JoseDFlorez · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
@@ -26,6 +26,15 @@ jobs:
       - run: pnpm package:skill
       - run: pnpm package:site
       - run: pnpm smoke:artifacts
+      - name: build the GitHub Pages repository prefix
+        run: pnpm build
+        env:
+          NEXT_PUBLIC_BASE_PATH: /${{ github.event.repository.name }}
+      - run: pnpm check:site
+      - name: verify the repository prefix export
+        run: pnpm test:browser
+        env:
+          DBDEP_SITE_URL: http://127.0.0.1:4173/${{ github.event.repository.name }}
   catalog:
     name: catalog (${{ matrix.postgres }})
     runs-on: ubuntu-latest

@@ -26,13 +26,18 @@ jobs:
       - run: pnpm exec playwright install --with-deps chromium
       - run: pnpm test
       - run: pnpm verify:examples
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+        id: pages
       - run: pnpm build
+        env:
+          NEXT_PUBLIC_BASE_PATH: ${{ steps.pages.outputs.base_path }}
       - run: pnpm check:site
       - run: pnpm test:browser
-      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+        env:
+          DBDEP_SITE_URL: http://127.0.0.1:4173${{ steps.pages.outputs.base_path }}
       - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
-          path: site/dist
+          path: site/out
           include-hidden-files: true
   deploy:
     needs: build

@@ -32,5 +32,7 @@ coverage/
 test-results/
 playwright-report/
 site/dist/
+.next/
+site/out/
 site/public/demos/
 site/public/demo-manifest.json
@@ -25,7 +25,7 @@ pnpm test:browser
 pnpm audit --audit-level=low
 ```
 
-Build before browser tests; Playwright serves `site/dist` through the local preview. The Node tests run offline and skip live cases without a disposable fixture DSN. Run `pnpm test:live` when PostgreSQL tools are available. This creates, stops and removes its own loopback cluster; supply `--pg-bin <directory>` through `pnpm test:live --pg-bin <directory>` if needed. CI has separate disposable PostgreSQL services.
+Build before browser tests; Playwright serves the Next.js static export in `site/out` through the local preview. CI also rebuilds and tests under the repository's Pages path. See [the Pages guide](docs/github-pages.md) to reproduce that check locally. The Node tests run offline and skip live cases without a disposable fixture DSN. Run `pnpm test:live` when PostgreSQL tools are available. This creates, stops and removes its own loopback cluster; supply `--pg-bin <directory>` through `pnpm test:live --pg-bin <directory>` if needed. CI has separate disposable PostgreSQL services.
 
 Use `pnpm exec prettier --check` with the files you changed. Describe checks actually performed, skipped prerequisites, and unresolved limits. Do not treat local receipts or configured workflows as proof that remote CI passed.
 
@@ -116,3 +116,5 @@ Follow [SemVer](https://semver.org/) and [docs/releases.md](docs/releases.md). U
 Complete relevant checks and artifact/hash comparisons on final `main` before creating an annotated `v<version>` tag. Never move or replace an existing release tag. Local commit/tag creation, remote push, GitHub release assets, npm publication and Pages deployment are distinct actions; perform publication only when authorized.
 
 The [Pages workflow](.github/workflows/pages.yml) is manual-only. Review the curated public contents before running it, and follow [Pages setup](docs/github-pages.md). CI action references are pinned to commit SHAs; retain least-privilege permissions when changing workflows.
+
+Dependency upgrades are maintainer-initiated pull requests. This repository has no Dependabot update configuration or automatic security-fix PRs. Keep the frozen lockfile, install-script restrictions and vulnerability audit. Review proposed upgrades and combine related changes into one pull request.
@@ -2,7 +2,7 @@
 
 A PostgreSQL dependency and migration-review skill for AI coding agents, with an independent Node.js toolkit. Inspect a schema, trace downstream consumers, and review a proposed change using evidence from SQL files or supplied catalog snapshots. The toolkit never applies migrations.
 
-The versioned `*.dbdep.json` model is the source of truth for validation, findings, interactive HTML, Markdown, Mermaid and DOT. Its canonical contract is **1.0.0**. The current hardening work targets local **v0.3.2**; remote installation receives these changes after they are pushed. Local checks do not establish a published release, deployed website, or passing remote CI.
+The versioned `*.dbdep.json` model is the source of truth for validation, findings, interactive HTML, Markdown, Mermaid and DOT. Its canonical contract is **1.0.0**. The current package version is **v0.3.2**. Installing from the repository uses its current `main` source; release tags remain immutable. Local checks do not establish a deployed website or passing remote CI.
 
 ## What it does
 
@@ -141,14 +141,14 @@ Screenshots illustrate presentation. Tests and source evidence establish graph b
 
 ## Website and GitHub Pages
 
-The separate [React/Vite website](site/README.md) has bilingual documentation at `/#/docs`, source-backed examples, and links to full standalone reports. It has no upload flow or database connection.
+The separate [Next.js website](site/README.md) exports the home page and bilingual documentation at `/docs/` as static HTML. It retains source-backed examples and links to full standalone reports. It has no upload flow or database connection.
 
 ```sh
 pnpm build
 pnpm preview
 ```
 
-Open the localhost URL printed by Vite. GitHub Pages deployment is a manual workflow after review and publication; it publishes `site/dist`. Curated examples and copied documentation become public. Local `out/`, `tmp/` and evaluation directories are not deployed. Follow the [Pages setup and deployment guide](docs/github-pages.md). No live deployment is claimed here.
+Open the localhost URL printed by the preview. GitHub Pages deployment is a manual workflow after review and publication; it publishes `site/out`. The build uses the configured Pages base path, including a repository subdirectory. Existing `/#/docs` bookmarks redirect after JavaScript loads. Curated examples and copied documentation become public. Local `out/`, `tmp/` and evaluation directories are not deployed. Follow the [Pages setup and deployment guide](docs/github-pages.md). No live deployment is claimed here.
 
 ## Repository layout
 
@@ -162,7 +162,7 @@ Open the localhost URL printed by Vite. GitHub Pages deployment is a manual work
 | `assets/viewer/`                        | Offline report viewer and embedded licensed fonts                                     |
 | `examples/`                             | Curated inputs, authentic sanitized capture and generated reports                     |
 | `tests/`                                | Node, browser and isolated live regressions                                           |
-| `site/`                                 | Separate React/Vite website, documentation and license notices                        |
+| `site/`                                 | Next.js static website, documentation and license notices                             |
 | `evals/`, `docs/`                       | Frozen evaluation evidence, validation, security audit and maintenance guides         |
 
 ## Known limitations

@@ -1,6 +1,6 @@
 # GitHub Pages
 
-The website is a static React/Vite application. GitHub Pages publishes the built `site/dist` directory through the repository's [manual Pages workflow](../.github/workflows/pages.yml). Local builds and release archives do not deploy it. No public deployment is claimed for the pending v0.3.2 work.
+The website uses Next.js App Router with a static export. GitHub Pages publishes the built `site/out` directory through the repository's [manual Pages workflow](../.github/workflows/pages.yml). Local builds and release archives do not deploy it. No public deployment is claimed here.
 
 ## Repository setup
 
@@ -26,7 +26,7 @@ pnpm check:site
 pnpm preview
 ```
 
-Open the local Vite URL, the documentation at `/#/docs`, and all three standalone example reports. Check asset loading, English/Spanish controls, keyboard navigation and report JSON/SVG exports. Browser verification needs Chromium:
+Open the local preview URL, the documentation at `/docs/`, and all three standalone example reports. Check asset loading, English/Spanish controls, keyboard navigation and report JSON/SVG exports. Browser verification needs Chromium:
 
 ```sh
 pnpm exec playwright install chromium
@@ -37,18 +37,35 @@ pnpm test:browser
 
 ## Repository-path routing
 
-`site/vite.config.ts` uses `base: "./"`, so generated asset links resolve relative to the repository's Pages directory. Application documentation uses hash routes, including `/#/docs`, which support direct links and reloads without server-side route rewrites. Keep both behaviors when changing routing or asset URLs. [Vite's deployment guide](https://vite.dev/guide/static-deploy.html#github-pages) explains the relationship between the asset base and hosting path.
+`site/next.config.mjs` uses `output: "export"` and `trailingSlash: true`. Each documentation route has an `index.html`, so direct links and reloads need no server rewrite. The workflow runs `configure-pages` before building and passes its `base_path` to `NEXT_PUBLIC_BASE_PATH`. Next.js prefixes internal links and runtime bundles; the site's asset utility prefixes report and license URLs. The base path is fixed at build time. See Next.js's [static export guide](https://nextjs.org/docs/app/guides/static-exports) and [basePath reference](https://nextjs.org/docs/app/api-reference/config/next-config-js/basePath).
 
 For a project site, a documentation URL has this shape:
 
 ```text
-https://<owner>.github.io/<repository>/#/docs
+https://<owner>.github.io/<repository>/docs/
 ```
 
-Use the deployment environment's actual URL; a configured workflow or local preview does not establish that URL is live.
+Existing `/#/docs` bookmarks redirect to the new routes after JavaScript loads. English content is present in the exported HTML; translation, saved preferences and interactive controls require JavaScript. A custom domain or account site can use an empty base path.
+
+To reproduce the project path on PowerShell:
+
+```powershell
+$env:NEXT_PUBLIC_BASE_PATH = '/Database-Dependency-Migration-Visualizer'
+pnpm build
+Remove-Item Env:NEXT_PUBLIC_BASE_PATH
+pnpm check:site
+$env:DBDEP_SITE_URL = 'http://127.0.0.1:4173/Database-Dependency-Migration-Visualizer'
+pnpm test:browser
+Remove-Item Env:DBDEP_SITE_URL
+pnpm preview
+```
+
+On macOS/Linux, use `NEXT_PUBLIC_BASE_PATH=/Database-Dependency-Migration-Visualizer pnpm build` and `DBDEP_SITE_URL=http://127.0.0.1:4173/Database-Dependency-Migration-Visualizer pnpm test:browser`.
+
+The preview reads the built base path, serves directory indexes and returns a real HTTP 404 for missing files. It binds only to loopback and rejects paths or symlinks outside the export. Use the deployment environment's actual URL after publishing; a local preview does not establish that URL is live. Check direct topic reloads, assets, report exports and the deployed 404 page.
 
 ## Public contents and subsequent deployments
 
-Only `site/dist` is uploaded. The curated examples, their architecture identifiers, generated reports, copied README/SKILL and license notices become publicly accessible. Review these deliberate publication inputs before deployment. Local `out/`, `tmp/`, raw evaluations and the repository's `evals/` directory are not deployment artifacts. The site has no upload endpoint, credentials or live database connection.
+Only `site/out` is uploaded. The curated examples, their architecture identifiers, generated reports, copied README/SKILL and license notices become publicly accessible. The publication validator compares exported pages, route payloads and runtime bundles with their compiled sources and checks public inputs byte-for-byte. It rejects unexpected files, source maps and symlinks. Review these deliberate publication inputs before deployment. Private `site/.next`, root `out/`, `tmp/`, raw evaluations and the repository's `evals/` directory are not deployment artifacts. The site has no upload endpoint, credentials or live database connection.
 
 For an update, review and publish the intended source, rerun the checks, then manually run the workflow for that reviewed `main` revision. Keep release tags immutable. See the [security policy](../SECURITY.md), [audit](security-audit.md), and [release procedure](releases.md).
@@ -0,0 +1,43 @@
+# Next.js migration validation
+
+Validated locally on 2026-10-09 with Windows, Node.js 24.15.0, pnpm 12.10.1, Next.js 16.4.0 and Playwright 1.63.0. This records the webpage migration on `feat/nextjs-static-site`. It does not replace frozen creator evaluations or earlier release receipts.
+
+## Completed changes
+
+The App Router exports the home page, documentation overview and seven topic pages as HTML. Direct topic links and reloads work without a server rewrite. English documentation is readable with JavaScript disabled. Old `#/docs` bookmarks redirect to the new routes when JavaScript runs.
+
+The shared shell retains the existing styles, fonts, ENG/ESP and theme preferences, motion, keyboard behavior and evidence traces. Standalone reports remain generated from the toolkit and open separately. Browser APIs run after mounting; the theme bootstrap restores preferences before paint. Navigation focuses the destination after its content mounts.
+
+Pages builds with its configured base path and uploads only `site/out`. CI validates both a root build and the repository path. The loopback preview serves actual files and HTTP 404 responses, rejects writes and prevents reads through paths or symlinks outside the export. Publication validation rejects unexpected public files, source maps and symlinks, and compares copied inputs and compiled runtime files byte-for-byte.
+
+The finalizer corrects Next.js's [Windows segment filename issue](https://github.com/vercel/next.js/issues/92339). It converts nested filenames to the names requested by the router, preserves bytes, rejects collisions before moving files and leaves Linux filenames unchanged. An explicit browser regression navigates all seven topics and fails on HTTP errors, console errors or hydration errors.
+
+The PR removes `.github/dependabot.yml`. Automatic security-fix PRs were already disabled in repository settings. Dependency auditing and the frozen lockfile remain active. Previous bot commits are preserved. All changes are submitted together in one PR.
+
+## Verification
+
+| Check                                                         | Result                                                                                                             |
+| ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
+| Frozen installation with scripts disabled                     | Passed; lockfile supply-chain policy accepted                                                                      |
+| Node test suite                                               | 144 passed, 2 live cases skipped without a fixture DSN                                                             |
+| Curated artifact regeneration                                 | All 18 outputs matched byte-for-byte                                                                               |
+| Dependency audit                                              | No known advisories reported across 131 dependencies                                                               |
+| Root production build and publication validation              | Passed; 9 content routes, 12 demo files and both copied source documents verified                                  |
+| Root browser suite                                            | 73 passed                                                                                                          |
+| Repository-prefix production build and publication validation | Passed at `/Database-Dependency-Migration-Visualizer`                                                              |
+| Repository-prefix browser suite                               | 73 passed                                                                                                          |
+| Desktop/mobile visual review                                  | Light/dark and English/Spanish captures retained the existing layout; no horizontal overflow in captures           |
+| Distribution smoke in an isolated snapshot                    | npm package and unpacked skill installed outside the checkout; doctor and all three strict demo validations passed |
+| Website archive                                               | Publication inputs and retained licenses verified before packaging                                                 |
+
+Local logs, publication inventories, audit results and captures are under the ignored `out/nextjs-*` paths. Package checks used an isolated snapshot rather than replacing existing `dist/v0.3.2` release artifacts. The normalizer has regressions for byte preservation, idempotence, collisions, Linux output and directory cleanup. Publication tests cover tampered bundles, unexpected payloads, mismatched base paths, source maps and directory links.
+
+## Limits and publication
+
+Remote CI must pass for the final PR revision, including the existing PostgreSQL 14-18 matrix. Local skipped live cases are not proof of that matrix. Main still requires an approval from `JoseDFlorez` or `Juanfrxz`, with a different maintainer approving the author's latest push.
+
+No Pages deployment, new release tag or release asset publication is part of this migration. Verify the deployed URL, direct topic reloads and 404 behavior after manually running Pages on reviewed `main`. Removing the version-update configuration takes effect when this PR merges.
+
+English is the exported default. Spanish translation, saved preferences, bookmark redirects and interactive controls require JavaScript. A base-path change requires rebuilding. The filename correction depends on the pinned Next.js export layout and must be reviewed when upgrading Next.js.
+
+Next.js generates runtime build identifiers, so website exports are not claimed to be byte-identical across independent builds. Toolkit/model/report reproducibility remains covered by deterministic checks. Packaging verification proves the contents of the tested snapshot and preserves earlier release evidence; it does not create a new release.