CHANGELOG Rebel Girl FM

New station schedule

• 06:00–09:00: The Brainless Radio Sisters; Mei during day-shift weeks.
• 09:00–12:00: Charlie – The Voice of the South; The Devil as guest.
• 12:00–15:00: The Brainless Radio Sisters; The Devil as guest.
• 15:00–18:00: Charlie – The Voice of the South; Mei during day-shift weeks.
• 18:00–21:00: Rebel Girl and Shadowman; The Little Folk Witch as guest; Mei during night-shift weeks.
• 21:00–00:00: Rebel Girl and Shadowman; The Little Folk Witch as guest.
• 00:00–03:00: Rebel Girl and Shadowman; Rumpelstilzchen as guest.
• 03:00–06:00: Rebel Girl and Shadowman; The Psychotic Girlfriend as guest; Mei during night-shift weeks.

Radio function

• The Rebel Player displays the complete current station schedule directly in the Radio tab.
• Guests and Mei are identified by their respective roles.
• At every shift change, the radio queue is automatically rebuilt and shuffled from songs by the assigned hosts, guests, and intern.
• Mei’s weekly rotation follows the ISO week in the station time zone Europe/Berlin.

Validation

• npm run check: 0 errors, 0 warnings, and 0 hints.
• Production build and sitemap validation: passed.

CDN and media index

• All 3,699 local CDN files were compared with the Cloudflare R2 bucket.
• 3,696 files were already identical; Rebel-Girl-cover-259.webp, Rebel-Girl-cover-260.webp, and Shadowman-cover-44.webp were uploaded.
• public/media-index.json was regenerated from the local object-storage source and contains 1,002 audio files, 1,009 videos, 1,002 lyric files, and 661 gallery images.
• Image and video sitemaps were regenerated from the synchronized media inventory.

Dependencies and documentation

• Astro ^7.0.9, Preact ^10.29.7, Vite ^8.1.4, Wrangler ^4.111.0, and all other installed packages match the current compatible registry versions.
• TypeScript intentionally remains on ^6.0.3, the newest major version supported by the current Astro checker.
• README and the AI project modules were synchronized to version 3.6.34.

Validation

• npm run check: 0 errors, 0 warnings, and 0 hints.
• npm run check:assets: 32 CDN paths, no errors.
• npm audit --audit-level=moderate: 0 vulnerabilities.
• Production build, sitemap check, and Cloudflare dry run: passed.

Rebel Player and station schedule

• The previously empty radio source now continuously plays songs by the characters assigned to the current shift.
• The current song pool is shuffled whenever radio is switched on, and the next track starts automatically after each song.
• The station schedule uses Berlin time and switches automatically between early, midday, day, handover and night shifts.
• The Brainless Radio Sisters and Charlie cover the day shifts. Rebel Girl, Shadowman, the Little Folk Witch, the Psychotic Girlfriend and Rumpelstilzchen form the night shift.
• As an intern, Mei alternates weekly between the day and night shifts. Her profile and lore were updated accordingly.

Dependencies and documentation

• Astro was updated to ^7.0.9, Preact to ^10.29.7, Vite to ^8.1.4 and Wrangler to ^4.111.0.
• @astrojs/cloudflare is now ^14.1.3, @cloudflare/workers-types is ^5.20260715.1, and the ws override is ^8.21.1.
• TypeScript remains on ^6.0.3, the newest version supported by the current Astro checker.
• The Workers compatibility date is set to 2026-06-24, the newest date supported by the bundled local runtime.
• The build automatically removes the adapter’s obsolete legacy_env field, which Wrangler 4.111 no longer accepts, from the generated deployment manifest.
• README, project modules, media index and sitemaps were synchronized.

Validation

• npm run check: 0 errors, 0 warnings and 0 hints.
• i18n: 584 keys per language.
• Song Generator security tests: passed.
• npm audit: 0 vulnerabilities.

Social Media

• The former “More Channels” placeholder card was replaced with a Funkwhale card.
• The Funkwhale card links to https://krasses.berlin/federation/music/libraries/4c2fba08-fe08-4c83-a629-550aa1faff99.
• Funkwhale and Storytellerz Discord were reordered so Funkwhale appears on the left and Discord on the right.
• The texts were added for German, English and Spanish.

CDN and Backup

• funkwhale.webp is stored at downloads/Logos/funkwhale.webp and served through https://cdn.rebel-girl-fm.de/downloads/Logos/funkwhale.webp?v=20260704.
• The R2/CDN sync checked 3696 objects, left 3694 unchanged and uploaded 2 objects.
• README and changelog were updated to v3.6.32.

Validation

• npm.cmd run check: passed.
• npm.cmd run check:assets: passed.
• npm.cmd run build: passed.
• CDN HEAD check for funkwhale.webp: 200 OK.

Dependency Update

• Astro was updated from ^7.0.5 to ^7.0.6.
• The Astro integrations were updated: @astrojs/cloudflare to ^14.1.1 and @astrojs/preact to ^6.0.1.
• Preact was updated from ^10.29.3 to ^10.29.4.
• Vite was updated from ^8.1.2 to ^8.1.3.
• Wrangler was updated from ^4.106.0 to ^4.107.0.
• @cloudflare/workers-types was updated to ^5.20260704.1.

Documentation

• README and technical project metadata now reflect the new package set and website version v3.6.31.
• The website changelog tab reads this entry from the localized Markdown sources for German, English and Spanish.

Validation

• npm outdated --json: no outdated packages.
• npm audit --audit-level=moderate: 0 vulnerabilities.
• npm run check: passed.

CDN and Images

• All known CDN references from the media index, code, manifest, image sitemap and video sitemap were checked with real GET/Range requests.
• 3,679 actually used CDN URLs were validated; the final run reported 0 errors and 0 missing local sources.
• 20 affected WebP image objects were repaired or made reachable again in R2.
• The website now uses targeted cache busting with ?v=20260702-r2 for these 20 image paths because the unversioned Cloudflare cache can still serve old 404 responses.
• The image sitemap now generates versioned URLs for the same affected images.

Affected Areas

• Azrael and Seraphine load their team images correctly again.
• Individual song covers for Charlie, The Devil, The Little Folk Witch and Rebel Girl are referenced correctly again.
• Gallery, downloads, about page, character data and image sitemap use the same cache-busting logic.

Project Audit and Cleanup

• Temporary test artifacts such as .playwright-cli/ and tmp/ were removed.
• .gitignore now permanently ignores these local test/check artifacts.
• tsconfig.json excludes tmp and .playwright-cli so Astro/TypeScript no longer analyzes generated check files.
• No domain/content files were blindly deleted; existing user/project changes were left intact.

Validation

• npm run check:assets: passed.
• npm run check: passed with 0 errors, 0 warnings, 0 hints.
• npm run build: passed.
• npm audit --audit-level=moderate: 0 vulnerabilities.
• Sitemap/robots check: 672 routes, 658 images, 1009 videos.

Playlists

• The playlist tab was corrected: the main list now shows all 19 playlists currently visible on Suno for @dampferbug.
• The previous reduction to only five playlists was reverted.
• Rebel Girl FM - The Secret Love now uses its own key, heimlicheliebe.
• Rebel Girl FM - Their Love remains a separate playlist with its own cover and link.
• The order follows the current Suno playlist tab and the reference screenshot.

Texts and Covers

• Playlist texts in German, English and Spanish were added for the new heimlicheliebe key.
• The i18n files now contain 569 keys per language.
• All cards use existing CDN covers from downloads/Bilder/Team/ or downloads/Bilder/playlist-cover/.

Documentation

• README was updated to version 3.6.29, 569 i18n keys per language and the complete 19-playlist list.
• The changelog tab includes this new entry in DE, EN and ES.

Validation and Deploy

• npm run check: passed.
• npm run check:assets: passed.
• Alternative Astro build to tmp/astro-build-check: passed.
• Cloudflare deploy succeeded; Worker version 56d407f7-523e-4699-afaa-7f239972f252.
• Live check /playlists: 200 OK.

Playlists

• The playlist tab was matched against the current Suno playlist tab for @dampferbug.
• The shared data source src/lib/playlistData.ts now shows the five currently visible Suno playlists:
  • Rebel Girl FM - The Devil
  • Rebel Girl FM - Charlie (The Voice of the South)
  • Rebel Girl FM - The Secret Love
  • Rebel Girl FM - Mei (The New Intern)
  • Sunshine State FM - The Brainless Radio Sisters
• Old main cards that are no longer visible in the current Suno playlist tab were removed from the main list.
• The StorytellerZ community block remains unchanged.

Texts and Covers

• Playlist texts in German, English and Spanish were synchronized for teufel, charlie, liebe, mei and radioschwestern.
• The new cards use existing CDN covers from downloads/Bilder/Team/ and downloads/Bilder/playlist-cover/.

Documentation

• README was updated to version 3.6.28, 566 i18n keys per language and the current playlist state.
• The changelog tab includes this new entry in DE, EN and ES.

Validation

• npm run check: passed.
• npm run check:assets: passed.
• node scripts/check_sitemap.mjs: passed; 672 routes, 658 images, 1009 videos.
• Alternative Astro build to tmp/astro-build-check: passed.
• Note: the regular npm run build was locally blocked by a locked dist/client folder with EPERM.

Program Updates

• astro was updated to ^7.0.5.
• @astrojs/cloudflare was updated to ^14.1.0.
• npm outdated reports no outdated packages after the update.
• npm audit reports 0 vulnerabilities.

Documentation and Website Tabs

• README and all files under ki/ were synchronized with the current project state.
• The changelog tab now includes this new entry.
• The privacy tab was updated in DE, EN and ES to the current July 2, 2026 status.

CDN and Media Index

• The R2/CDN sync was run against the local object-storage structure.
• public/media-index.json, public/image-sitemap.xml and public/video-sitemap.xml were regenerated.

Validation

• npm run sync:r2: passed; 3695 files checked, 3634 unchanged, 61 uploads, 0 failures.
• npm run sync: passed.
• npm run check:assets: passed.
• npm run check: passed.
• npm run build: passed.

CDN and Downloads

• public/media-index.json was regenerated from the current local object-storage structure.
• Audio, video, lyrics and image paths still consistently point to https://cdn.rebel-girl-fm.de/downloads/....
• The lyrics download tab uses the current downloads/Audio structure, matching the lyrics entries in the media index.

Rebel Player

• The Rebel Player loads media-index.json client-side and builds audio/video URLs from the current CDN base paths.
• Audio, video and player-cover paths were checked against the current media inventory.

Documentation

• README and all files under ki/ were synchronized to the current project state.

Validation

• npm run sync: passed.
• npm run sync:images: passed.
• npm run sync:videos: passed.
• npm run check:assets: passed.
• npm run check: passed.
• npm run build: passed.
• npm run sync:r2: passed; 3634 files checked, 3634 unchanged, 0 uploads, 0 errors.

Social Media and CDN

• The Suno and Telegram logos in the social media tab now use the v=20260623 version parameter.
• This bypasses previously cached logo versions and loads the current WebP files directly from the Cloudflare CDN.

Documentation

• README, website changelog, and all files in ki/ were synchronized to version 3.6.25.

Validation

• npm run check: passed.
• npm run check:assets: passed.
• npm run build: passed.
• Cloudflare deployment and production smoke test: passed.

CDN and Media

• Cloudflare R2/CDN was synchronized against the local media folder: 3503 files checked, 3494 unchanged, 9 missing objects uploaded, 0 failures.
• Three Radio Sisters music videos, three Radio Sisters song covers, Sunshine-State-FM2.webp, and the Suno and Telegram logos were uploaded.
• public/media-index.json, public/image-sitemap.xml, and public/video-sitemap.xml were regenerated.
• Current media inventory: 897 audio files, 995 videos, 942 lyric files, and 635 gallery images.

Website and Paths

• The social media tab now includes Suno, Mastodon, and Telegram with CDN logos and localized text in German, English, and Spanish.
• Asset validation now also checks hard-coded CDN paths against the local media inventory.
• R2 object checks now run concurrently, making synchronization significantly faster.

Tooling

• Updated Astro to 7.0.0, @astrojs/cloudflare to 14.0.0, @astrojs/preact to 6.0.0, and Vite to 8.0.16.
• Updated Wrangler to 4.103.0 and Cloudflare Workers Types to 4.20260623.1.
• Removed the unused local Lighthouse dependency; Lighthouse audits remain available through npx lighthouse.
• npm audit reports 0 known vulnerabilities and npm outdated reports no outdated direct packages.

Validation

• npm run check: passed.
• npm run check:assets: passed.
• npm run build: passed.
• Cloudflare deployment and production smoke test: passed.
• Cloudflare Worker version: 0fbd0eb9-790b-4a24-bd26-1acbe830c079.

CDN and Media

• Cloudflare R2/CDN was synchronized against the local media folder: 3496 files checked, 3489 unchanged, 7 missing objects uploaded, 0 failures.
• Three Charlie song covers were uploaded: Charlie - Die Stimme des Suedens-cover-4.webp, cover-5.webp, and cover-6.webp.
• Three Charlie music videos were uploaded: Rebel Girl FM - Honky Tonk Gewitter (Live).webm, Rebel Girl FM - Mein Weg zum Mikrofon.webm, and Rebel Girl FM - Staub, Schweiss und Radio-Blut.webm.
• downloads/Promts/bilder promt.txt was also added to R2.
• public/media-index.json, public/image-sitemap.xml, and public/video-sitemap.xml were regenerated from the external downloads folder.
• Current media state: 897 audio files, 992 videos, 942 lyrics files, and 631 gallery images.

Tests and Deploy

• npm run check: passed.
• npm run build: passed.
• Cloudflare Workers deploy: passed.

Charlie Reed

• Charlie’s backstory was expanded: she grew up on a ranch in the American South and found her love of country, Southern rock and honky tonk early.
• Her path to Hamburg is now clearer: a man persuaded her to move there, but the relationship did not last long.
• After the breakup, Charlie stayed in Hamburg, tried several jobs and eventually landed at a Hamburg radio station.
• Her small on-air slots as a traffic reporter, weather voice and loose voice in the day program now explain why some Hamburg listeners already knew her before Rebel Girl discovered her.
• Singing in bars after work was added as Charlie’s return to her real music before Rebel Girl found her in a small Hamburg bar.

Lore and i18n

• src/content/lore/lore.md and src/content/lore/figurenprofile.md were expanded with the new Charlie biography.
• The English and Spanish lore and character profile files were updated in sync.
• The Charlie character profile and the about.side.charlie.lore texts in German, English and Spanish were updated.

Tests

• npm run check: passed.
• npm run build: passed.
• Cloudflare Workers deploy: passed.

Song Generator

• The OpenRouter proxy now aborts hanging model requests after 8 seconds per model.
• This prevents the generator from staying stuck at 35% // SENDE AN KI when a free OpenRouter model does not respond.
• The active free model chain was reduced to currently listed free text models.
• Unavailable models such as moonshotai/kimi-k2.6:free and z-ai/glm-4.5-air:free were removed.
• wrangler.toml now uses openai/gpt-oss-20b:free as the preferred model and google/gemma-4-31b-it:free as fallback.

CDN and Media

• Cloudflare R2/CDN was updated with eight media objects: three Charlie music videos, three Charlie song covers, Rebel-Girl-cover-255.webp, and the updated Charlie team image.
• The local media filename Charlie – Die Stimme des Südens-cover-1..webp was corrected to Charlie – Die Stimme des Südens-cover-1.webp because Cloudflare blocked the double dot in the object key.
• All eight updated CDN URLs were verified with HEAD checks and return 200 OK.
• public/media-index.json, public/image-sitemap.xml, and public/video-sitemap.xml were resynchronized.
• Current media state: 897 audio files, 989 videos, 942 lyrics files, and 628 gallery images.
• scripts/generate-image-sitemap.mjs now writes the image sitemap atomically via a temporary file.

Tests and Deploy

• scripts/test_song_generator_security.mjs now checks the updated model chain and timeout protection.
• The live endpoint /api/song-generator/openrouter was tested successfully after deploy: status 200, model openai/gpt-oss-20b:free.
• npm run check: passed.
• npm run build: passed.
• npm run check:sitemap: passed with 637 routes, 628 images, and 989 videos.

Security Fixes

• The admin dashboard no longer renders song and media values via innerHTML; it now creates DOM nodes and assigns dynamic text through textContent.
• This closes the stored-XSS path from public song archive titles into the admin table.
• The OpenRouter proxy no longer treats client-provided system prompts as trusted model instructions.
• The Worker now builds upstream messages server-side and separates user data from the system prompt with BEGIN_USER_DATA / END_USER_DATA.
• Common prompt-injection phrases such as “ignore previous instructions” or “reveal the system prompt” are blocked in song ideas.

Tests

• scripts/test_song_generator_security.mjs now checks that admin rendering does not use .innerHTML.
• The same test script checks prompt-injection filters and server-built OpenRouter messages.

Validation

• npm run test:song-generator: passed.
• npm run check: passed.
• npm run build: passed.

Charlie Reed

• Charlie Reed is integrated as a new day-shift host with her own character page at /charlie.
• The profile page now includes birth date 15.06.1998, role, lore, image and structured image data.
• Charlie is connected to lore, the About team structure, gallery, player filters and the song-generator persona.

Gallery and Media

• Gallery and media index were updated to 624 images.
• Charlie images and Charlie song covers are served through CDN/R2.
• The side images on the About page now adapt dynamically to text and card height.

SEO

• Important gallery images now have dedicated SEO detail pages under /bilder/....
• Gallery, character and image detail pages output ImageObject JSON-LD.
• BaseHead now supports multiple JSON-LD entries per page.

Validation and Deploy

• npm run check: passed.
• npm run build: passed.
• Deployment via Wrangler succeeded, current Cloudflare version: ff8bb049-2489-4c41-80fc-ca74bf1a9c59.

About Page

• The team cards on the About page are now grouped into Nachtschicht, Tagschicht and side characters.
• The Brainless Radio Sisters were moved into the day shift.
• The day shift includes two empty placeholder cards for later entries.
• The lore panel now appears below the side-character cards.

Character Display

• Main character cards show artist names instead of legal names, including SHADOWMAN and REBEL GIRL.
• Mei is displayed as MEI in cards and as the character-page heading.
• Side characters now use robust translation keys so slugs such as punk-muschi do not render raw key names.

Validation

• npm run check: passed.

Update

• Updated @cloudflare/workers-types to ^4.20260613.1.
• Synchronized package-lock.json with the new package version.
• Checked npm outdated: Vite 8.0.16 remains intentionally excluded because the previous Astro/Cloudflare build validation failed.

CDN and Documentation

• Checked R2/CDN references for https://cdn.rebel-girl-fm.de across the project.
• Validated media-index.json in R2 mode.
• Updated media-index.json, image sitemap and video sitemap from the local object-storage source.
• Ran CDN/R2 sync: checked 3,479 files, 3,467 unchanged, uploaded 12 missing objects, 0 failures.
• Updated README, ki/MASTER.md, ki/02-tech-stack.md and ki/09-changelog.md.

Validation

• npm outdated: only Vite 8.0.16 remains open as an intentionally skipped major update.
• npm audit --audit-level=moderate: still reports known tooling advisories through esbuild/vite; npm audit fix --force would downgrade to astro@2.4.5 and was not applied.
• npm run check: passed.
• npm run build: passed.

Tooling and Dependencies

• Updated @astrojs/cloudflare to ^13.7.0.
• Updated astro to ^6.4.6.
• Updated @cloudflare/workers-types to ^4.20260612.1.
• Updated @tailwindcss/vite and tailwindcss to ^4.3.1.
• Updated wrangler to ^4.100.0.
• Synchronized package-lock.json with the new package versions.

Compatibility

• Vite 8.0.16 was installed and tested, but it breaks the Astro/Cloudflare build with require_dist is not a function.
• Vite therefore stays on the latest compatible 7.x line, ^7.3.5.

Validation

• npm run check: passed.
• npm run build: passed; sitemap/robots check with 96 routes, 607 images, and 977 videos.
• npm audit --audit-level=moderate: still reports known tooling advisories through esbuild/vite; npm audit fix --force would downgrade to astro@2.4.5, so it was not applied.

Song Generator

• The topic input field in the Song Generator now shows 5 instead of 3 lines.
• Generated original lyrics are capped client-side at 5000 characters so they can be pasted directly into Suno.
• The AI prompt explicitly tells the model about Suno’s 5000-character limit.
• Archive validation now blocks lyrics and German versions over 5000 characters server-side.

Validation

• npm run test:song-generator: passed.
• npm run check: 0 errors, 0 warnings, 0 hints; i18n remains at 525 keys per language.

Admin Backend V1

• Local admin interface prepared at /admin, but not enabled for production.
• Added protected admin APIs for session, statistics, songs, media listing, and R2 uploads.
• Cloudflare Access is expected as the protection layer; ADMIN_ACCESS_ENABLED=0 keeps the backend disabled in production.
• Added D1 migration migrations/0060_admin_backend.sql for media metadata and admin events.

Tooling and Cloudflare

• Updated Astro to ^6.4.4, @astrojs/cloudflare to ^13.6.1, @astrojs/preact to ^5.1.5, Workers Types to ^4.20260607.1, and Wrangler to ^4.98.0.
• Set Cloudflare compatibility_date to 2026-06-02, the newest date supported by the local Workers runtime binary.
• Vite 8.0.16 was tested, but not adopted because the Astro/Cloudflare runner failed with require_dist is not a function; Vite stays on the compatible 7.x line.

SEO, Mobile, and Security

• Admin routes are excluded from the sitemap and sitemap check.
• Song Generator security tests now also verify Admin Access headers, the admin kill switch, and admin sitemap exclusion.
• Mobile audit still shows action needed for large headlines on phone viewports.

Validation

• npm audit --audit-level=moderate: 0 vulnerabilities.
• npm run check:assets: passed.
• npm run check: 0 errors, 0 warnings, 0 hints; i18n remains at 525 keys per language.
• npm run build: passed; sitemap/robots check with 96 routes and 596 images.

Maintenance and automation

• npm run docs:sync synchronizes README and central AI documentation from changelog, package versions, i18n keys and media index data.
• npm run changelog:new -- <version> creates German, English and Spanish changelog files from one consistent template.
• npm run check:sitemap validates dist/client/sitemap-index.xml, dist/client/sitemap-0.xml, public/image-sitemap.xml and public/robots.txt.
• npm run test:song-generator checks song generator validation and API security invariants.
• npm run check now also runs the song generator security tests.
• npm run build now runs the sitemap/robots check after the Astro build.

Validation

• npm run check passed: Astro 0 errors, 0 warnings, 0 hints; i18n remains at 525 keys per language.
• npm run build passed: 96 sitemap routes and 593 unique images validated.

Privacy

• The privacy policy was updated in German, English and Spanish to June 2, 2026.
• Cloudflare Workers, Cloudflare R2/CDN, Cloudflare D1, Worker logs and OpenRouter are described more precisely.
• Song generator data flows were updated: prompt processing, short-term IP processing for rate limits and D1 archive fields.
• LocalStorage, Tally feedback, Twitch, YouTube and FlagCDN were aligned with the current project state.
• The text now clarifies that Rebel Girl FM does not use tracking, Google Analytics, a tag manager or advertising profiling.

Validation

• npm run check passed successfully.
• i18n remains synchronized with 525 keys per language.

Updates

• Astro was updated to ^6.4.2, Vite to ^7.3.5, Wrangler to ^4.96.0 and @cloudflare/workers-types to ^4.20260601.1.
• npm audit --audit-level=moderate reports no vulnerabilities.

Bug Fixes

• The song generator now allows JAPANISCH server-side in the OpenRouter proxy. The UI already exposed Japanese as a target language.
• Remaining encoding artifacts were removed from the song generator system prompt.

Pentest Hardening

• Unexpected API exceptions are logged server-side but no longer returned to clients as internal error messages.
• sitemap-index.xml is now explicitly covered by the sitemap cache rule in middleware.
• Checks, build, asset check, secret-pattern scan and input-filter smoke tests passed successfully.

Media and CDN

• public/media-index.json was regenerated from D:\sicherheit\Daten\Webseiten\Object Storage\rebel-girl-fm.de\downloads.
• The gallery now contains 593 WebP images; audio, video and lyrics remain at 897, 888 and 887 entries.
• Two new Folk-Hexe covers and five new Mei covers were uploaded directly to Cloudflare R2 in the rebel-girl-fm bucket.

Validation

• The seven new CDN URLs respond to HEAD requests with 200.
• public/image-sitemap.xml was regenerated with 593 images.
• npm run check:assets, npm run check and npm run build pass successfully.

Documentation

• The README and AI modules were brought up to date with Astro 6, Cloudflare Workers, R2/CDN, D1 archive, AI discovery and multilingual pages.
• The content sources now document the localized lore files in src/content/lore/en/ and src/content/lore/es/ as well as the localized changelog files in src/content/changelog/en/ and src/content/changelog/es/.

Indexing

• Sitemap documentation now points to sitemap-index.xml and image-sitemap.xml.
• The build generates the sitemap for the current German, English and Spanish routes, including lore, changelog, downloads and character profiles.

Project Cleanup

• The no longer referenced player voting helpers isVoted() and getBaseVotes() were removed.
• Local generated folders and dev logs were removed from the working tree; .env and node_modules were kept for deployment and local work.

Validation

• npm run check runs without errors, warnings or hints.
• npm run check:assets confirms the R2 media index.
• npm run build creates the Cloudflare Worker output without errors.

Playlists

• The Suno playlist Rebel Girl FM - Die Hirnlosen Radioschwestern was added to shared playlist data.
• The cover uses the existing CDN path for the Radio Sisters team image.
• German, English and Spanish playlist pages now show the same new card with localized text.

Validation

• npm run check confirms complete i18n keys for DE, EN and ES.
• npm run build creates the Cloudflare Worker output without errors.

AI Discovery

• robots.txt now sets Content-Signal: ai-train=no, search=yes, ai-input=yes.
• Public HTML pages return Markdown when requested with Accept: text/markdown.
• Markdown responses remain limited to public pages; /api/ and /admin/ are excluded.

Documentation

• README now describes AI discovery endpoints, the content-signal policy and intentionally unpublished OAuth, MCP and API catalog metadata.

Song Generator

• EINGABE LEEREN now sits directly next to ZUFALLS-SIGNAL.
• The old separate button block under the input was removed.

AI Indexing

• robots.txt explicitly allows important AI crawlers for public pages and keeps /api/ and /admin/ blocked.
• llms.txt provides a compact project map.
• llms-full.txt adds project identity, crawler rules, machine endpoints, main sections and character context.
• ai.txt points to the LLM and sitemap files.

Delivery

• HTML pages link the LLM files as text/plain alternates.
• Public Worker routes set X-Robots-Tag: index, follow.
• API and admin routes set noindex, nofollow, noarchive.
• HTML responses also expose the LLM files through Link headers.

Cloudflare Note

• Cloudflare dashboard bot rules must allow the permitted crawlers.
• The live check showed Cloudflare-managed robot content still being prepended; that zone setting must be disabled.

CDN Assets

• Partner logos now use the existing hyphenated files.
• The logo files were uploaded again to Cloudflare R2 and are reachable through the CDN.
• Old whitespace and %20 paths are no longer emitted on partner pages.

More Robust Image Paths

• Partner pages encode logo filenames before building CDN URLs.
• Playlist pages in DE, EN and ES encode image paths segment by segment.

QA

• npm run check and npm run build passed.
• A live asset crawl checked 602 asset URLs without 404 errors.

Song Generator

• The EINGABE LEEREN button removes the current topic text and refocuses the input.
• JAPANISCH was added to the language selection.
• Japanese is passed to the song prompt as a real target language.

QA

• npm run check and npm run build passed.

Song Generator

• TRANSMISSION STARTEN now shows progress and status directly in the generator.
• Validation errors, OpenRouter issues and archive errors appear under the button.
• The used OpenRouter model is shown after successful generation.
• ZUFALLS-SIGNAL now accepts the legitimate scenario and cover random prompts.
• If OpenRouter fails, a local fallback text is loaded.

OpenRouter and Free AI Models

• The proxy uses a fixed allowlist of free text models marked with :free.
• Paid models are blocked server-side.
• If one free model fails, the proxy tries the next one in the chain.

Image SEO and CDN

• public/image-sitemap.xml is generated from public/media-index.json.
• Gallery pages contain crawlable image fallbacks with descriptive alt text and CDN URLs.

Privacy

• Privacy texts now describe the free OpenRouter model chain, Cloudflare Workers, D1 archive and input protection more clearly.
• The fictional-character note remains in DE, EN and ES.
• The privacy date was set to May 27, 2026.

Security Review and QA

• Non-destructive checks covered headers, origin protection, invalid prompts, size limits, script/URL filters and rate limits.
• npm.cmd run check, npm.cmd run check:assets and npm.cmd run build passed.

Media and CDN

• The local downloads folder was synchronized with the Cloudflare R2 bucket.
• public/media-index.json was regenerated from the local object-storage structure.
• The current media index contains 897 audio files, 888 videos, 887 lyric files and 586 gallery images.
• npm run sync:r2 is available for future R2 syncs.

Dependencies and Build

• Astro, Cloudflare adapter, sitemap, Workers types and Wrangler were updated.
• Vite remains on the compatible 7.x line.

Privacy

• The privacy page was updated to May 27, 2026.
• The AI note now mentions ChatGPT, Claude and Google Gemini.
• Fictional character, biography, role, age and lore contact details are explicitly marked as fictional.

QA

• npm.cmd run check, npm.cmd run check:assets and npm.cmd run build passed.

Cloudflare Workers

• The project now targets Cloudflare Workers with the Astro runtime.
• Song-generator APIs use Cloudflare bindings through cloudflare:workers.
• Server-side code reads OPENROUTER_API_KEY, OPENROUTER_MODEL and the D1 binding DB.
• Old Pages deployment scripts were removed from npm scripts.

Song Generator

• The page is integrated into the standard site layout with header, navigation, background and language routes.
• Rebel Player links to the song generator from the gear menu.
• Character lore and fixed style rules are included in prompts.
• The generator is available in German, English and Spanish.

Security

• The proxy accepts only the expected song-generator prompt format.
• Characters, languages, moods, durations and formats are validated server-side.
• Browser and server inputs are checked against spam, random characters, links, email addresses, script code and excessive length.
• OpenRouter and archive routes have rate limits, size limits and origin checks.
• The D1 archive blocks duplicate entries for the same idea and character within 15 minutes.

Accessibility and Content

• Lore and About pages now include a browser Speech Synthesis read-aloud function.
• About was realigned to the full station, lore and StorytellerZ context.
• Image alt texts and aria labels were improved.

Rebel Player

• Playlist clicks start the selected track through the central player logic.
• Playback state, source switching and media unloading were stabilized.
• The gear menu contains a direct song-generator link.

SEO, Privacy and Maintenance

• README, privacy notes, sitemap, robots and metadata were updated.
• Temporary logs and Vite cache files were removed and added to .gitignore.

QA

• npm run check and npm run build passed.
• A local non-destructive security smoke test was performed.

Lore

• The lore page now generates a chapter navigation from ## headings.
• On desktop the chapter box stays visible at the side.
• On tablet and mobile it appears compactly above the content.
• Chapter links use smooth scrolling.

Playlists

• Playlist covers now use the same square image frame.
• Different source formats are cropped consistently with object-fit: cover.
• The Mei playlist now uses the real Mei image instead of the generic Rebel Girl cover.
• The change applies to German, English and Spanish.

QA

• npm run check and npm run build passed.
• Translation files were checked for complete keys, empty values, placeholders and playlist texts.
• An encoding issue in the About lore teaser was fixed.

Media and R2

• The local object-storage structure was cleaned up and uploaded again to Cloudflare R2.
• The rebel-girl-fm bucket contains 3,223 objects.
• Remaining PNG and WAV originals were removed after conversion.
• Current formats are .opus, .webm, .webp, .txt and .htaccess.
• public/media-index.json was regenerated.

Rebel Player

• Mei-Die-neue-Praktikantin is available as an audio filter.
• The Mei player cover points to the matching CDN image.

Playlists and Content

• The Mei and STTZ-AprilScherz Suno playlists were added.
• The lore page shows character images beside profile data.

QA

• npm run check and npm run build passed.

Content and Lore

• The old story workspace was moved into the production content structure.
• The chronicle now lives in src/content/lore/lore.md.
• Official character profiles are available as lore source in src/content/lore/figurenprofile.md.
• Main and side characters have Markdown files under src/content/characters/.

Character Profiles and About

• The About page now loads characters from the Characters collection.
• Main and side characters are sorted through category.
• Mei was added as a main character and Punk-Muschi moved to side characters.
• Character pages are connected for German, English and Spanish.

Internationalization

• Translation files were synchronized.
• All three languages contain 439 translation keys.

CDN and Media Index

• scripts/sync.js can build the media index from a local object-storage structure.
• Gallery scanning is recursive and CDN paths are encoded safely.

Rebel Player

• The fallback image, first loading state and cover URL handling were fixed.

SEO, Security and QA

• robots.txt and security headers were cleaned up.
• npm run check and npm run build passed.

Build Tooling

• A new .nvmrc with 24 is used by Cloudflare Pages, GitHub Actions and local node managers.
• .npmrc now contains legacy-peer-deps=true, solving the TypeScript 6 and @astrojs/check peer dependency conflict.

Stack Consistency

• All four partner projects now use the same build base: Node 24 plus npm with legacy-peer-deps.

Privacy

• The privacy date was updated to April 25, 2026 in DE, EN and ES.

No Content Changes

• Codebase and i18n keys remain unchanged.

Synchronization Release

This entry documents the language rollout for the three partner projects. Rebel Girl FM already had the DE/EN/ES feature set and served as the reference.

Partner Projects Expanded

• dampferburg: New Spanish routes, three inline SVG flags and sitemap i18n.
• dampfermessen: Around 150 new Spanish translation keys and a third flag button.
• noob-town: Spanish as third language with a GDPR-friendly inline flag switcher.

Rebel Girl FM as Reference

The established src/i18n/{de,en,es}.ts pattern served as the model for the other projects.

No Local Code Changes

• The Rebel Girl FM codebase stayed unchanged.
• The privacy date already matched April 24, 2026.

Cloudflare Automation

• A new wrangler.toml with R2 bucket binding was added.
• npm run setup:cloudflare checks and creates Cloudflare resources through the CLI.
• The setup script uses npx wrangler for cross-platform reliability.

Feedback Fallback

• If the Tally form is blocked, a notice with a direct link appears after five seconds.
• Three new translation keys were added per language.

Character Rename

• Dieter Lauerbach was renamed to Karl Lauerbach across translations and documentation.

Dependency Updates

• Astro, TypeScript, Wrangler, Tailwind and Vite dependencies were updated.

CSS and Build Fix

• A Tailwind @source directive was removed to avoid a rolldown build issue.

Unified Stack

• Rebel Girl FM now shares the same base stack with the partner projects.

Privacy

• The privacy date was updated to April 24, 2026.

Feedback Page

• New /feedback, /en/feedback and /es/feedback pages with embedded Tally form.
• The popup button was replaced by an inline form for better privacy and UX.
• Footer feedback links and translation keys were added.

Favicon

• Favicon was moved to the CDN WebP file.
• Duplicate SVG favicon entry was removed.

AI Documentation

• The old docs were replaced by 16 structured modules.
• CLAUDE.md was updated for the new module structure.

Privacy Update

• A new Tally.so third-party section was added in DE, EN and ES.
• The privacy date was updated to April 19, 2026.

Cleanup and Fixes

• Decap CMS was removed.
• Hero components hydrate faster.
• Video path filtering and ES gallery routing were corrected.

Complete Astro 6 Migration

• The project moved from static HTML/JS to Astro 6, Preact and Tailwind CSS v4.
• 85 pages are now generated with better performance, security and SEO.
• Interactive player, gallery and filters run as isolated Preact islands.
• Nanostores provide global playback state.
• Character profiles and changelog use Astro Content Collections.
• Page transitions run through <ClientRouter />.

Persona Updates

• A new sexuality field was added to all persona pages.
• All values were translated into German, English and Spanish.
• Persona pages now include structured Person JSON-LD.

Rebel Player

• A music-video playlist group was added to the video area.
• media-index.json is loaded client-side to avoid hydration issues.
• A loading indicator appears during player initialization.

SEO and Performance

• RadioStation JSON-LD, OG image dimensions, Twitter/X tags and PWA manifest were added.
• Persona images use eager loading where needed.
• The footer and robots.txt were improved.

Security and Fixes

• CSP was expanded for the media CDN.
• Character image URLs, OG image URLs, playlist loading and deployment settings were fixed.

AI Documentation

• CLAUDE.md and the ki/ documentation folder were added for AI assistants.

Cloudflare R2 Migration

• All media files are now delivered through cdn.rebel-girl-fm.de instead of the local repository.
• Media is cached and delivered globally through Cloudflare.
• The public/downloads/ folder was removed from the Git repository.

Cleanup

• Old MP4, WAV and PNG files were removed; only WebM, Opus and WebP remain.
• One-off PowerShell conversion scripts and temporary artifacts were removed.
• TypeScript hints and warnings were resolved.

Updates

• Astro, Preact and security-related dependencies were updated.
• The z import was migrated to astro/zod.

Fixes

• Lyrics indexing was corrected from Audio/ to Songtexte/.
• A Unicode error in the StorytellerZ logo filename was fixed.
• The Ex-Freund image was added to persona and About pages.
• Teufel’s age display was shortened.

Privacy

• The privacy policy now mentions Cloudflare R2 as the media CDN in all three languages.

Media Updates

• New assets for Stalkerin, Stalker and the Radio Sisters were added and converted to WebP.
• Generated persona images were connected to the matching side-character pages.
• Old PNG files were removed and the media index was rebuilt with sync.js.

Persona Lore

• All persona pages now show the full background story from the AI prompts.
• A color-matched “Lore:” heading appears before each lore text.
• Older description and story blocks were removed, leaving lore as the main body text.

Persona Data

• Age is now displayed as DD.MM.YYYY (X years).
• Genres were updated to the top three genres from the AI prompts.
• Duplicate role display was removed.

Layout Improvements

• Persona images now fill the full height of the info box.

About and i18n

• The About page received lore-based persona descriptions in DE, EN and ES.
• Translation files were synchronized to 372 keys per language.
• The i18n check script now also detects double-quoted values.

Dependencies and Config

• Astro, Preact and TypeScript path config were updated.
• README was rewritten with project documentation.

SPA Routing Rewrite

• Dual-mode routing: Production uses clean URLs; other environments use hash routing and remain F5-safe.
• useCleanUrls() function: Detects the production domain and controls URL handling.
• Universal URL detection: Handlers evaluate hash, path and ?p= parameters.
• Second popstate handler: Added path fallback for clean URLs.

Bugfixes

• Fixed file-not-found errors when pressing F5 on tabs.
• Tabs respond to clicks again.
• Removed a duplicate } syntax error in the first popstate handler.

Picture Fallback and Media Conversion

• All 52 images received WebP <source> plus JPG <img> fallback.
• 397 JPG fallbacks were generated, 6 MP4 files converted to WebM and 7 PNG duplicates removed.
• Format pairs are complete: Opus/MP3, WebM/MP4 and WebP/JPG.

Character Profiles

• Profiles for Rebel Girl, Shadowman, Folk-Hexe, Punk-Muschi, Freundin and Rumpelstilzchen were added.

i18n Synchronization

• New label keys, duplicate fixes and 29 missing ES keys were added.
• Full coverage: 308 translation keys for DE, EN and ES.

Bugfixes and Routing

• Local file system routing: Hash fallback for local direct page access.
• OnLoad SPA reset: Removed an outdated event listener.
• i18n completion: Missing error-page headings added for DE and ES.
• Asset validator: Fixed an incorrect regex in check_assets.js.

Compliance and Hosting

• GDPR update: Complete revision of the privacy policy in DE, EN and ES.
• Cloudflare migration: Hosting through Cloudflare Pages and GitHub.

Media and Twitch Integration

• Twitch live streaming: Seamless player integration.
• Auto UI adaptation: Controls are hidden automatically during live streams.

Major Feature Update

• Clean URLs: Full switch to modern routing with the History API.
• Hierarchical playlists: Deeper folder structure for audio sources.
• Modern language selector: Header dropdown for DE, EN and ES.

Security Audit and Hardening

• HTTP security headers, CSP, Permissions-Policy and XSS mitigation.

UX and Accessibility

• Contrast update, focus indicators and revamped 404 page.

Security and Accessibility

• Security hardening: Initial hardening for security headers.
• WCAG compliance: Contrast update for better readability.
• Clean URL setup: Initial setup via 404 redirect.

Global and Accessible

• Full multilingual support: Complete localization through i18n.
• ARIA implementation: Fully translated ARIA labels.

Player and Engine Update

• Playback modes: Shuffle and repeat functions.
• Deduplication: Automated cleanup of redundant media formats.

First Implementation

• Initial routing: SPA hashes and video deduplication.
• Persona integration: Shadowman, Freundin and Rumpelstilzchen playlists.

Performance Push

• Lazy loading, WebP and WebM for faster page and media loading.

Initial Release

• Basic SPA with player, gallery and social features.