chore(deps): update All dependencies

chore: remove Sentry integration
fix: remove nonce from style-src to allow unsafe-inline to work
2026-08-01 21:00:32 +00:00 · 2026-08-01 22:12:31 +02:00 · 2026-08-01 22:09:22 +02:00 · 2026-08-01 21:58:13 +02:00 · 2026-08-01 21:52:28 +02:00 · 2026-08-01 21:51:32 +02:00
536 changed files with 27237 additions and 17635 deletions
@@ -1,95 +1,74 @@
-# Connection to the LIVE/COPY emulator MySQL/MariaDB database.
-# The schema is owned by the Arcturus emulator — this app reads/writes data,
-# it does NOT own or migrate the emulator tables. Format:
-DATABASE_URL=mysql://user:[email protected]:3306/atomcms
+# ==============================================================================
+# Epicnextcms — Ultimate Speed & Low-Latency Example Configuration
+# ==============================================================================

-# Optional pool tuning (defaults shown)
-DATABASE_POOL_SIZE=10
-DATABASE_IDLE_TIMEOUT_MS=300000
-DATABASE_CONNECT_TIMEOUT_MS=10000
+# --- DATABASE (High Performance Pooling & Strict Timeouts) ---
+DATABASE_URL="mysql://user:password@localhost:3306/dbname?charset=utf8mb4&connection_limit=150&connect_timeout=5"
+DATABASE_POOL_SIZE=150
+DATABASE_IDLE_TIMEOUT_MS=60000
+DATABASE_CONNECT_TIMEOUT_MS=5000

-# Redis for rate limits, site-settings cache, and JWT invalidation
-# REDIS_URL=redis://localhost:6379
+# --- REDIS (Lightning Fast Caching & Sessions) ---
+REDIS_URL=redis://127.0.0.1:6379?connect_timeout=2
+REDIS_CACHE_TTL_DEFAULT=7200

-# Used by SSO ticket generation ({HOTEL_NAME}-{uuid})
-HOTEL_NAME=Atom
-APP_URL=http://localhost:3000
-# NEXT_PUBLIC_APP_URL=https://yourdomain.com
-AUTH_URL=http://localhost:3000
+# --- CORE RUNTIME & PERFORMANCE FLAGS ---
+NODE_ENV=production
+PORT=3002
+NEXT_TELEMETRY_DISABLED=1
+UV_THREADPOOL_SIZE=16

-# NextAuth — required in production (>=32 chars). Optional in development.
-# Laravel APP_KEY (base64:...) for existing 2FA secrets.
-AUTH_SECRET=
-APP_KEY=
-CONVERT_PASSWORDS=false
+# --- HOTEL & URLS ---
+HOTEL_NAME=EPIC WEB CONTROL
+APP_URL=http://localhost:3002
+NEXT_PUBLIC_APP_URL=http://localhost:3002
+AUTH_URL=http://localhost:3002

-# Password hashing for NEW/upgraded passwords: "bcrypt" (default; 60-char $2y$,
-# fits a varchar(64) users.password) or "argon2id" (~97 chars, needs a wider
-# column). Existing accounts in either format still verify on login.
-PASSWORD_HASH=bcrypt
+# --- IMAGER ---
+IMAGING_UPSTREAM_URL=http://127.0.0.1:3030/imaging
+NEXT_PUBLIC_IMAGER_URL=http://localhost:3002/imaging

-# Filesystem directory the badge uploader (/admin/badges) writes <code>.gif into
-# — the emulator's badge image folder (e.g. .../assets/c_images/album1584).
-# Leave unset to disable badge uploads.
-BADGE_UPLOAD_DIR=
+# --- SECURITY & HASHING ---
+AUTH_SECRET=your-super-secret-auth-key-change-this-min-32-chars
+APP_KEY=base64:your-app-key-here=
+CONVERT_PASSWORDS=true
+ARGON2_MEMORY_KB=65536
+ARGON2_ITERATIONS=4
+ARGON2_PARALLELISM=1

-# Emulator JAR backup job (jobs-worker, runs host-side). When both are set, the
-# worker copies the JAR daily into the backup dir, keeping the newest N.
-EMULATOR_JAR_PATH=
-EMULATOR_BACKUP_DIR=
+# --- PATHS ---
+BADGE_UPLOAD_DIR=./public/assets/images/badges
+EMULATOR_JAR_PATH=./emulator/Arcturus.jar
+EMULATOR_BACKUP_DIR=./backups/emulator
 EMULATOR_BACKUP_KEEP=7
+# Optional mysqldump (jobs-worker daily 03:30). Requires mysqldump on PATH.
+DB_BACKUP_DIR=
+DB_BACKUP_KEEP=7
+# Minutes between repeat health-fail alerts from jobs-worker (default 15).
+HEALTH_ALERT_COOLDOWN_MIN=15

-# RCON link to the Arcturus emulator
+# --- RCON (Low Latency Loop) ---
 RCON_HOST=127.0.0.1
-RCON_PORT=3001
+RCON_PORT=3003
+EMU_PORT=3004
+RCON_TIMEOUT_MS=2000

-# Public imager URL — overrides the default /imaging relative path.
-# Falls back to NEXT_PUBLIC_APP_URL/imaging when only the app URL is set.
-# NEXT_PUBLIC_IMAGER_URL=https://epicnabbo.nl/imaging
-
-# Preferred email provider (HTTP API). Used before SMTP when set.
-RESEND_API_KEY=
-
-# Optional SMTP fallback (password reset / alert emails)
+# --- EMAIL & NOTIFICATIONS ---
 SMTP_HOST=
 SMTP_PORT=587
 SMTP_USER=
 SMTP_PASSWORD=
-SMTP_FROM=
+SMTP_FROM=[email protected]

-# Optional alerting (jobs worker / alert service)
+# --- ALERTING & MONITORING ---
 DISCORD_WEBHOOK_URL=
 ALERT_EMAIL=

-# Optional AI content moderation (user comments / guestbook).
-# When set, posts are checked against the OpenAI Moderations endpoint in
-# addition to the website_wordfilter blocklist. Fail-open if unset/erroring.
+# --- MODERATION & PAYMENTS ---
 OPENAI_API_KEY=
-
-# Optional PayPal top-up (sandbox by default)
 PAYPAL_CLIENT_ID=
 PAYPAL_SECRET=
 PAYPAL_API=https://api-m.sandbox.paypal.com

-# Redis — REQUIRED for production (shared rate limits, site-settings cache,
-# JWT session invalidation cache). Without REDIS_URL the app falls back to
-# in-process memory: limits reset on restart and do not work across instances.
-# Deploy logs a loud warning when this is unset in production.
-REDIS_URL=redis://127.0.0.1:6379
-
-# Logging level (debug | info | warn | error). Defaults to 'info' in production,
-# 'debug' in development. Production logs use structured JSON via pino.
-LOG_LEVEL=info
-
-# Optional Sentry error monitoring (no-op when unset).
-# Server/edge use SENTRY_DSN; browser uses NEXT_PUBLIC_SENTRY_DSN.
-SENTRY_DSN=
-NEXT_PUBLIC_SENTRY_DSN=
-# Optional source-map upload during CI builds (requires SENTRY_AUTH_TOKEN).
-SENTRY_ORG=
-SENTRY_PROJECT=
-SENTRY_AUTH_TOKEN=
-# Optional release tag shown in Sentry (e.g. git sha).
-# Deploy sets APP_VERSION + NEXT_PUBLIC_APP_VERSION from git sha.
-APP_VERSION=
-NEXT_PUBLIC_APP_VERSION=
+# --- LOGGING ---
+LOG_LEVEL=error
@@ -1,11 +1,18 @@
 name: CI
 on:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
  pull_request:
    branches:
      - main
+  workflow_dispatch:

 jobs:
  check:
+    if: startsWith(gitea.ref_name, 'v') == false
    runs-on: shell
    steps:
      - name: Typecheck, lint, and test
@@ -30,12 +37,487 @@ jobs:
          git checkout -f "${REF}"

          export SKIP_ENV_VALIDATION=1
-          export ARGON2_MEMORY_SIZE=1024
-          export ARGON2_ITERATIONS=1
+          export NODE_ENV=test
+          export DATABASE_URL="mysql://test:test@localhost:3306/test?charset=utf8mb4"
+          export AUTH_SECRET="ci-test-secret-key-that-is-long-enough"
+          export REDIS_URL="redis://127.0.0.1:6379?connect_timeout=1"
          export BCRYPT_ROUNDS=4
          pnpm install --frozen-lockfile
-          pnpm prisma:generate
+          # Types come from the committed Drizzle schema (src/db/schema.ts).
          pnpm biome:lint
          pnpm typecheck
          pnpm test
          echo "--- CI checks passed ---"
+
+  deploy:
+    needs: check
+    if: gitea.event_name == 'push' && gitea.ref_name == 'main'
+    runs-on: shell
+    steps:
+      - name: Deploy
+        run: |
+          set -e
+
+          exec 9>/var/tmp/epic_web_control_deploy.lock
+          flock -n 9 || { echo "ERROR: Another deployment is already running! Cancelling."; exit 1; }
+
+          echo "--- Deploying ---"
+
+          LIVE="/var/www/atom-nexst"
+          STAGE=""
+          CUTOVER_STARTED=0
+
+          error_handler() {
+            cd /var/www/atom-nexst 2>/dev/null || cd / || true
+            echo "!!! DEPLOYMENT FAILED on line $1 !!!" >&2
+            # Roll back the build artifact if cutover already moved .next into place.
+            if [ "${CUTOVER_STARTED}" = "1" ] && [ -d "${LIVE}/.next.prev" ]; then
+              echo "Rolling back .next to previous artifact..." >&2
+              rm -rf "${LIVE}/.next" || true
+              mv "${LIVE}/.next.prev" "${LIVE}/.next" || true
+            fi
+            if [ -n "${STAGE}" ] && [ -d "${STAGE}" ]; then
+              git -C "${LIVE}" worktree remove --force "${STAGE}" 2>/dev/null || rm -rf "${STAGE}" || true
+            fi
+            pm2 restart next --update-env 2>/dev/null || pm2 start pnpm --name "next" -- start 2>/dev/null || true
+            exit 1
+          }
+          trap 'error_handler $LINENO' ERR
+
+          docker image prune -f
+
+          DEPLOY_USER="$(id -un)"
+          DEPLOY_GROUP="$(id -gn)"
+          sudo chown -R "${DEPLOY_USER}:${DEPLOY_GROUP}" "${LIVE}" 2>/dev/null || true
+          git config --global --add safe.directory "${LIVE}"
+          git -C "${LIVE}" remote set-url origin /docker/gitea/gitea/git/repositories/remco/epicnext-cms.git/
+
+          echo "Fetching origin/main..."
+          git -C "${LIVE}" fetch origin --prune
+
+          echo "Clearing sticky git index bits (if any)..."
+          STICKY_LIST="$(git -C "${LIVE}" ls-files -v | awk '/^[a-zS]/ {print substr($0,3)}' || true)"
+          if [ -n "${STICKY_LIST}" ]; then
+            echo "${STICKY_LIST}" | while IFS= read -r f; do
+              [ -n "$f" ] || continue
+              git -C "${LIVE}" update-index --no-skip-worktree --no-assume-unchanged -- "$f" 2>/dev/null || true
+            done
+          fi
+
+          export APP_VERSION="$(git -C "${LIVE}" rev-parse --short origin/main)"
+          echo "APP_VERSION=${APP_VERSION}"
+
+          STAGE="/var/tmp/atom-nexst-stage-${APP_VERSION}"
+          echo "Preparing stage worktree at ${STAGE} (live site stays up)..."
+          git -C "${LIVE}" worktree remove --force "${STAGE}" 2>/dev/null || rm -rf "${STAGE}" || true
+          git -C "${LIVE}" worktree add --detach "${STAGE}" origin/main
+
+          # Production env stays on the live tree; stage only needs a symlink for build/migrate.
+          ln -sfn "${LIVE}/.env" "${STAGE}/.env"
+
+          if ! grep -qE '^[[:space:]]*REDIS_URL=.+' "${LIVE}/.env" 2>/dev/null; then
+            echo "WARNING: REDIS_URL is unset in ${LIVE}/.env" >&2
+            echo "WARNING: Rate limits, site-settings cache, and JWT invalidation cache will be in-process only." >&2
+          fi
+
+          cd "${STAGE}"
+          rm -f tsconfig.tsbuildinfo .tsbuildinfo
+          find . -maxdepth 3 -name '*.tsbuildinfo' -delete 2>/dev/null || true
+          rm -rf .output dist .next .next/types .next/dev
+
+          # Restore build cache from last deploy so Turbopack can do
+          # incremental compilation (much faster rebuilds).
+          if [ -d "${LIVE}/.next/cache" ]; then
+            mkdir -p .next/cache
+            cp -r "${LIVE}/.next/cache/." .next/cache/
+          fi
+
+          # Stage shares MySQL with the live app + emulator. Keep the stage pool
+          # tiny so install/test/build cannot exhaust max_connections.
+          export DATABASE_POOL_SIZE="${DEPLOY_DATABASE_POOL_SIZE:-5}"
+          echo "STAGE DATABASE_POOL_SIZE=${DATABASE_POOL_SIZE}"
+
+          pnpm install --frozen-lockfile
+          # Types come from the committed Drizzle schema (src/db/schema.ts).
+          export BCRYPT_ROUNDS=4
+          pnpm typecheck
+          # Validate production env (AUTH_SECRET, DATABASE_URL, …) during build.
+          # Do not set SKIP_ENV_VALIDATION here — that flag is for tests/tooling only.
+          pnpm build
+
+          if [ ! -d "${STAGE}/.next" ]; then
+            echo "ERROR: stage build produced no .next/" >&2
+            exit 1
+          fi
+
+          echo "Cutover: stop service (free DB connections), migrate, swap .next..."
+          CUTOVER_STARTED=1
+          pm2 stop next --kill-timeout 10000 || true
+          # Wait for PM2 to fully exit and MariaDB to reclaim connections.
+          sleep 10
+
+          # Migrate only after live is stopped — avoids ER_CON_COUNT_ERROR while
+          # the old process still holds DATABASE_POOL_SIZE connections.
+          cd "${STAGE}"
+          MIGRATE_OK=0
+          for i in $(seq 1 10); do
+            if pnpm db:migrate; then
+              MIGRATE_OK=1
+              break
+            fi
+            echo "migrate attempt ${i}/10 failed (likely DB connections), retrying..."
+            sleep 5
+          done
+          if [ "${MIGRATE_OK}" != "1" ]; then
+            echo "ERROR: db:migrate failed after retries" >&2
+            exit 1
+          fi
+
+          cd "${LIVE}"
+          echo "Hard reset live tree to origin/main (no nuclear src wipe)..."
+          git reset --hard origin/main
+          # Keep env, uploads, and deps we are about to replace from stage.
+          git clean -fd \
+            -e .env -e .env.local -e .env.production -e .env*.local \
+            -e storage -e public/cache -e node_modules -e .next -e .next.prev
+
+          if ! git diff --exit-code HEAD -- src >/dev/null; then
+            echo "ERROR: live src/ still differs from HEAD after reset:" >&2
+            git diff --stat HEAD -- src >&2 || true
+            exit 1
+          fi
+          echo "Verified live src/ matches HEAD"
+
+          # Save current .next as backup before swapping (kept until health check passes).
+          if [ -d .next ]; then
+            mv .next .next.prev
+          fi
+          mv "${STAGE}/.next" .next
+
+          # Use the exact node_modules the stage build resolved against.
+          rm -rf node_modules
+          mv "${STAGE}/node_modules" node_modules
+
+          sudo chown -R "${DEPLOY_USER}:${DEPLOY_GROUP}" "${LIVE}" 2>/dev/null || true
+
+          # Next.js prefers an already-set process PORT over .env. PM2 may still
+          # have PORT=3000 from an older start, while .env (and nginx) expect 3002.
+          # Export PORT before start so the process matches health checks.
+          DEPLOY_PORT="$(grep -E '^[[:space:]]*PORT=' "${LIVE}/.env" 2>/dev/null | tail -1 | cut -d= -f2- || true)"
+          DEPLOY_PORT="$(printf '%s' "${DEPLOY_PORT}" | tr -cd '0-9')"
+          DEPLOY_PORT="${DEPLOY_PORT:-3002}"
+          export PORT="${DEPLOY_PORT}"
+          echo "PM2/health PORT=${PORT}"
+
+          free_tcp_port() {
+            local port="$1"
+            [ -n "${port}" ] || return 0
+            if command -v fuser >/dev/null 2>&1; then
+              fuser -k "${port}/tcp" 2>/dev/null || true
+            elif command -v lsof >/dev/null 2>&1; then
+              # Portable fallback when fuser is unavailable.
+              lsof -tiTCP:"${port}" -sTCP:LISTEN 2>/dev/null | xargs -r kill -9 2>/dev/null || true
+            fi
+          }
+
+          echo "Starting PM2 with a clean PORT=${PORT} listener..."
+          cd "${LIVE}"
+          # Cutover already stopped the app, but failed deploys can leave orphans
+          # on 3002 (or an old PM2 env still bound to 3000).
+          pm2 stop next --kill-timeout 10000 2>/dev/null || true
+          free_tcp_port "${PORT}"
+          free_tcp_port 3000
+          sleep 1
+          pm2 delete next 2>/dev/null || true
+          PORT="${PORT}" pm2 start pnpm --name next -- start
+          pm2 save 2>/dev/null || true
+
+          sleep 3
+          if ! pm2 show next 2>/dev/null | grep -q 'online'; then
+            echo "ERROR: PM2 next failed to start!" >&2
+            pm2 logs next --lines 20 --nostream >&2 || true
+            exit 1
+          fi
+
+          echo "Waiting for HTTP health check on port ${PORT}..."
+          HEALTH_URL="${DEPLOY_HEALTH_URL:-http://127.0.0.1:${PORT}/api/health}"
+          HEALTH_OK=0
+          for i in $(seq 1 20); do
+            BODY="$(curl -sf --max-time 5 "${HEALTH_URL}" 2>/dev/null || true)"
+            if echo "${BODY}" | grep -q '"database":true'; then
+              echo "Health OK (${HEALTH_URL})"
+              HEALTH_OK=1
+              break
+            fi
+            echo "Health attempt ${i}/20 failed (body=${BODY:-<empty>}), retrying..."
+            sleep 2
+          done
+          if [ "${HEALTH_OK}" != "1" ]; then
+            echo "ERROR: Health check failed after deploy (${HEALTH_URL})" >&2
+            echo "Last body: ${BODY:-<empty>}" >&2
+            echo "Listeners on PORT ${PORT}:" >&2
+            ss -tlnp 2>/dev/null | grep ":${PORT} " >&2 || netstat -tlnp 2>/dev/null | grep ":${PORT} " >&2 || true
+            pm2 env 0 2>/dev/null | grep -E '^PORT=' >&2 || true
+            pm2 logs next --lines 40 --nostream >&2 || true
+            exit 1
+          fi
+
+          echo "Cleaning stage worktree and previous .next backup..."
+          rm -rf "${LIVE}/.next.prev"
+          git -C "${LIVE}" worktree remove --force "${STAGE}" 2>/dev/null || rm -rf "${STAGE}" || true
+          STAGE=""
+
+          echo "--- Deployed successfully ---"
+
+  release:
+    if: startsWith(gitea.ref_name, 'v')
+    runs-on: shell
+    steps:
+      - name: Build and deploy
+        env:
+          VERSION: ${{ gitea.ref_name }}
+        run: |
+          set -e
+          exec 2>&1
+          WORK="$(mktemp -d /var/tmp/epicnext-deploy.XXXXXX)"
+          cleanup() { rm -rf "${WORK}"; }
+          trap cleanup EXIT
+          echo "=== Deploying ${VERSION} ==="
+          git clone --depth 50 \
+            /docker/gitea/gitea/git/repositories/remco/epicnext-cms.git \
+            "${WORK}"
+          cd "${WORK}"
+          git checkout "${VERSION}"
+          export NODE_ENV=production
+          export SKIP_ENV_VALIDATION=1
+          pnpm install --frozen-lockfile
+          # Types come from the committed Drizzle schema (src/db/schema.ts).
+          # Tag releases must apply CMS SQL migrations against the live DB
+          # (same path as push-to-main deploy), using the production .env.
+          LIVE="/var/www/atom-nexst"
+          ln -sfn "${LIVE}/.env" "${WORK}/.env"
+          MIGRATE_OK=0
+          for i in $(seq 1 10); do
+            if pnpm db:migrate; then
+              MIGRATE_OK=1
+              break
+            fi
+            echo "migrate attempt ${i}/10 failed (likely DB connections), retrying..."
+            sleep 5
+          done
+          if [ "${MIGRATE_OK}" != "1" ]; then
+            echo "ERROR: db:migrate failed after retries" >&2
+            exit 1
+          fi
+          pnpm build
+          pm2 restart next --update-env
+          pm2 save
+          echo "=== Deploy complete ==="
+      - name: Create Release
+        env:
+          VERSION: ${{ gitea.ref_name }}
+          GITEA_API: ${{ gitea.api_url }}
+          GITEA_REPO: ${{ gitea.repository }}
+        run: |
+          set -e
+          exec 2>&1
+          BARE="/docker/gitea/gitea/git/repositories/remco/epicnext-cms.git"
+          echo "=== Creating release for ${VERSION} ==="
+
+          PREV_TAG="$(git -C "$BARE" tag --sort=-creatordate | head -2 | tail -1 || echo '')"
+
+          if [ -n "$PREV_TAG" ] && [ "$PREV_TAG" != "$VERSION" ]; then
+            CHANGELOG="$(git -C "$BARE" log --oneline --no-decorate --max-count=50 "${PREV_TAG}..${VERSION}")"
+            [ -z "$CHANGELOG" ] && CHANGELOG="No commit changes since ${PREV_TAG}"
+          else
+            TOTAL="$(git -C "$BARE" rev-list --count "${VERSION}" 2>/dev/null || echo '?')"
+            CHANGELOG="Initial release of EpicNext-CMS (${TOTAL} commits)."
+          fi
+          [ -z "$CHANGELOG" ] && CHANGELOG="Initial release"
+
+          # Pin the other components at their current commits so the release is reproducible.
+          CAT_REF="$(git ls-remote https://gitlab.epicnabbo.nl/remco/Epicnabbo-Catalogus-Updated-Daily.git Beta-3 2>/dev/null | awk '{print $1}')"
+          NITRO_REF="$(git ls-remote https://github.com/duckietm/Nitro-V3.git main 2>/dev/null | awk '{print $1}')"
+          RENDER_REF="$(git ls-remote https://github.com/duckietm/Nitro_Render_V3.git main 2>/dev/null | awk '{print $1}')"
+          EMU_REF="$(git ls-remote https://github.com/duckietm/Polaris-Emulator.git main 2>/dev/null | awk '{print $1}')"
+
+          {
+            echo "# EpicNext-CMS ${VERSION}"
+            echo ""
+            echo "> Modern, high-performance CMS for Habbo hotel emulators — built on Next.js 16, React 19 and Drizzle ORM. Integrates with Polaris / Arcturus Morningstar databases."
+            echo ""
+            echo "## Menu"
+            echo "- [What is EpicNext-CMS?](#what-is-epicnext-cms)"
+            echo "- [System Requirements](#system-requirements)"
+            echo "- [Installation Wizard](#installation-wizard)"
+            echo "- [How it is used](#how-it-is-used)"
+            echo "- [Changes](#changes)"
+            echo "- [Linked repositories](#linked-repositories)"
+            echo ""
+            echo '<a id="what-is-epicnext-cms"></a>'
+            echo "## What is EpicNext-CMS?"
+            echo ""
+            echo "EpicNext-CMS is a full public-facing hotel website plus an administrative panel. It features NextAuth authentication (bcrypt with MD5 upgrade), real-time RCON communication with the emulator, Server-Sent Events for live radio, smooth page transitions and extensive extensibility. Full documentation: https://gitlab.epicnabbo.nl/remco/EpicNext-Cms/src/branch/main/README.md"
+            echo ""
+            echo '<a id="system-requirements"></a>'
+            echo "## System Requirements"
+            echo ""
+            echo "What you need to install before running the CMS:"
+            echo ""
+            echo "| Component | Version | Notes |"
+            echo "| --------- | ------- | ----- |"
+            echo "| Node.js | >= 22 | Required by Next.js 16 |"
+            echo "| pnpm | >= 10.33.4 | Package manager (npm/yarn not supported) |"
+            echo "| MySQL / MariaDB | 8.0+ / 10.6+ | Shared with the emulator |"
+            echo "| Redis | 7.x+ | Optional — caching, rate limiting, SSE |"
+            echo "| Java | 17+ | Only if building the emulator |"
+            echo "| Maven | 3.9+ | Only if building the emulator |"
+            echo ""
+            echo "The CMS shares its database with the Polaris / Arcturus emulator. It only reads/writes emulator-owned tables and never alters them."
+            echo ""
+            echo '<a id="installation-wizard"></a>'
+            echo "## Installation Wizard"
+            echo ""
+            echo "A complete hotel stack = **EpicNext-CMS** (this repo) + **Polaris Emulator** + **Nitro V3 client** + **Catalogus** data. Follow the steps in order."
+            echo ""
+            echo "**Quick links:** [Full setup guide](https://github.com/duckietm/Complete-Retro-on-Ubuntu) · [EpicNext-CMS repo](https://gitlab.epicnabbo.nl/remco/EpicNext-Cms) · [Reference configs in this repo](https://gitlab.epicnabbo.nl/remco/EpicNext-Cms/src/branch/main/setup)"
+            echo ""
+            echo "### 1. Clone & Install the CMS"
+            echo '```bash'
+            echo "git clone https://gitlab.epicnabbo.nl/remco/EpicNext-Cms.git"
+            echo "cd EpicNext-Cms"
+            echo "pnpm install"
+            echo '```'
+            echo ""
+            echo "### 2. Database Setup"
+            echo ""
+            echo "The CMS shares the emulator database. Import the Polaris/Arcturus database first, then create the CMS schema:"
+            echo '```sql'
+            echo "CREATE DATABASE IF NOT EXISTS epicnext_cms CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
+            echo '```'
+            echo ""
+            echo "### 3. Configure Environment"
+            echo '```bash'
+            echo "cp .env.example .env"
+            echo '```'
+            echo ""
+            echo "Edit .env with at minimum: DATABASE_URL, AUTH_SECRET, HOTEL_NAME and APP_URL. See .env.example for RCON, email, Redis, OAuth and PayPal options."
+            echo ""
+            echo "### 4. Run CMS Migrations"
+            echo '```bash'
+            echo "pnpm db:migrate"
+            echo '```'
+            echo ""
+            echo "Creates all CMS-owned tables (website_*, radio_*, acl_*, admin_audit_log). Emulator tables are never touched. Check status with pnpm db:migrate:status. Runtime types come from the committed Drizzle schema (src/db/schema.ts) via '@/lib/db'."
+            echo ""
+            echo "### 5. Polaris Emulator"
+            echo ""
+            echo "Clone and build the emulator (requires Java 17+ and Maven 3.9+):"
+            echo '```bash'
+            echo "git clone https://github.com/duckietm/Polaris-Emulator.git /var/www/emulator"
+            echo "cd /var/www/emulator/Emulator"
+            echo "mvn clean package"
+            echo '```'
+            echo ""
+            echo "Place the built Habbo-*-jar-with-dependencies.jar next to **config.ini** (see [setup/emulator/config.ini](https://gitlab.epicnabbo.nl/remco/EpicNext-Cms/src/branch/main/setup/emulator/config.ini)), then create a systemd unit from [setup/emulator/emulator.service](https://gitlab.epicnabbo.nl/remco/EpicNext-Cms/src/branch/main/setup/emulator/emulator.service) with the [emulator](https://gitlab.epicnabbo.nl/remco/EpicNext-Cms/src/branch/main/setup/emulator/emulator) launcher so it starts on boot. The bundled update-Nitrov3.sh in this repo automates cloning, building and updating the emulator and Nitro — run it any time to pull the latest commits and rebuild:"
+            echo '```bash'
+            echo "./update-Nitrov3.sh"
+            echo '```'
+            echo ""
+            echo "### 6. Nitro V3 & Renderer"
+            echo ""
+            echo "Clone both Nitro repos and build the client:"
+            echo '```bash'
+            echo "git clone https://github.com/duckietm/Nitro_Render_V3.git /var/www/Nitro_Render_V3"
+            echo "git clone https://github.com/duckietm/Nitro-V3.git /var/www/Nitro-V3"
+            echo "cd /var/www/Nitro_Render_V3 && yarn install && yarn link"
+            echo "cd /var/www/Nitro-V3 && yarn install && yarn link \"@nitrots/nitro-renderer\" && yarn build"
+            echo '```'
+            echo ""
+            echo "Copy the reference configs from [setup/nitro/](https://gitlab.epicnabbo.nl/remco/EpicNext-Cms/src/branch/main/setup/nitro) into /var/www/Nitro-V3/public/configuration, keep them as *.json, and replace **MY_DOMAIN** with your domain, API URL and gamedata paths (see the Full setup guide, NitroV3_And_Emulator.md)."
+            echo ""
+            echo "### 7. Catalogus (catalog & gamedata)"
+            echo ""
+            echo "Catalogus holds the daily-updated catalog/gamedata. Clone the Beta-3 branch alongside the other components:"
+            echo '```bash'
+            echo "git clone -b Beta-3 https://gitlab.epicnabbo.nl/remco/Epicnabbo-Catalogus-Updated-Daily.git /var/www/catalogus"
+            echo '```'
+            echo ""
+            echo "### 8. Build & Start the CMS"
+            echo '```bash'
+            echo "# Development (hot reload)"
+            echo "pnpm dev"
+            echo ""
+            echo "# Production"
+            echo "pnpm build && pnpm start"
+            echo '```'
+            echo ""
+            echo "Open http://localhost:3000 in your browser."
+            echo ""
+            echo "### 9. First Login"
+            echo ""
+            echo "1. Register at /register, or log in with an existing emulator account."
+            echo "2. Grant admin access: UPDATE users SET rank = 7 WHERE username = 'yourname';"
+            echo "3. Visit /admin and configure your hotel via Admin -> CMS Settings."
+            echo ""
+            echo '<a id="how-it-is-used"></a>'
+            echo "## How it is used"
+            echo ""
+            echo "- Public site: browse the hotel, news, radio and the Nitro client at /client."
+            echo "- Admin panel: /admin for CMS settings, theming (12 presets), users, radio and more."
+            echo "- Background jobs: run pnpm jobs:worker for daily backups and cleanup."
+            echo "- Optional: Cloudflare Turnstile / reCAPTCHA, OpenAI moderation and email/PayPal via .env."
+            echo ""
+            echo '<a id="changes"></a>'
+            echo "## Changes"
+            echo '```'
+            echo "${CHANGELOG}"
+            echo '```'
+            echo ""
+            echo '<a id="linked-repositories"></a>'
+            echo "## Linked repositories (exact commits)"
+            echo ""
+            echo "The game components below are pinned to the exact commits used by this release and are deployed alongside the CMS:"
+            echo ""
+            echo "| Component | Repository | Commit |"
+            echo "|-----------|------------|--------|"
+            echo "| Catalogus | https://gitlab.epicnabbo.nl/remco/Epicnabbo-Catalogus-Updated-Daily | ${CAT_REF:-?} |"
+            echo "| Nitro-V3 | https://github.com/duckietm/Nitro-V3 | ${NITRO_REF:-?} |"
+            echo "| Nitro-Render-V3 | https://github.com/duckietm/Nitro_Render_V3 | ${RENDER_REF:-?} |"
+            echo "| Polaris Emulator | https://github.com/duckietm/Polaris-Emulator | ${EMU_REF:-?} |"
+            echo ""
+            echo "**[Nitro-V3](https://github.com/duckietm/Nitro-V3)** · **[Nitro Renderer](https://github.com/duckietm/Nitro_Render_V3)** · **[Polaris Emulator](https://github.com/duckietm/Polaris-Emulator)** · **[Catalogus](https://gitlab.epicnabbo.nl/remco/Epicnabbo-Catalogus-Updated-Daily)**"
+            echo ""
+            echo "---"
+            echo "*Automated release from Gitea Actions*"
+          } > /tmp/release-body.md
+
+          PAYLOAD="$(jq -Rs --arg v "${VERSION}" '{tag_name: $v, name: $v, body: ., draft: false, prerelease: false}' < /tmp/release-body.md)"
+
+          TOKEN="${GITEA_TOKEN:-${{ secrets.GITEA_TOKEN }}}"
+
+          HTTP_CODE="$(curl -s -w '%{http_code}' -o /tmp/release-resp.json \
+            -X POST "${GITEA_API}/repos/${GITEA_REPO}/releases" \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$PAYLOAD")"
+
+          if [ "${HTTP_CODE}" = "409" ]; then
+            RELEASES="$(curl -sf "${GITEA_API}/repos/${GITEA_REPO}/releases" \
+              -H "Authorization: token ${TOKEN}")"
+            REL_ID="$(echo "$RELEASES" | jq -r ".[] | select(.tag_name==\"${VERSION}\") | .id")"
+            HTTP_CODE="$(curl -s -w '%{http_code}' -o /tmp/release-resp.json \
+              -X PATCH "${GITEA_API}/repos/${GITEA_REPO}/releases/${REL_ID}" \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "$PAYLOAD")"
+          fi
+
+          if [ "${HTTP_CODE:-0}" -ge 200 ] && [ "${HTTP_CODE:-0}" -lt 300 ]; then
+            echo "SUCCESS: Release ${VERSION} created/updated"
+            cat /tmp/release-resp.json | jq -r '.html_url // .id'
+          else
+            echo "FAILED HTTP ${HTTP_CODE}"
+            cat /tmp/release-resp.json
+            exit 1
+          fi
@@ -1,417 +0,0 @@
-name: Deploy
-on:
-  push:
-    branches:
-      - main
-    tags:
-      - "v*"
-jobs:
-  release:
-    if: startsWith(gitea.ref_name, 'v')
-    runs-on: shell
-    steps:
-      - name: Create Release
-        env:
-          VERSION: ${{ gitea.ref_name }}
-          GITEA_API: ${{ gitea.api_url }}
-          GITEA_REPO: ${{ gitea.repository }}
-        run: |
-          set -e
-          exec 2>&1
-          BARE="/docker/gitea/gitea/git/repositories/remco/epicnext-cms.git"
-          echo "=== Creating release for ${VERSION} ==="
-
-          PREV_TAG="$(git -C "$BARE" tag --sort=-creatordate | head -2 | tail -1 || echo '')"
-
-          if [ -n "$PREV_TAG" ] && [ "$PREV_TAG" != "$VERSION" ]; then
-            CHANGELOG="$(git -C "$BARE" log --oneline --no-decorate --max-count=50 "${PREV_TAG}..${VERSION}")"
-            [ -z "$CHANGELOG" ] && CHANGELOG="No commit changes since ${PREV_TAG}"
-          else
-            TOTAL="$(git -C "$BARE" rev-list --count "${VERSION}" 2>/dev/null || echo '?')"
-            CHANGELOG="Initial release of EpicNext-CMS (${TOTAL} commits)."
-          fi
-          [ -z "$CHANGELOG" ] && CHANGELOG="Initial release"
-
-          # Pin the other components at their current commits so the release is reproducible.
-          CAT_REF="$(git ls-remote https://gitlab.epicnabbo.nl/remco/Epicnabbo-Catalogus-Updated-Daily.git Beta-3 2>/dev/null | awk '{print $1}')"
-          NITRO_REF="$(git ls-remote https://github.com/duckietm/Nitro-V3.git main 2>/dev/null | awk '{print $1}')"
-          RENDER_REF="$(git ls-remote https://github.com/duckietm/Nitro_Render_V3.git main 2>/dev/null | awk '{print $1}')"
-          EMU_REF="$(git ls-remote https://github.com/duckietm/Polaris-Emulator.git main 2>/dev/null | awk '{print $1}')"
-
-          {
-            echo "# EpicNext-CMS ${VERSION}"
-            echo ""
-            echo "> Modern, high-performance CMS for Habbo hotel emulators — built on Next.js 16, React 19 and Prisma 7. Integrates with Polaris / Arcturus Morningstar databases."
-            echo ""
-            echo "## Menu"
-            echo "- [What is EpicNext-CMS?](#what-is-epicnext-cms)"
-            echo "- [System Requirements](#system-requirements)"
-            echo "- [Installation Wizard](#installation-wizard)"
-            echo "- [How it is used](#how-it-is-used)"
-            echo "- [Changes](#changes)"
-            echo "- [Linked repositories](#linked-repositories)"
-            echo ""
-            echo '<a id="what-is-epicnext-cms"></a>'
-            echo "## What is EpicNext-CMS?"
-            echo ""
-            echo "EpicNext-CMS is a full public-facing hotel website plus an administrative panel. It features NextAuth authentication (argon2id/bcrypt with MD5 upgrade), real-time RCON communication with the emulator, Server-Sent Events for live radio, smooth page transitions and extensive extensibility. Full documentation: https://gitlab.epicnabbo.nl/remco/EpicNext-Cms/src/branch/main/README.md"
-            echo ""
-            echo '<a id="system-requirements"></a>'
-            echo "## System Requirements"
-            echo ""
-            echo "What you need to install before running the CMS:"
-            echo ""
-            echo "| Component | Version | Notes |"
-            echo "| --------- | ------- | ----- |"
-            echo "| Node.js | >= 22 | Required by Next.js 16 |"
-            echo "| pnpm | >= 10.33.4 | Package manager (npm/yarn not supported) |"
-            echo "| MySQL / MariaDB | 8.0+ / 10.6+ | Shared with the emulator |"
-            echo "| Redis | 7.x+ | Optional — caching, rate limiting, SSE |"
-            echo "| Java | 17+ | Only if building the emulator |"
-            echo "| Maven | 3.9+ | Only if building the emulator |"
-            echo ""
-            echo "The CMS shares its database with the Polaris / Arcturus emulator. It only reads/writes emulator-owned tables and never alters them."
-            echo ""
-            echo '<a id="installation-wizard"></a>'
-            echo "## Installation Wizard"
-            echo ""
-            echo "A complete hotel stack = **EpicNext-CMS** (this repo) + **Polaris Emulator** + **Nitro V3 client** + **Catalogus** data. Follow the steps in order."
-            echo ""
-            echo "**Quick links:** [Full setup guide](https://github.com/duckietm/Complete-Retro-on-Ubuntu) · [EpicNext-CMS repo](https://gitlab.epicnabbo.nl/remco/EpicNext-Cms) · [Reference configs in this repo](https://gitlab.epicnabbo.nl/remco/EpicNext-Cms/src/branch/main/setup)"
-            echo ""
-            echo "### 1. Clone & Install the CMS"
-            echo '```bash'
-            echo "git clone https://gitlab.epicnabbo.nl/remco/EpicNext-Cms.git"
-            echo "cd EpicNext-Cms"
-            echo "pnpm install"
-            echo '```'
-            echo ""
-            echo "### 2. Database Setup"
-            echo ""
-            echo "The CMS shares the emulator database. Import the Polaris/Arcturus database first, then create the CMS schema:"
-            echo '```sql'
-            echo "CREATE DATABASE IF NOT EXISTS epicnext_cms CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
-            echo '```'
-            echo ""
-            echo "### 3. Configure Environment"
-            echo '```bash'
-            echo "cp .env.example .env"
-            echo '```'
-            echo ""
-            echo "Edit .env with at minimum: DATABASE_URL, AUTH_SECRET, HOTEL_NAME and APP_URL. See .env.example for RCON, email, Redis, OAuth and PayPal options."
-            echo ""
-            echo "### 4. Generate Prisma Client"
-            echo '```bash'
-            echo "pnpm prisma:generate"
-            echo '```'
-            echo ""
-            echo "### 5. Run CMS Migrations"
-            echo '```bash'
-            echo "pnpm db:migrate"
-            echo '```'
-            echo ""
-            echo "Creates all CMS-owned tables (website_*, radio_*, acl_*, admin_audit_log). Emulator tables are never touched. Check status with pnpm db:migrate:status."
-            echo ""
-            echo "### 6. Polaris Emulator"
-            echo ""
-            echo "Clone and build the emulator (requires Java 17+ and Maven 3.9+):"
-            echo '```bash'
-            echo "git clone https://github.com/duckietm/Polaris-Emulator.git /var/www/emulator"
-            echo "cd /var/www/emulator/Emulator"
-            echo "mvn clean package"
-            echo '```'
-            echo ""
-            echo "Place the built Habbo-*-jar-with-dependencies.jar next to **config.ini** (see [setup/emulator/config.ini](https://gitlab.epicnabbo.nl/remco/EpicNext-Cms/src/branch/main/setup/emulator/config.ini)), then create a systemd unit from [setup/emulator/emulator.service](https://gitlab.epicnabbo.nl/remco/EpicNext-Cms/src/branch/main/setup/emulator/emulator.service) with the [emulator](https://gitlab.epicnabbo.nl/remco/EpicNext-Cms/src/branch/main/setup/emulator/emulator) launcher so it starts on boot. The bundled update-Nitrov3.sh in this repo automates cloning, building and updating the emulator and Nitro — run it any time to pull the latest commits and rebuild:"
-            echo '```bash'
-            echo "./update-Nitrov3.sh"
-            echo '```'
-            echo ""
-            echo "### 7. Nitro V3 & Renderer"
-            echo ""
-            echo "Clone both Nitro repos and build the client:"
-            echo '```bash'
-            echo "git clone https://github.com/duckietm/Nitro_Render_V3.git /var/www/Nitro_Render_V3"
-            echo "git clone https://github.com/duckietm/Nitro-V3.git /var/www/Nitro-V3"
-            echo "cd /var/www/Nitro_Render_V3 && yarn install && yarn link"
-            echo "cd /var/www/Nitro-V3 && yarn install && yarn link \"@nitrots/nitro-renderer\" && yarn build"
-            echo '```'
-            echo ""
-            echo "Copy the reference configs from [setup/nitro/](https://gitlab.epicnabbo.nl/remco/EpicNext-Cms/src/branch/main/setup/nitro) into /var/www/Nitro-V3/public/configuration, keep them as *.json, and replace **MY_DOMAIN** with your domain, API URL and gamedata paths (see the Full setup guide, NitroV3_And_Emulator.md)."
-            echo ""
-            echo "### 8. Catalogus (catalog & gamedata)"
-            echo ""
-            echo "Catalogus holds the daily-updated catalog/gamedata. Clone the Beta-3 branch alongside the other components:"
-            echo '```bash'
-            echo "git clone -b Beta-3 https://gitlab.epicnabbo.nl/remco/Epicnabbo-Catalogus-Updated-Daily.git /var/www/catalogus"
-            echo '```'
-            echo ""
-            echo "### 9. Build & Start the CMS"
-            echo '```bash'
-            echo "# Development (hot reload)"
-            echo "pnpm dev"
-            echo ""
-            echo "# Production"
-            echo "pnpm build && pnpm start"
-            echo '```'
-            echo ""
-            echo "Open http://localhost:3000 in your browser."
-            echo ""
-            echo "### 10. First Login"
-            echo ""
-            echo "1. Register at /register, or log in with an existing emulator account."
-            echo "2. Grant admin access: UPDATE users SET rank = 7 WHERE username = 'yourname';"
-            echo "3. Visit /admin and configure your hotel via Admin -> CMS Settings."
-            echo ""
-            echo '<a id="how-it-is-used"></a>'
-            echo "## How it is used"
-            echo ""
-            echo "- Public site: browse the hotel, news, radio and the Nitro client at /client."
-            echo "- Admin panel: /admin for CMS settings, theming (12 presets), users, radio and more."
-            echo "- Background jobs: run pnpm jobs:worker for daily backups and cleanup."
-            echo "- Optional: Cloudflare Turnstile / reCAPTCHA, OpenAI moderation and email/PayPal via .env."
-            echo ""
-            echo '<a id="changes"></a>'
-            echo "## Changes"
-            echo '```'
-            echo "${CHANGELOG}"
-            echo '```'
-            echo ""
-            echo '<a id="linked-repositories"></a>'
-            echo "## Linked repositories (exact commits)"
-            echo ""
-            echo "The game components below are pinned to the exact commits used by this release and are deployed alongside the CMS:"
-            echo ""
-            echo "| Component | Repository | Commit |"
-            echo "|-----------|------------|--------|"
-            echo "| Catalogus | https://gitlab.epicnabbo.nl/remco/Epicnabbo-Catalogus-Updated-Daily | ${CAT_REF:-?} |"
-            echo "| Nitro-V3 | https://github.com/duckietm/Nitro-V3 | ${NITRO_REF:-?} |"
-            echo "| Nitro-Render-V3 | https://github.com/duckietm/Nitro_Render_V3 | ${RENDER_REF:-?} |"
-            echo "| Polaris Emulator | https://github.com/duckietm/Polaris-Emulator | ${EMU_REF:-?} |"
-            echo ""
-            echo "**[Nitro-V3](https://github.com/duckietm/Nitro-V3)** · **[Nitro Renderer](https://github.com/duckietm/Nitro_Render_V3)** · **[Polaris Emulator](https://github.com/duckietm/Polaris-Emulator)** · **[Catalogus](https://gitlab.epicnabbo.nl/remco/Epicnabbo-Catalogus-Updated-Daily)**"
-            echo ""
-            echo "---"
-            echo "*Automated release from Gitea Actions*"
-          } > /tmp/release-body.md
-
-          PAYLOAD="$(jq -Rs --arg v "${VERSION}" '{tag_name: $v, name: $v, body: ., draft: false, prerelease: false}' < /tmp/release-body.md)"
-
-          TOKEN="${GITEA_TOKEN:-${{ secrets.GITEA_TOKEN }}}"
-
-          HTTP_CODE="$(curl -s -w '%{http_code}' -o /tmp/release-resp.json \
-            -X POST "${GITEA_API}/repos/${GITEA_REPO}/releases" \
-            -H "Authorization: token ${TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$PAYLOAD")"
-
-          if [ "${HTTP_CODE}" = "409" ]; then
-            RELEASES="$(curl -sf "${GITEA_API}/repos/${GITEA_REPO}/releases" \
-              -H "Authorization: token ${TOKEN}")"
-            REL_ID="$(echo "$RELEASES" | jq -r ".[] | select(.tag_name==\"${VERSION}\") | .id")"
-            HTTP_CODE="$(curl -s -w '%{http_code}' -o /tmp/release-resp.json \
-              -X PATCH "${GITEA_API}/repos/${GITEA_REPO}/releases/${REL_ID}" \
-              -H "Authorization: token ${TOKEN}" \
-              -H "Content-Type: application/json" \
-              -d "$PAYLOAD")"
-          fi
-
-          if [ "${HTTP_CODE:-0}" -ge 200 ] && [ "${HTTP_CODE:-0}" -lt 300 ]; then
-            echo "SUCCESS: Release ${VERSION} created/updated"
-            cat /tmp/release-resp.json | jq -r '.html_url // .id'
-          else
-            echo "FAILED HTTP ${HTTP_CODE}"
-            cat /tmp/release-resp.json
-            exit 1
-          fi
-  deploy:
-    if: startsWith(gitea.ref_name, 'v') == false
-    runs-on: shell
-    steps:
-      - name: Deploy
-        run: |
-          set -e
-
-          exec 9>/var/tmp/epic_web_control_deploy.lock
-          flock -n 9 || { echo "ERROR: Another deployment is already running! Cancelling."; exit 1; }
-
-          echo "--- Deploying ---"
-
-          LIVE="/var/www/atom-nexst"
-          STAGE=""
-          CUTOVER_STARTED=0
-
-          error_handler() {
-            cd /var/www/atom-nexst 2>/dev/null || cd / || true
-            echo "!!! DEPLOYMENT FAILED on line $1 !!!" >&2
-            # Roll back the build artifact if cutover already moved .next into place.
-            if [ "${CUTOVER_STARTED}" = "1" ] && [ -d "${LIVE}/.next.prev" ]; then
-              echo "Rolling back .next to previous artifact..." >&2
-              rm -rf "${LIVE}/.next" || true
-              mv "${LIVE}/.next.prev" "${LIVE}/.next" || true
-            fi
-            if [ -n "${STAGE}" ] && [ -d "${STAGE}" ]; then
-              git -C "${LIVE}" worktree remove --force "${STAGE}" 2>/dev/null || rm -rf "${STAGE}" || true
-            fi
-            pm2 restart next --update-env 2>/dev/null || pm2 start pnpm --name "next" -- start 2>/dev/null || true
-            exit 1
-          }
-          trap 'error_handler $LINENO' ERR
-
-          docker image prune -f
-
-          DEPLOY_USER="$(id -un)"
-          DEPLOY_GROUP="$(id -gn)"
-          sudo chown -R "${DEPLOY_USER}:${DEPLOY_GROUP}" "${LIVE}" 2>/dev/null || true
-          git config --global --add safe.directory "${LIVE}"
-          git -C "${LIVE}" remote set-url origin /docker/gitea/gitea/git/repositories/remco/epicnext-cms.git/
-
-          echo "Fetching origin/main..."
-          git -C "${LIVE}" fetch origin --prune
-
-          echo "Clearing sticky git index bits (if any)..."
-          STICKY_LIST="$(git -C "${LIVE}" ls-files -v | awk '/^[a-zS]/ {print substr($0,3)}' || true)"
-          if [ -n "${STICKY_LIST}" ]; then
-            echo "${STICKY_LIST}" | while IFS= read -r f; do
-              [ -n "$f" ] || continue
-              git -C "${LIVE}" update-index --no-skip-worktree --no-assume-unchanged -- "$f" 2>/dev/null || true
-            done
-          fi
-
-          export APP_VERSION="$(git -C "${LIVE}" rev-parse --short origin/main)"
-          export NEXT_PUBLIC_APP_VERSION="${APP_VERSION}"
-          echo "APP_VERSION=${APP_VERSION}"
-
-          STAGE="/var/tmp/atom-nexst-stage-${APP_VERSION}"
-          echo "Preparing stage worktree at ${STAGE} (live site stays up)..."
-          git -C "${LIVE}" worktree remove --force "${STAGE}" 2>/dev/null || rm -rf "${STAGE}" || true
-          git -C "${LIVE}" worktree add --detach "${STAGE}" origin/main
-
-          # Production env stays on the live tree; stage only needs a symlink for build/migrate.
-          ln -sfn "${LIVE}/.env" "${STAGE}/.env"
-
-          if ! grep -qE '^[[:space:]]*REDIS_URL=.+' "${LIVE}/.env" 2>/dev/null; then
-            echo "WARNING: REDIS_URL is unset in ${LIVE}/.env" >&2
-            echo "WARNING: Rate limits, site-settings cache, and JWT invalidation cache will be in-process only." >&2
-          fi
-
-          cd "${STAGE}"
-          rm -f tsconfig.tsbuildinfo .tsbuildinfo
-          find . -maxdepth 3 -name '*.tsbuildinfo' -delete 2>/dev/null || true
-          rm -rf .output dist .next .next/types .next/dev
-
-          # Restore build cache from last deploy so Turbopack can do
-          # incremental compilation (much faster rebuilds).
-          if [ -d "${LIVE}/.next/cache" ]; then
-            mkdir -p .next/cache
-            cp -r "${LIVE}/.next/cache/." .next/cache/
-          fi
-
-          # Stage shares MySQL with the live app + emulator. Keep the stage pool
-          # tiny so install/test/build cannot exhaust max_connections.
-          export DATABASE_POOL_SIZE="${DEPLOY_DATABASE_POOL_SIZE:-5}"
-          echo "STAGE DATABASE_POOL_SIZE=${DATABASE_POOL_SIZE}"
-
-          pnpm install --frozen-lockfile
-          # prisma generate does not need a live DB connection.
-          pnpm prisma:generate
-          export ARGON2_MEMORY_SIZE=1024 ARGON2_ITERATIONS=1 BCRYPT_ROUNDS=4
-          pnpm typecheck
-          pnpm test
-          # Validate production env (AUTH_SECRET, DATABASE_URL, …) during build.
-          # Do not set SKIP_ENV_VALIDATION here — that flag is for tests/tooling only.
-          pnpm build
-
-          if [ ! -d "${STAGE}/.next" ]; then
-            echo "ERROR: stage build produced no .next/" >&2
-            exit 1
-          fi
-
-          echo "Cutover: stop service (free DB connections), migrate, swap .next..."
-          CUTOVER_STARTED=1
-          pm2 stop next --kill-timeout 10000 || true
-          # Wait for PM2 to fully exit and MariaDB to reclaim connections.
-          sleep 10
-
-          # Migrate only after live is stopped — avoids ER_CON_COUNT_ERROR while
-          # the old process still holds DATABASE_POOL_SIZE connections.
-          cd "${STAGE}"
-          MIGRATE_OK=0
-          for i in $(seq 1 10); do
-            if pnpm db:migrate; then
-              MIGRATE_OK=1
-              break
-            fi
-            echo "migrate attempt ${i}/10 failed (likely DB connections), retrying..."
-            sleep 5
-          done
-          if [ "${MIGRATE_OK}" != "1" ]; then
-            echo "ERROR: db:migrate failed after retries" >&2
-            exit 1
-          fi
-
-          cd "${LIVE}"
-          echo "Hard reset live tree to origin/main (no nuclear src wipe)..."
-          git reset --hard origin/main
-          # Keep env, uploads, and deps we are about to replace from stage.
-          git clean -fd \
-            -e .env -e .env.local -e .env.production -e .env*.local \
-            -e storage -e public/cache -e node_modules -e .next -e .next.prev
-
-          if ! git diff --exit-code HEAD -- src >/dev/null; then
-            echo "ERROR: live src/ still differs from HEAD after reset:" >&2
-            git diff --stat HEAD -- src >&2 || true
-            exit 1
-          fi
-          echo "Verified live src/ matches HEAD"
-
-          # Save current .next as backup before swapping (kept until health check passes).
-          if [ -d .next ]; then
-            mv .next .next.prev
-          fi
-          mv "${STAGE}/.next" .next
-
-          # Use the exact node_modules the stage build resolved against.
-          rm -rf node_modules
-          mv "${STAGE}/node_modules" node_modules
-
-          # Prisma client is gitignored — regenerate into live src/generated.
-          pnpm prisma:generate
-
-          sudo chown -R www-data:www-data "${LIVE}" 2>/dev/null || true
-
-          echo "Starting PM2 (zero-downtime reload)..."
-          pm2 reload next --update-env || pm2 start next --update-env
-
-          sleep 3
-          if ! pm2 show next 2>/dev/null | grep -q 'online'; then
-            echo "ERROR: PM2 next failed to start!" >&2
-            pm2 logs next --lines 20 --nostream >&2 || true
-            exit 1
-          fi
-
-          echo "Waiting for HTTP health check..."
-          HEALTH_URL="${DEPLOY_HEALTH_URL:-http://127.0.0.1:3000/api/health}"
-          HEALTH_OK=0
-          for i in $(seq 1 15); do
-            BODY="$(curl -sf --max-time 5 "${HEALTH_URL}" 2>/dev/null || true)"
-            if echo "${BODY}" | grep -q '"database":true'; then
-              echo "Health OK (${HEALTH_URL})"
-              HEALTH_OK=1
-              break
-            fi
-            echo "Health attempt ${i}/15 failed, retrying..."
-            sleep 2
-          done
-          if [ "${HEALTH_OK}" != "1" ]; then
-            echo "ERROR: Health check failed after deploy (${HEALTH_URL})" >&2
-            echo "Last body: ${BODY:-<empty>}" >&2
-            pm2 logs next --lines 40 --nostream >&2 || true
-            exit 1
-          fi
-
-          echo "Cleaning stage worktree and previous .next backup..."
-          rm -rf "${LIVE}/.next.prev"
-          git -C "${LIVE}" worktree remove --force "${STAGE}" 2>/dev/null || rm -rf "${STAGE}" || true
-          STAGE=""
-
-          echo "--- Deployed successfully ---"
@@ -11,9 +11,8 @@ jobs:
      - name: Self-hosted Renovate
        run: |
          set -e
-          
-          # Zorg ervoor dat de cache-map lokaal bestaat vóór Docker start
-          # Dit voorkomt dat Docker de map automatisch als 'root' aanmaakt
+
+          # Ensure cache dir exists before Docker starts
          mkdir -p /var/tmp/renovate-cache

          docker run --rm \
@@ -25,4 +24,4 @@ jobs:
            -e RENOVATE_CONFIG_FILE='{"extends":["config:recommended"]}' \
            -e LOG_LEVEL=info \
            -v /var/tmp/renovate-cache:/tmp/renovate-cache \
-            ghcr.io/renovatebot/renovate:latest
+            ghcr.io/renovatebot/renovate:latest
@@ -5,7 +5,6 @@ node_modules/
 next-env.d.ts
 .env
 *.tsbuildinfo
-# Prisma client is generated by `prisma generate`
 src/generated/
 # Runtime avatar/badge imaging disk cache
 public/cache/
@@ -0,0 +1 @@
+pnpm exec lint-staged
@@ -0,0 +1,2 @@
+pnpm typecheck
+pnpm test
@@ -1,8 +1,8 @@
 # EpicNext-CMS v1.0.1

-A modern, high-performance content management system for Habbo hotel emulators, built on **Next.js 16** (App Router) with **Prisma 7** and **React 19**. Designed to integrate seamlessly with Polaris / Arcturus Morningstar MySQL/MariaDB databases.
+A modern, high-performance content management system for Habbo hotel emulators, built on **Next.js 16** (App Router) with **Drizzle ORM** and **React 19**. Designed to integrate seamlessly with Polaris / Arcturus Morningstar MySQL/MariaDB databases.

-Features a premium animated homepage (typewriter hero, floating orbs, scroll counters), a full admin panel, NextAuth authentication (argon2id/bcrypt with MD5-to-argon2id upgrade), real-time RCON communication, Server-Sent Events for live radio data, smooth page transitions, and PM2 production deployment.
+Features a premium animated homepage (typewriter hero, floating orbs, scroll counters), a full admin panel, NextAuth authentication (argon2id hashing with legacy md5/bcrypt auto-upgrade), real-time RCON communication, Server-Sent Events for live radio data, smooth page transitions, and PM2 production deployment.

 ---

@@ -37,7 +37,9 @@ The CMS shares a database with the Polaris/Arcturus emulator. Use an existing da
 CREATE DATABASE IF NOT EXISTS epicnext_cms CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
 ```

-The CMS reads emulator-owned tables (`users`, `items`, `rooms`, `bans`, etc.) directly. It never creates, alters, or drops them.
+The CMS reads emulator-owned tables (`users`, `items`, `rooms`, `bans`, etc.) directly. It never creates, alters, or drops them. The Drizzle schema in `src/db/schema.ts` is generated from the existing database structure and does not modify it.
+
+> **Note:** The CMS does **not** own the emulator schema — it maps to those tables via Drizzle. Never run `drizzle-kit push` / `migrate` against the shared DB. CMS-owned tables (`website_*`, `radio_*`, etc.) are created via idempotent SQL in `drizzle/migrations/` (`pnpm db:migrate`).

 ### 3. Configure Environment

@@ -56,13 +58,34 @@ APP_URL=http://localhost:3000

 See `.env.example` for all optional variables (RCON, email, Redis, OAuth, PayPal, etc.).

-### 4. Generate Prisma Client
+### 4. ORM Setup & Type Generation

-```bash
-pnpm prisma:generate
+#### Drizzle ORM (Primary Data Layer)
+
+Drizzle ORM is the runtime data layer. The connection is a singleton in `src/lib/db.ts`:
+
+```ts
+import { db } from "@/lib/db";
+import { users } from "@/db/schema";
+import { eq } from "drizzle-orm/expressions";
+
+const found = await db.select()
+  .from(users)
+  .where(eq(users.username, "hello"));
 ```

-Generates TypeScript types in `src/generated/prisma/`.
+**Drizzle CLI** (`drizzle-kit`) is used for local development tasks — it is a devDependency and is never bundled in production.
+
+| Command | What it does |
+| ------- | ------------ |
+| `pnpm db:generate` | Draft SQL from Drizzle schema into `drizzle/drafts/` (review + copy into `drizzle/migrations/`) |
+| `pnpm db:studio` | Open Drizzle Studio (dev only) |
+| `pnpm db:introspect` | Reverse-engineer an existing DB into a Drizzle schema draft |
+| `pnpm db:schema:generate` | Regen committed `src/db/schema.ts` from previous schema names + live DB |
+
+> The CMS does **not** use `drizzle-kit push` or `drizzle-kit migrate` — the database is shared with the emulator. Apply CMS DDL only via `pnpm db:migrate`.
+
+Use `import { db } from "@/lib/db"` with table definitions from `src/db/schema.ts` for all database access. Types come from the committed Drizzle schema — no separate client code generation is required at build time.

 ### 5. Run CMS Migrations

@@ -70,7 +93,7 @@ Generates TypeScript types in `src/generated/prisma/`.
 pnpm db:migrate
 ```

-Creates all CMS-owned tables (`website_*`, `radio_*`, `acl_*`, `admin_audit_log`, etc.) via idempotent SQL files in `prisma/migrations/`. Emulator tables are never touched.
+Creates all CMS-owned tables (`website_*`, `radio_*`, `acl_*`, `admin_audit_log`, etc.) via idempotent SQL files in `drizzle/migrations/`. Emulator tables are never touched.

 Check migration status:

@@ -98,6 +121,235 @@ Open `http://localhost:3000` in your browser.

 ---

+## Nginx Configuration
+
+The CMS is designed to run behind an nginx reverse proxy. Below is a reference configuration covering SSL termination, WebSocket upgrade, proxy caching, and the Habbo imager integration.
+
+### Prerequisites
+
+- SSL certificates in `/etc/ssl/cert.pem` and `/etc/ssl/key.pem` (or use Let's Encrypt)
+- Next.js running on `127.0.0.1:3000` (default) or your configured port
+- Habbo imager (optional) running on `127.0.0.1:3030`
+
+### Reference Configuration
+
+Create a file in `/etc/nginx/sites-available/epicnext` and symlink it to `sites-enabled`:
+
+```nginx
+# ==========================================
+# GLOBAL SETTINGS
+# ==========================================
+server_tokens off;
+gzip on;
+gzip_vary on;
+gzip_proxied off;
+gzip_comp_level 6;
+gzip_min_length 256;
+gzip_types text/plain text/css text/javascript application/json
+           application/javascript application/xml application/xml+rss
+           image/svg+xml font/opentype font/ttf font/woff font/woff2;
+
+# ==========================================
+# REDIRECT HTTP → HTTPS
+# ==========================================
+server {
+    listen 80;
+    listen [::]:80;
+    server_name yourdomain.com www.yourdomain.com;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/epicnext/public;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# ==========================================
+# MAIN HTTPS SERVER
+# ==========================================
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name yourdomain.com www.yourdomain.com;
+
+    root /var/www/epicnext/public;
+    index index.html;
+
+    # SSL Certificates
+    ssl_certificate /etc/ssl/cert.pem;
+    ssl_certificate_key /etc/ssl/key.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+
+    # Security Headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    client_max_body_size 20m;
+    client_body_timeout 30s;
+    client_header_timeout 10s;
+    keepalive_timeout 15s;
+    send_timeout 10s;
+
+    # Shared Proxy Settings
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_buffers 16 16k;
+    proxy_buffer_size 32k;
+
+    # ------------------------------------------
+    # Static Files
+    # ------------------------------------------
+    location ^~ /nitro-client/ {
+        alias /var/www/Nitro-V3/dist/;
+        expires 7d;
+        add_header Cache-Control "public";
+        access_log off;
+    }
+
+    location = /favicon.ico { expires 1y; access_log off; log_not_found off; try_files $uri =404; }
+    location = /robots.txt  { expires 1d; access_log off; log_not_found off; try_files $uri =404; }
+
+    # ------------------------------------------
+    # Next.js Assets (immutable, long cache)
+    # ------------------------------------------
+    location /_next/static/ {
+        proxy_pass http://127.0.0.1:3000;
+        add_header Cache-Control "public, max-age=31536000, immutable";
+    }
+
+    location /_next/data/ {
+        proxy_pass http://127.0.0.1:3000;
+        add_header Cache-Control "public, max-age=0, must-revalidate";
+    }
+
+    # ------------------------------------------
+    # API Routes (never cached)
+    # ------------------------------------------
+    location /api/ {
+        proxy_pass http://127.0.0.1:3000;
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+    }
+
+    # ------------------------------------------
+    # Habbo Imager (optional)
+    # ------------------------------------------
+    # Proxies to a Docker container that renders Habbo avatars.
+    # The imager caches renders to disk, so a long s-maxage is safe.
+    location /imaging {
+        proxy_pass http://127.0.0.1:3030;
+        add_header Cache-Control "public, max-age=3600, s-maxage=86400, stale-while-revalidate=86400" always;
+    }
+
+    # ------------------------------------------
+    # WebSocket (Radio / SSE)
+    # ------------------------------------------
+    location /ws {
+        proxy_pass http://127.0.0.1:3030;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 86400;
+    }
+
+    # ------------------------------------------
+    # Main Page Proxy (with HTML caching)
+    # ------------------------------------------
+    # The CMS middleware sets:
+    #   Cache-Control: public, s-maxage=300, stale-while-revalidate=300  (anonymous)
+    #   Cache-Control: private, no-store                                  (authenticated)
+    #
+    # nginx caches anonymous responses and serves them directly, bypassing
+    # the Node.js process entirely. Authenticated responses are never cached.
+    #
+    # proxy_cache_valid: cache 200 responses for 60 seconds
+    # proxy_ignore_headers Vary: Next.js emits many Vary headers (rsc,
+    #   next-router-*, Accept-Encoding) that would fragment the cache key.
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
+        proxy_http_version 1.1;
+        proxy_buffering on;
+
+        proxy_cache html_cache;
+        proxy_cache_valid 200 60s;
+        proxy_cache_key "$host$request_uri";
+        proxy_ignore_headers Vary;
+        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
+        proxy_cache_background_update on;
+        proxy_cache_revalidate on;
+        add_header X-Cache-Status $upstream_cache_status always;
+    }
+
+    # ------------------------------------------
+    # Health Check
+    # ------------------------------------------
+    location /health {
+        access_log off;
+        return 200 "OK";
+        add_header Content-Type text/plain;
+    }
+
+    # Block hidden files
+    location ~ /(\.|vendor|storage/logs/|\.(sql|sqlite|sqlite3)$) {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}
+```
+
+### HTML Caching
+
+The CMS uses an **origin-level proxy cache** for anonymous HTML pages. This means:
+
+- **Anonymous visitors** receive cached HTML directly from nginx (~1ms), skipping the Node.js process entirely.
+- **Authenticated visitors** always hit Node.js (personalized content).
+- The cache is **auto-invalidated** after 60 seconds and revalidates in the background.
+
+The proxy cache zone is defined in the `http` block (above any `server` block):
+
+```nginx
+proxy_cache_path /var/cache/nginx/html_cache levels=1:2 keys_zone=html_cache:50m max_size=500m inactive=10m use_temp_path=off;
+```
+
+Verify caching works by checking the `X-Cache-Status` response header:
+
+```bash
+# First request (MISS = fetched from Node.js, now cached)
+curl -sI https://yourdomain.com/ | grep X-Cache-Status
+# → X-Cache-Status: MISS
+
+# Second request (HIT = served from nginx cache)
+curl -sI https://yourdomain.com/ | grep X-Cache-Status
+# → X-Cache-Status: HIT
+```
+
+### Key Points
+
+| Setting | Value | Why |
+| ------- | ----- | --- |
+| `proxy_http_version 1.1` | HTTP/1.1 to upstream | Required for keep-alive and chunked transfer |
+| `proxy_buffering on` | Buffer upstream response | Required for proxy_cache to work with chunked responses |
+| `proxy_ignore_headers Vary` | Ignore upstream Vary | Next.js emits dynamic Vary headers (rsc, next-router-*) that would fragment the cache |
+| `proxy_cache_valid 200 60s` | Cache 200s for 60s | Balances freshness with performance |
+| `proxy_cache_use_stale` | Serve stale on error | Keeps the site available during brief upstream outages |
+
+---
+
 ## Production Deployment (PM2)

 ```bash
@@ -130,10 +382,16 @@ The CMS runs behind an nginx reverse proxy on the default port 3000. Static asse
 | `pnpm test`            | Run all tests (Vitest)                             |
 | `pnpm db:migrate`      | Apply pending SQL migrations                       |
 | `pnpm db:migrate:status` | Show migration status                           |
+| `pnpm db:schema:generate` | Regen `src/db/schema.ts` from prior schema + live DB |
+| `pnpm db:generate`     | Draft SQL via drizzle-kit → `drizzle/drafts/`      |
+| `pnpm db:studio`       | Drizzle Studio (dev)                               |
+| `pnpm db:introspect`   | drizzle-kit introspect (draft)                     |
 | `pnpm analyze`         | Build + open bundle analyzer                       |
 | `pnpm jobs:worker`     | Start background task worker (systemd / PM2)       |
 | `pnpm biome:check`     | Lint and format code                               |

+**Drizzle Kit notes:** `db:generate` / `db:introspect` write drafts only. Reviewed SQL must be copied into `drizzle/migrations/` as a new numbered file, then applied with `pnpm db:migrate`. Never run `drizzle-kit push` or `drizzle-kit migrate` against production.
+
 ---

 ## Performance Features
@@ -160,21 +418,26 @@ The CMS runs behind an nginx reverse proxy on the default port 3000. Static asse
 ## Architecture

 ```
-├── prisma/
-│   ├── schema.prisma          # ~190 models (emulator + CMS)
-│   └── migrations/            # 16 SQL migrations for CMS tables
+├── drizzle/
+│   ├── migrations/            # CMS SQL migrations (idempotent, tracked in cms_migrations)
+│   └── drafts/                # drizzle-kit generate output (never auto-applied)
 ├── scripts/
-│   ├── apply-migrations.ts    # Custom migration runner
+│   ├── apply-migrations.ts    # SQL migration runner (apply + status)
 │   ├── jobs-worker.ts         # Background task scheduler
-│   └── sql-statements.ts      # SQL parsing utilities
+│   ├── merge-config.cjs       # Utility: merge split config files
+│   └── generate-drizzle-schema.mjs # Regen src/db/schema.ts from schema + live DB
 ├── src/
+│   ├── db/
+│   │   ├── schema.ts          # Drizzle ORM schema (committed — runtime data layer)
+│   │   └── relations.ts       # Drizzle relations
 │   ├── app/                   # Next.js App Router (pages & API routes)
 │   ├── actions/               # Server Actions
 │   ├── components/            # UI components
 │   ├── lib/
 │   │   ├── auth/              # NextAuth, password hashing, 2FA, SSO tickets
 │   │   ├── services/          # RCON, email, currency, PayPal, alerts
-│   │   ├── prisma.ts          # Database connection singleton
+│   │   ├── db.ts              # Drizzle connection singleton (runtime)
+│   │   ├── cached-db.ts       # Redis-backed query cache helpers
 │   │   ├── redis.ts           # Redis client (ioredis)
 │   │   ├── redis-cache.ts     # Redis caching utility for API routes
 │   │   ├── cache.ts           # In-memory cache fallback
@@ -195,9 +458,17 @@ The CMS runs behind an nginx reverse proxy on the default port 3000. Static asse
 | Component                                         | Type                    | Migrations                          |
 | ------------------------------------------------- | ----------------------- | ----------------------------------- |
 | Emulator tables (`users`, `items`, `rooms`, etc.) | Existing Polaris schema | None — CMS reads/writes only        |
-| CMS tables (`website_*`, `radio_*`, etc.)         | CMS-owned               | `prisma/migrations/*.sql` (16 files) |
+| CMS tables (`website_*`, `radio_*`, etc.)         | CMS-owned               | `drizzle/migrations/*.sql`           |
 | Migration tracking                                | `cms_migrations` table  | Auto-created by migration runner     |

+### ORM Architecture
+
+- **Runtime (Drizzle ORM)**: `@/lib/db` exposes a Drizzle singleton. Schema lives in `src/db/schema.ts`.
+- **Schema regeneration**: `pnpm db:schema:generate` reuses field/table names from the previous `src/db/schema.ts` and refreshes column types from the live DB.
+- **Drizzle Kit**: studio / generate / introspect for local tooling; CMS apply path remains `pnpm db:migrate`.
+
+Use `import { db } from "@/lib/db"` with queries built via `src/db/schema.ts`.
+
 ---

 ## Optional Integrations
@@ -260,7 +531,9 @@ pnpm biome:check  # Lint and format
 1. Ensure typecheck and tests pass: `pnpm typecheck && pnpm test`
 2. Follow existing code conventions (Server Components where possible, minimal client boundaries)
 3. Use the `src/lib/motion.ts` animation variants for consistent animations
-4. SQL migrations in `prisma/migrations/` must be idempotent
+4. SQL migrations in `drizzle/migrations/` must be idempotent
+5. For new database code, use the Drizzle runtime directly (`import { db } from "@/lib/db"`) — see [ORM Setup](#4-orm-setup--type-generation)
+6. Avoid `any` — use `eslint-disable` or `biome-ignore` comments only when unavoidable

 ---

@@ -0,0 +1,19 @@
+import "dotenv/config";
+import { defineConfig } from "drizzle-kit";
+
+// Schema source of truth for the query builder: src/db/schema.ts
+// (regenerated via `pnpm db:schema:generate` from the previous schema + live DB).
+//
+// This DB is shared with the Arcturus emulator — NEVER run `drizzle-kit migrate`
+// or `push` against it. CMS DDL stays in drizzle/migrations/*.sql applied by
+// `pnpm db:migrate`. Use `pnpm db:generate` only for draft SQL under drizzle/drafts/.
+export default defineConfig({
+	dialect: "mysql",
+	schema: "./src/db/schema.ts",
+	out: "./drizzle/drafts",
+	dbCredentials: {
+		url: process.env.DATABASE_URL ?? "",
+	},
+	strict: true,
+	verbose: true,
+});
@@ -0,0 +1 @@
+Draft SQL from `pnpm db:generate` (drizzle-kit). Never apply these automatically — copy reviewed statements into drizzle/migrations/ as numbered CMS migrations, then `pnpm db:migrate`.
@@ -1,14 +0,0 @@
-import { expect, test } from "@playwright/test";
-
-test.describe("Admin panel", () => {
-	test("admin login page redirects unauthenticated users", async ({ page }) => {
-		await page.goto("/admin");
-		await expect(page).toHaveURL(/login/);
-	});
-
-	test("admin page has login form", async ({ page }) => {
-		await page.goto("/admin");
-		await expect(page.locator('input[name="username"]')).toBeVisible();
-		await expect(page.locator('input[name="password"]')).toBeVisible();
-	});
-});
@@ -1,32 +0,0 @@
-import { expect, test } from "@playwright/test";
-
-test.describe("Authentication flows", () => {
-	test("login form validates required fields", async ({ page }) => {
-		await page.goto("/login");
-		await page.click('button[type="submit"]');
-		await expect(page.locator("text=required")).toBeVisible({ timeout: 5000 });
-	});
-
-	test("login with invalid credentials shows error", async ({ page }) => {
-		await page.goto("/login");
-		await page.fill('input[name="username"]', "nonexistent");
-		await page.fill('input[name="password"]', "wrongpassword");
-		await page.click('button[type="submit"]');
-		await expect(page.locator("text=invalid")).toBeVisible({ timeout: 5000 });
-	});
-
-	test("register page has password confirmation field", async ({ page }) => {
-		await page.goto("/register");
-		await expect(page.locator('input[name="confirmPassword"]')).toBeVisible();
-	});
-
-	test("register form validates password match", async ({ page }) => {
-		await page.goto("/register");
-		await page.fill('input[name="password"]', "Password123!");
-		await page.fill('input[name="confirmPassword"]', "DifferentPass123!");
-		await page.click('button[type="submit"]');
-		await expect(page.locator("text=match|komen overeen|kloppen")).toBeVisible({
-			timeout: 5000,
-		});
-	});
-});
@@ -1,16 +0,0 @@
-import { expect, test } from "@playwright/test";
-
-test("homepage has title", async ({ page }) => {
-	await page.goto("/");
-	await expect(page).toHaveTitle(/Magic Hotel|Atom/i);
-});
-
-test("register page loads", async ({ page }) => {
-	await page.goto("/register");
-	await expect(page).toHaveTitle(/registreer|register|konto/i);
-});
-
-test("login page loads", async ({ page }) => {
-	await page.goto("/login");
-	await expect(page).toHaveTitle(/inloggen|login/i);
-});
@@ -1,24 +0,0 @@
-import { expect, test } from "@playwright/test";
-
-test.describe("Public navigation", () => {
-	test("homepage loads with expected elements", async ({ page }) => {
-		await page.goto("/");
-		await expect(page.locator("nav")).toBeVisible();
-		await expect(page.locator("footer")).toBeVisible();
-	});
-
-	test("community page loads", async ({ page }) => {
-		await page.goto("/community");
-		await expect(page).toHaveTitle(/community/i);
-	});
-
-	test("shop page loads", async ({ page }) => {
-		await page.goto("/shop");
-		await expect(page.locator("h1, h2").first()).toBeVisible();
-	});
-
-	test("404 page for unknown routes", async ({ page }) => {
-		const response = await page.goto("/this-page-does-not-exist");
-		expect(response?.status()).toBe(404);
-	});
-});
@@ -0,0 +1,21 @@
+module.exports = {
+  apps: [
+    {
+      name: "next",
+      script: ".next/standalone/server.js",
+      exec_mode: "cluster",
+      instances: 0,
+      max_memory_restart: "512M",
+      env: {
+        NODE_ENV: "production",
+        PORT: 3002,
+        RCON_PORT: 3003,
+        NEXT_PHASE: "phase-production-server",
+      },
+      merge_logs: true,
+      error_file: ".pm2/errors.log",
+      out_file: ".pm2/out.log",
+      log_date_format: "YYYY-MM-DD HH:mm:ss",
+    },
+  ],
+};
@@ -4,8 +4,7 @@
 		"src/app/**/page.{ts,tsx}",
 		"src/app/**/layout.{ts,tsx}",
 		"src/app/**/route.{ts,tsx}",
-		"src/app/**/{error,not-found,loading,template,default,global-error}.{ts,tsx}",
-		"sentry.{server,edge}.config.ts"
+		"src/app/**/{error,not-found,loading,template,default,global-error}.{ts,tsx}"
 	],
 	"project": ["src/**/*.{ts,tsx}"],
 	"ignoreDependencies": [
@@ -1,20 +0,0 @@
-module.exports = {
-  ci: {
-    collect: {
-      url: ["http://localhost:3000"],
-      numberOfRuns: 3,
-    },
-    assert: {
-      preset: "lighthouse:no-pwa",
-      assertions: {
-        "categories:performance": ["error", { minScore: 0.9 }],
-        "categories:accessibility": ["error", { minScore: 0.9 }],
-        "categories:best-practices": ["error", { minScore: 0.9 }],
-        "categories:seo": ["error", { minScore: 0.8 }],
-        "first-contentful-paint": ["error", { maxNumericValue: 2000 }],
-        "largest-contentful-paint": ["error", { maxNumericValue: 2500 }],
-        "cumulative-layout-shift": ["error", { maxNumericValue: 0.1 }],
-      },
-    },
-  },
-};
@@ -1,8 +1,22 @@
+import { execFileSync } from "node:child_process";
 import withBundleAnalyzer from "@next/bundle-analyzer";
-import { withSentryConfig } from "@sentry/nextjs";
 import type { NextConfig } from "next";
 import createNextIntlPlugin from "next-intl/plugin";

+function resolveDeploymentId(): string | undefined {
+	const configuredId = process.env.NEXT_DEPLOYMENT_ID?.trim();
+	if (configuredId) return configuredId;
+
+	try {
+		return execFileSync("git", ["rev-parse", "HEAD"], {
+			encoding: "utf8",
+			stdio: ["ignore", "pipe", "ignore"],
+		}).trim();
+	} catch {
+		return process.env.APP_VERSION?.trim() || undefined;
+	}
+}
+
 const securityHeaders = [
 	{ key: "X-DNS-Prefetch-Control", value: "on" },
 	{
@@ -20,26 +34,23 @@ const securityHeaders = [
 ];

 const nextConfig: NextConfig = {
+	deploymentId: resolveDeploymentId(),
 	turbopack: {},
-	serverExternalPackages: [
-		"@prisma/adapter-mariadb",
-		"mariadb",
-		"@prisma/client",
-		"lzma",
-		"sharp",
-		"pino",
-		"pino-pretty",
-	],
+	serverExternalPackages: ["mariadb", "lzma", "sharp", "pino", "pino-pretty"],

 	// Enable React Compiler for automatic memoization
 	reactCompiler: true,

-	// Compress responses with gzip
+	// Compress responses with gzip/brotli
 	compress: true,

-	// Disable Next.js telemetry
+	// Disable Next.js telemetry and browser sourcemaps in production
 	productionBrowserSourceMaps: false,

+	experimental: {
+		useTypeScriptCli: true,
+	},
+
 	// Add caching headers for static assets
 	async headers() {
 		return [
@@ -70,28 +81,8 @@ const withNextIntl = createNextIntlPlugin("./src/i18n/request.ts");

 const config = withNextIntl(nextConfig);

-// Source-map upload + release creation need SENTRY_AUTH_TOKEN.
-// Without it, keep the SDK wrapper but skip remote Sentry build steps
-// so CI/prod compile stays quiet (runtime DSN still works independently).
-const sentryAuthToken = process.env.SENTRY_AUTH_TOKEN;
-
 const withBA = withBundleAnalyzer({
 	enabled: process.env.ANALYZE === "true",
 });

-export default withBA(
-	withSentryConfig(config, {
-		org: process.env.SENTRY_ORG,
-		project: process.env.SENTRY_PROJECT,
-		authToken: sentryAuthToken,
-		silent: !process.env.CI || !sentryAuthToken,
-		widenClientFileUpload: true,
-		sourcemaps: {
-			disable: !sentryAuthToken,
-		},
-		release: {
-			create: Boolean(sentryAuthToken),
-		},
-		telemetry: false,
-	}),
-);
+export default withBA(config);
@@ -10,32 +10,28 @@
 		"dev": "next dev",
 		"build": "next build",
 		"start": "next start",
-		"prisma:generate": "prisma generate",
-		"typecheck": "tsc6 --noEmit --incremental false",
+		"typecheck": "tsc --noEmit --incremental",
 		"biome:check": "biome check --write .",
 		"biome:lint": "biome lint .",
 		"biome:format": "biome format --write .",
 		"knip": "knip",
 		"analyze": "ANALYZE=true pnpm build",
 		"test": "vitest run",
-		"test:e2e": "playwright test",
-		"lint": "eslint . --ext .ts,.tsx --max-warnings=50",
-		"lint:fix": "eslint . --ext .ts,.tsx --fix --max-warnings=50",
-		"lhci:collect": "lhci collect",
-		"lhci:assert": "lhci assert",
-		"lhci:server": "lhci server",
 		"db:migrate": "tsx scripts/apply-migrations.ts",
 		"db:migrate:status": "tsx scripts/apply-migrations.ts --status",
+		"db:schema:generate": "node scripts/generate-drizzle-schema.mjs",
+		"db:generate": "drizzle-kit generate",
+		"db:studio": "drizzle-kit studio",
+		"db:introspect": "drizzle-kit introspect",
 		"jobs:worker": "tsx scripts/jobs-worker.ts",
 		"prepare": "husky"
 	},
 	"lint-staged": {
 		"*.{js,jsx,ts,tsx}": [
-			"biome check --write",
-			"eslint --fix --max-warnings=50"
+			"biome check --write"
 		],
 		"*.{json,md,css,scss,html}": [
-			"biome format --write"
+			"biome format --write --no-errors-on-unmatched"
 		]
 	},
 	"dependencies": {
@@ -43,39 +39,34 @@
 		"@dnd-kit/core": "^6.3.1",
 		"@dnd-kit/sortable": "^10.0.0",
 		"@dnd-kit/utilities": "^3.2.2",
-		"@hookform/resolvers": "^5.5.7",
-		"@prisma/adapter-mariadb": "^7.9.1",
-		"@prisma/client": "^7.9.1",
-		"@sentry/nextjs": "^10.68.0",
-		"@tanstack/react-virtual": "^3.14.8",
-		"bcrypt": "^6.0.0",
+		"@hookform/resolvers": "^5.6.0",
+		"@tanstack/react-virtual": "^3.14.9",
 		"class-variance-authority": "^0.7.1",
 		"clsx": "^2.1.1",
 		"cmdk": "^1.1.1",
 		"croner": "^10.0.1",
-		"framer-motion": "^12.42.2",
+		"drizzle-orm": "^0.45.2",
 		"hash-wasm": "^4.12.0",
 		"ioredis": "^5.11.1",
+		"isomorphic-dompurify": "^3.21.0",
 		"jpeg-js": "^0.4.4",
 		"json5": "^2.2.3",
 		"jszip": "^3.10.1",
 		"lenis": "^1.3.25",
-		"lucide-react": "^1.27.0",
+		"lucide-react": "^1.28.0",
 		"lzma": "^2.3.2",
+		"motion": "^12.43.0",
 		"music-metadata": "^11.14.0",
 		"mysql2": "^3.23.2",
 		"next": "^16.2.12",
 		"next-auth": "5.0.0-beta.32",
 		"next-intl": "^4.13.4",
-		"next-view-transitions": "^0.3.5",
-		"nodemailer": "^9.0.3",
 		"otplib": "^13.4.1",
 		"pino": "^10.3.1",
 		"react": "^19.2.8",
 		"react-dom": "^19.2.8",
-		"react-hook-form": "^7.83.0",
+		"react-hook-form": "^7.84.0",
 		"resend": "^6.18.1",
-		"sanitize-html": "^2.17.6",
 		"server-only": "^0.0.1",
 		"sharp": "^0.35.3",
 		"sonner": "^2.0.7",
@@ -85,37 +76,26 @@
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.5.6",
-		"@eslint/js": "10.0.1",
-		"@lhci/cli": "^0.15.1",
 		"@next/bundle-analyzer": "^16.2.12",
-		"@next/eslint-plugin-next": "^16.2.12",
-		"@playwright/test": "1.62.0",
 		"@tailwindcss/forms": "^0.5.11",
 		"@tailwindcss/postcss": "^4.3.3",
 		"@tailwindcss/typography": "^0.5.20",
-		"@types/bcrypt": "^6.0.0",
 		"@types/node": "^26.1.2",
-		"@types/nodemailer": "^8.0.1",
-		"@types/react": "^19.2.17",
-		"@types/react-dom": "^19.2.3",
-		"@types/sanitize-html": "^2.16.1",
+		"@types/react": "^19.2.18",
+		"@types/react-dom": "^19.2.4",
 		"@vitest/coverage-v8": "4.1.10",
 		"babel-plugin-react-compiler": "^1.0.0",
 		"dotenv": "^17.4.2",
-		"eslint": "10.8.0",
-		"eslint-plugin-react-hooks": "^7.1.1",
-		"eslint-plugin-security": "^4.0.1",
-		"eslint-plugin-unused-imports": "4.4.1",
+		"drizzle-kit": "^0.31.10",
 		"husky": "^9.1.7",
-		"knip": "^6.29.0",
+		"knip": "^6.31.0",
+		"lint-staged": "^17.3.0",
 		"pino-pretty": "^13.1.3",
-		"postcss": "^8.5.24",
-		"prisma": "^7.9.1",
+		"postcss": "^8.5.25",
 		"tailwindcss": "^4.3.3",
 		"tsx": "^4.23.1",
-		"typescript": "npm:@typescript/typescript6@^6.0.2",
-		"typescript-eslint": "^8.65.0",
-		"vite": "8.1.5",
+		"typescript": "^7.0.2",
+		"vite": "8.2.0",
 		"vitest": "4.1.10"
 	}
-}
+}
@@ -1,33 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-export default defineConfig({
-	testDir: "./e2e",
-	fullyParallel: true,
-	forbidOnly: !!process.env.CI,
-	retries: process.env.CI ? 2 : 0,
-	workers: process.env.CI ? 1 : undefined,
-	reporter: "html",
-	use: {
-		baseURL: process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000",
-		trace: "on-first-retry",
-	},
-	projects: [
-		{
-			name: "chromium",
-			use: { ...devices["Desktop Chrome"] },
-		},
-		{
-			name: "firefox",
-			use: { ...devices["Desktop Firefox"] },
-		},
-		{
-			name: "webkit",
-			use: { ...devices["Desktop Safari"] },
-		},
-	],
-	webServer: {
-		command: "pnpm dev",
-		url: "http://localhost:3000",
-		reuseExistingServer: !process.env.CI,
-	},
-});
@@ -3,13 +3,9 @@
 # pnpm v11 vervanger voor onlyBuiltDependencies
 allowBuilds:
  esbuild: true
-  prisma: true
-  "@prisma/client": true
-  "@prisma/engines": true
  sharp: true
  "@parcel/watcher": true
  "@swc/core": true
-  "@sentry/cli": true
  bcrypt: true

 # Al jouw overrides netjes bij elkaar inclusief de nieuwe security patches
@@ -20,7 +16,7 @@ overrides:
  uuid: "^9.0.1"
  fast-uri: "^3.1.3"
  "@hono/node-server": "^1.19.13"
-  postcss: "^8.5.19"
+  postcss: "^8.5.25"
  # Dwingt alle diepe subdependencies (zoals lhci) naar de veilige tmp-versie
  tmp: "^0.2.6"
  # NIEUWE SECURITY PATCHES:
@@ -32,4 +28,4 @@ peerDependencyRules:
  allowedVersions:
    nodemailer: "9.0.3"
  ignoreMissing:
-    - nodemailer
+    - nodemailer
@@ -1,16 +0,0 @@
-import "dotenv/config";
-import { defineConfig, env } from "prisma/config";
-
-// Prisma 7 config. The datasource URL lives here (not in schema.prisma).
-// We NEVER run `prisma migrate`/`db push` against this database — it is shared
-// live with the Arcturus emulator. CMS-only schema changes go in
-// prisma/migrations/*.sql (idempotent) applied via `pnpm db:migrate`.
-export default defineConfig({
-	schema: "prisma/schema.prisma",
-	migrations: {
-		path: "prisma/migrations",
-	},
-	datasource: {
-		url: env("DATABASE_URL"),
-	},
-});
@@ -6,7 +6,7 @@ import { mysqlConnectionUrl } from "./db-url";
 import { splitSqlStatements } from "./sql-statements";

 const __dirname = dirname(fileURLToPath(import.meta.url));
-const MIGRATIONS_DIR = resolve(__dirname, "../prisma/migrations");
+const MIGRATIONS_DIR = resolve(__dirname, "../drizzle/migrations");
 const TRACKING_TABLE = "cms_migrations";

 interface MigrationFile {
@@ -0,0 +1,526 @@
+#!/usr/bin/env node
+// Generates src/db/schema.ts from:
+//  1. existing src/db/schema.ts  -> TS export names, camelCase fields, column maps, keys
+//  2. live MySQL introspection   -> real column types (DB is authoritative for DDL)
+//
+// The DB is owned by the Arcturus emulator; we never run drizzle-kit migrate/push.
+// CMS DDL lands in drizzle/migrations/*.sql via `pnpm db:migrate`.
+// drizzle-kit (`pnpm db:generate` / studio / introspect) is draft/browse tooling only.
+//
+// Usage: pnpm db:schema:generate
+import "dotenv/config";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const MYSQL2_UNSUPPORTED_OPTIONS = [
+	"connection_limit",
+	"pool_timeout",
+	"connect_timeout",
+];
+
+function mysqlConnectionUrl(value) {
+	const url = new URL(value);
+	for (const option of MYSQL2_UNSUPPORTED_OPTIONS)
+		url.searchParams.delete(option);
+	return url.toString();
+}
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const ROOT = resolve(__dirname, "..");
+const SCHEMA_TS = resolve(ROOT, "src/db/schema.ts");
+const OUT = SCHEMA_TS;
+
+// ---------- Parse existing Drizzle schema (naming source of truth) ----------
+const schemaSource = readFileSync(SCHEMA_TS, "utf-8");
+
+/**
+ * @returns {{ name: string, table: string, fields: object[], ids: string[]|null, uniques: string[][] }}
+ */
+function parseDrizzleTables(source) {
+	const models = [];
+	const re2 =
+		/^export const (\w+) = mysqlTable\(\s*"([^"]+)"\s*,\s*\{([\s\S]*?)\n\}(?:,\s*\(t\)\s*=>\s*\[([\s\S]*?)\])?\s*\);/gm;
+
+	let match = re2.exec(source);
+	const seen = new Set();
+	while (match !== null) {
+		const [, name, table, body, extras] = match;
+		if (!seen.has(name)) {
+			seen.add(name);
+			models.push(parseTableBody(name, table, body, extras ?? ""));
+		}
+		match = re2.exec(source);
+	}
+
+	if (models.length === 0) {
+		throw new Error(
+			`[schema-gen] Failed to parse any mysqlTable exports from ${SCHEMA_TS}`,
+		);
+	}
+	return models;
+}
+
+function parseTableBody(name, table, body, extras) {
+	const fields = [];
+	for (const line of body.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("//")) continue;
+		const m = trimmed.match(/^(\w+)\s*:\s*(.+?),?\s*$/);
+		if (!m) continue;
+		const fieldName = m[1];
+		const expr = m[2];
+		const colMatch = expr.match(/\(\s*"([^"]+)"/);
+		if (!colMatch) continue;
+		const column = colMatch[1];
+
+		const isBoolean = /\bboolean\s*\(/.test(expr);
+		const enumMatch = expr.match(/mysqlEnum\s*\(\s*"[^"]+"\s*,\s*(\[[^\]]*\])/);
+		let enumValues = null;
+		if (enumMatch) {
+			try {
+				enumValues = JSON.parse(enumMatch[1].replace(/'/g, '"'));
+			} catch {
+				enumValues = [...enumMatch[1].matchAll(/"([^"]+)"/g)].map((x) => x[1]);
+			}
+		}
+
+		let defaultContent = null;
+		const defIdx = expr.indexOf(".default(");
+		if (defIdx >= 0) {
+			const start = defIdx + ".default(".length;
+			let depth = 0;
+			for (let i = start; i < expr.length; i++) {
+				const ch = expr[i];
+				if (ch === "(") depth++;
+				else if (ch === ")") {
+					if (depth === 0) {
+						defaultContent = expr.slice(start, i).trim();
+						break;
+					}
+					depth--;
+				}
+			}
+		}
+
+		fields.push({
+			fieldName,
+			column,
+			optional: !/\.notNull\s*\(/.test(expr),
+			isId: /\.primaryKey\s*\(/.test(expr),
+			isUnique: /\.unique\s*\(/.test(expr),
+			autoIncrement: /\.autoincrement\s*\(/.test(expr),
+			isBoolean,
+			enumValues,
+			defaultContent,
+			// legacy shape used by columnExpr / fallback
+			prismaType: isBoolean
+				? "Boolean"
+				: enumValues
+					? fieldName === "gender"
+						? "users_gender"
+						: fieldName === "type" && table === "bans"
+							? "bans_type"
+							: "String"
+					: "String",
+			attrs: defaultContent ? `@default(${defaultContent})` : "",
+			dbHint: null,
+		});
+	}
+
+	let ids = null;
+	const uniques = [];
+	if (extras) {
+		const pk = extras.match(
+			/primaryKey\(\s*\{\s*columns:\s*\[([^\]]+)\]\s*\}\s*\)/,
+		);
+		if (pk) {
+			ids = [...pk[1].matchAll(/t\.(\w+)/g)].map((m) => m[1]);
+		}
+		for (const u of extras.matchAll(/uniqueIndex\([^)]*\)\.on\(([^)]+)\)/g)) {
+			uniques.push([...u[1].matchAll(/t\.(\w+)/g)].map((m) => m[1]));
+		}
+	}
+
+	return { name, table, fields, ids, uniques };
+}
+
+const models = parseDrizzleTables(schemaSource);
+
+// ---------- Introspect live MySQL ----------
+let url;
+try {
+	const raw = process.env.DATABASE_URL;
+	if (!raw) throw new Error("DATABASE_URL is required");
+	url = mysqlConnectionUrl(raw);
+} catch (err) {
+	console.error("[schema-gen] No DATABASE_URL:", err.message);
+	process.exit(1);
+}
+const mysql = await import("mysql2/promise");
+const conn = await mysql.createConnection(url);
+
+const [cols] = await conn.query(
+	`SELECT table_name, column_name, data_type, column_type, is_nullable,
+	        column_key, column_default, extra
+	   FROM information_schema.columns
+	  WHERE table_schema = DATABASE()`,
+);
+await conn.end();
+
+const colByTable = new Map();
+for (const c of cols) {
+	const key = `${c.table_name}.${c.column_name}`;
+	colByTable.set(key, c);
+}
+
+// ---------- Build drizzle column builders ----------
+const used = new Set(["mysqlTable", "primaryKey", "uniqueIndex", "customType"]);
+let usedSql = false;
+
+function use(name) {
+	used.add(name);
+}
+
+function markSqlUsed() {
+	usedSql = true;
+}
+
+function quote(v) {
+	return `"${String(v).replace(/"/g, '\\"')}"`;
+}
+
+/** Map a DB column row to a drizzle column expression string. */
+function columnExpr(field, dbCol) {
+	const col = field.column;
+	let type = "";
+
+	const unsigned = /unsigned/.test(dbCol?.column_type ?? "");
+	const decimalMatch = dbCol?.column_type?.match(/decimal\((\d+),(\d+)\)/);
+	const enumMatch = dbCol?.column_type?.match(/^enum\((.+)\)$/);
+
+	if (field.prismaType === "users_gender" || field.prismaType === "bans_type") {
+		use("mysqlEnum");
+		const values = enumMatch
+			? [...enumMatch[1].matchAll(/'([^']+)'/g)].map((m) => m[1])
+			: (field.enumValues ??
+				(field.prismaType === "users_gender"
+					? ["M", "F"]
+					: ["account", "ip", "machine", "super"]));
+		return `mysqlEnum(${quote(col)}, ${JSON.stringify(values)})`;
+	}
+
+	switch (dbCol?.data_type) {
+		case "int":
+			use("int");
+			type = unsigned
+				? `int(${quote(col)}, { unsigned: true })`
+				: `int(${quote(col)})`;
+			break;
+		case "tinyint": {
+			const isBool =
+				dbCol.column_type === "tinyint(1)" &&
+				(field.isBoolean || field.prismaType === "Boolean");
+			if (isBool) {
+				use("boolean");
+				type = `boolean(${quote(col)})`;
+			} else {
+				use("tinyint");
+				type = unsigned
+					? `tinyint(${quote(col)}, { unsigned: true })`
+					: `tinyint(${quote(col)})`;
+			}
+			break;
+		}
+		case "smallint":
+			use("smallint");
+			type = unsigned
+				? `smallint(${quote(col)}, { unsigned: true })`
+				: `smallint(${quote(col)})`;
+			break;
+		case "mediumint":
+			use("mediumint");
+			type = unsigned
+				? `mediumint(${quote(col)}, { unsigned: true })`
+				: `mediumint(${quote(col)})`;
+			break;
+		case "bigint":
+			use("bigint");
+			type = `bigint(${quote(col)}, { mode: "bigint", unsigned: ${unsigned} })`;
+			break;
+		case "varchar":
+		case "enum": {
+			use("varchar");
+			const maxLen = enumMatch
+				? Math.max(
+						...[...enumMatch[1].matchAll(/'([^']+)'/g)].map((m) => m[1].length),
+						1,
+					)
+				: Number(dbCol?.column_type?.match(/\((\d+)\)/)?.[1] ?? 255);
+			type = `varchar(${quote(col)}, { length: ${maxLen} })`;
+			break;
+		}
+		case "char":
+			use("char");
+			type = `char(${quote(col)}, { length: ${Number(dbCol?.column_type?.match(/\((\d+)\)/)?.[1] ?? 8)} })`;
+			break;
+		case "text":
+			use("text");
+			type = `text(${quote(col)})`;
+			break;
+		case "mediumtext":
+			use("mediumtext");
+			type = `mediumtext(${quote(col)})`;
+			break;
+		case "longtext":
+			use("longtext");
+			type = `longtext(${quote(col)})`;
+			break;
+		case "datetime": {
+			use("datetime");
+			const fsp = dbCol.column_type.match(/datetime\((\d+)\)/)?.[1];
+			type = fsp
+				? `datetime(${quote(col)}, { fsp: ${Number(fsp)} })`
+				: `datetime(${quote(col)})`;
+			break;
+		}
+		case "timestamp": {
+			use("timestamp");
+			const fsp = dbCol.column_type.match(/timestamp\((\d+)\)/)?.[1];
+			type = fsp
+				? `timestamp(${quote(col)}, { fsp: ${Number(fsp)} })`
+				: `timestamp(${quote(col)})`;
+			break;
+		}
+		case "double":
+			use("double");
+			type = `double(${quote(col)})`;
+			break;
+		case "float":
+			use("float");
+			type = `float(${quote(col)})`;
+			break;
+		case "decimal":
+			use("decimal");
+			type = `decimal(${quote(col)}, { precision: ${Number(decimalMatch?.[1] ?? 10)}, scale: ${Number(decimalMatch?.[2] ?? 0)}, mode: "number" })`;
+			break;
+		case "json":
+			use("json");
+			type = `json(${quote(col)})`;
+			break;
+		case "date":
+			type = `dateAsDate(${quote(col)})`;
+			break;
+		case "time":
+			type = `timeAsDate(${quote(col)})`;
+			break;
+		case "blob":
+		case "tinyblob":
+		case "mediumblob":
+		case "longblob":
+			use("binary");
+			type = `binary(${quote(col)})`;
+			break;
+		default:
+			console.warn(
+				`[schema-gen] WARN unhandled DB type "${dbCol?.data_type}" for ${col}`,
+			);
+			use("varchar");
+			type = `varchar(${quote(col)}, { length: 255 })`;
+	}
+
+	return type;
+}
+
+function modifiers(field, dbCol) {
+	let expr = "";
+	if (dbCol?.extra?.includes("auto_increment") || field.autoIncrement) {
+		expr += `.autoincrement()`;
+	}
+	if (field.isId) {
+		expr += `.primaryKey()`;
+	} else if (dbCol?.column_key === "UNI" && !field.isUnique) {
+		expr += `.unique()`;
+	} else if (field.isUnique) {
+		expr += `.unique()`;
+	}
+	if (!field.optional) {
+		expr += `.notNull()`;
+	}
+	expr += emitDefault(field, dbCol);
+	return expr;
+}
+
+function emitDefault(field, dbCol) {
+	const content = field.defaultContent;
+	if (!content) return "";
+	if (
+		content === "sql`CURRENT_TIMESTAMP`" ||
+		content.includes("CURRENT_TIMESTAMP")
+	) {
+		markSqlUsed();
+		return `.default(sql\`CURRENT_TIMESTAMP\`)`;
+	}
+	if (content === "true" || content === "false") return `.default(${content})`;
+	if (/^-?\d+n$/.test(content)) return `.default(${content})`;
+	if (/^-?\d+$/.test(content)) {
+		return dbCol?.data_type === "bigint"
+			? `.default(${content}n)`
+			: `.default(${content})`;
+	}
+	if (/^-?\d+\.\d+$/.test(content)) return `.default(${content})`;
+	if (
+		(content.startsWith('"') && content.endsWith('"')) ||
+		(content.startsWith("'") && content.endsWith("'"))
+	) {
+		return `.default(${JSON.stringify(content.slice(1, -1))})`;
+	}
+	return `.default(${content})`;
+}
+
+function modelTable(model) {
+	const rows = [];
+	for (const f of model.fields) {
+		const dbCol = colByTable.get(`${model.table}.${f.column}`);
+		if (!dbCol) {
+			const fallback = fallbackColumn(f) + modifiers(f, null);
+			rows.push(`\t${f.fieldName}: ${fallback},`);
+			console.warn(
+				`[schema-gen] WARN ${model.table}.${f.column} (${f.fieldName}) missing in DB, used fallback`,
+			);
+			continue;
+		}
+		rows.push(
+			`\t${f.fieldName}: ${columnExpr(f, dbCol)}${modifiers(f, dbCol)},`,
+		);
+	}
+
+	const uniqueRows = [];
+	if (model.ids) {
+		const idCols = model.ids
+			.map((n) => model.fields.find((f) => f.fieldName === n || f.column === n))
+			.filter(Boolean)
+			.map((f) => `t.${f.fieldName}`);
+		if (idCols.length)
+			uniqueRows.push(`\tprimaryKey({ columns: [${idCols.join(", ")}] }),`);
+	}
+	for (const u of model.uniques) {
+		const cols = u
+			.map((n) => model.fields.find((f) => f.fieldName === n || f.column === n))
+			.filter(Boolean)
+			.map((f) => `t.${f.fieldName}`);
+		if (cols.length)
+			uniqueRows.push(
+				`\tuniqueIndex("${model.table}_${u.join("_")}").on(${cols.join(", ")}),`,
+			);
+	}
+
+	if (uniqueRows.length) {
+		return `export const ${model.name} = mysqlTable(
+	"${model.table}",
+	{
+${rows.join("\n")}
+	},
+	(t) => [
+${uniqueRows.join("\n")}
+	],
+);`;
+	}
+	return `export const ${model.name} = mysqlTable("${model.table}", {
+${rows.join("\n")}
+});`;
+}
+
+function fallbackColumn(field) {
+	const name = field.column;
+	if (field.enumValues) {
+		use("mysqlEnum");
+		return `mysqlEnum(${quote(name)}, ${JSON.stringify(field.enumValues)})`;
+	}
+	if (field.isBoolean || field.prismaType === "Boolean") {
+		use("boolean");
+		return `boolean(${quote(name)})`;
+	}
+	use("varchar");
+	return `varchar(${quote(name)}, { length: 255 })`;
+}
+
+// ---------- Generate file ----------
+const body = models.map(modelTable).join("\n\n");
+
+const IMPORTABLE = [
+	"bigint",
+	"binary",
+	"boolean",
+	"char",
+	"customType",
+	"date",
+	"datetime",
+	"decimal",
+	"double",
+	"float",
+	"int",
+	"json",
+	"longtext",
+	"mediumint",
+	"mediumtext",
+	"mysqlEnum",
+	"mysqlTable",
+	"primaryKey",
+	"smallint",
+	"text",
+	"time",
+	"timestamp",
+	"tinyint",
+	"uniqueIndex",
+	"varchar",
+];
+const importList = IMPORTABLE.filter((b) => used.has(b));
+
+const helpers = [
+	"// MySQL TIME / DATE columns are hydrated as JS Date (epoch 1970-01-01",
+	"// for TIME). Keep this so existing call sites stay unchanged.",
+	"const timeAsDate = customType<{ data: Date; driverData: string }>({",
+	"	dataType() {",
+	'		return "time";',
+	"	},",
+	"	toDriver(value) {",
+	"		return value.toISOString().slice(11, 19);",
+	"	},",
+	"	fromDriver(value) {",
+	// biome-ignore lint/suspicious/noTemplateCurlyInString: code generation template literal
+	"		return new Date(`1970-01-01T${value}Z`);",
+	"	},",
+	"});",
+	"",
+	"const dateAsDate = customType<{ data: Date; driverData: string }>({",
+	"	dataType() {",
+	'		return "date";',
+	"	},",
+	"	toDriver(value) {",
+	"		return value.toISOString().slice(0, 10);",
+	"	},",
+	"	fromDriver(value) {",
+	// biome-ignore lint/suspicious/noTemplateCurlyInString: code generation template literal
+	"		return new Date(`${value}T00:00:00Z`);",
+	"	},",
+	"});",
+	"",
+	"",
+].join("\n");
+
+const sqlImport = usedSql ? 'import { sql } from "drizzle-orm";\n' : "";
+
+const out = `// AUTO-GENERATED by scripts/generate-drizzle-schema.mjs — DO NOT EDIT.
+// TS field names come from the previous src/db/schema.ts; column types from the
+// live MySQL DB. Run \`pnpm db:schema:generate\` after schema/map changes.
+${sqlImport}import {
+${importList.map((b) => `\t${b},`).join("\n")}
+} from "drizzle-orm/mysql-core";
+
+${helpers}${body}
+`;
+
+mkdirSync(dirname(OUT), { recursive: true });
+writeFileSync(OUT, out);
+console.log(`[schema-gen] Wrote ${OUT} (${models.length} tables)`);
@@ -1,29 +1,81 @@
-import * as Sentry from "@sentry/nextjs";
 import { Cron } from "croner";
+import { lt, sql } from "drizzle-orm";
 import { env } from "../src/env";
+import { db, PasswordReset, WebsiteLoginLogs } from "../src/lib/db";
 import { logger } from "../src/lib/logger";
-import { prisma } from "../src/lib/prisma";
-
-function initWorkerSentry(): void {
-	const dsn = process.env.SENTRY_DSN;
-	if (!dsn || process.env.NODE_ENV !== "production") return;
-
-	Sentry.init({
-		dsn,
-		environment: process.env.NODE_ENV,
-		release: process.env.APP_VERSION,
-		tracesSampleRate: 0.05,
-	});
-	logger.info("Sentry initialized for jobs worker", { module: "jobs" });
-}
+import { redis } from "../src/lib/redis";
+import { emulatorOffline, healthDegraded } from "../src/lib/services/alert";
+import { rcon } from "../src/lib/services/rcon";

 function captureWorkerError(err: unknown, context: string): void {
 	logger.error(context, {
 		module: "jobs",
 		err: err instanceof Error ? err.message : String(err),
 	});
-	if (process.env.SENTRY_DSN) {
-		Sentry.captureException(err);
+}
+
+/** In-process cooldown so a flapping probe does not spam Discord/email. */
+const alertCooldownMs = (env.HEALTH_ALERT_COOLDOWN_MIN ?? 15) * 60_000;
+const lastHealthAlertAt = new Map<string, number>();
+
+function canAlert(key: string): boolean {
+	const now = Date.now();
+	const prev = lastHealthAlertAt.get(key) ?? 0;
+	if (now - prev < alertCooldownMs) return false;
+	lastHealthAlertAt.set(key, now);
+	return true;
+}
+
+async function probeHealth(): Promise<{
+	database: boolean;
+	redis: boolean | null;
+	emulator: boolean;
+}> {
+	const database = await db
+		.execute(sql`SELECT 1`)
+		.then(() => true)
+		.catch(() => false);
+
+	let redisOk: boolean | null = null;
+	if (env.REDIS_URL) {
+		if (!redis) {
+			redisOk = false;
+		} else {
+			try {
+				redisOk = (await redis.ping()) === "PONG";
+			} catch {
+				redisOk = false;
+			}
+		}
+	}
+
+	const emulator = await rcon.send("ping", null).catch(() => false);
+	return {
+		database,
+		redis: redisOk,
+		emulator: Boolean(emulator),
+	};
+}
+
+async function checkOpsHealth(): Promise<void> {
+	try {
+		const health = await probeHealth();
+		const degraded =
+			!health.database || health.redis === false || !health.emulator;
+		if (!degraded) return;
+
+		if (!health.emulator && health.database && health.redis !== false) {
+			if (canAlert("emulator")) {
+				await emulatorOffline("jobs-worker RCON ping failed");
+			}
+			return;
+		}
+
+		if (canAlert("health")) {
+			await healthDegraded(health);
+		}
+	} catch (err) {
+		captureWorkerError(err, "Health probe failed");
 	}
 }

@@ -69,12 +121,90 @@ async function backupEmulatorJar(): Promise<void> {
 	}
 }

+/** Optional mysqldump when DB_BACKUP_DIR is set (host must have mysqldump on PATH). */
+async function backupDatabase(): Promise<void> {
+	const backupDir = env.DB_BACKUP_DIR;
+	if (!backupDir || !env.DATABASE_URL) return;
+
+	const { mkdirSync, readdirSync, unlinkSync, existsSync, createWriteStream } =
+		await import("node:fs");
+	const { resolve } = await import("node:path");
+	const { spawn } = await import("node:child_process");
+
+	let parsed: URL;
+	try {
+		parsed = new URL(env.DATABASE_URL);
+	} catch {
+		logger.error("Invalid DATABASE_URL for DB backup", { module: "jobs" });
+		return;
+	}
+
+	if (!existsSync(backupDir)) {
+		mkdirSync(backupDir, { recursive: true });
+	}
+
+	const timestamp = new Date().toISOString().slice(0, 19).replace(/[T:]/g, "-");
+	const dbName =
+		decodeURIComponent(parsed.pathname.replace(/^\//, "")) || "cms";
+	const outFile = resolve(backupDir, `db-${dbName}-${timestamp}.sql`);
+
+	const args = [
+		`-h${parsed.hostname}`,
+		`-P${parsed.port || "3306"}`,
+		`-u${decodeURIComponent(parsed.username)}`,
+		`--single-transaction`,
+		`--routines`,
+		`--databases`,
+		dbName,
+	];
+	if (parsed.password) {
+		args.splice(3, 0, `-p${decodeURIComponent(parsed.password)}`);
+	}
+
+	await new Promise<void>((resolvePromise) => {
+		const child = spawn("mysqldump", args, {
+			stdio: ["ignore", "pipe", "pipe"],
+		});
+		const out = createWriteStream(outFile);
+		child.stdout.pipe(out);
+		let stderr = "";
+		child.stderr.on("data", (chunk: Buffer) => {
+			stderr += chunk.toString();
+		});
+		child.on("error", (err) => {
+			captureWorkerError(err, "mysqldump spawn failed (is it on PATH?)");
+			resolvePromise();
+		});
+		child.on("close", (code) => {
+			out.end();
+			if (code !== 0) {
+				captureWorkerError(
+					new Error(stderr || `mysqldump exit ${code}`),
+					"DB backup failed",
+				);
+			} else {
+				logger.info("Backed up database", { module: "jobs", outFile });
+				const keep = env.DB_BACKUP_KEEP ?? 7;
+				const files = readdirSync(backupDir)
+					.filter((f) => f.startsWith("db-") && f.endsWith(".sql"))
+					.sort()
+					.reverse();
+				for (let i = keep; i < files.length; i++) {
+					const file = files[i];
+					if (file) unlinkSync(resolve(backupDir, file));
+				}
+			}
+			resolvePromise();
+		});
+	});
+}
+
 async function cleanupOldLogs(): Promise<void> {
 	try {
 		const cutoff = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
-		await prisma.websiteLoginLogs.deleteMany({
-			where: { createdAt: { lt: cutoff } },
-		});
+		await db
+			.delete(WebsiteLoginLogs)
+			.where(lt(WebsiteLoginLogs.createdAt, cutoff));
 		logger.info("Cleaned up login logs older than 30 days", { module: "jobs" });
 	} catch (err) {
 		captureWorkerError(err, "Log cleanup failed");
@@ -84,9 +214,7 @@ async function cleanupOldLogs(): Promise<void> {
 async function cleanupOldSessions(): Promise<void> {
 	try {
 		const cutoff = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
-		await prisma.passwordReset.deleteMany({
-			where: { createdAt: { lt: cutoff } },
-		});
+		await db.delete(PasswordReset).where(lt(PasswordReset.createdAt, cutoff));
 		logger.info("Cleaned up expired password reset tokens", {
 			module: "jobs",
 		});
@@ -96,7 +224,6 @@ async function cleanupOldSessions(): Promise<void> {
 }

 async function main() {
-	initWorkerSentry();
 	logger.info("Worker started", { module: "jobs" });

 	if (env.EMULATOR_JAR_PATH && env.EMULATOR_BACKUP_DIR) {
@@ -108,6 +235,15 @@ async function main() {
 		});
 	}

+	if (env.DB_BACKUP_DIR) {
+		new Cron("30 3 * * *", () => {
+			backupDatabase().catch((e) => captureWorkerError(e, "DB backup error"));
+		});
+		logger.info("Scheduled: mysqldump DB backup (daily 03:30)", {
+			module: "jobs",
+		});
+	}
+
 	new Cron("0 4 * * *", () => {
 		Promise.all([cleanupOldLogs(), cleanupOldSessions()]).catch((e) =>
 			captureWorkerError(e, "Cleanup error"),
@@ -115,10 +251,16 @@ async function main() {
 	});
 	logger.info("Scheduled: old data cleanup (daily 04:00)", { module: "jobs" });

+	new Cron("*/5 * * * *", () => {
+		checkOpsHealth().catch((e) => captureWorkerError(e, "Health check error"));
+	});
+	logger.info("Scheduled: ops health probe (every 5 min)", { module: "jobs" });
+
 	await Promise.all([
 		backupEmulatorJar(),
 		cleanupOldLogs(),
 		cleanupOldSessions(),
+		checkOpsHealth(),
 	]);
 }

@@ -0,0 +1,53 @@
+const fs = require("node:fs");
+const JSON5 = require("json5");
+
+const exampleFile = process.argv[2];
+const targetFile = process.argv[3];
+
+if (!exampleFile || !targetFile) {
+	process.exit(1);
+}
+
+function deepMerge(target, source) {
+	const result = { ...target };
+	for (const key of Object.keys(source)) {
+		if (
+			source[key] !== null &&
+			typeof source[key] === "object" &&
+			!Array.isArray(source[key])
+		) {
+			result[key] = deepMerge(target[key] || {}, source[key]);
+		} else {
+			if (!(key in result)) {
+				result[key] = source[key];
+			}
+		}
+	}
+	return result;
+}
+
+let example;
+try {
+	const content = fs.readFileSync(exampleFile, "utf-8");
+	example = JSON5.parse(content);
+} catch {
+	process.exit(1);
+}
+
+let current = {};
+try {
+	if (fs.existsSync(targetFile)) {
+		const content = fs.readFileSync(targetFile, "utf-8");
+		current = JSON5.parse(content);
+	}
+} catch {
+	current = {};
+}
+
+const merged = deepMerge(current, example);
+
+const isJson5 = targetFile.endsWith(".json5");
+const output = isJson5
+	? JSON5.stringify(merged, null, 4)
+	: JSON.stringify(merged, null, 4);
+fs.writeFileSync(targetFile, `${output}\n`);
@@ -16,7 +16,8 @@ import {
 	randomBytes,
 	timingSafeEqual,
 } from "node:crypto";
-import { prisma } from "../src/lib/prisma";
+import { eq, isNotNull } from "drizzle-orm";
+import { db, User } from "../src/lib/db";

 function getKey(appKey: string): Buffer {
 	const raw = appKey.startsWith("base64:")
@@ -84,10 +85,10 @@ async function main() {
 	}
 	const key = getKey(appKey);

-	const users = await prisma.user.findMany({
-		where: { twoFactorSecret: { not: null } },
-		select: { id: true, twoFactorSecret: true },
-	});
+	const users = await db
+		.select({ id: User.id, twoFactorSecret: User.twoFactorSecret })
+		.from(User)
+		.where(isNotNull(User.twoFactorSecret));

 	console.log(`Found ${users.length} user(s) with a twoFactorSecret.`);

@@ -107,10 +108,10 @@ async function main() {
 		try {
 			const plaintext = decryptCbc(user.twoFactorSecret, key);
 			const reEncrypted = encryptGcm(plaintext, key);
-			await prisma.user.update({
-				where: { id: user.id },
-				data: { twoFactorSecret: reEncrypted },
-			});
+			await db
+				.update(User)
+				.set({ twoFactorSecret: reEncrypted })
+				.where(eq(User.id, user.id));
 			console.log(`  [OK]   User ${user.id} — migrated`);
 			migrated++;
 		} catch (err) {
@@ -125,12 +126,10 @@ async function main() {
 	if (errors > 0) process.exit(1);
 }

-main()
-	.catch((err) => {
-		console.error(err);
-		process.exit(1);
-	})
-	.finally(() => prisma.$disconnect());
+main().catch((err) => {
+	console.error(err);
+	process.exit(1);
+});

 /* ---- helpers (mirrored from laravel-encrypter.ts) ---- */

@@ -5,7 +5,7 @@ import { describe, expect, it } from "vitest";
 describe("radio columns migration", () => {
 	it("adds every column idempotently for partially migrated databases", () => {
 		const sql = readFileSync(
-			resolve("prisma/migrations/0009_radio_contests_giveaways_columns.sql"),
+			resolve("drizzle/migrations/0009_radio_contests_giveaways_columns.sql"),
 			"utf8",
 		);
 		const additions = sql.match(/ADD COLUMN(?! IF NOT EXISTS)/gi) ?? [];
@@ -1,16 +0,0 @@
-import * as Sentry from "@sentry/nextjs";
-import { redactSentryEvent } from "@/lib/sentry-redact";
-
-const dsn = process.env.SENTRY_DSN;
-
-if (dsn) {
-	Sentry.init({
-		dsn,
-		environment: process.env.NODE_ENV,
-		release: process.env.APP_VERSION,
-		tracesSampleRate: process.env.NODE_ENV === "production" ? 0.1 : 1.0,
-		enabled: process.env.NODE_ENV === "production",
-		ignoreErrors: ["AbortError", "NEXT_REDIRECT", "NEXT_NOT_FOUND"],
-		beforeSend: redactSentryEvent,
-	});
-}
@@ -1,21 +0,0 @@
-import * as Sentry from "@sentry/nextjs";
-import { redactSentryEvent } from "@/lib/sentry-redact";
-
-const dsn = process.env.SENTRY_DSN;
-
-if (dsn) {
-	Sentry.init({
-		dsn,
-		environment: process.env.NODE_ENV,
-		release: process.env.APP_VERSION,
-		tracesSampleRate: process.env.NODE_ENV === "production" ? 0.1 : 1.0,
-		enabled: process.env.NODE_ENV === "production",
-		ignoreErrors: [
-			"Network request failed",
-			"AbortError",
-			"NEXT_REDIRECT",
-			"NEXT_NOT_FOUND",
-		],
-		beforeSend: redactSentryEvent,
-	});
-}
@@ -1,66 +0,0 @@
-# ===========================================================================
-# Polaris Emulator — reference config.ini
-# Copy this to /var/www/emulator/Emulator/target/config.ini and fill in the
-# values marked CHANGE_ME. The emulator reads this file on startup.
-# Full guide: https://github.com/duckietm/Complete-Retro-on-Ubuntu
-# ===========================================================================
-
-# ---- Database configuration ----
-db.hostname=127.0.0.1
-db.port=3306
-db.database=habbo                         # DB name (shared with the CMS)
-db.username=root                          # Username
-db.password=CHANGE_ME                     # Password
-db.params=?characterEncoding=utf8&useSSL=false&serverTimezone=Europe/Amsterdam
-db.pool.minsize=25
-db.pool.maxsize=100
-db.pool.connection_timeout_ms=10000
-db.pool.idle_timeout_ms=600000
-db.pool.max_lifetime_ms=1800000
-db.pool.validation_timeout_ms=5000
-db.pool.leak_detection_ms=20000           # set to 0 to disable leak detection
-
-# ---- Game configuration ----
-# Host IP. Use 0.0.0.0 in most cases. Use 127.0.0.1 for LAN only.
-game.host=0.0.0.0
-game.port=3000
-
-# ---- RCON configuration ----
-# Leave host at 127.0.0.1 if the CMS runs on the same server as the emulator.
-rcon.host=127.0.0.1
-rcon.port=3001
-rcon.allowed=127.0.0.1;127.0.0.2
-
-# ---- Nitro secure runtime assets (disabled by default) ----
-nitro.secure.assets.enabled=false
-nitro.secure.api.enabled=false
-nitro.secure.session_ttl_sec=900
-nitro.secure.config.root=
-nitro.secure.gamedata.root=
-# Set a persistent secret when using Cloudflare or multiple backend requests.
-nitro.secure.master_key=change-me-to-a-long-random-secret
-
-# ---- Login ----
-login.remember.enabled=true
-login.remember.duration.days=30
-# Optional: set a persistent remember-me JWT secret here.
-login.remember.jwt.secret=
-login.news.limit=5
-
-# ---- Secure runtime ECDH session TTL in seconds ----
-# (kept for compatibility; unused when secure assets are disabled)
-
-# ---- WebSockets (Nitro client) ----
-ws.enabled=true
-ws.host=0.0.0.0
-ws.port=2096
-# Header used to obtain the real client IP when behind a proxy
-# (usually X-Forwarded-For, or CF-Connecting-IP behind Cloudflare).
-ws.ip.header=X-Forwarded-For
-
-# ---- Console / emulator_settings ----
-# Run these SQL statements ONCE, after importing the emulator database:
-#   USE habbo;
-#   UPDATE emulator_settings SET `value` = '0' WHERE `key` = 'console.mode';
-#   UPDATE emulator_settings SET `value` = 'MY_DOMAIN.COM,*.MY_DOMAIN.COM,localhost,127.0.0.1' WHERE `key` = 'websockets.whitelist';
-# console.mode MUST be 0 and the whitelist MUST match your domain.
@@ -1,17 +0,0 @@
-#!/bin/sh
-# Launcher for the Polaris emulator.
-# Place at /var/www/emulator/Emulator/target/emulator and chmod +x.
-# Update the JAR name to match the version built by `mvn clean package`.
-
-file_name_emulator=emulator.log
-current_time=$(date "+%H%M_%d-%m-%Y")
-file_name=$file_name_emulator.$current_time
-
-# Rotate the previous log
-mkdir -p /var/log/emu
-mv /var/log/emu/emulator.log /var/log/emu/$file_name 2>/dev/null || true
-
-# -Xmx4096m = 4 GB. 1 GB=1024, 2 GB=2048, 3 GB=3072, 4 GB=4096
-java -Dfile.encoding=UTF8 -Xmx4096m \
-  -jar /var/www/emulator/Emulator/target/Habbo-*-jar-with-dependencies.jar \
-  >/var/log/emu/emulator.log
@@ -1,25 +0,0 @@
-[Unit]
-Description=Habbo Emulator
-
-# Make sure the database has started before the emulator can start
-After=mariadb.service
-Requires=mariadb.service
-
-# If you want to run as a less privileged account, change User below.
-# Make sure that account has the right permissions on the working directory and target folders.
-[Service]
-User=root
-
-# Working directory where config.ini and the JAR live
-WorkingDirectory=/var/www/emulator/Emulator/target
-
-# The launcher script we created below. It is a shell wrapper that calls the JAR.
-ExecStart=/var/www/emulator/Emulator/target/emulator
-
-SuccessExitStatus=143
-TimeoutStopSec=10
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
@@ -1,8 +0,0 @@
-{
-  "distObfuscationEnabled": false,
-  "secureAssetsEnabled": false,
-  "secureApiEnabled": false,
-  "apiBaseUrl": "https://MY_DOMAIN:2096",
-  "plainConfigBaseUrl": "https://MY_DOMAIN/configuration/",
-  "plainGamedataBaseUrl": "https://MY_DOMAIN/gamedata/"
-}
@@ -1,75 +0,0 @@
-{
-  "socket.url": "wss://MY_DOMAIN.COM:2096",
-  "crypto.ws.enabled": false,
-  "crypto.ws.signing.enabled": false,
-  "crypto.ws.signing.public_key": "",
-  "api.url": "https://MY_DOMAIN.COM:2096",
-  "asset.url": "https://MY_DOMAIN.COM/gamedata",
-  "image.library.url": "http://MY_DOMAIN.COM/gamedata/c_images/",
-  "hof.furni.url": "https://MY_DOMAIN.COM",
-  "images.url": "${asset.url}/images",
-  "gamedata.url": "${asset.url}",
-  "sounds.url": "${asset.url}/sounds/%sample%.mp3",
-  "external.texts.url": [
-    "${gamedata.url}/config/ExternalTexts.json?v=1",
-    "${gamedata.url}/config/UITexts.json?v=1"
-  ],
-  "external.samples.url": "${gamedata.url}/sounds/sound_machine_sample_%sample%.mp3",
-  "furnidata.url": "${gamedata.url}/config/FurnitureData.json?v=1",
-  "productdata.url": "${gamedata.url}/config/ProductData.json?v=1",
-  "avatar.actions.url": "${gamedata.url}/config/HabboAvatarActions.json?v=1",
-  "avatar.figuredata.url": "${gamedata.url}/config/FigureData.json?v=1",
-  "avatar.figuremap.url": "${gamedata.url}/config/FigureMap.json?v=1",
-  "avatar.effectmap.url": "${gamedata.url}/config/EffectMap.json?v=1",
-  "avatar.asset.url": "${asset.url}/clothes/%libname%.nitro",
-  "avatar.asset.effect.url": "${asset.url}/effect/%libname%.nitro",
-  "furni.asset.url": "${asset.url}/furniture/%libname%.nitro",
-  "furni.asset.icon.url": "http://MY_DOMAIN.COM/gamedata/icons/%libname%%param%_icon.png",
-  "pet.asset.url": "${asset.url}/pets/%libname%.nitro",
-  "generic.asset.url": "${asset.url}/bundled/generic/%libname%.nitro",
-  "room.asset.url": "${asset.url}/room/%libname%/%libname%.json",
-  "badge.asset.url": "${image.library.url}album1584/%badgename%.gif",
-  "badge.asset.group.url": "http://MY_DOMAIN.COM/habbo-imaging/badge/%badgedata%",
-  "badge.asset.group.external.url": "",
-  "badge.asset.grouparts.url": "https://MY_DOMAIN.COM/gamedata/badgeparts/badgepart_%part%.png",
-  "furni.rotation.bounce.steps": 20,
-  "furni.rotation.bounce.height": 0.0625,
-  "room.color.skip.transition": false,
-  "enable.avatar.arrow": false,
-  "system.animation.fps": 60,
-  "system.limits.fps": false,
-  "system.dispatcher.log": false,
-  "system.packet.log": false,
-  "system.pong.manually": true,
-  "system.pong.interval.ms": 20000,
-  "room.color.skip.transition": true,
-  "user.badges.group.slot.enabled": true,
-  "timezone.settings": "Europe/Amsterdam",
-  "login.screen.enabled": true,
-  "login.endpoint": "${api.url}/api/auth/login",
-  "login.register.endpoint": "${api.url}/api/auth/register",
-  "login.forgot.endpoint": "${api.url}/api/auth/forgot-password",
-  "login.logout.endpoint": "${api.url}/api/auth/logout",
-  "login.health.endpoint": "${api.url}/api/auth/health",
-  "login.check-email.endpoint": "${api.url}/api/auth/check-email",
-  "login.check-username.endpoint": "${api.url}/api/auth/check-username",
-  "login.room_templates.endpoint": "${api.url}/api/auth/room-templates",
-  "login.remember.endpoint": "${api.url}/api/auth/remember",
-  "login.server_key.endpoint": "${api.url}/api/auth/server-key",
-  "login.sso-token.endpoint": "${api.url}/api/auth/sso-token",
-  "login.refresh.endpoint": "${api.url}/api/auth/refresh",
-  "badges.custom.list.endpoint": "${api.url}/api/badges/custom",
-  "badges.custom.create.endpoint": "${api.url}/api/badges/custom",
-  "badges.custom.update.endpoint": "${api.url}/api/badges/custom/%badgeId%",
-  "badges.custom.delete.endpoint": "${api.url}/api/badges/custom/%badgeId%",
-  "badges.custom.texts.endpoint": "${api.url}/api/badges/custom/texts",
-  "account.change-password.endpoint": "${api.url}/api/auth/change-password",
-  "account.change-email.endpoint": "${api.url}/api/auth/change-email",
-  "account.change-username.endpoint": "${api.url}/api/auth/change-username",
-  "login.health.method": "GET",
-  "login.news.url": "${asset.url}/news/news.json",
-  "login.turnstile.enabled": false,
-  "login.turnstile.sitekey": "",
-  "avatar.mandatory.libraries": ["bd:1", "li:0"],
-  "avatar.mandatory.effect.libraries": ["dance.1", "dance.2", "dance.3", "dance.4"]
-}
@@ -1,38 +0,0 @@
-{
-  "image.library.notifications.url": "${image.library.url}notifications/%image%.png",
-  "achievements.images.url": "${image.library.url}Quests/%image%.png",
-  "camera.url": "https://MY_DOMAIN.COM/camera/photo",
-  "thumbnails.url": "https://MY_DOMAIN.COM/camera/photo/thumb/%thumbnail%.png",
-  "url.prefix": "",
-  "habbopages.url": "/gamedata/habbopages/",
-  "group.homepage.url": "${url.prefix}/groups/%groupid%/id",
-  "guide.help.alpha.groupid": 0,
-  "chat.viewer.height.percentage": 0.4,
-  "widget.dimmer.colorwheel": false,
-  "avatar.wardrobe.max.slots": 10,
-  "user.badges.max.slots": 5,
-  "camera.publish.disabled": false,
-  "hc.disabled": false,
-  "badge.descriptions.enabled": true,
-  "motto.max.length": 38,
-  "bot.name.max.length": 15,
-  "wired.action.bot.talk.to.avatar.max.length": 64,
-  "wired.action.bot.talk.max.length": 64,
-  "wired.action.chat.max.length": 100,
-  "wired.action.kick.from.room.max.length": 100,
-  "wired.action.mute.user.max.length": 100,
-  "game.center.enabled": false,
-  "catalog.style.new": true,
-  "show.google.ads": false,
-  "loginview": {
-    "images": {
-      "background": "${asset.url}/c_images/reception/stretch_blue.png",
-      "background.colour": "#6eadc8",
-      "sun": "${asset.url}/c_images/reception/sun.png",
-      "drape": "${asset.url}/c_images/reception/drape.png",
-      "left": "${asset.url}/c_images/reception/ts.png",
-      "right": "${asset.url}/c_images/reception/US_right.png",
-      "right.repeat": "${asset.url}/c_images/reception/US_top_right.png"
-    }
-  }
-}
@@ -0,0 +1,98 @@
+// @ts-nocheck
+
+import { redirect } from "next/navigation";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermission } from "@/lib/admin/guard";
+import { logger } from "@/lib/logger";
+import { ActionError } from "@/lib/safe-action-shared";
+import { logStaffActivity } from "@/lib/services/staff-activity";
+import { createAd, deleteAd } from "./admin-ads";
+
+const { insertValues, deleteWhere } = vi.hoisted(() => {
+	const insertValues = vi.fn().mockResolvedValue([{ insertId: 1 }]);
+	const deleteWhere = vi.fn().mockResolvedValue([{ affectedRows: 1 }]);
+	return { insertValues, deleteWhere };
+});
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({ PERMS: { PAGES_EDIT: "pages.edit" } }));
+vi.mock("@/lib/db", () => ({
+	db: {
+		insert: vi.fn(() => ({ values: insertValues })),
+		update: vi.fn(() => ({
+			set: vi.fn(() => ({
+				where: vi.fn().mockResolvedValue([{ affectedRows: 1 }]),
+			})),
+		})),
+		delete: vi.fn(() => ({ where: deleteWhere })),
+	},
+	WebsiteAds: { id: "id" },
+}));
+vi.mock("@/lib/logger", () => ({ logger: { error: vi.fn() } }));
+vi.mock("@/lib/safe-action", () => ({
+	adminAction: vi.fn((_o: unknown, f: (...args: unknown[]) => unknown) => f),
+}));
+vi.mock("@/lib/safe-action-shared", () => ({
+	ActionError: class extends Error {},
+	actionOk: vi.fn(() => "ok"),
+}));
+vi.mock("@/lib/services/staff-activity", () => ({ logStaffActivity: vi.fn() }));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+vi.mock("next/navigation", () => ({ redirect: vi.fn() }));
+
+const staff = { id: 1, rank: 7, username: "admin" };
+const fakeForm = (data: Record<string, string>) => ({
+	get: (k: string) => data[k] ?? null,
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(requirePermission).mockResolvedValue(staff as never);
+	insertValues.mockResolvedValue([{ insertId: 1 }]);
+	deleteWhere.mockResolvedValue([{ affectedRows: 1 }]);
+});
+
+describe("createAd", () => {
+	it("creates ad and redirects", async () => {
+		await createAd(
+			fakeForm({ image: "https://example.com/ad.png" }) as unknown as FormData,
+		);
+		expect(insertValues).toHaveBeenCalled();
+		expect(logStaffActivity).toHaveBeenCalled();
+		expect(redirect).toHaveBeenCalledWith("/admin/ads");
+	});
+
+	it("returns early when image empty", async () => {
+		await createAd(fakeForm({ image: "" }) as unknown as FormData);
+		expect(insertValues).not.toHaveBeenCalled();
+	});
+
+	it("logs error on db failure", async () => {
+		insertValues.mockRejectedValue(new Error("db"));
+		await createAd(fakeForm({ image: "x" }) as unknown as FormData);
+		expect(logger.error).toHaveBeenCalled();
+	});
+});
+
+describe("deleteAd", () => {
+	it("deletes ad and returns ok", async () => {
+		const h = deleteAd as unknown as (ctx: {
+			data: { id: bigint };
+			session: { user: { id: string } };
+		}) => Promise<string>;
+		expect(
+			await h({ data: { id: BigInt(99) }, session: { user: { id: "1" } } }),
+		).toBe("ok");
+	});
+
+	it("throws ActionError when not found", async () => {
+		deleteWhere.mockResolvedValue([{ affectedRows: 0 }]);
+		const h = deleteAd as unknown as (ctx: {
+			data: { id: bigint };
+			session: { user: { id: string } };
+		}) => Promise<string>;
+		await expect(
+			h({ data: { id: BigInt(999) }, session: { user: { id: "1" } } }),
+		).rejects.toThrow(ActionError);
+	});
+});
@@ -1,13 +1,15 @@
 "use server";

+import { eq } from "drizzle-orm";
+import type { ResultSetHeader } from "mysql2";
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 import { z } from "zod";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, WebsiteAds } from "@/lib/db";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { logger } from "@/lib/logger";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { adminAction } from "@/lib/safe-action";
 import { ActionError, actionOk } from "@/lib/safe-action-shared";
 import { logStaffActivity } from "@/lib/services/staff-activity";
@@ -25,15 +27,17 @@ export async function createAd(formData: FormData): Promise<void> {

 	const now = new Date();
 	try {
-		const ad = await prisma.websiteAds.create({
-			data: { image, createdAt: now, updatedAt: now },
-		});
+		const [result] = (await db.insert(WebsiteAds).values({
+			image,
+			createdAt: now,
+			updatedAt: now,
+		})) as unknown as [ResultSetHeader];
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "ad_create",
-			description: `Created advertisement #${ad.id} (${image})`,
+			description: `Created advertisement #${result.insertId} (${image})`,
 			targetType: "website_ad",
-			targetId: Number(ad.id),
+			targetId: Number(result.insertId),
 		});
 	} catch (err) {
 		logger.error("Action failed: createAd", {
@@ -58,10 +62,10 @@ export async function updateAd(formData: FormData): Promise<void> {
 	if (!image) return;

 	try {
-		await prisma.websiteAds.update({
-			where: { id },
-			data: { image, updatedAt: new Date() },
-		});
+		await db
+			.update(WebsiteAds)
+			.set({ image, updatedAt: new Date() })
+			.where(eq(WebsiteAds.id, id));
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "ad_update",
@@ -92,8 +96,14 @@ export const deleteAd = adminAction(
 	async (ctx) => {
 		const id = ctx.data.id;
 		try {
-			await prisma.websiteAds.delete({ where: { id } });
-		} catch {
+			const [result] = (await db
+				.delete(WebsiteAds)
+				.where(eq(WebsiteAds.id, id))) as unknown as [ResultSetHeader];
+			if (!result.affectedRows) {
+				throw new ActionError("Advertisement not found");
+			}
+		} catch (err) {
+			if (err instanceof ActionError) throw err;
 			throw new ActionError("Advertisement not found");
 		}
 		await logStaffActivity({
@@ -115,7 +125,7 @@ export async function deleteAdForm(formData: FormData): Promise<void> {
 	if (!id) return;

 	try {
-		await prisma.websiteAds.delete({ where: { id } });
+		await db.delete(WebsiteAds).where(eq(WebsiteAds.id, id));
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "ad_delete",
@@ -0,0 +1,47 @@
+// @ts-nocheck
+import { revalidatePath } from "next/cache";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermission } from "@/lib/admin/guard";
+import { rcon } from "@/lib/services/rcon";
+import { sendHotelAlert } from "./admin-alerts";
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({
+	PERMS: { NOTIFICATIONS_EDIT: "notifications.edit" },
+}));
+vi.mock("@/lib/db", () => ({
+	db: {
+		insert: vi.fn(() => ({ values: vi.fn().mockResolvedValue([]) })),
+	},
+	AlertLogs: {},
+}));
+vi.mock("@/lib/services/rcon", () => ({ rcon: { send: vi.fn() } }));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+
+const fakeForm = (data: Record<string, string>) => ({
+	get: (key: string) => data[key] ?? null,
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(requirePermission).mockResolvedValue({
+		id: 1,
+		rank: 7,
+		username: "admin",
+	} as never);
+});
+
+describe("sendHotelAlert", () => {
+	it("sends hotel alert and revalidates", async () => {
+		await sendHotelAlert(
+			fakeForm({ message: "Hello!" }) as unknown as FormData,
+		);
+		expect(rcon.send).toHaveBeenCalledWith("hotelalert", { message: "Hello!" });
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/alerts");
+	});
+
+	it("returns early when message is empty", async () => {
+		await sendHotelAlert(fakeForm({ message: "" }) as unknown as FormData);
+		expect(rcon.send).not.toHaveBeenCalled();
+	});
+});
@@ -1,7 +1,9 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { AlertLogs, db } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
 import { rcon } from "@/lib/services/rcon";

@@ -29,3 +31,17 @@ export async function sendHotelAlert(formData: FormData): Promise<void> {

 	revalidatePath("/admin/alerts");
 }
+
+/** Mark every unread ops alert as read. */
+export async function markAllAlertsRead(): Promise<void> {
+	await requirePermission(PERMS.NOTIFICATIONS_VIEW);
+	try {
+		await db
+			.update(AlertLogs)
+			.set({ isRead: true, updatedAt: new Date() })
+			.where(eq(AlertLogs.isRead, false));
+	} catch {
+		/* ignore */
+	}
+	revalidatePath("/admin/alerts");
+}
@@ -1,10 +1,11 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, WebsiteStaffApplications } from "@/lib/db";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";

 export async function dismissApplication(formData: FormData): Promise<void> {
 	await requirePermission(PERMS.USERS_EDIT);
@@ -12,7 +13,9 @@ export async function dismissApplication(formData: FormData): Promise<void> {
 	if (!id) return;

 	try {
-		await prisma.websiteStaffApplications.delete({ where: { id } });
+		await db
+			.delete(WebsiteStaffApplications)
+			.where(eq(WebsiteStaffApplications.id, id));
 	} catch {
 		// already gone / no DB — nothing to do
 	}
@@ -1,25 +1,31 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 import { requirePermission } from "@/lib/admin/guard";
+import {
+	db,
+	WebsiteArticleComments,
+	WebsiteArticleReactions,
+	WebsiteArticles,
+} from "@/lib/db";
 import { slugify } from "@/lib/format";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";

 async function uniqueSlug(title: string): Promise<string> {
 	const base = slugify(title);
 	let slug = base;
 	let n = 2;
-	while (
-		await prisma.websiteArticles.findUnique({
-			where: { slug },
-			select: { id: true },
-		})
-	) {
+	for (;;) {
+		const [existing] = await db
+			.select({ id: WebsiteArticles.id })
+			.from(WebsiteArticles)
+			.where(eq(WebsiteArticles.slug, slug))
+			.limit(1);
+		if (!existing) return slug;
 		slug = `${base}-${n++}`;
 	}
-	return slug;
 }

 export async function createArticle(formData: FormData): Promise<void> {
@@ -41,17 +47,15 @@ export async function createArticle(formData: FormData): Promise<void> {

 	try {
 		const now = new Date();
-		await prisma.websiteArticles.create({
-			data: {
-				slug: rawSlug ? await uniqueSlug(rawSlug) : await uniqueSlug(title),
-				title: title.slice(0, 255),
-				shortStory: shortStory.slice(0, 255),
-				fullStory,
-				image: image.slice(0, 255),
-				userId: staff.id,
-				createdAt: now,
-				updatedAt: now,
-			},
+		await db.insert(WebsiteArticles).values({
+			slug: rawSlug ? await uniqueSlug(rawSlug) : await uniqueSlug(title),
+			title: title.slice(0, 255),
+			shortStory: shortStory.slice(0, 255),
+			fullStory,
+			image: image.slice(0, 255),
+			userId: staff.id,
+			createdAt: now,
+			updatedAt: now,
 		});
 	} catch {
 		// Database error — re-render unchanged with error.
@@ -67,9 +71,9 @@ export async function updateArticle(formData: FormData): Promise<void> {
 	const id = BigInt(String(formData.get("id")));
 	const rawSlug = String(formData.get("slug") ?? "").trim();
 	try {
-		await prisma.websiteArticles.update({
-			where: { id },
-			data: {
+		await db
+			.update(WebsiteArticles)
+			.set({
 				title: String(formData.get("title") ?? "")
 					.normalize("NFC")
 					.trim()
@@ -87,8 +91,8 @@ export async function updateArticle(formData: FormData): Promise<void> {
 					.trim()
 					.slice(0, 255),
 				updatedAt: new Date(),
-			},
-		});
+			})
+			.where(eq(WebsiteArticles.id, id));
 	} catch {
 		redirect("/admin/articles?error=Update failed");
 	}
@@ -100,11 +104,15 @@ export async function deleteArticle(formData: FormData): Promise<void> {
 	await requirePermission(PERMS.NEWS_EDIT);
 	const id = BigInt(String(formData.get("id")));
 	try {
-		await prisma.$transaction([
-			prisma.websiteArticleReactions.deleteMany({ where: { articleId: id } }),
-			prisma.websiteArticleComments.deleteMany({ where: { articleId: id } }),
-			prisma.websiteArticles.delete({ where: { id } }),
-		]);
+		await db.transaction(async (tx) => {
+			await tx
+				.delete(WebsiteArticleReactions)
+				.where(eq(WebsiteArticleReactions.articleId, id));
+			await tx
+				.delete(WebsiteArticleComments)
+				.where(eq(WebsiteArticleComments.articleId, id));
+			await tx.delete(WebsiteArticles).where(eq(WebsiteArticles.id, id));
+		});
 	} catch {
 		redirect("/admin/articles?error=Delete failed");
 	}
@@ -1,9 +1,10 @@
 "use server";

+import { and, eq, max } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, UsersBadges } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { rcon } from "@/lib/services/rcon";

 export async function giveBadge(formData: FormData): Promise<void> {
@@ -23,19 +24,20 @@ export async function giveBadge(formData: FormData): Promise<void> {
 	// users_badges has no unique (user_id, badge_code) constraint, so guard
 	// against duplicates and compute the next free slot ourselves.
 	try {
-		const existing = await prisma.usersBadges.findFirst({
-			where: { userId, badgeCode: code },
-			select: { id: true },
-		});
+		const [existing] = await db
+			.select({ id: UsersBadges.id })
+			.from(UsersBadges)
+			.where(
+				and(eq(UsersBadges.userId, userId), eq(UsersBadges.badgeCode, code)),
+			)
+			.limit(1);
 		if (!existing) {
-			const max = await prisma.usersBadges.aggregate({
-				where: { userId },
-				_max: { slotId: true },
-			});
-			const slotId = (max._max.slotId ?? 0) + 1;
-			await prisma.usersBadges.create({
-				data: { userId, slotId, badgeCode: code },
-			});
+			const [agg] = await db
+				.select({ maxSlot: max(UsersBadges.slotId) })
+				.from(UsersBadges)
+				.where(eq(UsersBadges.userId, userId));
+			const slotId = (agg?.maxSlot ?? 0) + 1;
+			await db.insert(UsersBadges).values({ userId, slotId, badgeCode: code });
 		}
 	} catch {
 		// Best-effort: the RCON grant already succeeded for online users.
@@ -0,0 +1,84 @@
+// @ts-nocheck
+import { revalidatePath } from "next/cache";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermissionRateLimited } from "@/lib/admin/guard";
+import { rcon } from "@/lib/services/rcon";
+import { createBan, liftBan } from "./admin-bans";
+
+const { selectLimit, insertValues, deleteWhere } = vi.hoisted(() => {
+	const selectLimit = vi.fn();
+	const insertValues = vi.fn().mockResolvedValue([{ insertId: 1 }]);
+	const deleteWhere = vi.fn().mockResolvedValue([{ affectedRows: 1 }]);
+	return { selectLimit, insertValues, deleteWhere };
+});
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermissionRateLimited: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({ PERMS: { USERS_BAN: "users.ban" } }));
+vi.mock("@/lib/db", () => ({
+	db: {
+		select: vi.fn(() => ({
+			from: vi.fn(() => ({
+				where: vi.fn(() => ({
+					limit: selectLimit,
+				})),
+			})),
+		})),
+		insert: vi.fn(() => ({ values: insertValues })),
+		delete: vi.fn(() => ({ where: deleteWhere })),
+	},
+	Ban: { id: "id", userId: "userId" },
+	User: { id: "id", username: "username" },
+}));
+vi.mock("@/lib/services/rcon", () => ({ rcon: { disconnectUser: vi.fn() } }));
+vi.mock("@/lib/services/staff-activity", () => ({ logStaffActivity: vi.fn() }));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+
+const staff = { id: 1, rank: 7, username: "admin" };
+const fakeForm = (data: Record<string, string>) => ({
+	get: (key: string) => data[key] ?? null,
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(requirePermissionRateLimited).mockResolvedValue(staff as never);
+	selectLimit.mockResolvedValue([{ username: "baduser" }]);
+	insertValues.mockResolvedValue([{ insertId: 1 }]);
+	deleteWhere.mockResolvedValue([{ affectedRows: 1 }]);
+});
+
+describe("createBan", () => {
+	it("creates a ban for valid inputs", async () => {
+		await createBan(
+			fakeForm({
+				userId: "42",
+				reason: "Spam",
+				hours: "24",
+				type: "account",
+			}) as unknown as FormData,
+		);
+		expect(insertValues).toHaveBeenCalledWith(
+			expect.objectContaining({ userId: 42, type: "account" }),
+		);
+		expect(rcon.disconnectUser).toHaveBeenCalledWith(42, "baduser");
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/bans");
+	});
+
+	it("returns early when userId is invalid", async () => {
+		await createBan(
+			fakeForm({
+				userId: "0",
+				hours: "1",
+				type: "account",
+			}) as unknown as FormData,
+		);
+		expect(insertValues).not.toHaveBeenCalled();
+	});
+});
+
+describe("liftBan", () => {
+	it("deletes ban and revalidates", async () => {
+		await liftBan(fakeForm({ id: "42" }) as unknown as FormData);
+		expect(deleteWhere).toHaveBeenCalled();
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/bans");
+	});
+});
@@ -1,14 +1,13 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
-import type { $Enums } from "@/generated/prisma/client";
 import { requirePermissionRateLimited } from "@/lib/admin/guard";
+import { Ban, db, User } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";

-type BanType = $Enums.bans_type;
 const BAN_TYPES: ReadonlySet<string> = new Set([
 	"account",
 	"ip",
@@ -31,23 +30,22 @@ export async function createBan(formData: FormData): Promise<void> {
 	// Emulator convention: banExpire 0 = permanent (not a far-future timestamp).
 	const banExpire = hours > 0 ? now + Math.floor(hours) * 3600 : 0;

-	const user = await prisma.user.findUnique({
-		where: { id: userId },
-		select: { username: true },
-	});
+	const [user] = await db
+		.select({ username: User.username })
+		.from(User)
+		.where(eq(User.id, userId))
+		.limit(1);

-	await prisma.ban.create({
-		data: {
-			userId,
-			ip: "",
-			machineId: "",
-			userStaffId: staff.id,
-			timestamp: now,
-			banExpire,
-			banReason: reason,
-			type: type as BanType,
-			cfhTopic: -1,
-		},
+	await db.insert(Ban).values({
+		userId,
+		ip: "",
+		machineId: "",
+		userStaffId: staff.id,
+		timestamp: now,
+		banExpire,
+		banReason: reason,
+		type: type as "account" | "ip" | "machine" | "super",
+		cfhTopic: -1,
 	});

 	if (user) await rcon.disconnectUser(userId, user.username);
@@ -65,7 +63,7 @@ export async function liftBan(formData: FormData): Promise<void> {
 	const staff = await requirePermissionRateLimited(PERMS.USERS_BAN);
 	const id = Number(formData.get("id"));
 	if (id > 0) {
-		await prisma.ban.delete({ where: { id } });
+		await db.delete(Ban).where(eq(Ban.id, id));
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "ban_lift",
@@ -1,10 +1,11 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, EmailTemplates } from "@/lib/db";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";

 export async function createEmailTemplate(formData: FormData): Promise<void> {
 	await requirePermission(PERMS.PAGES_EDIT);
@@ -23,14 +24,12 @@ export async function createEmailTemplate(formData: FormData): Promise<void> {
 	const isActive = formData.get("isActive") != null;
 	if (!name || !subject || !body) return;

-	await prisma.emailTemplates.create({
-		data: {
-			name,
-			subject,
-			body,
-			variables: variablesRaw || null,
-			isActive,
-		},
+	await db.insert(EmailTemplates).values({
+		name,
+		subject,
+		body,
+		variables: variablesRaw || null,
+		isActive,
 	});
 	revalidatePath("/admin/email-templates");
 }
@@ -56,15 +55,15 @@ export async function updateEmailTemplate(formData: FormData): Promise<void> {
 	const isActive = formData.get("isActive") != null;
 	if (!subject || !body) return;

-	await prisma.emailTemplates.update({
-		where: { id },
-		data: {
+	await db
+		.update(EmailTemplates)
+		.set({
 			subject,
 			body,
 			variables: variablesRaw || null,
 			isActive,
-		},
-	});
+		})
+		.where(eq(EmailTemplates.id, id));
 	revalidatePath("/admin/email-templates");
 }

@@ -72,6 +71,6 @@ export async function deleteEmailTemplate(formData: FormData): Promise<void> {
 	await requirePermission(PERMS.PAGES_EDIT);
 	const id = formPositiveBigInt(formData, "id");
 	if (!id) return;
-	await prisma.emailTemplates.delete({ where: { id } });
+	await db.delete(EmailTemplates).where(eq(EmailTemplates.id, id));
 	revalidatePath("/admin/email-templates");
 }
@@ -2,8 +2,8 @@

 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, EmulatorSettings, EmulatorTexts } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";

 // emulator_settings: PK is the string column `key`, payload is `value` (VarChar 512).
 // emulator_texts: PK is the string column `key`, payload is `value` (VarChar 4096).
@@ -20,11 +20,10 @@ export async function updateEmulatorSetting(formData: FormData): Promise<void> {
 		.normalize("NFC")
 		.slice(0, 512);
 	if (!key) return;
-	await prisma.emulatorSettings.upsert({
-		where: { key },
-		update: { value },
-		create: { key, value },
-	});
+	await db
+		.insert(EmulatorSettings)
+		.values({ key, value })
+		.onDuplicateKeyUpdate({ set: { value } });
 	revalidatePath("/admin/emulator");
 }

@@ -38,10 +37,9 @@ export async function updateEmulatorText(formData: FormData): Promise<void> {
 		.normalize("NFC")
 		.slice(0, 4096);
 	if (!key) return;
-	await prisma.emulatorTexts.upsert({
-		where: { key },
-		update: { value },
-		create: { key, value },
-	});
+	await db
+		.insert(EmulatorTexts)
+		.values({ key, value })
+		.onDuplicateKeyUpdate({ set: { value } });
 	revalidatePath("/admin/emulator");
 }
@@ -0,0 +1,91 @@
+// @ts-nocheck
+import { revalidatePath } from "next/cache";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermissionRateLimited } from "@/lib/admin/guard";
+import { logStaffActivity } from "@/lib/services/staff-activity";
+import { disbandGuild } from "./admin-guilds";
+
+const { selectLimit, transactionFn, deleteWhere, updateSet } = vi.hoisted(
+	() => {
+		const selectLimit = vi.fn();
+		const transactionFn = vi.fn();
+		const deleteWhere = vi.fn().mockResolvedValue([{ affectedRows: 1 }]);
+		const updateSet = vi.fn(() => ({ where: vi.fn().mockResolvedValue([]) }));
+		return { selectLimit, transactionFn, deleteWhere, updateSet };
+	},
+);
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermissionRateLimited: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({ PERMS: { USERS_EDIT: "users.edit" } }));
+vi.mock("@/lib/db", () => ({
+	db: {
+		select: vi.fn(() => ({
+			from: vi.fn(() => ({
+				where: vi.fn(() => ({
+					limit: selectLimit,
+				})),
+			})),
+		})),
+		transaction: transactionFn,
+		delete: vi.fn(() => ({ where: deleteWhere })),
+		update: vi.fn(() => ({ set: updateSet })),
+	},
+	Guilds: { id: "id", name: "name", userId: "userId" },
+	GuildsForumsThreads: { id: "id", guildId: "guildId" },
+	GuildsForumsComments: { threadId: "threadId" },
+	GuildForumViews: { guildId: "guildId" },
+	GuildsMembers: { guildId: "guildId" },
+	Rooms: { guildId: "guildId" },
+	Items: { guildId: "guildId" },
+}));
+vi.mock("@/lib/services/staff-activity", () => ({ logStaffActivity: vi.fn() }));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+
+const staff = { id: 1, rank: 7, username: "admin" };
+const fakeForm = (data: Record<string, string>) => ({
+	get: (key: string) => data[key] ?? null,
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(requirePermissionRateLimited).mockResolvedValue(staff as never);
+});
+
+describe("disbandGuild", () => {
+	it("disbands guild and cleans related data", async () => {
+		selectLimit.mockResolvedValue([{ id: 1, name: "TestGuild", userId: 42 }]);
+		transactionFn.mockImplementation(
+			async (fn: (tx: unknown) => Promise<void>) => {
+				const txSelectLimit = vi.fn().mockResolvedValue([{ id: 10 }]);
+				const tx = {
+					select: vi.fn(() => ({
+						from: vi.fn(() => ({
+							where: vi.fn(() => ({
+								limit: txSelectLimit,
+							})),
+						})),
+					})),
+					delete: vi.fn(() => ({ where: vi.fn().mockResolvedValue([]) })),
+					update: vi.fn(() => ({
+						set: vi.fn(() => ({ where: vi.fn().mockResolvedValue([]) })),
+					})),
+				};
+				// For threads findMany (no limit) — make where resolve to array
+				tx.select = vi.fn(() => ({
+					from: vi.fn(() => ({
+						where: vi.fn().mockResolvedValue([{ id: 10 }]),
+					})),
+				}));
+				await fn(tx);
+			},
+		);
+		await disbandGuild(fakeForm({ id: "1" }) as unknown as FormData);
+		expect(logStaffActivity).toHaveBeenCalled();
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/guilds");
+	});
+
+	it("returns early when id is not positive", async () => {
+		await disbandGuild(fakeForm({ id: "0" }) as unknown as FormData);
+		expect(selectLimit).not.toHaveBeenCalled();
+	});
+});
@@ -1,9 +1,19 @@
 "use server";

+import { eq, inArray } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermissionRateLimited } from "@/lib/admin/guard";
+import {
+	db,
+	GuildForumViews,
+	Guilds,
+	GuildsForumsComments,
+	GuildsForumsThreads,
+	GuildsMembers,
+	Items,
+	Rooms,
+} from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";

 /** Disband a guild and clean related membership/forum rows. */
@@ -12,29 +22,36 @@ export async function disbandGuild(formData: FormData): Promise<void> {
 	const id = Number(formData.get("id"));
 	if (!(id > 0)) return;

-	const guild = await prisma.guilds.findUnique({
-		where: { id },
-		select: { id: true, name: true, userId: true },
-	});
+	const [guild] = await db
+		.select({
+			id: Guilds.id,
+			name: Guilds.name,
+			userId: Guilds.userId,
+		})
+		.from(Guilds)
+		.where(eq(Guilds.id, id))
+		.limit(1);
 	if (!guild) return;

-	await prisma.$transaction(async (tx) => {
-		const threads = await tx.guildsForumsThreads.findMany({
-			where: { guildId: id },
-			select: { id: true },
-		});
+	await db.transaction(async (tx) => {
+		const threads = await tx
+			.select({ id: GuildsForumsThreads.id })
+			.from(GuildsForumsThreads)
+			.where(eq(GuildsForumsThreads.guildId, id));
 		const threadIds = threads.map((t) => t.id);
 		if (threadIds.length > 0) {
-			await tx.guildsForumsComments.deleteMany({
-				where: { threadId: { in: threadIds } },
-			});
-			await tx.guildsForumsThreads.deleteMany({ where: { guildId: id } });
+			await tx
+				.delete(GuildsForumsComments)
+				.where(inArray(GuildsForumsComments.threadId, threadIds));
+			await tx
+				.delete(GuildsForumsThreads)
+				.where(eq(GuildsForumsThreads.guildId, id));
 		}
-		await tx.guildForumViews.deleteMany({ where: { guildId: id } });
-		await tx.guildsMembers.deleteMany({ where: { guildId: id } });
-		await tx.rooms.updateMany({ where: { guildId: id }, data: { guildId: 0 } });
-		await tx.items.updateMany({ where: { guildId: id }, data: { guildId: 0 } });
-		await tx.guilds.delete({ where: { id } });
+		await tx.delete(GuildForumViews).where(eq(GuildForumViews.guildId, id));
+		await tx.delete(GuildsMembers).where(eq(GuildsMembers.guildId, id));
+		await tx.update(Rooms).set({ guildId: 0 }).where(eq(Rooms.guildId, id));
+		await tx.update(Items).set({ guildId: 0 }).where(eq(Items.guildId, id));
+		await tx.delete(Guilds).where(eq(Guilds.id, id));
 	});

 	await logStaffActivity({
@@ -1,9 +1,15 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { z } from "zod";
+import {
+	Ban,
+	db,
+	WebsiteHelpCenterTicketReplies,
+	WebsiteHelpCenterTickets,
+} from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { adminAction } from "@/lib/safe-action";
 import { ActionError, actionOk } from "@/lib/safe-action-shared";
 import { logAudit } from "@/lib/services/audit";
@@ -25,39 +31,99 @@ function revalidateHelpCenterTicketPaths(ticketId: bigint) {
 	const id = String(ticketId);
 	revalidatePath("/admin/help-tickets");
 	revalidatePath(`/admin/help-tickets/${id}`);
+	revalidatePath("/mod/help-tickets");
+	revalidatePath(`/mod/help-tickets/${id}`);
 	revalidatePath("/help/tickets");
 	revalidatePath(`/help/tickets/${id}`);
 }

-export const replyHelpCenterTicket = adminAction(
-	{ permission: PERMS.TICKETS_EDIT, schema: replyHelpCenterTicketSchema },
+export const liftBanFromHelpTicket = adminAction(
+	{
+		permission: PERMS.USERS_BAN,
+		schema: helpCenterTicketIdSchema,
+	},
 	async (ctx) => {
 		const ticketId = ctx.data.ticketId;
-		const ticket = await prisma.websiteHelpCenterTickets.findUnique({
-			where: { id: ticketId },
-			select: { id: true, open: true },
+		const [ticket] = await db
+			.select({
+				id: WebsiteHelpCenterTickets.id,
+				userId: WebsiteHelpCenterTickets.userId,
+				open: WebsiteHelpCenterTickets.open,
+				title: WebsiteHelpCenterTickets.title,
+			})
+			.from(WebsiteHelpCenterTickets)
+			.where(eq(WebsiteHelpCenterTickets.id, ticketId))
+			.limit(1);
+		if (!ticket) throw new ActionError("Ticket not found");
+		if (ticket.userId == null) {
+			throw new ActionError("Ticket has no requester to unban");
+		}
+
+		const result = await db.delete(Ban).where(eq(Ban.userId, ticket.userId));
+		const removed = Number(
+			(result as unknown as [{ affectedRows: number }])[0]?.affectedRows ?? 0,
+		);
+
+		const now = new Date();
+		if (ticket.open) {
+			await db
+				.update(WebsiteHelpCenterTickets)
+				.set({ open: false, updatedAt: now })
+				.where(eq(WebsiteHelpCenterTickets.id, ticketId));
+		}
+
+		logAudit({
+			userId: ctx.session.user.id,
+			action: "unban_via_help_ticket",
+			target: "User",
+			targetId: ticket.userId,
+			after: {
+				ticketId: String(ticketId),
+				removedBans: removed,
+				title: ticket.title,
+			},
 		});

+		revalidateHelpCenterTicketPaths(ticketId);
+		revalidatePath("/admin/bans");
+		revalidatePath(`/admin/users/show/${ticket.userId}`);
+		return actionOk({ removed, userId: ticket.userId });
+	},
+);
+
+const HELP_TICKET_EDIT = [PERMS.TICKETS_EDIT, PERMS.MOD_TICKETS_EDIT] as const;
+
+export const replyHelpCenterTicket = adminAction(
+	{ permission: HELP_TICKET_EDIT, schema: replyHelpCenterTicketSchema },
+	async (ctx) => {
+		const ticketId = ctx.data.ticketId;
+		const [ticket] = await db
+			.select({
+				id: WebsiteHelpCenterTickets.id,
+				open: WebsiteHelpCenterTickets.open,
+			})
+			.from(WebsiteHelpCenterTickets)
+			.where(eq(WebsiteHelpCenterTickets.id, ticketId))
+			.limit(1);
+
 		if (!ticket) throw new ActionError("Ticket not found");

 		const now = new Date();
 		const staffId = Number(ctx.session.user.id);

-		await prisma.$transaction([
-			prisma.websiteHelpCenterTicketReplies.create({
-				data: {
-					ticketId,
-					userId: staffId,
-					content: ctx.data.content.trim(),
-					createdAt: now,
-					updatedAt: now,
-				},
-			}),
-			prisma.websiteHelpCenterTickets.update({
-				where: { id: ticketId },
-				data: { updatedAt: now },
-			}),
-		]);
+		await db.transaction(async (tx) => {
+			await tx.insert(WebsiteHelpCenterTicketReplies).values({
+				ticketId,
+				userId: staffId,
+				content: ctx.data.content.trim(),
+				createdAt: now,
+				updatedAt: now,
+			});
+			await tx
+				.update(WebsiteHelpCenterTickets)
+				.set({ updatedAt: now })
+				.where(eq(WebsiteHelpCenterTickets.id, ticketId));
+		});

 		logAudit({
 			userId: staffId,
@@ -72,22 +138,26 @@ export const replyHelpCenterTicket = adminAction(
 );

 export const closeHelpCenterTicket = adminAction(
-	{ permission: PERMS.TICKETS_EDIT, schema: helpCenterTicketIdSchema },
+	{ permission: HELP_TICKET_EDIT, schema: helpCenterTicketIdSchema },
 	async (ctx) => {
 		const ticketId = ctx.data.ticketId;
-		const ticket = await prisma.websiteHelpCenterTickets.findUnique({
-			where: { id: ticketId },
-			select: { id: true, open: true },
-		});
+		const [ticket] = await db
+			.select({
+				id: WebsiteHelpCenterTickets.id,
+				open: WebsiteHelpCenterTickets.open,
+			})
+			.from(WebsiteHelpCenterTickets)
+			.where(eq(WebsiteHelpCenterTickets.id, ticketId))
+			.limit(1);

 		if (!ticket) throw new ActionError("Ticket not found");
 		if (!ticket.open) throw new ActionError("Ticket is already closed");

 		const now = new Date();
-		await prisma.websiteHelpCenterTickets.update({
-			where: { id: ticketId },
-			data: { open: false, updatedAt: now },
-		});
+		await db
+			.update(WebsiteHelpCenterTickets)
+			.set({ open: false, updatedAt: now })
+			.where(eq(WebsiteHelpCenterTickets.id, ticketId));

 		logAudit({
 			userId: Number(ctx.session.user.id),
@@ -104,22 +174,26 @@ export const closeHelpCenterTicket = adminAction(
 );

 export const reopenHelpCenterTicket = adminAction(
-	{ permission: PERMS.TICKETS_EDIT, schema: helpCenterTicketIdSchema },
+	{ permission: HELP_TICKET_EDIT, schema: helpCenterTicketIdSchema },
 	async (ctx) => {
 		const ticketId = ctx.data.ticketId;
-		const ticket = await prisma.websiteHelpCenterTickets.findUnique({
-			where: { id: ticketId },
-			select: { id: true, open: true },
-		});
+		const [ticket] = await db
+			.select({
+				id: WebsiteHelpCenterTickets.id,
+				open: WebsiteHelpCenterTickets.open,
+			})
+			.from(WebsiteHelpCenterTickets)
+			.where(eq(WebsiteHelpCenterTickets.id, ticketId))
+			.limit(1);

 		if (!ticket) throw new ActionError("Ticket not found");
 		if (ticket.open) throw new ActionError("Ticket is already open");

 		const now = new Date();
-		await prisma.websiteHelpCenterTickets.update({
-			where: { id: ticketId },
-			data: { open: true, updatedAt: now },
-		});
+		await db
+			.update(WebsiteHelpCenterTickets)
+			.set({ open: true, updatedAt: now })
+			.where(eq(WebsiteHelpCenterTickets.id, ticketId));

 		logAudit({
 			userId: Number(ctx.session.user.id),
@@ -0,0 +1,77 @@
+import { redirect } from "next/navigation";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermission } from "@/lib/admin/guard";
+import {
+	createHelpQuestion,
+	deleteHelpQuestion,
+	updateHelpQuestion,
+} from "./admin-help";
+
+const { insertValues, updateWhere, deleteWhere } = vi.hoisted(() => {
+	const insertValues = vi.fn().mockResolvedValue([{ insertId: 5 }]);
+	const updateWhere = vi.fn().mockResolvedValue([{ affectedRows: 1 }]);
+	const deleteWhere = vi.fn().mockResolvedValue([{ affectedRows: 1 }]);
+	return { insertValues, updateWhere, deleteWhere };
+});
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({ PERMS: { PAGES_EDIT: "pages.edit" } }));
+vi.mock("@/lib/db", () => ({
+	db: {
+		insert: vi.fn(() => ({ values: insertValues })),
+		update: vi.fn(() => ({ set: vi.fn(() => ({ where: updateWhere })) })),
+		delete: vi.fn(() => ({ where: deleteWhere })),
+	},
+	WebsiteHelpCenterCategories: { id: "id" },
+}));
+vi.mock("@/lib/services/staff-activity", () => ({ logStaffActivity: vi.fn() }));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+vi.mock("next/navigation", () => ({ redirect: vi.fn() }));
+
+const staff = { id: 1, rank: 7, username: "admin" };
+const fakeForm = (data: Record<string, string | null>) => ({
+	get: (key: string) => (key in data ? data[key] : null),
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(requirePermission).mockResolvedValue(staff as never);
+	insertValues.mockResolvedValue([{ insertId: 5 }]);
+	updateWhere.mockResolvedValue([{ affectedRows: 1 }]);
+	deleteWhere.mockResolvedValue([{ affectedRows: 1 }]);
+});
+
+describe("createHelpQuestion", () => {
+	it("creates a help question and redirects", async () => {
+		await createHelpQuestion(
+			fakeForm({
+				name: "FAQ",
+				content: "<p>Answer</p>",
+			}) as unknown as FormData,
+		);
+		expect(insertValues).toHaveBeenCalled();
+		expect(redirect).toHaveBeenCalledWith("/admin/help-questions");
+	});
+});
+
+describe("updateHelpQuestion", () => {
+	it("updates and redirects", async () => {
+		await updateHelpQuestion(
+			fakeForm({
+				id: "42",
+				name: "Updated",
+				content: "New",
+			}) as unknown as FormData,
+		);
+		expect(updateWhere).toHaveBeenCalled();
+		expect(redirect).toHaveBeenCalledWith("/admin/help-questions");
+	});
+});
+
+describe("deleteHelpQuestion", () => {
+	it("deletes and redirects", async () => {
+		await deleteHelpQuestion(fakeForm({ id: "42" }) as unknown as FormData);
+		expect(deleteWhere).toHaveBeenCalled();
+		expect(redirect).toHaveBeenCalledWith("/admin/help-questions");
+	});
+});
@@ -1,12 +1,14 @@
 "use server";

+import { eq } from "drizzle-orm";
+import type { ResultSetHeader } from "mysql2";
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, WebsiteHelpCenterCategories } from "@/lib/db";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { canonicalize, sanitizeField } from "@/lib/foundation/security";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";

 // CRUD for help-center FAQ entries (website_help_center_categories). Each entry
@@ -32,25 +34,23 @@ export async function createHelpQuestion(formData: FormData): Promise<void> {
 		sanitizeField(formData.get("buttonBorderColor"), 16) || "#facc15";

 	try {
-		const entry = await prisma.websiteHelpCenterCategories.create({
-			data: {
-				name,
-				content,
-				position: parsePosition(formData.get("position")),
-				imageUrl: imageUrl || null,
-				buttonText: buttonText || null,
-				buttonUrl: buttonUrl || null,
-				buttonColor,
-				buttonBorderColor,
-				smallBox: formData.get("smallBox") != null,
-			},
-		});
+		const [result] = (await db.insert(WebsiteHelpCenterCategories).values({
+			name,
+			content,
+			position: parsePosition(formData.get("position")),
+			imageUrl: imageUrl || null,
+			buttonText: buttonText || null,
+			buttonUrl: buttonUrl || null,
+			buttonColor,
+			buttonBorderColor,
+			smallBox: formData.get("smallBox") != null,
+		})) as unknown as [ResultSetHeader];
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "help_create",
-			description: `Created help-center entry #${entry.id} (${name})`,
+			description: `Created help-center entry #${result.insertId} (${name})`,
 			targetType: "help_center_category",
-			targetId: Number(entry.id),
+			targetId: Number(result.insertId),
 		});
 	} catch {
 		// Unique name collision or DB error — re-render unchanged with error.
@@ -81,9 +81,9 @@ export async function updateHelpQuestion(formData: FormData): Promise<void> {
 		sanitizeField(formData.get("buttonBorderColor"), 16) || "#facc15";

 	try {
-		await prisma.websiteHelpCenterCategories.update({
-			where: { id },
-			data: {
+		await db
+			.update(WebsiteHelpCenterCategories)
+			.set({
 				name,
 				content,
 				position: parsePosition(formData.get("position")),
@@ -93,8 +93,8 @@ export async function updateHelpQuestion(formData: FormData): Promise<void> {
 				buttonColor,
 				buttonBorderColor,
 				smallBox: formData.get("smallBox") != null,
-			},
-		});
+			})
+			.where(eq(WebsiteHelpCenterCategories.id, id));
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "help_update",
@@ -116,7 +116,9 @@ export async function deleteHelpQuestion(formData: FormData): Promise<void> {
 	if (!id) return;

 	try {
-		await prisma.websiteHelpCenterCategories.delete({ where: { id } });
+		await db
+			.delete(WebsiteHelpCenterCategories)
+			.where(eq(WebsiteHelpCenterCategories.id, id));
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "help_delete",
@@ -1,9 +1,10 @@
 "use server";

+import { asc } from "drizzle-orm";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, WebsiteHousekeepingPermissions } from "@/lib/db";
 import { redirectSafe } from "@/lib/foundation/security";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";

 /**
 * Housekeeping table writes are retired. Runtime access uses ACL only.
@@ -34,16 +35,19 @@ export async function bulkImportPermissions(
 export async function exportPermissions(): Promise<string> {
 	await requirePermission(PERMS.SETTINGS_VIEW);

-	const perms = await prisma.websiteHousekeepingPermissions.findMany({
-		orderBy: [{ groupName: "asc" }, { permission: "asc" }],
-		select: {
-			permission: true,
-			minRank: true,
-			description: true,
-			groupName: true,
-			dependsOn: true,
-		},
-	});
+	const perms = await db
+		.select({
+			permission: WebsiteHousekeepingPermissions.permission,
+			minRank: WebsiteHousekeepingPermissions.minRank,
+			description: WebsiteHousekeepingPermissions.description,
+			groupName: WebsiteHousekeepingPermissions.groupName,
+			dependsOn: WebsiteHousekeepingPermissions.dependsOn,
+		})
+		.from(WebsiteHousekeepingPermissions)
+		.orderBy(
+			asc(WebsiteHousekeepingPermissions.groupName),
+			asc(WebsiteHousekeepingPermissions.permission),
+		);

 	return JSON.stringify(perms, null, 2);
 }
@@ -0,0 +1,88 @@
+// @ts-nocheck
+import { revalidatePath } from "next/cache";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermission } from "@/lib/admin/guard";
+import {
+	addBlacklist,
+	addWhitelist,
+	deleteBlacklist,
+	deleteWhitelist,
+} from "./admin-ip";
+
+const { insertValues, deleteWhere } = vi.hoisted(() => {
+	const insertValues = vi.fn().mockResolvedValue([{ insertId: 1 }]);
+	const deleteWhere = vi.fn().mockResolvedValue([{ affectedRows: 1 }]);
+	return { insertValues, deleteWhere };
+});
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({
+	PERMS: { SETTINGS_EDIT: "settings.edit" },
+}));
+vi.mock("@/lib/db", () => ({
+	db: {
+		insert: vi.fn(() => ({ values: insertValues })),
+		delete: vi.fn(() => ({ where: deleteWhere })),
+	},
+	WebsiteIpWhitelist: { id: "id" },
+	WebsiteIpBlacklist: { id: "id" },
+}));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+
+const staff = { id: 1, rank: 7, username: "admin" };
+const fakeForm = (data: Record<string, string>) => ({
+	get: (key: string) => data[key] ?? null,
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(requirePermission).mockResolvedValue(staff as never);
+	insertValues.mockResolvedValue([{ insertId: 1 }]);
+	deleteWhere.mockResolvedValue([{ affectedRows: 1 }]);
+});
+
+describe("addWhitelist", () => {
+	it("creates whitelist entry", async () => {
+		await addWhitelist(
+			fakeForm({ ipAddress: "192.168.1.1" }) as unknown as FormData,
+		);
+		expect(insertValues).toHaveBeenCalledWith({
+			ipAddress: "192.168.1.1",
+			asn: null,
+			whitelistAsn: false,
+		});
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/ip");
+	});
+
+	it("returns early when ip is empty", async () => {
+		await addWhitelist(fakeForm({ ipAddress: "" }) as unknown as FormData);
+		expect(insertValues).not.toHaveBeenCalled();
+	});
+});
+
+describe("deleteWhitelist", () => {
+	it("deletes whitelist entry", async () => {
+		await deleteWhitelist(fakeForm({ id: "42" }) as unknown as FormData);
+		expect(deleteWhere).toHaveBeenCalled();
+	});
+});
+
+describe("addBlacklist", () => {
+	it("creates blacklist entry", async () => {
+		await addBlacklist(
+			fakeForm({ ipAddress: "203.0.113.1" }) as unknown as FormData,
+		);
+		expect(insertValues).toHaveBeenCalledWith({
+			ipAddress: "203.0.113.1",
+			asn: null,
+			blacklistAsn: false,
+		});
+	});
+});
+
+describe("deleteBlacklist", () => {
+	it("deletes blacklist entry", async () => {
+		await deleteBlacklist(fakeForm({ id: "99" }) as unknown as FormData);
+		expect(deleteWhere).toHaveBeenCalled();
+	});
+});
@@ -1,9 +1,10 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, WebsiteIpBlacklist, WebsiteIpWhitelist } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";

 function parseIp(formData: FormData): string {
 	return String(formData.get("ipAddress") ?? "")
@@ -25,8 +26,10 @@ export async function addWhitelist(formData: FormData): Promise<void> {
 	const ipAddress = parseIp(formData);
 	if (!ipAddress) return;
 	const asn = parseAsn(formData);
-	await prisma.websiteIpWhitelist.create({
-		data: { ipAddress, asn, whitelistAsn: asn != null },
+	await db.insert(WebsiteIpWhitelist).values({
+		ipAddress,
+		asn,
+		whitelistAsn: asn != null,
 	});
 	revalidatePath("/admin/ip");
 }
@@ -37,7 +40,9 @@ export async function deleteWhitelist(formData: FormData): Promise<void> {
 		.normalize("NFC")
 		.trim();
 	if (!raw) return;
-	await prisma.websiteIpWhitelist.delete({ where: { id: BigInt(raw) } });
+	await db
+		.delete(WebsiteIpWhitelist)
+		.where(eq(WebsiteIpWhitelist.id, BigInt(raw)));
 	revalidatePath("/admin/ip");
 }

@@ -46,8 +51,10 @@ export async function addBlacklist(formData: FormData): Promise<void> {
 	const ipAddress = parseIp(formData);
 	if (!ipAddress) return;
 	const asn = parseAsn(formData);
-	await prisma.websiteIpBlacklist.create({
-		data: { ipAddress, asn, blacklistAsn: asn != null },
+	await db.insert(WebsiteIpBlacklist).values({
+		ipAddress,
+		asn,
+		blacklistAsn: asn != null,
 	});
 	revalidatePath("/admin/ip");
 }
@@ -58,6 +65,8 @@ export async function deleteBlacklist(formData: FormData): Promise<void> {
 		.normalize("NFC")
 		.trim();
 	if (!raw) return;
-	await prisma.websiteIpBlacklist.delete({ where: { id: BigInt(raw) } });
+	await db
+		.delete(WebsiteIpBlacklist)
+		.where(eq(WebsiteIpBlacklist.id, BigInt(raw)));
 	revalidatePath("/admin/ip");
 }
@@ -1,12 +1,24 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";

-const { mockUpsert, mockRequirePermission, mockReload, mockRevalidatePath } =
-	vi.hoisted(() => ({
-		mockUpsert: vi.fn(),
+const {
+	mockValues,
+	mockOnDuplicateKeyUpdate,
+	mockRequirePermission,
+	mockReload,
+	mockRevalidatePath,
+} = vi.hoisted(() => {
+	const mockOnDuplicateKeyUpdate = vi.fn().mockResolvedValue(undefined);
+	const mockValues = vi.fn(() => ({
+		onDuplicateKeyUpdate: mockOnDuplicateKeyUpdate,
+	}));
+	return {
+		mockValues,
+		mockOnDuplicateKeyUpdate,
 		mockRequirePermission: vi.fn(),
 		mockReload: vi.fn(),
 		mockRevalidatePath: vi.fn(),
-	}));
+	};
+});

 vi.mock("@/lib/permissions", () => ({
 	PERMS: {
@@ -16,10 +28,11 @@ vi.mock("@/lib/permissions", () => ({
 	},
 }));

-vi.mock("@/lib/prisma", () => ({
-	prisma: {
-		websiteSetting: { upsert: mockUpsert },
+vi.mock("@/lib/db", () => ({
+	db: {
+		insert: vi.fn(() => ({ values: mockValues })),
 	},
+	WebsiteSetting: { key: "key", value: "value" },
 }));

 vi.mock("@/lib/admin/guard", () => ({
@@ -38,6 +51,10 @@ import { saveMaintenance } from "./admin-maintenance";

 beforeEach(() => {
 	vi.clearAllMocks();
+	mockValues.mockReturnValue({
+		onDuplicateKeyUpdate: mockOnDuplicateKeyUpdate,
+	});
+	mockOnDuplicateKeyUpdate.mockResolvedValue(undefined);
 });

 describe("saveMaintenance", () => {
@@ -57,37 +74,26 @@ describe("saveMaintenance", () => {

 		expect(mockRequirePermission).toHaveBeenCalled();

-		expect(mockUpsert).toHaveBeenCalledTimes(3);
-		expect(mockUpsert).toHaveBeenCalledWith(
+		expect(mockValues).toHaveBeenCalledTimes(3);
+		expect(mockValues).toHaveBeenCalledWith(
 			expect.objectContaining({
-				where: { key: "maintenance_enabled" },
-				update: { value: "1" },
-				create: expect.objectContaining({
-					key: "maintenance_enabled",
-					value: "1",
-				}),
+				key: "maintenance_enabled",
+				value: "1",
 			}),
 		);
-		expect(mockUpsert).toHaveBeenCalledWith(
+		expect(mockValues).toHaveBeenCalledWith(
 			expect.objectContaining({
-				where: { key: "maintenance_message" },
-				update: { value: "We will be back soon!" },
-				create: expect.objectContaining({
-					key: "maintenance_message",
-					value: "We will be back soon!",
-				}),
+				key: "maintenance_message",
+				value: "We will be back soon!",
 			}),
 		);
-		expect(mockUpsert).toHaveBeenCalledWith(
+		expect(mockValues).toHaveBeenCalledWith(
 			expect.objectContaining({
-				where: { key: "min_maintenance_login_rank" },
-				update: { value: "3" },
-				create: expect.objectContaining({
-					key: "min_maintenance_login_rank",
-					value: "3",
-				}),
+				key: "min_maintenance_login_rank",
+				value: "3",
 			}),
 		);
+		expect(mockOnDuplicateKeyUpdate).toHaveBeenCalledTimes(3);

 		expect(mockReload).toHaveBeenCalledOnce();
 		expect(mockRevalidatePath).toHaveBeenCalledWith("/admin/maintenance");
@@ -106,16 +112,16 @@ describe("saveMaintenance", () => {

 		await saveMaintenance(fd);

-		expect(mockUpsert).toHaveBeenCalledWith(
+		expect(mockValues).toHaveBeenCalledWith(
 			expect.objectContaining({
-				where: { key: "maintenance_enabled" },
-				update: { value: "0" },
+				key: "maintenance_enabled",
+				value: "0",
 			}),
 		);
-		expect(mockUpsert).toHaveBeenCalledWith(
+		expect(mockValues).toHaveBeenCalledWith(
 			expect.objectContaining({
-				where: { key: "min_maintenance_login_rank" },
-				update: { value: "5" },
+				key: "min_maintenance_login_rank",
+				value: "5",
 			}),
 		);
 	});
@@ -134,10 +140,10 @@ describe("saveMaintenance", () => {

 		await saveMaintenance(fd);

-		expect(mockUpsert).toHaveBeenCalledWith(
+		expect(mockValues).toHaveBeenCalledWith(
 			expect.objectContaining({
-				where: { key: "min_maintenance_login_rank" },
-				update: { value: "5" },
+				key: "min_maintenance_login_rank",
+				value: "5",
 			}),
 		);
 	});
@@ -156,10 +162,10 @@ describe("saveMaintenance", () => {

 		await saveMaintenance(fd);

-		expect(mockUpsert).toHaveBeenCalledWith(
+		expect(mockValues).toHaveBeenCalledWith(
 			expect.objectContaining({
-				where: { key: "min_maintenance_login_rank" },
-				update: { value: "5" },
+				key: "min_maintenance_login_rank",
+				value: "5",
 			}),
 		);
 	});
@@ -2,8 +2,8 @@

 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, WebsiteSetting } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";

 // Maintenance mode lives in three CMS-owned website_settings rows (mirrors
@@ -27,12 +27,15 @@ const COMMENTS: Record<string, string> = {
 };

 async function upsertSetting(key: string, value: string): Promise<void> {
-	await prisma.websiteSetting.upsert({
-		where: { key },
-		update: { value },
-		// eslint-disable-next-line security/detect-object-injection -- key is one of 3 known const values
-		create: { key, value, comment: COMMENTS[key] ?? null },
-	});
+	await db
+		.insert(WebsiteSetting)
+		.values({
+			key,
+			value,
+			// eslint-disable-next-line security/detect-object-injection -- key is one of 3 known const values
+			comment: COMMENTS[key] ?? null,
+		})
+		.onDuplicateKeyUpdate({ set: { value } });
 }

 export async function saveMaintenance(formData: FormData): Promise<void> {
@@ -1,9 +1,10 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermissionRateLimited } from "@/lib/admin/guard";
+import { db, MarketplaceItems } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";

 /** Cancel an active marketplace listing (state 1 → 0). */
@@ -14,16 +15,23 @@ export async function cancelMarketplaceListing(
 	const id = Number(formData.get("id"));
 	if (!(id > 0)) return;

-	const listing = await prisma.marketplaceItems.findUnique({
-		where: { id },
-		select: { id: true, state: true, userId: true, itemId: true, price: true },
-	});
+	const [listing] = await db
+		.select({
+			id: MarketplaceItems.id,
+			state: MarketplaceItems.state,
+			userId: MarketplaceItems.userId,
+			itemId: MarketplaceItems.itemId,
+			price: MarketplaceItems.price,
+		})
+		.from(MarketplaceItems)
+		.where(eq(MarketplaceItems.id, id))
+		.limit(1);
 	if (listing?.state !== 1) return;

-	await prisma.marketplaceItems.update({
-		where: { id },
-		data: { state: 0 },
-	});
+	await db
+		.update(MarketplaceItems)
+		.set({ state: 0 })
+		.where(eq(MarketplaceItems.id, id));

 	await logStaffActivity({
 		staffId: staff.id,
@@ -0,0 +1,59 @@
+// @ts-nocheck
+
+import path from "node:path";
+import { revalidatePath } from "next/cache";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermission } from "@/lib/admin/guard";
+import { resolveMediaPath } from "@/lib/media-storage";
+import { deleteMedia, uploadMedia, uploadMediaAndReturn } from "./admin-media";
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({ PERMS: { PAGES_EDIT: "pages.edit" } }));
+vi.mock("@/lib/media-storage", () => {
+	const root = path.join("/tmp", "nexst-test-media");
+	return {
+		MEDIA_ROOT: root,
+		resolveMediaPath: vi.fn((name: string) => path.join(root, name)),
+	};
+});
+vi.mock("node:fs/promises", () => ({
+	mkdir: vi.fn(),
+	writeFile: vi.fn(),
+	unlink: vi.fn(),
+}));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+
+const staff = { id: 1, rank: 7, username: "admin" };
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(requirePermission).mockResolvedValue(staff as never);
+});
+
+describe("uploadMedia", () => {
+	it("returns error when no file provided", async () => {
+		const result = await uploadMedia(new FormData());
+		expect(result.ok).toBe(false);
+		expect(result.error).toBe("No file provided");
+	});
+});
+
+describe("uploadMediaAndReturn", () => {
+	it("returns empty string when no file", async () => {
+		expect(await uploadMediaAndReturn(new FormData())).toBe("");
+	});
+});
+
+describe("deleteMedia", () => {
+	it("deletes media file and revalidates", async () => {
+		await deleteMedia("photo.png");
+		expect(revalidatePath).toHaveBeenCalledWith("/api/media");
+	});
+
+	it("skips deletion when path is outside media root", async () => {
+		vi.mocked(resolveMediaPath).mockReturnValue("/etc/passwd");
+		await deleteMedia("../../../etc/passwd");
+		const { unlink } = await import("node:fs/promises");
+		expect(unlink).not.toHaveBeenCalled();
+	});
+});
@@ -0,0 +1,43 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { z } from "zod";
+import {
+	ADMIN_NAV_CONFIG_KEY,
+	type AdminNavConfig,
+	serializeAdminNavConfig,
+} from "@/lib/admin-nav-config";
+import { actionOk, adminAction } from "@/lib/foundation/action";
+import { PERMS } from "@/lib/permissions";
+import { siteSettings } from "@/lib/services/site-settings";
+
+const schema = z.object({
+	groupOrder: z.array(z.string()),
+	hiddenGroups: z.array(z.string()),
+	hiddenItems: z.array(z.string()),
+	itemOrder: z.record(z.string(), z.array(z.string())),
+});
+
+export const saveAdminNavConfig = adminAction(
+	{
+		permission: PERMS.SETTINGS_EDIT,
+		schema,
+		rateLimitKey: "admin-nav-config-save",
+		rateLimitMax: 30,
+	},
+	async (ctx) => {
+		const config: AdminNavConfig = {
+			groupOrder: ctx.data.groupOrder,
+			hiddenGroups: ctx.data.hiddenGroups,
+			hiddenItems: ctx.data.hiddenItems,
+			itemOrder: ctx.data.itemOrder,
+		};
+		await siteSettings.update(
+			ADMIN_NAV_CONFIG_KEY,
+			serializeAdminNavConfig(config),
+		);
+		revalidatePath("/admin", "layout");
+		revalidatePath("/admin/menu");
+		return actionOk({ saved: true });
+	},
+);
@@ -0,0 +1,72 @@
+// @ts-nocheck
+import { revalidatePath } from "next/cache";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermission } from "@/lib/admin/guard";
+import { tryRemoveLocalPhotoFile } from "@/lib/admin/photo-files";
+import { logStaffActivity } from "@/lib/services/staff-activity";
+import { deletePhoto } from "./admin-photos";
+
+const { select, deleteFn, limit, whereDelete } = vi.hoisted(() => {
+	const limit = vi.fn();
+	const whereSelect = vi.fn(() => ({ limit }));
+	const from = vi.fn(() => ({ where: whereSelect }));
+	const select = vi.fn(() => ({ from }));
+	const whereDelete = vi.fn();
+	const deleteFn = vi.fn(() => ({ where: whereDelete }));
+	return { select, deleteFn, limit, whereDelete, whereSelect, from };
+});
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({ PERMS: { PAGES_EDIT: "pages.edit" } }));
+vi.mock("@/lib/admin/photo-files", () => ({
+	tryRemoveLocalPhotoFile: vi.fn().mockResolvedValue(true),
+}));
+vi.mock("@/lib/services/staff-activity", () => ({
+	logStaffActivity: vi.fn().mockResolvedValue(undefined),
+}));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+vi.mock("@/lib/db", () => ({
+	db: {
+		select: (...args) => select(...args),
+		delete: (...args) => deleteFn(...args),
+	},
+	CameraWeb: { id: "id", url: "url" },
+}));
+
+const fakeForm = (data) => ({
+	get: (key) => data[key] ?? null,
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	limit.mockResolvedValue([{ id: 42, url: "/uploads/cam/42.png" }]);
+	whereDelete.mockResolvedValue(undefined);
+	vi.mocked(requirePermission).mockResolvedValue({
+		id: 1,
+		rank: 7,
+		username: "admin",
+	});
+});
+
+describe("deletePhoto", () => {
+	it("deletes a photo and revalidates", async () => {
+		await deletePhoto(fakeForm({ id: "42" }));
+		expect(select).toHaveBeenCalled();
+		expect(deleteFn).toHaveBeenCalled();
+		expect(tryRemoveLocalPhotoFile).toHaveBeenCalledWith("/uploads/cam/42.png");
+		expect(logStaffActivity).toHaveBeenCalledWith(
+			expect.objectContaining({
+				action: "photo_delete",
+				targetId: 42,
+			}),
+		);
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/photos");
+		expect(revalidatePath).toHaveBeenCalledWith("/photos");
+	});
+
+	it("returns early when id is not positive", async () => {
+		await deletePhoto(fakeForm({ id: "0" }));
+		expect(select).not.toHaveBeenCalled();
+		expect(deleteFn).not.toHaveBeenCalled();
+	});
+});
@@ -1,20 +1,70 @@
 "use server";

+import { eq, inArray } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { tryRemoveLocalPhotoFile } from "@/lib/admin/photo-files";
+import { CameraWeb, db } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
+import { logStaffActivity } from "@/lib/services/staff-activity";

 export async function deletePhoto(formData: FormData): Promise<void> {
-	await requirePermission(PERMS.PAGES_EDIT);
+	const staff = await requirePermission(PERMS.PAGES_EDIT);
 	const id = Number(formData.get("id"));
 	if (!(id > 0)) return;

-	try {
-		await prisma.cameraWeb.delete({ where: { id } });
-	} catch {
-		// Record may have already been removed; ignore.
+	const [row] = await db
+		.select({ id: CameraWeb.id, url: CameraWeb.url })
+		.from(CameraWeb)
+		.where(eq(CameraWeb.id, id))
+		.limit(1);
+
+	if (row) {
+		await db.delete(CameraWeb).where(eq(CameraWeb.id, id));
+		await tryRemoveLocalPhotoFile(row.url);
+		await logStaffActivity({
+			staffId: staff.id,
+			action: "photo_delete",
+			description: `Deleted camera photo #${id}`,
+			targetType: "camera_web",
+			targetId: id,
+		});
 	}

 	revalidatePath("/admin/photos");
+	revalidatePath("/photos");
+}
+
+export async function bulkDeletePhotos(formData: FormData): Promise<void> {
+	const staff = await requirePermission(PERMS.PAGES_EDIT);
+	const raw = String(formData.get("ids") ?? "");
+	const ids = raw
+		.split(",")
+		.map((s) => Number(s.trim()))
+		.filter((n) => Number.isFinite(n) && n > 0);
+	if (ids.length === 0) return;
+
+	const rows = await db
+		.select({ id: CameraWeb.id, url: CameraWeb.url })
+		.from(CameraWeb)
+		.where(inArray(CameraWeb.id, ids));
+
+	if (rows.length > 0) {
+		await db.delete(CameraWeb).where(
+			inArray(
+				CameraWeb.id,
+				rows.map((r) => r.id),
+			),
+		);
+		await Promise.all(rows.map((r) => tryRemoveLocalPhotoFile(r.url)));
+		await logStaffActivity({
+			staffId: staff.id,
+			action: "photo_bulk_delete",
+			description: `Deleted ${rows.length} camera photo(s)`,
+			targetType: "camera_web",
+		});
+	}
+
+	revalidatePath("/admin/photos");
+	revalidatePath("/photos");
 }
@@ -1,11 +1,12 @@
 "use server";

 import { randomBytes } from "node:crypto";
+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, RadioApiKeys } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";

 // Radio API keys (radio_api_keys). External integrations (AzureCast bridges,
@@ -50,23 +51,22 @@ export async function createApiKey(formData: FormData): Promise<void> {

 	const now = new Date();
 	try {
-		const created = await prisma.radioApiKeys.create({
-			data: {
-				name,
-				key,
-				allowedIps,
-				rateLimit,
-				isActive: true,
-				createdAt: now,
-				updatedAt: now,
-			},
+		const [result] = await db.insert(RadioApiKeys).values({
+			name,
+			key,
+			allowedIps,
+			rateLimit,
+			isActive: true,
+			createdAt: now,
+			updatedAt: now,
 		});
+		const createdId = BigInt(result.insertId);
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "radio_api_key_create",
-			description: `Created radio API key "${name}" (#${created.id}, rate limit ${rateLimit})`,
+			description: `Created radio API key "${name}" (#${createdId}, rate limit ${rateLimit})`,
 			targetType: "radio_api_key",
-			targetId: Number(created.id),
+			targetId: Number(createdId),
 		});
 	} catch {
 		// Unique-key collision (astronomically unlikely) or DB down — fail soft.
@@ -84,17 +84,21 @@ export async function toggleApiKey(formData: FormData): Promise<void> {
 	if (id == null) return;

 	try {
-		const existing = await prisma.radioApiKeys.findUnique({
-			where: { id },
-			select: { name: true, isActive: true },
-		});
+		const [existing] = await db
+			.select({
+				name: RadioApiKeys.name,
+				isActive: RadioApiKeys.isActive,
+			})
+			.from(RadioApiKeys)
+			.where(eq(RadioApiKeys.id, id))
+			.limit(1);
 		if (!existing) return;

 		const next = !existing.isActive;
-		await prisma.radioApiKeys.update({
-			where: { id },
-			data: { isActive: next, updatedAt: new Date() },
-		});
+		await db
+			.update(RadioApiKeys)
+			.set({ isActive: next, updatedAt: new Date() })
+			.where(eq(RadioApiKeys.id, id));
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "radio_api_key_toggle",
@@ -116,7 +120,7 @@ export async function deleteApiKey(formData: FormData): Promise<void> {
 	if (id == null) return;

 	try {
-		await prisma.radioApiKeys.delete({ where: { id } });
+		await db.delete(RadioApiKeys).where(eq(RadioApiKeys.id, id));
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "radio_api_key_delete",
@@ -1,9 +1,10 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, RadioAutoDjPlaylist } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";

 // AutoDJ playlist CRUD (radio_auto_dj_playlist). CMS-owned table backing the
@@ -65,25 +66,24 @@ export async function createTrack(formData: FormData): Promise<void> {
 	const now = new Date();

 	try {
-		const created = await prisma.radioAutoDjPlaylist.create({
-			data: {
-				title,
-				artist: artist || null,
-				album: album || null,
-				artworkUrl: artworkUrl || null,
-				duration,
-				sortOrder,
-				isActive,
-				createdAt: now,
-				updatedAt: now,
-			},
+		const [result] = await db.insert(RadioAutoDjPlaylist).values({
+			title,
+			artist: artist || null,
+			album: album || null,
+			artworkUrl: artworkUrl || null,
+			duration,
+			sortOrder,
+			isActive,
+			createdAt: now,
+			updatedAt: now,
 		});
+		const createdId = Number(result.insertId);
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "radio_autodj_create",
 			description: `Created AutoDJ track "${title}"${artist ? ` by ${artist}` : ""}`,
 			targetType: "radio_auto_dj_track",
-			targetId: Number(created.id),
+			targetId: createdId,
 		});
 	} catch {
 		// Fail soft — DB unavailable; re-render without throwing.
@@ -100,10 +100,10 @@ export async function toggleTrack(formData: FormData): Promise<void> {
 	const isActive = bool(formData.get("isActive"));

 	try {
-		await prisma.radioAutoDjPlaylist.update({
-			where: { id },
-			data: { isActive, updatedAt: new Date() },
-		});
+		await db
+			.update(RadioAutoDjPlaylist)
+			.set({ isActive, updatedAt: new Date() })
+			.where(eq(RadioAutoDjPlaylist.id, id));
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "radio_autodj_toggle",
@@ -123,7 +123,7 @@ export async function deleteTrack(formData: FormData): Promise<void> {
 	if (id === null) return;

 	try {
-		await prisma.radioAutoDjPlaylist.delete({ where: { id } });
+		await db.delete(RadioAutoDjPlaylist).where(eq(RadioAutoDjPlaylist.id, id));
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "radio_autodj_delete",
@@ -1,9 +1,10 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, RadioBanners, RadioRanks, WebsiteSetting } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";

 // ── Helpers ────────────────────────────────────────────────────────────────
@@ -44,11 +45,10 @@ export async function saveRadioSetting(formData: FormData): Promise<void> {
 	if (!key) return;

 	try {
-		await prisma.websiteSetting.upsert({
-			where: { key },
-			update: { value },
-			create: { key, value, comment: comment || null },
-		});
+		await db
+			.insert(WebsiteSetting)
+			.values({ key, value, comment: comment || null })
+			.onDuplicateKeyUpdate({ set: { value } });
 		siteSettings.reload();
 	} catch {
 		// DB unavailable — fail soft so the action does not throw.
@@ -71,14 +71,13 @@ export async function saveRadioSettings(formData: FormData): Promise<void> {
 	if (keys.length === 0) return;

 	try {
-		await prisma.$transaction(
+		await Promise.all(
 			keys.map((key) => {
 				const value = str(formData.get(key));
-				return prisma.websiteSetting.upsert({
-					where: { key },
-					update: { value },
-					create: { key, value, comment: null },
-				});
+				return db
+					.insert(WebsiteSetting)
+					.values({ key, value, comment: null })
+					.onDuplicateKeyUpdate({ set: { value } });
 			}),
 		);
 		siteSettings.reload();
@@ -105,17 +104,15 @@ export async function createRadioBanner(formData: FormData): Promise<void> {
 	const now = new Date();

 	try {
-		await prisma.radioBanners.create({
-			data: {
-				userId: BigInt(staff.id),
-				imagePath,
-				title: title || null,
-				description: description || null,
-				sortOrder,
-				isActive,
-				createdAt: now,
-				updatedAt: now,
-			},
+		await db.insert(RadioBanners).values({
+			userId: BigInt(staff.id),
+			imagePath,
+			title: title || null,
+			description: description || null,
+			sortOrder,
+			isActive,
+			createdAt: now,
+			updatedAt: now,
 		});
 	} catch {
 		// Fail soft.
@@ -139,17 +136,17 @@ export async function updateRadioBanner(formData: FormData): Promise<void> {
 	if (!imagePath) return;

 	try {
-		await prisma.radioBanners.update({
-			where: { id },
-			data: {
+		await db
+			.update(RadioBanners)
+			.set({
 				imagePath,
 				title: title || null,
 				description: description || null,
 				sortOrder,
 				isActive,
 				updatedAt: new Date(),
-			},
-		});
+			})
+			.where(eq(RadioBanners.id, id));
 	} catch {
 		// Row may be gone; ignore.
 	}
@@ -161,7 +158,7 @@ export async function deleteRadioBanner(formData: FormData): Promise<void> {
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 	try {
-		await prisma.radioBanners.delete({ where: { id } });
+		await db.delete(RadioBanners).where(eq(RadioBanners.id, id));
 	} catch {
 		// Already deleted; ignore.
 	}
@@ -181,15 +178,13 @@ export async function createRadioRank(formData: FormData): Promise<void> {
 	const now = new Date();

 	try {
-		await prisma.radioRanks.create({
-			data: {
-				name,
-				description: description || null,
-				badgeCode: badgeCode || null,
-				isActive,
-				createdAt: now,
-				updatedAt: now,
-			},
+		await db.insert(RadioRanks).values({
+			name,
+			description: description || null,
+			badgeCode: badgeCode || null,
+			isActive,
+			createdAt: now,
+			updatedAt: now,
 		});
 	} catch {
 		// Fail soft.
@@ -209,16 +204,16 @@ export async function updateRadioRank(formData: FormData): Promise<void> {
 	if (!name) return;

 	try {
-		await prisma.radioRanks.update({
-			where: { id },
-			data: {
+		await db
+			.update(RadioRanks)
+			.set({
 				name,
 				description: description || null,
 				badgeCode: badgeCode || null,
 				isActive,
 				updatedAt: new Date(),
-			},
-		});
+			})
+			.where(eq(RadioRanks.id, id));
 	} catch {
 		// Row may be gone; ignore.
 	}
@@ -230,7 +225,7 @@ export async function deleteRadioRank(formData: FormData): Promise<void> {
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 	try {
-		await prisma.radioRanks.delete({ where: { id } });
+		await db.delete(RadioRanks).where(eq(RadioRanks.id, id));
 	} catch {
 		// Already deleted; ignore.
 	}
@@ -1,9 +1,10 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, RadioShouts } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";

 /** Parse a FormData field into a positive BigInt id, or null when invalid. */
@@ -28,7 +29,7 @@ export async function deleteShout(formData: FormData): Promise<void> {
 	if (id === null) return;

 	try {
-		await prisma.radioShouts.delete({ where: { id } });
+		await db.delete(RadioShouts).where(eq(RadioShouts.id, id));
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "radio.shout.delete",
@@ -3,8 +3,8 @@
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, WebsiteSetting } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 import { logStaffActivity } from "@/lib/services/staff-activity";

@@ -67,15 +67,16 @@ export async function savePoints(formData: FormData): Promise<void> {
 	};

 	try {
-		await prisma.$transaction(
+		await Promise.all(
 			POINTS_KEYS.map((key) =>
-				prisma.websiteSetting.upsert({
-					where: { key },
+				db
+					.insert(WebsiteSetting)
 					// eslint-disable-next-line security/detect-object-injection -- key from POINTS_KEYS const
-					update: { value: values[key] },
-					// eslint-disable-next-line security/detect-object-injection -- key from POINTS_KEYS const
-					create: { key, value: values[key], comment: "Radio points" },
-				}),
+					.values({ key, value: values[key], comment: "Radio points" })
+					.onDuplicateKeyUpdate({
+						// eslint-disable-next-line security/detect-object-injection -- key from POINTS_KEYS const
+						set: { value: values[key] },
+					}),
 			),
 		);
 		siteSettings.reload();
@@ -1,10 +1,11 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, WebsiteRareValueCategories, WebsiteRareValues } from "@/lib/db";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";

 export async function createCategory(formData: FormData): Promise<void> {
 	await requirePermission(PERMS.SHOP_EDIT);
@@ -24,8 +25,10 @@ export async function createCategory(formData: FormData): Promise<void> {
 	if (!name || !badge) return;

 	try {
-		await prisma.websiteRareValueCategories.create({
-			data: { name, badge, priority },
+		await db.insert(WebsiteRareValueCategories).values({
+			name,
+			badge,
+			priority,
 		});
 	} catch {
 		// Unique name collision or DB error — ignore, page will re-render unchanged.
@@ -40,8 +43,12 @@ export async function deleteCategory(formData: FormData): Promise<void> {

 	try {
 		// Remove the category's values first to avoid orphaned rows.
-		await prisma.websiteRareValues.deleteMany({ where: { categoryId: id } });
-		await prisma.websiteRareValueCategories.delete({ where: { id } });
+		await db
+			.delete(WebsiteRareValues)
+			.where(eq(WebsiteRareValues.categoryId, id));
+		await db
+			.delete(WebsiteRareValueCategories)
+			.where(eq(WebsiteRareValueCategories.id, id));
 	} catch {
 		// Not found or DB error — ignore.
 	}
@@ -81,16 +88,14 @@ export async function createValue(formData: FormData): Promise<void> {
 			.slice(0, 255) || "diamonds";

 	try {
-		await prisma.websiteRareValues.create({
-			data: {
-				categoryId,
-				itemId,
-				name,
-				creditValue: creditValueRaw || null,
-				currencyValue: currencyValueRaw || null,
-				currencyType,
-				furnitureIcon,
-			},
+		await db.insert(WebsiteRareValues).values({
+			categoryId,
+			itemId,
+			name,
+			creditValue: creditValueRaw || null,
+			currencyValue: currencyValueRaw || null,
+			currencyType,
+			furnitureIcon,
 		});
 	} catch {
 		// DB error — ignore.
@@ -104,7 +109,7 @@ export async function deleteValue(formData: FormData): Promise<void> {
 	if (!id) return;

 	try {
-		await prisma.websiteRareValues.delete({ where: { id } });
+		await db.delete(WebsiteRareValues).where(eq(WebsiteRareValues.id, id));
 	} catch {
 		// Not found or DB error — ignore.
 	}
@@ -1,16 +1,17 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { z } from "zod";
 import { MANAGED_SETTING_KEYS } from "@/app/admin/settings/cms-settings-config";
 import { requirePermissionRateLimited } from "@/lib/admin/guard";
+import { db, WebsiteSetting } from "@/lib/db";
 import { actionOk, adminAction } from "@/lib/foundation/action";
 import {
 	HABBO_GAMEDATA_HOTEL_SETTING_KEY,
 	normalizeHabboGamedataHotel,
 } from "@/lib/habbo-gamedata-hotel";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { clearHabboItCache } from "@/lib/services/habbo-furnidata-cache";
 import { clearBadgeCache } from "@/lib/services/habboassets";
 import { siteSettings } from "@/lib/services/site-settings";
@@ -48,11 +49,10 @@ export const saveManagedSettings = adminAction(
 			.map(([key, value]) => [key, normalizeSettingValue(key, value)] as const);
 		await Promise.all(
 			entries.map(([key, value]) =>
-				prisma.websiteSetting.upsert({
-					where: { key },
-					update: { value },
-					create: { key, value },
-				}),
+				db
+					.insert(WebsiteSetting)
+					.values({ key, value })
+					.onDuplicateKeyUpdate({ set: { value } }),
 			),
 		);
 		await siteSettings.reload();
@@ -76,7 +76,10 @@ export async function updateSetting(formData: FormData): Promise<void> {
 		String(formData.get("value") ?? "").normalize("NFC"),
 	);
 	if (!key) return;
-	await prisma.websiteSetting.update({ where: { key }, data: { value } });
+	await db
+		.update(WebsiteSetting)
+		.set({ value })
+		.where(eq(WebsiteSetting.key, key));
 	await siteSettings.reload();
 	bustGamedataCachesIfNeeded(key);
 	revalidatePath("/admin/settings");
@@ -97,11 +100,10 @@ export async function createSetting(formData: FormData): Promise<void> {
 		.trim()
 		.slice(0, 255);
 	if (!key) return;
-	await prisma.websiteSetting.upsert({
-		where: { key },
-		update: { value },
-		create: { key, value, comment: comment || null },
-	});
+	await db
+		.insert(WebsiteSetting)
+		.values({ key, value, comment: comment || null })
+		.onDuplicateKeyUpdate({ set: { value } });
 	await siteSettings.reload();
 	bustGamedataCachesIfNeeded(key);
 	revalidatePath("/admin/settings");
@@ -113,7 +115,7 @@ export async function deleteSetting(formData: FormData): Promise<void> {
 		.normalize("NFC")
 		.trim();
 	if (!key) return;
-	await prisma.websiteSetting.delete({ where: { key } });
+	await db.delete(WebsiteSetting).where(eq(WebsiteSetting.key, key));
 	await siteSettings.reload();
 	bustGamedataCachesIfNeeded(key);
 	revalidatePath("/admin/settings");
@@ -1,11 +1,13 @@
 "use server";

+import { eq } from "drizzle-orm";
+import type { ResultSetHeader } from "mysql2";
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, WebsiteShopArticles } from "@/lib/db";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { logServerError } from "@/lib/server-log";
 import { logStaffActivity } from "@/lib/services/staff-activity";

@@ -40,43 +42,42 @@ export async function createShopArticle(formData: FormData): Promise<void> {
 	if (!name) return;

 	const now = new Date();
+	const costs = reqUInt(formData, "costs");
 	try {
-		const created = await prisma.websiteShopArticles.create({
-			data: {
-				name,
-				info: String(formData.get("info") ?? "")
+		const [result] = (await db.insert(WebsiteShopArticles).values({
+			name,
+			info: String(formData.get("info") ?? "")
+				.normalize("NFC")
+				.trim()
+				.slice(0, 255),
+			iconUrl: String(formData.get("icon") ?? "")
+				.normalize("NFC")
+				.trim()
+				.slice(0, 255),
+			color: String(formData.get("color") ?? "")
+				.normalize("NFC")
+				.trim()
+				.slice(0, 255),
+			costs,
+			giveRank: optUInt(formData, "giveRank"),
+			credits: optUInt(formData, "credits"),
+			duckets: optUInt(formData, "duckets"),
+			diamonds: optUInt(formData, "diamonds"),
+			badges:
+				String(formData.get("badges") ?? "")
 					.normalize("NFC")
 					.trim()
-					.slice(0, 255),
-				iconUrl: String(formData.get("icon") ?? "")
-					.normalize("NFC")
-					.trim()
-					.slice(0, 255),
-				color: String(formData.get("color") ?? "")
-					.normalize("NFC")
-					.trim()
-					.slice(0, 255),
-				costs: reqUInt(formData, "costs"),
-				giveRank: optUInt(formData, "giveRank"),
-				credits: optUInt(formData, "credits"),
-				duckets: optUInt(formData, "duckets"),
-				diamonds: optUInt(formData, "diamonds"),
-				badges:
-					String(formData.get("badges") ?? "")
-						.normalize("NFC")
-						.trim()
-						.slice(0, 255) || null,
-				position: reqUInt(formData, "position"),
-				createdAt: now,
-				updatedAt: now,
-			},
-		});
+					.slice(0, 255) || null,
+			position: reqUInt(formData, "position"),
+			createdAt: now,
+			updatedAt: now,
+		})) as unknown as [ResultSetHeader];
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "shop_create",
-			description: `Created shop package "${name}" (${created.costs} costs)`,
+			description: `Created shop package "${name}" (${costs} costs)`,
 			targetType: "shop_article",
-			targetId: Number(created.id),
+			targetId: Number(result.insertId),
 		});
 	} catch (error) {
 		logServerError("admin.shop_create_failed", error, {
@@ -103,9 +104,9 @@ export async function updateShopArticle(formData: FormData): Promise<void> {
 	if (!name) return;

 	try {
-		await prisma.websiteShopArticles.update({
-			where: { id },
-			data: {
+		await db
+			.update(WebsiteShopArticles)
+			.set({
 				name,
 				info: String(formData.get("info") ?? "")
 					.normalize("NFC")
@@ -131,8 +132,8 @@ export async function updateShopArticle(formData: FormData): Promise<void> {
 						.slice(0, 255) || null,
 				position: reqUInt(formData, "position"),
 				updatedAt: new Date(),
-			},
-		});
+			})
+			.where(eq(WebsiteShopArticles.id, id));
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "shop_update",
@@ -159,7 +160,7 @@ export async function deleteShopArticle(formData: FormData): Promise<void> {
 	if (!id) return;

 	try {
-		await prisma.websiteShopArticles.delete({ where: { id } });
+		await db.delete(WebsiteShopArticles).where(eq(WebsiteShopArticles.id, id));
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "shop_delete",
@@ -0,0 +1,134 @@
+// @ts-nocheck
+import { revalidatePath } from "next/cache";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermission } from "@/lib/admin/guard";
+import { logStaffActivity } from "@/lib/services/staff-activity";
+import { createTag, deleteTag, updateTag } from "./admin-tags";
+
+const { insertValues, updateWhere, deleteWhere, transaction } = vi.hoisted(
+	() => {
+		const insertValues = vi.fn().mockResolvedValue([{ insertId: 1 }]);
+		const updateWhere = vi.fn().mockResolvedValue([{ affectedRows: 1 }]);
+		const deleteWhere = vi.fn().mockResolvedValue([{ affectedRows: 1 }]);
+		const transaction = vi.fn(async (fn) =>
+			fn({
+				delete: vi.fn(() => ({ where: deleteWhere })),
+			}),
+		);
+		return { insertValues, updateWhere, deleteWhere, transaction };
+	},
+);
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({ PERMS: { PAGES_EDIT: "pages.edit" } }));
+vi.mock("@/lib/db", () => ({
+	db: {
+		insert: vi.fn(() => ({ values: insertValues })),
+		update: vi.fn(() => ({ set: vi.fn(() => ({ where: updateWhere })) })),
+		delete: vi.fn(() => ({ where: deleteWhere })),
+		transaction,
+	},
+	Tags: { id: "id", name: "name", backgroundColor: "backgroundColor" },
+	Taggables: { tagId: "tagId" },
+}));
+vi.mock("@/lib/services/staff-activity", () => ({ logStaffActivity: vi.fn() }));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+
+const staff = { id: 1, rank: 7, username: "admin" };
+const fakeForm = (data: Record<string, string>) => ({
+	get: (key: string) => data[key] ?? null,
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(requirePermission).mockResolvedValue(staff as never);
+	insertValues.mockResolvedValue([{ insertId: 1 }]);
+	updateWhere.mockResolvedValue([{ affectedRows: 1 }]);
+	deleteWhere.mockResolvedValue([{ affectedRows: 1 }]);
+	transaction.mockImplementation(async (fn) =>
+		fn({
+			delete: vi.fn(() => ({ where: deleteWhere })),
+		}),
+	);
+});
+
+describe("createTag", () => {
+	it("creates a tag and revalidates", async () => {
+		await createTag(
+			fakeForm({
+				name: "News",
+				backgroundColor: "#ff0000",
+			}) as unknown as FormData,
+		);
+
+		expect(insertValues).toHaveBeenCalledWith(
+			expect.objectContaining({ name: "News" }),
+		);
+		expect(logStaffActivity).toHaveBeenCalled();
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/tags");
+	});
+
+	it("returns early when name is empty", async () => {
+		await createTag(fakeForm({ name: "" }) as unknown as FormData);
+		expect(insertValues).not.toHaveBeenCalled();
+	});
+
+	it("uses default color when not provided", async () => {
+		await createTag(fakeForm({ name: "Test" }) as unknown as FormData);
+
+		expect(insertValues).toHaveBeenCalledWith(
+			expect.objectContaining({ backgroundColor: "#888888" }),
+		);
+	});
+
+	it("handles db error gracefully", async () => {
+		insertValues.mockRejectedValue(new Error("DB error"));
+
+		await expect(
+			createTag(fakeForm({ name: "News" }) as unknown as FormData),
+		).resolves.toBeUndefined();
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/tags");
+	});
+});
+
+describe("updateTag", () => {
+	it("updates a tag and revalidates", async () => {
+		await updateTag(
+			fakeForm({
+				id: "42",
+				name: "Updated",
+				backgroundColor: "#00ff00",
+			}) as unknown as FormData,
+		);
+
+		expect(updateWhere).toHaveBeenCalled();
+		expect(logStaffActivity).toHaveBeenCalled();
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/tags");
+	});
+
+	it("returns early when id is invalid", async () => {
+		await updateTag(fakeForm({ id: "", name: "Test" }) as unknown as FormData);
+		expect(updateWhere).not.toHaveBeenCalled();
+	});
+
+	it("returns early when name is empty after update", async () => {
+		await updateTag(fakeForm({ id: "42", name: "" }) as unknown as FormData);
+		expect(updateWhere).not.toHaveBeenCalled();
+	});
+});
+
+describe("deleteTag", () => {
+	it("deletes a tag and its taggables", async () => {
+		await deleteTag(fakeForm({ id: "42" }) as unknown as FormData);
+
+		expect(transaction).toHaveBeenCalled();
+		expect(deleteWhere).toHaveBeenCalled();
+		expect(logStaffActivity).toHaveBeenCalled();
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/tags");
+	});
+
+	it("returns early when id is invalid", async () => {
+		await deleteTag(fakeForm({ id: "" }) as unknown as FormData);
+		expect(transaction).not.toHaveBeenCalled();
+	});
+});
@@ -1,9 +1,11 @@
 "use server";

+import { eq } from "drizzle-orm";
+import type { ResultSetHeader } from "mysql2";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, Taggables, Tags } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";

 // ── Helpers ────────────────────────────────────────────────────────────────
@@ -40,15 +42,18 @@ export async function createTag(formData: FormData): Promise<void> {
 	const now = new Date();

 	try {
-		const created = await prisma.tags.create({
-			data: { name, backgroundColor, createdAt: now, updatedAt: now },
-		});
+		const [result] = (await db.insert(Tags).values({
+			name,
+			backgroundColor,
+			createdAt: now,
+			updatedAt: now,
+		})) as unknown as [ResultSetHeader];
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "tag_create",
-			description: `Created tag "${name}" (#${created.id})`,
+			description: `Created tag "${name}" (#${result.insertId})`,
 			targetType: "tag",
-			targetId: Number(created.id),
+			targetId: Number(result.insertId),
 		});
 	} catch {
 		// Fail soft — DB unavailable or duplicate.
@@ -66,10 +71,10 @@ export async function updateTag(formData: FormData): Promise<void> {
 	if (!name) return;

 	try {
-		await prisma.tags.update({
-			where: { id },
-			data: { name, backgroundColor, updatedAt: new Date() },
-		});
+		await db
+			.update(Tags)
+			.set({ name, backgroundColor, updatedAt: new Date() })
+			.where(eq(Tags.id, id));
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "tag_update",
@@ -90,10 +95,10 @@ export async function deleteTag(formData: FormData): Promise<void> {

 	try {
 		// Remove the tag and any taggable links pointing at it.
-		await prisma.$transaction([
-			prisma.taggables.deleteMany({ where: { tagId: id } }),
-			prisma.tags.delete({ where: { id } }),
-		]);
+		await db.transaction(async (tx) => {
+			await tx.delete(Taggables).where(eq(Taggables.tagId, id));
+			await tx.delete(Tags).where(eq(Tags.id, id));
+		});
 		await logStaffActivity({
 			staffId: staff.id,
 			action: "tag_delete",
@@ -0,0 +1,59 @@
+// @ts-nocheck
+import { revalidatePath } from "next/cache";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermission } from "@/lib/admin/guard";
+import { createTeam, deleteTeam } from "./admin-teams";
+
+const { insertValues, deleteWhere } = vi.hoisted(() => {
+	const insertValues = vi.fn().mockResolvedValue([{ insertId: 1 }]);
+	const deleteWhere = vi.fn().mockResolvedValue([{ affectedRows: 1 }]);
+	return { insertValues, deleteWhere };
+});
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({ PERMS: { USERS_EDIT: "users.edit" } }));
+vi.mock("@/lib/db", () => ({
+	db: {
+		insert: vi.fn(() => ({ values: insertValues })),
+		delete: vi.fn(() => ({ where: deleteWhere })),
+	},
+	WebsiteTeams: { id: "id" },
+}));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+
+const staff = { id: 1, rank: 7, username: "admin" };
+const fakeForm = (data: Record<string, string | null>) => ({
+	get: (key: string) => (key in data ? data[key] : null),
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(requirePermission).mockResolvedValue(staff as never);
+	insertValues.mockResolvedValue([{ insertId: 1 }]);
+	deleteWhere.mockResolvedValue([{ affectedRows: 1 }]);
+});
+
+describe("createTeam", () => {
+	it("creates a team entry", async () => {
+		await createTeam(
+			fakeForm({ rankName: "Moderator" }) as unknown as FormData,
+		);
+		expect(insertValues).toHaveBeenCalledWith(
+			expect.objectContaining({ rankName: "Moderator" }),
+		);
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/teams");
+	});
+
+	it("returns early when rankName is empty", async () => {
+		await createTeam(fakeForm({ rankName: "" }) as unknown as FormData);
+		expect(insertValues).not.toHaveBeenCalled();
+	});
+});
+
+describe("deleteTeam", () => {
+	it("deletes a team entry", async () => {
+		await deleteTeam(fakeForm({ id: "42" }) as unknown as FormData);
+		expect(deleteWhere).toHaveBeenCalled();
+		expect(revalidatePath).toHaveBeenCalledWith("/admin/teams");
+	});
+});
@@ -1,9 +1,10 @@
 "use server";

+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, WebsiteTeams } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";

 export async function createTeam(formData: FormData): Promise<void> {
 	await requirePermission(PERMS.USERS_EDIT);
@@ -26,16 +27,14 @@ export async function createTeam(formData: FormData): Promise<void> {
 	const hiddenRank = formData.get("hiddenRank") === "on";

 	const now = new Date();
-	await prisma.websiteTeams.create({
-		data: {
-			rankName: rankName.slice(0, 255),
-			badge: badge ? badge.slice(0, 255) : null,
-			jobDescription: jobDescription ? jobDescription.slice(0, 255) : null,
-			staffColor: staffColor.slice(0, 255),
-			hiddenRank,
-			createdAt: now,
-			updatedAt: now,
-		},
+	await db.insert(WebsiteTeams).values({
+		rankName: rankName.slice(0, 255),
+		badge: badge ? badge.slice(0, 255) : null,
+		jobDescription: jobDescription ? jobDescription.slice(0, 255) : null,
+		staffColor: staffColor.slice(0, 255),
+		hiddenRank,
+		createdAt: now,
+		updatedAt: now,
 	});

 	revalidatePath("/admin/teams");
@@ -45,7 +44,7 @@ export async function deleteTeam(formData: FormData): Promise<void> {
 	await requirePermission(PERMS.USERS_EDIT);

 	const id = BigInt(String(formData.get("id")));
-	await prisma.websiteTeams.delete({ where: { id } });
+	await db.delete(WebsiteTeams).where(eq(WebsiteTeams.id, id));

 	revalidatePath("/admin/teams");
 }
@@ -3,8 +3,8 @@
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, WebsiteSetting } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 import { ensureReadableThemeColors } from "@/lib/theme-contrast";
@@ -24,11 +24,10 @@ const HEADING_KEYS = ["size_heading_h1", "size_heading_h2", "size_heading_h3"];
 const CUSTOM_CSS_MAX = 20000;

 async function writeSetting(key: string, value: string): Promise<void> {
-	await prisma.websiteSetting.upsert({
-		where: { key },
-		update: { value },
-		create: { key, value, comment: "Theme (housekeeping)" },
-	});
+	await db
+		.insert(WebsiteSetting)
+		.values({ key, value, comment: "Theme (housekeeping)" })
+		.onDuplicateKeyUpdate({ set: { value } });
 }

 export async function saveTheme(formData: FormData): Promise<void> {
@@ -1,10 +1,12 @@
 "use server";

+import { eq } from "drizzle-orm";
+import type { ResultSetHeader } from "mysql2";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
 import { positiveBigInt } from "@/lib/api";
+import { db, WebsiteShopVouchers } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import {
 	type ActionResult,
 	actionError,
@@ -45,19 +47,17 @@ export async function createVoucher(input: {
 	const now = new Date();

 	try {
-		const created = await prisma.websiteShopVouchers.create({
-			data: {
-				code,
-				amount: Math.floor(amount),
-				maxUses,
-				useCount: 0,
-				expiresAt,
-				createdAt: now,
-				updatedAt: now,
-			},
-		});
+		const [result] = (await db.insert(WebsiteShopVouchers).values({
+			code,
+			amount: Math.floor(amount),
+			maxUses,
+			useCount: 0,
+			expiresAt,
+			createdAt: now,
+			updatedAt: now,
+		})) as unknown as [ResultSetHeader];
 		revalidatePath("/admin/vouchers");
-		return actionOk({ id: String(created.id) });
+		return actionOk({ id: String(result.insertId) });
 	} catch (error) {
 		logServerError("admin.voucher_create_failed", error);
 		return actionError("Could not create voucher (code may already exist)");
@@ -73,7 +73,7 @@ export async function deleteVoucher(input: {
 	if (!id) return actionError("Missing voucher id");

 	try {
-		await prisma.websiteShopVouchers.delete({ where: { id } });
+		await db.delete(WebsiteShopVouchers).where(eq(WebsiteShopVouchers.id, id));
 		revalidatePath("/admin/vouchers");
 		return actionOk();
 	} catch (error) {
@@ -0,0 +1,60 @@
+import { redirect } from "next/navigation";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { requirePermission } from "@/lib/admin/guard";
+import { siteSettings } from "@/lib/services/site-settings";
+import { saveVpn } from "./admin-vpn";
+
+const { mockValues, mockOnDuplicateKeyUpdate } = vi.hoisted(() => {
+	const mockOnDuplicateKeyUpdate = vi.fn().mockResolvedValue(undefined);
+	const mockValues = vi.fn(() => ({
+		onDuplicateKeyUpdate: mockOnDuplicateKeyUpdate,
+	}));
+	return { mockValues, mockOnDuplicateKeyUpdate };
+});
+
+vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
+vi.mock("@/lib/permissions", () => ({
+	PERMS: { SETTINGS_EDIT: "settings.edit" },
+}));
+vi.mock("@/lib/db", () => ({
+	db: {
+		insert: vi.fn(() => ({ values: mockValues })),
+	},
+	WebsiteSetting: { key: "key", value: "value" },
+}));
+vi.mock("@/lib/services/site-settings", () => ({
+	siteSettings: { reload: vi.fn() },
+}));
+vi.mock("@/lib/services/staff-activity", () => ({ logStaffActivity: vi.fn() }));
+vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+vi.mock("next/navigation", () => ({ redirect: vi.fn() }));
+
+const staff = { id: 1, rank: 7, username: "admin" };
+const fakeForm = (data: Record<string, string | null>) => ({
+	get: (key: string) => (key in data ? data[key] : null),
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(requirePermission).mockResolvedValue(staff as never);
+	mockValues.mockReturnValue({
+		onDuplicateKeyUpdate: mockOnDuplicateKeyUpdate,
+	});
+	mockOnDuplicateKeyUpdate.mockResolvedValue(undefined);
+});
+
+describe("saveVpn", () => {
+	it("saves VPN settings and redirects", async () => {
+		await saveVpn(
+			fakeForm({
+				vpn_block_enabled: "1",
+				vpn_provider: "proxycheck",
+				vpn_api_key: "abc123",
+			}) as unknown as FormData,
+		);
+		expect(mockValues).toHaveBeenCalledTimes(4);
+		expect(mockOnDuplicateKeyUpdate).toHaveBeenCalledTimes(4);
+		expect(siteSettings.reload).toHaveBeenCalled();
+		expect(redirect).toHaveBeenCalledWith("/admin/vpn?saved=1");
+	});
+});
@@ -3,8 +3,8 @@
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 import { requirePermission } from "@/lib/admin/guard";
+import { db, WebsiteSetting } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 import { logStaffActivity } from "@/lib/services/staff-activity";

@@ -21,11 +21,10 @@ async function writeSetting(
 	value: string,
 	comment: string,
 ): Promise<void> {
-	await prisma.websiteSetting.upsert({
-		where: { key },
-		update: { value },
-		create: { key, value, comment },
-	});
+	await db
+		.insert(WebsiteSetting)
+		.values({ key, value, comment })
+		.onDuplicateKeyUpdate({ set: { value } });
 }

 export async function saveVpn(formData: FormData): Promise<void> {
				`@@ -0,0 +1 @@`
				Draft SQL from `pnpm db:generate` (drizzle-kit). Never apply these automatically — copy reviewed statements into drizzle/migrations/ as numbered CMS migrations, then `pnpm db:migrate`.