UI

.vscode/settings.json

@@ -3,5 +3,6 @@
         "messages",
         "src/i18n"
     ],
+    "snyk.advanced.organization": "512ef4a1-6034-4537-a391-9692d282122a",
     "snyk.advanced.autoSelectOrganization": true
 }

Dockerfile

@@ -1,56 +1,43 @@
 # syntax=docker/dockerfile:1
-
-# ============================================
 # Stage 1: Dependencies
-# ============================================
+FROM --platform=$BUILDPLATFORM node:20-alpine AS deps
-FROM --platform=$BUILDPLATFORM node:26-alpine3.24 AS deps
-
 WORKDIR /app
 
-ENV NEXT_TELEMETRY_DISABLED=1
+# Install pnpm
+RUN corepack enable && corepack prepare pnpm@latest --activate
 
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
 
-# Node 25+ images ship without corepack; keep pnpm in sync with "packageManager"
-RUN npm install -g [email protected] \
- && pnpm install --frozen-lockfile
-
-# ============================================
 # Stage 2: Builder
-# ============================================
+FROM --platform=$BUILDPLATFORM node:20-alpine AS builder
-FROM --platform=$BUILDPLATFORM node:26-alpine3.24 AS builder
-
 WORKDIR /app
 
-ENV NEXT_TELEMETRY_DISABLED=1
+# Install pnpm
-
+RUN corepack enable && corepack prepare pnpm@latest --activate
-RUN npm install -g [email protected]
 
 COPY --from=deps /app/node_modules ./node_modules
-
 COPY . .
+ENV NEXT_TELEMETRY_DISABLED=1
 
-RUN pnpm build
+RUN pnpm run build
 
-# ============================================
 # Stage 3: Runner
-# ============================================
+FROM node:20-alpine AS runner
-FROM node:26-alpine3.24 AS runner
-
 WORKDIR /app
 
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
-ENV PORT=3000
-ENV HOSTNAME=0.0.0.0
 
-RUN addgroup -S nodejs -g 1001 \
+RUN addgroup --system --gid 1001 nodejs
- && adduser -S nextjs -u 1001
+RUN adduser --system --uid 1001 nextjs
 
-COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+# Copy only necessary files
+COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 
+# Copy tenant data and message files (not included in standalone bundle)
 COPY --from=builder --chown=nextjs:nodejs /app/data ./data
 COPY --from=builder --chown=nextjs:nodejs /app/messages ./messages
 
@@ -58,4 +45,7 @@ USER nextjs
 
 EXPOSE 3000
 
+ENV PORT=3000
+ENV HOSTNAME="0.0.0.0"
+
 CMD ["node", "server.js"] 

package.json

@@ -2,7 +2,7 @@
   "name": "nini-artgallery",
   "version": "0.1.0",
   "private": true,
-  "packageManager": "pnpm@12.5.1",
+  "packageManager": "pnpm@10.29.3",
   "scripts": {
     "dev": "next dev --turbopack",
     "build": "next build",
@@ -11,35 +11,42 @@
     "lint:fix": "eslint --fix ."
   },
   "dependencies": {
-    "@ai-sdk/react": "^4.0.112",
+    "@ai-sdk/react": "^3.0.87",
     "@heroicons/react": "^2.2.0",
-    "@openrouter/ai-sdk-provider": "^3.1.0",
+    "@openrouter/ai-sdk-provider": "^2.2.3",
     "@types/jsonwebtoken": "^9.0.10",
-    "ai": "^7.0.109",
+    "@types/nodemailer": "^7.0.9",
+    "ai": "^6.0.85",
     "jsonwebtoken": "^9.0.3",
-    "next": "16.3.6",
+    "next": "16.1.6",
-    "next-intl": "^4.14.6",
+    "next-intl": "^4.8.2",
-    "nodemailer": "^10.0.10",
+    "nodemailer": "^8.0.1",
-    "react": "19.3.0",
+    "react": "19.2.4",
-    "react-dom": "19.3.0",
+    "react-dom": "19.2.4",
     "server-only": "^0.0.1",
-    "zod": "^4.6.5"
+    "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@eslint/eslintrc": "^3.3.7",
+    "@eslint/eslintrc": "^3.3.3",
     "@eslint/js": "^10.0.1",
-    "@tailwindcss/postcss": "^4.3.3",
+    "@tailwindcss/postcss": "^4.1.18",
-    "@types/node": "^26.6.2",
+    "@types/node": "^25.2.3",
-    "@types/react": "19.3.0",
+    "@types/react": "19.2.14",
-    "@types/react-dom": "19.3.0",
+    "@types/react-dom": "19.2.3",
-    "@typescript-eslint/eslint-plugin": "^8.70.1",
+    "@typescript-eslint/eslint-plugin": "^8.55.0",
-    "@typescript-eslint/parser": "^8.70.1",
+    "@typescript-eslint/parser": "^8.55.0",
-    "eslint": "^10.11.0",
+    "eslint": "^10.0.0",
-    "eslint-config-next": "16.3.5",
+    "eslint-config-next": "16.1.6",
-    "globals": "^17.12.0",
+    "globals": "^17.3.0",
-    "postcss": "^8.5.28",
+    "postcss": "^8.5.6",
     "postcss-load-config": "^6.0.1",
-    "tailwindcss": "^4.3.3",
+    "tailwindcss": "^4.1.18",
-    "typescript": "^6.0.3"
+    "typescript": "^5.9.3"
+  },
+  "pnpm": {
+    "overrides": {
+      "@types/react": "19.2.14",
+      "@types/react-dom": "19.2.3"
+    }
   }
 }

pnpm-workspace.yaml

@@ -1,21 +1,4 @@
-allowBuilds:
+onlyBuiltDependencies:
-  '@parcel/watcher': true
+  - "@tailwindcss/oxide"
-  '@swc/core': true
+  - sharp
-  sharp: true
+  - unrs-resolver
-  unrs-resolver: true
-# [email protected] fixes GHSA-vcvr-r3jv-pc5j (critical RCE in next/og); these exact-version
-# exclusions only bypass the 24h release-age gate and can be removed after 2026-09-24.
-minimumReleaseAgeExclude:
-  - '@next/[email protected]'
-  - '@next/[email protected]'
-  - '@next/[email protected]'
-  - '@next/[email protected]'
-  - '@next/[email protected]'
-  - '@next/[email protected]'
-  - '@next/[email protected]'
-  - '@next/[email protected]'
-  - '@next/[email protected]'
-  - [email protected]
-overrides:
-  '@types/react': 19.3.0
-  '@types/react-dom': 19.3.0

src/app/api/chat/route.ts

@@ -81,7 +81,7 @@ export async function POST(req: Request) {
 
     const result = streamText({
       model: openrouter("openai/gpt-4o-mini"),
-      instructions:
+      system:
         `You ARE ${artist.name}, the artist whose gallery the visitor is browsing. ` +
         `Always speak in first person. When greeting a visitor or starting a conversation, ` +
         `introduce yourself by name (${artist.name}) so they know who they're talking to.\n\n` +

src/app/api/transcribe/route.ts

@@ -64,13 +64,15 @@ export async function POST(req: Request) {
     // ── Transcribe via OpenRouter audio model ─────────────────────
     const result = await generateText({
       model: openrouter(TRANSCRIPTION_MODEL),
-      // AI SDK v7 rejects system messages inside `messages`; use `instructions`.
+      messages: [
-      instructions:
+        {
+          role: "system",
+          content:
             `Transcribe the following audio exactly in ${languageName}. ` +
             "Return ONLY the transcription text — no preamble, no explanation, no formatting. " +
             "If the audio contains only silence, background noise, or no discernible speech, " +
             "return exactly the string [SILENCE] and nothing else.",
-      messages: [
+        },
         {
           role: "user",
           content: [