From a942daa233fe762d9667112a5d49da60872b6c14 Mon Sep 17 00:00:00 2001
From: James Morton <james.morton@quackback.io>
Date: Tue, 30 Jun 2026 08:44:03 +0100
Subject: [PATCH] fix(fonts): self-host branding fonts so no Google Fonts
 <link> is emitted

The portal/widget rendered a fonts.googleapis.com stylesheet <link> for the
selected branding font. On a Cloudflare zone with Cloudflare Fonts enabled, the
edge rewrites that link into an inline @font-face block, so the served DOM stops
matching the client render and hydration fails (React #418) on every portal page.

Bundle every font referenced by the branding picker (FONT_OPTIONS) and the theme
presets (presets.ts) via @fontsource and remove the Google Fonts plumbing:
GOOGLE_FONT_MAP, getGoogleFontsUrl, the portal/widget/auth-shell links, the
theme-preview copy, and ALL_FONTS_URL. Geist ships as the "Geist Sans" family,
Lato as 400/700, and Nunito is preset-only.

Legacy branding configs saved with the bare "Geist" value are normalised to
"Geist Sans" at read time (normalizeFontSans, applied in generateThemeCSS and the
admin picker) so they keep rendering, no data migration needed.

Pin the web app's zod to 4.3.6: adding the font deps re-resolved the lockfile and
hoisted zod 4.4.3 to the top, which is type-incompatible with the MCP SDK used in
mcp/tools.ts. The exact pin keeps the app on 4.3.6; the TanStack build tooling
keeps 4.4.3.
---
 apps/web/package.json                         | 18 ++++-
 .../admin/settings/branding/theme-preview.tsx | 68 ++++--------------
 .../settings/branding/use-branding-state.ts   | 30 ++------
 .../src/components/auth/portal-auth-shell.tsx |  7 +-
 apps/web/src/globals.css                      | 72 ++++++++++++++++++-
 .../theme/__tests__/normalize-font.test.ts    | 37 ++++++++++
 apps/web/src/lib/shared/theme/generator.ts    | 59 +++++----------
 apps/web/src/lib/shared/theme/index.ts        |  2 +-
 apps/web/src/lib/shared/theme/presets.ts      |  4 +-
 apps/web/src/routes/__tests__/_portal.test.ts |  1 -
 apps/web/src/routes/_portal.tsx               |  8 +--
 .../src/routes/admin/settings.branding.tsx    |  3 -
 apps/web/src/routes/widget.tsx                | 15 +---
 bun.lock                                      | 72 ++++++++++++++++---
 14 files changed, 233 insertions(+), 163 deletions(-)
 create mode 100644 apps/web/src/lib/shared/theme/__tests__/normalize-font.test.ts

diff --git a/apps/web/package.json b/apps/web/package.json
index 42f471cca..abf698f77 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -26,6 +26,22 @@
     "@dnd-kit/utilities": "^3.2.2",
     "@floating-ui/dom": "^1.7.6",
     "@fontsource-variable/inter": "^5.2.8",
+    "@fontsource/dm-sans": "^5.2.8",
+    "@fontsource/fira-code": "^5.2.7",
+    "@fontsource/geist-sans": "^5.2.5",
+    "@fontsource/inter": "^5.2.8",
+    "@fontsource/jetbrains-mono": "^5.2.8",
+    "@fontsource/lato": "^5.2.7",
+    "@fontsource/lora": "^5.2.8",
+    "@fontsource/manrope": "^5.2.8",
+    "@fontsource/merriweather": "^5.2.11",
+    "@fontsource/nunito": "^5.2.7",
+    "@fontsource/open-sans": "^5.2.7",
+    "@fontsource/playfair-display": "^5.2.8",
+    "@fontsource/plus-jakarta-sans": "^5.2.8",
+    "@fontsource/poppins": "^5.2.7",
+    "@fontsource/roboto": "^5.2.10",
+    "@fontsource/space-grotesk": "^5.2.10",
     "@heroicons/react": "^2.2.0",
     "@hookform/resolvers": "^5.2.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
@@ -118,7 +134,7 @@
     "tw-animate-css": "^1.4.0",
     "typeid-js": "^1.2.0",
     "yaml": "^2.8.4",
-    "zod": "^4.3.6",
+    "zod": "4.3.6",
     "zod-openapi": "^5.4.6",
     "zustand": "^5.0.12"
   },
diff --git a/apps/web/src/components/admin/settings/branding/theme-preview.tsx b/apps/web/src/components/admin/settings/branding/theme-preview.tsx
index f6e22625a..47002ceb3 100644
--- a/apps/web/src/components/admin/settings/branding/theme-preview.tsx
+++ b/apps/web/src/components/admin/settings/branding/theme-preview.tsx
@@ -13,42 +13,6 @@ import {
 import type { ParsedCssVariables } from '@/lib/shared/theme'
 import { cn } from '@/lib/shared/utils'
 
-/** Map font family names to Google Fonts URL */
-const GOOGLE_FONT_MAP: Record<string, string> = {
-  '"Inter"': 'Inter',
-  '"Roboto"': 'Roboto',
-  '"Open Sans"': 'Open+Sans',
-  '"Lato"': 'Lato',
-  '"Montserrat"': 'Montserrat',
-  '"Poppins"': 'Poppins',
-  '"Nunito"': 'Nunito',
-  '"DM Sans"': 'DM+Sans',
-  '"Plus Jakarta Sans"': 'Plus+Jakarta+Sans',
-  '"Geist"': 'Geist',
-  '"Work Sans"': 'Work+Sans',
-  '"Raleway"': 'Raleway',
-  '"Source Sans 3"': 'Source+Sans+3',
-  '"Outfit"': 'Outfit',
-  '"Manrope"': 'Manrope',
-  '"Space Grotesk"': 'Space+Grotesk',
-  '"Playfair Display"': 'Playfair+Display',
-  '"Merriweather"': 'Merriweather',
-  '"Lora"': 'Lora',
-  '"Crimson Text"': 'Crimson+Text',
-  '"Fira Code"': 'Fira+Code',
-  '"JetBrains Mono"': 'JetBrains+Mono',
-}
-
-function getGoogleFontsUrl(fontFamily: string | undefined): string | null {
-  if (!fontFamily) return null
-  for (const [cssName, googleName] of Object.entries(GOOGLE_FONT_MAP)) {
-    if (fontFamily.includes(cssName)) {
-      return `https://fonts.googleapis.com/css2?family=${googleName}:wght@400;500;600;700&display=swap`
-    }
-  }
-  return null
-}
-
 interface ThemePreviewProps {
   previewMode: 'light' | 'dark'
   /** Parsed CSS variables from the theme CSS (source of truth) */
@@ -72,26 +36,22 @@ export function ThemePreview({ previewMode, cssVariables }: ThemePreviewProps) {
   const cssVars = useMemo(() => ({ ...modeVars, ...COMPONENT_ALIASES }), [modeVars])
 
   const fontFamily = modeVars['--font-sans'] || DEFAULT_FONT
-  const googleFontsUrl = useMemo(() => getGoogleFontsUrl(fontFamily), [fontFamily])
 
   return (
-    <>
-      {googleFontsUrl && <link rel="stylesheet" href={googleFontsUrl} />}
-      <div
-        className="rounded-lg border overflow-hidden"
-        style={
-          {
-            ...cssVars,
-            backgroundColor: 'var(--background)',
-            borderColor: 'var(--border)',
-            color: 'var(--foreground)',
-            fontFamily,
-          } as React.CSSProperties
-        }
-      >
-        <PortalPreview />
-      </div>
-    </>
+    <div
+      className="rounded-lg border overflow-hidden"
+      style={
+        {
+          ...cssVars,
+          backgroundColor: 'var(--background)',
+          borderColor: 'var(--border)',
+          color: 'var(--foreground)',
+          fontFamily,
+        } as React.CSSProperties
+      }
+    >
+      <PortalPreview />
+    </div>
   )
 }
 
diff --git a/apps/web/src/components/admin/settings/branding/use-branding-state.ts b/apps/web/src/components/admin/settings/branding/use-branding-state.ts
index f44fdfa62..340a0a53e 100644
--- a/apps/web/src/components/admin/settings/branding/use-branding-state.ts
+++ b/apps/web/src/components/admin/settings/branding/use-branding-state.ts
@@ -7,6 +7,7 @@ import {
   generateReadableCSS,
   parseCssToMinimal,
   replaceCssVar,
+  normalizeFontSans,
   type ThemeConfig,
   type MinimalThemeVariables,
   type ThemeMode,
@@ -14,127 +15,108 @@ import {
 } from '@/lib/shared/theme'
 import { useSaveBrandingTheme } from '@/lib/client/mutations/settings'
 
+// Each `value` family must be self-hosted in globals.css (matching the @fontsource
+// @font-face family name), or the selection falls back to the generic stack.
 export const FONT_OPTIONS = [
   {
     id: 'inter',
     name: 'Inter',
     value: '"Inter", ui-sans-serif, system-ui, sans-serif',
     category: 'Sans Serif',
-    googleName: 'Inter',
   },
   {
     id: 'system',
     name: 'System UI',
     value: 'ui-sans-serif, system-ui, -apple-system, sans-serif',
     category: 'System',
-    googleName: null,
   },
   {
     id: 'roboto',
     name: 'Roboto',
     value: '"Roboto", ui-sans-serif, system-ui, sans-serif',
     category: 'Sans Serif',
-    googleName: 'Roboto',
   },
   {
     id: 'open-sans',
     name: 'Open Sans',
     value: '"Open Sans", ui-sans-serif, system-ui, sans-serif',
     category: 'Sans Serif',
-    googleName: 'Open+Sans',
   },
   {
     id: 'lato',
     name: 'Lato',
     value: '"Lato", ui-sans-serif, system-ui, sans-serif',
     category: 'Sans Serif',
-    googleName: 'Lato',
   },
   {
     id: 'poppins',
     name: 'Poppins',
     value: '"Poppins", ui-sans-serif, system-ui, sans-serif',
     category: 'Sans Serif',
-    googleName: 'Poppins',
   },
   {
     id: 'dm-sans',
     name: 'DM Sans',
     value: '"DM Sans", ui-sans-serif, system-ui, sans-serif',
     category: 'Sans Serif',
-    googleName: 'DM+Sans',
   },
   {
     id: 'jakarta',
     name: 'Plus Jakarta Sans',
     value: '"Plus Jakarta Sans", ui-sans-serif, system-ui, sans-serif',
     category: 'Sans Serif',
-    googleName: 'Plus+Jakarta+Sans',
   },
   {
     id: 'geist',
     name: 'Geist',
-    value: '"Geist", ui-sans-serif, system-ui, sans-serif',
+    // @fontsource publishes Geist as the "Geist Sans" family (see globals.css).
+    value: '"Geist Sans", ui-sans-serif, system-ui, sans-serif',
     category: 'Sans Serif',
-    googleName: 'Geist',
   },
   {
     id: 'manrope',
     name: 'Manrope',
     value: '"Manrope", ui-sans-serif, system-ui, sans-serif',
     category: 'Sans Serif',
-    googleName: 'Manrope',
   },
   {
     id: 'space-grotesk',
     name: 'Space Grotesk',
     value: '"Space Grotesk", ui-sans-serif, system-ui, sans-serif',
     category: 'Sans Serif',
-    googleName: 'Space+Grotesk',
   },
   {
     id: 'playfair',
     name: 'Playfair Display',
     value: '"Playfair Display", ui-serif, Georgia, serif',
     category: 'Serif',
-    googleName: 'Playfair+Display',
   },
   {
     id: 'merriweather',
     name: 'Merriweather',
     value: '"Merriweather", ui-serif, Georgia, serif',
     category: 'Serif',
-    googleName: 'Merriweather',
   },
   {
     id: 'lora',
     name: 'Lora',
     value: '"Lora", ui-serif, Georgia, serif',
     category: 'Serif',
-    googleName: 'Lora',
   },
   {
     id: 'fira-code',
     name: 'Fira Code',
     value: '"Fira Code", ui-monospace, monospace',
     category: 'Monospace',
-    googleName: 'Fira+Code',
   },
   {
     id: 'jetbrains',
     name: 'JetBrains Mono',
     value: '"JetBrains Mono", ui-monospace, monospace',
     category: 'Monospace',
-    googleName: 'JetBrains+Mono',
   },
 ] as const
 
-export const ALL_FONTS_URL = `https://fonts.googleapis.com/css2?family=${FONT_OPTIONS.filter(
-  (f) => f.googleName
-)
-  .map((f) => f.googleName)
-  .join('&family=')}&display=swap`
-
 const DEFAULT_FONT = '"Inter", ui-sans-serif, system-ui, sans-serif'
 const DEFAULT_RADIUS = 0.625
 
@@ -247,7 +229,7 @@ export function useBrandingState(options: UseBrandingStateOptions): BrandingStat
   )
 
   const currentFontId = useMemo(
-    () => FONT_OPTIONS.find((f) => f.value === font)?.id || 'inter',
+    () => FONT_OPTIONS.find((f) => f.value === normalizeFontSans(font))?.id || 'inter',
     [font]
   )
 
diff --git a/apps/web/src/components/auth/portal-auth-shell.tsx b/apps/web/src/components/auth/portal-auth-shell.tsx
index 8401e5c2a..cef35cc38 100644
--- a/apps/web/src/components/auth/portal-auth-shell.tsx
+++ b/apps/web/src/components/auth/portal-auth-shell.tsx
@@ -1,7 +1,7 @@
 import { useMemo } from 'react'
 import { useRouteContext } from '@tanstack/react-router'
 import { PortalBrandMark } from './portal-brand-mark'
-import { generateThemeCSS, getGoogleFontsUrl } from '@/lib/shared/theme'
+import { generateThemeCSS } from '@/lib/shared/theme'
 import type { BrandingConfig } from '@/lib/server/domains/settings/settings.types'
 
 interface PortalAuthShellProps {
@@ -38,14 +38,9 @@ export function PortalAuthShell({ heading, subheading, children, footer }: Porta
     const hasThemeConfig = brandingConfig.light || brandingConfig.dark
     return hasThemeConfig ? generateThemeCSS(brandingConfig) : ''
   }, [brandingConfig])
-  const googleFontsUrl = useMemo(
-    () => (brandingConfig ? getGoogleFontsUrl(brandingConfig) : null),
-    [brandingConfig]
-  )
 
   return (
     <div className="relative min-h-screen flex items-center justify-center px-4 py-12 overflow-hidden">
-      {googleFontsUrl && <link rel="stylesheet" href={googleFontsUrl} />}
       {themeStyles && <style dangerouslySetInnerHTML={{ __html: themeStyles }} />}
       {customCss && <style dangerouslySetInnerHTML={{ __html: customCss }} />}
       <div
diff --git a/apps/web/src/globals.css b/apps/web/src/globals.css
index 125bea82a..988542545 100644
--- a/apps/web/src/globals.css
+++ b/apps/web/src/globals.css
@@ -1,10 +1,76 @@
 @import "tailwindcss";
 @plugin "@tailwindcss/typography";
 @import "tw-animate-css";
-/* Self-hosted Inter (variable, wght 100..900). Bundled from npm so no
-   fonts.googleapis.com <link> exists for a CDN (Cloudflare Fonts) to
-   rewrite — see the widget hydration / CDN-rewrite notes. */
+/* Self-hosted fonts: every font referenced by the branding picker (FONT_OPTIONS in
+   use-branding-state.ts) AND the theme presets (FONTS in presets.ts) is bundled here,
+   so no fonts.googleapis.com <link> is emitted. An edge optimizer (e.g. Cloudflare
+   Fonts) rewrites such a link into inline @font-face and breaks SSR hydration — add
+   fonts here, never via a Google Fonts <link>, and keep the family name matching the
+   value those two sources store. Inter also loads variable for the default UI; Lato
+   ships 400/700 only; Geist's @fontsource family is "Geist Sans". */
 @import "@fontsource-variable/inter/index.css";
+@import "@fontsource/inter/400.css";
+@import "@fontsource/inter/500.css";
+@import "@fontsource/inter/600.css";
+@import "@fontsource/inter/700.css";
+@import "@fontsource/roboto/400.css";
+@import "@fontsource/roboto/500.css";
+@import "@fontsource/roboto/600.css";
+@import "@fontsource/roboto/700.css";
+@import "@fontsource/open-sans/400.css";
+@import "@fontsource/open-sans/500.css";
+@import "@fontsource/open-sans/600.css";
+@import "@fontsource/open-sans/700.css";
+@import "@fontsource/lato/400.css";
+@import "@fontsource/lato/700.css";
+@import "@fontsource/nunito/400.css";
+@import "@fontsource/nunito/500.css";
+@import "@fontsource/nunito/600.css";
+@import "@fontsource/nunito/700.css";
+@import "@fontsource/poppins/400.css";
+@import "@fontsource/poppins/500.css";
+@import "@fontsource/poppins/600.css";
+@import "@fontsource/poppins/700.css";
+@import "@fontsource/dm-sans/400.css";
+@import "@fontsource/dm-sans/500.css";
+@import "@fontsource/dm-sans/600.css";
+@import "@fontsource/dm-sans/700.css";
+@import "@fontsource/plus-jakarta-sans/400.css";
+@import "@fontsource/plus-jakarta-sans/500.css";
+@import "@fontsource/plus-jakarta-sans/600.css";
+@import "@fontsource/plus-jakarta-sans/700.css";
+@import "@fontsource/manrope/400.css";
+@import "@fontsource/manrope/500.css";
+@import "@fontsource/manrope/600.css";
+@import "@fontsource/manrope/700.css";
+@import "@fontsource/space-grotesk/400.css";
+@import "@fontsource/space-grotesk/500.css";
+@import "@fontsource/space-grotesk/600.css";
+@import "@fontsource/space-grotesk/700.css";
+@import "@fontsource/playfair-display/400.css";
+@import "@fontsource/playfair-display/500.css";
+@import "@fontsource/playfair-display/600.css";
+@import "@fontsource/playfair-display/700.css";
+@import "@fontsource/merriweather/400.css";
+@import "@fontsource/merriweather/500.css";
+@import "@fontsource/merriweather/600.css";
+@import "@fontsource/merriweather/700.css";
+@import "@fontsource/lora/400.css";
+@import "@fontsource/lora/500.css";
+@import "@fontsource/lora/600.css";
+@import "@fontsource/lora/700.css";
+@import "@fontsource/fira-code/400.css";
+@import "@fontsource/fira-code/500.css";
+@import "@fontsource/fira-code/600.css";
+@import "@fontsource/fira-code/700.css";
+@import "@fontsource/jetbrains-mono/400.css";
+@import "@fontsource/jetbrains-mono/500.css";
+@import "@fontsource/jetbrains-mono/600.css";
+@import "@fontsource/jetbrains-mono/700.css";
+@import "@fontsource/geist-sans/400.css";
+@import "@fontsource/geist-sans/500.css";
+@import "@fontsource/geist-sans/600.css";
+@import "@fontsource/geist-sans/700.css";
 
 @custom-variant dark (&:is(.dark *));
 
diff --git a/apps/web/src/lib/shared/theme/__tests__/normalize-font.test.ts b/apps/web/src/lib/shared/theme/__tests__/normalize-font.test.ts
new file mode 100644
index 000000000..18bb8adb7
--- /dev/null
+++ b/apps/web/src/lib/shared/theme/__tests__/normalize-font.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest'
+import { normalizeFontSans, generateThemeCSS } from '../generator'
+
+describe('normalizeFontSans', () => {
+  it('maps the legacy bare "Geist" family to the bundled "Geist Sans"', () => {
+    expect(normalizeFontSans('"Geist", ui-sans-serif, system-ui, sans-serif')).toBe(
+      '"Geist Sans", ui-sans-serif, system-ui, sans-serif'
+    )
+  })
+
+  it('is idempotent on an already-current value', () => {
+    const current = '"Geist Sans", ui-sans-serif, system-ui, sans-serif'
+    expect(normalizeFontSans(current)).toBe(current)
+  })
+
+  it('leaves other families untouched', () => {
+    const inter = '"Inter", ui-sans-serif, system-ui, sans-serif'
+    expect(normalizeFontSans(inter)).toBe(inter)
+  })
+})
+
+describe('generateThemeCSS legacy font normalization', () => {
+  it('renders a saved bare "Geist" config as the bundled "Geist Sans" family', () => {
+    const css = generateThemeCSS({
+      themeMode: 'user',
+      light: {
+        fontSans: '"Geist", ui-sans-serif, system-ui, sans-serif',
+        primary: 'oklch(0.205 0 0)',
+        destructive: 'oklch(0.577 0.245 27)',
+        background: 'oklch(1 0 0)',
+        foreground: 'oklch(0.145 0 0)',
+      },
+    })
+    expect(css).toContain('"Geist Sans"')
+    expect(css).not.toContain('"Geist",')
+  })
+})
diff --git a/apps/web/src/lib/shared/theme/generator.ts b/apps/web/src/lib/shared/theme/generator.ts
index 30bc458c7..0873fcb3d 100644
--- a/apps/web/src/lib/shared/theme/generator.ts
+++ b/apps/web/src/lib/shared/theme/generator.ts
@@ -147,6 +147,22 @@ function variablesToCSS(vars: ThemeVariables): string {
   return declarations.join(' ')
 }
 
+// Maps a font family saved under an old name to the one now self-hosted in
+// globals.css. Geist self-hosts via @fontsource/geist-sans, whose @font-face
+// family is "Geist Sans", so a fontSans saved before that rename still resolves.
+const LEGACY_FONT_ALIASES: Record<string, string> = {
+  '"Geist"': '"Geist Sans"',
+}
+
+/** Rewrite legacy font-family names in a fontSans stack to their bundled equivalent. */
+export function normalizeFontSans(fontSans: string): string {
+  let normalized = fontSans
+  for (const [legacy, current] of Object.entries(LEGACY_FONT_ALIASES)) {
+    normalized = normalized.replaceAll(legacy, current)
+  }
+  return normalized
+}
+
 export function generateThemeCSS(config: ThemeConfig): string {
   if (!config) return ''
 
@@ -157,6 +173,8 @@ export function generateThemeCSS(config: ThemeConfig): string {
   const darkVars = config.dark
     ? expandTheme(config.dark as MinimalThemeVariables, { mode: 'dark' })
     : {}
+  if (lightVars.fontSans) lightVars.fontSans = normalizeFontSans(lightVars.fontSans)
+  if (darkVars.fontSans) darkVars.fontSans = normalizeFontSans(darkVars.fontSans)
 
   const parts: string[] = []
 
@@ -209,44 +227,3 @@ export function parseThemeConfig(json: string | null | undefined): ThemeConfig |
 export function serializeThemeConfig(config: ThemeConfig): string {
   return JSON.stringify(config)
 }
-
-const GOOGLE_FONT_MAP: Record<string, string> = {
-  '"Inter"': 'Inter',
-  '"Roboto"': 'Roboto',
-  '"Open Sans"': 'Open+Sans',
-  '"Lato"': 'Lato',
-  '"Montserrat"': 'Montserrat',
-  '"Poppins"': 'Poppins',
-  '"Nunito"': 'Nunito',
-  '"DM Sans"': 'DM+Sans',
-  '"Plus Jakarta Sans"': 'Plus+Jakarta+Sans',
-  '"Geist"': 'Geist',
-  '"Work Sans"': 'Work+Sans',
-  '"Raleway"': 'Raleway',
-  '"Source Sans 3"': 'Source+Sans+3',
-  '"Outfit"': 'Outfit',
-  '"Manrope"': 'Manrope',
-  '"Space Grotesk"': 'Space+Grotesk',
-  '"Playfair Display"': 'Playfair+Display',
-  '"Merriweather"': 'Merriweather',
-  '"Lora"': 'Lora',
-  '"Crimson Text"': 'Crimson+Text',
-  '"Fira Code"': 'Fira+Code',
-  '"JetBrains Mono"': 'JetBrains+Mono',
-}
-
-function extractGoogleFont(fontFamily: string | undefined): string | null {
-  if (!fontFamily) return null
-  for (const [cssName, googleName] of Object.entries(GOOGLE_FONT_MAP)) {
-    if (fontFamily.includes(cssName)) return googleName
-  }
-  return null
-}
-
-export function getGoogleFontsUrl(config: ThemeConfig): string | null {
-  if (!config) return null
-  const fontSans = config.light?.fontSans
-  const googleFont = extractGoogleFont(fontSans)
-  if (!googleFont) return null
-  return `https://fonts.googleapis.com/css2?family=${googleFont}:wght@400;500;600;700&display=swap`
-}
diff --git a/apps/web/src/lib/shared/theme/index.ts b/apps/web/src/lib/shared/theme/index.ts
index ec169e4c5..1b1a3d1b8 100644
--- a/apps/web/src/lib/shared/theme/index.ts
+++ b/apps/web/src/lib/shared/theme/index.ts
@@ -99,7 +99,7 @@ export {
   replaceCssVar,
   parseThemeConfig,
   serializeThemeConfig,
-  getGoogleFontsUrl,
+  normalizeFontSans,
 } from './generator'
 
 export type { ParsedCssVariables } from './css-parser'
diff --git a/apps/web/src/lib/shared/theme/presets.ts b/apps/web/src/lib/shared/theme/presets.ts
index 45a3bb544..9a726129f 100644
--- a/apps/web/src/lib/shared/theme/presets.ts
+++ b/apps/web/src/lib/shared/theme/presets.ts
@@ -2,10 +2,12 @@ import type { ThemePreset } from './types'
 import type { MinimalThemeVariables } from './expand'
 import { expandTheme } from './expand'
 
+// Each family here must be self-hosted in globals.css (and match the @fontsource
+// @font-face family name exactly), or the preset falls back to the generic stack.
 const FONTS = {
   inter: '"Inter", ui-sans-serif, system-ui, sans-serif',
   system: 'ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, sans-serif',
-  geist: '"Geist", ui-sans-serif, system-ui, sans-serif',
+  geist: '"Geist Sans", ui-sans-serif, system-ui, sans-serif',
   jakarta: '"Plus Jakarta Sans", ui-sans-serif, system-ui, sans-serif',
   dmSans: '"DM Sans", ui-sans-serif, system-ui, sans-serif',
   nunito: '"Nunito", ui-sans-serif, system-ui, sans-serif',
diff --git a/apps/web/src/routes/__tests__/_portal.test.ts b/apps/web/src/routes/__tests__/_portal.test.ts
index ce87b2a72..7f4388d6c 100644
--- a/apps/web/src/routes/__tests__/_portal.test.ts
+++ b/apps/web/src/routes/__tests__/_portal.test.ts
@@ -30,7 +30,6 @@ vi.mock('@/lib/server/domains/settings/redact', () => ({
 }))
 vi.mock('@/lib/shared/theme', () => ({
   generateThemeCSS: vi.fn(() => ''),
-  getGoogleFontsUrl: vi.fn(() => null),
 }))
 vi.mock('@/lib/shared/i18n', () => ({ resolveLocale: vi.fn(async () => 'en') }))
 vi.mock('@/lib/shared/types/settings', () => ({
diff --git a/apps/web/src/routes/_portal.tsx b/apps/web/src/routes/_portal.tsx
index 4583dd34e..5e26b86b4 100644
--- a/apps/web/src/routes/_portal.tsx
+++ b/apps/web/src/routes/_portal.tsx
@@ -6,7 +6,7 @@ import { AuthDialog } from '@/components/auth/auth-dialog'
 import { PortalAccessGate } from '@/components/portal/portal-access-gate'
 import type { PortalAccessGateError } from '@/lib/shared/types/portal-gate-error'
 import { DEFAULT_AUTH_CONFIG } from '@/lib/shared/types/settings'
-import { generateThemeCSS, getGoogleFontsUrl } from '@/lib/shared/theme'
+import { generateThemeCSS } from '@/lib/shared/theme'
 import { PortalIntlProvider } from '@/components/portal-intl-provider'
 import { getPortalLocaleFn, loadPortalIntl } from '@/lib/server/functions/locale'
 import { DEFAULT_LOCALE } from '@/lib/shared/i18n'
@@ -159,9 +159,6 @@ export const Route = createFileRoute('/_portal')({
     // Always apply custom CSS on top (cascades over theme styles)
     const customCssToApply = customCss
 
-    // Always load Google Fonts from theme config
-    const googleFontsUrl = getGoogleFontsUrl(brandingConfig)
-
     const initialUserData = session?.user
       ? {
           name: session.user.name,
@@ -190,7 +187,6 @@ export const Route = createFileRoute('/_portal')({
       themeStyles,
       customCss: customCssToApply,
       themeMode,
-      googleFontsUrl,
       initialUserData,
       authConfig,
       locale,
@@ -268,7 +264,6 @@ function PortalLayout() {
     themeStyles,
     customCss,
     themeMode,
-    googleFontsUrl,
     initialUserData,
     authConfig,
     locale,
@@ -288,7 +283,6 @@ function PortalLayout() {
           isAuthenticated={isAuthenticated}
         />
         <div className="min-h-screen bg-background flex flex-col">
-          {googleFontsUrl && <link rel="stylesheet" href={googleFontsUrl} />}
           {themeStyles && <style dangerouslySetInnerHTML={{ __html: themeStyles }} />}
           {/* Custom CSS is injected after theme styles so it can override */}
           {customCss && <style dangerouslySetInnerHTML={{ __html: customCss }} />}
diff --git a/apps/web/src/routes/admin/settings.branding.tsx b/apps/web/src/routes/admin/settings.branding.tsx
index 66b791e53..f53e98733 100644
--- a/apps/web/src/routes/admin/settings.branding.tsx
+++ b/apps/web/src/routes/admin/settings.branding.tsx
@@ -41,7 +41,6 @@ import {
 import { ThemePreview } from '@/components/admin/settings/branding/theme-preview'
 import {
   useBrandingState,
-  ALL_FONTS_URL,
   FONT_OPTIONS,
 } from '@/components/admin/settings/branding/use-branding-state'
 import { oklchColor } from '@/components/admin/settings/branding/oklch-color-extension'
@@ -187,8 +186,6 @@ function BrandingPage() {
 
   return (
     <>
-      <link rel="stylesheet" href={ALL_FONTS_URL} />
-
       <div className="space-y-6 max-w-5xl">
         <div className="lg:hidden">
           <BackLink to="/admin/settings">Settings</BackLink>
diff --git a/apps/web/src/routes/widget.tsx b/apps/web/src/routes/widget.tsx
index 5019a715a..2ac608843 100644
--- a/apps/web/src/routes/widget.tsx
+++ b/apps/web/src/routes/widget.tsx
@@ -2,7 +2,7 @@ import { createFileRoute, Outlet, redirect } from '@tanstack/react-router'
 import { createServerFn } from '@tanstack/react-start'
 import { getRequestHeaders, setResponseHeader } from '@tanstack/react-start/server'
 import { z } from 'zod'
-import { generateThemeCSS, getGoogleFontsUrl } from '@/lib/shared/theme'
+import { generateThemeCSS } from '@/lib/shared/theme'
 import { resolveLocale } from '@/lib/shared/i18n'
 import { WidgetAuthProvider } from '@/components/widget/widget-auth-provider'
 import { extractSessionTokenFromCookie } from '@/lib/server/functions/portal-session-token'
@@ -93,7 +93,6 @@ export const Route = createFileRoute('/widget')({
       themeMode,
       themeStyles,
       customCss,
-      googleFontsUrl: getGoogleFontsUrl(brandingConfig),
       portalUser,
       portalSessionToken,
       hmacRequired: settings?.publicWidgetConfig?.hmacRequired ?? false,
@@ -105,15 +104,8 @@ export const Route = createFileRoute('/widget')({
 })
 
 function WidgetLayout() {
-  const {
-    themeStyles,
-    customCss,
-    googleFontsUrl,
-    portalUser,
-    portalSessionToken,
-    hmacRequired,
-    locale,
-  } = Route.useLoaderData()
+  const { themeStyles, customCss, portalUser, portalSessionToken, hmacRequired, locale } =
+    Route.useLoaderData()
 
   return (
     <WidgetAuthProvider
@@ -122,7 +114,6 @@ function WidgetLayout() {
       hmacRequired={hmacRequired}
       initialLocale={locale}
     >
-      {googleFontsUrl && <link rel="stylesheet" href={googleFontsUrl} />}
       {themeStyles && <style dangerouslySetInnerHTML={{ __html: themeStyles }} />}
       {customCss && <style dangerouslySetInnerHTML={{ __html: customCss }} />}
       <style
diff --git a/bun.lock b/bun.lock
index 449664ea2..d02edb12d 100644
--- a/bun.lock
+++ b/bun.lock
@@ -44,7 +44,7 @@
     },
     "apps/web": {
       "name": "@quackback/web",
-      "version": "0.12.4",
+      "version": "0.13.1",
       "dependencies": {
         "@aws-sdk/client-s3": "^3.1032.0",
         "@aws-sdk/s3-request-presigner": "^3.1032.0",
@@ -54,6 +54,22 @@
         "@dnd-kit/utilities": "^3.2.2",
         "@floating-ui/dom": "^1.7.6",
         "@fontsource-variable/inter": "^5.2.8",
+        "@fontsource/dm-sans": "^5.2.8",
+        "@fontsource/fira-code": "^5.2.7",
+        "@fontsource/geist-sans": "^5.2.5",
+        "@fontsource/inter": "^5.2.8",
+        "@fontsource/jetbrains-mono": "^5.2.8",
+        "@fontsource/lato": "^5.2.7",
+        "@fontsource/lora": "^5.2.8",
+        "@fontsource/manrope": "^5.2.8",
+        "@fontsource/merriweather": "^5.2.11",
+        "@fontsource/nunito": "^5.2.7",
+        "@fontsource/open-sans": "^5.2.7",
+        "@fontsource/playfair-display": "^5.2.8",
+        "@fontsource/plus-jakarta-sans": "^5.2.8",
+        "@fontsource/poppins": "^5.2.7",
+        "@fontsource/roboto": "^5.2.10",
+        "@fontsource/space-grotesk": "^5.2.10",
         "@heroicons/react": "^2.2.0",
         "@hookform/resolvers": "^5.2.2",
         "@modelcontextprotocol/sdk": "^1.29.0",
@@ -146,7 +162,7 @@
         "tw-animate-css": "^1.4.0",
         "typeid-js": "^1.2.0",
         "yaml": "^2.8.4",
-        "zod": "^4.3.6",
+        "zod": "4.3.6",
         "zod-openapi": "^5.4.6",
         "zustand": "^5.0.12",
       },
@@ -529,6 +545,38 @@
 
     "@fontsource-variable/inter": ["@fontsource-variable/inter@5.2.8", "", {}, "sha512-kOfP2D+ykbcX/P3IFnokOhVRNoTozo5/JxhAIVYLpea/UBmCQ/YWPBfWIDuBImXX/15KH+eKh4xpEUyS2sQQGQ=="],
 
+    "@fontsource/dm-sans": ["@fontsource/dm-sans@5.2.8", "", {}, "sha512-tlovG42m9ESG28WiHpLq3F5umAlm64rv0RkqTbYowRn70e9OlRr5a3yTJhrhrY+k5lftR/OFJjPzOLQzk8EfCA=="],
+
+    "@fontsource/fira-code": ["@fontsource/fira-code@5.2.7", "", {}, "sha512-tnB9NNund9TwIym8/7DMJe573nlPEQb+fKUV5GL8TBYXjIhDvL0D7mgmNVNQUPhXp+R7RylQeiBdkA4EbOHPGQ=="],
+
+    "@fontsource/geist-sans": ["@fontsource/geist-sans@5.2.5", "", {}, "sha512-anllOHyJbElRs9fV15TeDRqAeb1IKm4bSknPl6ZMoyPTx1BBy7logudcUwpNjmQLkzn4Q0JGQLRCUKJYoyST6A=="],
+
+    "@fontsource/inter": ["@fontsource/inter@5.2.8", "", {}, "sha512-P6r5WnJoKiNVV+zvW2xM13gNdFhAEpQ9dQJHt3naLvfg+LkF2ldgSLiF4T41lf1SQCM9QmkqPTn4TH568IRagg=="],
+
+    "@fontsource/jetbrains-mono": ["@fontsource/jetbrains-mono@5.2.8", "", {}, "sha512-6w8/SG4kqvIMu7xd7wt6x3idn1Qux3p9N62s6G3rfldOUYHpWcc2FKrqf+Vo44jRvqWj2oAtTHrZXEP23oSKwQ=="],
+
+    "@fontsource/lato": ["@fontsource/lato@5.2.7", "", {}, "sha512-k5mum1ADbDW5cTw1Ett1eQVWeoZ6gq0ct6SFBibEhB4LRxhniChJZTBgd6ph5yBxLkN1fcnsnmicBNA4S/3nbw=="],
+
+    "@fontsource/lora": ["@fontsource/lora@5.2.8", "", {}, "sha512-AQlfsHw4TP1x/eb2IZ6VjQ70ctKa39m9JN9A4zlvDOeKYLrCs+GaYIEQ86Y6YfSPGHn01bErXkRcyktOW0LOPQ=="],
+
+    "@fontsource/manrope": ["@fontsource/manrope@5.2.8", "", {}, "sha512-gJHJmcuUk7qWcNCfcAri/DJQtXtBYqi9yKratr4jXhSo0I3xUtNNKI+igQIcw5c+m95g0vounk8ZnX/kb8o0TA=="],
+
+    "@fontsource/merriweather": ["@fontsource/merriweather@5.2.11", "", {}, "sha512-ZiIMeUh5iT8d73o6xlSF8GKgjV5pgiFrufYc5jZTVAfExtWKqM2vQHnsqXSFMv4ELhAcjt6Vf+5T3oVGXhAizQ=="],
+
+    "@fontsource/nunito": ["@fontsource/nunito@5.2.7", "", {}, "sha512-pmtBq0H9ex9nk+RtJYEJOD9pag393iHETnl/PVKleF4i06cd0ttngK5ZCTgYb5eOqR3Xdlrjtev8m7bmgYprew=="],
+
+    "@fontsource/open-sans": ["@fontsource/open-sans@5.2.7", "", {}, "sha512-8yfgDYjE5O0vmTPdrcjV35y4yMnctsokmi9gN49Gcsr0sjzkMkR97AnKDe6OqZh2SFkYlR28fxOvi21bYEgMSw=="],
+
+    "@fontsource/playfair-display": ["@fontsource/playfair-display@5.2.8", "", {}, "sha512-fUEhib70SszNhQVsGbUMSsWJhr7Je0rdeuZdtGpDNu0GKF1xJM8QhpI/y0pckU25GcChXm9TLOmeZupkvvZo2g=="],
+
+    "@fontsource/plus-jakarta-sans": ["@fontsource/plus-jakarta-sans@5.2.8", "", {}, "sha512-P5qE49fqdeD+7DXH1KBxmMPlB17LTz1zvBhFH0tFzfnYTKVJVyb0pR6plh0ZGXxcB+Oayb54FZZw3V42/DawTw=="],
+
+    "@fontsource/poppins": ["@fontsource/poppins@5.2.7", "", {}, "sha512-6uQyPmseo4FgI97WIhA4yWRlNaoLk4vSDK/PyRwdqqZb5zAEuc+Kunt8JTMcsHYUEGYBtN15SNkMajMdqUSUmg=="],
+
+    "@fontsource/roboto": ["@fontsource/roboto@5.2.10", "", {}, "sha512-8HlA5FtSfz//oFSr2eL7GFXAiE7eIkcGOtx7tjsLKq+as702x9+GU7K95iDeWFapHC4M2hv9RrpXKRTGGBI8Zg=="],
+
+    "@fontsource/space-grotesk": ["@fontsource/space-grotesk@5.2.10", "", {}, "sha512-XNXEbT74OIITPqw2H6HXwPDp85fy43uxfBwFR5PU+9sLnjuLj12KlhVM9nZVN6q6dlKjkuN8JisW/OBxwxgUew=="],
+
     "@formatjs/cli": ["@formatjs/cli@6.14.2", "", { "peerDependencies": { "@glimmer/syntax": "^0.84.3 || ^0.95.0", "@vue/compiler-core": "^3.5.0", "content-tag": "^4.1.0", "vue": "^3.5.0" }, "optionalPeers": ["@glimmer/syntax", "@vue/compiler-core", "content-tag", "vue"], "bin": { "formatjs": "bin/formatjs" } }, "sha512-0aZLIRcrxIf6QU2u04bIorYIVA1Sm8hHlHzlK9ROGB2BLN0WbiBCwK3jAPV9um+pPS6O4ZFT6K9c2j/3iMkmSw=="],
 
     "@formatjs/fast-memoize": ["@formatjs/fast-memoize@3.1.2", "", {}, "sha512-vPnriihkfK0lzoQGaXq+qXH23VsYyansRTkTgo2aTG0k1NjLFyZimFVdfj4C9JkSE5dm7CEngcQ5TTc1yAyBfQ=="],
@@ -2541,7 +2589,7 @@
 
     "yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
 
-    "zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
+    "zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
 
     "zod-openapi": ["zod-openapi@5.4.6", "", { "peerDependencies": { "zod": "^3.25.74 || ^4.0.0" } }, "sha512-P2jsOOBAq/6hCwUsMCjUATZ8szkMsV5VAwZENfyxp2Hc/XPJQpVwAgevWZc65xZauCwWB9LAn7zYeiCJFAEL+A=="],
 
@@ -2557,18 +2605,26 @@
 
     "@aws-crypto/util/@smithy/util-utf8": ["@smithy/util-utf8@2.3.0", "", { "dependencies": { "@smithy/util-buffer-from": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A=="],
 
+    "@better-auth/core/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
+
+    "@better-auth/oauth-provider/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
+
     "@esbuild-kit/core-utils/esbuild": ["esbuild@0.18.20", "", { "optionalDependencies": { "@esbuild/android-arm": "0.18.20", "@esbuild/android-arm64": "0.18.20", "@esbuild/android-x64": "0.18.20", "@esbuild/darwin-arm64": "0.18.20", "@esbuild/darwin-x64": "0.18.20", "@esbuild/freebsd-arm64": "0.18.20", "@esbuild/freebsd-x64": "0.18.20", "@esbuild/linux-arm": "0.18.20", "@esbuild/linux-arm64": "0.18.20", "@esbuild/linux-ia32": "0.18.20", "@esbuild/linux-loong64": "0.18.20", "@esbuild/linux-mips64el": "0.18.20", "@esbuild/linux-ppc64": "0.18.20", "@esbuild/linux-riscv64": "0.18.20", "@esbuild/linux-s390x": "0.18.20", "@esbuild/linux-x64": "0.18.20", "@esbuild/netbsd-x64": "0.18.20", "@esbuild/openbsd-x64": "0.18.20", "@esbuild/sunos-x64": "0.18.20", "@esbuild/win32-arm64": "0.18.20", "@esbuild/win32-ia32": "0.18.20", "@esbuild/win32-x64": "0.18.20" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA=="],
 
     "@eslint-community/eslint-utils/eslint-visitor-keys": ["eslint-visitor-keys@3.4.3", "", {}, "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag=="],
 
     "@modelcontextprotocol/sdk/ajv": ["ajv@8.18.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A=="],
 
+    "@modelcontextprotocol/sdk/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
+
     "@quackback/import/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
 
     "@quackback/import/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
     "@quackback/web/@tiptap/extension-mention": ["@tiptap/extension-mention@3.22.3", "", { "peerDependencies": { "@tiptap/core": "^3.22.3", "@tiptap/pm": "^3.22.3", "@tiptap/suggestion": "^3.22.3" } }, "sha512-wJmpjU6WqZgbMJUwGQKhwnzCdN/DtsFGRsExCvncuQxFKgsMzhW+NWwmzgrGJDyS8BMKzqwyKlSc1dcMOYzgJQ=="],
 
+    "@quackback/web/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
+
     "@radix-ui/react-accordion/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
 
     "@radix-ui/react-alert-dialog/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
@@ -2683,16 +2739,10 @@
 
     "@tanstack/router-generator/jiti": ["jiti@2.7.0", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ=="],
 
-    "@tanstack/router-generator/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
-
     "@tanstack/router-plugin/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
 
-    "@tanstack/router-plugin/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
-
     "@tanstack/start-plugin-core/@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],
 
-    "@tanstack/start-plugin-core/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
-
     "@testing-library/dom/dom-accessibility-api": ["dom-accessibility-api@0.5.16", "", {}, "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg=="],
 
     "@typescript-eslint/eslint-plugin/ignore": ["ignore@7.0.5", "", {}, "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg=="],
@@ -2703,6 +2753,8 @@
 
     "better-auth/kysely": ["kysely@0.29.2", "", {}, "sha512-s6WVJyEZrbm6jhBpiKHsGHyePMrVQKJ85wZCFCr9W4QHv6WTjWIrdvTmO9hDEA3bNK0xkrE2DqrHsXMLWuZpQg=="],
 
+    "better-auth/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
+
     "better-call/rou3": ["rou3@0.7.12", "", {}, "sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg=="],
 
     "bullmq/semver": ["semver@7.7.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA=="],
@@ -2721,6 +2773,8 @@
 
     "eslint-plugin-react/minimatch": ["minimatch@3.1.5", "", { "dependencies": { "brace-expansion": "^1.1.7" } }, "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w=="],
 
+    "eslint-plugin-react-hooks/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
+
     "form-data/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
 
     "htmlparser2/entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],