port: {{ .Values.server.port }}

charts/helm/checkmate/templates/worker/deployment.yaml

@@ -0,0 +1,66 @@
+{{- $api := include "checkmate.api" . | fromYaml -}}
+{{- if .Values.worker.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: checkmate-worker
+spec:
+  {{- if not .Values.worker.autoscaling.enabled }}
+  replicas: {{ .Values.worker.replicas }} # omitted when autoscaling owns the replica count
+  {{- end }}
+  selector:
+    matchLabels:
+      app: checkmate-worker
+  template:
+    metadata:
+      labels:
+        app: checkmate-worker
+    spec:
+      terminationGracePeriodSeconds: {{ .Values.worker.terminationGracePeriodSeconds }}
+    {{- with .Values.worker.affinity }}
+      affinity:
+        {{- tpl ( . | toYaml) $ | nindent 8 }}
+    {{- end }}
+    {{- with .Values.worker.tolerations }}
+      tolerations:
+        {{- tpl ( . | toYaml) $ | nindent 8 }}
+    {{- end }}
+      containers:
+        - name: worker
+          image: {{ include "checkmate.image" (dict "image" (.Values.worker.image | default $api.image) "tag" (.Values.worker.tag | default $api.tag) "root" $) }}
+          imagePullPolicy: {{ .Values.worker.imagePullPolicy | default $api.imagePullPolicy }}
+          ports:
+            - name: health
+              containerPort: {{ .Values.worker.healthPort }}
+          envFrom:
+            - secretRef:
+                name: checkmate-secrets # DB_CONNECTION_STRING (+ JWT_SECRET/CLIENT_HOST for validateEnv)
+          env:
+          # Secret default CLIENT_HOST is the non-URL "change_me"; override like the API so validateEnv passes.
+          - name: CLIENT_HOST
+            value: "{{ .Values.client.protocol }}://{{ .Values.client.ingress.host }}"
+          - name: QUEUE_MODE
+            value: "worker"
+          - name: HEALTH_PORT
+            value: {{ .Values.worker.healthPort | quote }}
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: health
+            initialDelaySeconds: {{ .Values.worker.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.worker.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.worker.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.worker.probes.liveness.failureThreshold }}
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: health
+            initialDelaySeconds: {{ .Values.worker.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.worker.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.worker.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.worker.probes.readiness.failureThreshold }}
+          {{- with .Values.worker.resources }}
+          resources:
+              {{- tpl ( . | toYaml) $ | nindent 12 }}
+          {{- end }}
+{{- end }}

charts/helm/checkmate/templates/worker/scaledobject.yaml

@@ -0,0 +1,30 @@
+{{- if and .Values.worker.enabled .Values.worker.autoscaling.enabled }}
+apiVersion: keda.sh/v1alpha1
+kind: ScaledObject
+metadata:
+  name: checkmate-worker
+spec:
+  scaleTargetRef:
+    name: checkmate-worker
+  minReplicaCount: {{ .Values.worker.autoscaling.minReplicaCount }} # floor: never 0 — a cold gap stops checks
+  maxReplicaCount: {{ .Values.worker.autoscaling.maxReplicaCount }}
+  cooldownPeriod: {{ .Values.worker.autoscaling.cooldownPeriod }}
+  advanced:
+    horizontalPodAutoscalerConfig:
+      behavior:
+        scaleDown:
+          stabilizationWindowSeconds: {{ .Values.worker.autoscaling.stabilizationWindowSeconds }}
+  triggers:
+    - type: mongodb
+      metadata:
+        dbName: {{ .Values.worker.autoscaling.mongo.dbName | quote }}
+        collection: {{ .Values.worker.autoscaling.mongo.collection | quote }}
+        # The Phase 2 countDueBacklog predicate, time-relativized with $$NOW (epoch-ms via $toLong):
+        query: >-
+          { "type": "check", "isActive": true,
+            "$expr": { "$lte": ["$nextScheduledAt", { "$toLong": "$$NOW" }] },
+            "$or": [ { "lockedUntil": null },
+                     { "$expr": { "$lt": ["$lockedUntil", { "$toLong": "$$NOW" }] } } ] }
+        queryValue: {{ .Values.worker.autoscaling.backlogPerReplica | quote }}
+        connectionStringFromEnv: DB_CONNECTION_STRING # resolved from the worker's checkmate-secrets
+{{- end }}

charts/helm/checkmate/values.yaml

@@ -1,5 +1,7 @@
 client:
-  image: ghcr.io/bluewave-labs/checkmate-client:v3.2.0
+  image: ghcr.io/bluewave-labs/checkmate-client
+  tag: "" # defaults to Chart.appVersion; set a full repo:tag in `image` to pin (e.g. a :latest dev tag)
+  imagePullPolicy: IfNotPresent # IfNotPresent so kind-loaded :latest images are used (not pulled)
   port: 80
   protocol: http
   ingress:
@@ -17,10 +19,24 @@ client:
       # a cert-manager issuer annotation (e.g. cert-manager.io/cluster-issuer: "letsencrypt-prod").
       # The secret will be automatically created by cert-manager when using the cert-manager.io/cluster-issuer annotation
 
-server:
-  image: ghcr.io/bluewave-labs/checkmate-backend:v3.2.0
+api:
+  image: ghcr.io/bluewave-labs/checkmate-backend
+  tag: "" # defaults to Chart.appVersion; set a full repo:tag in `image` to pin (e.g. a :latest dev tag)
+  imagePullPolicy: IfNotPresent # IfNotPresent so kind-loaded :latest images are used (not pulled)
   port: 52345
   protocol: http
+  # Liveness/readiness probes hit GET /api/v1/health on the api port (proves the HTTP server is up).
+  probes:
+    liveness:
+      initialDelaySeconds: 10
+      periodSeconds: 10
+      timeoutSeconds: 3
+      failureThreshold: 3
+    readiness:
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      timeoutSeconds: 3
+      failureThreshold: 3
   ingress:
     enabled: true
     host: change_me
@@ -31,40 +47,62 @@ server:
     #   cert-manager.io/cluster-issuer: "letsencrypt-prod"
     tls:
       enabled: false
-      # secretName: {{ .Release.Name }}-server-tls  # Optional; defaults to <release>-server-tls if omitted
-      # Note: when enabling TLS, also set server.protocol: https and add
+      # secretName: {{ .Release.Name }}-api-tls  # Optional; defaults to <release>-api-tls if omitted
+      # Note: when enabling TLS, also set api.protocol: https and add
       # a cert-manager issuer annotation (e.g. cert-manager.io/cluster-issuer: "letsencrypt-prod").
       # The secret will be automatically created by cert-manager when using the cert-manager.io/cluster-issuer annotation
 
-redis:
-  enabled: false
-  image: redis:7.2
-  port: 6379
-
 mongodb:
-  image: ghcr.io/bluewave-labs/checkmate-mongo:v3.2.0
+  image: ghcr.io/bluewave-labs/checkmate-mongo
+  tag: "" # defaults to Chart.appVersion; set a full repo:tag in `image` to pin
+  imagePullPolicy: IfNotPresent # IfNotPresent so kind-loaded :latest images are used (not pulled)
   port: 27017
 
+worker:
+  # Off by default; existing installs are unchanged. When true, a dedicated worker processes all
+  # jobs and the API stops processing (QUEUE_PRIMARY_PROCESSES is derived as false). When false, the
+  # API is all-in-one and processes jobs itself.
+  enabled: false
+  image: "" # defaults to api.image when empty, same as API image
+  tag: "" # defaults to api.tag (-> Chart.appVersion) when empty
+  imagePullPolicy: "" # defaults to api.imagePullPolicy when empty
+  replicas: 1 # used only when autoscaling.enabled = false
+  healthPort: 52346 # HEALTH_PORT; serves /livez /readyz /metrics
+  terminationGracePeriodSeconds: 30 # MUST stay > the server drain timeout (25s) or workers are killed mid-drain
+  resources: {}
+  affinity: {}
+  tolerations: {}
+  probes:
+    liveness: # /livez — failureThreshold>=3 so one slow tick never restarts mid-job
+      initialDelaySeconds: 10
+      periodSeconds: 10
+      timeoutSeconds: 3
+      failureThreshold: 3
+    readiness: # /readyz — flips to 503 on drain
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      timeoutSeconds: 3
+      failureThreshold: 3
+  autoscaling:
+    enabled: false # requires the KEDA operator installed in-cluster
+    minReplicaCount: 1 # processing floor — never 0 (a cold gap silently stops checks)
+    maxReplicaCount: 10
+    backlogPerReplica: 50 # KEDA queryValue: target due-backlog per worker
+    cooldownPeriod: 300 # seconds before scaling an idle target down
+    stabilizationWindowSeconds: 300 # damp the interval-boundary herd
+    mongo:
+      dbName: uptime_db # must match DB_CONNECTION_STRING's database
+      collection: jobs
+
 secrets:
   JWT_SECRET: change_me
-#  REFRESH_TOKEN_SECRET: change_me
-#  SYSTEM_EMAIL_ADDRESS: test@example.com
-#  SYSTEM_EMAIL_PASSWORD: change_me
-#  SYSTEM_EMAIL_HOST: smtp.example.com
-#  SYSTEM_EMAIL_PORT: "587"
-#  PAGESPEED_API_KEY: change_me
-  DB_CONNECTION_STRING: mongodb://checkmate-mongodb.namespace.svc:27017/uptime_db
+  DB_CONNECTION_STRING: mongodb://checkmate-mongodb:27017/uptime_db
   CLIENT_HOST: change_me
-#  REDIS_HOST: redis
-#  REDIS_PORT: "6379"
-#  DB_TYPE: MongoDB
-#  TOKEN_TTL: 99d
-#  REFRESH_TOKEN_TTL: 99d
+  NODE_ENV: production
+  LOG_LEVEL: info
+  TOKEN_TTL: 99d
 
 persistence:
   mongo:
     size: 5Gi
     storageClass: ""
-  redis:
-    size: 1Gi
-    storageClass: ""

client/package-lock.json

@@ -1,13 +1,14 @@
 {
 	"name": "client",
-	"version": "3.8.1",
+	"version": "3.9.2",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "client",
-			"version": "3.8.1",
+			"version": "3.9.2",
 			"dependencies": {
+				"@csstools/css-tokenizer": "^3.0.4",
 				"@emotion/react": "^11.13.3",
 				"@emotion/styled": "^11.13.0",
 				"@hello-pangea/dnd": "^18.0.0",
@@ -23,7 +24,7 @@
 				"html2canvas": "^1.4.1",
 				"human-interval": "2.0.1",
 				"i18next": "25.4.2",
-				"joi": "17.13.3",
+				"joi": "17.13.4",
 				"lucide-react": "^0.562.0",
 				"maplibre-gl": "^5.19.0",
 				"mui-color-input": "^7.0.0",
@@ -64,10 +65,12 @@
 			}
 		},
 		"node_modules/@babel/code-frame": {
-			"version": "7.29.0",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+			"integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
 			"license": "MIT",
 			"dependencies": {
-				"@babel/helper-validator-identifier": "^7.28.5",
+				"@babel/helper-validator-identifier": "^7.29.7",
 				"js-tokens": "^4.0.0",
 				"picocolors": "^1.1.1"
 			},
@@ -76,26 +79,30 @@
 			}
 		},
 		"node_modules/@babel/compat-data": {
-			"version": "7.29.0",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+			"integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
 			"license": "MIT",
 			"engines": {
 				"node": ">=6.9.0"
 			}
 		},
 		"node_modules/@babel/core": {
-			"version": "7.29.0",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+			"integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
 			"license": "MIT",
 			"peer": true,
 			"dependencies": {
-				"@babel/code-frame": "^7.29.0",
-				"@babel/generator": "^7.29.0",
-				"@babel/helper-compilation-targets": "^7.28.6",
-				"@babel/helper-module-transforms": "^7.28.6",
-				"@babel/helpers": "^7.28.6",
-				"@babel/parser": "^7.29.0",
-				"@babel/template": "^7.28.6",
-				"@babel/traverse": "^7.29.0",
-				"@babel/types": "^7.29.0",
+				"@babel/code-frame": "^7.29.7",
+				"@babel/generator": "^7.29.7",
+				"@babel/helper-compilation-targets": "^7.29.7",
+				"@babel/helper-module-transforms": "^7.29.7",
+				"@babel/helpers": "^7.29.7",
+				"@babel/parser": "^7.29.7",
+				"@babel/template": "^7.29.7",
+				"@babel/traverse": "^7.29.7",
+				"@babel/types": "^7.29.7",
 				"@jridgewell/remapping": "^2.3.5",
 				"convert-source-map": "^2.0.0",
 				"debug": "^4.1.0",
@@ -116,11 +123,13 @@
 			"license": "MIT"
 		},
 		"node_modules/@babel/generator": {
-			"version": "7.29.0",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.7.tgz",
+			"integrity": "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==",
 			"license": "MIT",
 			"dependencies": {
-				"@babel/parser": "^7.29.0",
-				"@babel/types": "^7.29.0",
+				"@babel/parser": "^7.29.7",
+				"@babel/types": "^7.29.7",
 				"@jridgewell/gen-mapping": "^0.3.12",
 				"@jridgewell/trace-mapping": "^0.3.28",
 				"jsesc": "^3.0.2"
@@ -130,11 +139,13 @@
 			}
 		},
 		"node_modules/@babel/helper-compilation-targets": {
-			"version": "7.28.6",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+			"integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
 			"license": "MIT",
 			"dependencies": {
-				"@babel/compat-data": "^7.28.6",
-				"@babel/helper-validator-option": "^7.27.1",
+				"@babel/compat-data": "^7.29.7",
+				"@babel/helper-validator-option": "^7.29.7",
 				"browserslist": "^4.24.0",
 				"lru-cache": "^5.1.1",
 				"semver": "^6.3.1"
@@ -144,30 +155,36 @@
 			}
 		},
 		"node_modules/@babel/helper-globals": {
-			"version": "7.28.0",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+			"integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
 			"license": "MIT",
 			"engines": {
 				"node": ">=6.9.0"
 			}
 		},
 		"node_modules/@babel/helper-module-imports": {
-			"version": "7.28.6",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+			"integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
 			"license": "MIT",
 			"dependencies": {
-				"@babel/traverse": "^7.28.6",
-				"@babel/types": "^7.28.6"
+				"@babel/traverse": "^7.29.7",
+				"@babel/types": "^7.29.7"
 			},
 			"engines": {
 				"node": ">=6.9.0"
 			}
 		},
 		"node_modules/@babel/helper-module-transforms": {
-			"version": "7.28.6",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+			"integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
 			"license": "MIT",
 			"dependencies": {
-				"@babel/helper-module-imports": "^7.28.6",
-				"@babel/helper-validator-identifier": "^7.28.5",
-				"@babel/traverse": "^7.28.6"
+				"@babel/helper-module-imports": "^7.29.7",
+				"@babel/helper-validator-identifier": "^7.29.7",
+				"@babel/traverse": "^7.29.7"
 			},
 			"engines": {
 				"node": ">=6.9.0"
@@ -185,42 +202,52 @@
 			}
 		},
 		"node_modules/@babel/helper-string-parser": {
-			"version": "7.27.1",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+			"integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
 			"license": "MIT",
 			"engines": {
 				"node": ">=6.9.0"
 			}
 		},
 		"node_modules/@babel/helper-validator-identifier": {
-			"version": "7.28.5",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+			"integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
 			"license": "MIT",
 			"engines": {
 				"node": ">=6.9.0"
 			}
 		},
 		"node_modules/@babel/helper-validator-option": {
-			"version": "7.27.1",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+			"integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
 			"license": "MIT",
 			"engines": {
 				"node": ">=6.9.0"
 			}
 		},
 		"node_modules/@babel/helpers": {
-			"version": "7.28.6",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+			"integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
 			"license": "MIT",
 			"dependencies": {
-				"@babel/template": "^7.28.6",
-				"@babel/types": "^7.28.6"
+				"@babel/template": "^7.29.7",
+				"@babel/types": "^7.29.7"
 			},
 			"engines": {
 				"node": ">=6.9.0"
 			}
 		},
 		"node_modules/@babel/parser": {
-			"version": "7.29.0",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz",
+			"integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==",
 			"license": "MIT",
 			"dependencies": {
-				"@babel/types": "^7.29.0"
+				"@babel/types": "^7.29.7"
 			},
 			"bin": {
 				"parser": "bin/babel-parser.js"
@@ -265,27 +292,31 @@
 			}
 		},
 		"node_modules/@babel/template": {
-			"version": "7.28.6",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+			"integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
 			"license": "MIT",
 			"dependencies": {
-				"@babel/code-frame": "^7.28.6",
-				"@babel/parser": "^7.28.6",
-				"@babel/types": "^7.28.6"
+				"@babel/code-frame": "^7.29.7",
+				"@babel/parser": "^7.29.7",
+				"@babel/types": "^7.29.7"
 			},
 			"engines": {
 				"node": ">=6.9.0"
 			}
 		},
 		"node_modules/@babel/traverse": {
-			"version": "7.29.0",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.7.tgz",
+			"integrity": "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==",
 			"license": "MIT",
 			"dependencies": {
-				"@babel/code-frame": "^7.29.0",
-				"@babel/generator": "^7.29.0",
-				"@babel/helper-globals": "^7.28.0",
-				"@babel/parser": "^7.29.0",
-				"@babel/template": "^7.28.6",
-				"@babel/types": "^7.29.0",
+				"@babel/code-frame": "^7.29.7",
+				"@babel/generator": "^7.29.7",
+				"@babel/helper-globals": "^7.29.7",
+				"@babel/parser": "^7.29.7",
+				"@babel/template": "^7.29.7",
+				"@babel/types": "^7.29.7",
 				"debug": "^4.3.1"
 			},
 			"engines": {
@@ -293,16 +324,37 @@
 			}
 		},
 		"node_modules/@babel/types": {
-			"version": "7.29.0",
+			"version": "7.29.7",
+			"resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz",
+			"integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==",
 			"license": "MIT",
 			"dependencies": {
-				"@babel/helper-string-parser": "^7.27.1",
-				"@babel/helper-validator-identifier": "^7.28.5"
+				"@babel/helper-string-parser": "^7.29.7",
+				"@babel/helper-validator-identifier": "^7.29.7"
 			},
 			"engines": {
 				"node": ">=6.9.0"
 			}
 		},
+		"node_modules/@csstools/css-tokenizer": {
+			"version": "3.0.4",
+			"resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-3.0.4.tgz",
+			"integrity": "sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/csstools"
+				},
+				{
+					"type": "opencollective",
+					"url": "https://opencollective.com/csstools"
+				}
+			],
+			"license": "MIT",
+			"engines": {
+				"node": ">=18"
+			}
+		},
 		"node_modules/@ctrl/tinycolor": {
 			"version": "4.2.0",
 			"license": "MIT",
@@ -1619,7 +1671,9 @@
 			}
 		},
 		"node_modules/@remix-run/router": {
-			"version": "1.23.2",
+			"version": "1.23.3",
+			"resolved": "https://registry.npmjs.org/@remix-run/router/-/router-1.23.3.tgz",
+			"integrity": "sha512-4An71tdz9X8+3sI4Qqqd2LWd9vS39J7sqd9EU4Scw7TJE/qB10Flv/UuqbPVgfQV9XoK8Np6jNquZitnZq5i+Q==",
 			"license": "MIT",
 			"engines": {
 				"node": ">=14.0.0"
@@ -1651,9 +1705,9 @@
 			}
 		},
 		"node_modules/@rollup/rollup-android-arm-eabi": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.59.0.tgz",
-			"integrity": "sha512-upnNBkA6ZH2VKGcBj9Fyl9IGNPULcjXRlg0LLeaioQWueH30p6IXtJEbKAgvyv+mJaMxSm1l6xwDXYjpEMiLMg==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.62.2.tgz",
+			"integrity": "sha512-6o7ZLZK+BeenkZCFNDXqpbjw9bD6nuWonvS/lwQJp7NoVVxm6p3qE7qQ5jGuBjiFsgvqjD8mZAU5oWxTmbOeOg==",
 			"cpu": [
 				"arm"
 			],
@@ -1664,9 +1718,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-android-arm64": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.59.0.tgz",
-			"integrity": "sha512-hZ+Zxj3SySm4A/DylsDKZAeVg0mvi++0PYVceVyX7hemkw7OreKdCvW2oQ3T1FMZvCaQXqOTHb8qmBShoqk69Q==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.62.2.tgz",
+			"integrity": "sha512-BaH7BllCACHoH1LguOU56UItGfUWjujlO65kS9LAodViaN4bwIKd7oeW/ZHJ/4ljr/7MIiENnNy3HJ0zXv8Zkw==",
 			"cpu": [
 				"arm64"
 			],
@@ -1677,9 +1731,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-darwin-arm64": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.59.0.tgz",
-			"integrity": "sha512-W2Psnbh1J8ZJw0xKAd8zdNgF9HRLkdWwwdWqubSVk0pUuQkoHnv7rx4GiF9rT4t5DIZGAsConRE3AxCdJ4m8rg==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.62.2.tgz",
+			"integrity": "sha512-v39RCCvj4He82I9sFmk+M1VZ0PLM9sfsLVikjfx2hYBNALhrrOR2D3JjQA6AhlaSOgcR+RzrKY7e1+bT6SUO/A==",
 			"cpu": [
 				"arm64"
 			],
@@ -1690,9 +1744,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-darwin-x64": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.59.0.tgz",
-			"integrity": "sha512-ZW2KkwlS4lwTv7ZVsYDiARfFCnSGhzYPdiOU4IM2fDbL+QGlyAbjgSFuqNRbSthybLbIJ915UtZBtmuLrQAT/w==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.62.2.tgz",
+			"integrity": "sha512-yl0y2vq3S3lHeuXhEdss6TWfKW8vkujImO12tn4ZkG/4oghr09LvdYm2RElVjokTQiUvDUGXLGsYeLqUMCKpGA==",
 			"cpu": [
 				"x64"
 			],
@@ -1703,9 +1757,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-freebsd-arm64": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.59.0.tgz",
-			"integrity": "sha512-EsKaJ5ytAu9jI3lonzn3BgG8iRBjV4LxZexygcQbpiU0wU0ATxhNVEpXKfUa0pS05gTcSDMKpn3Sx+QB9RlTTA==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.62.2.tgz",
+			"integrity": "sha512-tT4pvt4qXD+vEoezupCWi+a1F0vvDiksiHc+PxRlYTOH1I6/X4id9jPxTP+Fg+545euaFT1jJVs4CEdHZAU1vw==",
 			"cpu": [
 				"arm64"
 			],
@@ -1716,9 +1770,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-freebsd-x64": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.59.0.tgz",
-			"integrity": "sha512-d3DuZi2KzTMjImrxoHIAODUZYoUUMsuUiY4SRRcJy6NJoZ6iIqWnJu9IScV9jXysyGMVuW+KNzZvBLOcpdl3Vg==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.62.2.tgz",
+			"integrity": "sha512-6nU5F2wCW+qvCBhTn1pdIU3bzsIoF7EUwsCDRxilWGprQR6yd508YnH9+OKFCwpfS8pjZqDUmnCAr7exax0XCg==",
 			"cpu": [
 				"x64"
 			],
@@ -1729,9 +1783,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.59.0.tgz",
-			"integrity": "sha512-t4ONHboXi/3E0rT6OZl1pKbl2Vgxf9vJfWgmUoCEVQVxhW6Cw/c8I6hbbu7DAvgp82RKiH7TpLwxnJeKv2pbsw==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.62.2.tgz",
+			"integrity": "sha512-n1GJHPOvpIfhi3TmrCeh6S6URt9BFCt0KQE3qvexyGCTAKpR4Lg+eWvNZEqu7epxwus/8ElT3hacYEucm49SZg==",
 			"cpu": [
 				"arm"
 			],
@@ -1742,9 +1796,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-arm-musleabihf": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.59.0.tgz",
-			"integrity": "sha512-CikFT7aYPA2ufMD086cVORBYGHffBo4K8MQ4uPS/ZnY54GKj36i196u8U+aDVT2LX4eSMbyHtyOh7D7Zvk2VvA==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.62.2.tgz",
+			"integrity": "sha512-JqgflS8wEB+UXV/vS1RpRbifGBeN4D5lz8D8oOFbFZw4vedvdOgCFAjfBmIMdW3yL10XpQQ0Ambepw6MXrhOnA==",
 			"cpu": [
 				"arm"
 			],
@@ -1755,9 +1809,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-arm64-gnu": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.59.0.tgz",
-			"integrity": "sha512-jYgUGk5aLd1nUb1CtQ8E+t5JhLc9x5WdBKew9ZgAXg7DBk0ZHErLHdXM24rfX+bKrFe+Xp5YuJo54I5HFjGDAA==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.62.2.tgz",
+			"integrity": "sha512-wnFJkogWvN4jm/hQRF2UBaeUmk20j5+DmHvoyWii2b8HJDyvz1MF2OU/6ynXt2KR63rbZLWkFpoytpdc/yBuSA==",
 			"cpu": [
 				"arm64"
 			],
@@ -1768,9 +1822,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-arm64-musl": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.59.0.tgz",
-			"integrity": "sha512-peZRVEdnFWZ5Bh2KeumKG9ty7aCXzzEsHShOZEFiCQlDEepP1dpUl/SrUNXNg13UmZl+gzVDPsiCwnV1uI0RUA==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.62.2.tgz",
+			"integrity": "sha512-HVu2bp0zhvJ8xHEV9+UUs7S90VadmBSY3LcIMvozbPo4AuMGDWlz3ymHLHZPX4hR67TKTt8Qp5PJ5RBg/i+RMQ==",
 			"cpu": [
 				"arm64"
 			],
@@ -1781,9 +1835,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-loong64-gnu": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.59.0.tgz",
-			"integrity": "sha512-gbUSW/97f7+r4gHy3Jlup8zDG190AuodsWnNiXErp9mT90iCy9NKKU0Xwx5k8VlRAIV2uU9CsMnEFg/xXaOfXg==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.62.2.tgz",
+			"integrity": "sha512-mQqqAV8QaoSgr9I2fKDLY2BAVvmKjWoGiu/cSYQonsLvtqwEn1E4QYfnCOcp5zoEqNhsDYin1s6jx/VJmrxlZg==",
 			"cpu": [
 				"loong64"
 			],
@@ -1794,9 +1848,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-loong64-musl": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.59.0.tgz",
-			"integrity": "sha512-yTRONe79E+o0FWFijasoTjtzG9EBedFXJMl888NBEDCDV9I2wGbFFfJQQe63OijbFCUZqxpHz1GzpbtSFikJ4Q==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.62.2.tgz",
+			"integrity": "sha512-IxKLoxCQ2IWi6bT2akyDUBGsOImDKB+sPp4EsTmwFQ/fMwpCKm8uLSSgP/Kx/QYUgKis6SEZ5/Nlhup0DIA0PQ==",
 			"cpu": [
 				"loong64"
 			],
@@ -1807,9 +1861,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-ppc64-gnu": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.59.0.tgz",
-			"integrity": "sha512-sw1o3tfyk12k3OEpRddF68a1unZ5VCN7zoTNtSn2KndUE+ea3m3ROOKRCZxEpmT9nsGnogpFP9x6mnLTCaoLkA==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.62.2.tgz",
+			"integrity": "sha512-Mk5ha2RQSgyFfmYYLkBpPnUk8D8FriBxesO1u9O75X0mHgXL1UQcH5Itl2lurWL2tj0RxV9b9tJgipac0hRY9A==",
 			"cpu": [
 				"ppc64"
 			],
@@ -1820,9 +1874,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-ppc64-musl": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.59.0.tgz",
-			"integrity": "sha512-+2kLtQ4xT3AiIxkzFVFXfsmlZiG5FXYW7ZyIIvGA7Bdeuh9Z0aN4hVyXS/G1E9bTP/vqszNIN/pUKCk/BTHsKA==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.62.2.tgz",
+			"integrity": "sha512-CjvEnqJL/0/TQ3TXX3OPIJ/kmBellrWd4heXUmHeJlTnmwjKpSJzoehLaL6Xk0ZnMHBu9dZuFADNOrtjF4v+2w==",
 			"cpu": [
 				"ppc64"
 			],
@@ -1833,9 +1887,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-riscv64-gnu": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.59.0.tgz",
-			"integrity": "sha512-NDYMpsXYJJaj+I7UdwIuHHNxXZ/b/N2hR15NyH3m2qAtb/hHPA4g4SuuvrdxetTdndfj9b1WOmy73kcPRoERUg==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.62.2.tgz",
+			"integrity": "sha512-1SiZbzwdkaDURsew/tSOrooKiYy7EQGT6m8ufavAi9NEyQb/6VuIxFXAL1fqa4iZe3g4NbNk4P7J32z2tw5Mgg==",
 			"cpu": [
 				"riscv64"
 			],
@@ -1846,9 +1900,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-riscv64-musl": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.59.0.tgz",
-			"integrity": "sha512-nLckB8WOqHIf1bhymk+oHxvM9D3tyPndZH8i8+35p/1YiVoVswPid2yLzgX7ZJP0KQvnkhM4H6QZ5m0LzbyIAg==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.62.2.tgz",
+			"integrity": "sha512-nQts12zJ3NQRoE6uYljOH89v7szzLDvG2JD/vsX+vGXU8w/At1GowTZ5/7qeFQ8m7L55rpR8Okugnuo5bgjy2Q==",
 			"cpu": [
 				"riscv64"
 			],
@@ -1859,9 +1913,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-s390x-gnu": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.59.0.tgz",
-			"integrity": "sha512-oF87Ie3uAIvORFBpwnCvUzdeYUqi2wY6jRFWJAy1qus/udHFYIkplYRW+wo+GRUP4sKzYdmE1Y3+rY5Gc4ZO+w==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.62.2.tgz",
+			"integrity": "sha512-E9/ll019jhPIJgpzfZoIkBGhcz+kKNgVWYRY0zr9srBdPPFVpvOKW8VaJKUbeK+eZXyQF9ltME+Kk6affeaPgg==",
 			"cpu": [
 				"s390x"
 			],
@@ -1872,9 +1926,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-x64-gnu": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.59.0.tgz",
-			"integrity": "sha512-3AHmtQq/ppNuUspKAlvA8HtLybkDflkMuLK4DPo77DfthRb71V84/c4MlWJXixZz4uruIH4uaa07IqoAkG64fg==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.62.2.tgz",
+			"integrity": "sha512-5BqxR/pshjey51iliyzTD5Xi3EN0aLmQ2lZ3lvefVV9c82BvrLo2/6OT55iifpWBufs6kdwWbuOKS841DrmK9A==",
 			"cpu": [
 				"x64"
 			],
@@ -1885,9 +1939,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-x64-musl": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.59.0.tgz",
-			"integrity": "sha512-2UdiwS/9cTAx7qIUZB/fWtToJwvt0Vbo0zmnYt7ED35KPg13Q0ym1g442THLC7VyI6JfYTP4PiSOWyoMdV2/xg==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.62.2.tgz",
+			"integrity": "sha512-uNN83XxQrRAh/w0/pmAfibcwyb6YWt4gP+dpnQKPVJshAloQ785ii8CT8ZCIxkGg9opVsvAlGhFitSm6D1Jjpg==",
 			"cpu": [
 				"x64"
 			],
@@ -1898,9 +1952,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-openbsd-x64": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.59.0.tgz",
-			"integrity": "sha512-M3bLRAVk6GOwFlPTIxVBSYKUaqfLrn8l0psKinkCFxl4lQvOSz8ZrKDz2gxcBwHFpci0B6rttydI4IpS4IS/jQ==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.62.2.tgz",
+			"integrity": "sha512-srjEIxSH3LRnJN6THczDHWQplqEMFiAJrTab0msUryh9kwNpkICf3Ea6q6MN/2cZwRFUNx5w+h6Hpi4QuHS6Zg==",
 			"cpu": [
 				"x64"
 			],
@@ -1911,9 +1965,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-openharmony-arm64": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.59.0.tgz",
-			"integrity": "sha512-tt9KBJqaqp5i5HUZzoafHZX8b5Q2Fe7UjYERADll83O4fGqJ49O1FsL6LpdzVFQcpwvnyd0i+K/VSwu/o/nWlA==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.62.2.tgz",
+			"integrity": "sha512-8hOJnxgbyObnCm5AlRA3A931xX19xq80RjVTKgJOvEKWqJruP/Uf12IbAOaDjjEXYRewwHLfmF0YRIdK3OwKWA==",
 			"cpu": [
 				"arm64"
 			],
@@ -1924,9 +1978,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-win32-arm64-msvc": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.59.0.tgz",
-			"integrity": "sha512-V5B6mG7OrGTwnxaNUzZTDTjDS7F75PO1ae6MJYdiMu60sq0CqN5CVeVsbhPxalupvTX8gXVSU9gq+Rx1/hvu6A==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.62.2.tgz",
+			"integrity": "sha512-mmF4AY1i0hG/bLWUctUq59gtmgaSIRa3cu/A3JFRp/sCNEme2bgDEiDS22P9FbnJB8NJNF4jPJiSP5RHQpUTDg==",
 			"cpu": [
 				"arm64"
 			],
@@ -1937,9 +1991,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-win32-ia32-msvc": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.59.0.tgz",
-			"integrity": "sha512-UKFMHPuM9R0iBegwzKF4y0C4J9u8C6MEJgFuXTBerMk7EJ92GFVFYBfOZaSGLu6COf7FxpQNqhNS4c4icUPqxA==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.62.2.tgz",
+			"integrity": "sha512-DZgkknc6jhHrk46V25vbAM0zZkyP0nSDkJB8/dRkLTxv470dOmWDqGoEJl/9A0dFfS7yE3REOwNDxpHwSLSt0Q==",
 			"cpu": [
 				"ia32"
 			],
@@ -1950,9 +2004,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-win32-x64-gnu": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.59.0.tgz",
-			"integrity": "sha512-laBkYlSS1n2L8fSo1thDNGrCTQMmxjYY5G0WFWjFFYZkKPjsMBsgJfGf4TLxXrF6RyhI60L8TMOjBMvXiTcxeA==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.62.2.tgz",
+			"integrity": "sha512-T6xr6ucWSFto+VGajA8YH26LdpHRuP4YLHEKAtCWvJDOlnmWcDZVCI2Jmjr+IFHDlt2zRaTAKE4tfjTaWLgJBg==",
 			"cpu": [
 				"x64"
 			],
@@ -1963,9 +2017,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-win32-x64-msvc": {
-			"version": "4.59.0",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.59.0.tgz",
-			"integrity": "sha512-2HRCml6OztYXyJXAvdDXPKcawukWY2GpR5/nxKp4iBgiO3wcoEGkAaqctIbZcNB6KlUQBIqt8VYkNSj2397EfA==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.62.2.tgz",
+			"integrity": "sha512-BfzEnDJOt9T8M989/lA37EcJgat01wLRnoi5dQf3QzOH7jzpqTAzdDbVfRljVr5r+jzKqpbHeyOfAaXxAd0PAA==",
 			"cpu": [
 				"x64"
 			],
@@ -2298,7 +2352,9 @@
 			"license": "MIT"
 		},
 		"node_modules/@types/estree": {
-			"version": "1.0.8",
+			"version": "1.0.9",
+			"resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+			"integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
 			"license": "MIT"
 		},
 		"node_modules/@types/geojson": {
@@ -2724,6 +2780,18 @@
 				"acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
 			}
 		},
+		"node_modules/agent-base": {
+			"version": "6.0.2",
+			"resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+			"integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+			"license": "MIT",
+			"dependencies": {
+				"debug": "4"
+			},
+			"engines": {
+				"node": ">= 6.0.0"
+			}
+		},
 		"node_modules/ajv": {
 			"version": "6.14.0",
 			"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
@@ -2962,13 +3030,14 @@
 			}
 		},
 		"node_modules/axios": {
-			"version": "1.15.2",
-			"resolved": "https://registry.npmjs.org/axios/-/axios-1.15.2.tgz",
-			"integrity": "sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==",
+			"version": "1.18.1",
+			"resolved": "https://registry.npmjs.org/axios/-/axios-1.18.1.tgz",
+			"integrity": "sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==",
 			"license": "MIT",
 			"dependencies": {
-				"follow-redirects": "^1.15.11",
+				"follow-redirects": "^1.16.0",
 				"form-data": "^4.0.5",
+				"https-proxy-agent": "^5.0.1",
 				"proxy-from-env": "^2.1.0"
 			}
 		},
@@ -2998,14 +3067,21 @@
 			}
 		},
 		"node_modules/baseline-browser-mapping": {
-			"version": "2.9.19",
+			"version": "2.10.42",
+			"resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.42.tgz",
+			"integrity": "sha512-c/jurFrDLyui7o1J86yLkRu4LMsTYcBohveus7/I2Hzdn9KIP2bdJPTue/lR1KH46enoPbD77GKeSYNdyPoD3Q==",
 			"license": "Apache-2.0",
 			"bin": {
-				"baseline-browser-mapping": "dist/cli.js"
+				"baseline-browser-mapping": "dist/cli.cjs"
+			},
+			"engines": {
+				"node": ">=6.0.0"
 			}
 		},
 		"node_modules/brace-expansion": {
-			"version": "1.1.12",
+			"version": "1.1.15",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
+			"integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -3027,7 +3103,9 @@
 			}
 		},
 		"node_modules/browserslist": {
-			"version": "4.28.1",
+			"version": "4.28.5",
+			"resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.5.tgz",
+			"integrity": "sha512-Cu2E6QejHWzuDMTkuwgpABFgDfZrXLQq5V13YOACZx4mFAG4IwGTbTfHPMr4WtxlHoXSM8FIuRwYYCz5XiabaQ==",
 			"funding": [
 				{
 					"type": "opencollective",
@@ -3045,11 +3123,11 @@
 			"license": "MIT",
 			"peer": true,
 			"dependencies": {
-				"baseline-browser-mapping": "^2.9.0",
-				"caniuse-lite": "^1.0.30001759",
-				"electron-to-chromium": "^1.5.263",
-				"node-releases": "^2.0.27",
-				"update-browserslist-db": "^1.2.0"
+				"baseline-browser-mapping": "^2.10.42",
+				"caniuse-lite": "^1.0.30001800",
+				"electron-to-chromium": "^1.5.387",
+				"node-releases": "^2.0.50",
+				"update-browserslist-db": "^1.2.3"
 			},
 			"bin": {
 				"browserslist": "cli.js"
@@ -3148,7 +3226,9 @@
 			}
 		},
 		"node_modules/caniuse-lite": {
-			"version": "1.0.30001766",
+			"version": "1.0.30001803",
+			"resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001803.tgz",
+			"integrity": "sha512-g/uHREV2ZpK9qMalCsWaxmA6ol+DX8GYhuf3T40RKoP+oL7vhRJh8LNt73PCjpnR6l14FzfPrB5Yux4PKm2meg==",
 			"funding": [
 				{
 					"type": "opencollective",
@@ -3624,7 +3704,9 @@
 			"license": "ISC"
 		},
 		"node_modules/electron-to-chromium": {
-			"version": "1.5.283",
+			"version": "1.5.388",
+			"resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.388.tgz",
+			"integrity": "sha512-Pl/aJaqOOxYxda3vcx1IKSJimwYXHDkEnGn0F+kG2EE68dDtx2uCinaS+Vih8Z91B9t8CSAbiF/HKyWcnXjhzw==",
 			"license": "ISC"
 		},
 		"node_modules/emoji-regex": {
@@ -3862,6 +3944,8 @@
 		},
 		"node_modules/escalade": {
 			"version": "3.2.0",
+			"resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
+			"integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
 			"license": "MIT",
 			"engines": {
 				"node": ">=6"
@@ -4282,14 +4366,16 @@
 			}
 		},
 		"node_modules/form-data": {
-			"version": "4.0.5",
+			"version": "4.0.6",
+			"resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+			"integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
 			"license": "MIT",
 			"dependencies": {
 				"asynckit": "^0.4.0",
 				"combined-stream": "^1.0.8",
 				"es-set-tostringtag": "^2.1.0",
-				"hasown": "^2.0.2",
-				"mime-types": "^2.1.12"
+				"hasown": "^2.0.4",
+				"mime-types": "^2.1.35"
 			},
 			"engines": {
 				"node": ">= 6"
@@ -4615,7 +4701,9 @@
 			}
 		},
 		"node_modules/hasown": {
-			"version": "2.0.2",
+			"version": "2.0.4",
+			"resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+			"integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
 			"license": "MIT",
 			"dependencies": {
 				"function-bind": "^1.1.2"
@@ -4653,6 +4741,19 @@
 				"node": ">=8.0.0"
 			}
 		},
+		"node_modules/https-proxy-agent": {
+			"version": "5.0.1",
+			"resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+			"integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+			"license": "MIT",
+			"dependencies": {
+				"agent-base": "6",
+				"debug": "4"
+			},
+			"engines": {
+				"node": ">= 6"
+			}
+		},
 		"node_modules/human-interval": {
 			"version": "2.0.1",
 			"license": "MIT",
@@ -5190,7 +5291,9 @@
 			}
 		},
 		"node_modules/joi": {
-			"version": "17.13.3",
+			"version": "17.13.4",
+			"resolved": "https://registry.npmjs.org/joi/-/joi-17.13.4.tgz",
+			"integrity": "sha512-1RuuER6kmt8K8I3nIWvPZKi5RQCb568ZPyY4Pwjlua+yo+63ZTmIwxLZH0heBmiKN4uxjvCiarDrjaeH84xicQ==",
 			"license": "BSD-3-Clause",
 			"dependencies": {
 				"@hapi/hoek": "^9.3.0",
@@ -5205,7 +5308,19 @@
 			"license": "MIT"
 		},
 		"node_modules/js-yaml": {
-			"version": "4.1.1",
+			"version": "4.3.0",
+			"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+			"integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/puzrin"
+				},
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/nodeca"
+				}
+			],
 			"license": "MIT",
 			"dependencies": {
 				"argparse": "^2.0.1"
@@ -5456,6 +5571,8 @@
 		},
 		"node_modules/lru-cache": {
 			"version": "5.1.1",
+			"resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
+			"integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
 			"license": "ISC",
 			"dependencies": {
 				"yallist": "^3.0.2"
@@ -5787,8 +5904,13 @@
 			}
 		},
 		"node_modules/node-releases": {
-			"version": "2.0.27",
-			"license": "MIT"
+			"version": "2.0.50",
+			"resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.50.tgz",
+			"integrity": "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==",
+			"license": "MIT",
+			"engines": {
+				"node": ">=18"
+			}
 		},
 		"node_modules/numbered": {
 			"version": "1.1.0",
@@ -6363,10 +6485,12 @@
 			}
 		},
 		"node_modules/react-router": {
-			"version": "6.30.3",
+			"version": "6.30.4",
+			"resolved": "https://registry.npmjs.org/react-router/-/react-router-6.30.4.tgz",
+			"integrity": "sha512-SVUsDe+DybHM/WmYKIVYhZh1o5Dcuf16yM6WjG02Q9XVFMZIJyHYhwrr6bFBXZkVP6z69kNkMyBCujt8FaFLJA==",
 			"license": "MIT",
 			"dependencies": {
-				"@remix-run/router": "1.23.2"
+				"@remix-run/router": "1.23.3"
 			},
 			"engines": {
 				"node": ">=14.0.0"
@@ -6376,11 +6500,13 @@
 			}
 		},
 		"node_modules/react-router-dom": {
-			"version": "6.30.3",
+			"version": "6.30.4",
+			"resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-6.30.4.tgz",
+			"integrity": "sha512-q4HvNl+mmDdkS0g+MqiBZNteQJCuimWoOyHMy4T/RQLAn9Z29+E91QXRaxOujeMl2HTzRSS0KFPd7lxX3PjV0Q==",
 			"license": "MIT",
 			"dependencies": {
-				"@remix-run/router": "1.23.2",
-				"react-router": "6.30.3"
+				"@remix-run/router": "1.23.3",
+				"react-router": "6.30.4"
 			},
 			"engines": {
 				"node": ">=14.0.0"
@@ -6609,13 +6735,13 @@
 			"license": "Unlicense"
 		},
 		"node_modules/rollup": {
-			"version": "4.57.1",
-			"resolved": "https://registry.npmjs.org/rollup/-/rollup-4.59.0.tgz",
-			"integrity": "sha512-2oMpl67a3zCH9H79LeMcbDhXW/UmWG/y2zuqnF2jQq5uq9TbM9TVyXvA4+t+ne2IIkBdrLpAaRQAvo7YI/Yyeg==",
+			"version": "4.62.2",
+			"resolved": "https://registry.npmjs.org/rollup/-/rollup-4.62.2.tgz",
+			"integrity": "sha512-RFnrW4lhXA3s3eqHDZvN654g8OTjzRfqpIRJYczCGB6HzphckVAi/Qh4tbPUbRuDi7s1Llv8g/NspLkttY3gTA==",
 			"license": "MIT",
 			"peer": true,
 			"dependencies": {
-				"@types/estree": "1.0.8"
+				"@types/estree": "1.0.9"
 			},
 			"bin": {
 				"rollup": "dist/bin/rollup"
@@ -6625,31 +6751,31 @@
 				"npm": ">=8.0.0"
 			},
 			"optionalDependencies": {
-				"@rollup/rollup-android-arm-eabi": "4.59.0",
-				"@rollup/rollup-android-arm64": "4.59.0",
-				"@rollup/rollup-darwin-arm64": "4.59.0",
-				"@rollup/rollup-darwin-x64": "4.59.0",
-				"@rollup/rollup-freebsd-arm64": "4.59.0",
-				"@rollup/rollup-freebsd-x64": "4.59.0",
-				"@rollup/rollup-linux-arm-gnueabihf": "4.59.0",
-				"@rollup/rollup-linux-arm-musleabihf": "4.59.0",
-				"@rollup/rollup-linux-arm64-gnu": "4.59.0",
-				"@rollup/rollup-linux-arm64-musl": "4.59.0",
-				"@rollup/rollup-linux-loong64-gnu": "4.59.0",
-				"@rollup/rollup-linux-loong64-musl": "4.59.0",
-				"@rollup/rollup-linux-ppc64-gnu": "4.59.0",
-				"@rollup/rollup-linux-ppc64-musl": "4.59.0",
-				"@rollup/rollup-linux-riscv64-gnu": "4.59.0",
-				"@rollup/rollup-linux-riscv64-musl": "4.59.0",
-				"@rollup/rollup-linux-s390x-gnu": "4.59.0",
-				"@rollup/rollup-linux-x64-gnu": "4.59.0",
-				"@rollup/rollup-linux-x64-musl": "4.59.0",
-				"@rollup/rollup-openbsd-x64": "4.59.0",
-				"@rollup/rollup-openharmony-arm64": "4.59.0",
-				"@rollup/rollup-win32-arm64-msvc": "4.59.0",
-				"@rollup/rollup-win32-ia32-msvc": "4.59.0",
-				"@rollup/rollup-win32-x64-gnu": "4.59.0",
-				"@rollup/rollup-win32-x64-msvc": "4.59.0",
+				"@rollup/rollup-android-arm-eabi": "4.62.2",
+				"@rollup/rollup-android-arm64": "4.62.2",
+				"@rollup/rollup-darwin-arm64": "4.62.2",
+				"@rollup/rollup-darwin-x64": "4.62.2",
+				"@rollup/rollup-freebsd-arm64": "4.62.2",
+				"@rollup/rollup-freebsd-x64": "4.62.2",
+				"@rollup/rollup-linux-arm-gnueabihf": "4.62.2",
+				"@rollup/rollup-linux-arm-musleabihf": "4.62.2",
+				"@rollup/rollup-linux-arm64-gnu": "4.62.2",
+				"@rollup/rollup-linux-arm64-musl": "4.62.2",
+				"@rollup/rollup-linux-loong64-gnu": "4.62.2",
+				"@rollup/rollup-linux-loong64-musl": "4.62.2",
+				"@rollup/rollup-linux-ppc64-gnu": "4.62.2",
+				"@rollup/rollup-linux-ppc64-musl": "4.62.2",
+				"@rollup/rollup-linux-riscv64-gnu": "4.62.2",
+				"@rollup/rollup-linux-riscv64-musl": "4.62.2",
+				"@rollup/rollup-linux-s390x-gnu": "4.62.2",
+				"@rollup/rollup-linux-x64-gnu": "4.62.2",
+				"@rollup/rollup-linux-x64-musl": "4.62.2",
+				"@rollup/rollup-openbsd-x64": "4.62.2",
+				"@rollup/rollup-openharmony-arm64": "4.62.2",
+				"@rollup/rollup-win32-arm64-msvc": "4.62.2",
+				"@rollup/rollup-win32-ia32-msvc": "4.62.2",
+				"@rollup/rollup-win32-x64-gnu": "4.62.2",
+				"@rollup/rollup-win32-x64-msvc": "4.62.2",
 				"fsevents": "~2.3.2"
 			}
 		},
@@ -7518,6 +7644,8 @@
 		},
 		"node_modules/update-browserslist-db": {
 			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
+			"integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
 			"funding": [
 				{
 					"type": "opencollective",
@@ -7587,9 +7715,9 @@
 			}
 		},
 		"node_modules/vite": {
-			"version": "6.4.2",
-			"resolved": "https://registry.npmjs.org/vite/-/vite-6.4.2.tgz",
-			"integrity": "sha512-2N/55r4JDJ4gdrCvGgINMy+HH3iRpNIz8K6SFwVsA+JbQScLiC+clmAxBgwiSPgcG9U15QmvqCGWzMbqda5zGQ==",
+			"version": "6.4.3",
+			"resolved": "https://registry.npmjs.org/vite/-/vite-6.4.3.tgz",
+			"integrity": "sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==",
 			"license": "MIT",
 			"peer": true,
 			"dependencies": {
@@ -7892,6 +8020,8 @@
 		},
 		"node_modules/yallist": {
 			"version": "3.1.1",
+			"resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
+			"integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
 			"license": "ISC"
 		},
 		"node_modules/yaml": {

client/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "client",
 	"private": true,
-	"version": "3.8.1",
+	"version": "3.9.2",
 	"type": "module",
 	"scripts": {
 		"dev": "vite",
@@ -17,6 +17,7 @@
 		"**/*": "prettier --write --ignore-unknown"
 	},
 	"dependencies": {
+		"@csstools/css-tokenizer": "^3.0.4",
 		"@emotion/react": "^11.13.3",
 		"@emotion/styled": "^11.13.0",
 		"@hello-pangea/dnd": "^18.0.0",
@@ -32,7 +33,7 @@
 		"html2canvas": "^1.4.1",
 		"human-interval": "2.0.1",
 		"i18next": "25.4.2",
-		"joi": "17.13.3",
+		"joi": "17.13.4",
 		"lucide-react": "^0.562.0",
 		"maplibre-gl": "^5.19.0",
 		"mui-color-input": "^7.0.0",

client/src/Components/inputs/TextInput.tsx

@@ -22,7 +22,7 @@ export const TextInput = forwardRef<HTMLInputElement, TextInputProps>(function T
 		width: "100%",
 		"& .MuiOutlinedInput-root": {
 			borderRadius: theme.shape.borderRadius,
-			height: 34,
+			height: props.multiline ? "auto" : 34,
 			fontSize: typographyLevels.base,
 			overflow: "hidden",
 		},

client/src/Hooks/useMonitorForm.ts

@@ -1,6 +1,6 @@
 import { useMemo } from "react";
 import { monitorSchema, type MonitorFormData } from "@/Validation/monitor";
-import { DefaultPageSpeedStrategy } from "@/Types/Monitor";
+import { DefaultHttpMethod, DefaultPageSpeedStrategy } from "@/Types/Monitor";
 import type { Monitor, MonitorType } from "@/Types/Monitor";
 
 interface UseMonitorFormOptions {
@@ -40,11 +40,13 @@ export const getMonitorDefaults = (
 				...getGeoCheckDefaults(data),
 				type: "http",
 				url: data?.url || "",
+				method: data?.method ?? DefaultHttpMethod,
 				ignoreTlsErrors: data?.ignoreTlsErrors || false,
 				useAdvancedMatching: data?.useAdvancedMatching || false,
 				matchMethod: data?.matchMethod || "",
 				expectedValue: data?.expectedValue || "",
 				jsonPath: data?.jsonPath || "",
+				customUpCodes: data?.customUpCodes || [],
 			};
 			break;
 		case "ping":
@@ -133,11 +135,13 @@ export const getMonitorDefaults = (
 				...getGeoCheckDefaults(data),
 				type: "http",
 				url: "",
+				method: DefaultHttpMethod,
 				ignoreTlsErrors: false,
 				useAdvancedMatching: false,
 				matchMethod: "",
 				expectedValue: "",
 				jsonPath: "",
+				customUpCodes: [],
 			};
 	}
 

client/src/Pages/CreateMonitor/index.tsx

@@ -1,6 +1,7 @@
 import { useMemo, useState } from "react";
 import { useEffect } from "react";
 import { logger } from "@/Utils/logger";
+import { ALL_HTTP_STATUS_CODES } from "@/Utils/statusCode";
 import { useParams, useLocation, useNavigate } from "react-router";
 import { useForm, Controller } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
@@ -41,8 +42,11 @@ import {
 	type Monitor,
 	type MonitorType,
 	type GamesMap,
+	type HttpMethod,
 	supportsGeoCheck,
 	DefaultPageSpeedStrategy,
+	DefaultHttpMethod,
+	HttpMethods,
 } from "@/Types/Monitor";
 import type { Notification } from "@/Types/Notification";
 import type { Tag } from "@/Types/Tag";
@@ -258,7 +262,7 @@ const CreateMonitorPage = () => {
 		resolver: zodResolver(schema),
 		defaultValues: defaults,
 	});
-	const { control, watch, handleSubmit, clearErrors, trigger, reset } = form;
+	const { control, watch, handleSubmit, clearErrors, trigger, reset, setValue } = form;
 
 	useEffect(() => {
 		reset(defaults);
@@ -270,6 +274,7 @@ const CreateMonitorPage = () => {
 	const showStep = (step: number) => isEditMode || currentStep === step;
 
 	const watchedType = watch("type") as MonitorType;
+	const watchedMethod = watch("method") as HttpMethod | undefined;
 	const watchedUseAdvancedMatching = watch("useAdvancedMatching") as boolean;
 	const watchGeoCheckEnabled = watch("geoCheckEnabled") as boolean;
 
@@ -1091,27 +1096,144 @@ const CreateMonitorPage = () => {
 					rightContent={
 						<Stack spacing={theme.spacing(LAYOUT.MD)}>
 							<Controller
-								name="useAdvancedMatching"
+								name="method"
 								control={control}
 								render={({ field }) => (
-									<Stack
-										direction="row"
-										alignItems="center"
-										spacing={theme.spacing(SPACING.LG)}
-									>
-										<Switch
-											checked={field.value ?? false}
-											onChange={(e) => field.onChange(e.target.checked)}
-										/>
-										<Typography>
+									<Stack spacing={theme.spacing(LAYOUT.MD)}>
+										<Select
+											{...field}
+											value={field.value ?? DefaultHttpMethod}
+											onChange={(e) => {
+												const value = e.target.value as HttpMethod;
+												field.onChange(value);
+												// HEAD has no response body, reset advanced matching fields if selected
+												if (value === "HEAD") {
+													setValue("useAdvancedMatching", false);
+													setValue("matchMethod", "");
+													setValue("expectedValue", "");
+													setValue("jsonPath", "");
+												}
+											}}
+											fieldLabel={t(
+												"pages.createMonitor.form.advanced.option.method.label"
+											)}
+										>
+											{HttpMethods.map((method) => (
+												<MenuItem
+													key={method}
+													value={method}
+												>
+													{method}
+												</MenuItem>
+											))}
+										</Select>
+										<Typography
+											component="span"
+											color={theme.palette.text.secondary}
+											sx={{ opacity: 0.8 }}
+										>
 											{t(
-												"pages.createMonitor.form.advanced.option.advancedMatching.label"
+												`pages.createMonitor.form.advanced.option.method.description.${field.value ?? DefaultHttpMethod}`
 											)}
 										</Typography>
 									</Stack>
 								)}
 							/>
-							{watchedUseAdvancedMatching && (
+							<Controller
+								name="customUpCodes"
+								control={control}
+								render={({ field }) => {
+									const selectedOptions = ALL_HTTP_STATUS_CODES.filter((option) =>
+										field.value?.includes(option.id)
+									);
+									return (
+										<Stack spacing={theme.spacing(LAYOUT.MD)}>
+											<Autocomplete
+												multiple
+												autoHighlight
+												options={ALL_HTTP_STATUS_CODES}
+												value={selectedOptions}
+												getOptionLabel={(option) => option.name}
+												isOptionEqualToValue={(option, value) => option.id === value.id}
+												onChange={(
+													_: unknown,
+													newValue: typeof ALL_HTTP_STATUS_CODES
+												) => {
+													field.onChange(newValue?.map((v) => v.id) || []);
+												}}
+												fieldLabel={t(
+													"pages.createMonitor.form.advanced.option.customUpCodes.label"
+												)}
+											/>
+											<Typography
+												component="span"
+												color={theme.palette.text.secondary}
+												sx={{ opacity: 0.8 }}
+											>
+												{t(
+													"pages.createMonitor.form.advanced.option.customUpCodes.description"
+												)}
+											</Typography>
+											{selectedOptions.length > 0 && (
+												<Stack
+													flex={1}
+													gap={theme.spacing(SPACING.MD)}
+													width="100%"
+												>
+													{selectedOptions.map((option, index) => (
+														<Stack
+															direction="row"
+															alignItems="center"
+															key={option.id}
+															width="100%"
+														>
+															<Typography flexGrow={1}>{option.name}</Typography>
+															<IconButton
+																size="small"
+																onClick={() => {
+																	field.onChange(
+																		field.value?.filter((id) => id !== option.id)
+																	);
+																}}
+																aria-label={t(
+																	"pages.createMonitor.form.advanced.option.customUpCodes.removeAriaLabel"
+																)}
+															>
+																<Trash2 size={16} />
+															</IconButton>
+															{index < selectedOptions.length - 1 && <Divider />}
+														</Stack>
+													))}
+												</Stack>
+											)}
+										</Stack>
+									);
+								}}
+							/>
+							{watchedMethod !== "HEAD" && (
+								<Controller
+									name="useAdvancedMatching"
+									control={control}
+									render={({ field }) => (
+										<Stack
+											direction="row"
+											alignItems="center"
+											spacing={theme.spacing(SPACING.LG)}
+										>
+											<Switch
+												checked={field.value ?? false}
+												onChange={(e) => field.onChange(e.target.checked)}
+											/>
+											<Typography>
+												{t(
+													"pages.createMonitor.form.advanced.option.advancedMatching.label"
+												)}
+											</Typography>
+										</Stack>
+									)}
+								/>
+							)}
+							{watchedUseAdvancedMatching && watchedMethod !== "HEAD" && (
 								<Stack spacing={theme.spacing(LAYOUT.MD)}>
 									<Controller
 										name="matchMethod"

client/src/Pages/Logs/components/TableJobs.tsx

@@ -42,12 +42,15 @@ export const TableJobs = ({
 		maxWidth: 220,
 	};
 
+	const isRunning = (row: QueueJobWithId) =>
+		row.lockedBy !== null && row.lockedUntil !== null && row.lockedUntil > Date.now();
+
 	const headers: Header<QueueJobWithId>[] = [
 		{
 			id: "state",
 			content: t("pages.logs.table.headers.state"),
 			render: (row) => {
-				if (row.lockedAt) {
+				if (isRunning(row)) {
 					return t("common.labels.running");
 				}
 				if (row.monitorActive === true) {
@@ -72,18 +75,6 @@ export const TableJobs = ({
 				</Typography>
 			),
 		},
-		{
-			id: "url",
-			content: t("common.table.headers.url"),
-			render: (row) => (
-				<Typography
-					title={row.monitorUrl ?? ""}
-					sx={cellSx}
-				>
-					{row.monitorUrl}
-				</Typography>
-			),
-		},
 		{
 			id: "type",
 			content: t("common.table.headers.type"),
@@ -92,50 +83,36 @@ export const TableJobs = ({
 		{
 			id: "interval",
 			content: t("common.table.headers.interval"),
-			render: (row) => {
-				let interval;
-				if (row.monitorId.toString().includes("geo")) {
-					interval = row.monitorGeoInterval ?? 0;
-				} else {
-					interval = row.repeat ?? 0;
-				}
-				return <Typography sx={cellSx}>{prettyMilliseconds(interval)}</Typography>;
-			},
+			render: (row) => (
+				<Typography sx={cellSx}>{prettyMilliseconds(row.monitorInterval ?? 0)}</Typography>
+			),
 		},
 		{
-			id: "lastRun",
-			content: t("pages.logs.table.headers.lastRunAt"),
+			id: "lastFinishedAt",
+			content: t("pages.logs.table.headers.lastFinishedAt"),
 			render: (row) => {
-				const v = formatTimestamp(row.lastRunAt) ?? "-";
+				const lastFinishedAt = formatTimestamp(row.lastFinishedAt) ?? "-";
 				return (
 					<Typography
-						title={v}
+						title={lastFinishedAt}
 						sx={cellSx}
 					>
-						{v}
+						{lastFinishedAt}
 					</Typography>
 				);
 			},
 		},
 		{
-			id: "lastRunTook",
-			content: t("pages.logs.table.headers.lastRunTook"),
+			id: "nextScheduledAt",
+			content: t("pages.logs.table.headers.nextScheduledAt"),
 			render: (row) => {
-				const value = row.lastRunTook ? prettyMilliseconds(row.lastRunTook) : "-";
-				return <Typography sx={cellSx}>{value}</Typography>;
-			},
-		},
-		{
-			id: "lockedAt",
-			content: t("pages.logs.table.headers.lockedAt"),
-			render: (row) => {
-				const v = formatTimestamp(row.lockedAt) ?? "-";
+				const nextScheduledAt = formatTimestamp(row.nextScheduledAt) ?? "-";
 				return (
 					<Typography
-						title={v}
+						title={nextScheduledAt}
 						sx={cellSx}
 					>
-						{v}
+						{nextScheduledAt}
 					</Typography>
 				);
 			},
@@ -169,7 +146,7 @@ export const TableJobs = ({
 				headers={headers}
 				data={jobsWithId}
 				getRowSx={(row) => ({
-					...(row.lockedAt && {
+					...(isRunning(row) && {
 						"& td": { backgroundColor: theme.palette.rowStatus.running },
 					}),
 					...(row.monitorActive === false && {

client/src/Pages/StatusPage/Create/index.tsx

@@ -162,6 +162,7 @@ const CreateStatusPage = () => {
 		fd.append("showUptimePercentage", String(data.showUptimePercentage));
 		fd.append("showAdminLoginLink", String(data.showAdminLoginLink));
 		fd.append("showInfrastructure", String(data.showInfrastructure));
+		fd.append("customCSS", data.customCSS ?? "");
 		if (data.theme) fd.append("theme", data.theme);
 		if (data.themeMode) fd.append("themeMode", data.themeMode);
 
@@ -530,6 +531,33 @@ const CreateStatusPage = () => {
 					}
 				/>
 			)}
+			{showStep(1) && (
+				<ConfigBox
+					title={t("pages.statusPages.form.customCSS.title")}
+					subtitle={t("pages.statusPages.form.customCSS.description")}
+					rightContent={
+						<Controller
+							name="customCSS"
+							control={control}
+							render={({ field, fieldState }) => (
+								<TextField
+									{...field}
+									multiline
+									rows={8}
+									fieldLabel={t(
+										"pages.statusPages.form.customCSS.option.customCSS.label"
+									)}
+									placeholder={t(
+										"pages.statusPages.form.customCSS.option.customCSS.placeholder"
+									)}
+									error={!!fieldState.error}
+									helperText={fieldState.error?.message}
+								/>
+							)}
+						/>
+					}
+				/>
+			)}
 			{showStep(1) && (
 				<ConfigBox
 					title={t("pages.statusPages.form.features.title")}

client/src/Pages/StatusPage/Status/index.tsx

@@ -2,6 +2,7 @@ import { BasePage, BaseFallback } from "@/Components/design-elements";
 import Typography from "@mui/material/Typography";
 import { Link } from "react-router-dom";
 import Stack from "@mui/material/Stack";
+import Box from "@mui/material/Box";
 
 import { useTheme } from "@mui/material";
 import { useTranslation } from "react-i18next";
@@ -16,6 +17,7 @@ import {
 } from "@/Types/StatusPage";
 import {
 	buildStatusPageApiPath,
+	getStatusPagePreviewUrl,
 	getStatusPagePublicUrl,
 	isCustomDomainHost,
 } from "@/Utils/statusPageUrl";
@@ -38,6 +40,7 @@ import { BoldHero } from "@/Pages/StatusPage/Status/themes/bold/BoldHero";
 import { editorialStyles } from "@/Pages/StatusPage/Status/themes/editorial/styles";
 import { EditorialHeader } from "@/Pages/StatusPage/Status/themes/editorial/EditorialHeader";
 import { EditorialHero } from "@/Pages/StatusPage/Status/themes/editorial/EditorialHero";
+import { minimalStyles } from "@/Pages/StatusPage/Status/themes/minimal/styles";
 
 const THEME_CONFIGS: Record<StatusPageTheme, ThemeConfig<any>> = {
 	refined: {
@@ -63,6 +66,11 @@ const THEME_CONFIGS: Record<StatusPageTheme, ThemeConfig<any>> = {
 		HeroSlot: EditorialHero,
 		overallStatusOptions: { allUpKey: "pages.statusPages.editorial.allUp" },
 	},
+	minimal: {
+		createStyles: minimalStyles,
+		HeaderSlot: RefinedHeader,
+		HeroSlot: RefinedHero,
+	},
 };
 
 const StatusPageView = () => {
@@ -121,17 +129,9 @@ const StatusPageView = () => {
 		);
 	}
 
-	const themeConfig = THEME_CONFIGS[resolveStatusPageTheme(statusPage.theme)];
-	const themedRenderer = (
-		<BaseStatusPage
-			statusPage={statusPage}
-			monitors={monitors}
-			config={themeConfig}
-		/>
-	);
-
 	// Public route: render directly on the viewport, themed background covers everything.
 	if (isPublic) {
+		const themeConfig = THEME_CONFIGS[resolveStatusPageTheme(statusPage.theme)];
 		return (
 			<StatusPageThemeProvider
 				theme={statusPage.theme}
@@ -139,12 +139,17 @@ const StatusPageView = () => {
 				timezone={statusPage.timezone}
 				paintBody
 			>
-				{themedRenderer}
+				<BaseStatusPage
+					statusPage={statusPage}
+					monitors={monitors}
+					config={themeConfig}
+				/>
 			</StatusPageThemeProvider>
 		);
 	}
 
 	const publicUrl = getStatusPagePublicUrl(statusPage);
+	const previewUrl = getStatusPagePreviewUrl(statusPage);
 	return (
 		<BasePage
 			loading={isLoading}
@@ -163,7 +168,16 @@ const StatusPageView = () => {
 				timezone={statusPage.timezone}
 				transparent
 			>
-				<BrowserFrame url={publicUrl}>{themedRenderer}</BrowserFrame>
+				<BrowserFrame url={publicUrl}>
+					<Box
+						component="iframe"
+						src={previewUrl}
+						title={t("pages.statusPages.preview.title")}
+						flex={1}
+						width="100%"
+						border={0}
+					/>
+				</BrowserFrame>
 			</StatusPageThemeProvider>
 		</BasePage>
 	);

client/src/Pages/StatusPage/Status/themes/BrowserFrame.tsx

@@ -64,7 +64,13 @@ export const BrowserFrame = ({ url, children }: Props) => {
 					{url}
 				</Box>
 			</Box>
-			<Box sx={{ flex: 1, minHeight: 0 }}>{children}</Box>
+			<Box
+				display="flex"
+				flexDirection="column"
+				sx={{ flex: 1, minHeight: 0 }}
+			>
+				{children}
+			</Box>
 		</Box>
 	);
 };

client/src/Pages/StatusPage/Status/themes/minimal/styles.ts

@@ -0,0 +1,66 @@
+import type { SxProps, Theme } from "@mui/material/styles";
+import type { StatusPageThemeTokens } from "../tokens";
+import type { OverallTone } from "../shared/overallStatus";
+import { refinedStyles, type RefinedStyles } from "../refined/styles";
+
+type FlatSx = Exclude<SxProps<Theme>, readonly unknown[] | ((theme: Theme) => unknown)>;
+
+const extend = (base: SxProps<Theme>, overrides: SxProps<Theme>): SxProps<Theme> => [
+	base as FlatSx,
+	overrides as FlatSx,
+];
+
+export const minimalStyles = (
+	tokens: StatusPageThemeTokens,
+	isDark: boolean
+): RefinedStyles => {
+	const base = refinedStyles(tokens, isDark);
+
+	return {
+		...base,
+		page: extend(base.page, {
+			maxWidth: 820,
+			p: { xs: "32px 16px 64px", md: "48px 20px 72px" },
+		}),
+		top: extend(base.top, {
+			mb: "44px",
+			pb: "16px",
+			borderBottom: `1px solid ${tokens.border}`,
+		}),
+		logoMono: extend(base.logoMono, {
+			borderRadius: "50%",
+			background: tokens.text,
+		}),
+		hero: extend(base.hero, {
+			alignItems: "center",
+			background: "transparent",
+			border: 0,
+			boxShadow: "none",
+			p: 0,
+			mb: "40px",
+		}),
+		heroRow: extend(base.heroRow, { justifyContent: "center" }),
+		heroTitle: extend(base.heroTitle, {
+			flex: "initial",
+			fontSize: { xs: 22, md: 28 },
+			fontWeight: 650,
+			textAlign: "center",
+		}),
+		heroIcon: (_tone: OverallTone) => ({ display: "none" }),
+		heroSub: extend(base.heroSub, { textAlign: "center", mt: "4px" }),
+		chartSwitch: extend(base.chartSwitch, { borderRadius: tokens.radius }),
+		card: extend(base.card, {
+			boxShadow: "none",
+			transition: "none",
+			"&:hover": { transform: "none", boxShadow: "none" },
+		}),
+		cardRow: extend(base.cardRow, { p: "14px 16px" }),
+		badge: (tone) =>
+			extend(base.badge(tone), {
+				background: "transparent",
+				p: 0,
+			}),
+		gauge: extend(base.gauge, { borderRadius: tokens.radius }),
+		footer: extend(base.footer, { mt: "48px", fontSize: 11 }),
+	};
+};

client/src/Pages/StatusPage/Status/themes/shared/BaseStatusPage.tsx

@@ -102,6 +102,7 @@ export const BaseStatusPage = ({ statusPage, monitors, config }: Props) => {
 
 	return (
 		<Box sx={styles.page}>
+			{statusPage.customCSS && <style>{statusPage.customCSS}</style>}
 			<Stack
 				component="header"
 				direction={{ xs: "column", md: "row" }}

client/src/Pages/StatusPage/Status/themes/tokens.ts

@@ -191,9 +191,47 @@ const editorial: ThemeVariants = {
 	},
 };
 
+const minimal: ThemeVariants = {
+	light: {
+		bg: "#ffffff",
+		surface: "#ffffff",
+		border: "#dfe3e8",
+		text: "#17191c",
+		textMuted: "#667085",
+		up: "#12a174",
+		upStrong: "#087a57",
+		upSoft: "#e7f7f1",
+		degraded: "#b54708",
+		degradedSoft: "#fff1dc",
+		down: "#c4323f",
+		downSoft: "#fde8ea",
+		warn: "#c27803",
+		warnSoft: "#fff3d6",
+		radius: "6px",
+	},
+	dark: {
+		bg: "#0d0f12",
+		surface: "#111419",
+		border: "#2b3038",
+		text: "#f2f4f7",
+		textMuted: "#98a2b3",
+		up: "#32d6a0",
+		upStrong: "#1eb783",
+		upSoft: "rgba(50,214,160,0.14)",
+		degraded: "#f0a44b",
+		degradedSoft: "rgba(240,164,75,0.16)",
+		down: "#ff6675",
+		downSoft: "rgba(255,102,117,0.16)",
+		warn: "#f2b84b",
+		warnSoft: "rgba(242,184,75,0.16)",
+		radius: "6px",
+	},
+};
+
 export const themeTokens: Record<StatusPageTheme, ThemeVariants> = {
 	refined,
 	modern,
 	bold,
 	editorial,
+	minimal,
 };

client/src/Pages/Uptime/Monitors/Components/UptimeMonitorsTable.tsx

@@ -324,7 +324,9 @@ export const MonitorTable = ({
 					</Stack>
 				),
 				render: (row) => {
-					return row.type;
+					return row.type === "http" && row.method
+						? `${row.type} (${row.method})`
+						: row.type;
 				},
 			},
 			{

client/src/Types/Monitor.ts

@@ -48,6 +48,10 @@ export const PageSpeedStrategies = ["desktop", "mobile"] as const;
 export type PageSpeedStrategy = (typeof PageSpeedStrategies)[number];
 export const DefaultPageSpeedStrategy: PageSpeedStrategy = "desktop";
 
+export const HttpMethods = ["GET", "HEAD"] as const;
+export type HttpMethod = (typeof HttpMethods)[number];
+export const DefaultHttpMethod: HttpMethod = "GET";
+
 export interface Monitor {
 	id: string;
 	userId: string;
@@ -64,6 +68,7 @@ export interface Monitor {
 	jsonPath?: string;
 	expectedValue?: string;
 	matchMethod?: MonitorMatchMethod;
+	method?: HttpMethod;
 	url: string;
 	port?: number;
 	isActive: boolean;
@@ -71,6 +76,7 @@ export interface Monitor {
 	uptimePercentage?: number;
 	notifications: string[];
 	tags: string[];
+	customUpCodes?: number[];
 	secret?: string;
 	cpuAlertThreshold: number;
 	cpuAlertCounter: number;

client/src/Types/Queue.ts

@@ -30,23 +30,16 @@ export type QueueMetrics = {
 
 export type QueueJobSummary = {
 	monitorId: string | number;
-	monitorUrl: string | null;
 	monitorType: string | null;
 	monitorInterval: number | null;
-	monitorGeoInterval: number | null;
 	monitorActive: boolean | null;
-	active: boolean;
 	lockedBy: string | null;
 	lockedUntil: number | null;
-	lockedAt: number | null;
+	nextScheduledAt: number;
 	runCount: number;
 	failCount: number;
 	failReason: string | null;
-	lastRunAt: number | null;
 	lastFinishedAt: number | null;
-	lastRunTook: number | null;
-	lastFailedAt: number | null;
-	repeat: number | null;
 };
 
 export interface QueueData {

client/src/Types/StatusPage.ts

@@ -21,7 +21,13 @@ export const getMonitorTypeLabel = (
 	return key ? t(key) : type;
 };
 
-export const STATUS_PAGE_THEMES = ["refined", "modern", "bold", "editorial"] as const;
+export const STATUS_PAGE_THEMES = [
+	"refined",
+	"modern",
+	"bold",
+	"editorial",
+	"minimal",
+] as const;
 export type StatusPageTheme = (typeof STATUS_PAGE_THEMES)[number];
 export const DEFAULT_STATUS_PAGE_THEME: StatusPageTheme = "refined";
 

client/src/Utils/customCss.ts

@@ -0,0 +1,16 @@
+import { isTokenString, isTokenURL, tokenize } from "@csstools/css-tokenizer";
+
+// Mirrors the server check (server/src/utils/customCss.ts) so the form rejects
+// the same CSS the API would.
+const EXTERNAL_TARGET = /^\s*(?:https?:|\/\/)/i;
+
+export const cssReferencesExternalResource = (css?: string | null): boolean => {
+	if (typeof css !== "string" || css === "") {
+		return false;
+	}
+
+	return tokenize({ css }).some(
+		(token) =>
+			(isTokenURL(token) || isTokenString(token)) && EXTERNAL_TARGET.test(token[4].value)
+	);
+};

client/src/Utils/statusCode.ts

@@ -74,3 +74,96 @@ export const getStatusCodeValueType = (code: number): ValueType => {
 	if (code < 400) return "neutral";
 	return "negative";
 };
+
+export interface HttpStatusCodeOption {
+	id: number;
+	name: string;
+}
+
+/**
+ * Must stay in sync with HttpStatusCodes in server/src/domain/monitors/monitor.types.ts
+ */
+export const ALL_HTTP_STATUS_CODES: HttpStatusCodeOption[] = [
+	{ id: 100, name: "100 - Continue" },
+	{ id: 101, name: "101 - Switching Protocols" },
+	{ id: 102, name: "102 - Processing" },
+	{ id: 103, name: "103 - Early Hints" },
+	{ id: 200, name: "200 - OK" },
+	{ id: 201, name: "201 - Created" },
+	{ id: 202, name: "202 - Accepted" },
+	{ id: 203, name: "203 - Non-Authoritative Information" },
+	{ id: 204, name: "204 - No Content" },
+	{ id: 205, name: "205 - Reset Content" },
+	{ id: 206, name: "206 - Partial Content" },
+	{ id: 207, name: "207 - Multi-Status" },
+	{ id: 208, name: "208 - Already Reported" },
+	{ id: 226, name: "226 - IM Used" },
+	{ id: 300, name: "300 - Multiple Choices" },
+	{ id: 301, name: "301 - Moved Permanently" },
+	{ id: 302, name: "302 - Found" },
+	{ id: 303, name: "303 - See Other" },
+	{ id: 304, name: "304 - Not Modified" },
+	{ id: 305, name: "305 - Use Proxy" },
+	{ id: 307, name: "307 - Temporary Redirect" },
+	{ id: 308, name: "308 - Permanent Redirect" },
+	{ id: 400, name: "400 - Bad Request" },
+	{ id: 401, name: "401 - Unauthorized" },
+	{ id: 402, name: "402 - Payment Required" },
+	{ id: 403, name: "403 - Forbidden" },
+	{ id: 404, name: "404 - Not Found" },
+	{ id: 405, name: "405 - Method Not Allowed" },
+	{ id: 406, name: "406 - Not Acceptable" },
+	{ id: 407, name: "407 - Proxy Authentication Required" },
+	{ id: 408, name: "408 - Request Timeout" },
+	{ id: 409, name: "409 - Conflict" },
+	{ id: 410, name: "410 - Gone" },
+	{ id: 411, name: "411 - Length Required" },
+	{ id: 412, name: "412 - Precondition Failed" },
+	{ id: 413, name: "413 - Payload Too Large" },
+	{ id: 414, name: "414 - URI Too Long" },
+	{ id: 415, name: "415 - Unsupported Media Type" },
+	{ id: 416, name: "416 - Range Not Satisfiable" },
+	{ id: 417, name: "417 - Expectation Failed" },
+	{ id: 418, name: "418 - I'm a Teapot" },
+	{ id: 419, name: "419 - Page Expired (Laravel)" },
+	{ id: 420, name: "420 - Enhance Your Calm (Twitter)" },
+	{ id: 421, name: "421 - Misdirected Request" },
+	{ id: 422, name: "422 - Unprocessable Entity" },
+	{ id: 423, name: "423 - Locked" },
+	{ id: 424, name: "424 - Failed Dependency" },
+	{ id: 425, name: "425 - Too Early" },
+	{ id: 426, name: "426 - Upgrade Required" },
+	{ id: 428, name: "428 - Precondition Required" },
+	{ id: 429, name: "429 - Too Many Requests" },
+	{ id: 431, name: "431 - Request Header Fields Too Large" },
+	{ id: 440, name: "440 - Login Time-out (IIS)" },
+	{ id: 449, name: "449 - Retry With (IIS)" },
+	{ id: 451, name: "451 - Unavailable For Legal Reasons" },
+	{ id: 460, name: "460 - Client Closed Connection (AWS ELB)" },
+	{ id: 463, name: "463 - X-Forwarded-For Too Large (AWS ELB)" },
+	{ id: 497, name: "497 - HTTP Request Sent to HTTPS Port (NGINX)" },
+	{ id: 499, name: "499 - Client Closed Request (NGINX)" },
+	{ id: 500, name: "500 - Internal Server Error" },
+	{ id: 501, name: "501 - Not Implemented" },
+	{ id: 502, name: "502 - Bad Gateway" },
+	{ id: 503, name: "503 - Service Unavailable" },
+	{ id: 504, name: "504 - Gateway Timeout" },
+	{ id: 505, name: "505 - HTTP Version Not Supported" },
+	{ id: 506, name: "506 - Variant Also Negotiates" },
+	{ id: 507, name: "507 - Insufficient Storage" },
+	{ id: 508, name: "508 - Loop Detected" },
+	{ id: 509, name: "509 - Bandwidth Limit Exceeded (Apache)" },
+	{ id: 510, name: "510 - Not Extended" },
+	{ id: 511, name: "511 - Network Authentication Required" },
+	{ id: 520, name: "520 - Web Server Returned an Unknown Error (Cloudflare)" },
+	{ id: 521, name: "521 - Web Server Is Down (Cloudflare)" },
+	{ id: 522, name: "522 - Connection Timed Out (Cloudflare)" },
+	{ id: 523, name: "523 - Origin Is Unreachable (Cloudflare)" },
+	{ id: 524, name: "524 - A Timeout Occurred (Cloudflare)" },
+	{ id: 525, name: "525 - SSL Handshake Failed (Cloudflare)" },
+	{ id: 526, name: "526 - Invalid SSL Certificate (Cloudflare)" },
+	{ id: 527, name: "527 - Railgun Error (Cloudflare)" },
+	{ id: 529, name: "529 - Site is overloaded" },
+	{ id: 530, name: "530 - Site is frozen (Cloudflare)" },
+	{ id: 561, name: "561 - Unauthorized (AWS ELB)" },
+];

client/src/Utils/statusPageUrl.ts

@@ -70,6 +70,16 @@ export const getStatusPagePublicUrl = (
 	return `${PUBLIC_STATUS_PAGE_PREFIX}/${statusPage.url}`;
 };
 
+// Same-origin URL for the admin preview iframe; a custom domain would be cross
+// origin and blocked by the admin document's CSP frame-src.
+export const getStatusPagePreviewUrl = (statusPage: Pick<StatusPage, "url">): string => {
+	if (typeof window !== "undefined") {
+		return `${window.location.origin}${PUBLIC_STATUS_PAGE_PREFIX}/${statusPage.url}`;
+	}
+
+	return `${PUBLIC_STATUS_PAGE_PREFIX}/${statusPage.url}`;
+};
+
 export const buildStatusPageApiPath = (options: {
 	url?: string;
 	useCustomDomain?: boolean;

client/src/Validation/monitor.ts

@@ -1,7 +1,13 @@
 import { z } from "zod";
 import type { FieldPath } from "react-hook-form";
 import { GeoContinents } from "@/Types/GeoCheck";
-import { DnsRecordTypes, PageSpeedStrategies, type MonitorType } from "@/Types/Monitor";
+import {
+	DnsRecordTypes,
+	HttpMethods,
+	PageSpeedStrategies,
+	type MonitorType,
+} from "@/Types/Monitor";
+import { ALL_HTTP_STATUS_CODES } from "@/Utils/statusCode";
 
 // Wizard step a field is validated on. Attached inline to each field below so
 // the grouping lives next to the field definition; unannotated fields default
@@ -53,9 +59,15 @@ const geoCheckFields = {
 };
 
 // HTTP monitor schema
+const httpStatusCodeSet = new Set(ALL_HTTP_STATUS_CODES.map((c) => c.id));
+const httpStatusCode = z.number().refine((code) => httpStatusCodeSet.has(code), {
+	message: "Must be a valid HTTP status code",
+});
+
 const httpSchema = baseSchema.extend({
 	type: z.literal("http"),
 	url: urlSchema,
+	method: z.enum(HttpMethods).optional().register(monitorStepRegistry, { step: 2 }),
 	ignoreTlsErrors: z.boolean().register(monitorStepRegistry, { step: 2 }),
 	useAdvancedMatching: z.boolean().register(monitorStepRegistry, { step: 2 }),
 	matchMethod: z
@@ -64,6 +76,10 @@ const httpSchema = baseSchema.extend({
 		.register(monitorStepRegistry, { step: 2 }),
 	expectedValue: z.string().optional().register(monitorStepRegistry, { step: 2 }),
 	jsonPath: z.string().optional().register(monitorStepRegistry, { step: 2 }),
+	customUpCodes: z
+		.array(httpStatusCode)
+		.optional()
+		.register(monitorStepRegistry, { step: 2 }),
 	...geoCheckFields,
 });
 

client/src/Validation/statusPage.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import type { FieldPath } from "react-hook-form";
 import { STATUS_PAGE_THEMES, STATUS_PAGE_THEME_MODES } from "@/Types/StatusPage";
+import { cssReferencesExternalResource } from "@/Utils/customCss";
 
 // Wizard step a field is validated on. Attached inline to each field below so
 // the grouping lives next to the field definition; unannotated fields default
@@ -58,7 +59,14 @@ export const statusPageSchema = z.object({
 	showUptimePercentage: z.boolean().register(statusPageStepRegistry, { step: 1 }),
 	showAdminLoginLink: z.boolean().register(statusPageStepRegistry, { step: 1 }),
 	showInfrastructure: z.boolean().register(statusPageStepRegistry, { step: 1 }),
-	customCSS: z.string().optional().register(statusPageStepRegistry, { step: 1 }),
+	customCSS: z
+		.string()
+		.max(100000, "Custom CSS must be at most 100000 characters")
+		.refine((css) => !cssReferencesExternalResource(css), {
+			message: "Custom CSS cannot reference external URLs or use @import",
+		})
+		.optional()
+		.register(statusPageStepRegistry, { step: 1 }),
 	theme: z
 		.enum(STATUS_PAGE_THEMES)
 		.optional()

client/src/locales/ar.json

@@ -941,10 +941,7 @@
 					"monitorId": "معرّف المراقب",
 					"runCount": "عدد التشغيلات",
 					"failCount": "عدد حالات الفشل",
-					"lastRunAt": "آخر تشغيل في",
-					"lockedAt": "مقفل في",
 					"lastFinishedAt": "آخر انتهاء في",
-					"lastRunTook": "مدة آخر تشغيل",
 					"lastFailedAt": "آخر فشل في",
 					"failReason": "سبب الفشل",
 					"state": "الحالة"

client/src/locales/ca.json

@@ -945,10 +945,7 @@
 					"monitorId": "ID del monitor",
 					"runCount": "Recompte d'execucions",
 					"failCount": "Recompte",
-					"lastRunAt": "Darrera execució",
-					"lockedAt": "Bloquejat el",
 					"lastFinishedAt": "Darrera finalització",
-					"lastRunTook": "Durada de la darrera execució",
 					"lastFailedAt": "Darrera fallada",
 					"failReason": "Motiu de la fallada",
 					"state": "Estat"

client/src/locales/cs.json

@@ -941,10 +941,7 @@
 					"monitorId": "ID monitoru",
 					"runCount": "Počet spuštění",
 					"failCount": "Počet selhání",
-					"lastRunAt": "Poslední spuštění",
-					"lockedAt": "Uzamčeno v",
 					"lastFinishedAt": "Naposledy dokončeno",
-					"lastRunTook": "Poslední běh trval",
 					"lastFailedAt": "Poslední selhání",
 					"failReason": "Důvod selhání",
 					"state": "Stav"

client/src/locales/de.json

@@ -941,10 +941,7 @@
 					"monitorId": "Monitor-ID",
 					"runCount": "Ausführungen",
 					"failCount": "Fehlerzahl",
-					"lastRunAt": "Letzter Lauf am",
-					"lockedAt": "Gesperrt am",
 					"lastFinishedAt": "Zuletzt abgeschlossen am",
-					"lastRunTook": "Letzter Lauf dauerte",
 					"lastFailedAt": "Letzter Fehler am",
 					"failReason": "Fehlergrund",
 					"state": "Status"

client/src/locales/en.json

@@ -490,6 +490,13 @@
 				"advanced": {
 					"description": "Optional settings for advanced use cases",
 					"option": {
+						"method": {
+							"label": "Request method",
+							"description": {
+								"GET": "GET fetches the full response including the body.  Advanced matching fully supported",
+								"HEAD": "HEAD fetches only response headers for reducing load on the target. Supports status code matching but not advanced matching as there is no body."
+							}
+						},
 						"advancedMatching": {
 							"label": "Use advanced matching"
 						},
@@ -505,6 +512,11 @@
 							"equal": "Equal",
 							"include": "Include",
 							"regex": "Regex"
+						},
+						"customUpCodes": {
+							"label": "Accepted status codes",
+							"description": "Add any non-2xx codes that should also be considered successful.",
+							"removeAriaLabel": "Remove status code"
 						}
 					},
 					"title": "Advanced settings"
@@ -1020,11 +1032,9 @@
 					"monitorId": "Monitor ID",
 					"runCount": "Run count",
 					"failCount": "Count",
-					"lastRunAt": "Last run at",
-					"lockedAt": "Locked at",
+					"nextScheduledAt": "Next run at",
 					"lockedBy": "Locked by",
 					"lastFinishedAt": "Last finished at",
-					"lastRunTook": "Last run took",
 					"lastFailedAt": "Last failed",
 					"failReason": "Fail reason"
 				}
@@ -1575,6 +1585,10 @@
 						"editorial": {
 							"name": "Editorial",
 							"description": "Serif headings and hairline dividers. Distinctive and calm."
+						},
+						"minimal": {
+							"name": "Minimal",
+							"description": "Flat, focused, and compact with only the essentials."
 						}
 					}
 				},
@@ -1584,6 +1598,16 @@
 					"light": "Light only",
 					"dark": "Dark only"
 				},
+				"customCSS": {
+					"title": "Custom CSS",
+					"description": "Add custom CSS to fine-tune the look of your public status page.",
+					"option": {
+						"customCSS": {
+							"label": "Custom CSS",
+							"placeholder": "footer { display: none; }"
+						}
+					}
+				},
 				"features": {
 					"title": "Features",
 					"description": "Configure what information is displayed on your status page.",
@@ -1606,6 +1630,9 @@
 			"header": {
 				"title": "Status pages",
 				"description": "Publish public pages that show real-time uptime and incident history to your customers and stakeholders."
+			},
+			"preview": {
+				"title": "Status page preview"
 			}
 		},
 		"uptime": {

client/src/locales/es.json

@@ -941,10 +941,7 @@
 					"monitorId": "ID de monitor",
 					"runCount": "Conteo de ejecuciones",
 					"failCount": "Conteo de fallas",
-					"lastRunAt": "Última ejecución",
-					"lockedAt": "Bloqueado a las",
 					"lastFinishedAt": "Última finalización",
-					"lastRunTook": "Última ejecución tomó",
 					"lastFailedAt": "Última falla",
 					"failReason": "Razón de falla",
 					"state": "Estado"

client/src/locales/fi.json

@@ -941,10 +941,7 @@
 					"monitorId": "Monitorin tunnus",
 					"runCount": "Suorituskerrat",
 					"failCount": "Epäonnistumiskerrat",
-					"lastRunAt": "Viimeisin suoritus",
-					"lockedAt": "Lukittu",
 					"lastFinishedAt": "Viimeisin valmistuminen",
-					"lastRunTook": "Viimeisin suoritus kesti",
 					"lastFailedAt": "Viimeisin epäonnistuminen",
 					"failReason": "Epäonnistumisen syy",
 					"state": "Tila"

client/src/locales/fr.json

@@ -941,10 +941,7 @@
 					"monitorId": "ID du moniteur",
 					"runCount": "Nombre d'exécutions",
 					"failCount": "Nombre d'échecs",
-					"lastRunAt": "Dernière exécution",
-					"lockedAt": "Verrouillé le",
 					"lastFinishedAt": "Dernière fin",
-					"lastRunTook": "Durée dernière exécution",
 					"lastFailedAt": "Dernier échec",
 					"failReason": "Raison de l'échec",
 					"state": "État"

client/src/locales/ja.json

@@ -941,10 +941,7 @@
 					"monitorId": "モニターID",
 					"runCount": "実行回数",
 					"failCount": "失敗回数",
-					"lastRunAt": "最終実行日時",
-					"lockedAt": "ロック日時",
 					"lastFinishedAt": "最終完了日時",
-					"lastRunTook": "最終実行時間",
 					"lastFailedAt": "最終失敗日時",
 					"failReason": "失敗理由",
 					"state": "状態"

client/src/locales/pt-BR.json

@@ -941,10 +941,7 @@
 					"monitorId": "ID do monitor",
 					"runCount": "Contagem de execuções",
 					"failCount": "Contagem de falhas",
-					"lastRunAt": "Última execução em",
-					"lockedAt": "Bloqueado em",
 					"lastFinishedAt": "Última conclusão em",
-					"lastRunTook": "Última execução durou",
 					"lastFailedAt": "Última falha em",
 					"failReason": "Motivo da falha",
 					"state": "Estado"

client/src/locales/ru.json

@@ -941,10 +941,7 @@
 					"monitorId": "ID монитора",
 					"runCount": "Кол-во запусков",
 					"failCount": "Кол-во ошибок",
-					"lastRunAt": "Последний запуск",
-					"lockedAt": "Заблокировано в",
 					"lastFinishedAt": "Последнее завершение",
-					"lastRunTook": "Последний запуск занял",
 					"lastFailedAt": "Последняя ошибка",
 					"failReason": "Причина ошибки",
 					"state": "Состояние"

client/src/locales/th.json

@@ -941,10 +941,7 @@
 					"monitorId": "รหัสมอนิเตอร์",
 					"runCount": "จำนวนรัน",
 					"failCount": "จำนวนล้มเหลว",
-					"lastRunAt": "รันล่าสุดเมื่อ",
-					"lockedAt": "ล็อกเมื่อ",
 					"lastFinishedAt": "เสร็จสิ้นล่าสุดเมื่อ",
-					"lastRunTook": "รันล่าสุดใช้เวลา",
 					"lastFailedAt": "ล้มเหลวล่าสุดเมื่อ",
 					"failReason": "สาเหตุที่ล้มเหลว",
 					"state": "สถานะ"

client/src/locales/tr.json

@@ -941,10 +941,7 @@
 					"monitorId": "Monitör ID",
 					"runCount": "Çalışma sayısı",
 					"failCount": "Başarısızlık sayısı",
-					"lastRunAt": "Son çalışma zamanı",
-					"lockedAt": "Kilitlenme zamanı",
 					"lastFinishedAt": "Son tamamlanma zamanı",
-					"lastRunTook": "Son çalışma süresi",
 					"lastFailedAt": "Son başarısızlık zamanı",
 					"failReason": "Başarısızlık nedeni",
 					"state": "Durum"

client/src/locales/uk.json

@@ -941,10 +941,7 @@
 					"monitorId": "ID монітора",
 					"runCount": "Кількість запусків",
 					"failCount": "Кількість помилок",
-					"lastRunAt": "Останній запуск",
-					"lockedAt": "Заблоковано о",
 					"lastFinishedAt": "Останнє завершення",
-					"lastRunTook": "Останній запуск тривав",
 					"lastFailedAt": "Остання помилка",
 					"failReason": "Причина помилки",
 					"state": "Стан"

client/src/locales/vi.json

@@ -941,10 +941,7 @@
 					"monitorId": "ID trình giám sát",
 					"runCount": "Số lần chạy",
 					"failCount": "Số lần lỗi",
-					"lastRunAt": "Chạy lần cuối lúc",
-					"lockedAt": "Khóa lúc",
 					"lastFinishedAt": "Hoàn thành lần cuối lúc",
-					"lastRunTook": "Lần chạy cuối mất",
 					"lastFailedAt": "Lỗi lần cuối lúc",
 					"failReason": "Lý do lỗi",
 					"state": "Trạng thái"

client/src/locales/zh-CN.json

@@ -941,10 +941,7 @@
 					"monitorId": "监控 ID",
 					"runCount": "运行次数",
 					"failCount": "失败次数",
-					"lastRunAt": "上次运行于",
-					"lockedAt": "锁定于",
 					"lastFinishedAt": "上次完成于",
-					"lastRunTook": "上次运行耗时",
 					"lastFailedAt": "上次失败于",
 					"failReason": "失败原因",
 					"state": "状态"

client/src/locales/zh-TW.json

@@ -941,10 +941,7 @@
 					"monitorId": "監控 ID",
 					"runCount": "執行次數",
 					"failCount": "失敗次數",
-					"lastRunAt": "最後執行於",
-					"lockedAt": "鎖定於",
 					"lastFinishedAt": "最後完成於",
-					"lastRunTook": "最後執行耗時",
 					"lastFailedAt": "最後失敗於",
 					"failReason": "失敗原因",
 					"state": "狀態"

docker/.gitignore

@@ -2,14 +2,10 @@
 !quickstart.sh
 !build_images.sh
 dev/mongo/data/*
-dev/redis/data/*
 dist/mongo/data/*
-dist/redis/data/*
 prod/mongo/data/*
-prod/redis/data/*
 dist/docker-compose-test.yaml
 /dist-mono/mongo/data/*
-/dist-mono/redis/data/*
 /dist-arm/mongo/data/*
 *.env
 

docker/coolify/build_images.bat

@@ -12,14 +12,11 @@ set dockerfiles[0]=.\docker\coolify\client.Dockerfile
 set services[1]=bluewaveuptime/uptime_database_mongo
 set dockerfiles[1]=.\docker\coolify\mongoDB.Dockerfile
 
-set services[2]=bluewaveuptime/uptime_redis
-set dockerfiles[2]=.\docker\coolify\redis.Dockerfile
-
-set services[3]=bluewaveuptime/uptime_server
-set dockerfiles[3]=.\docker\coolify\server.Dockerfile
+set services[2]=bluewaveuptime/uptime_server
+set dockerfiles[2]=.\docker\coolify\server.Dockerfile
 
 REM Loop through each service and build the corresponding image
-for /L %%i in (0,1,2,3) do (
+for /L %%i in (0,1,2) do (
     set service=!services[%%i]!
     set dockerfile=!dockerfiles[%%i]!
 

docker/coolify/build_images.sh

@@ -7,7 +7,6 @@ cd ../../
 declare -A services=(
   ["bluewaveuptime/uptime_client"]="./docker/coolify/client.Dockerfile"
   ["bluewaveuptime/uptime_database_mongo"]="./docker/coolify/mongoDB.Dockerfile"
-  ["bluewaveuptime/uptime_redis"]="./docker/coolify/redis.Dockerfile"
   ["bluewaveuptime/uptime_server"]="./docker/coolify/server.Dockerfile"
 )
 

docker/coolify/redis.Dockerfile

@@ -1,2 +0,0 @@
-FROM redis
-EXPOSE 6379

docker/coolify/server.Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-slim
+FROM node:22-slim
 
 # Install ping
 RUN apt-get update \

docker/dev/docker-compose.custom-ca-example.yaml

@@ -19,7 +19,6 @@ services:
       # Mount the certs directory (read-only for security)
       - ./certs:/certs:ro
     depends_on:
-      - redis
       - mongodb
     # Optional: Add healthcheck to ensure the server starts properly
     healthcheck:

docker/dev/docker-compose.yaml

@@ -20,9 +20,35 @@ services:
       - server.env
     depends_on:
       - mongodb
+  worker:
+    image: uptime_server:latest
+    restart: always
+    ports:
+      - "52346:52346"
+    env_file:
+      - server.env
+    environment:
+      QUEUE_MODE: "worker"
+      HEALTH_PORT: "52346"
+    stop_grace_period: 30s
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "node",
+          "-e",
+          "require('http').get('http://localhost:52346/livez',r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))",
+        ]
+      interval: 15s
+      timeout: 3s
+      retries: 3
+    depends_on:
+      - mongodb
   mongodb:
     image: uptime_mongo:latest
     restart: always
+    ports:
+      - "27017:27017"
     command: ["mongod", "--quiet", "--bind_ip_all"]
     volumes:
       - ./mongo/data:/data/db

docker/dev/server.Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-slim
+FROM node:22-slim
 
 # Install ping
 RUN apt-get update \

docker/dist-arm/docker-compose.yaml

@@ -9,7 +9,6 @@ services:
       - UPTIME_APP_API_BASE_URL=http://localhost:52345/api/v1
       - UPTIME_APP_CLIENT_HOST=http://localhost
       - DB_CONNECTION_STRING=mongodb://mongodb:27017/uptime_db
-      - REDIS_URL=redis://redis:6379
       - CLIENT_HOST=http://localhost
       - JWT_SECRET=my_secret
     depends_on:

docker/dist-arm/server.Dockerfile

@@ -19,7 +19,7 @@ RUN npm run build
 # ---------------------
 # Backend stage
 # ---------------------
-FROM node:20-slim AS backend
+FROM node:22-slim AS backend
 
 # Install ping
 RUN apt-get update \

docker/dist-mono/server.Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-slim AS frontend-build
+FROM node:22-slim AS frontend-build
 
 WORKDIR /app/client
 
@@ -8,7 +8,7 @@ RUN npm install
 COPY client ./
 RUN npm run build
 
-FROM node:20-slim AS app
+FROM node:22-slim AS app
 
 # Install ping
 RUN apt-get update \

docker/dist/server.Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-slim
+FROM node:22-slim
 
 # Install ping
 RUN apt-get update \

docker/prod/server.Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-slim
+FROM node:22-slim
 
 # Install ping
 RUN apt-get update \

docker/staging/server.Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-slim
+FROM node:22-slim
 
 # Install ping
 RUN apt-get update \

docker/unified/server.Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-slim
+FROM node:22-slim
 
 # Install ping
 RUN apt-get update \

server/openapi.json

@@ -386,6 +386,10 @@
 						"type": "string",
 						"enum": ["equal", "include", "regex"]
 					},
+					"method": {
+						"type": "string",
+						"enum": ["GET", "HEAD"]
+					},
 					"notifications": {
 						"type": "array",
 						"items": {
@@ -466,6 +470,9 @@
 					},
 					"updatedAt": {
 						"type": "string"
+					},
+					"lastEvaluatedAt": {
+						"type": "number"
 					}
 				},
 				"required": [
@@ -480,6 +487,7 @@
 					"statusWindowThreshold",
 					"ignoreTlsErrors",
 					"useAdvancedMatching",
+					"method",
 					"notifications",
 					"tags",
 					"cpuAlertThreshold",
@@ -493,7 +501,8 @@
 					"teamId",
 					"userId",
 					"createdAt",
-					"updatedAt"
+					"updatedAt",
+					"lastEvaluatedAt"
 				],
 				"additionalProperties": {
 					"nullable": true
@@ -7066,6 +7075,10 @@
 											}
 										]
 									},
+									"method": {
+										"type": "string",
+										"enum": ["GET", "HEAD"]
+									},
 									"gameId": {
 										"anyOf": [
 											{
@@ -7666,6 +7679,11 @@
 														}
 													]
 												},
+												"method": {
+													"type": "string",
+													"enum": ["GET", "HEAD"],
+													"default": "GET"
+												},
 												"url": {
 													"type": "string",
 													"minLength": 1
@@ -8278,6 +8296,10 @@
 											}
 										]
 									},
+									"method": {
+										"type": "string",
+										"enum": ["GET", "HEAD"]
+									},
 									"port": {
 										"type": "number",
 										"minimum": 1,
@@ -10498,6 +10520,10 @@
 									"showInfrastructure": {
 										"type": "boolean"
 									},
+									"customCSS": {
+										"type": "string",
+										"maxLength": 100000
+									},
 									"removeLogo": {
 										"anyOf": [
 											{
@@ -10712,6 +10738,10 @@
 									"showInfrastructure": {
 										"type": "boolean"
 									},
+									"customCSS": {
+										"type": "string",
+										"maxLength": 100000
+									},
 									"removeLogo": {
 										"anyOf": [
 											{

server/package.json

@@ -31,6 +31,7 @@
 		"node": ">=20"
 	},
 	"dependencies": {
+		"@csstools/css-tokenizer": "^3.0.4",
 		"@grpc/grpc-js": "^1.14.3",
 		"@grpc/proto-loader": "^0.8.0",
 		"axios": "^1.15.2",
@@ -55,8 +56,9 @@
 		"mjml": "^5.0.0-alpha.4",
 		"mongoose": "^8.3.3",
 		"multer": "^1.4.5-lts.2",
-		"nodemailer": "8.0.5",
+		"nodemailer": "8.0.11",
 		"ping": "0.4.4",
+		"re2": "^1.24.1",
 		"sharp": "0.33.5",
 		"ssl-checker": "2.0.10",
 		"swagger-ui-express": "5.0.1",

server/src/api/controllers/queueController.ts

@@ -1,4 +1,4 @@
-import { IWorker } from "@/worker/worker.interface.js";
+import { IJobScheduler } from "@/worker/worker.interface.js";
 import { getQueueJobsQueryValidation } from "@/api/validation/queueValidation.js";
 import { Request, Response, NextFunction } from "express";
 
@@ -13,10 +13,7 @@ export interface IJobQueueController {
 
 class JobQueueController implements IJobQueueController {
 	static SERVICE_NAME = SERVICE_NAME;
-	private worker: IWorker;
-	constructor(worker: IWorker) {
-		this.worker = worker;
-	}
+	constructor(private scheduler: IJobScheduler) {}
 
 	get serviceName() {
 		return JobQueueController.SERVICE_NAME;
@@ -24,7 +21,7 @@ class JobQueueController implements IJobQueueController {
 
 	getMetrics = async (req: Request, res: Response, next: NextFunction) => {
 		try {
-			const metrics = await this.worker.getMetrics();
+			const metrics = await this.scheduler.getMetrics();
 			res.status(200).json({
 				success: true,
 				msg: "Queue metrics fetched successfully",
@@ -38,7 +35,7 @@ class JobQueueController implements IJobQueueController {
 	getJobs = async (req: Request, res: Response, next: NextFunction) => {
 		try {
 			const pagination = getQueueJobsQueryValidation.parse(req.query);
-			const { jobs, count } = await this.worker.getJobs(pagination);
+			const { jobs, count } = await this.scheduler.getJobs(pagination);
 			return res.status(200).json({
 				success: true,
 				msg: "Queue jobs fetched successfully",
@@ -52,8 +49,8 @@ class JobQueueController implements IJobQueueController {
 	getAllMetrics = async (req: Request, res: Response, next: NextFunction) => {
 		try {
 			const pagination = getQueueJobsQueryValidation.parse(req.query);
-			const { jobs, count } = await this.worker.getJobs(pagination);
-			const metrics = await this.worker.getMetrics();
+			const { jobs, count } = await this.scheduler.getJobs(pagination);
+			const metrics = await this.scheduler.getMetrics();
 			return res.status(200).json({
 				success: true,
 				msg: "Queue metrics fetched successfully",
@@ -66,7 +63,7 @@ class JobQueueController implements IJobQueueController {
 
 	flushQueue = async (req: Request, res: Response, next: NextFunction) => {
 		try {
-			const result = await this.worker.flushQueues();
+			const result = await this.scheduler.flushQueues();
 			return res.status(200).json({
 				success: true,
 				msg: "Queue flushed successfully",

server/src/api/controllers/statusPageController.ts

@@ -10,11 +10,7 @@ import {
 import { AppError } from "@/utils/AppError.js";
 import { requireTeamId, requireUserId } from "@/api/controllers/controllerUtils.js";
 import { IStatusPageService } from "@/domain/status-pages/status-page.service.js";
-import { IMonitorsRepository } from "@/domain/monitors/monitor.repository.interface.js";
-import { ISettingsService } from "@/domain/app-settings/app-settings.service.js";
-import { NormalizeData } from "@/utils/dataUtils.js";
 import { resolveStatusPageDomainFromRequest } from "@/utils/statusPageDomain.js";
-import type { StatusPage } from "@/domain/status-pages/status-page.type.js";
 
 const SERVICE_NAME = "statusPageController";
 
@@ -31,53 +27,14 @@ export interface IStatusPageController {
 class StatusPageController implements IStatusPageController {
 	static SERVICE_NAME = SERVICE_NAME;
 	private statusPageService: IStatusPageService;
-	private monitorsRepository: IMonitorsRepository;
-	private settingsService: ISettingsService;
-	constructor(statusPageService: IStatusPageService, monitorsRepository: IMonitorsRepository, settingsService: ISettingsService) {
+	constructor(statusPageService: IStatusPageService) {
 		this.statusPageService = statusPageService;
-		this.monitorsRepository = monitorsRepository;
-		this.settingsService = settingsService;
 	}
 
 	get serviceName() {
 		return StatusPageController.SERVICE_NAME;
 	}
 
-	private buildStatusPagePayload = async (statusPage: StatusPage, req: Request) => {
-		if (!statusPage.isPublished) {
-			const teamId = requireTeamId(req?.user?.teamId);
-			if (statusPage.teamId !== teamId) {
-				throw new AppError({ message: "Forbidden", status: 403 });
-			}
-		}
-
-		const settings = await this.settingsService.getDBSettings();
-		const showURL = settings.showURL;
-
-		const monitors = await this.monitorsRepository.findByIds(statusPage.monitors);
-		const monitorOrder = new Map(statusPage.monitors.map((id, index) => [id, index]));
-		const sortedMonitors = [...monitors].sort((a, b) => {
-			const orderA = monitorOrder.get(a.id) ?? Number.MAX_SAFE_INTEGER;
-			const orderB = monitorOrder.get(b.id) ?? Number.MAX_SAFE_INTEGER;
-			return orderA - orderB;
-		});
-
-		const normalizedMonitors = sortedMonitors.map((monitor) => {
-			const normalizedChecks = NormalizeData(monitor.recentChecks, 10, 100);
-			if (!showURL) {
-				// eslint-disable-next-line @typescript-eslint/no-unused-vars
-				const { url, port, secret, notifications, ...rest } = monitor;
-				return { ...rest, checks: normalizedChecks };
-			}
-			return { ...monitor, checks: normalizedChecks };
-		});
-
-		return {
-			statusPage,
-			monitors: normalizedMonitors,
-		};
-	};
-
 	createStatusPage = async (req: Request, res: Response, next: NextFunction) => {
 		try {
 			createStatusPageBodyValidation.parse(req.body);
@@ -135,7 +92,7 @@ class StatusPageController implements IStatusPageController {
 			}
 
 			const statusPage = await this.statusPageService.getStatusPageByUrl(req.params.url as string);
-			const data = await this.buildStatusPagePayload(statusPage, req);
+			const data = await this.statusPageService.getPublicStatusPagePayload(statusPage, req.user?.teamId);
 
 			return res.status(200).json({
 				success: true,
@@ -161,7 +118,7 @@ class StatusPageController implements IStatusPageController {
 				throw new AppError({ message: "Status page not found", status: 404 });
 			}
 
-			const data = await this.buildStatusPagePayload(statusPage, req);
+			const data = await this.statusPageService.getPublicStatusPagePayload(statusPage, req.user?.teamId);
 
 			return res.status(200).json({
 				success: true,

server/src/api/controllers/statusPageThemeFlag.ts

@@ -1,33 +0,0 @@
-import { DEFAULT_STATUS_PAGE_THEME, DEFAULT_STATUS_PAGE_THEME_MODE, type StatusPage } from "@/domain/status-pages/status-page.type.js";
-
-/**
- * When STATUS_PAGE_THEMES_ENABLED is false, the controller drops incoming
- * theme fields before persisting so an admin client can't accidentally store
- * a value the public page won't honour. Whatever a caller sends here for
- * `theme` / `themeMode` is silently ignored — the rest of the body is
- * preserved verbatim.
- *
- * The strip is silent (not a 400) because the kill switch is an ops-side
- * concern: API clients should not have to know whether the operator has
- * disabled themes today, only that their saved value won't take effect.
- * If we later decide we'd rather fail loudly, change this to throw a
- * 400 AppError; downstream consumers already handle it.
- */
-export const withoutThemeFields = (body: Record<string, unknown>): Record<string, unknown> => {
-	const rest = { ...body };
-	delete rest.theme;
-	delete rest.themeMode;
-	return rest;
-};
-
-/**
- * When STATUS_PAGE_THEMES_ENABLED is false, callers reading a status page
- * should see the canonical default theme / mode regardless of what's stored
- * in Mongo. Whatever the user previously chose stays in the DB so flipping
- * the flag back on resurfaces their selection.
- */
-export const applyDefaultTheme = (statusPage: StatusPage): StatusPage => ({
-	...statusPage,
-	theme: DEFAULT_STATUS_PAGE_THEME,
-	themeMode: DEFAULT_STATUS_PAGE_THEME_MODE,
-});

server/src/api/middleware/handleErrors.ts

@@ -1,12 +1,12 @@
 import type { NextFunction, Request, Response } from "express";
 import { MulterError } from "multer";
-import { logger } from "@/utils/logger.js";
+import type { ILogger } from "@/utils/logger.js";
 import { AppError } from "@/utils/AppError.js";
 
 // Multer throws MulterError, send 413 Payload Too Large / 400
 const multerErrorStatus = (error: MulterError): number => (error.code === "LIMIT_FILE_SIZE" ? 413 : 400);
 
-const handleErrors = (error: unknown, req: Request, res: Response, _next: NextFunction) => {
+const handleErrors = (logger: ILogger) => (error: unknown, req: Request, res: Response, _next: NextFunction) => {
 	const status = error instanceof MulterError ? multerErrorStatus(error) : error instanceof AppError ? error.status || 500 : 500;
 	const message = error instanceof AppError ? error.message : error instanceof Error ? error.message : "Server error";
 	const service = error instanceof AppError ? error.service : error instanceof MulterError ? "uploadMiddleware" : "unknownService";

server/src/api/middleware/rateLimiter.ts

@@ -1,12 +1,14 @@
 import rateLimit from "express-rate-limit";
 
-export const generalApiLimiter = rateLimit({
-	windowMs: 60 * 1000,
-	limit: 600,
-	standardHeaders: true,
-	legacyHeaders: false,
-	ipv6Subnet: 64,
-});
+export const generalApiLimiter = (devMode: boolean) =>
+	rateLimit({
+		windowMs: 60 * 1000,
+		limit: 600,
+		standardHeaders: true,
+		legacyHeaders: false,
+		ipv6Subnet: 64,
+		skip: () => devMode,
+	});
 
 export const authApiLimiter = rateLimit({
 	windowMs: 60 * 1000,

server/src/api/middleware/statusPageDocumentCsp.ts

@@ -0,0 +1,27 @@
+import type { NextFunction, Request, Response } from "express";
+import { normalizeStatusPageDomain } from "@/utils/statusPageDomain.js";
+
+const PUBLIC_STATUS_PAGE_DOCUMENT_PREFIX = "/status/public";
+
+// Browsers enforce the intersection of all CSP headers, so this only tightens
+// the status page on top of the global helmet policy, blocking external images,
+// fonts, and stylesheets from custom CSS while keeping the app's Google Fonts.
+const STATUS_PAGE_CSP = [
+	"img-src 'self' data:",
+	"font-src 'self' data: https://fonts.gstatic.com",
+	"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+].join("; ");
+
+// A status page document is served on the public path or on a custom domain
+// (any host other than the app's own). Mirrors the client isCustomDomainHost.
+export const createStatusPageDocumentCsp = (clientHost: string) => {
+	const appHostname = normalizeStatusPageDomain(clientHost);
+
+	return (req: Request, res: Response, next: NextFunction) => {
+		const onCustomDomain = appHostname !== null && normalizeStatusPageDomain(req.hostname) !== appHostname;
+		if (req.path.startsWith(PUBLIC_STATUS_PAGE_DOCUMENT_PREFIX) || onCustomDomain) {
+			res.append("Content-Security-Policy", STATUS_PAGE_CSP);
+		}
+		return next();
+	};
+};

server/src/api/routes/statusPageRoute.ts

@@ -1,5 +1,6 @@
 import { IStatusPageController } from "@/api/controllers/statusPageController.js";
 import { RequestHandler, Router } from "express";
+import { isAllowed } from "@/api/middleware/isAllowed.js";
 import { imageUpload } from "@/api/middleware/upload.js";
 
 class StatusPageRoutes {
@@ -15,12 +16,12 @@ class StatusPageRoutes {
 	initRoutes(verifyJWT: RequestHandler, verifyStatusPageAccess: RequestHandler) {
 		this.router.get("/team", verifyJWT, this.statusPageController.getStatusPagesByTeamId);
 
-		this.router.post("/", imageUpload.single("logo"), verifyJWT, this.statusPageController.createStatusPage);
-		this.router.put("/:id", imageUpload.single("logo"), verifyJWT, this.statusPageController.updateStatusPage);
+		this.router.post("/", imageUpload.single("logo"), verifyJWT, isAllowed(["admin", "superadmin"]), this.statusPageController.createStatusPage);
+		this.router.put("/:id", imageUpload.single("logo"), verifyJWT, isAllowed(["admin", "superadmin"]), this.statusPageController.updateStatusPage);
 
 		this.router.get("/resolve", this.statusPageController.resolveStatusPageByDomain);
 		this.router.get("/:url", verifyStatusPageAccess, this.statusPageController.getStatusPageByUrl);
-		this.router.delete("/:id", verifyJWT, this.statusPageController.deleteStatusPage);
+		this.router.delete("/:id", verifyJWT, isAllowed(["admin", "superadmin"]), this.statusPageController.deleteStatusPage);
 	}
 
 	getRouter() {

server/src/api/validation/monitorValidation.ts

@@ -1,8 +1,10 @@
 import { z } from "zod";
+import RE2 from "re2";
 import { booleanCoercion, dnsHostnameRegex, dnsServerValidation } from "./shared.js";
 import { GeoContinents } from "@/domain/geo-checks/geo-check.type.js";
 import {
 	DnsRecordTypes,
+	HttpMethods,
 	HttpStatusCodeSet,
 	MonitorMatchMethods,
 	MonitorStatuses,
@@ -70,6 +72,30 @@ const refineStrategyType = (body: { type?: string; strategy?: string }, ctx: z.R
 	}
 };
 
+// The regex is executed at check time with RE2, reject patterns RE2 won't accept
+const refineRegexPattern = (body: { matchMethod?: string; expectedValue?: string }, ctx: z.RefinementCtx) => {
+	if (body.matchMethod !== "regex" || !body.expectedValue) return;
+	try {
+		new RE2(body.expectedValue);
+	} catch {
+		ctx.addIssue({
+			code: "custom",
+			path: ["expectedValue"],
+			message: "Invalid regex pattern. Backreferences and lookahead/lookbehind are not supported.",
+		});
+	}
+};
+
+const refineHeadMatching = (body: { method?: string; useAdvancedMatching?: boolean; jsonPath?: string }, ctx: z.RefinementCtx) => {
+	if (body.method === "HEAD" && (body.useAdvancedMatching === true || (body.jsonPath ?? "") !== "")) {
+		ctx.addIssue({
+			code: "custom",
+			path: ["method"],
+			message: "HEAD requests have no response body, so they cannot use advanced matching or a JSON path",
+		});
+	}
+};
+
 export const createMonitorBodyValidation = z
 	.object({
 		_id: z.string().optional(),
@@ -95,6 +121,7 @@ export const createMonitorBodyValidation = z
 		jsonPath: z.union([z.string(), z.literal("")]).optional(),
 		expectedValue: z.union([z.string(), z.literal("")]).optional(),
 		matchMethod: z.union([z.enum(MonitorMatchMethods), z.literal("")]).optional(),
+		method: z.enum(HttpMethods).optional(),
 		gameId: z.union([z.string(), z.literal("")]).optional(),
 		grpcServiceName: z.union([z.string(), z.literal("")]).default(""),
 		strategy: z.enum(PageSpeedStrategies).optional(),
@@ -107,7 +134,9 @@ export const createMonitorBodyValidation = z
 		dnsRecordType: z.enum(DnsRecordTypes).optional(),
 	})
 	.superRefine(refineDnsHostname)
-	.superRefine(refineStrategyType);
+	.superRefine(refineStrategyType)
+	.superRefine(refineHeadMatching)
+	.superRefine(refineRegexPattern);
 
 export const editMonitorBodyValidation = z
 	.object({
@@ -127,6 +156,7 @@ export const editMonitorBodyValidation = z
 		jsonPath: z.union([z.string(), z.literal("")]).optional(),
 		expectedValue: z.union([z.string(), z.literal("")]).optional(),
 		matchMethod: z.union([z.enum(MonitorMatchMethods), z.literal("")]).optional(),
+		method: z.enum(HttpMethods).optional(),
 		port: z.number().min(1).max(65535).optional(),
 		cpuAlertThreshold: z.number().optional(),
 		memoryAlertThreshold: z.number().optional(),
@@ -144,7 +174,9 @@ export const editMonitorBodyValidation = z
 		dnsRecordType: z.enum(DnsRecordTypes).optional(),
 	})
 	.superRefine(refineDnsHostname)
-	.superRefine(refineStrategyType);
+	.superRefine(refineStrategyType)
+	.superRefine(refineHeadMatching)
+	.superRefine(refineRegexPattern);
 
 export const pauseMonitorParamValidation = z.object({
 	monitorId: z.string().min(1, "Monitor ID is required"),
@@ -184,6 +216,7 @@ const importedMonitorSchema = z
 		jsonPath: z.union([z.string(), z.literal("")]).optional(),
 		expectedValue: z.union([z.string(), z.literal("")]).optional(),
 		matchMethod: z.union([z.enum(MonitorMatchMethods), z.literal("")]).optional(),
+		method: z.enum(HttpMethods).optional().default("GET"),
 		url: z.string().min(1, "URL is required"),
 		port: z.number().optional(),
 		isActive: z.boolean().default(true),
@@ -215,7 +248,9 @@ const importedMonitorSchema = z
 		updatedAt: z.string().optional(),
 	})
 	.superRefine(refineDnsHostname)
-	.superRefine(refineStrategyType);
+	.superRefine(refineStrategyType)
+	.superRefine(refineHeadMatching)
+	.superRefine(refineRegexPattern);
 
 export const importMonitorsBodyValidation = z.object({
 	monitors: z.array(importedMonitorSchema).min(1, "At least one monitor is required"),
@@ -251,6 +286,7 @@ export const monitorResponseSchema = z
 		jsonPath: z.string().optional(),
 		expectedValue: z.string().optional(),
 		matchMethod: z.enum(MonitorMatchMethods).optional(),
+		method: z.enum(HttpMethods),
 		notifications: z.array(z.string()),
 		tags: z.array(z.string()),
 		customUpCodes: z.array(httpStatusCode).optional(),

server/src/api/validation/statusPageValidation.ts

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { booleanCoercion, dnsHostnameRegex } from "./shared.js";
 import { StatusPageTypes, StatusPageThemes, StatusPageThemeModes } from "@/domain/status-pages/status-page.type.js";
 import { normalizeStatusPageDomain } from "@/utils/statusPageDomain.js";
+import { cssReferencesExternalResource } from "@/utils/customCss.js";
 
 //****************************************
 // Status Page Validations
@@ -48,6 +49,13 @@ export const createStatusPageBodyValidation = z
 		showUptimePercentage: booleanCoercion,
 		showAdminLoginLink: booleanCoercion.optional(),
 		showInfrastructure: booleanCoercion.optional(),
+		customCSS: z
+			.string()
+			.max(100000, "Custom CSS must be at most 100000 characters")
+			.refine((css) => !cssReferencesExternalResource(css), {
+				message: "Custom CSS cannot reference external URLs or use @import",
+			})
+			.optional(),
 		removeLogo: z.union([z.literal("true"), z.literal("false")]).optional(),
 		theme: z.enum(StatusPageThemes).optional(),
 		themeMode: z.enum(StatusPageThemeModes).optional(),

server/src/app.ts

@@ -9,20 +9,21 @@ import { handleErrors } from "@/api/middleware/handleErrors.js";
 import { generalApiLimiter } from "@/api/middleware/rateLimiter.js";
 import { sanitizeBody, sanitizeQuery } from "@/api/middleware/sanitization.js";
 import { setupRoutes } from "@/config/routes.js";
-import { InitializedServices } from "@/config/services.js";
 import { InitializedControllers } from "@/config/controllers.js";
 import { EnvConfig } from "@/domain/app-settings/app-settings.service.js";
 import { createStatusPageCorsOrigin } from "@/api/middleware/statusPageCorsOrigin.js";
 import { isPublicStatusPageApiPath } from "@/api/middleware/statusPagePublicApiPath.js";
+import { createStatusPageDocumentCsp } from "@/api/middleware/statusPageDocumentCsp.js";
+import { ApiServices } from "@/config/services.api.js";
 
 export const createApp = ({
-	services,
+	apiServices: services,
 	controllers,
 	envSettings,
 	frontendPath,
 	openApiSpec,
 }: {
-	services: InitializedServices;
+	apiServices: ApiServices;
 	controllers: InitializedControllers;
 	envSettings: EnvConfig;
 	frontendPath: string;
@@ -38,7 +39,8 @@ export const createApp = ({
 	};
 	const publicStatusPageCorsOrigin = createStatusPageCorsOrigin(allowedOrigin, services.statusPagesRepository);
 
-	app.use(generalApiLimiter);
+	const devMode = envSettings.nodeEnv === "development";
+	app.use(generalApiLimiter(devMode));
 
 	app.use((req, res, next) => {
 		const corsOptions = isPublicStatusPageApiPath(req.method, req.path)
@@ -48,6 +50,8 @@ export const createApp = ({
 		return cors(corsOptions)(req, res, next);
 	});
 
+	app.use(createStatusPageDocumentCsp(allowedOrigin));
+
 	app.use(express.static(frontendPath));
 
 	app.use(express.json());
@@ -112,6 +116,6 @@ export const createApp = ({
 	app.get("*", (req, res) => {
 		res.sendFile(path.join(frontendPath, "index.html"));
 	});
-	app.use(handleErrors);
+	app.use(handleErrors(services.logger));
 	return app;
 };

server/src/config/controllers.ts

@@ -12,7 +12,7 @@ import NotificationController from "../api/controllers/notificationController.js
 import TagsController from "../api/controllers/tagController.js";
 import DiagnosticController from "../api/controllers/diagnosticController.js";
 import IncidentController from "../api/controllers/incidentController.js";
-import type { InitializedServices } from "@/config/services.js";
+import { ApiServices } from "@/config/services.api.js";
 
 export interface InitializedControllers {
 	authController: AuthController;
@@ -30,21 +30,21 @@ export interface InitializedControllers {
 	diagnosticController: DiagnosticController;
 	incidentController: IncidentController;
 }
-export const initializeControllers = (services: InitializedServices): InitializedControllers => {
+export const initializeControllers = (apiServices: ApiServices): InitializedControllers => {
 	return {
-		authController: new AuthController(services.userService),
-		monitorController: new MonitorController(services.monitorService, services.notificationsService),
-		settingsController: new SettingsController(services.settingsService, services.emailService),
-		checkController: new CheckController(services.checkService),
-		geoCheckController: new GeoCheckController(services.geoChecksService),
-		inviteController: new InviteController(services.inviteService),
-		maintenanceWindowController: new MaintenanceWindowController(services.maintenanceWindowService),
-		queueController: new QueueController(services.worker),
-		logController: new LogController(services.logger),
-		statusPageController: new StatusPageController(services.statusPageService, services.monitorsRepository, services.settingsService),
-		notificationController: new NotificationController(services.notificationsService, services.monitorsRepository),
-		tagController: new TagsController(services.tagsService),
-		diagnosticController: new DiagnosticController(services.diagnosticService),
-		incidentController: new IncidentController(services.incidentService),
+		authController: new AuthController(apiServices.userService),
+		monitorController: new MonitorController(apiServices.monitorService, apiServices.notificationsService),
+		settingsController: new SettingsController(apiServices.settingsService, apiServices.emailService),
+		checkController: new CheckController(apiServices.checkService),
+		geoCheckController: new GeoCheckController(apiServices.geoChecksService),
+		inviteController: new InviteController(apiServices.inviteService),
+		maintenanceWindowController: new MaintenanceWindowController(apiServices.maintenanceWindowService),
+		queueController: new QueueController(apiServices.worker),
+		logController: new LogController(apiServices.logger),
+		statusPageController: new StatusPageController(apiServices.statusPageService),
+		notificationController: new NotificationController(apiServices.notificationsService, apiServices.monitorsRepository),
+		tagController: new TagsController(apiServices.tagsService),
+		diagnosticController: new DiagnosticController(apiServices.diagnosticService),
+		incidentController: new IncidentController(apiServices.incidentService),
 	};
 };

server/src/config/envValidation.ts

@@ -1,10 +1,13 @@
 import { z } from "zod";
 import { DbTypes, QueueModes } from "@/domain/app-settings/app-settings.type.js";
 import { booleanCoercion } from "@/api/validation/shared.js";
+import { ILogger } from "@/utils/logger.js";
 
 const envSchema = z.object({
 	// Server Configuration
 	PORT: z.string().default("52345"),
+	// Port for worker health checks
+	HEALTH_PORT: z.string().default("52346"),
 	NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
 	LOG_LEVEL: z.enum(["error", "warn", "info", "debug"]).default("debug"),
 
@@ -31,24 +34,39 @@ const envSchema = z.object({
 
 export type ValidatedEnv = z.infer<typeof envSchema>;
 
-export const validateEnv = (): ValidatedEnv => {
+export const validateEnv = (logger: ILogger): ValidatedEnv => {
 	const result = envSchema.safeParse(process.env);
 
 	if (!result.success) {
-		console.error("Environment validation failed:");
-		console.error("");
+		logger.error({
+			message: "Env validation failed",
+			method: "validateEnv",
+			service: "Server",
+		});
 
 		const errors = result.error.format();
 		for (const [key, value] of Object.entries(errors)) {
 			if (key !== "_errors" && value && typeof value === "object" && "_errors" in value) {
-				console.error(`  ${key}: ${value._errors.join(", ")}`);
+				logger.error({
+					message: `${key}: ${value._errors.join(", ")}`,
+					method: "validateEnv",
+					service: "Server",
+				});
 			}
 		}
 
-		console.error("Please check your .env file and ensure all required variables are set.");
+		logger.error({
+			message: "Please check your .env file and ensure all required variables are set.",
+			method: "validateEnv",
+			service: "Server",
+		});
 		process.exit(1);
 	}
 
-	console.log("Environment variables validated successfully");
+	logger.info({
+		message: "Environment variables validated successfully",
+		method: "validateEnv",
+		service: "Server",
+	});
 	return result.data;
 };

server/src/config/routes.ts

@@ -3,7 +3,7 @@ import { createVerifyJWT } from "../api/middleware/verifyJWT.js";
 import { createVerifyStatusPageAccess } from "../api/middleware/verifyStatusPageAccess.js";
 import { authApiLimiter } from "../api/middleware/rateLimiter.js";
 import type { InitializedControllers } from "./controllers.js";
-import type { InitializedServices } from "./services.js";
+import type { ApiServices } from "@/config/services.api.js";
 
 import AuthRoutes from "../api/routes/authRoute.js";
 import InviteRoutes from "../api/routes/inviteRoute.js";
@@ -21,8 +21,8 @@ import TagRoutes from "../api/routes/tagRoutes.js";
 
 import IncidentRoutes from "../api/routes/incidentRoute.js";
 
-export const setupRoutes = (app: Application, controllers: InitializedControllers, services: InitializedServices) => {
-	const verifyJWT = createVerifyJWT(services.settingsService);
+export const setupRoutes = (app: Application, controllers: InitializedControllers, apiServices: ApiServices) => {
+	const verifyJWT = createVerifyJWT(apiServices.settingsService);
 	const authRoutes = new AuthRoutes(controllers.authController, verifyJWT);
 	const monitorRoutes = new MonitorRoutes(controllers.monitorController);
 	const settingsRoutes = new SettingsRoutes(controllers.settingsController);
@@ -32,7 +32,7 @@ export const setupRoutes = (app: Application, controllers: InitializedController
 	const maintenanceWindowRoutes = new MaintenanceWindowRoutes(controllers.maintenanceWindowController);
 	const queueRoutes = new QueueRoutes(controllers.queueController);
 	const logRoutes = new LogRoutes(controllers.logController);
-	const verifyStatusPageAccess = createVerifyStatusPageAccess(services.statusPagesRepository, verifyJWT);
+	const verifyStatusPageAccess = createVerifyStatusPageAccess(apiServices.statusPagesRepository, verifyJWT);
 	const statusPageRoutes = new StatusPageRoutes(controllers.statusPageController, verifyJWT, verifyStatusPageAccess);
 	const notificationRoutes = new NotificationRoutes(controllers.notificationController);
 	const tagRoutes = new TagRoutes(controllers.tagController);

server/src/config/services.api.ts

@@ -0,0 +1,109 @@
+import { DiagnosticService, IDiagnosticService } from "@/domain/diagnostics/diagnostic.service.js";
+import { IInviteService, InviteService } from "@/domain/invites/invite.service.js";
+import { IMaintenanceWindowService, MaintenanceWindowService } from "@/domain/maintenance-windows/maintenance-window.service.js";
+import { IMonitorService, MonitorService } from "@/domain/monitors/monitor.service.js";
+import { IStatusPageService, StatusPageService } from "@/domain/status-pages/status-page.service.js";
+import { ITagsService, TagsService } from "@/domain/tags/tag.service.js";
+import { IUserService, UserService } from "@/domain/users/user.service.js";
+import { IJobScheduler } from "@/worker/worker.interface.js";
+
+// Third-party
+import jwt from "jsonwebtoken";
+import crypto from "crypto";
+import { games } from "gamedig";
+
+import { SharedServices } from "@/config/services.shared.js";
+
+export interface ApiServices extends SharedServices {
+	worker: IJobScheduler; // control-plane handle only (DBQueueWorker in all-in-one, bare JobScheduler in API-only)
+	userService: IUserService;
+	monitorService: IMonitorService;
+	maintenanceWindowService: IMaintenanceWindowService;
+	inviteService: IInviteService;
+	statusPageService: IStatusPageService;
+	tagsService: ITagsService;
+	diagnosticService: IDiagnosticService;
+}
+
+export const buildApi = (shared: SharedServices, jobScheduler: IJobScheduler): ApiServices => {
+	const {
+		logger,
+		db,
+		settingsService,
+		emailService,
+		monitorsRepository,
+		checksRepository,
+		geoChecksRepository,
+		monitorStatsRepository,
+		statusPagesRepository,
+		usersRepository,
+		invitesRepository,
+		recoveryTokensRepository,
+		settingsRepository,
+		tagsRepository,
+		incidentsRepository,
+		teamsRepository,
+		maintenanceWindowsRepository,
+		jobsRepository,
+	} = shared;
+
+	const userService = new UserService({
+		crypto,
+		emailService,
+		settingsService,
+		logger,
+		jwt,
+		scheduler: jobScheduler,
+		monitorsRepository,
+		usersRepository,
+		invitesRepository,
+		recoveryTokensRepository,
+		settingsRepository,
+		teamsRepository,
+	});
+
+	// ***********************
+	//  Business services
+	// ***********************
+
+	const monitorService = new MonitorService({
+		scheduler: jobScheduler,
+		logger,
+		games,
+		monitorsRepository,
+		checksRepository,
+		geoChecksRepository,
+		monitorStatsRepository,
+		statusPagesRepository,
+		incidentsRepository,
+	});
+
+	const maintenanceWindowService = new MaintenanceWindowService({
+		monitorsRepository,
+		maintenanceWindowsRepository,
+		jobsRepository,
+		scheduler: jobScheduler,
+	});
+
+	const inviteService = new InviteService({
+		invitesRepository,
+		settingsService,
+		emailService,
+	});
+
+	const statusPageService = new StatusPageService(statusPagesRepository, settingsService, monitorsRepository);
+	const tagsService = new TagsService(tagsRepository, monitorsRepository);
+	const diagnosticService = new DiagnosticService(db);
+
+	return {
+		...shared,
+		worker: jobScheduler,
+		userService,
+		monitorService,
+		maintenanceWindowService,
+		inviteService,
+		statusPageService,
+		tagsService,
+		diagnosticService,
+	};
+};

server/src/config/services.shared.ts

@@ -1,136 +1,90 @@
 import { Mongoose } from "mongoose";
 import { hostname } from "node:os";
 import { randomUUID } from "node:crypto";
-import MongoDB from "../db/db.mongo.js";
-import { IDb } from "@/db/db.interface.js";
-import { EnvConfig, ISettingsService, SettingsService } from "@/domain/app-settings/app-settings.service.js";
-import { CheckService, ICheckService } from "@/domain/checks/check.service.js";
-import { DiagnosticService, IDiagnosticService } from "@/domain/diagnostics/diagnostic.service.js";
-import { GeoChecksService, IGeoChecksService } from "@/domain/geo-checks/geo-check.service.js";
-import { IIncidentService, IncidentService } from "@/domain/incidents/incident.service.js";
-import { IInviteService, InviteService } from "@/domain/invites/invite.service.js";
-import { IMaintenanceWindowService, MaintenanceWindowService } from "@/domain/maintenance-windows/maintenance-window.service.js";
-import { IMonitorService, MonitorService } from "@/domain/monitors/monitor.service.js";
-import { INotificationMessageBuilder, NotificationMessageBuilder } from "@/domain/notifications/notification.message-builder.js";
-import { INotificationsService, NotificationsService } from "@/domain/notifications/notification.service.js";
-import { DiscordProvider } from "@/domain/notifications/providers/discord.js";
-import { EmailProvider } from "@/domain/notifications/providers/email.js";
-import { MatrixProvider } from "@/domain/notifications/providers/matrix.js";
-import { NtfyProvider } from "@/domain/notifications/providers/ntfy.js";
-import { PagerDutyProvider } from "@/domain/notifications/providers/pagerduty.js";
-import { PushoverProvider } from "@/domain/notifications/providers/pushover.js";
-import { SlackProvider } from "@/domain/notifications/providers/slack.js";
-import { TeamsProvider } from "@/domain/notifications/providers/teams.js";
-import { TelegramProvider } from "@/domain/notifications/providers/telegram.js";
-import { TwilioProvider } from "@/domain/notifications/providers/twilio.js";
-import { WebhookProvider } from "@/domain/notifications/providers/webhook.js";
-import { IStatusPageService, StatusPageService } from "@/domain/status-pages/status-page.service.js";
-import { ITagsService, TagsService } from "@/domain/tags/tag.service.js";
-import { IUserService, UserService } from "@/domain/users/user.service.js";
-import { BufferService, IBufferService } from "@/service/bufferService.js";
-import { EmailService, IEmailService } from "@/service/emailService.js";
-import { GlobalPingService } from "@/service/globalPingService.js";
-import { WorkerHelper } from "@/worker/worker.helper.js";
-import { IWorker } from "@/worker/worker.interface.js";
-import { INetworkService, NetworkService } from "@/service/networkService.js";
-import { IStatusService, StatusService } from "@/service/statusService.js";
-import { MonitorStatusPolicy } from "@/worker/worker.monitor-status-policy.js";
-
-// Network providers
-import { PingProvider } from "@/service/network/PingProvider.js";
-import { HttpProvider } from "@/service/network/HttpProvider.js";
-import { AdvancedMatcher } from "@/service/network/AdvancedMatcher.js";
-import { PageSpeedProvider } from "@/service/network/PageSpeedProvider.js";
-import { HardwareProvider } from "@/service/network/HardwareProvider.js";
-import { DockerProvider } from "@/service/network/DockerProvider.js";
-import { PortProvider } from "@/service/network/PortProvider.js";
-import { GameProvider } from "@/service/network/GameProvider.js";
-import { GrpcProvider } from "@/service/network/GrpcProvider.js";
-import { WebSocketProvider } from "@/service/network/WebSocketProvider.js";
-import { DNSProvider } from "@/service/network/DNSProvider.js";
-
-// Third-party
-import { Resolver } from "dns/promises";
-import axios from "axios";
-import got from "got";
-import ping from "ping";
-import Docker from "dockerode";
-import net from "net";
 import fs from "fs";
 import path from "path";
 import nodemailer from "nodemailer";
 import pkg from "handlebars";
 const { compile } = pkg;
 import mjml2html from "mjml";
-import jwt from "jsonwebtoken";
-import crypto from "crypto";
-import { games, GameDig } from "gamedig";
-import jmespath from "jmespath";
-import * as grpc from "@grpc/grpc-js";
-import * as protoLoader from "@grpc/proto-loader";
-import WebSocket from "ws";
 
-// Repositories
-import { ISettingsRepository } from "@/domain/app-settings/app-settings-repository.interface.js";
-import MongoSettingsRepository from "@/domain/app-settings/app-settings.repository.mongo.js";
-import { IChecksRepository } from "@/domain/checks/check.repository.interface.js";
-import MongoChecksRepository from "@/domain/checks/check.repository.mongo.js";
-import { IGeoChecksRepository } from "@/domain/geo-checks/geo-check.repository.interface.js";
-import MongoGeoChecksRepository from "@/domain/geo-checks/geo-check.repository.mongo.js";
-import { IIncidentsRepository } from "@/domain/incidents/incident.repository.interface.js";
-import MongoIncidentsRepository from "@/domain/incidents/incident.repository.mongo.js";
-import { IInvitesRepository } from "@/domain/invites/invite.repository.interface.js";
-import MongoInvitesRepository from "@/domain/invites/invite.repository.mongo.js";
-import { IMaintenanceWindowsRepository } from "@/domain/maintenance-windows/maintenance-window.repository.interface.js";
-import MongoMaintenanceWindowsRepository from "@/domain/maintenance-windows/maintenance-window.repository.mongo.js";
-import { IMonitorStatsRepository } from "@/domain/monitor-stats/monitor-stats.repository.interface.js";
-import MongoMonitorStatsRepository from "@/domain/monitor-stats/monitor-stats.repository.mongo.js";
-import { IMonitorsRepository } from "@/domain/monitors/monitor.repository.interface.js";
-import MongoMonitorsRepository from "@/domain/monitors/monitor.repository.mongo.js";
-import { INotificationsRepository } from "@/domain/notifications/notification.repository.interface.js";
-import MongoNotificationsRepository from "@/domain/notifications/notification.repository.mongo.js";
-import { IRecoveryTokensRepository } from "@/domain/recovery-tokens/recovery-token.repository.interface.js";
-import MongoRecoveryTokensRepository from "@/domain/recovery-tokens/recovery-token.repository.mongo.js";
-import { IStatusPagesRepository } from "@/domain/status-pages/status-page-repository.interface.js";
-import MongoStatusPagesRepository from "@/domain/status-pages/status-page-repository.mongo.js";
-import { ITagsRepository } from "@/domain/tags/tag.repository.interface.js";
-import MongoTagsRepository from "@/domain/tags/tag.repository.mongo.js";
-import { ITeamsRepository } from "@/domain/teams/team.repository.interface.js";
-import MongoTeamsRepository from "@/domain/teams/team.repository.model.js";
-import { IUsersRepository } from "@/domain/users/user.repository.interface.js";
-import MongoUsersRepository from "@/domain/users/user.repository.mongo.js";
+import MongoDB from "@/db/db.mongo.js";
+import { IDb } from "@/db/db.interface.js";
+import { ISettingsService, EnvConfig, SettingsService } from "@/domain/app-settings/app-settings.service.js";
+import { ICheckService, CheckService } from "@/domain/checks/check.service.js";
+import { IGeoChecksService, GeoChecksService } from "@/domain/geo-checks/geo-check.service.js";
+import { IIncidentService, IncidentService } from "@/domain/incidents/incident.service.js";
+import { INotificationMessageBuilder, NotificationMessageBuilder } from "@/domain/notifications/notification.message-builder.js";
+import { INotificationsService, NotificationsService } from "@/domain/notifications/notification.service.js";
+import { IEmailService, EmailService } from "@/service/emailService.js";
+import { GlobalPingService } from "@/service/globalPingService.js";
 import { ILogger } from "@/utils/logger.js";
-import { NotificationReactor } from "@/worker/reactors/reactor.notification.js";
-import { ReactorDispatcher } from "@/worker/reactors/reactor.dispatcher.js";
-import { IncidentReactor } from "@/worker/reactors/reactor.incident.js";
-import { CheckPipeline, GeoChecksPipeline } from "@/worker/worker.check-pipeline.js";
-import { CheckProducer } from "@/worker/worker.check-producer.js";
-import { CheckEvaluator } from "@/worker/worker.check-evaluator.js";
-import { DBQueueWorker } from "@/worker/worker.db-queue.js";
-import MongoJobsRepository from "@/domain/jobs/job.repository.mongo.js";
-import MongoQueueWorkersRepository from "@/domain/queue-workers/queue-worker.repository.mongo.js";
 
-export type InitializedServices = {
-	settingsService: ISettingsService;
+// Notification providers
+import { WebhookProvider } from "@/domain/notifications/providers/webhook.js";
+import { SlackProvider } from "@/domain/notifications/providers/slack.js";
+import { EmailProvider } from "@/domain/notifications/providers/email.js";
+import { DiscordProvider } from "@/domain/notifications/providers/discord.js";
+import { PagerDutyProvider } from "@/domain/notifications/providers/pagerduty.js";
+import { MatrixProvider } from "@/domain/notifications/providers/matrix.js";
+import { TeamsProvider } from "@/domain/notifications/providers/teams.js";
+import { TelegramProvider } from "@/domain/notifications/providers/telegram.js";
+import { PushoverProvider } from "@/domain/notifications/providers/pushover.js";
+import { TwilioProvider } from "@/domain/notifications/providers/twilio.js";
+import { NtfyProvider } from "@/domain/notifications/providers/ntfy.js";
+
+// Repository interfaces
+import { ISettingsRepository } from "@/domain/app-settings/app-settings-repository.interface.js";
+import { IChecksRepository } from "@/domain/checks/check.repository.interface.js";
+import { IGeoChecksRepository } from "@/domain/geo-checks/geo-check.repository.interface.js";
+import { IIncidentsRepository } from "@/domain/incidents/incident.repository.interface.js";
+import { IInvitesRepository } from "@/domain/invites/invite.repository.interface.js";
+import { IJobsRepository } from "@/domain/jobs/job.repository.interface.js";
+import { IMaintenanceWindowsRepository } from "@/domain/maintenance-windows/maintenance-window.repository.interface.js";
+import { IMonitorStatsRepository } from "@/domain/monitor-stats/monitor-stats.repository.interface.js";
+import { IMonitorsRepository } from "@/domain/monitors/monitor.repository.interface.js";
+import { INotificationsRepository } from "@/domain/notifications/notification.repository.interface.js";
+import { IQueueWorkersRepository } from "@/domain/queue-workers/queue-worker.repository.interface.js";
+import { IRecoveryTokensRepository } from "@/domain/recovery-tokens/recovery-token.repository.interface.js";
+import { IStatusPagesRepository } from "@/domain/status-pages/status-page-repository.interface.js";
+import { ITagsRepository } from "@/domain/tags/tag.repository.interface.js";
+import { ITeamsRepository } from "@/domain/teams/team.repository.interface.js";
+import { IUsersRepository } from "@/domain/users/user.repository.interface.js";
+
+// Mongo repository implementations
+import MongoSettingsRepository from "@/domain/app-settings/app-settings.repository.mongo.js";
+import MongoChecksRepository from "@/domain/checks/check.repository.mongo.js";
+import MongoGeoChecksRepository from "@/domain/geo-checks/geo-check.repository.mongo.js";
+import MongoIncidentsRepository from "@/domain/incidents/incident.repository.mongo.js";
+import MongoInvitesRepository from "@/domain/invites/invite.repository.mongo.js";
+import MongoJobsRepository from "@/domain/jobs/job.repository.mongo.js";
+import MongoMaintenanceWindowsRepository from "@/domain/maintenance-windows/maintenance-window.repository.mongo.js";
+import MongoMonitorStatsRepository from "@/domain/monitor-stats/monitor-stats.repository.mongo.js";
+import MongoMonitorsRepository from "@/domain/monitors/monitor.repository.mongo.js";
+import MongoNotificationsRepository from "@/domain/notifications/notification.repository.mongo.js";
+import MongoQueueWorkersRepository from "@/domain/queue-workers/queue-worker.repository.mongo.js";
+import MongoRecoveryTokensRepository from "@/domain/recovery-tokens/recovery-token.repository.mongo.js";
+import MongoStatusPagesRepository from "@/domain/status-pages/status-page-repository.mongo.js";
+import MongoTagsRepository from "@/domain/tags/tag.repository.mongo.js";
+import MongoTeamsRepository from "@/domain/teams/team.repository.model.js";
+import MongoUsersRepository from "@/domain/users/user.repository.mongo.js";
+
+// Shared infrastructure + business services that both the API and the worker process construct.
+export interface SharedServices {
+	logger: ILogger;
 	db: IDb<Mongoose>;
-	networkService: INetworkService;
+	settingsService: ISettingsService;
 	emailService: IEmailService;
-	bufferService: IBufferService;
-	statusService: IStatusService;
-	worker: IWorker;
-	userService: IUserService;
+	notificationMessageBuilder: INotificationMessageBuilder;
+	incidentService: IIncidentService;
 	checkService: ICheckService;
 	geoChecksService: IGeoChecksService;
-	diagnosticService: IDiagnosticService;
-	inviteService: IInviteService;
-	maintenanceWindowService: IMaintenanceWindowService;
-	monitorService: IMonitorService;
-	incidentService: IIncidentService;
-	logger: ILogger;
 	notificationsService: INotificationsService;
-	tagsService: ITagsService;
-	statusPageService: IStatusPageService;
-	notificationMessageBuilder: INotificationMessageBuilder;
+
+	// Queue identity (one per process; the worker reuses these)
+	workerId: string;
+	jobsRepository: IJobsRepository;
+	queueWorkersRepository: IQueueWorkersRepository;
 
 	// Repositories
 	monitorsRepository: IMonitorsRepository;
@@ -147,9 +101,9 @@ export type InitializedServices = {
 	incidentsRepository: IIncidentsRepository;
 	teamsRepository: ITeamsRepository;
 	maintenanceWindowsRepository: IMaintenanceWindowsRepository;
-};
+}
 
-export const initializeServices = async ({
+export const buildShared = async ({
 	logger,
 	envSettings,
 	settingsService,
@@ -157,69 +111,43 @@ export const initializeServices = async ({
 	logger: ILogger;
 	envSettings: EnvConfig;
 	settingsService: ISettingsService;
-}): Promise<InitializedServices> => {
-	// Create DB
+}): Promise<SharedServices> => {
+	// Shared worker ID
+	const workerId = `${hostname()}:${process.pid}:${randomUUID()}`;
 
+	// Create DB
 	let db: IDb<Mongoose> | null = null;
 	db = new MongoDB(logger, envSettings);
 	await db.connect();
 
+	// Repositories
 	const monitorsRepository = new MongoMonitorsRepository();
 	const checksRepository = new MongoChecksRepository(logger);
+	const incidentsRepository = new MongoIncidentsRepository();
+	const usersRepository = new MongoUsersRepository();
 	const geoChecksRepository = new MongoGeoChecksRepository(logger);
+	const notificationsRepository = new MongoNotificationsRepository();
+	const jobsRepository = new MongoJobsRepository(workerId);
+	const queueWorkersRepository = new MongoQueueWorkersRepository();
 	const monitorStatsRepository = new MongoMonitorStatsRepository();
 	const statusPagesRepository = new MongoStatusPagesRepository();
-	const usersRepository = new MongoUsersRepository();
 	const invitesRepository = new MongoInvitesRepository();
 	const recoveryTokensRepository = new MongoRecoveryTokensRepository();
 	const settingsRepository = new MongoSettingsRepository();
-	const notificationsRepository = new MongoNotificationsRepository();
 	const tagsRepository = new MongoTagsRepository();
-	const incidentsRepository = new MongoIncidentsRepository();
 	const teamsRepository = new MongoTeamsRepository();
 	const maintenanceWindowsRepository = new MongoMaintenanceWindowsRepository();
-	// One identity per process
-	const workerId = `${hostname()}:${process.pid}:${randomUUID()}`;
-	const jobsRepository = new MongoJobsRepository(workerId);
-	const queueWorkersRepository = new MongoQueueWorkersRepository();
 
 	// Inject settings repository into settings service (now that DB is connected)
 	(settingsService as SettingsService).setRepository(settingsRepository);
 
-	// Network providers
-	const pingProvider = new PingProvider(ping);
-	const httpProvider = new HttpProvider(got, new AdvancedMatcher(jmespath));
-	const pageSpeedProvider = new PageSpeedProvider(httpProvider, settingsService, logger);
-	const hardwareProvider = new HardwareProvider(httpProvider);
-	const dockerProvider = new DockerProvider(logger, Docker);
-	const portProvider = new PortProvider(net);
-	const gameProvider = new GameProvider(logger, GameDig);
-	const grpcProvider = new GrpcProvider(grpc, protoLoader);
-	const webSocketProvider = new WebSocketProvider(WebSocket);
-	const dnsProvider = new DNSProvider(() => new Resolver());
-
-	const networkService = new NetworkService(axios, logger, [
-		pingProvider,
-		httpProvider,
-		pageSpeedProvider,
-		hardwareProvider,
-		dockerProvider,
-		portProvider,
-		gameProvider,
-		grpcProvider,
-		webSocketProvider,
-		dnsProvider,
-	]);
-	const emailService = new EmailService(settingsService, fs, path, compile, mjml2html, nodemailer, logger);
-
+	// Services
 	const notificationMessageBuilder = new NotificationMessageBuilder();
-
+	const emailService = new EmailService(settingsService, fs, path, compile, mjml2html, nodemailer, logger);
 	const incidentService = new IncidentService(logger, incidentsRepository, monitorsRepository, usersRepository, notificationMessageBuilder);
-
 	const checkService = new CheckService(monitorsRepository, logger, checksRepository);
 
 	const globalPingService = new GlobalPingService(logger);
-
 	const geoChecksService = new GeoChecksService({
 		logger,
 		geoChecksRepository,
@@ -227,11 +155,6 @@ export const initializeServices = async ({
 		monitorsRepository,
 	});
 
-	const bufferService = new BufferService(logger, checkService, geoChecksService, settingsService, jobsRepository);
-
-	const statusService = new StatusService(logger, bufferService, monitorsRepository, monitorStatsRepository, checksRepository);
-
-	// Notification providers
 	const webhookProvider = new WebhookProvider(logger);
 	const slackProvider = new SlackProvider(logger);
 	const emailProvider = new EmailProvider(emailService, logger);
@@ -263,121 +186,20 @@ export const initializeServices = async ({
 		notificationMessageBuilder
 	);
 
-	const tagsService = new TagsService(tagsRepository, monitorsRepository);
-
-	const monitorStatusPolicy = new MonitorStatusPolicy();
-	// reactors and dispatcher
-	const notificationReactor = new NotificationReactor(notificationsService);
-	const incidentReactor = new IncidentReactor(incidentService);
-	const reactorDispatcher = new ReactorDispatcher(logger, [notificationReactor, incidentReactor]);
-
-	// Check producer/evaluator
-	const checkProducer = new CheckProducer(monitorsRepository, maintenanceWindowsRepository, checkService, networkService, bufferService, logger);
-	const checkEvaluator = new CheckEvaluator(statusService, monitorStatusPolicy);
-
-	// pipelines
-	const checkPipeline = new CheckPipeline(checkProducer, checkEvaluator);
-
-	const geoCheckPipeline = new GeoChecksPipeline(maintenanceWindowsRepository, geoChecksService, bufferService, logger);
-
-	const workerHelper = new WorkerHelper(
+	const sharedServices: SharedServices = {
 		logger,
-		checkService,
-		settingsService,
-		monitorsRepository,
-		jobsRepository,
-		teamsRepository,
-		monitorStatsRepository,
-		checksRepository,
-		incidentsRepository,
-		geoChecksRepository,
-		reactorDispatcher,
-		checkPipeline,
-		geoCheckPipeline
-	);
-
-	const worker = await DBQueueWorker.create(
-		logger,
-		jobsRepository,
-		monitorsRepository,
-		checksRepository,
-		checkService,
-		checkProducer,
-		checkEvaluator,
-		geoCheckPipeline,
-		reactorDispatcher,
-		workerHelper,
-		queueWorkersRepository,
-		envSettings.queueMode,
-		envSettings.queuePrimaryProcesses,
-		workerId
-	);
-
-	// Business services
-	const userService = new UserService({
-		crypto,
-		emailService,
-		settingsService,
-		logger,
-		jwt,
-		worker,
-		monitorsRepository,
-		usersRepository,
-		invitesRepository,
-		recoveryTokensRepository,
-		settingsRepository,
-		teamsRepository,
-	});
-
-	const diagnosticService = new DiagnosticService(db);
-	const inviteService = new InviteService({
-		invitesRepository,
-		settingsService,
-		emailService,
-	});
-	const maintenanceWindowService = new MaintenanceWindowService({
-		monitorsRepository,
-		maintenanceWindowsRepository,
-		jobsRepository,
-	});
-	const monitorService = new MonitorService({
-		worker,
-		logger,
-		games,
-		monitorsRepository,
-		checksRepository,
-		geoChecksRepository,
-		monitorStatsRepository,
-		statusPagesRepository,
-		incidentsRepository,
-	});
-
-	const statusPageService = new StatusPageService(statusPagesRepository, settingsService);
-
-	const services = {
-		settingsService,
 		db,
-		networkService,
+		settingsService,
 		emailService,
-		bufferService,
-		statusService,
-		worker,
-		userService,
+		notificationMessageBuilder,
+		incidentService,
 		checkService,
 		geoChecksService,
-		diagnosticService,
-		inviteService,
-		maintenanceWindowService,
-		monitorService,
-		incidentService,
-		logger,
 		notificationsService,
-		tagsService,
-		statusPageService,
-		notificationMessageBuilder,
-
-		// Repositories
+		workerId,
+		jobsRepository,
 		monitorsRepository,
+		queueWorkersRepository,
 		checksRepository,
 		geoChecksRepository,
 		monitorStatsRepository,
@@ -392,6 +214,5 @@ export const initializeServices = async ({
 		teamsRepository,
 		maintenanceWindowsRepository,
 	};
-
-	return services;
+	return sharedServices;
 };

server/src/config/services.worker.ts

@@ -0,0 +1,154 @@
+import { Resolver } from "dns/promises";
+import axios from "axios";
+import got from "got";
+import ping from "ping";
+import Docker from "dockerode";
+import net from "net";
+import { GameDig } from "gamedig";
+import jmespath from "jmespath";
+import * as grpc from "@grpc/grpc-js";
+import * as protoLoader from "@grpc/proto-loader";
+import WebSocket from "ws";
+import mongoose from "mongoose";
+
+import { EnvConfig } from "@/domain/app-settings/app-settings.service.js";
+import { SharedServices } from "@/config/services.shared.js";
+import { INetworkService, NetworkService } from "@/service/networkService.js";
+import { IBufferService, BufferService } from "@/service/bufferService.js";
+import { IStatusService, StatusService } from "@/service/statusService.js";
+import { IQueueWorker } from "@/worker/worker.interface.js";
+import { MonitorStatusPolicy } from "@/worker/worker.monitor-status-policy.js";
+import { WorkerHelper } from "@/worker/worker.helper.js";
+import { CheckProducer } from "@/worker/worker.check-producer.js";
+import { CheckEvaluator } from "@/worker/worker.check-evaluator.js";
+import { GeoChecksPipeline } from "@/worker/worker.check-pipeline.js";
+import { NotificationReactor } from "@/worker/reactors/reactor.notification.js";
+import { IncidentReactor } from "@/worker/reactors/reactor.incident.js";
+import { ReactorDispatcher } from "@/worker/reactors/reactor.dispatcher.js";
+import { DBQueueWorker } from "@/worker/worker.db-queue.js";
+
+// Network providers
+import { PingProvider } from "@/service/network/PingProvider.js";
+import { HttpProvider } from "@/service/network/HttpProvider.js";
+import { AdvancedMatcher } from "@/service/network/AdvancedMatcher.js";
+import { PageSpeedProvider } from "@/service/network/PageSpeedProvider.js";
+import { HardwareProvider } from "@/service/network/HardwareProvider.js";
+import { DockerProvider } from "@/service/network/DockerProvider.js";
+import { PortProvider } from "@/service/network/PortProvider.js";
+import { GameProvider } from "@/service/network/GameProvider.js";
+import { GrpcProvider } from "@/service/network/GrpcProvider.js";
+import { WebSocketProvider } from "@/service/network/WebSocketProvider.js";
+import { DNSProvider } from "@/service/network/DNSProvider.js";
+export interface WorkerServices {
+	worker: IQueueWorker;
+	networkService: INetworkService;
+	bufferService: IBufferService;
+	statusService: IStatusService;
+}
+
+export const buildWorker = async (shared: SharedServices, envSettings: EnvConfig): Promise<WorkerServices> => {
+	const {
+		logger,
+		settingsService,
+		checkService,
+		geoChecksService,
+		notificationsService,
+		incidentService,
+		workerId,
+		jobsRepository,
+		queueWorkersRepository,
+		monitorsRepository,
+		checksRepository,
+		geoChecksRepository,
+		monitorStatsRepository,
+		incidentsRepository,
+		teamsRepository,
+		maintenanceWindowsRepository,
+	} = shared;
+
+	// ***********************
+	// Network providers
+	// ***********************
+	const pingProvider = new PingProvider(ping);
+	const httpProvider = new HttpProvider(got, new AdvancedMatcher(jmespath));
+	const pageSpeedProvider = new PageSpeedProvider(httpProvider, settingsService, logger);
+	const hardwareProvider = new HardwareProvider(httpProvider);
+	const dockerProvider = new DockerProvider(logger, Docker);
+	const portProvider = new PortProvider(net);
+	const gameProvider = new GameProvider(logger, GameDig);
+	const grpcProvider = new GrpcProvider(grpc, protoLoader);
+	const webSocketProvider = new WebSocketProvider(WebSocket);
+	const dnsProvider = new DNSProvider(() => new Resolver());
+
+	const networkService = new NetworkService(axios, logger, [
+		pingProvider,
+		httpProvider,
+		pageSpeedProvider,
+		hardwareProvider,
+		dockerProvider,
+		portProvider,
+		gameProvider,
+		grpcProvider,
+		webSocketProvider,
+		dnsProvider,
+	]);
+
+	const bufferService = new BufferService(logger, checkService, geoChecksService, settingsService, jobsRepository);
+	const statusService = new StatusService(logger, monitorsRepository, monitorStatsRepository);
+	const monitorStatusPolicy = new MonitorStatusPolicy();
+
+	// ***********************
+	// Reactors and dispatcher
+	// Handles notifications and incidents
+	// ***********************
+
+	const notificationReactor = new NotificationReactor(notificationsService);
+	const incidentReactor = new IncidentReactor(incidentService);
+	const reactorDispatcher = new ReactorDispatcher(logger, [notificationReactor, incidentReactor]);
+
+	// ***********************
+	// Check producer/evaluator
+	// Handles creating and evaluatiog checks
+	// ***********************
+	const checkProducer = new CheckProducer(monitorsRepository, maintenanceWindowsRepository, checkService, networkService, bufferService, logger);
+	const checkEvaluator = new CheckEvaluator(statusService, monitorStatusPolicy);
+	const geoCheckPipeline = new GeoChecksPipeline(maintenanceWindowsRepository, geoChecksService, bufferService, logger);
+
+	// ***********************
+	// Worker
+	// ***********************
+
+	const workerHelper = new WorkerHelper(
+		logger,
+		checkService,
+		settingsService,
+		monitorsRepository,
+		jobsRepository,
+		teamsRepository,
+		monitorStatsRepository,
+		checksRepository,
+		incidentsRepository,
+		geoChecksRepository
+	);
+
+	const worker = await DBQueueWorker.create(
+		logger,
+		() => mongoose.connection.readyState === 1,
+		jobsRepository,
+		monitorsRepository,
+		checksRepository,
+		checkService,
+		bufferService,
+		checkProducer,
+		checkEvaluator,
+		geoCheckPipeline,
+		reactorDispatcher,
+		workerHelper,
+		queueWorkersRepository,
+		envSettings.queueMode,
+		envSettings.queuePrimaryProcesses,
+		workerId
+	);
+
+	return { worker, networkService, bufferService, statusService };
+};

server/src/db/db.mongo.ts

@@ -42,7 +42,7 @@ class MongoDB implements IDb<Mongoose> {
 			// the unique index on MonitorStats.monitorId is enforced, otherwise databases
 			// with stray duplicates (caused by the pre-fix race in updateRunningStats)
 			// will crash at startup when the unique index fails to build.
-			await runMigrations();
+			await runMigrations(this.logger);
 
 			// Sync indexes
 			const models = mongoose.modelNames();

server/src/db/migration/0002_convertChecksToTimeSeries.ts

@@ -1,5 +1,5 @@
 import mongoose from "mongoose";
-import type { Document, AnyBulkWriteOperation } from "mongodb";
+import type { Document } from "mongodb";
 
 const CHECKS_COLLECTION = "checks";
 const BACKUP_COLLECTION = "checks_backup";
@@ -144,7 +144,11 @@ const migrateBackupData = async (backedUp: boolean): Promise<MigrationStats> =>
 
 		stats.totalSource = await source.countDocuments();
 		const cursor = source.find();
-		const operations: AnyBulkWriteOperation<Document>[] = [];
+		// Derive the op type from the exact bulkWrite we call so it matches whichever `mongodb` copy
+		// Mongoose resolves (a fresh Docker/multiarch install nests its own under mongoose/node_modules,
+		// distinct from the top-level one — importing AnyBulkWriteOperation from "mongodb" picks the wrong copy).
+		type BulkOp = Parameters<typeof target.bulkWrite>[0][number];
+		const operations: BulkOp[] = [];
 		const invalidDocs: Document[] = [];
 
 		while (await cursor.hasNext()) {

server/src/db/migration/0003_cleanupDuplicateMonitorStats.ts

@@ -1,12 +1,12 @@
 import { MonitorStatsModel } from "../../domain/monitor-stats/monitor-stats.model.js";
-import { logger } from "@/utils/logger.js";
+import type { ILogger } from "@/utils/logger.js";
 
 /**
  * Cleanup duplicate MonitorStats documents
  * Keeps the most recent document (by updatedAt) for each monitorId
  * and deletes all older duplicates
  */
-export async function cleanupDuplicateMonitorStats(): Promise<void> {
+export async function cleanupDuplicateMonitorStats(logger: ILogger): Promise<void> {
 	const SERVICE_NAME = "Migration:CleanupDuplicateMonitorStats";
 
 	try {

server/src/db/migration/0004_fixInfrastructureThresholds.ts

@@ -1,11 +1,11 @@
 import { MonitorModel } from "../../domain/monitors/monitor.model.js";
-import { logger } from "@/utils/logger.js";
+import type { ILogger } from "@/utils/logger.js";
 
 /**
  * Fix infrastructure monitors that had thresholds incorrectly set to 0 or 5
  * due to the old default value. Updates them to 100 (disabled).
  */
-export async function fixInfrastructureThresholds(): Promise<void> {
+export async function fixInfrastructureThresholds(logger: ILogger): Promise<void> {
 	const SERVICE_NAME = "Migration:FixInfrastructureThresholds";
 
 	try {

server/src/db/migration/0005_migrateStatusPageTypeToArray.ts

@@ -1,8 +1,8 @@
 import mongoose from "mongoose";
-import { logger } from "@/utils/logger.js";
+import type { ILogger } from "@/utils/logger.js";
 import StatusPageModel from "../../domain/status-pages/status-page.model.js";
 
-export async function migrateStatusPageTypeToArray(): Promise<void> {
+export async function migrateStatusPageTypeToArray(logger: ILogger): Promise<void> {
 	const SERVICE_NAME = "Migration:MigrateStatusPageTypeToArray";
 
 	try {

server/src/db/migration/0006_cleanupDuplicateMonitorStatsForUniqueIndex.ts

@@ -1,5 +1,5 @@
 import { MonitorStatsModel } from "../../domain/monitor-stats/monitor-stats.model.js";
-import { logger } from "@/utils/logger.js";
+import type { ILogger } from "@/utils/logger.js";
 
 /**
  * Second-pass dedupe of MonitorStats before the unique index on monitorId is enforced.
@@ -11,7 +11,7 @@ import { logger } from "@/utils/logger.js";
  * Keeps the document with the highest totalChecks for each monitorId (most data) and
  * deletes the rest. Falls back to most recent updatedAt when totalChecks tie.
  */
-export async function cleanupDuplicateMonitorStatsForUniqueIndex(): Promise<void> {
+export async function cleanupDuplicateMonitorStatsForUniqueIndex(logger: ILogger): Promise<void> {
 	const SERVICE_NAME = "Migration:CleanupDuplicateMonitorStatsForUniqueIndex";
 
 	try {

server/src/db/migration/0007_migrateMaintenanceWindowMonitorIdToArray.ts

@@ -1,6 +1,5 @@
 import mongoose from "mongoose";
-import type { AnyBulkWriteOperation, Document } from "mongodb";
-import { logger } from "@/utils/logger.js";
+import type { ILogger } from "@/utils/logger.js";
 import MaintenanceWindowModel from "../../domain/maintenance-windows/maintenance-window.model.js";
 
 type GroupResult = {
@@ -18,7 +17,7 @@ type GroupResult = {
 	monitorIds: mongoose.Types.ObjectId[];
 };
 
-export async function migrateMaintenanceWindowMonitorIdToArray(): Promise<void> {
+export async function migrateMaintenanceWindowMonitorIdToArray(logger: ILogger): Promise<void> {
 	const SERVICE_NAME = "Migration:MigrateMaintenanceWindowMonitorIdToArray";
 
 	try {
@@ -65,7 +64,11 @@ export async function migrateMaintenanceWindowMonitorIdToArray(): Promise<void>
 			return;
 		}
 
-		const bulkOps: AnyBulkWriteOperation<Document>[] = [];
+		// Derive the op type from the exact bulkWrite we call, so it always matches whichever `mongodb`
+		// copy Mongoose resolves (a fresh Docker install nests its own under mongoose/node_modules,
+		// distinct from the top-level one — importing the type from "mongodb" picks the wrong copy).
+		type BulkOp = Parameters<typeof MaintenanceWindowModel.collection.bulkWrite>[0][number];
+		const bulkOps: BulkOp[] = [];
 		let originalDocCount = 0;
 
 		for (const group of groups) {