CHANGELOG Rebel Girl FM

Maintenance and automation

• npm run docs:sync synchronizes README and central AI documentation from changelog, package versions, i18n keys and media index data.
• npm run changelog:new -- <version> creates German, English and Spanish changelog files from one consistent template.
• npm run check:sitemap validates dist/client/sitemap-index.xml, dist/client/sitemap-0.xml, public/image-sitemap.xml and public/robots.txt.
• npm run test:song-generator checks song generator validation and API security invariants.
• npm run check now also runs the song generator security tests.
• npm run build now runs the sitemap/robots check after the Astro build.

Validation

• npm run check passed: Astro 0 errors, 0 warnings, 0 hints; i18n remains at 525 keys per language.
• npm run build passed: 96 sitemap routes and 593 unique images validated.

Privacy

• The privacy policy was updated in German, English and Spanish to June 2, 2026.
• Cloudflare Workers, Cloudflare R2/CDN, Cloudflare D1, Worker logs and OpenRouter are described more precisely.
• Song generator data flows were updated: prompt processing, short-term IP processing for rate limits and D1 archive fields.
• LocalStorage, Tally feedback, Twitch, YouTube and FlagCDN were aligned with the current project state.
• The text now clarifies that Rebel Girl FM does not use tracking, Google Analytics, a tag manager or advertising profiling.

Validation

• npm run check passed successfully.
• i18n remains synchronized with 525 keys per language.

Updates

• Astro was updated to ^6.4.2, Vite to ^7.3.5, Wrangler to ^4.96.0 and @cloudflare/workers-types to ^4.20260601.1.
• npm audit --audit-level=moderate reports no vulnerabilities.

Bug Fixes

• The song generator now allows JAPANISCH server-side in the OpenRouter proxy. The UI already exposed Japanese as a target language.
• Remaining encoding artifacts were removed from the song generator system prompt.

Pentest Hardening

• Unexpected API exceptions are logged server-side but no longer returned to clients as internal error messages.
• sitemap-index.xml is now explicitly covered by the sitemap cache rule in middleware.
• Checks, build, asset check, secret-pattern scan and input-filter smoke tests passed successfully.

Media and CDN

• public/media-index.json was regenerated from D:\sicherheit\Daten\Webseiten\Object Storage\rebel-girl-fm.de\downloads.
• The gallery now contains 593 WebP images; audio, video and lyrics remain at 897, 888 and 887 entries.
• Two new Folk-Hexe covers and five new Mei covers were uploaded directly to Cloudflare R2 in the rebel-girl-fm bucket.

Validation

• The seven new CDN URLs respond to HEAD requests with 200.
• public/image-sitemap.xml was regenerated with 593 images.
• npm run check:assets, npm run check and npm run build pass successfully.

Documentation

• The README and AI modules were brought up to date with Astro 6, Cloudflare Workers, R2/CDN, D1 archive, AI discovery and multilingual pages.
• The content sources now document the localized lore files in src/content/lore/en/ and src/content/lore/es/ as well as the localized changelog files in src/content/changelog/en/ and src/content/changelog/es/.

Indexing

• Sitemap documentation now points to sitemap-index.xml and image-sitemap.xml.
• The build generates the sitemap for the current German, English and Spanish routes, including lore, changelog, downloads and character profiles.

Project Cleanup

• The no longer referenced player voting helpers isVoted() and getBaseVotes() were removed.
• Local generated folders and dev logs were removed from the working tree; .env and node_modules were kept for deployment and local work.

Validation

• npm run check runs without errors, warnings or hints.
• npm run check:assets confirms the R2 media index.
• npm run build creates the Cloudflare Worker output without errors.

Playlists

• The Suno playlist Rebel Girl FM - Die Hirnlosen Radioschwestern was added to shared playlist data.
• The cover uses the existing CDN path for the Radio Sisters team image.
• German, English and Spanish playlist pages now show the same new card with localized text.

Validation

• npm run check confirms complete i18n keys for DE, EN and ES.
• npm run build creates the Cloudflare Worker output without errors.

AI Discovery

• robots.txt now sets Content-Signal: ai-train=no, search=yes, ai-input=yes.
• Public HTML pages return Markdown when requested with Accept: text/markdown.
• Markdown responses remain limited to public pages; /api/ and /admin/ are excluded.

Documentation

• README now describes AI discovery endpoints, the content-signal policy and intentionally unpublished OAuth, MCP and API catalog metadata.

Song Generator

• EINGABE LEEREN now sits directly next to ZUFALLS-SIGNAL.
• The old separate button block under the input was removed.

AI Indexing

• robots.txt explicitly allows important AI crawlers for public pages and keeps /api/ and /admin/ blocked.
• llms.txt provides a compact project map.
• llms-full.txt adds project identity, crawler rules, machine endpoints, main sections and character context.
• ai.txt points to the LLM and sitemap files.

Delivery

• HTML pages link the LLM files as text/plain alternates.
• Public Worker routes set X-Robots-Tag: index, follow.
• API and admin routes set noindex, nofollow, noarchive.
• HTML responses also expose the LLM files through Link headers.

Cloudflare Note

• Cloudflare dashboard bot rules must allow the permitted crawlers.
• The live check showed Cloudflare-managed robot content still being prepended; that zone setting must be disabled.

CDN Assets

• Partner logos now use the existing hyphenated files.
• The logo files were uploaded again to Cloudflare R2 and are reachable through the CDN.
• Old whitespace and %20 paths are no longer emitted on partner pages.

More Robust Image Paths

• Partner pages encode logo filenames before building CDN URLs.
• Playlist pages in DE, EN and ES encode image paths segment by segment.

QA

• npm run check and npm run build passed.
• A live asset crawl checked 602 asset URLs without 404 errors.

Song Generator

• The EINGABE LEEREN button removes the current topic text and refocuses the input.
• JAPANISCH was added to the language selection.
• Japanese is passed to the song prompt as a real target language.

QA

• npm run check and npm run build passed.

Song Generator

• TRANSMISSION STARTEN now shows progress and status directly in the generator.
• Validation errors, OpenRouter issues and archive errors appear under the button.
• The used OpenRouter model is shown after successful generation.
• ZUFALLS-SIGNAL now accepts the legitimate scenario and cover random prompts.
• If OpenRouter fails, a local fallback text is loaded.

OpenRouter and Free AI Models

• The proxy uses a fixed allowlist of free text models marked with :free.
• Paid models are blocked server-side.
• If one free model fails, the proxy tries the next one in the chain.

Image SEO and CDN

• public/image-sitemap.xml is generated from public/media-index.json.
• Gallery pages contain crawlable image fallbacks with descriptive alt text and CDN URLs.

Privacy

• Privacy texts now describe the free OpenRouter model chain, Cloudflare Workers, D1 archive and input protection more clearly.
• The fictional-character note remains in DE, EN and ES.
• The privacy date was set to May 27, 2026.

Security Review and QA

• Non-destructive checks covered headers, origin protection, invalid prompts, size limits, script/URL filters and rate limits.
• npm.cmd run check, npm.cmd run check:assets and npm.cmd run build passed.

Media and CDN

• The local downloads folder was synchronized with the Cloudflare R2 bucket.
• public/media-index.json was regenerated from the local object-storage structure.
• The current media index contains 897 audio files, 888 videos, 887 lyric files and 586 gallery images.
• npm run sync:r2 is available for future R2 syncs.

Dependencies and Build

• Astro, Cloudflare adapter, sitemap, Workers types and Wrangler were updated.
• Vite remains on the compatible 7.x line.

Privacy

• The privacy page was updated to May 27, 2026.
• The AI note now mentions ChatGPT, Claude and Google Gemini.
• Fictional character, biography, role, age and lore contact details are explicitly marked as fictional.

QA

• npm.cmd run check, npm.cmd run check:assets and npm.cmd run build passed.

Cloudflare Workers

• The project now targets Cloudflare Workers with the Astro runtime.
• Song-generator APIs use Cloudflare bindings through cloudflare:workers.
• Server-side code reads OPENROUTER_API_KEY, OPENROUTER_MODEL and the D1 binding DB.
• Old Pages deployment scripts were removed from npm scripts.

Song Generator

• The page is integrated into the standard site layout with header, navigation, background and language routes.
• Rebel Player links to the song generator from the gear menu.
• Character lore and fixed style rules are included in prompts.
• The generator is available in German, English and Spanish.

Security

• The proxy accepts only the expected song-generator prompt format.
• Characters, languages, moods, durations and formats are validated server-side.
• Browser and server inputs are checked against spam, random characters, links, email addresses, script code and excessive length.
• OpenRouter and archive routes have rate limits, size limits and origin checks.
• The D1 archive blocks duplicate entries for the same idea and character within 15 minutes.

Accessibility and Content

• Lore and About pages now include a browser Speech Synthesis read-aloud function.
• About was realigned to the full station, lore and StorytellerZ context.
• Image alt texts and aria labels were improved.

Rebel Player

• Playlist clicks start the selected track through the central player logic.
• Playback state, source switching and media unloading were stabilized.
• The gear menu contains a direct song-generator link.

SEO, Privacy and Maintenance

• README, privacy notes, sitemap, robots and metadata were updated.
• Temporary logs and Vite cache files were removed and added to .gitignore.

QA

• npm run check and npm run build passed.
• A local non-destructive security smoke test was performed.

Lore

• The lore page now generates a chapter navigation from ## headings.
• On desktop the chapter box stays visible at the side.
• On tablet and mobile it appears compactly above the content.
• Chapter links use smooth scrolling.

Playlists

• Playlist covers now use the same square image frame.
• Different source formats are cropped consistently with object-fit: cover.
• The Mei playlist now uses the real Mei image instead of the generic Rebel Girl cover.
• The change applies to German, English and Spanish.

QA

• npm run check and npm run build passed.
• Translation files were checked for complete keys, empty values, placeholders and playlist texts.
• An encoding issue in the About lore teaser was fixed.

Media and R2

• The local object-storage structure was cleaned up and uploaded again to Cloudflare R2.
• The rebel-girl-fm bucket contains 3,223 objects.
• Remaining PNG and WAV originals were removed after conversion.
• Current formats are .opus, .webm, .webp, .txt and .htaccess.
• public/media-index.json was regenerated.

Rebel Player

• Mei-Die-neue-Praktikantin is available as an audio filter.
• The Mei player cover points to the matching CDN image.

Playlists and Content

• The Mei and STTZ-AprilScherz Suno playlists were added.
• The lore page shows character images beside profile data.

QA

• npm run check and npm run build passed.

Content and Lore

• The old story workspace was moved into the production content structure.
• The chronicle now lives in src/content/lore/lore.md.
• Official character profiles are available as lore source in src/content/lore/figurenprofile.md.
• Main and side characters have Markdown files under src/content/characters/.

Character Profiles and About

• The About page now loads characters from the Characters collection.
• Main and side characters are sorted through category.
• Mei was added as a main character and Punk-Muschi moved to side characters.
• Character pages are connected for German, English and Spanish.

Internationalization

• Translation files were synchronized.
• All three languages contain 439 translation keys.

CDN and Media Index

• scripts/sync.js can build the media index from a local object-storage structure.
• Gallery scanning is recursive and CDN paths are encoded safely.

Rebel Player

• The fallback image, first loading state and cover URL handling were fixed.

SEO, Security and QA

• robots.txt and security headers were cleaned up.
• npm run check and npm run build passed.

Build Tooling

• A new .nvmrc with 24 is used by Cloudflare Pages, GitHub Actions and local node managers.
• .npmrc now contains legacy-peer-deps=true, solving the TypeScript 6 and @astrojs/check peer dependency conflict.

Stack Consistency

• All four partner projects now use the same build base: Node 24 plus npm with legacy-peer-deps.

Privacy

• The privacy date was updated to April 25, 2026 in DE, EN and ES.

No Content Changes

• Codebase and i18n keys remain unchanged.

Synchronization Release

This entry documents the language rollout for the three partner projects. Rebel Girl FM already had the DE/EN/ES feature set and served as the reference.

Partner Projects Expanded

• dampferburg: New Spanish routes, three inline SVG flags and sitemap i18n.
• dampfermessen: Around 150 new Spanish translation keys and a third flag button.
• noob-town: Spanish as third language with a GDPR-friendly inline flag switcher.

Rebel Girl FM as Reference

The established src/i18n/{de,en,es}.ts pattern served as the model for the other projects.

No Local Code Changes

• The Rebel Girl FM codebase stayed unchanged.
• The privacy date already matched April 24, 2026.

Cloudflare Automation

• A new wrangler.toml with R2 bucket binding was added.
• npm run setup:cloudflare checks and creates Cloudflare resources through the CLI.
• The setup script uses npx wrangler for cross-platform reliability.

Feedback Fallback

• If the Tally form is blocked, a notice with a direct link appears after five seconds.
• Three new translation keys were added per language.

Character Rename

• Dieter Lauerbach was renamed to Karl Lauerbach across translations and documentation.

Dependency Updates

• Astro, TypeScript, Wrangler, Tailwind and Vite dependencies were updated.

CSS and Build Fix

• A Tailwind @source directive was removed to avoid a rolldown build issue.

Unified Stack

• Rebel Girl FM now shares the same base stack with the partner projects.

Privacy

• The privacy date was updated to April 24, 2026.

Feedback Page

• New /feedback, /en/feedback and /es/feedback pages with embedded Tally form.
• The popup button was replaced by an inline form for better privacy and UX.
• Footer feedback links and translation keys were added.

Favicon

• Favicon was moved to the CDN WebP file.
• Duplicate SVG favicon entry was removed.

AI Documentation

• The old docs were replaced by 16 structured modules.
• CLAUDE.md was updated for the new module structure.

Privacy Update

• A new Tally.so third-party section was added in DE, EN and ES.
• The privacy date was updated to April 19, 2026.

Cleanup and Fixes

• Decap CMS was removed.
• Hero components hydrate faster.
• Video path filtering and ES gallery routing were corrected.

Complete Astro 6 Migration

• The project moved from static HTML/JS to Astro 6, Preact and Tailwind CSS v4.
• 85 pages are now generated with better performance, security and SEO.
• Interactive player, gallery and filters run as isolated Preact islands.
• Nanostores provide global playback state.
• Character profiles and changelog use Astro Content Collections.
• Page transitions run through <ClientRouter />.

Persona Updates

• A new sexuality field was added to all persona pages.
• All values were translated into German, English and Spanish.
• Persona pages now include structured Person JSON-LD.

Rebel Player

• A music-video playlist group was added to the video area.
• media-index.json is loaded client-side to avoid hydration issues.
• A loading indicator appears during player initialization.

SEO and Performance

• RadioStation JSON-LD, OG image dimensions, Twitter/X tags and PWA manifest were added.
• Persona images use eager loading where needed.
• The footer and robots.txt were improved.

Security and Fixes

• CSP was expanded for the media CDN.
• Character image URLs, OG image URLs, playlist loading and deployment settings were fixed.

AI Documentation

• CLAUDE.md and the ki/ documentation folder were added for AI assistants.

Cloudflare R2 Migration

• All media files are now delivered through cdn.rebel-girl-fm.de instead of the local repository.
• Media is cached and delivered globally through Cloudflare.
• The public/downloads/ folder was removed from the Git repository.

Cleanup

• Old MP4, WAV and PNG files were removed; only WebM, Opus and WebP remain.
• One-off PowerShell conversion scripts and temporary artifacts were removed.
• TypeScript hints and warnings were resolved.

Updates

• Astro, Preact and security-related dependencies were updated.
• The z import was migrated to astro/zod.

Fixes

• Lyrics indexing was corrected from Audio/ to Songtexte/.
• A Unicode error in the StorytellerZ logo filename was fixed.
• The Ex-Freund image was added to persona and About pages.
• Teufel’s age display was shortened.

Privacy

• The privacy policy now mentions Cloudflare R2 as the media CDN in all three languages.

Media Updates

• New assets for Stalkerin, Stalker and the Radio Sisters were added and converted to WebP.
• Generated persona images were connected to the matching side-character pages.
• Old PNG files were removed and the media index was rebuilt with sync.js.

Persona Lore

• All persona pages now show the full background story from the AI prompts.
• A color-matched “Lore:” heading appears before each lore text.
• Older description and story blocks were removed, leaving lore as the main body text.

Persona Data

• Age is now displayed as DD.MM.YYYY (X years).
• Genres were updated to the top three genres from the AI prompts.
• Duplicate role display was removed.

Layout Improvements

• Persona images now fill the full height of the info box.

About and i18n

• The About page received lore-based persona descriptions in DE, EN and ES.
• Translation files were synchronized to 372 keys per language.
• The i18n check script now also detects double-quoted values.

Dependencies and Config

• Astro, Preact and TypeScript path config were updated.
• README was rewritten with project documentation.

SPA Routing Rewrite

• Dual-mode routing: Production uses clean URLs; other environments use hash routing and remain F5-safe.
• useCleanUrls() function: Detects the production domain and controls URL handling.
• Universal URL detection: Handlers evaluate hash, path and ?p= parameters.
• Second popstate handler: Added path fallback for clean URLs.

Bugfixes

• Fixed file-not-found errors when pressing F5 on tabs.
• Tabs respond to clicks again.
• Removed a duplicate } syntax error in the first popstate handler.

Picture Fallback and Media Conversion

• All 52 images received WebP <source> plus JPG <img> fallback.
• 397 JPG fallbacks were generated, 6 MP4 files converted to WebM and 7 PNG duplicates removed.
• Format pairs are complete: Opus/MP3, WebM/MP4 and WebP/JPG.

Character Profiles

• Profiles for Rebel Girl, Shadowman, Folk-Hexe, Punk-Muschi, Freundin and Rumpelstilzchen were added.

i18n Synchronization

• New label keys, duplicate fixes and 29 missing ES keys were added.
• Full coverage: 308 translation keys for DE, EN and ES.

Bugfixes and Routing

• Local file system routing: Hash fallback for local direct page access.
• OnLoad SPA reset: Removed an outdated event listener.
• i18n completion: Missing error-page headings added for DE and ES.
• Asset validator: Fixed an incorrect regex in check_assets.js.

Compliance and Hosting

• GDPR update: Complete revision of the privacy policy in DE, EN and ES.
• Cloudflare migration: Hosting through Cloudflare Pages and GitHub.

Media and Twitch Integration

• Twitch live streaming: Seamless player integration.
• Auto UI adaptation: Controls are hidden automatically during live streams.

Major Feature Update

• Clean URLs: Full switch to modern routing with the History API.
• Hierarchical playlists: Deeper folder structure for audio sources.
• Modern language selector: Header dropdown for DE, EN and ES.

Security Audit and Hardening

• HTTP security headers, CSP, Permissions-Policy and XSS mitigation.

UX and Accessibility

• Contrast update, focus indicators and revamped 404 page.

Security and Accessibility

• Security hardening: Initial hardening for security headers.
• WCAG compliance: Contrast update for better readability.
• Clean URL setup: Initial setup via 404 redirect.

Global and Accessible

• Full multilingual support: Complete localization through i18n.
• ARIA implementation: Fully translated ARIA labels.

Player and Engine Update

• Playback modes: Shuffle and repeat functions.
• Deduplication: Automated cleanup of redundant media formats.

First Implementation

• Initial routing: SPA hashes and video deduplication.
• Persona integration: Shadowman, Freundin and Rumpelstilzchen playlists.

Performance Push

• Lazy loading, WebP and WebM for faster page and media loading.

Initial Release

• Basic SPA with player, gallery and social features.