Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,22 @@
+.git
+.github
+node_modules
+vendor
+storage/app/public/*
+storage/framework/cache/*
+storage/framework/sessions/*
+storage/framework/views/*
+storage/logs/*
+
+# The package manifest is built on whatever machine ran composer, and on a
+# development machine that includes dev-only service providers. Copying it into
+# a --no-dev image makes Laravel try to boot a class that is not there.
+bootstrap/cache/*.php
+database/*.sqlite
+database/*.sqlite-journal
+.env
+.env.*
+!.env.example
+.phpunit.result.cache
+docs/*.pdf
+public/storage

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[{compose,docker-compose}.{yml,yaml}]
+indent_size = 4

.env.example

@@ -0,0 +1,188 @@
+APP_NAME="Pireon Admin"
+APP_ENV=local
+APP_KEY=
+APP_DEBUG=true
+APP_URL=http://localhost:8000
+
+APP_LOCALE=es
+APP_FALLBACK_LOCALE=es
+APP_FAKER_LOCALE=es_ES
+
+APP_MAINTENANCE_DRIVER=file
+# APP_MAINTENANCE_STORE=database
+
+# PHP_CLI_SERVER_WORKERS=4
+
+BCRYPT_ROUNDS=12
+
+LOG_CHANNEL=stack
+LOG_STACK=single
+LOG_DEPRECATIONS_CHANNEL=null
+LOG_LEVEL=debug
+
+DB_CONNECTION=sqlite
+# DB_HOST=127.0.0.1
+# DB_PORT=3306
+# DB_DATABASE=laravel
+# DB_USERNAME=root
+# DB_PASSWORD=
+
+SESSION_DRIVER=database
+SESSION_LIFETIME=120
+SESSION_ENCRYPT=false
+SESSION_PATH=/
+SESSION_DOMAIN=null
+
+BROADCAST_CONNECTION=log
+FILESYSTEM_DISK=local
+QUEUE_CONNECTION=database
+
+CACHE_STORE=database
+# CACHE_PREFIX=
+
+MEMCACHED_HOST=127.0.0.1
+
+REDIS_CLIENT=phpredis
+REDIS_HOST=127.0.0.1
+REDIS_PASSWORD=null
+REDIS_PORT=6379
+
+MAIL_MAILER=log
+MAIL_SCHEME=null
+MAIL_HOST=127.0.0.1
+MAIL_PORT=2525
+MAIL_USERNAME=null
+MAIL_PASSWORD=null
+MAIL_FROM_ADDRESS="hello@example.com"
+MAIL_FROM_NAME="${APP_NAME}"
+
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_DEFAULT_REGION=us-east-1
+AWS_BUCKET=
+AWS_USE_PATH_STYLE_ENDPOINT=false
+
+VITE_APP_NAME="${APP_NAME}"
+
+###############################################################################
+# Pireon OAuth2 identity server
+#
+# Register this app as an OAuth client at https://oauth.pireon.dev and paste the
+# credentials here. The redirect URI must match the one registered there exactly.
+###############################################################################
+PIREON_SERVER=https://oauth.pireon.dev
+PIREON_CLIENT_ID=
+PIREON_CLIENT_SECRET=
+PIREON_REDIRECT_URI="${APP_URL}/auth/callback"
+PIREON_SCOPES=account:read
+
+# Grants. The panel's sign-in form uses the password grant, so turning this off
+# locks everyone out of the panel as well as out of POST /api/v1/auth/token.
+PIREON_PASSWORD_GRANT=true
+
+# How long an API bearer token stays valid here after being revoked upstream.
+PIREON_INTROSPECTION_TTL=60
+PIREON_HTTP_TIMEOUT=10
+
+# Role granted on a user's first sign-in.
+PIREON_DEFAULT_ROLE=viewer
+
+# Refuse sessions for accounts the identity server reports as inactive or
+# still awaiting administrator approval.
+PIREON_REQUIRE_ACTIVE=true
+PIREON_REQUIRE_APPROVED=true
+
+###############################################################################
+# Public site (separate, server-rendered application)
+###############################################################################
+SITE_URL=http://localhost:4321
+
+# Frontend i18n routers serve the default locale without a prefix. Turn this
+# on only if yours prefixes every locale.
+SITE_PREFIX_DEFAULT_LOCALE=false
+
+# Shared secret letting the frontend render unpublished content.
+# Leave empty to disable previews entirely. Generate one with:
+#   php -r "echo bin2hex(random_bytes(24)), PHP_EOL;"
+SITE_PREVIEW_TOKEN=
+
+# Seconds a shared cache may serve a public response without revalidating.
+SITE_CACHE_SECONDS=60
+
+# Requests per minute on the public API. With SSR every visitor's page view
+# arrives from the frontend's IP, so this is a budget for the WHOLE site at
+# once. Add that IP to SITE_TRUSTED_IPS to bypass the limit entirely.
+SITE_RATE_LIMIT=600
+SITE_TRUSTED_IPS=
+
+# Shared secret the frontend presents when reporting addresses it could not
+# resolve (X-Ingest-Token). Those reports are what turns Redirects from
+# something only this side can write into a list of links actually broken out
+# there. Leave empty to disable the endpoint — empty never means "anyone may
+# report". Generate one with:
+#   php -r "echo bin2hex(random_bytes(24)), PHP_EOL;"
+SITE_INGEST_TOKEN=
+
+# Reports per minute, and paths per request.
+SITE_TELEMETRY_RATE_LIMIT=60
+SITE_TELEMETRY_MAX_BATCH=50
+
+# Submissions — the only public write endpoints. Set to false to close the
+# forms without deploying; the frontend reads the flag from /site and hides
+# them rather than showing a form that would be refused.
+SITE_ACCEPT_SUBMISSIONS=true
+
+# Field name no human fills in. Anything arriving with it set is filed as
+# spam — filed, not dropped, so a browser autofill cannot lose a real message.
+SITE_HONEYPOT_FIELD=website
+
+# Per e-mail address, per minute; and across the whole site, per hour. There is
+# deliberately no per-IP budget: with SSR every submission arrives from the
+# frontend's address.
+SITE_SUBMISSION_RATE_LIMIT=3
+SITE_SUBMISSION_HOURLY_LIMIT=60
+SITE_SUBMISSION_DEDUPE_MINUTES=1440
+
+# Also e-mail the panel users who can read the inbox (needs a working mailer).
+SITE_SUBMISSION_MAIL=false
+
+###############################################################################
+# Images
+###############################################################################
+# Disk uploads live on. It has to be one with public URLs: the frontend is a
+# separate application on another host. `public` needs `php artisan storage:link`
+# once. If you have uploads from before this setting existed they are on the
+# private `local` disk — either move them to storage/app/public or set this to
+# `local`, which is served through the application's own /storage route.
+MEDIA_DISK=public
+
+# Images above this many pixels are recorded with their dimensions but not
+# resampled: resizing one costs more memory than it is worth, and it is nearly
+# always a mistake rather than an intention.
+MEDIA_MAX_PIXELS=50000000
+
+###############################################################################
+# Git repositories — self-hosted Gitea
+###############################################################################
+GIT_PROVIDER=gitea
+
+# Instance root, WITHOUT /api/v1 — the driver appends it.
+GITEA_URL=https://git.example.org
+
+# Only needed for private repositories, or if the instance requires sign-in to
+# read. Gitea → Settings → Applications. Narrowest useful scopes:
+# read:repository, read:issue.
+GITEA_TOKEN=
+
+# Organisation used when a repository is entered as a bare name.
+GITEA_ORG=
+
+# Optional: only for mirrors or the odd repository hosted on GitHub.
+GITHUB_TOKEN=
+GITHUB_ORG=
+
+# hourly | daily | or a raw cron expression
+GIT_SYNC_CRON=hourly
+GIT_SYNC_TTL=55
+GIT_MAX_ISSUES=25
+GIT_HTTP_TIMEOUT=15

.env.production.example

@@ -0,0 +1,118 @@
+###############################################################################
+# Production environment for the Docker stack.
+#
+#   cp .env.production.example .env.production
+#   docker compose run --rm --no-deps app php artisan key:generate --show
+#
+# Everything the containers need is here; docker-compose.yml sets the database,
+# cache, session and queue drivers itself so they cannot drift.
+###############################################################################
+
+APP_NAME="Pireon Admin"
+APP_ENV=production
+APP_DEBUG=false
+
+# Required. Without it sessions cannot be decrypted and the signed preview
+# links cannot be verified — the entrypoint refuses to start rather than
+# failing later in a way nobody connects to this.
+APP_KEY=
+
+# The public address of the panel itself, https included. It is what the API
+# builds absolute image URLs from, so getting it wrong means every image on the
+# public site points at the wrong host.
+APP_URL=https://admin.example.org
+
+APP_LOCALE=es
+APP_FALLBACK_LOCALE=es
+
+LOG_CHANNEL=stack
+LOG_STACK=single
+LOG_LEVEL=warning
+
+# Port the stack listens on. Put a reverse proxy in front of it and terminate
+# TLS there.
+APP_PORT=8000
+
+###############################################################################
+# Database
+###############################################################################
+DB_DATABASE=pireon
+DB_USERNAME=pireon
+
+# No default on purpose: compose refuses to start without it.
+DB_PASSWORD=
+
+###############################################################################
+# Pireon OAuth2 identity server
+#
+# The panel's sign-in form uses the password grant, so the registered client
+# must allow it.
+###############################################################################
+PIREON_SERVER=https://oauth.pireon.dev
+PIREON_CLIENT_ID=
+PIREON_CLIENT_SECRET=
+PIREON_REDIRECT_URI="${APP_URL}/auth/callback"
+PIREON_SCOPES=account:read
+PIREON_PASSWORD_GRANT=true
+PIREON_INTROSPECTION_TTL=60
+PIREON_DEFAULT_ROLE=viewer
+PIREON_REQUIRE_ACTIVE=true
+PIREON_REQUIRE_APPROVED=true
+
+###############################################################################
+# Public site (separate, server-rendered application)
+###############################################################################
+SITE_URL=https://example.org
+SITE_PREFIX_DEFAULT_LOCALE=false
+SITE_CACHE_SECONDS=60
+
+# Generate with: php -r "echo bin2hex(random_bytes(24)), PHP_EOL;"
+SITE_PREVIEW_TOKEN=
+
+# With SSR every visitor's page view arrives from the frontend's address, so
+# this budget is for the whole site at once. Add that address here and it
+# bypasses the limit entirely.
+SITE_RATE_LIMIT=600
+SITE_TRUSTED_IPS=
+
+# Shared secret for the 404 reports the frontend sends back. Empty disables
+# the endpoint. Generate with: php -r "echo bin2hex(random_bytes(24)), PHP_EOL;"
+SITE_INGEST_TOKEN=
+SITE_TELEMETRY_RATE_LIMIT=60
+SITE_TELEMETRY_MAX_BATCH=50
+
+SITE_ACCEPT_SUBMISSIONS=true
+SITE_HONEYPOT_FIELD=website
+SITE_SUBMISSION_RATE_LIMIT=3
+SITE_SUBMISSION_HOURLY_LIMIT=60
+SITE_SUBMISSION_DEDUPE_MINUTES=1440
+SITE_SUBMISSION_MAIL=false
+
+###############################################################################
+# Images
+#
+# `public` is right for this stack: the storage volume is mounted in the web
+# container and Caddy serves /storage/* straight off disk without touching PHP.
+###############################################################################
+MEDIA_DISK=public
+MEDIA_MAX_PIXELS=50000000
+
+###############################################################################
+# Git repositories
+###############################################################################
+GIT_PROVIDER=gitea
+GITEA_URL=
+GITEA_TOKEN=
+GITEA_ORG=
+GIT_SYNC_CRON=hourly
+
+###############################################################################
+# Mail — only needed if SITE_SUBMISSION_MAIL is true
+###############################################################################
+MAIL_MAILER=log
+MAIL_HOST=
+MAIL_PORT=587
+MAIL_USERNAME=
+MAIL_PASSWORD=
+MAIL_FROM_ADDRESS="admin@example.org"
+MAIL_FROM_NAME="${APP_NAME}"

.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+*.blade.php diff=html
+*.css diff=css
+*.html diff=html
+*.md diff=markdown
+*.php diff=php
+
+/.github export-ignore
+CHANGELOG.md export-ignore
+.styleci.yml export-ignore

.gitignore

@@ -0,0 +1,29 @@
+*.log
+.DS_Store
+.env
+.env.backup
+.env.backup-*
+.env.production
+.phpactor.json
+.phpunit.result.cache
+/.claude/settings.local.json
+/.codex
+/.cursor/
+/.idea
+/.nova
+/.phpunit.cache
+/.vscode
+/.zed
+/auth.json
+/node_modules
+/public/build
+/public/fonts-manifest.dev.json
+/public/hot
+/public/storage
+/storage/*.key
+/storage/pail
+/vendor
+_ide_helper.php
+Homestead.json
+Homestead.yaml
+Thumbs.db

.npmrc

@@ -0,0 +1,2 @@
+ignore-scripts=true
+audit=true

Dockerfile

@@ -0,0 +1,122 @@
+# syntax=docker/dockerfile:1
+
+###############################################################################
+# Base
+#
+# Both stages share it, so dependencies are resolved against exactly the PHP
+# that will run them — Filament requires ext-intl, and a composer image that
+# lacks it would either refuse to install or, worse, install something the
+# runtime cannot use.
+###############################################################################
+# PHP 8.4, not the 8.3 that composer.json's `^8.3` suggests: the lock file
+# resolved Symfony 8, which requires >=8.4.1. Building on 8.3 fails at
+# `composer install`, which is a much better place to find out than a deploy.
+FROM dunglas/frankenphp:1-php8.4 AS base
+
+WORKDIR /app
+
+# gd with WebP is not optional: it is what App\Services\Media\ImageProcessor
+# derives every responsive version with. exif is what stops a photo taken
+# sideways staying sideways. pcntl lets the queue worker shut down cleanly
+# instead of being killed mid-job.
+RUN install-php-extensions \
+        pdo_pgsql \
+        gd \
+        exif \
+        intl \
+        zip \
+        pcntl \
+        opcache \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends postgresql-client \
+    && rm -rf /var/lib/apt/lists/*
+
+# In base rather than only in runtime, so the test stage runs under the same
+# PHP settings production does — a memory limit that is only set in production
+# is a memory limit nothing has tried.
+COPY docker/php.ini /usr/local/etc/php/conf.d/app.ini
+
+###############################################################################
+# Dependencies
+###############################################################################
+FROM base AS vendor
+
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+
+COPY composer.json composer.lock ./
+
+# `--no-scripts` because the post-install hooks boot the application, and the
+# application cannot boot before its code is here. They are run explicitly in
+# the runtime stage instead, where everything exists.
+RUN composer install \
+        --no-dev \
+        --no-scripts \
+        --no-autoloader \
+        --prefer-dist \
+        --no-interaction
+
+COPY . .
+
+RUN composer dump-autoload --no-dev --optimize --classmap-authoritative
+
+###############################################################################
+# Test
+#
+# The production image is built with --no-dev, which leaves out the test runner
+# itself. Verifying this application against Postgres therefore needs its own
+# stage — see docker-compose.test.yml, and the JSON-column queries it exists to
+# exercise.
+###############################################################################
+FROM base AS test
+
+# Only the dev dependencies need this one, so production stays without it.
+RUN install-php-extensions bcmath
+
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+
+COPY composer.json composer.lock ./
+
+RUN composer install --no-scripts --no-autoloader --prefer-dist --no-interaction
+
+COPY . .
+
+# An empty .env: the file is excluded from the build context on purpose, and
+# without it every single test emits a "failed to open stream" warning that
+# buries the real output.
+RUN touch .env \
+    && composer dump-autoload --optimize \
+    && php artisan package:discover --ansi
+
+###############################################################################
+# Runtime
+###############################################################################
+FROM base AS runtime
+
+LABEL org.opencontainers.image.title="Pireon Admin" \
+      org.opencontainers.image.description="Admin panel and REST API for the collective"
+
+COPY docker/Caddyfile /etc/caddy/Caddyfile
+
+COPY --from=vendor /app/vendor ./vendor
+COPY . .
+
+COPY docker/entrypoint.sh /usr/local/bin/entrypoint
+RUN chmod +x /usr/local/bin/entrypoint
+
+# Filament serves its own CSS and JS from public/; publishing them at build
+# time means the running container never writes to public/.
+#
+# There is deliberately no Node stage: the only `@vite` directive left is in
+# Laravel's default welcome page, which this application redirects away from.
+RUN php artisan package:discover --ansi \
+    && php artisan filament:assets
+
+RUN chown -R www-data:www-data storage bootstrap/cache
+
+ENV SERVER_NAME=:80
+
+EXPOSE 80
+
+ENTRYPOINT ["entrypoint"]
+
+CMD ["frankenphp", "run", "--config", "/etc/caddy/Caddyfile"]

app/Actions/Auth/SyncPireonUser.php

@@ -0,0 +1,81 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Actions\Auth;
+
+use App\Models\User;
+use App\Services\Pireon\PireonIdentity;
+use Illuminate\Support\Facades\DB;
+use Spatie\Permission\Models\Role;
+
+/**
+ * Mirror an identity from the OAuth server into the local users table.
+ *
+ * Identity fields are overwritten on every login — the identity server is the
+ * source of truth for who someone is. Local roles are never touched here: this
+ * application owns authorisation, so a role granted in the panel survives every
+ * subsequent login, and `app_roles` reported upstream grant nothing.
+ */
+class SyncPireonUser
+{
+    public function handle(PireonIdentity $identity): User
+    {
+        return DB::transaction(function () use ($identity): User {
+            $user = User::query()
+                ->where('oauth_id', $identity->id)
+                ->first();
+
+            // Adopt a pre-existing local account created by a seeder or an
+            // earlier import, so the first real login claims it instead of
+            // colliding with the unique email index.
+            $user ??= User::query()
+                ->whereNull('oauth_id')
+                ->where('email', $identity->email)
+                ->first();
+
+            $isNew = $user === null;
+            $user ??= new User;
+
+            $user->fill([
+                'oauth_id' => $identity->id,
+                'name' => $identity->name,
+                'email' => $identity->email,
+                'is_active' => $identity->isActive,
+                'remote_roles' => $identity->roles,
+                'last_login_at' => now(),
+            ]);
+
+            // The upstream account is already verified by the identity server;
+            // recording it here keeps Laravel's own checks satisfied.
+            $user->email_verified_at ??= now();
+
+            $user->save();
+
+            if ($isNew) {
+                $this->assignDefaultRole($user);
+            }
+
+            return $user->refresh();
+        });
+    }
+
+    /**
+     * A brand new identity gets the least-privileged role. Promoting them is a
+     * deliberate act performed by an administrator in the panel.
+     */
+    protected function assignDefaultRole(User $user): void
+    {
+        $role = (string) config('pireon.default_role');
+
+        if (blank($role) || $user->roles()->exists()) {
+            return;
+        }
+
+        // Silently skip when the role has not been seeded yet, so a login can
+        // never fail because of a missing local role.
+        if (Role::where('name', $role)->exists()) {
+            $user->assignRole($role);
+        }
+    }
+}

app/Auth/PireonTokenGuard.php

@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Auth;
+
+use App\Actions\Auth\SyncPireonUser;
+use App\Models\User;
+use App\Services\Pireon\PireonClient;
+use App\Services\Pireon\PireonException;
+use App\Services\Pireon\PireonIdentity;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Cache;
+
+/**
+ * Resolves the API caller from a bearer token issued by the Pireon server.
+ *
+ * The server publishes neither a JWKS document nor an introspection endpoint,
+ * so a token is validated the only way available: by spending it on
+ * GET /api/user upstream. A 401 there means the token is expired, revoked, or
+ * client-credentials-only, and the request is anonymous here.
+ *
+ * That upstream call is cached briefly, keyed by a SHA-256 hash of the token so
+ * the token itself never lands in the cache store. The TTL is the window during
+ * which a token revoked upstream still works here — keep it short.
+ */
+class PireonTokenGuard
+{
+    public function __construct(
+        protected PireonClient $client,
+        protected SyncPireonUser $sync,
+    ) {}
+
+    public function __invoke(Request $request): ?User
+    {
+        $token = $request->bearerToken();
+
+        if (blank($token) || ! $this->client->isConfigured()) {
+            return null;
+        }
+
+        $identity = $this->resolveIdentity($token);
+
+        if ($identity === null || ! $identity->isUsable()) {
+            return null;
+        }
+
+        $user = $this->localUser($identity);
+
+        // Locally deactivating an account revokes API access immediately,
+        // without needing anything to change upstream.
+        return $user->is_active ? $user : null;
+    }
+
+    protected function resolveIdentity(string $token): ?PireonIdentity
+    {
+        $key = 'pireon:introspect:'.hash('sha256', $token);
+        $ttl = (int) config('pireon.introspection_ttl', 60);
+
+        $cached = Cache::get($key);
+
+        if (is_array($cached)) {
+            return $cached === [] ? null : PireonIdentity::fromResponse($cached);
+        }
+
+        try {
+            $identity = $this->client->identity($token);
+        } catch (PireonException $e) {
+            // Cache the rejection too, so a client hammering us with a dead
+            // token cannot turn into a flood of upstream requests. Never cache
+            // a transport failure — that would lock out valid tokens whenever
+            // the identity server has a blip.
+            if ($e->status === 401) {
+                Cache::put($key, [], min($ttl, 60));
+            }
+
+            return null;
+        }
+
+        Cache::put($key, $identity->toArray(), $ttl);
+
+        return $identity;
+    }
+
+    /**
+     * Mirror the identity locally so policies, ownership checks and foreign
+     * keys have a real row to work with. Local roles are left untouched.
+     */
+    protected function localUser(PireonIdentity $identity): User
+    {
+        $user = User::query()->where('oauth_id', $identity->id)->first();
+
+        return $user ?? $this->sync->handle($identity);
+    }
+}

app/Console/Commands/AssignRole.php

@@ -0,0 +1,67 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\User;
+use Illuminate\Console\Command;
+use Spatie\Permission\Models\Role;
+
+use function Laravel\Prompts\select;
+
+/**
+ * Bootstraps administration.
+ *
+ * Local accounts only appear after their first OAuth login, so there is no
+ * super admin to promote anyone at install time. This command is the way in:
+ * sign in once through the panel, then run
+ *
+ *   php artisan user:role you@example.com super_admin
+ */
+class AssignRole extends Command
+{
+    protected $signature = 'user:role {email : Email of the user, as known to the identity server}
+                                      {role? : Role to grant; prompts when omitted}
+                                      {--revoke : Remove the role instead of granting it}
+                                      {--only : Replace all of the user\'s roles with this one}';
+
+    protected $description = 'Grant or revoke a local role for a user';
+
+    public function handle(): int
+    {
+        $user = User::query()->where('email', $this->argument('email'))->first();
+
+        if (! $user) {
+            $this->error("No local user with email [{$this->argument('email')}].");
+            $this->line('Local accounts are created on first login. Ask them to sign in once, then re-run this.');
+
+            return self::FAILURE;
+        }
+
+        $role = $this->argument('role') ?? select(
+            label: 'Which role?',
+            options: Role::query()->pluck('name', 'name')->all(),
+        );
+
+        if (! Role::query()->where('name', $role)->exists()) {
+            $this->error("No role named [{$role}]. Run `php artisan permissions:sync` first.");
+
+            return self::FAILURE;
+        }
+
+        match (true) {
+            (bool) $this->option('revoke') => $user->removeRole($role),
+            (bool) $this->option('only') => $user->syncRoles([$role]),
+            default => $user->assignRole($role),
+        };
+
+        $this->info(sprintf(
+            '%s now has roles: %s',
+            $user->email,
+            $user->fresh()->roles->pluck('name')->implode(', ') ?: '(none)',
+        ));
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/GenerateApiTypesCommand.php

@@ -0,0 +1,298 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+use Symfony\Component\Yaml\Yaml;
+
+/**
+ * TypeScript definitions for whoever writes the frontend.
+ *
+ * The specification is already the contract; this is the same contract in the
+ * form an editor can check while somebody types. It matters more than usual
+ * here: the frontend is a separate project in an undecided framework, so
+ * everything about these payloads that is not written down has to be
+ * remembered, and the one thing every candidate framework agrees on is
+ * TypeScript.
+ *
+ * Generated rather than written, and `--check` exists so it can be proved to
+ * be current: a hand-maintained type file drifts exactly like a
+ * hand-maintained specification, which is the problem this started from.
+ */
+class GenerateApiTypesCommand extends Command
+{
+    protected $signature = 'api:types
+                            {--output=public/api-types.d.ts : Where to write them}
+                            {--check : Fail if the file on disk is out of date, and write nothing}';
+
+    protected $description = 'Generate TypeScript definitions for the public API from openapi.yaml';
+
+    /**
+     * @var array<string, mixed>
+     */
+    protected array $spec = [];
+
+    public function handle(): int
+    {
+        $source = public_path('openapi.yaml');
+
+        if (! file_exists($source)) {
+            $this->components->error(__('console.types.no_spec'));
+
+            return self::FAILURE;
+        }
+
+        $this->spec = (array) Yaml::parseFile($source);
+
+        $output = base_path((string) $this->option('output'));
+        $generated = $this->render();
+
+        if ($this->option('check')) {
+            $current = file_exists($output) ? file_get_contents($output) : null;
+
+            if ($current === $generated) {
+                $this->components->info(__('console.types.current'));
+
+                return self::SUCCESS;
+            }
+
+            $this->components->error(__('console.types.stale'));
+
+            return self::FAILURE;
+        }
+
+        file_put_contents($output, $generated);
+
+        $this->components->info(__('console.types.written', [
+            'path' => $this->option('output'),
+            'count' => count($this->schemas()),
+        ]));
+
+        return self::SUCCESS;
+    }
+
+    protected function render(): string
+    {
+        $lines = [
+            '/**',
+            // From the document, never from the configuration. This file is
+            // generated, committed and checked with `--check`, so anything in
+            // it that varies by environment turns that check into a failure
+            // that depends on where it ran.
+            ' * '.($this->spec['info']['title'] ?? 'This application').' — the public payloads.',
+            ' *',
+            ' * Generated from openapi.yaml by `php artisan api:types`. Do not edit:',
+            ' * change the specification instead, and the contract test will hold the',
+            ' * API to it.',
+            ' */',
+            '',
+        ];
+
+        foreach ($this->schemas() as $name => $schema) {
+            $lines[] = $this->renderSchema((string) $name, (array) $schema);
+        }
+
+        $lines[] = $this->renderPaths();
+
+        return implode("\n", $lines);
+    }
+
+    /**
+     * Only the shapes the public API answers with. The administration schemas
+     * are in the same document, but they are read by callers holding a token
+     * and writing PHP or curl, not by the frontend.
+     *
+     * @return array<string, mixed>
+     */
+    protected function schemas(): array
+    {
+        $schemas = (array) ($this->spec['components']['schemas'] ?? []);
+
+        $wanted = array_filter(
+            array_keys($schemas),
+            fn (string $name) => str_starts_with($name, 'Public')
+                || in_array($name, ['Image', 'Alternates', 'TranslatedField'], true),
+        );
+
+        // Alphabetical, so a schema added upstream never reshuffles the file.
+        sort($wanted);
+
+        return array_replace(array_flip($wanted), array_intersect_key($schemas, array_flip($wanted)));
+    }
+
+    /**
+     * @param  array<string, mixed>  $schema
+     */
+    protected function renderSchema(string $name, array $schema): string
+    {
+        $doc = $this->docBlock($schema['description'] ?? null, '');
+        $doc = $doc === '' ? '' : $doc."\n";
+
+        if (($schema['type'] ?? null) !== 'object' || ! isset($schema['properties'])) {
+            return "{$doc}export type {$name} = ".$this->type($schema).";\n";
+        }
+
+        $lines = ["{$doc}export interface {$name} {"];
+
+        foreach ((array) $schema['properties'] as $property => $definition) {
+            $definition = (array) $definition;
+
+            if ($comment = $this->docBlock($definition['description'] ?? null, '  ')) {
+                $lines[] = $comment;
+            }
+
+            // Nullable is this document's way of saying "may not be there",
+            // which is what the contract test holds the API to as well.
+            $optional = ($definition['nullable'] ?? false) === true ? '?' : '';
+
+            $lines[] = "  {$property}{$optional}: ".$this->type($definition).';';
+        }
+
+        $lines[] = "}\n";
+
+        return implode("\n", $lines);
+    }
+
+    /**
+     * A map from every public path to what it answers with, so a typed client
+     * can be written without repeating any of this by hand.
+     */
+    protected function renderPaths(): string
+    {
+        $lines = [
+            '/** What each public endpoint answers with, under `data`. */',
+            'export interface PublicApiPayloads {',
+        ];
+
+        foreach ((array) ($this->spec['paths'] ?? []) as $path => $operations) {
+            if (! str_starts_with((string) $path, '/public/v1') || ! isset($operations['get'])) {
+                continue;
+            }
+
+            $schema = $operations['get']['responses'][200]['content']['application/json']['schema'] ?? null;
+
+            if ($schema === null) {
+                continue;
+            }
+
+            $data = (array) ($this->resolve((array) $schema)['properties']['data'] ?? []);
+
+            $lines[] = "  '{$path}': ".($data === [] ? 'unknown' : $this->type($data)).';';
+        }
+
+        $lines[] = '}';
+        $lines[] = '';
+
+        return implode("\n", $lines);
+    }
+
+    /**
+     * One schema as a TypeScript type.
+     *
+     * @param  array<string, mixed>  $schema
+     */
+    protected function type(array $schema): string
+    {
+        if (isset($schema['$ref'])) {
+            return basename((string) $schema['$ref']);
+        }
+
+        if (isset($schema['allOf'])) {
+            $parts = array_map(fn ($part) => $this->type((array) $part), (array) $schema['allOf']);
+
+            return implode(' & ', $parts);
+        }
+
+        if (isset($schema['enum'])) {
+            return implode(' | ', array_map(
+                fn ($value) => is_string($value) ? "'{$value}'" : json_encode($value),
+                (array) $schema['enum'],
+            ));
+        }
+
+        return match ($schema['type'] ?? 'object') {
+            'array' => $this->arrayType((array) ($schema['items'] ?? [])),
+            'integer', 'number' => 'number',
+            'boolean' => 'boolean',
+            'string' => 'string',
+            'object' => $this->objectType($schema),
+            default => 'unknown',
+        };
+    }
+
+    /**
+     * @param  array<string, mixed>  $items
+     */
+    protected function arrayType(array $items): string
+    {
+        $type = $items === [] ? 'unknown' : $this->type($items);
+
+        // `(A & B)[]` rather than `A & B[]`, which would mean something else.
+        return str_contains($type, ' ') ? "({$type})[]" : "{$type}[]";
+    }
+
+    /**
+     * @param  array<string, mixed>  $schema
+     */
+    protected function objectType(array $schema): string
+    {
+        if (! isset($schema['properties'])) {
+            // The one shape this covers is `alternates`: a locale code to a
+            // path, with the locales known only at runtime.
+            $values = isset($schema['additionalProperties']) && is_array($schema['additionalProperties'])
+                ? $this->type((array) $schema['additionalProperties'])
+                : 'string';
+
+            return "Record<string, {$values}>";
+        }
+
+        $fields = [];
+
+        foreach ((array) $schema['properties'] as $property => $definition) {
+            $definition = (array) $definition;
+            $optional = ($definition['nullable'] ?? false) === true ? '?' : '';
+
+            $fields[] = "{$property}{$optional}: ".$this->type($definition);
+        }
+
+        return '{ '.implode('; ', $fields).' }';
+    }
+
+    /**
+     * Descriptions carried across, because half of what this document knows is
+     * in its prose — why a field is only on the detail endpoint, what a null
+     * means — and none of that survives a type on its own.
+     */
+    protected function docBlock(?string $text, string $indent): string
+    {
+        $text = trim((string) $text);
+
+        if ($text === '') {
+            return '';
+        }
+
+        $lines = array_map(
+            fn (string $line) => "{$indent} * ".rtrim($line),
+            explode("\n", $text),
+        );
+
+        return "{$indent}/**\n".implode("\n", $lines)."\n{$indent} */";
+    }
+
+    /**
+     * @param  array<string, mixed>  $schema
+     * @return array<string, mixed>
+     */
+    protected function resolve(array $schema): array
+    {
+        if (isset($schema['$ref'])) {
+            $name = basename((string) $schema['$ref']);
+
+            return $this->resolve((array) ($this->spec['components']['schemas'][$name] ?? []));
+        }
+
+        return $schema;
+    }
+}

app/Console/Commands/ProcessMediaCommand.php

@@ -0,0 +1,70 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\Media;
+use App\Services\Media\ImageProcessor;
+use Illuminate\Console\Command;
+
+/**
+ * The safety net, and the way back from a change of settings.
+ *
+ * Uploads queue their own processing, but a queue that is not running would
+ * leave images without dimensions and nobody would notice until the page
+ * reflowed. The scheduler runs this every ten minutes so a stalled worker
+ * costs a delay rather than a permanently half-done image.
+ *
+ * `--all` reprocesses everything, which is what you want after changing the
+ * widths or adding a format: the media table is derived, so it can always be
+ * rebuilt from the files themselves.
+ */
+class ProcessMediaCommand extends Command
+{
+    protected $signature = 'media:process
+                            {--all : Reprocess every image, not only the pending ones}
+                            {--limit=100 : Maximum number of images to handle in one run}';
+
+    protected $description = 'Derive dimensions, responsive versions and placeholders for uploaded images';
+
+    public function handle(ImageProcessor $processor): int
+    {
+        $media = Media::query()
+            ->unless($this->option('all'), fn ($q) => $q->pending())
+            ->orderBy('id')
+            ->limit(max(1, (int) $this->option('limit')))
+            ->get();
+
+        if ($media->isEmpty()) {
+            $this->components->info('Nothing to process.');
+
+            return self::SUCCESS;
+        }
+
+        $failed = 0;
+
+        foreach ($media as $item) {
+            $processor->process($item->refresh());
+
+            if ($item->refresh()->error) {
+                $failed++;
+                $this->components->error("{$item->path} — {$item->error}");
+
+                continue;
+            }
+
+            $this->components->twoColumnDetail(
+                $item->path,
+                $item->width ? "{$item->width}×{$item->height} · ".count($item->variants ?? []).' versions' : 'no dimensions',
+            );
+        }
+
+        $this->newLine();
+        $this->components->info("Processed {$media->count()} images, {$failed} failed.");
+
+        // A failure here is usually a missing file, which is worth a non-zero
+        // exit in a deploy script.
+        return $failed > 0 ? self::FAILURE : self::SUCCESS;
+    }
+}

app/Console/Commands/PruneContentCommand.php

@@ -0,0 +1,228 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Filament\Pages\Trash;
+use App\Models\ContentView;
+use App\Models\Media;
+use App\Models\MissingUrl;
+use App\Models\Revision;
+use Illuminate\Console\Command;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Storage;
+
+/**
+ * Throws away what nothing points at any more.
+ *
+ * Five things now accumulate for ever and none of them is visible: the change
+ * history, the bin, image files whose record is gone, and the two things the
+ * frontend reports — the 404s and the daily reading figures. Individually they
+ * are rounding errors; over a couple of years they are most of the database
+ * and most of the disk, and by then nobody remembers what any of it was.
+ *
+ * The two the frontend writes are the ones that grow without anybody in the
+ * collective doing anything, which is why they are pruned as part of the
+ * routine rather than behind a flag.
+ *
+ * Deliberately conservative and deliberately explicit: nothing here runs
+ * without being asked, `--dry-run` says what would go, and the windows are
+ * generous. Deleting somebody's work by accident is much worse than a database
+ * that is larger than it needs to be.
+ */
+class PruneContentCommand extends Command
+{
+    protected $signature = 'content:prune
+                            {--history-days=365 : Keep revisions younger than this}
+                            {--trash-days=90 : Erase soft-deleted records older than this}
+                            {--missing-days=30 : Forget one-off 404s not seen for this long}
+                            {--views-days=400 : Keep daily reading figures for this long}
+                            {--media : Also delete image files nothing points at}
+                            {--dry-run : Report what would go without deleting anything}';
+
+    protected $description = 'Prune old revisions, long-deleted records, stale telemetry and orphaned image files';
+
+    protected bool $pretend = false;
+
+    public function handle(): int
+    {
+        $this->pretend = (bool) $this->option('dry-run');
+
+        if ($this->pretend) {
+            $this->components->warn(__('console.prune.dry_run'));
+        }
+
+        $this->pruneRevisions();
+        $this->pruneTrash();
+        $this->pruneMissingUrls();
+        $this->pruneViews();
+
+        // Files are the one thing here that cannot be undone by restoring a
+        // row, so they are opt-in rather than part of the routine.
+        if ($this->option('media')) {
+            $this->pruneMedia();
+        }
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * Old history, except the record's first and last entries.
+     *
+     * Keeping those two costs almost nothing and preserves the two facts
+     * anybody ever asks a history for years later: when it appeared, and who
+     * touched it last.
+     */
+    protected function pruneRevisions(): void
+    {
+        $days = max(1, (int) $this->option('history-days'));
+        $cutoff = now()->subDays($days);
+
+        $keep = Revision::query()
+            ->selectRaw('MIN(id) as id')
+            ->groupBy('revisionable_type', 'revisionable_id')
+            ->pluck('id')
+            ->merge(Revision::query()
+                ->selectRaw('MAX(id) as id')
+                ->groupBy('revisionable_type', 'revisionable_id')
+                ->pluck('id'));
+
+        $query = Revision::query()
+            ->where('created_at', '<', $cutoff)
+            ->whereNotIn('id', $keep);
+
+        $count = $query->count();
+
+        if (! $this->pretend && $count > 0) {
+            $query->delete();
+        }
+
+        $this->report(__('console.prune.revisions'), $count);
+    }
+
+    /**
+     * Records that have been in the bin long enough that nobody is coming back
+     * for them.
+     */
+    protected function pruneTrash(): void
+    {
+        $days = max(1, (int) $this->option('trash-days'));
+        $cutoff = now()->subDays($days);
+        $total = 0;
+
+        foreach (array_keys(Trash::RECOVERABLE) as $model) {
+            /** @var class-string<Model> $model */
+            $records = $model::onlyTrashed()->where('deleted_at', '<', $cutoff)->get();
+
+            $total += $records->count();
+
+            if ($this->pretend) {
+                continue;
+            }
+
+            // One at a time rather than a mass delete: the models have events
+            // — the history records the erasure, the content version moves —
+            // and a bulk query would skip every one of them.
+            $records->each(fn (Model $record) => $record->forceDelete());
+        }
+
+        $this->report(__('console.prune.trash'), $total);
+    }
+
+    /**
+     * Addresses that were asked for once and never again.
+     *
+     * The table is written by strangers, so it is the one thing here that can
+     * grow without anybody in the collective doing anything: a scanner walking
+     * random paths leaves a row per path it invents. What survives is what a
+     * person could act on — anything hit more than once, and anything already
+     * resolved or deliberately ignored, because forgetting those would bring
+     * the same decision back next week as though it had never been made.
+     */
+    protected function pruneMissingUrls(): void
+    {
+        $days = max(1, (int) $this->option('missing-days'));
+
+        $query = MissingUrl::query()
+            ->pending()
+            ->where('hits', '<', 2)
+            ->where('last_seen_at', '<', now()->subDays($days));
+
+        $count = $query->count();
+
+        if (! $this->pretend && $count > 0) {
+            $query->delete();
+        }
+
+        $this->report(__('console.prune.missing_urls'), $count);
+    }
+
+    /**
+     * Reading figures old enough that nobody compares against them.
+     *
+     * A row per record, per language, per day adds up quietly: it is the only
+     * table here that grows every day the site is up, whatever anybody does.
+     * The window is over a year on purpose — "more than last spring" is a
+     * question people ask, and answering it costs a few thousand rows.
+     */
+    protected function pruneViews(): void
+    {
+        $days = max(1, (int) $this->option('views-days'));
+
+        $query = ContentView::query()
+            ->where('day', '<', now()->subDays($days)->toDateString());
+
+        $count = $query->count();
+
+        if (! $this->pretend && $count > 0) {
+            $query->delete();
+        }
+
+        $this->report(__('console.prune.views'), $count);
+    }
+
+    /**
+     * Image files no record mentions any more.
+     *
+     * Changing a project's cover leaves the old file on disk for ever, along
+     * with every derived version of it. Nothing breaks; the disk just fills up
+     * with images nobody can reach.
+     */
+    protected function pruneMedia(): void
+    {
+        $referenced = Media::referencedPaths();
+        $freed = 0;
+        $count = 0;
+
+        foreach (Media::query()->get() as $media) {
+            if (in_array($media->path, $referenced, true)) {
+                continue;
+            }
+
+            $count++;
+            $freed += (int) $media->size;
+
+            if ($this->pretend) {
+                continue;
+            }
+
+            $media->deleteDerived();
+            Storage::disk($media->disk)->delete($media->path);
+            $media->delete();
+        }
+
+        $this->report(
+            __('console.prune.media'),
+            $count,
+            $count > 0 ? round($freed / 1024 / 1024, 1).' MB' : null,
+        );
+    }
+
+    protected function report(string $label, int $count, ?string $extra = null): void
+    {
+        $value = $count === 0 ? '<fg=gray>—</>' : "<fg=yellow>{$count}</>";
+
+        $this->components->twoColumnDetail($label, $extra ? "{$value} · {$extra}" : $value);
+    }
+}

app/Console/Commands/ScheduleContentCommand.php

@@ -0,0 +1,82 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Enums\CallStatus;
+use App\Models\Call;
+use App\Models\Page;
+use App\Models\Project;
+use Illuminate\Console\Command;
+
+/**
+ * Keeps the stored state honest about what the site is actually showing.
+ *
+ * Most of scheduling needs no command at all: the `published` scopes read the
+ * dates, so content appears and disappears on time whether or not anything is
+ * running. What a scope cannot do is change what the panel *says*, and a panel
+ * that reports "Open" for a call the site stopped offering weeks ago is how a
+ * counter stops being read.
+ *
+ * So this closes what has expired and leaves everything else alone. In
+ * particular it does not touch the status of pages or projects: their window
+ * already hides them, and rewriting a status would throw away the one somebody
+ * chose in order to record something the dates already say.
+ */
+class ScheduleContentCommand extends Command
+{
+    protected $signature = 'content:schedule
+                            {--dry-run : Report what would change without changing it}';
+
+    protected $description = 'Close calls past their date and report content entering or leaving the site';
+
+    public function handle(): int
+    {
+        $expired = Call::query()
+            ->where('status', CallStatus::Open)
+            ->whereNotNull('closes_at')
+            ->where('closes_at', '<', now())
+            ->get();
+
+        foreach ($expired as $call) {
+            $title = $call->getTranslation('title', (string) config('locales.default'), false);
+
+            $this->components->twoColumnDetail(
+                $title ?: "#{$call->id}",
+                '<fg=gray>'.__('console.schedule.closed').'</>',
+            );
+
+            if (! $this->option('dry-run')) {
+                $call->update(['status' => CallStatus::Closed]);
+            }
+        }
+
+        $this->report();
+
+        $this->components->info(
+            trans_choice('console.schedule.summary', $expired->count(), ['count' => $expired->count()])
+        );
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * What the dates are about to do on their own. Nothing here needs acting
+     * on; it is here so that a scheduled release is visible in the logs before
+     * it happens rather than only afterwards.
+     */
+    protected function report(): void
+    {
+        $pending = Page::query()->scheduled()->count() + Project::query()->scheduled()->count();
+        $expiring = Page::query()->expired()->count() + Project::query()->expired()->count();
+
+        if ($pending > 0) {
+            $this->components->twoColumnDetail(__('console.schedule.pending'), (string) $pending);
+        }
+
+        if ($expiring > 0) {
+            $this->components->twoColumnDetail(__('console.schedule.off_site'), (string) $expiring);
+        }
+    }
+}

app/Console/Commands/SiteCheckCommand.php

@@ -0,0 +1,101 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Support\Health\Finding;
+use App\Support\Health\HealthReport;
+use App\Support\Health\Severity;
+use Illuminate\Console\Command;
+use Illuminate\Support\Collection;
+
+/**
+ * The same checks as the panel page, for a deploy script.
+ *
+ * Exits non-zero when something is wrong, so a release can refuse to finish
+ * on a site that is already broken — or, with `--fail-on=error`, only on the
+ * faults that a visitor would actually hit.
+ */
+class SiteCheckCommand extends Command
+{
+    protected $signature = 'site:check
+                            {--fail-on=warning : Exit non-zero from this severity up (error|warning|never)}
+                            {--json : Machine-readable output}';
+
+    protected $description = 'Check the public site for missing translations, broken URLs, broken images and other faults';
+
+    public function handle(HealthReport $report): int
+    {
+        // Every check: a deploy is not a person, so there is nobody here to
+        // hide a result from.
+        $findings = $report->runAll();
+
+        if ($this->option('json')) {
+            $this->line((string) json_encode($findings->map(fn (Finding $f) => [
+                'key' => $f->key,
+                'severity' => $f->severity->value,
+                'count' => $f->count,
+                'samples' => $f->samples,
+            ])->all(), JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE));
+
+            return $this->exitCode($findings);
+        }
+
+        foreach ($findings as $finding) {
+            $this->components->twoColumnDetail(
+                $finding->title(),
+                $this->badge($finding),
+            );
+
+            foreach ($finding->samples as $sample) {
+                $this->line("    <fg=gray>· {$sample}</>");
+            }
+        }
+
+        $this->newLine();
+
+        $problems = $findings->filter(fn (Finding $f) => $f->severity->isProblem());
+
+        if ($problems->isEmpty()) {
+            $this->components->info(__('health.all_clear'));
+        } else {
+            $this->components->warn(
+                trans_choice('health.problem_summary', $problems->count(), ['count' => $problems->count()])
+            );
+        }
+
+        return $this->exitCode($findings);
+    }
+
+    /**
+     * @param  Collection<int, Finding>  $findings
+     */
+    protected function exitCode($findings): int
+    {
+        $threshold = match ((string) $this->option('fail-on')) {
+            'error' => Severity::Error,
+            'never' => null,
+            default => Severity::Warning,
+        };
+
+        if ($threshold === null) {
+            return self::SUCCESS;
+        }
+
+        $failing = $findings->contains(
+            fn (Finding $f) => $f->severity->weight() <= $threshold->weight() && $f->severity->isProblem()
+        );
+
+        return $failing ? self::FAILURE : self::SUCCESS;
+    }
+
+    protected function badge(Finding $finding): string
+    {
+        return match ($finding->severity) {
+            Severity::Ok => '<fg=green>ok</>',
+            Severity::Warning => "<fg=yellow>{$finding->count}</>",
+            Severity::Error => "<fg=red>{$finding->count}</>",
+        };
+    }
+}

app/Console/Commands/SiteMaintenanceCommand.php

@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Support\Maintenance;
+use Carbon\CarbonImmutable;
+use Illuminate\Console\Command;
+
+/**
+ * Toggles maintenance for the public site from the CLI, for use in deploy
+ * scripts.
+ *
+ * Note this is *not* `artisan down`: the panel and the admin API stay up
+ * throughout, which is the point.
+ */
+class SiteMaintenanceCommand extends Command
+{
+    protected $signature = 'site:maintenance
+                            {--up : Bring the public site back}
+                            {--message= : Notice shown to visitors, in the default locale}
+                            {--until= : When it lifts automatically, e.g. "+2 hours"}
+                            {--status : Only report the current state}';
+
+    protected $description = 'Put the public site into maintenance, or bring it back (the panel stays up)';
+
+    public function handle(): int
+    {
+        if ($this->option('status')) {
+            return $this->reportStatus();
+        }
+
+        if ($this->option('up')) {
+            Maintenance::disable();
+
+            $this->components->info('The public site is back.');
+
+            return self::SUCCESS;
+        }
+
+        $message = $this->option('message');
+        $until = $this->option('until');
+
+        Maintenance::enable(
+            message: filled($message) ? [config('locales.default') => $message] : null,
+            until: filled($until) ? CarbonImmutable::parse($until) : null,
+        );
+
+        $this->components->warn('The public site is now in maintenance.');
+        $this->components->bulletList(array_filter([
+            'Visitors get 503 with the notice; the panel and admin API are unaffected.',
+            filled($until) ? 'Lifts automatically at '.Maintenance::until()?->toDateTimeString() : null,
+            'The team can still see the real site via the preview token or a trusted IP.',
+        ]));
+
+        return self::SUCCESS;
+    }
+
+    protected function reportStatus(): int
+    {
+        if (! Maintenance::isEnabled()) {
+            $this->components->info('The public site is up.');
+
+            return self::SUCCESS;
+        }
+
+        $this->components->warn('The public site is in maintenance.');
+
+        $this->components->twoColumnDetail('Since', Maintenance::startedAt()?->diffForHumans() ?? '—');
+        $this->components->twoColumnDetail('Lifts at', Maintenance::until()?->toDateTimeString() ?? 'manually');
+        $this->components->twoColumnDetail('Notice', Maintenance::message());
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/SyncPermissions.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use Database\Seeders\RolePermissionSeeder;
+use Illuminate\Console\Command;
+
+class SyncPermissions extends Command
+{
+    protected $signature = 'permissions:sync';
+
+    protected $description = 'Sync roles and permissions in the database with App\\Support\\Permissions';
+
+    public function handle(): int
+    {
+        $this->call('db:seed', ['--class' => RolePermissionSeeder::class, '--force' => true]);
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/SyncRepositories.php

@@ -0,0 +1,98 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Jobs\SyncRepository;
+use App\Models\Repository;
+use App\Services\Git\GitException;
+use App\Services\Git\GitManager;
+use Illuminate\Console\Command;
+use Illuminate\Support\Collection;
+
+class SyncRepositories extends Command
+{
+    protected $signature = 'repos:sync
+                            {repository?* : Limit to these "owner/repo" names}
+                            {--force : Sync even if refreshed recently}
+                            {--sync : Run inline instead of dispatching to the queue}';
+
+    protected $description = 'Refresh repository stats and newcomer-friendly issues from their git provider';
+
+    public function handle(GitManager $git): int
+    {
+        $repositories = Repository::query()
+            ->when(
+                $names = $this->argument('repository'),
+                fn ($q) => $q->whereIn('full_name', $names),
+            )
+            ->unless(
+                $this->option('force') || $names,
+                // Skip anything refreshed recently so a manual sync is not
+                // immediately redone by the scheduled run.
+                fn ($q) => $q->where(fn ($sub) => $sub
+                    ->whereNull('last_synced_at')
+                    ->orWhere('last_synced_at', '<', now()->subMinutes((int) config('git.sync_ttl_minutes', 55)))),
+            )
+            ->get();
+
+        if ($repositories->isEmpty()) {
+            $this->components->info('Nothing to sync.');
+
+            return self::SUCCESS;
+        }
+
+        // Running inline gives immediate, readable output — useful when
+        // setting things up or debugging a failing repository.
+        if ($this->option('sync')) {
+            return $this->runInline($git, $repositories);
+        }
+
+        $repositories->each(fn (Repository $repo) => SyncRepository::dispatch($repo));
+
+        $this->components->info("Queued {$repositories->count()} repositories for syncing.");
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * @param  Collection<int, Repository>  $repositories
+     */
+    protected function runInline(GitManager $git, $repositories): int
+    {
+        $failed = 0;
+
+        foreach ($repositories as $repository) {
+            try {
+                $synced = $git->sync($repository);
+
+                $this->components->twoColumnDetail(
+                    $repository->full_name,
+                    sprintf(
+                        '<fg=green>%d★</> · %d issues · %s',
+                        $synced->stars,
+                        $synced->goodFirstIssues()->count(),
+                        $synced->pushed_at?->diffForHumans() ?? 'never pushed',
+                    ),
+                );
+            } catch (GitException $e) {
+                $failed++;
+
+                $this->components->twoColumnDetail(
+                    $repository->full_name,
+                    '<fg=red>'.$e->getMessage().'</>',
+                );
+            }
+        }
+
+        if ($failed > 0) {
+            $this->newLine();
+            $this->components->warn("{$failed} repository(ies) failed to sync.");
+
+            return self::FAILURE;
+        }
+
+        return self::SUCCESS;
+    }
+}

app/Enums/ApplicationKind.php

@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use Filament\Support\Contracts\HasColor;
+use Filament\Support\Contracts\HasLabel;
+
+/**
+ * What somebody wants when they write in.
+ *
+ * A collective like this receives two very different messages through the same
+ * form — "I have a few hours a week" and "my association needs a website" — and
+ * they go to different people. Keeping them apart costs one column and saves
+ * the inbox from being triaged by hand every time.
+ */
+enum ApplicationKind: string implements HasColor, HasLabel
+{
+    /** Offering time: an answer to a call, or a general "count me in". */
+    case Contribute = 'contribute';
+
+    /** Asking for time: an NGO or association with a project in mind. */
+    case Request = 'request';
+
+    public function getLabel(): string
+    {
+        return __("enums.application_kind.{$this->value}");
+    }
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::Contribute => 'success',
+            self::Request => 'info',
+        };
+    }
+
+    /** @return array<string, string> */
+    public static function options(): array
+    {
+        return collect(self::cases())
+            ->mapWithKeys(fn (self $case) => [$case->value => $case->getLabel()])
+            ->all();
+    }
+}

app/Enums/ApplicationStatus.php

@@ -0,0 +1,57 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use Filament\Support\Contracts\HasColor;
+use Filament\Support\Contracts\HasLabel;
+
+/**
+ * Where a submission is in the pipeline.
+ *
+ * `Spam` is a status rather than a deletion because the anti-spam checks are
+ * heuristics: a real person whose browser autofilled the honeypot lands here,
+ * and someone can rescue them. Nothing that arrives is ever thrown away
+ * silently.
+ */
+enum ApplicationStatus: string implements HasColor, HasLabel
+{
+    case New = 'new';
+    case Contacted = 'contacted';
+    case Accepted = 'accepted';
+    case Declined = 'declined';
+    case Spam = 'spam';
+
+    public function getLabel(): string
+    {
+        return __("enums.application_status.{$this->value}");
+    }
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::New => 'warning',
+            self::Contacted => 'info',
+            self::Accepted => 'success',
+            self::Declined => 'gray',
+            self::Spam => 'danger',
+        };
+    }
+
+    /**
+     * Whether reaching this status means somebody dealt with the submission.
+     */
+    public function isHandled(): bool
+    {
+        return $this !== self::New;
+    }
+
+    /** @return array<string, string> */
+    public static function options(): array
+    {
+        return collect(self::cases())
+            ->mapWithKeys(fn (self $case) => [$case->value => $case->getLabel()])
+            ->all();
+    }
+}

app/Enums/CallStatus.php

@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use Filament\Support\Contracts\HasColor;
+use Filament\Support\Contracts\HasLabel;
+
+enum CallStatus: string implements HasColor, HasLabel
+{
+    case Open = 'open';
+    case Filled = 'filled';
+    case Closed = 'closed';
+
+    public function getLabel(): string
+    {
+        return __("enums.call_status.{$this->value}");
+    }
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::Open => 'success',
+            self::Filled => 'info',
+            self::Closed => 'gray',
+        };
+    }
+
+    /** @return array<string, string> */
+    public static function options(): array
+    {
+        return collect(self::cases())
+            ->mapWithKeys(fn (self $case) => [$case->value => $case->getLabel()])
+            ->all();
+    }
+}

app/Enums/GitProvider.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use App\Services\Git\GitManager;
+use Filament\Support\Contracts\HasLabel;
+
+enum GitProvider: string implements HasLabel
+{
+    case Gitea = 'gitea';
+    case GitHub = 'github';
+    case GitLab = 'gitlab';
+
+    public function getLabel(): string
+    {
+        return match ($this) {
+            self::Gitea => 'Gitea',
+            self::GitHub => 'GitHub',
+            self::GitLab => 'GitLab',
+        };
+    }
+
+    public static function default(): self
+    {
+        return self::tryFrom((string) config('git.default')) ?? self::Gitea;
+    }
+
+    /**
+     * A provider is usable only when it has a driver registered *and* that
+     * driver has what it needs.
+     *
+     * The distinction matters for self-hosted providers: Gitea has a driver,
+     * but without GITEA_URL there is no instance to talk to, and offering it
+     * in the panel would only produce failures later.
+     */
+    public function isSupported(): bool
+    {
+        $config = config("git.providers.{$this->value}");
+
+        if (! is_array($config) || ! isset($config['driver'])) {
+            return false;
+        }
+
+        return rescue(
+            fn () => app(GitManager::class)->driver($this)->isConfigured(),
+            rescue: false,
+            report: false,
+        );
+    }
+
+    /** @return array<string, string> */
+    public static function options(): array
+    {
+        return collect(self::cases())
+            ->mapWithKeys(fn (self $case) => [$case->value => $case->getLabel()])
+            ->all();
+    }
+}

app/Enums/MissingUrlStatus.php

@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use Filament\Support\Contracts\HasColor;
+use Filament\Support\Contracts\HasLabel;
+
+/**
+ * What has been decided about an address that does not resolve.
+ *
+ * `Ignored` exists so the list stays readable. Most of what a public site is
+ * asked for is a bot looking for somebody else's admin panel, and a list where
+ * the real broken links are buried under that noise is a list nobody opens.
+ * Ignoring keeps counting — it hides a row, it does not stop the record.
+ */
+enum MissingUrlStatus: string implements HasColor, HasLabel
+{
+    case Pending = 'pending';
+    case Resolved = 'resolved';
+    case Ignored = 'ignored';
+
+    public function getLabel(): string
+    {
+        return __("enums.missing_url_status.{$this->value}");
+    }
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::Pending => 'warning',
+            self::Resolved => 'success',
+            self::Ignored => 'gray',
+        };
+    }
+
+    /** @return array<string, string> */
+    public static function options(): array
+    {
+        return collect(self::cases())
+            ->mapWithKeys(fn (self $case) => [$case->value => $case->getLabel()])
+            ->all();
+    }
+}

app/Enums/PageStatus.php

@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use Filament\Support\Contracts\HasColor;
+use Filament\Support\Contracts\HasIcon;
+use Filament\Support\Contracts\HasLabel;
+
+enum PageStatus: string implements HasColor, HasIcon, HasLabel
+{
+    case Draft = 'draft';
+    case Review = 'review';
+    case Published = 'published';
+    case Archived = 'archived';
+
+    public function getLabel(): string
+    {
+        return __("enums.page_status.{$this->value}");
+    }
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::Draft => 'gray',
+            self::Review => 'warning',
+            self::Published => 'success',
+            self::Archived => 'danger',
+        };
+    }
+
+    public function getIcon(): string
+    {
+        return match ($this) {
+            self::Draft => 'heroicon-o-pencil-square',
+            self::Review => 'heroicon-o-eye',
+            self::Published => 'heroicon-o-check-circle',
+            self::Archived => 'heroicon-o-archive-box',
+        };
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    public static function options(): array
+    {
+        return collect(self::cases())
+            ->mapWithKeys(fn (self $case) => [$case->value => $case->getLabel()])
+            ->all();
+    }
+}

app/Enums/ProjectStatus.php

@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use Filament\Support\Contracts\HasColor;
+use Filament\Support\Contracts\HasIcon;
+use Filament\Support\Contracts\HasLabel;
+
+enum ProjectStatus: string implements HasColor, HasIcon, HasLabel
+{
+    case Idea = 'idea';
+    case Active = 'active';
+    case Paused = 'paused';
+    case Completed = 'completed';
+    case Archived = 'archived';
+
+    public function getLabel(): string
+    {
+        return __("enums.project_status.{$this->value}");
+    }
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::Idea => 'gray',
+            self::Active => 'success',
+            self::Paused => 'warning',
+            self::Completed => 'info',
+            self::Archived => 'danger',
+        };
+    }
+
+    public function getIcon(): string
+    {
+        return match ($this) {
+            self::Idea => 'heroicon-o-light-bulb',
+            self::Active => 'heroicon-o-bolt',
+            self::Paused => 'heroicon-o-pause-circle',
+            self::Completed => 'heroicon-o-check-badge',
+            self::Archived => 'heroicon-o-archive-box',
+        };
+    }
+
+    /** @return array<string, string> */
+    public static function options(): array
+    {
+        return collect(self::cases())
+            ->mapWithKeys(fn (self $case) => [$case->value => $case->getLabel()])
+            ->all();
+    }
+}

app/Enums/RadarRing.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use Filament\Support\Contracts\HasColor;
+use Filament\Support\Contracts\HasLabel;
+
+/**
+ * Tech radar placement, following the ThoughtWorks rings.
+ */
+enum RadarRing: string implements HasColor, HasLabel
+{
+    case Adopt = 'adopt';
+    case Trial = 'trial';
+    case Assess = 'assess';
+    case Hold = 'hold';
+
+    public function getLabel(): string
+    {
+        return __("enums.radar_ring.{$this->value}");
+    }
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::Adopt => 'success',
+            self::Trial => 'info',
+            self::Assess => 'warning',
+            self::Hold => 'danger',
+        };
+    }
+
+    /** @return array<string, string> */
+    public static function options(): array
+    {
+        return collect(self::cases())
+            ->mapWithKeys(fn (self $case) => [$case->value => $case->getLabel()])
+            ->all();
+    }
+}

app/Enums/ReviewEvent.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use Filament\Support\Contracts\HasColor;
+use Filament\Support\Contracts\HasIcon;
+use Filament\Support\Contracts\HasLabel;
+
+/**
+ * What happened in a review, as the record's own thread tells it.
+ *
+ * Deliberately not a status field. The state of a review is one question —
+ * waiting or not — and it is answered by `review_requested_at`; these are the
+ * events that got it there, kept so the conversation reads as a conversation
+ * rather than as a column that changed value.
+ */
+enum ReviewEvent: string implements HasColor, HasIcon, HasLabel
+{
+    case Requested = 'requested';
+    case Returned = 'returned';
+    case Published = 'published';
+    case Commented = 'commented';
+
+    public function getLabel(): string
+    {
+        return __("enums.review_event.{$this->value}");
+    }
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::Requested => 'warning',
+            self::Returned => 'danger',
+            self::Published => 'success',
+            self::Commented => 'gray',
+        };
+    }
+
+    public function getIcon(): string
+    {
+        return match ($this) {
+            self::Requested => 'heroicon-o-hand-raised',
+            self::Returned => 'heroicon-o-arrow-uturn-left',
+            self::Published => 'heroicon-o-check-circle',
+            self::Commented => 'heroicon-o-chat-bubble-left-ellipsis',
+        };
+    }
+
+    /** @return array<string, string> */
+    public static function options(): array
+    {
+        return collect(self::cases())
+            ->mapWithKeys(fn (self $case) => [$case->value => $case->getLabel()])
+            ->all();
+    }
+}

app/Enums/TechnologyCategory.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+use Filament\Support\Contracts\HasLabel;
+
+enum TechnologyCategory: string implements HasLabel
+{
+    case Language = 'language';
+    case Framework = 'framework';
+    case Datastore = 'datastore';
+    case Infrastructure = 'infrastructure';
+    case Tool = 'tool';
+    case Practice = 'practice';
+
+    public function getLabel(): string
+    {
+        return __("enums.technology_category.{$this->value}");
+    }
+
+    /** @return array<string, string> */
+    public static function options(): array
+    {
+        return collect(self::cases())
+            ->mapWithKeys(fn (self $case) => [$case->value => $case->getLabel()])
+            ->all();
+    }
+}

app/Filament/Concerns/WarnsOfConcurrentEditing.php

@@ -0,0 +1,154 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Concerns;
+
+use App\Support\Presence;
+use Filament\Notifications\Notification;
+use Filament\Support\Exceptions\Halt;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+use Livewire\Attributes\Locked;
+
+/**
+ * Two people can open the same record's edit screen at once, and nothing in
+ * Filament's own EditRecord page says so. This is the two things that fact
+ * calls for.
+ *
+ * The soft warning: whoever opens the screen second is told, right away, who
+ * else already has it open. Only ever shown to the person arriving later —
+ * the first person has no reason to expect company, and there is nothing this
+ * screen could tell them that would help.
+ *
+ * The hard guard: whoever *saves* second is refused, if the record changed
+ * underneath them since their screen was opened. This is the one that
+ * actually prevents losing work, and it does not depend on the warning above
+ * having been seen or even shown — a closed tab, a second monitor, a
+ * teammate ten minutes ago all end up caught the same way, because it checks
+ * the database at the moment of saving rather than trusting what the warning
+ * said earlier.
+ *
+ * Applied to every Edit page rather than picked per resource: a collision is
+ * a property of two people and one record, not of what the record happens to
+ * be.
+ */
+trait WarnsOfConcurrentEditing
+{
+    /**
+     * `updated_at` as read straight from the database when this screen was
+     * opened — not through the model, so a cast or a mutator cannot make two
+     * identical instants compare unequal.
+     *
+     * Public and Locked, both on purpose and for different reasons. Public
+     * because Livewire only carries public properties across requests — a
+     * protected one resets to null on every hydration, which silently
+     * disables the whole guard. Locked because a plain public property can be
+     * overwritten by whatever a request claims it should be; the one thing
+     * this value must never be is something the browser gets to supply.
+     */
+    #[Locked]
+    public ?string $loadedUpdatedAt = null;
+
+    public function mount(int|string $record): void
+    {
+        parent::mount($record);
+
+        $this->loadedUpdatedAt = $this->currentUpdatedAt();
+
+        $this->warnOfOtherEditors();
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     */
+    protected function handleRecordUpdate(Model $record, array $data): Model
+    {
+        $current = $this->currentUpdatedAt();
+
+        if ($this->loadedUpdatedAt !== null && $current !== null && $current !== $this->loadedUpdatedAt) {
+            $this->warnOfConflict();
+
+            throw (new Halt)->rollBackDatabaseTransaction();
+        }
+
+        $record = parent::handleRecordUpdate($record, $data);
+
+        // What was just written is the new baseline: saving again without
+        // reloading is judged against what this screen itself just wrote,
+        // not against the moment it was first opened.
+        $this->loadedUpdatedAt = $this->currentUpdatedAt();
+
+        return $record;
+    }
+
+    protected function warnOfOtherEditors(): void
+    {
+        $user = Auth::user();
+
+        if ($user === null) {
+            return;
+        }
+
+        $others = Presence::touch($this->getRecord(), $user);
+
+        if ($others->isEmpty()) {
+            return;
+        }
+
+        Notification::make()
+            ->warning()
+            ->title(__('panel.presence.title'))
+            ->body(__('panel.presence.body', ['names' => $others->pluck('name')->implode(', ')]))
+            ->persistent()
+            ->send();
+    }
+
+    protected function warnOfConflict(): void
+    {
+        Notification::make()
+            ->danger()
+            ->title(__('panel.concurrency.title'))
+            ->body($this->conflictMessage())
+            ->persistent()
+            ->send();
+    }
+
+    /**
+     * Named when the history knows who — which is most of the time, since
+     * every content model records who changed what. Without a name the
+     * message still says everything that matters: it changed, and saving now
+     * would have erased that.
+     */
+    protected function conflictMessage(): string
+    {
+        $record = $this->getRecord();
+
+        $author = method_exists($record, 'revisions')
+            ? $record->revisions()->value('user_name')
+            : null;
+
+        return $author !== null
+            ? __('panel.concurrency.body_with_author', ['name' => $author])
+            : __('panel.concurrency.body');
+    }
+
+    /**
+     * Read straight from the table: one column, no relations, no casts to
+     * disagree about, and no risk of a stale in-memory copy answering for the
+     * database.
+     *
+     * Precision is whole seconds, which is what `timestamps()` stores here —
+     * two saves inside the same second are a genuine race even in
+     * production, and this guard is honest about not catching that one.
+     */
+    protected function currentUpdatedAt(): ?string
+    {
+        $record = $this->getRecord();
+
+        return DB::table($record->getTable())
+            ->where($record->getKeyName(), $record->getKey())
+            ->value('updated_at');
+    }
+}

app/Filament/Pages/Auth/PireonLogin.php

@@ -0,0 +1,178 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Pages\Auth;
+
+use App\Actions\Auth\SyncPireonUser;
+use App\Services\Pireon\AccessToken;
+use App\Services\Pireon\PireonClient;
+use App\Services\Pireon\PireonException;
+use App\Services\Pireon\TokenStore;
+use DanHarrin\LivewireRateLimiting\Exceptions\TooManyRequestsException;
+use Filament\Auth\Http\Responses\Contracts\LoginResponse;
+use Filament\Auth\Pages\Login;
+use Filament\Facades\Filament;
+use Illuminate\Contracts\Support\Htmlable;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Validation\ValidationException;
+use SensitiveParameter;
+
+/**
+ * The panel's login screen: an ordinary e-mail and password form.
+ *
+ * The identity server is still the only thing that decides whether those
+ * credentials are correct — there are no local passwords, and `users` has no
+ * usable password column — but the person signing in never sees that. They
+ * type their credentials here and land in the panel.
+ *
+ * The cost of that convenience is stated plainly because it is real: this
+ * application now handles the password rather than never seeing it. It is sent
+ * straight to the identity server over the password grant and is never stored,
+ * logged, or written anywhere; but a compromise here would expose credentials
+ * to the identity server, which the redirect flow made impossible. The
+ * Authorization Code + PKCE routes are still in place
+ * ([`PireonAuthController`](app/Http/Controllers/Auth/PireonAuthController.php))
+ * for anyone who wants that trade back.
+ */
+class PireonLogin extends Login
+{
+    public function getTitle(): string|Htmlable
+    {
+        return __('pireon.sign_in');
+    }
+
+    public function getHeading(): string|Htmlable
+    {
+        return __('pireon.sign_in');
+    }
+
+    public function getSubheading(): string|Htmlable|null
+    {
+        return __('pireon.sign_in_intro');
+    }
+
+    /**
+     * Filament's own flow checks the credentials against the local user table.
+     * There are no local passwords here, so the whole of it is replaced: the
+     * identity server is asked instead, and only what it says is trusted.
+     */
+    public function authenticate(): ?LoginResponse
+    {
+        try {
+            // Filament's own limiter, keyed by IP: five attempts, then a wait.
+            // The identity server has its own; this stops us spending it.
+            $this->rateLimit(5);
+        } catch (TooManyRequestsException $exception) {
+            $this->getRateLimitedNotification($exception)?->send();
+
+            return null;
+        }
+
+        $data = $this->form->getState();
+
+        $this->assertUsable();
+
+        $token = $this->exchange((string) $data['email'], (string) $data['password']);
+
+        $client = app(PireonClient::class);
+
+        try {
+            $identity = $client->identity($token->accessToken);
+        } catch (PireonException $e) {
+            $this->fail($e);
+        }
+
+        // Said only once the credentials were right, so this cannot be used to
+        // find out which addresses have an account.
+        if (! $identity->isUsable()) {
+            throw ValidationException::withMessages([
+                'data.email' => $identity->isApproved()
+                    ? __('pireon.inactive')
+                    : __('pireon.pending_approval'),
+            ]);
+        }
+
+        $user = app(SyncPireonUser::class)->handle($identity);
+
+        // Being a valid account upstream is not the same as being allowed in
+        // here: roles are this application's business.
+        if (! $user->canAccessPanel(Filament::getCurrentOrDefaultPanel())) {
+            throw ValidationException::withMessages([
+                'data.email' => __('pireon.no_permission'),
+            ]);
+        }
+
+        // Rotate the session id so a fixated pre-login session cannot be
+        // reused now that it carries an authenticated identity.
+        session()->regenerate();
+
+        Auth::login($user, (bool) ($data['remember'] ?? false));
+
+        app(TokenStore::class)->put($token);
+
+        if ($user->locale) {
+            session()->put(config('locales.session_key'), $user->locale);
+        }
+
+        return app(LoginResponse::class);
+    }
+
+    /**
+     * Trade the credentials for a token upstream.
+     *
+     * Any refusal answers with the same message. The identity server
+     * distinguishes an unknown address from a wrong password; repeating that
+     * here would turn the form into a way of finding out who has an account.
+     */
+    protected function exchange(string $email, #[SensitiveParameter] string $password): AccessToken
+    {
+        try {
+            return app(PireonClient::class)->requestPasswordToken($email, $password);
+        } catch (PireonException $e) {
+            $this->fail($e);
+        }
+    }
+
+    /**
+     * A misconfiguration is an operator's problem, not a visitor's, so it says
+     * what is actually wrong instead of "those credentials are incorrect".
+     */
+    protected function assertUsable(): void
+    {
+        if (! app(PireonClient::class)->isConfigured()) {
+            throw ValidationException::withMessages([
+                'data.email' => __('pireon.not_configured_body', ['server' => (string) config('pireon.server')]),
+            ]);
+        }
+
+        if (! config('pireon.password_grant_enabled')) {
+            throw ValidationException::withMessages([
+                'data.email' => __('pireon.password_grant_disabled'),
+            ]);
+        }
+    }
+
+    protected function fail(PireonException $e): never
+    {
+        // The address is logged, the password never is — it does not leave the
+        // request it arrived in.
+        Log::warning('Pireon sign-in failed', [
+            'message' => $e->getMessage(),
+            'status' => $e->status,
+        ]);
+
+        // Only say "those credentials are wrong" when that is what happened.
+        // A server that answered 500, or did not answer at all, has said
+        // nothing about the password, and reporting otherwise sends whoever is
+        // signing in to look for a problem that is not theirs.
+        if (! $e->isRejection()) {
+            throw ValidationException::withMessages([
+                'data.email' => __('pireon.server_unavailable'),
+            ]);
+        }
+
+        $this->throwFailureValidationException();
+    }
+}

app/Filament/Pages/SiteHealth.php

@@ -0,0 +1,147 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Pages;
+
+use App\Support\Health\Finding;
+use App\Support\Health\HealthReport;
+use App\Support\Health\Severity;
+use BackedEnum;
+use Filament\Actions\Action;
+use Filament\Notifications\Notification;
+use Filament\Pages\Page;
+use Filament\Support\Icons\Heroicon;
+use Illuminate\Contracts\Support\Htmlable;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Auth;
+use UnitEnum;
+
+/**
+ * Everything wrong with the public site, in one place.
+ *
+ * This page exists because the site is somewhere else. A missing translation,
+ * two records answering at the same URL, an image whose file is gone: none of
+ * it is visible where the content is edited. It shows up on the frontend,
+ * usually late, and usually to a visitor rather than to us.
+ */
+class SiteHealth extends Page
+{
+    protected string $view = 'filament.pages.site-health';
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedShieldCheck;
+
+    protected static ?int $navigationSort = 88;
+
+    /**
+     * Not a public Livewire property: a Finding is a plain object, and
+     * Livewire can only carry types it knows how to serialise. It is
+     * recomputed per render instead, which is what opening this page is for.
+     *
+     * @var Collection<int, Finding>|null
+     */
+    protected ?Collection $findings = null;
+
+    public static function canAccess(): bool
+    {
+        // Anyone who edits content benefits from seeing what is wrong with it.
+        // Individual checks hide themselves behind their own permission.
+        return Auth::user()?->can('panel.access') ?? false;
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return __('health.title');
+    }
+
+    public function getTitle(): string|Htmlable
+    {
+        return __('health.title');
+    }
+
+    public function getSubheading(): string|Htmlable|null
+    {
+        return __('health.subheading');
+    }
+
+    /**
+     * @return Collection<int, Finding>
+     */
+    public function findings(): Collection
+    {
+        return $this->findings ??= app(HealthReport::class)->runFor(Auth::user());
+    }
+
+    /**
+     * @return array<int, Action>
+     */
+    protected function getHeaderActions(): array
+    {
+        return [
+            Action::make('refresh')
+                ->label(__('health.actions.refresh'))
+                ->icon('heroicon-o-arrow-path')
+                ->color('gray')
+                ->action(function (): void {
+                    $this->refreshFindings();
+
+                    Notification::make()
+                        ->title(__('health.refreshed'))
+                        ->success()
+                        ->send();
+                }),
+        ];
+    }
+
+    public function refreshFindings(): void
+    {
+        // The badge is cached so that drawing it does not run ten checks on
+        // every page of the panel; opening this page is the one moment we
+        // definitely want fresh answers.
+        app(HealthReport::class)->forget(Auth::user());
+
+        $this->findings = null;
+    }
+
+    /**
+     * @return Collection<int, Finding>
+     */
+    public function problems(): Collection
+    {
+        return $this->findings()->filter(fn (Finding $f) => $f->severity->isProblem());
+    }
+
+    /**
+     * @return Collection<int, Finding>
+     */
+    public function passing(): Collection
+    {
+        return $this->findings()->reject(fn (Finding $f) => $f->severity->isProblem());
+    }
+
+    public function hasErrors(): bool
+    {
+        return $this->problems()->contains(fn (Finding $f) => $f->severity === Severity::Error);
+    }
+
+    /**
+     * A count in the sidebar, because a diagnostics page nobody opens
+     * diagnoses nothing.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        $problems = app(HealthReport::class)->problemCount(Auth::user());
+
+        return $problems > 0 ? (string) $problems : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'warning';
+    }
+}

app/Filament/Pages/SiteMaintenance.php

@@ -0,0 +1,216 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Pages;
+
+use App\Models\Setting;
+use App\Support\Maintenance;
+use BackedEnum;
+use Carbon\CarbonImmutable;
+use Filament\Actions\Action;
+use Filament\Forms\Components\DateTimePicker;
+use Filament\Forms\Components\Textarea;
+use Filament\Notifications\Notification;
+use Filament\Pages\Page;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Components\Tabs;
+use Filament\Schemas\Components\Tabs\Tab;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Illuminate\Contracts\Support\Htmlable;
+use Illuminate\Support\Facades\Auth;
+use UnitEnum;
+
+/**
+ * Puts the **public site** into maintenance, without touching the panel.
+ *
+ * The distinction is the whole feature: `artisan down` would lock out the
+ * collective as well, exactly when they need to be fixing whatever went wrong.
+ * Here the team keeps editing, repositories keep syncing, and only visitors of
+ * the public site see the notice.
+ */
+class SiteMaintenance extends Page
+{
+    protected string $view = 'filament.pages.site-maintenance';
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedWrenchScrewdriver;
+
+    protected static ?int $navigationSort = 90;
+
+    /**
+     * @var array<string, mixed>|null
+     */
+    public ?array $data = [];
+
+    public static function canAccess(): bool
+    {
+        return Auth::user()?->can('settings.view') ?? false;
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return __('maintenance.title');
+    }
+
+    public function getTitle(): string|Htmlable
+    {
+        return __('maintenance.title');
+    }
+
+    public function getSubheading(): string|Htmlable|null
+    {
+        return __('maintenance.subheading');
+    }
+
+    /**
+     * A red badge in the sidebar while the site is down — this is not
+     * something anyone should be able to forget about.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        return Maintenance::isEnabled() ? __('maintenance.badge') : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'danger';
+    }
+
+    public function mount(): void
+    {
+        $this->form->fill([
+            'message' => Maintenance::messages(),
+            'until' => Maintenance::until()?->toDateTimeString(),
+        ]);
+    }
+
+    public function form(Schema $schema): Schema
+    {
+        return $schema
+            ->statePath('data')
+            ->components([
+                Section::make(__('maintenance.notice'))
+                    ->description(__('maintenance.notice_hint'))
+                    ->schema([
+                        Tabs::make('message')
+                            ->tabs(collect(config('locales.supported'))
+                                ->map(fn (array $meta, string $locale) => Tab::make($locale)
+                                    ->label(trim(($meta['flag'] ?? '').' '.($meta['native'] ?? $locale)))
+                                    ->schema([
+                                        Textarea::make("message.{$locale}")
+                                            ->hiddenLabel()
+                                            ->rows(3)
+                                            ->placeholder(__('maintenance.default_message', [], $locale))
+                                            ->maxLength(500),
+                                    ]))
+                                ->values()
+                                ->all())
+                            ->columnSpanFull(),
+
+                        DateTimePicker::make('until')
+                            ->label(__('maintenance.until'))
+                            ->helperText(__('maintenance.until_hint'))
+                            ->seconds(false)
+                            ->minDate(now()),
+                    ]),
+            ]);
+    }
+
+    /**
+     * @return array<int, Action>
+     */
+    protected function getHeaderActions(): array
+    {
+        return [
+            Action::make('enable')
+                ->label(__('maintenance.enable'))
+                ->icon('heroicon-o-exclamation-triangle')
+                ->color('danger')
+                ->requiresConfirmation()
+                ->modalDescription(__('maintenance.enable_confirm'))
+                ->visible(fn () => ! Maintenance::isEnabled() && $this->canToggle())
+                ->action(function (): void {
+                    $data = $this->form->getState();
+
+                    Maintenance::enable(
+                        message: array_filter($data['message'] ?? [], fn ($v) => filled($v)),
+                        until: filled($data['until'] ?? null) ? CarbonImmutable::parse($data['until']) : null,
+                    );
+
+                    Notification::make()
+                        ->warning()
+                        ->title(__('maintenance.enabled_notice'))
+                        ->send();
+                }),
+
+            Action::make('disable')
+                ->label(__('maintenance.disable'))
+                ->icon('heroicon-o-check-circle')
+                ->color('success')
+                ->requiresConfirmation()
+                ->visible(fn () => Maintenance::isEnabled() && $this->canToggle())
+                ->action(function (): void {
+                    Maintenance::disable();
+
+                    Notification::make()
+                        ->success()
+                        ->title(__('maintenance.disabled_notice'))
+                        ->send();
+                }),
+
+            Action::make('save')
+                ->label(__('maintenance.save_message'))
+                ->color('gray')
+                ->visible(fn () => $this->canToggle())
+                ->action(function (): void {
+                    $data = $this->form->getState();
+                    $messages = array_filter($data['message'] ?? [], fn ($v) => filled($v));
+
+                    // Saving the wording must not itself take the site down.
+                    if (Maintenance::isEnabled()) {
+                        Maintenance::enable(
+                            message: $messages,
+                            until: filled($data['until'] ?? null) ? CarbonImmutable::parse($data['until']) : null,
+                        );
+                    } else {
+                        Setting::set(Maintenance::KEY, [
+                            ...Maintenance::state(),
+                            'enabled' => false,
+                            'message' => $messages,
+                        ]);
+                    }
+
+                    Notification::make()
+                        ->success()
+                        ->title(__('maintenance.message_saved'))
+                        ->send();
+                }),
+        ];
+    }
+
+    public function isEnabled(): bool
+    {
+        return Maintenance::isEnabled();
+    }
+
+    public function startedAt(): ?string
+    {
+        return Maintenance::startedAt()?->diffForHumans();
+    }
+
+    public function endsAt(): ?string
+    {
+        return Maintenance::until()?->isoFormat('LLL');
+    }
+
+    public function canToggle(): bool
+    {
+        return Auth::user()?->can('settings.maintenance') ?? false;
+    }
+}

app/Filament/Pages/Trash.php

@@ -0,0 +1,183 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Pages;
+
+use App\Models\Application;
+use App\Models\Category;
+use App\Models\Client;
+use App\Models\Member;
+use App\Models\Page;
+use App\Models\Project;
+use App\Models\Service;
+use App\Models\Testimonial;
+use BackedEnum;
+use Filament\Notifications\Notification;
+use Filament\Pages\Page as FilamentPage;
+use Filament\Support\Icons\Heroicon;
+use Illuminate\Contracts\Support\Htmlable;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Auth;
+use UnitEnum;
+
+/**
+ * Everything deleted, in one place.
+ *
+ * Soft deletes are everywhere, but recovering something meant remembering
+ * which resource it had been in and then turning on a filter — which is a lot
+ * to ask of somebody who has just deleted the wrong thing and is looking for
+ * the undo button.
+ */
+class Trash extends FilamentPage
+{
+    protected string $view = 'filament.pages.trash';
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedTrash;
+
+    protected static ?int $navigationSort = 87;
+
+    /**
+     * Every model that can be recovered, and the permission that governs it.
+     *
+     * @var array<class-string<Model>, string>
+     */
+    public const RECOVERABLE = [
+        Page::class => 'pages',
+        Project::class => 'projects',
+        Service::class => 'services',
+        Member::class => 'members',
+        Client::class => 'clients',
+        Testimonial::class => 'testimonials',
+        Category::class => 'categories',
+
+        // The inbox soft-deletes too, and it is gated by its own permission
+        // below — a viewer never sees a stranger's message here either.
+        Application::class => 'applications',
+    ];
+
+    public static function canAccess(): bool
+    {
+        return Auth::user()?->can('panel.access') ?? false;
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return __('panel.trash.title');
+    }
+
+    public function getTitle(): string|Htmlable
+    {
+        return __('panel.trash.title');
+    }
+
+    public function getSubheading(): string|Htmlable|null
+    {
+        return __('panel.trash.subheading');
+    }
+
+    /**
+     * What is in the bin, grouped by what it is — and only the kinds this user
+     * is allowed to see in the first place.
+     *
+     * @return Collection<string, array{label: string, records: Collection<int, Model>}>
+     */
+    public function groups(): Collection
+    {
+        $user = Auth::user();
+
+        return collect(self::RECOVERABLE)
+            ->filter(fn (string $resource) => $user?->can("{$resource}.view_any") ?? false)
+            ->map(fn (string $resource, string $model) => [
+                'model' => $model,
+                'label' => __("panel.{$resource}.plural"),
+                'records' => $model::onlyTrashed()->latest('deleted_at')->limit(25)->get(),
+            ])
+            ->filter(fn (array $group) => $group['records']->isNotEmpty());
+    }
+
+    public function total(): int
+    {
+        return $this->groups()->sum(fn (array $group) => $group['records']->count());
+    }
+
+    /**
+     * Put one thing back.
+     */
+    public function restoreRecord(string $model, int|string $id): void
+    {
+        $record = $this->find($model, $id);
+
+        if (! $record || ! Auth::user()?->can('restore', $record)) {
+            return;
+        }
+
+        $record->restore();
+
+        Notification::make()
+            ->title(__('panel.trash.restored'))
+            ->success()
+            ->send();
+    }
+
+    /**
+     * Erase one thing for good.
+     */
+    public function eraseRecord(string $model, int|string $id): void
+    {
+        $record = $this->find($model, $id);
+
+        if (! $record || ! Auth::user()?->can('forceDelete', $record)) {
+            return;
+        }
+
+        $record->forceDelete();
+
+        Notification::make()
+            ->title(__('panel.trash.erased'))
+            ->warning()
+            ->send();
+    }
+
+    /**
+     * How a record is described here, whatever kind it is.
+     */
+    public function labelFor(Model $record): string
+    {
+        foreach (['name', 'title', 'author_name', 'full_name'] as $attribute) {
+            $value = $record->getAttribute($attribute);
+
+            if (blank($value)) {
+                continue;
+            }
+
+            return is_array($value)
+                ? (string) ($value[config('locales.default')] ?? reset($value))
+                : (string) $value;
+        }
+
+        return '#'.$record->getKey();
+    }
+
+    protected function find(string $model, int|string $id): ?Model
+    {
+        // Only the models this page declares: an id and a class name arriving
+        // from the browser must not be able to reach anything else.
+        if (! array_key_exists($model, self::RECOVERABLE)) {
+            return null;
+        }
+
+        return $model::onlyTrashed()->find($id);
+    }
+
+    public static function getNavigationBadge(): ?string
+    {
+        return null;
+    }
+}

app/Filament/RelationManagers/ReviewsRelationManager.php

@@ -0,0 +1,98 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\RelationManagers;
+
+use App\Filament\Support\ReviewActions;
+use App\Models\ReviewComment;
+use Filament\Actions\Action;
+use Filament\Forms\Components\Textarea;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * The conversation about one record, on the record.
+ *
+ * Sits beside the change history and answers a different question. A revision
+ * knows the title used to say something else; it cannot know that this went
+ * back because the photo is missing, because that sentence was never a field
+ * on the form. Kept together with the two review buttons so the reason and the
+ * decision are written in the same place, rather than the decision here and
+ * the reason in somebody's chat window.
+ */
+class ReviewsRelationManager extends RelationManager
+{
+    protected static string $relationship = 'reviewComments';
+
+    public static function getTitle(Model $ownerRecord, string $pageClass): string
+    {
+        return __('panel.reviews.title');
+    }
+
+    /**
+     * The badge says "waiting", not "how many": a count of comments is
+     * trivia, and whether somebody is waiting for an answer is not.
+     */
+    public static function getBadge(Model $ownerRecord, string $pageClass): ?string
+    {
+        return $ownerRecord->isAwaitingReview() ? '!' : null;
+    }
+
+    public static function getBadgeColor(Model $ownerRecord, string $pageClass): ?string
+    {
+        return 'warning';
+    }
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('id', 'desc')
+            ->modifyQueryUsing(fn ($query) => $query->with('user'))
+            ->columns([
+                TextColumn::make('event')
+                    ->label(__('panel.reviews.fields.event'))
+                    ->badge(),
+
+                TextColumn::make('user_name')
+                    ->label(__('panel.reviews.fields.who'))
+                    ->state(fn (ReviewComment $record) => $record->author()),
+
+                TextColumn::make('body')
+                    ->label(__('panel.reviews.fields.note'))
+                    ->wrap()
+                    ->placeholder('—'),
+
+                TextColumn::make('created_at')
+                    ->label(__('panel.reviews.fields.when'))
+                    ->since()
+                    ->dateTimeTooltip()
+                    ->sortable(),
+            ])
+            ->headerActions([
+                ReviewActions::request(),
+                ReviewActions::returnForChanges(),
+
+                // Plain comments, for the half of a review that is neither a
+                // rejection nor an approval: a question, or an answer to one.
+                Action::make('comment')
+                    ->label(__('panel.reviews.actions.comment'))
+                    ->icon('heroicon-o-chat-bubble-left-ellipsis')
+                    ->color('gray')
+                    ->visible(fn () => $this->getOwnerRecord()->exists)
+                    ->schema([
+                        Textarea::make('body')
+                            ->label(__('panel.reviews.fields.note'))
+                            ->rows(3)
+                            ->required()
+                            ->maxLength(2000),
+                    ])
+                    ->action(fn (array $data) => $this->getOwnerRecord()->comment($data['body'])),
+            ])
+            ->emptyStateHeading(__('panel.reviews.empty.heading'))
+            ->emptyStateDescription(__('panel.reviews.empty.description'))
+            ->emptyStateIcon('heroicon-o-chat-bubble-left-right');
+    }
+}

app/Filament/RelationManagers/RevisionsRelationManager.php

@@ -0,0 +1,127 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\RelationManagers;
+
+use App\Models\Revision;
+use Filament\Actions\Action;
+use Filament\Notifications\Notification;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+
+/**
+ * Who changed what, on the record it happened to.
+ *
+ * One class for every resource: the history of a page and the history of a
+ * testimonial differ only in what is in them.
+ */
+class RevisionsRelationManager extends RelationManager
+{
+    protected static string $relationship = 'revisions';
+
+    public static function getTitle(Model $ownerRecord, string $pageClass): string
+    {
+        return __('panel.revisions.title');
+    }
+
+    public static function getBadge(Model $ownerRecord, string $pageClass): ?string
+    {
+        $count = $ownerRecord->revisions()->count();
+
+        return $count > 0 ? (string) $count : null;
+    }
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('id', 'desc')
+            ->modifyQueryUsing(fn ($query) => $query->with('user'))
+            ->columns([
+                TextColumn::make('event')
+                    ->label(__('panel.revisions.fields.event'))
+                    ->badge()
+                    ->formatStateUsing(fn (string $state) => __("panel.revisions.events.{$state}"))
+                    // Publishing is a separate permission because it is a
+                    // bigger act than editing; it reads differently here too.
+                    ->color(fn (string $state) => match ($state) {
+                        'published' => 'success',
+                        'unpublished' => 'warning',
+                        'created' => 'info',
+                        'deleted', 'erased' => 'danger',
+                        default => 'gray',
+                    }),
+
+                TextColumn::make('user_name')
+                    ->label(__('panel.revisions.fields.author'))
+                    ->state(fn (Revision $record) => $record->author()),
+
+                TextColumn::make('changeset')
+                    ->label(__('panel.revisions.fields.fields'))
+                    ->state(fn (Revision $record) => $record->fields())
+                    ->badge()
+                    ->color('gray')
+                    ->limitList(4)
+                    ->placeholder('—'),
+
+                TextColumn::make('created_at')
+                    ->label(__('panel.revisions.fields.when'))
+                    ->since()
+                    ->dateTimeTooltip()
+                    ->sortable(),
+            ])
+            ->filters([
+                SelectFilter::make('event')
+                    ->label(__('panel.revisions.fields.event'))
+                    ->options(fn () => collect(['created', 'updated', 'published', 'unpublished', 'deleted', 'restored', 'erased'])
+                        ->mapWithKeys(fn (string $e) => [$e => __("panel.revisions.events.{$e}")])
+                        ->all()),
+            ])
+            ->recordActions([
+                Action::make('diff')
+                    ->label(__('panel.revisions.actions.diff'))
+                    ->icon('heroicon-o-eye')
+                    ->modalHeading(fn (Revision $record) => __('panel.revisions.diff_heading', [
+                        'author' => $record->author(),
+                        'when' => $record->created_at?->isoFormat('LLL'),
+                    ]))
+                    ->modalSubmitAction(false)
+                    ->modalContent(fn (Revision $record) => view('filament.revisions.diff', [
+                        'revision' => $record,
+                    ])),
+
+                Action::make('restore')
+                    ->label(__('panel.revisions.actions.restore'))
+                    ->icon('heroicon-o-arrow-uturn-left')
+                    ->color('warning')
+                    ->requiresConfirmation()
+                    ->modalDescription(__('panel.revisions.restore_confirm'))
+                    ->authorize(fn () => (bool) Auth::user()?->can('update', $this->getOwnerRecord()))
+                    // Nothing to put back for a creation or a deletion, and
+                    // the newest revision already is the current state.
+                    ->visible(fn (Revision $record) => filled($record->changeset)
+                        && $record->isNot($this->getOwnerRecord()->revisions()->first()))
+                    ->action(function (Revision $record): void {
+                        $owner = $this->getOwnerRecord();
+
+                        // Restoring is itself a change, so it lands in the
+                        // history like any other — the way back is never lost.
+                        $owner->forceFill($record->previousValues())->save();
+
+                        Notification::make()
+                            ->title(__('panel.revisions.restored'))
+                            ->success()
+                            ->send();
+                    }),
+            ]);
+    }
+
+    public function isReadOnly(): bool
+    {
+        return true;
+    }
+}

app/Filament/Resources/Applications/ApplicationResource.php

@@ -0,0 +1,113 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Applications;
+
+use App\Filament\Resources\Applications\Pages\ListApplications;
+use App\Filament\Resources\Applications\Pages\ViewApplication;
+use App\Filament\Resources\Applications\Schemas\ApplicationInfolist;
+use App\Filament\Resources\Applications\Tables\ApplicationsTable;
+use App\Models\Application;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use UnitEnum;
+
+/**
+ * The inbox.
+ *
+ * Everything else in this panel is written by the collective; this is the one
+ * resource written by the public. That difference shapes the whole thing:
+ * nothing here is created by hand, the submitted half is read-only, and the
+ * badge in the sidebar counts the people still waiting for a reply.
+ */
+class ApplicationResource extends Resource
+{
+    protected static ?string $model = Application::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedInboxArrowDown;
+
+    protected static ?int $navigationSort = 4;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.applications.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.applications.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->name;
+    }
+
+    public static function infolist(Schema $schema): Schema
+    {
+        return ApplicationInfolist::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return ApplicationsTable::configure($table);
+    }
+
+    /**
+     * @return Builder<Application>
+     */
+    public static function getEloquentQuery(): Builder
+    {
+        // `subject()` reads the call on every row, and the handler shows in an
+        // optional column: both are loaded up front rather than per row.
+        return parent::getEloquentQuery()->with(['call', 'handler']);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListApplications::route('/'),
+            'view' => ViewApplication::route('/{record}'),
+        ];
+    }
+
+    /**
+     * Submissions arrive from the public site. Nobody types one in.
+     */
+    public static function canCreate(): bool
+    {
+        return false;
+    }
+
+    /**
+     * The number of people waiting for an answer — the only figure in this
+     * panel that represents somebody else's time rather than ours.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        $pending = static::getModel()::query()->pending()->count();
+
+        return $pending > 0 ? (string) $pending : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'warning';
+    }
+
+    public static function getNavigationBadgeTooltip(): ?string
+    {
+        return __('panel.applications.badge_tooltip');
+    }
+}

app/Filament/Resources/Applications/Pages/ListApplications.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Applications\Pages;
+
+use App\Enums\ApplicationKind;
+use App\Enums\ApplicationStatus;
+use App\Filament\Resources\Applications\ApplicationResource;
+use Filament\Resources\Pages\ListRecords;
+use Filament\Schemas\Components\Tabs\Tab;
+use Illuminate\Database\Eloquent\Builder;
+
+class ListApplications extends ListRecords
+{
+    protected static string $resource = ApplicationResource::class;
+
+    /**
+     * Tabs rather than filters for the two questions asked most often: who is
+     * still waiting, and who is offering time versus asking for it.
+     *
+     * @return array<string, Tab>
+     */
+    public function getTabs(): array
+    {
+        return [
+            'pending' => Tab::make(__('panel.applications.tabs.pending'))
+                ->modifyQueryUsing(fn (Builder $query) => $query->pending())
+                ->badge(ApplicationResource::getModel()::query()->pending()->count())
+                ->badgeColor('warning'),
+
+            'contribute' => Tab::make(__('panel.applications.tabs.contribute'))
+                ->modifyQueryUsing(fn (Builder $query) => $query
+                    ->where('kind', ApplicationKind::Contribute)
+                    ->notSpam()),
+
+            'request' => Tab::make(__('panel.applications.tabs.request'))
+                ->modifyQueryUsing(fn (Builder $query) => $query
+                    ->where('kind', ApplicationKind::Request)
+                    ->notSpam()),
+
+            'all' => Tab::make(__('panel.applications.tabs.all')),
+
+            'spam' => Tab::make(__('panel.applications.tabs.spam'))
+                ->modifyQueryUsing(fn (Builder $query) => $query
+                    ->where('status', ApplicationStatus::Spam)),
+        ];
+    }
+
+    public function getDefaultActiveTab(): string|int|null
+    {
+        return 'pending';
+    }
+}

app/Filament/Resources/Applications/Pages/ViewApplication.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Applications\Pages;
+
+use App\Filament\Resources\Applications\ApplicationResource;
+use App\Filament\Resources\Applications\Tables\ApplicationsTable;
+use App\Models\Application;
+use Filament\Actions\Action;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\ForceDeleteAction;
+use Filament\Actions\RestoreAction;
+use Filament\Forms\Components\Textarea;
+use Filament\Notifications\Notification;
+use Filament\Resources\Pages\ViewRecord;
+
+class ViewApplication extends ViewRecord
+{
+    protected static string $resource = ApplicationResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            // Answering is the point of the record, so the reply is the first
+            // button rather than something to copy out of the page.
+            Action::make('reply')
+                ->label(__('panel.applications.actions.reply'))
+                ->icon('heroicon-o-envelope')
+                ->color('primary')
+                ->url(fn (Application $record) => 'mailto:'.$record->email.'?subject='
+                    .rawurlencode(__('panel.applications.reply_subject', [
+                        'subject' => $record->subject(),
+                    ])))
+                ->openUrlInNewTab(),
+
+            Action::make('notes')
+                ->label(__('panel.applications.actions.notes'))
+                ->icon('heroicon-o-pencil-square')
+                ->color('gray')
+                ->authorize('update')
+                ->schema([
+                    Textarea::make('notes')
+                        ->label(__('panel.applications.fields.notes'))
+                        ->helperText(__('panel.applications.fields.notes_hint'))
+                        ->rows(6),
+                ])
+                ->fillForm(fn (Application $record) => ['notes' => $record->notes])
+                ->action(function (Application $record, array $data): void {
+                    // Notes are outside the model's fillable list on purpose —
+                    // nothing arriving from the public form may ever land in
+                    // them — so they are written explicitly here.
+                    $record->forceFill(['notes' => $data['notes']])->save();
+
+                    Notification::make()
+                        ->title(__('panel.applications.saved'))
+                        ->success()
+                        ->send();
+                }),
+
+            ...ApplicationsTable::statusActions(),
+
+            DeleteAction::make(),
+            RestoreAction::make(),
+            ForceDeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Applications/Schemas/ApplicationInfolist.php

@@ -0,0 +1,108 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Applications\Schemas;
+
+use App\Models\Application;
+use Filament\Infolists\Components\KeyValueEntry;
+use Filament\Infolists\Components\TextEntry;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+
+/**
+ * A submission is read, not edited: everything above the divider was written
+ * by somebody else and must stay exactly as they sent it. Only the notes and
+ * the status below belong to the collective.
+ */
+class ApplicationInfolist
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make(__('panel.applications.sections.message'))
+                ->columns(3)
+                ->schema([
+                    TextEntry::make('name')
+                        ->label(__('panel.applications.fields.name'))
+                        ->weight('bold'),
+
+                    TextEntry::make('email')
+                        ->label(__('panel.applications.fields.email'))
+                        ->copyable()
+                        // The reply is the whole point of the record, so it is
+                        // one click away rather than a copy-paste.
+                        ->url(fn (Application $record) => 'mailto:'.$record->email),
+
+                    TextEntry::make('organisation')
+                        ->label(__('panel.applications.fields.organisation'))
+                        ->placeholder('—'),
+
+                    TextEntry::make('kind')
+                        ->label(__('panel.applications.fields.kind'))
+                        ->badge(),
+
+                    TextEntry::make('call_title')
+                        ->label(__('panel.applications.fields.subject'))
+                        ->state(fn (Application $record) => $record->subject()),
+
+                    TextEntry::make('hours_per_week')
+                        ->label(__('panel.applications.fields.hours_per_week'))
+                        ->formatStateUsing(fn (?int $state) => $state ? "{$state} h" : '—')
+                        // The number to compare against the call's own ask.
+                        ->helperText(fn (Application $record) => $record->call?->hours_per_week
+                            ? __('panel.applications.fields.hours_asked', [
+                                'hours' => $record->call->hours_per_week,
+                            ])
+                            : null),
+
+                    TextEntry::make('message')
+                        ->label(__('panel.applications.fields.message'))
+                        ->prose()
+                        ->columnSpanFull(),
+
+                    KeyValueEntry::make('links')
+                        ->label(__('panel.applications.fields.links'))
+                        ->keyLabel(__('panel.applications.fields.link_name'))
+                        ->valueLabel(__('panel.applications.fields.link_url'))
+                        ->columnSpanFull()
+                        ->visible(fn (Application $record) => filled($record->links)),
+                ]),
+
+            Section::make(__('panel.applications.sections.internal'))
+                ->description(__('panel.applications.sections.internal_hint'))
+                ->columns(4)
+                ->schema([
+                    TextEntry::make('status')
+                        ->label(__('panel.applications.fields.status'))
+                        ->badge(),
+
+                    TextEntry::make('created_at')
+                        ->label(__('panel.applications.fields.received_at'))
+                        ->dateTime(),
+
+                    TextEntry::make('handler.name')
+                        ->label(__('panel.applications.fields.handled_by'))
+                        ->placeholder('—'),
+
+                    TextEntry::make('handled_at')
+                        ->label(__('panel.applications.fields.handled_at'))
+                        ->dateTime()
+                        ->placeholder('—'),
+
+                    TextEntry::make('locale')
+                        ->label(__('panel.applications.fields.locale'))
+                        ->badge()
+                        ->color('gray')
+                        // Reply in the language they wrote in.
+                        ->formatStateUsing(fn (string $state) => config("locales.supported.{$state}.native", $state)),
+
+                    TextEntry::make('notes')
+                        ->label(__('panel.applications.fields.notes'))
+                        ->prose()
+                        ->placeholder(__('panel.applications.fields.notes_empty'))
+                        ->columnSpanFull(),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/Applications/Tables/ApplicationsTable.php

@@ -0,0 +1,163 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Applications\Tables;
+
+use App\Enums\ApplicationKind;
+use App\Enums\ApplicationStatus;
+use App\Models\Application;
+use Filament\Actions\Action;
+use Filament\Actions\ActionGroup;
+use Filament\Actions\BulkAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Actions\ViewAction;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Facades\Auth;
+
+/**
+ * An inbox rather than a catalogue.
+ *
+ * What it optimises for is the one question worth asking every morning: is
+ * anybody waiting for an answer? Hence the pending filter on by default, the
+ * relative timestamps, and the status transitions one click from the list.
+ */
+class ApplicationsTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                TextColumn::make('name')
+                    ->label(__('panel.applications.fields.name'))
+                    ->weight('medium')
+                    ->description(fn (Application $record) => $record->email)
+                    ->searchable(['name', 'email']),
+
+                TextColumn::make('kind')
+                    ->label(__('panel.applications.fields.kind'))
+                    ->badge()
+                    ->sortable(),
+
+                TextColumn::make('call_title')
+                    ->label(__('panel.applications.fields.subject'))
+                    ->state(fn (Application $record) => $record->subject())
+                    ->color(fn (Application $record) => $record->call_id ? null : 'gray')
+                    ->wrap()
+                    ->toggleable(),
+
+                TextColumn::make('hours_per_week')
+                    ->label(__('panel.applications.fields.hours_per_week'))
+                    ->badge()
+                    ->color('info')
+                    ->formatStateUsing(fn (?int $state) => $state ? "{$state} h" : '—')
+                    ->toggleable(),
+
+                TextColumn::make('status')
+                    ->label(__('panel.applications.fields.status'))
+                    ->badge()
+                    ->sortable(),
+
+                TextColumn::make('created_at')
+                    ->label(__('panel.applications.fields.received_at'))
+                    ->since()
+                    ->dateTimeTooltip()
+                    ->sortable(),
+
+                TextColumn::make('handler.name')
+                    ->label(__('panel.applications.fields.handled_by'))
+                    ->placeholder('—')
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->filters([
+                // No default here: the tabs above already decide what is in
+                // view, and a filter with a default would silently empty the
+                // spam tab.
+                SelectFilter::make('status')
+                    ->label(__('panel.applications.fields.status'))
+                    ->options(ApplicationStatus::options())
+                    ->multiple(),
+
+                SelectFilter::make('kind')
+                    ->label(__('panel.applications.fields.kind'))
+                    ->options(ApplicationKind::options()),
+
+                SelectFilter::make('call')
+                    ->label(__('panel.applications.fields.call'))
+                    ->relationship('call', 'title->'.config('locales.default'))
+                    ->searchable()
+                    ->preload(),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                ViewAction::make(),
+
+                ActionGroup::make(static::statusActions())
+                    ->label(__('panel.applications.actions.group'))
+                    ->icon('heroicon-m-ellipsis-horizontal'),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    BulkAction::make('mark_spam')
+                        ->label(__('panel.applications.actions.spam'))
+                        ->icon('heroicon-o-no-symbol')
+                        ->color('danger')
+                        ->requiresConfirmation()
+                        ->authorize(fn () => (bool) Auth::user()?->can('applications.update'))
+                        ->action(fn (Collection $records) => $records->each(
+                            fn (Application $record) => $record->markAs(ApplicationStatus::Spam, Auth::user()),
+                        ))
+                        ->deselectRecordsAfterCompletion(),
+
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ])
+            ->emptyStateHeading(__('panel.applications.empty.heading'))
+            ->emptyStateDescription(__('panel.applications.empty.description'))
+            ->emptyStateIcon('heroicon-o-inbox');
+    }
+
+    /**
+     * The status transitions, shared by the list and the record page so the
+     * two cannot drift apart.
+     *
+     * @return array<int, Action>
+     */
+    public static function statusActions(): array
+    {
+        $styles = [
+            ApplicationStatus::Contacted->value => ['heroicon-o-chat-bubble-left-right', 'info'],
+            ApplicationStatus::Accepted->value => ['heroicon-o-check-circle', 'success'],
+            ApplicationStatus::Declined->value => ['heroicon-o-x-circle', 'gray'],
+            ApplicationStatus::Spam->value => ['heroicon-o-no-symbol', 'danger'],
+        ];
+
+        $actions = [];
+
+        foreach ($styles as $status => [$icon, $color]) {
+            $target = ApplicationStatus::from($status);
+
+            $actions[] = Action::make("mark_{$status}")
+                ->label(__("panel.applications.actions.{$status}"))
+                ->icon($icon)
+                ->color($color)
+                ->requiresConfirmation($target === ApplicationStatus::Spam)
+                ->authorize('update')
+                ->visible(fn (Application $record) => $record->status !== $target)
+                ->action(fn (Application $record) => $record->markAs($target, Auth::user()));
+        }
+
+        return $actions;
+    }
+}

app/Filament/Resources/Calls/CallResource.php

@@ -0,0 +1,291 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Calls;
+
+use App\Enums\CallStatus;
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Calls\Pages\CreateCall;
+use App\Filament\Resources\Calls\Pages\EditCall;
+use App\Filament\Resources\Calls\Pages\ListCalls;
+use App\Filament\Resources\Calls\RelationManagers\ApplicationsRelationManager;
+use App\Filament\Support\PreviewAction;
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Call;
+use App\Rules\UniqueTranslatedSlug;
+use BackedEnum;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ReplicateAction;
+use Filament\Forms\Components\DatePicker;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Str;
+use UnitEnum;
+
+/**
+ * Calls for contributors — the conversion point of the whole site.
+ *
+ * The hours-per-week and duration fields are what make this worth having as a
+ * model of its own: a volunteer weighs time, and "~4h/week for 8 weeks" is a
+ * decision someone can make in seconds.
+ */
+class CallResource extends Resource
+{
+    protected static ?string $model = Call::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedHandRaised;
+
+    protected static ?int $navigationSort = 3;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.calls.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.calls.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->getTranslation('title', app()->getLocale());
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()->schema([
+                TranslatableTabs::make(fn (string $locale, bool $isDefault) => [
+                    TextInput::make("title.{$locale}")
+                        ->label(__('panel.calls.fields.title'))
+                        ->required($isDefault)
+                        ->maxLength(255)
+                        ->columnSpanFull()
+                        ->live(onBlur: true)
+                        ->afterStateUpdated(function (?string $state, callable $get, callable $set) use ($locale) {
+                            if (blank($get("slug.{$locale}"))) {
+                                $set("slug.{$locale}", Str::slug((string) $state));
+                            }
+                        }),
+
+                    TextInput::make("slug.{$locale}")
+                        ->label(__('panel.calls.fields.slug'))
+                        ->required($isDefault)
+                        ->maxLength(255)
+                        ->columnSpanFull()
+                        ->rules(fn ($record) => [new UniqueTranslatedSlug(Call::class, $record?->id)]),
+
+                    Textarea::make("description.{$locale}")
+                        ->label(__('panel.calls.fields.description'))
+                        ->rows(4)
+                        ->columnSpanFull(),
+
+                    // Unpaid work needs an explicit exchange. Saying it out
+                    // loud attracts more people than leaving it implied.
+                    Textarea::make("what_you_get.{$locale}")
+                        ->label(__('panel.calls.fields.what_you_get'))
+                        ->helperText(__('panel.calls.fields.what_you_get_hint'))
+                        ->rows(3)
+                        ->columnSpanFull(),
+                ]),
+            ]),
+
+            Section::make(__('panel.calls.sections.commitment'))
+                ->description(__('panel.calls.sections.commitment_hint'))
+                ->columns(3)
+                ->schema([
+                    TextInput::make('hours_per_week')
+                        ->label(__('panel.calls.fields.hours_per_week'))
+                        ->numeric()
+                        ->minValue(1)
+                        ->maxValue(40)
+                        ->suffix('h'),
+
+                    TextInput::make('duration_weeks')
+                        ->label(__('panel.calls.fields.duration_weeks'))
+                        ->numeric()
+                        ->minValue(1),
+
+                    Select::make('seniority')
+                        ->label(__('panel.calls.fields.seniority'))
+                        ->options([
+                            'any' => __('panel.calls.seniority.any'),
+                            'junior' => __('panel.calls.seniority.junior'),
+                            'mid' => __('panel.calls.seniority.mid'),
+                            'senior' => __('panel.calls.seniority.senior'),
+                        ]),
+                ]),
+
+            Section::make()
+                ->columns(2)
+                ->schema([
+                    Select::make('project_id')
+                        ->label(__('panel.calls.fields.project'))
+                        ->relationship('project', 'title->'.config('locales.default'))
+                        ->searchable()
+                        ->preload()
+                        ->helperText(__('panel.calls.fields.project_hint')),
+
+                    Select::make('status')
+                        ->label(__('panel.calls.fields.status'))
+                        ->options(CallStatus::class)
+                        ->default(CallStatus::Open)
+                        ->required(),
+
+                    Select::make('technologies')
+                        ->label(__('panel.calls.fields.technologies'))
+                        ->relationship('technologies', 'name')
+                        ->multiple()
+                        ->preload()
+                        ->searchable()
+                        ->columnSpanFull(),
+
+                    DatePicker::make('opens_at')->label(__('panel.calls.fields.opens_at')),
+                    DatePicker::make('closes_at')->label(__('panel.calls.fields.closes_at')),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        $locale = app()->getLocale();
+
+        return $table
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                TextColumn::make('title')
+                    ->label(__('panel.calls.fields.title'))
+                    ->weight('medium')
+                    ->wrap()
+                    ->searchable(query: fn ($q, string $search) => $q
+                        ->where("title->{$locale}", 'like', "%{$search}%")),
+
+                TextColumn::make('status')
+                    ->label(__('panel.calls.fields.status'))
+                    ->badge()
+                    ->sortable(),
+
+                TextColumn::make('project.title')
+                    ->label(__('panel.calls.fields.project'))
+                    ->badge()
+                    ->color('gray')
+                    ->placeholder(__('panel.calls.no_project')),
+
+                // The number that does the work on the public site.
+                TextColumn::make('hours_per_week')
+                    ->label(__('panel.calls.fields.commitment'))
+                    ->formatStateUsing(fn ($state, Call $record) => $state
+                        ? trans_choice('panel.calls.commitment_summary', $record->duration_weeks ?? 0, [
+                            'hours' => $state,
+                            'weeks' => $record->duration_weeks,
+                        ])
+                        : '—')
+                    ->badge()
+                    ->color('info'),
+
+                TextColumn::make('technologies.name')
+                    ->label(__('panel.calls.fields.technologies'))
+                    ->badge()
+                    ->color('gray')
+                    ->limitList(3)
+                    ->toggleable(),
+
+                TextColumn::make('closes_at')
+                    ->label(__('panel.calls.fields.closes_at'))
+                    ->date()
+                    ->placeholder('—')
+                    ->sortable(),
+            ])
+            ->filters([
+                SelectFilter::make('status')
+                    ->label(__('panel.calls.fields.status'))
+                    ->options(CallStatus::options())
+                    ->multiple(),
+
+                SelectFilter::make('technologies')
+                    ->label(__('panel.calls.fields.technologies'))
+                    ->relationship('technologies', 'name')
+                    ->multiple()
+                    ->preload(),
+            ])
+            ->recordActions([
+                // A near-copy is a real workflow: the third similar service,
+                // next year's call. The slug is cleared because two records
+                // cannot answer at the same URL.
+                ReplicateAction::make()
+                    ->label(__('panel.actions.duplicate'))
+                    ->icon('heroicon-o-document-duplicate')
+                    ->excludeAttributes(['slug', 'published_at', 'unpublish_at'])
+                    ->modalHeading(__('panel.actions.duplicate_heading'))
+                    ->successNotificationTitle(__('panel.actions.duplicated')),
+
+                PreviewAction::for('call'),
+
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([DeleteBulkAction::make()]),
+            ]);
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            RevisionsRelationManager::class,
+            ApplicationsRelationManager::class,
+        ];
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['title->'.app()->getLocale()];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListCalls::route('/'),
+            'create' => CreateCall::route('/create'),
+            'edit' => EditCall::route('/{record}/edit'),
+        ];
+    }
+
+    /**
+     * How many contributor slots are currently open — the number that tells
+     * the collective whether the site is doing its job.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        $open = static::getModel()::query()->open()->count();
+
+        return $open > 0 ? (string) $open : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'success';
+    }
+}

app/Filament/Resources/Calls/Pages/CreateCall.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Calls\Pages;
+
+use App\Filament\Resources\Calls\CallResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateCall extends CreateRecord
+{
+    protected static string $resource = CallResource::class;
+}

app/Filament/Resources/Calls/Pages/EditCall.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Calls\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Calls\CallResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditCall extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = CallResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Calls/Pages/ListCalls.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Calls\Pages;
+
+use App\Filament\Resources\Calls\CallResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListCalls extends ListRecords
+{
+    protected static string $resource = CallResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Calls/RelationManagers/ApplicationsRelationManager.php

@@ -0,0 +1,93 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Calls\RelationManagers;
+
+use App\Enums\ApplicationStatus;
+use App\Filament\Resources\Applications\ApplicationResource;
+use App\Models\Application;
+use Filament\Actions\Action;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+
+/**
+ * Who answered this call, shown on the call itself.
+ *
+ * The inbox is the place to work through everything at once; this is the place
+ * to answer the question you actually have while looking at an opening — is
+ * anybody interested? A call with no replies after a month is telling you
+ * something about the call, not about the people.
+ */
+class ApplicationsRelationManager extends RelationManager
+{
+    protected static string $relationship = 'applications';
+
+    public static function getTitle(Model $ownerRecord, string $pageClass): string
+    {
+        return __('panel.applications.plural');
+    }
+
+    public static function getBadge(Model $ownerRecord, string $pageClass): ?string
+    {
+        $pending = $ownerRecord->applications()->pending()->count();
+
+        return $pending > 0 ? (string) $pending : null;
+    }
+
+    public static function canViewForRecord(Model $ownerRecord, string $pageClass): bool
+    {
+        // The inbox holds personal data, so it stays behind its own permission
+        // even for someone already allowed to edit the call.
+        return (bool) Auth::user()?->can('applications.view_any');
+    }
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                TextColumn::make('name')
+                    ->label(__('panel.applications.fields.name'))
+                    ->weight('medium')
+                    ->description(fn (Application $record) => $record->email),
+
+                TextColumn::make('hours_per_week')
+                    ->label(__('panel.applications.fields.hours_per_week'))
+                    ->badge()
+                    ->color('info')
+                    ->formatStateUsing(fn (?int $state) => $state ? "{$state} h" : '—'),
+
+                TextColumn::make('status')
+                    ->label(__('panel.applications.fields.status'))
+                    ->badge(),
+
+                TextColumn::make('created_at')
+                    ->label(__('panel.applications.fields.received_at'))
+                    ->since()
+                    ->dateTimeTooltip(),
+            ])
+            ->recordActions([
+                Action::make('open')
+                    ->label(__('panel.applications.actions.open'))
+                    ->icon('heroicon-o-arrow-top-right-on-square')
+                    ->url(fn (Application $record) => ApplicationResource::getUrl('view', ['record' => $record])),
+
+                Action::make('mark_contacted')
+                    ->label(__('panel.applications.actions.contacted'))
+                    ->icon('heroicon-o-chat-bubble-left-right')
+                    ->color('info')
+                    ->authorize('update')
+                    ->visible(fn (Application $record) => $record->status === ApplicationStatus::New)
+                    ->action(fn (Application $record) => $record->markAs(
+                        ApplicationStatus::Contacted,
+                        Auth::user(),
+                    )),
+            ])
+            ->emptyStateHeading(__('panel.applications.empty.call_heading'))
+            ->emptyStateIcon('heroicon-o-inbox');
+    }
+}

app/Filament/Resources/Categories/CategoryResource.php

@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Categories;
+
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Categories\Pages\CreateCategory;
+use App\Filament\Resources\Categories\Pages\EditCategory;
+use App\Filament\Resources\Categories\Pages\ListCategories;
+use App\Filament\Resources\Categories\Schemas\CategoryForm;
+use App\Filament\Resources\Categories\Tables\CategoriesTable;
+use App\Models\Category;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\SoftDeletingScope;
+use UnitEnum;
+
+class CategoryResource extends Resource
+{
+    protected static ?string $model = Category::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedTag;
+
+    protected static ?int $navigationSort = 20;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.categories.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.categories.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.content');
+    }
+
+    /**
+     * Records are labelled by their name in the admin's current language.
+     */
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->getTranslation('name', app()->getLocale());
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return CategoryForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return CategoriesTable::configure($table);
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['name->'.app()->getLocale()];
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            RevisionsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListCategories::route('/'),
+            'create' => CreateCategory::route('/create'),
+            'edit' => EditCategory::route('/{record}/edit'),
+        ];
+    }
+
+    public static function getRecordRouteBindingEloquentQuery(): Builder
+    {
+        return parent::getRecordRouteBindingEloquentQuery()
+            ->withoutGlobalScopes([SoftDeletingScope::class]);
+    }
+}

app/Filament/Resources/Categories/Pages/CreateCategory.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Filament\Resources\Categories\Pages;
+
+use App\Filament\Resources\Categories\CategoryResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateCategory extends CreateRecord
+{
+    protected static string $resource = CategoryResource::class;
+}

app/Filament/Resources/Categories/Pages/EditCategory.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Filament\Resources\Categories\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Categories\CategoryResource;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\ForceDeleteAction;
+use Filament\Actions\RestoreAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditCategory extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = CategoryResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+            ForceDeleteAction::make(),
+            RestoreAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Categories/Pages/ListCategories.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Filament\Resources\Categories\Pages;
+
+use App\Filament\Resources\Categories\CategoryResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListCategories extends ListRecords
+{
+    protected static string $resource = CategoryResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Categories/Schemas/CategoryForm.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Categories\Schemas;
+
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Category;
+use App\Rules\UniqueTranslatedSlug;
+use Filament\Forms\Components\ColorPicker;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Support\Str;
+
+class CategoryForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            TranslatableTabs::make(fn (string $locale, bool $isDefault) => [
+                TextInput::make("name.{$locale}")
+                    ->label(__('panel.categories.fields.name'))
+                    ->required($isDefault)
+                    ->maxLength(255)
+                    ->live(onBlur: true)
+                    // Fill the slug from the name while it is still untouched,
+                    // per locale, so each language gets its own readable URL.
+                    ->afterStateUpdated(function (?string $state, callable $get, callable $set) use ($locale) {
+                        if (blank($get("slug.{$locale}"))) {
+                            $set("slug.{$locale}", Str::slug((string) $state));
+                        }
+                    }),
+
+                TextInput::make("slug.{$locale}")
+                    ->label(__('panel.categories.fields.slug'))
+                    ->required($isDefault)
+                    ->maxLength(255)
+                    ->rules(fn ($record) => [new UniqueTranslatedSlug(Category::class, $record?->id)]),
+
+                Textarea::make("description.{$locale}")
+                    ->label(__('panel.categories.fields.description'))
+                    ->rows(3)
+                    ->maxLength(1000)
+                    ->columnSpanFull(),
+            ]),
+
+            Section::make()
+                ->columns(3)
+                ->schema([
+                    ColorPicker::make('color')
+                        ->label(__('panel.categories.fields.color')),
+
+                    TextInput::make('position')
+                        ->label(__('panel.categories.fields.position'))
+                        ->numeric()
+                        ->default(0)
+                        ->minValue(0),
+
+                    Toggle::make('is_visible')
+                        ->label(__('panel.categories.fields.is_visible'))
+                        ->default(true),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/Categories/Tables/CategoriesTable.php

@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Categories\Tables;
+
+use App\Filament\Support\TranslationStatusColumn;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Tables\Columns\ColorColumn;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+
+class CategoriesTable
+{
+    public static function configure(Table $table): Table
+    {
+        $locale = app()->getLocale();
+
+        return $table
+            ->defaultSort('position')
+            ->reorderable('position')
+            ->columns([
+                ColorColumn::make('color')
+                    ->label(__('panel.categories.fields.color')),
+
+                TextColumn::make('name')
+                    ->label(__('panel.categories.fields.name'))
+                    // The model resolves `name` to the active locale already;
+                    // sort and search must target that locale's JSON key.
+                    ->searchable(query: fn ($query, string $search) => $query
+                        ->where("name->{$locale}", 'like', "%{$search}%"))
+                    ->sortable(query: fn ($query, string $direction) => $query
+                        ->orderBy("name->{$locale}", $direction)),
+
+                TextColumn::make('slug')
+                    ->label(__('panel.categories.fields.slug'))
+                    ->color('gray')
+                    ->toggleable(isToggledHiddenByDefault: true),
+
+                TranslationStatusColumn::make('translations')
+                    ->label(__('panel.pages.fields.translations')),
+
+                TextColumn::make('pages_count')
+                    ->label(__('panel.categories.fields.pages_count'))
+                    ->counts('pages')
+                    ->badge()
+                    ->sortable(),
+
+                IconColumn::make('is_visible')
+                    ->label(__('panel.categories.fields.is_visible'))
+                    ->boolean()
+                    ->sortable(),
+            ])
+            ->filters([
+                TernaryFilter::make('is_visible')
+                    ->label(__('panel.categories.fields.is_visible')),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ]);
+    }
+}

app/Filament/Resources/Clients/ClientResource.php

@@ -0,0 +1,220 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Clients;
+
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Clients\Pages\CreateClient;
+use App\Filament\Resources\Clients\Pages\EditClient;
+use App\Filament\Resources\Clients\Pages\ListClients;
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Client;
+use BackedEnum;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\ImageColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
+use UnitEnum;
+
+/**
+ * The organisations the work was for.
+ *
+ * This used to be a name typed into every project by hand. Being a record
+ * makes the wall of logos possible, stops the same association becoming two
+ * entities because of a typo, and gives "everything we did for them" an
+ * answer.
+ */
+class ClientResource extends Resource
+{
+    protected static ?string $model = Client::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedBuildingOffice2;
+
+    protected static ?int $navigationSort = 5;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.clients.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.clients.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->name;
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()
+                ->columns(2)
+                ->schema([
+                    // A proper noun: an association is called what it is called
+                    // in every language, so this is not translated.
+                    TextInput::make('name')
+                        ->label(__('panel.clients.fields.name'))
+                        ->required()
+                        ->maxLength(255)
+                        ->live(onBlur: true)
+                        ->afterStateUpdated(function (?string $state, callable $get, callable $set) {
+                            if (blank($get('slug'))) {
+                                $set('slug', Str::slug((string) $state));
+                            }
+                        }),
+
+                    TextInput::make('slug')
+                        ->label(__('panel.clients.fields.slug'))
+                        ->required()
+                        ->maxLength(255)
+                        ->rules(fn ($record) => [
+                            Rule::unique('clients', 'slug')->ignore($record?->id),
+                        ]),
+
+                    TextInput::make('url')
+                        ->label(__('panel.clients.fields.url'))
+                        ->url()
+                        ->maxLength(2048)
+                        ->columnSpanFull(),
+
+                    FileUpload::make('logo')
+                        ->label(__('panel.clients.fields.logo'))
+                        ->image()
+                        ->disk(config('media.disk'))
+                        ->directory('clients')
+                        ->helperText(__('panel.clients.fields.logo_hint'))
+                        ->columnSpanFull(),
+
+                    TranslatableTabs::make(fn (string $locale) => [
+                        TextInput::make("sector.{$locale}")
+                            ->label(__('panel.clients.fields.sector'))
+                            ->maxLength(120)
+                            ->columnSpanFull(),
+                    ])->columnSpanFull(),
+
+                    Toggle::make('is_public')
+                        ->label(__('panel.clients.fields.is_public'))
+                        // Not everybody wants to appear on somebody else's
+                        // website, and that is their call, not ours.
+                        ->helperText(__('panel.clients.fields.is_public_hint'))
+                        ->default(true),
+
+                    TextInput::make('position')
+                        ->label(__('panel.clients.fields.position'))
+                        ->numeric()
+                        ->default(0),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('position')
+            ->reorderable('position')
+            ->columns([
+                ImageColumn::make('logo')
+                    ->label('')
+                    ->disk(config('media.disk'))
+                    ->height(32),
+
+                TextColumn::make('name')
+                    ->label(__('panel.clients.fields.name'))
+                    ->weight('medium')
+                    ->description(fn (Client $record) => $record->getTranslation('sector', app()->getLocale(), false) ?: null)
+                    ->searchable()
+                    ->sortable(),
+
+                TextColumn::make('projects_count')
+                    ->label(__('panel.clients.fields.projects'))
+                    ->counts('projects')
+                    ->badge()
+                    ->color('gray'),
+
+                IconColumn::make('is_public')
+                    ->label(__('panel.clients.fields.is_public'))
+                    ->boolean(),
+
+                TextColumn::make('url')
+                    ->label(__('panel.clients.fields.url'))
+                    ->url(fn (Client $record) => $record->url)
+                    ->openUrlInNewTab()
+                    ->placeholder('—')
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->filters([
+                TernaryFilter::make('is_public')->label(__('panel.clients.fields.is_public')),
+
+                // A client with no logo is a hole in the wall of logos.
+                Filter::make('without_logo')
+                    ->label(__('panel.clients.filters.without_logo'))
+                    ->query(fn (Builder $query) => $query->whereNull('logo')),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ]);
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['name'];
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            RevisionsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListClients::route('/'),
+            'create' => CreateClient::route('/create'),
+            'edit' => EditClient::route('/{record}/edit'),
+        ];
+    }
+}

app/Filament/Resources/Clients/Pages/CreateClient.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Clients\Pages;
+
+use App\Filament\Resources\Clients\ClientResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateClient extends CreateRecord
+{
+    protected static string $resource = ClientResource::class;
+}

app/Filament/Resources/Clients/Pages/EditClient.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Clients\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Clients\ClientResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditClient extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = ClientResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Clients/Pages/ListClients.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Clients\Pages;
+
+use App\Filament\Resources\Clients\ClientResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListClients extends ListRecords
+{
+    protected static string $resource = ClientResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Media/MediaResource.php

@@ -0,0 +1,203 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Media;
+
+use App\Filament\Resources\Media\Pages\ListMedia;
+use App\Jobs\ProcessMedia;
+use App\Models\Media;
+use BackedEnum;
+use Filament\Actions\Action;
+use Filament\Actions\DeleteAction;
+use Filament\Notifications\Notification;
+use Filament\Resources\Resource;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\ImageColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Storage;
+use UnitEnum;
+
+/**
+ * Everything that has been uploaded, and what is known about it.
+ *
+ * Nothing here is authored: the rows are derived from the files, so this is a
+ * place to look rather than to write. What it answers is the set of questions
+ * nowhere else could — what is taking up the disk, which images never got
+ * processed, and which files nothing points at any more.
+ */
+class MediaResource extends Resource
+{
+    protected static ?string $model = Media::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedPhoto;
+
+    protected static ?int $navigationSort = 86;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.media.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.media.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->path;
+    }
+
+    public static function canCreate(): bool
+    {
+        // Files arrive by being uploaded on a record, not from here.
+        return false;
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                ImageColumn::make('path')
+                    ->label('')
+                    ->disk(fn (Media $record) => $record->disk)
+                    ->height(48),
+
+                TextColumn::make('path')
+                    ->label(__('panel.media.fields.file'))
+                    ->fontFamily('mono')
+                    ->size('xs')
+                    ->wrap()
+                    ->searchable()
+                    ->description(fn (Media $record) => $record->mime),
+
+                TextColumn::make('width')
+                    ->label(__('panel.media.fields.size'))
+                    ->state(fn (Media $record) => $record->width
+                        ? "{$record->width}×{$record->height}"
+                        : __('panel.media.pending'))
+                    ->badge()
+                    ->color(fn (Media $record) => $record->width ? 'gray' : 'warning'),
+
+                TextColumn::make('variants')
+                    ->label(__('panel.media.fields.versions'))
+                    ->state(fn (Media $record) => count($record->variants ?? []))
+                    ->badge()
+                    ->color(fn (int $state) => $state > 0 ? 'success' : 'gray'),
+
+                // Original plus every derived version: the number that
+                // explains where the disk went.
+                TextColumn::make('size')
+                    ->label(__('panel.media.fields.weight'))
+                    ->state(fn (Media $record) => round($record->totalSize() / 1024).' KB')
+                    ->sortable(),
+
+                TextColumn::make('used')
+                    ->label(__('panel.media.fields.used'))
+                    ->state(fn (Media $record) => $record->isReferenced()
+                        ? __('panel.media.in_use')
+                        : __('panel.media.orphan'))
+                    ->badge()
+                    ->color(fn (Media $record) => $record->isReferenced() ? 'success' : 'warning'),
+
+                TextColumn::make('error')
+                    ->label(__('panel.media.fields.error'))
+                    ->wrap()
+                    ->color('danger')
+                    ->placeholder('—')
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->filters([
+                Filter::make('pending')
+                    ->label(__('panel.media.filters.pending'))
+                    ->query(fn (Builder $query) => $query->pending()),
+
+                Filter::make('failed')
+                    ->label(__('panel.media.filters.failed'))
+                    ->query(fn (Builder $query) => $query->whereNotNull('error')),
+
+                // Everything the prune command would take away.
+                Filter::make('orphans')
+                    ->label(__('panel.media.filters.orphans'))
+                    ->query(fn (Builder $query) => $query
+                        ->whereNotIn('path', Media::referencedPaths())),
+
+                Filter::make('missing')
+                    ->label(__('panel.media.filters.missing'))
+                    ->query(fn (Builder $query) => $query
+                        ->whereIn('id', Media::query()->get()
+                            ->reject(fn (Media $m) => $m->exists())
+                            ->pluck('id'))),
+            ])
+            ->recordActions([
+                Action::make('open')
+                    ->label(__('panel.media.actions.open'))
+                    ->icon('heroicon-o-arrow-top-right-on-square')
+                    ->url(fn (Media $record) => $record->url())
+                    ->openUrlInNewTab(),
+
+                Action::make('reprocess')
+                    ->label(__('panel.media.actions.reprocess'))
+                    ->icon('heroicon-o-arrow-path')
+                    ->color('gray')
+                    ->action(function (Media $record): void {
+                        ProcessMedia::dispatch($record);
+
+                        Notification::make()
+                            ->title(__('panel.media.actions.reprocess_queued'))
+                            ->success()
+                            ->send();
+                    }),
+
+                // Only offered for files nothing points at: deleting one in
+                // use would put a broken image on the public site.
+                DeleteAction::make()
+                    ->visible(fn (Media $record) => ! $record->isReferenced())
+                    ->before(function (Media $record): void {
+                        $record->deleteDerived();
+                        Storage::disk($record->disk)->delete($record->path);
+                    }),
+            ])
+            ->emptyStateHeading(__('panel.media.empty.heading'))
+            ->emptyStateDescription(__('panel.media.empty.description'))
+            ->emptyStateIcon('heroicon-o-photo');
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['path'];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListMedia::route('/'),
+        ];
+    }
+
+    public static function getNavigationBadge(): ?string
+    {
+        $pending = static::getModel()::query()->pending()->count();
+
+        return $pending > 0 ? (string) $pending : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'warning';
+    }
+}

app/Filament/Resources/Media/Pages/ListMedia.php

@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Media\Pages;
+
+use App\Filament\Resources\Media\MediaResource;
+use App\Models\Media;
+use Filament\Actions\Action;
+use Filament\Notifications\Notification;
+use Filament\Resources\Pages\ListRecords;
+use Illuminate\Support\Facades\Auth;
+
+class ListMedia extends ListRecords
+{
+    protected static string $resource = MediaResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            // The media table is derived, so rebuilding it is always safe and
+            // is the answer to "I changed the widths, now what?".
+            Action::make('reprocess_all')
+                ->label(__('panel.media.actions.reprocess_all'))
+                ->icon('heroicon-o-arrow-path')
+                ->color('gray')
+                ->requiresConfirmation()
+                ->modalDescription(__('panel.media.actions.reprocess_all_hint'))
+                ->visible(fn () => Auth::user()?->can('media.view_any'))
+                ->action(function (): void {
+                    Media::query()->update(['processed_at' => null]);
+
+                    Notification::make()
+                        ->title(__('panel.media.actions.reprocess_queued'))
+                        ->success()
+                        ->send();
+                }),
+        ];
+    }
+
+    public function getSubheading(): ?string
+    {
+        $total = Media::query()->get()->sum(fn (Media $m) => $m->totalSize());
+
+        return __('panel.media.subheading', [
+            'count' => Media::query()->count(),
+            'size' => round($total / 1024 / 1024, 1),
+        ]);
+    }
+}

app/Filament/Resources/Members/MemberResource.php

@@ -0,0 +1,93 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Members;
+
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Members\Pages\CreateMember;
+use App\Filament\Resources\Members\Pages\EditMember;
+use App\Filament\Resources\Members\Pages\ListMembers;
+use App\Filament\Resources\Members\Schemas\MemberForm;
+use App\Filament\Resources\Members\Tables\MembersTable;
+use App\Models\Member;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\SoftDeletingScope;
+use UnitEnum;
+
+/**
+ * People in the collective.
+ *
+ * Deliberately separate from User: most members never need panel access, and
+ * removing someone's admin rights must not remove them from the website.
+ */
+class MemberResource extends Resource
+{
+    protected static ?string $model = Member::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedUserGroup;
+
+    protected static ?int $navigationSort = 2;
+
+    protected static ?string $recordTitleAttribute = 'name';
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.members.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.members.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return MemberForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return MembersTable::configure($table);
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['name'];
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            RevisionsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListMembers::route('/'),
+            'create' => CreateMember::route('/create'),
+            'edit' => EditMember::route('/{record}/edit'),
+        ];
+    }
+
+    public static function getRecordRouteBindingEloquentQuery(): Builder
+    {
+        return parent::getRecordRouteBindingEloquentQuery()
+            ->withoutGlobalScopes([SoftDeletingScope::class]);
+    }
+}

app/Filament/Resources/Members/Pages/CreateMember.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Members\Pages;
+
+use App\Filament\Resources\Members\MemberResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateMember extends CreateRecord
+{
+    protected static string $resource = MemberResource::class;
+}

app/Filament/Resources/Members/Pages/EditMember.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Members\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Members\MemberResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditMember extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = MemberResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Members/Pages/ListMembers.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Members\Pages;
+
+use App\Filament\Resources\Members\MemberResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListMembers extends ListRecords
+{
+    protected static string $resource = MemberResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Members/Schemas/MemberForm.php

@@ -0,0 +1,121 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Members\Schemas;
+
+use App\Filament\Support\TranslatableTabs;
+use Filament\Forms\Components\DatePicker;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
+
+class MemberForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()
+                ->columns(2)
+                ->schema([
+                    TextInput::make('name')
+                        ->label(__('panel.members.fields.name'))
+                        ->required()
+                        ->maxLength(255)
+                        ->live(onBlur: true)
+                        ->afterStateUpdated(function (?string $state, callable $get, callable $set) {
+                            if (blank($get('slug'))) {
+                                $set('slug', Str::slug((string) $state));
+                            }
+                        }),
+
+                    TextInput::make('slug')
+                        ->label(__('panel.members.fields.slug'))
+                        ->required()
+                        ->maxLength(255)
+                        ->rules(fn ($record) => [Rule::unique('members', 'slug')->ignore($record?->id)]),
+
+                    FileUpload::make('avatar')
+                        ->label(__('panel.members.fields.avatar'))
+                        ->image()
+                        ->avatar()
+                        // Explicit: the default disk is private, and the
+                        // frontend runs on another host.
+                        ->disk(config('media.disk'))
+                        ->directory('members')
+                        ->imageEditor()
+                        // A portrait is described by the person's name, so
+                        // there is no alt field here to fill in wrong.
+                        ->helperText(__('panel.members.fields.avatar_hint')),
+
+                    // The link that makes commit attribution and the git
+                    // integration line up with a real person.
+                    TextInput::make('github_username')
+                        ->label(__('panel.members.fields.github_username'))
+                        ->prefix('github.com/')
+                        ->maxLength(120),
+
+                    Select::make('user_id')
+                        ->label(__('panel.members.fields.user'))
+                        ->relationship('user', 'name')
+                        ->searchable()
+                        ->preload()
+                        ->helperText(__('panel.members.fields.user_hint')),
+
+                    Select::make('technologies')
+                        ->label(__('panel.members.fields.technologies'))
+                        ->relationship('technologies', 'name')
+                        ->multiple()
+                        ->preload()
+                        ->searchable(),
+                ]),
+
+            Section::make(__('panel.members.sections.profile'))
+                ->description(__('panel.members.sections.profile_hint'))
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale, bool $isDefault) => [
+                        TextInput::make("headline.{$locale}")
+                            ->label(__('panel.members.fields.headline'))
+                            ->maxLength(255)
+                            ->columnSpanFull(),
+
+                        Textarea::make("bio.{$locale}")
+                            ->label(__('panel.members.fields.bio'))
+                            ->rows(5)
+                            ->columnSpanFull(),
+                    ]),
+                ]),
+
+            Section::make(__('panel.members.sections.membership'))
+                ->columns(3)
+                ->schema([
+                    Toggle::make('is_public')
+                        ->label(__('panel.members.fields.is_public'))
+                        ->default(true),
+
+                    Toggle::make('is_founder')
+                        ->label(__('panel.members.fields.is_founder')),
+
+                    TextInput::make('position')
+                        ->label(__('panel.members.fields.position'))
+                        ->numeric()
+                        ->default(0),
+
+                    DatePicker::make('joined_at')
+                        ->label(__('panel.members.fields.joined_at')),
+
+                    // Leaving hides them from the current roster without
+                    // erasing the work they did.
+                    DatePicker::make('left_at')
+                        ->label(__('panel.members.fields.left_at'))
+                        ->helperText(__('panel.members.fields.left_at_hint')),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/Members/Tables/MembersTable.php

@@ -0,0 +1,102 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Members\Tables;
+
+use App\Models\Member;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\ImageColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+
+class MembersTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->defaultSort('position')
+            ->reorderable('position')
+            ->columns([
+                ImageColumn::make('avatar')
+                    ->label('')
+                    ->circular()
+                    ->disk(config('media.disk'))
+                    ->defaultImageUrl(fn (Member $r) => 'https://ui-avatars.com/api/?name='.urlencode($r->name)),
+
+                TextColumn::make('name')
+                    ->label(__('panel.members.fields.name'))
+                    ->weight('medium')
+                    ->description(fn (Member $r) => $r->getTranslation('headline', app()->getLocale(), false) ?: null)
+                    ->searchable(['name', 'slug', 'github_username'])
+                    ->sortable(),
+
+                TextColumn::make('technologies.name')
+                    ->label(__('panel.members.fields.technologies'))
+                    ->badge()
+                    ->color('gray')
+                    ->limitList(3)
+                    ->expandableLimitedList()
+                    ->toggleable(),
+
+                TextColumn::make('projects_count')
+                    ->label(__('panel.members.fields.projects'))
+                    ->counts('projects')
+                    ->badge(),
+
+                IconColumn::make('is_founder')
+                    ->label(__('panel.members.fields.is_founder'))
+                    ->boolean()
+                    ->toggleable(),
+
+                IconColumn::make('is_public')
+                    ->label(__('panel.members.fields.is_public'))
+                    ->boolean(),
+
+                TextColumn::make('left_at')
+                    ->label(__('panel.members.fields.left_at'))
+                    ->date()
+                    ->placeholder('—')
+                    ->toggleable(),
+            ])
+            ->filters([
+                TernaryFilter::make('is_public')
+                    ->label(__('panel.members.fields.is_public')),
+
+                SelectFilter::make('technologies')
+                    ->label(__('panel.members.fields.technologies'))
+                    ->relationship('technologies', 'name')
+                    ->multiple()
+                    ->preload(),
+
+                Filter::make('current')
+                    ->label(__('panel.members.filters.current'))
+                    ->default()
+                    ->query(fn (Builder $q) => $q->whereNull('left_at')),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ]);
+    }
+}

app/Filament/Resources/MissingUrls/MissingUrlResource.php

@@ -0,0 +1,287 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\MissingUrls;
+
+use App\Enums\MissingUrlStatus;
+use App\Filament\Resources\MissingUrls\Pages\ListMissingUrls;
+use App\Models\MissingUrl;
+use App\Models\Redirect;
+use BackedEnum;
+use Filament\Actions\Action;
+use Filament\Actions\BulkAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Notifications\Notification;
+use Filament\Resources\Resource;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Database\Eloquent\Model;
+use UnitEnum;
+
+/**
+ * Addresses visitors asked for and the frontend could not answer.
+ *
+ * Redirects were only ever written from one side: a slug renamed here leaves a
+ * note behind, because that is the moment the old address is still known. The
+ * links that break without anybody renaming anything — the previous website's,
+ * an address on a poster, another site's link to a page that moved years ago —
+ * failed silently, in front of a visitor, and never reached this panel.
+ *
+ * This is the other half. Nothing here is authored: rows arrive from the
+ * frontend, and the only decision to make about one is whether it deserves a
+ * redirect. Which is why the whole screen is really one button.
+ */
+class MissingUrlResource extends Resource
+{
+    protected static ?string $model = MissingUrl::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedMagnifyingGlassCircle;
+
+    // Directly under Redirects: the two are read together, and this one is
+    // where the other one's entries come from.
+    protected static ?int $navigationSort = 86;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.missing_urls.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.missing_urls.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->path;
+    }
+
+    public static function canCreate(): bool
+    {
+        // These are reported, not written. A hand-typed one would be a
+        // redirect somebody had not got round to creating yet.
+        return false;
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            // Worst first: how many people hit it, not when it last happened.
+            // One address requested two hundred times is the whole point of
+            // the screen; a hundred requested once each are noise.
+            ->defaultSort('hits', 'desc')
+            ->columns([
+                TextColumn::make('path')
+                    ->label(__('panel.missing_urls.fields.path'))
+                    ->fontFamily('mono')
+                    ->searchable()
+                    ->wrap()
+                    // The strongest signal on the row: a referrer on our own
+                    // domain means something we publish links here.
+                    ->description(fn (MissingUrl $record) => $record->isInternalReferrer()
+                        ? __('panel.missing_urls.linked_from_us')
+                        : null),
+
+                TextColumn::make('hits')
+                    ->label(__('panel.missing_urls.fields.hits'))
+                    ->badge()
+                    ->color(fn (int $state) => match (true) {
+                        $state >= 10 => 'danger',
+                        $state >= 2 => 'warning',
+                        default => 'gray',
+                    })
+                    ->sortable(),
+
+                TextColumn::make('locale')
+                    ->label(__('panel.missing_urls.fields.locale'))
+                    ->badge()
+                    ->color('gray')
+                    ->toggleable(),
+
+                TextColumn::make('status')
+                    ->label(__('panel.missing_urls.fields.status'))
+                    ->badge(),
+
+                TextColumn::make('referrer')
+                    ->label(__('panel.missing_urls.fields.referrer'))
+                    ->placeholder(__('panel.missing_urls.no_referrer'))
+                    ->wrap()
+                    ->size('xs')
+                    ->color(fn (MissingUrl $record) => $record->isInternalReferrer() ? 'danger' : 'gray')
+                    ->toggleable(),
+
+                TextColumn::make('last_seen_at')
+                    ->label(__('panel.missing_urls.fields.last_seen'))
+                    ->since()
+                    ->dateTimeTooltip()
+                    ->sortable(),
+            ])
+            ->filters([
+                SelectFilter::make('status')
+                    ->label(__('panel.missing_urls.fields.status'))
+                    ->options(MissingUrlStatus::options())
+                    // The list is a to-do list, so it opens as one.
+                    ->default(MissingUrlStatus::Pending->value),
+
+                Filter::make('internal')
+                    ->label(__('panel.missing_urls.filters.internal'))
+                    ->query(fn (Builder $query) => $query
+                        ->where('referrer', 'like', rtrim((string) config('site.url'), '/').'%')),
+
+                Filter::make('repeated')
+                    ->label(__('panel.missing_urls.filters.repeated'))
+                    ->query(fn (Builder $query) => $query->where('hits', '>=', 2)),
+            ])
+            ->recordActions([
+                Action::make('redirect')
+                    ->label(__('panel.missing_urls.actions.redirect'))
+                    ->icon('heroicon-o-arrows-right-left')
+                    ->color('primary')
+                    ->authorize('redirect')
+                    ->visible(fn (MissingUrl $record) => $record->status !== MissingUrlStatus::Resolved)
+                    ->modalHeading(__('panel.missing_urls.actions.redirect_heading'))
+                    ->modalDescription(__('panel.missing_urls.actions.redirect_hint'))
+                    ->schema([
+                        // Read-only: the origin is the address that failed. It
+                        // is here to be seen while typing the destination, not
+                        // to be edited.
+                        TextInput::make('from')
+                            ->label(__('panel.redirects.fields.from'))
+                            ->disabled()
+                            ->dehydrated(false)
+                            ->default(fn (MissingUrl $record) => $record->path),
+
+                        TextInput::make('to')
+                            ->label(__('panel.redirects.fields.to'))
+                            ->required()
+                            ->maxLength(500)
+                            ->placeholder('/proyectos/nombre-nuevo')
+                            ->dehydrateStateUsing(fn (string $state) => Redirect::normalise($state)),
+
+                        Select::make('status')
+                            ->label(__('panel.redirects.fields.status'))
+                            ->options([
+                                301 => __('panel.redirects.statuses.301'),
+                                302 => __('panel.redirects.statuses.302'),
+                            ])
+                            ->default(301)
+                            ->required(),
+
+                        Select::make('locale')
+                            ->label(__('panel.redirects.fields.locale'))
+                            ->helperText(__('panel.missing_urls.actions.locale_hint'))
+                            ->options(fn () => collect(config('locales.supported'))
+                                ->map(fn (array $meta, string $code) => $meta['native'] ?? $code)
+                                ->all())
+                            ->default(fn (MissingUrl $record) => $record->locale)
+                            ->placeholder(__('panel.redirects.every_locale')),
+                    ])
+                    ->action(function (MissingUrl $record, array $data): void {
+                        // The record is marked resolved by the redirect being
+                        // created, not from here, so a rule written anywhere
+                        // else closes its report too.
+                        Redirect::create([
+                            'from' => $record->path,
+                            'to' => $data['to'],
+                            'status' => $data['status'],
+                            'locale' => $data['locale'] ?? null,
+                            'is_enabled' => true,
+                        ]);
+
+                        Notification::make()
+                            ->title(__('panel.missing_urls.actions.redirected'))
+                            ->success()
+                            ->send();
+                    }),
+
+                Action::make('ignore')
+                    ->label(__('panel.missing_urls.actions.ignore'))
+                    ->icon('heroicon-o-eye-slash')
+                    ->color('gray')
+                    ->authorize('update')
+                    ->visible(fn (MissingUrl $record) => $record->status !== MissingUrlStatus::Ignored)
+                    ->action(fn (MissingUrl $record) => $record->update([
+                        'status' => MissingUrlStatus::Ignored,
+                    ])),
+
+                Action::make('unignore')
+                    ->label(__('panel.missing_urls.actions.unignore'))
+                    ->icon('heroicon-o-eye')
+                    ->color('gray')
+                    ->authorize('update')
+                    ->visible(fn (MissingUrl $record) => $record->status === MissingUrlStatus::Ignored)
+                    ->action(fn (MissingUrl $record) => $record->update([
+                        'status' => MissingUrlStatus::Pending,
+                    ])),
+
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    // The bulk action that matters: a scan produces dozens of
+                    // rows at once and dismissing them one by one is how a
+                    // list stops being read.
+                    BulkAction::make('ignore')
+                        ->label(__('panel.missing_urls.actions.ignore'))
+                        ->icon('heroicon-o-eye-slash')
+                        ->authorize('updateAny')
+                        ->deselectRecordsAfterCompletion()
+                        ->action(fn (Collection $records) => MissingUrl::query()
+                            ->whereKey($records->pluck('id'))
+                            ->update(['status' => MissingUrlStatus::Ignored])),
+
+                    DeleteBulkAction::make(),
+                ]),
+            ])
+            ->emptyStateHeading(__('panel.missing_urls.empty.heading'))
+            ->emptyStateDescription(__('panel.missing_urls.empty.description'))
+            ->emptyStateIcon('heroicon-o-magnifying-glass-circle');
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['path'];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListMissingUrls::route('/'),
+        ];
+    }
+
+    /**
+     * Only what somebody still has to decide about, and only when it has
+     * happened more than once — a badge counting one-off scans would be a
+     * number that never reaches zero, which is a number nobody looks at.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        $pending = static::getModel()::query()->pending()->where('hits', '>=', 2)->count();
+
+        return $pending > 0 ? (string) $pending : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'warning';
+    }
+}

app/Filament/Resources/MissingUrls/Pages/ListMissingUrls.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\MissingUrls\Pages;
+
+use App\Filament\Resources\MissingUrls\MissingUrlResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListMissingUrls extends ListRecords
+{
+    protected static string $resource = MissingUrlResource::class;
+
+    // No create action: the frontend is the only author there is.
+    protected function getHeaderActions(): array
+    {
+        return [];
+    }
+}

app/Filament/Resources/Pages/PageResource.php

@@ -0,0 +1,103 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages;
+
+use App\Filament\RelationManagers\ReviewsRelationManager;
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Pages\Pages\CreatePage;
+use App\Filament\Resources\Pages\Pages\EditPage;
+use App\Filament\Resources\Pages\Pages\ListPages;
+use App\Filament\Resources\Pages\Schemas\PageForm;
+use App\Filament\Resources\Pages\Tables\PagesTable;
+use App\Models\Page;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\SoftDeletingScope;
+use UnitEnum;
+
+class PageResource extends Resource
+{
+    protected static ?string $model = Page::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedDocumentText;
+
+    protected static ?int $navigationSort = 10;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.pages.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.pages.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.content');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->getTranslation('title', app()->getLocale());
+    }
+
+    /**
+     * Global search looks inside the admin's current language only, so results
+     * read the way they expect rather than surfacing a stray English match.
+     *
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['title->'.app()->getLocale()];
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return PageForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return PagesTable::configure($table);
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            ReviewsRelationManager::class,
+            RevisionsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListPages::route('/'),
+            'create' => CreatePage::route('/create'),
+            'edit' => EditPage::route('/{record}/edit'),
+        ];
+    }
+
+    public static function getRecordRouteBindingEloquentQuery(): Builder
+    {
+        return parent::getRecordRouteBindingEloquentQuery()
+            ->withoutGlobalScopes([SoftDeletingScope::class]);
+    }
+
+    public static function getNavigationBadge(): ?string
+    {
+        $drafts = static::getModel()::query()->where('status', 'draft')->count();
+
+        return $drafts > 0 ? (string) $drafts : null;
+    }
+}

app/Filament/Resources/Pages/Pages/CreatePage.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Pages;
+
+use App\Enums\PageStatus;
+use App\Filament\Resources\Pages\PageResource;
+use Filament\Resources\Pages\CreateRecord;
+use Illuminate\Support\Facades\Auth;
+
+class CreatePage extends CreateRecord
+{
+    protected static string $resource = PageResource::class;
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function mutateFormDataBeforeCreate(array $data): array
+    {
+        $data['author_id'] ??= Auth::id();
+
+        // Creating something already marked published goes live now unless a
+        // date was chosen deliberately.
+        if (($data['status'] ?? null) === PageStatus::Published->value && blank($data['published_at'] ?? null)) {
+            $data['published_at'] = now();
+        }
+
+        return $data;
+    }
+}

app/Filament/Resources/Pages/Pages/EditPage.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Pages;
+
+use App\Enums\PageStatus;
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Pages\PageResource;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\ForceDeleteAction;
+use Filament\Actions\RestoreAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditPage extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = PageResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+            ForceDeleteAction::make(),
+            RestoreAction::make(),
+        ];
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function mutateFormDataBeforeSave(array $data): array
+    {
+        if (($data['status'] ?? null) === PageStatus::Published->value && blank($data['published_at'] ?? null)) {
+            $data['published_at'] = now();
+        }
+
+        return $data;
+    }
+}

app/Filament/Resources/Pages/Pages/ListPages.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Pages;
+
+use App\Filament\Resources\Pages\PageResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListPages extends ListRecords
+{
+    protected static string $resource = PageResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Pages/Schemas/PageForm.php

@@ -0,0 +1,176 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Schemas;
+
+use App\Enums\PageStatus;
+use App\Filament\Resources\Pages\PageResource;
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Page;
+use App\Rules\UniqueTranslatedSlug;
+use App\Support\DuplicateTitles;
+use Filament\Forms\Components\DateTimePicker;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\RichEditor;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Str;
+
+class PageForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make(__('panel.pages.sections.content'))
+                ->description(__('panel.pages.sections.content_hint'))
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale, bool $isDefault) => [
+                        TextInput::make("title.{$locale}")
+                            ->label(__('panel.pages.fields.title'))
+                            ->required($isDefault)
+                            ->maxLength(255)
+                            ->columnSpanFull()
+                            ->live(onBlur: true)
+                            ->afterStateUpdated(function (?string $state, ?Model $record, callable $get, callable $set) use ($locale, $isDefault) {
+                                if (blank($get("slug.{$locale}"))) {
+                                    $set("slug.{$locale}", Str::slug((string) $state));
+                                }
+
+                                // Only the language content is actually
+                                // written in matters here: a near-duplicate
+                                // in a language nobody is looking at right
+                                // now would be a warning about the wrong
+                                // thing.
+                                if ($isDefault) {
+                                    DuplicateTitles::warnIfSimilar(
+                                        Page::class,
+                                        PageResource::class,
+                                        $state,
+                                        $locale,
+                                        $record?->getKey(),
+                                    );
+                                }
+                            }),
+
+                        TextInput::make("slug.{$locale}")
+                            ->label(__('panel.pages.fields.slug'))
+                            ->required($isDefault)
+                            ->maxLength(255)
+                            ->columnSpanFull()
+                            ->rules(fn ($record) => [new UniqueTranslatedSlug(Page::class, $record?->id)]),
+
+                        Textarea::make("excerpt.{$locale}")
+                            ->label(__('panel.pages.fields.excerpt'))
+                            ->rows(2)
+                            ->maxLength(500)
+                            ->columnSpanFull(),
+
+                        RichEditor::make("body.{$locale}")
+                            ->label(__('panel.pages.fields.body'))
+                            ->columnSpanFull(),
+                    ]),
+                ]),
+
+            Section::make(__('panel.pages.sections.publishing'))
+                ->columns(2)
+                ->schema([
+                    Select::make('status')
+                        ->label(__('panel.pages.fields.status'))
+                        ->options(PageStatus::class)
+                        ->default(PageStatus::Draft)
+                        ->required()
+                        ->live()
+                        // Editing content and pushing it live are separate
+                        // permissions, so the status field itself is locked
+                        // for users who may only write.
+                        ->disabled(fn () => Auth::user()?->cannot('pages.publish'))
+                        ->dehydrated(),
+
+                    DateTimePicker::make('published_at')
+                        ->label(__('panel.pages.fields.published_at'))
+                        ->seconds(false)
+                        ->helperText(__('panel.pages.fields.published_at_hint')),
+
+                    // The date nobody remembers on their own. A notice about
+                    // something that already happened stays up until somebody
+                    // trips over it.
+                    DateTimePicker::make('unpublish_at')
+                        ->label(__('panel.pages.fields.unpublish_at'))
+                        ->helperText(__('panel.pages.fields.unpublish_at_hint'))
+                        ->seconds(false)
+                        ->after('published_at')
+                        ->disabled(fn () => Auth::user()?->cannot('pages.publish'))
+                        ->dehydrated(),
+
+                    Select::make('category_id')
+                        ->label(__('panel.pages.fields.category'))
+                        ->relationship('category', 'name->'.config('locales.default'))
+                        ->searchable()
+                        ->preload(),
+
+                    Select::make('author_id')
+                        ->label(__('panel.pages.fields.author'))
+                        ->relationship('author', 'name')
+                        ->searchable()
+                        ->preload()
+                        ->default(fn () => Auth::id())
+                        ->visible(fn () => Auth::user()?->can('users.view_any')),
+
+                    FileUpload::make('featured_image')
+                        ->label(__('panel.pages.fields.featured_image'))
+                        ->image()
+                        // Explicit: the default disk is private, and the
+                        // frontend runs on another host and has to be able to
+                        // fetch what you upload.
+                        ->disk(config('media.disk'))
+                        ->directory('pages')
+                        ->imageEditor()
+                        // So the description field appears as soon as there is
+                        // something to describe.
+                        ->live()
+                        ->columnSpanFull(),
+
+                    // Alt text lives with the record rather than with the
+                    // file, because the same image can need a different
+                    // description depending on where it is used.
+                    TranslatableTabs::make(fn (string $locale) => [
+                        TextInput::make("featured_image_alt.{$locale}")
+                            ->label(__('panel.pages.fields.featured_image_alt'))
+                            ->helperText(__('panel.pages.fields.featured_image_alt_hint'))
+                            ->maxLength(255)
+                            ->columnSpanFull(),
+                    ])
+                        ->visible(fn (callable $get) => filled($get('featured_image')))
+                        ->columnSpanFull(),
+
+                    Toggle::make('is_featured')
+                        ->label(__('panel.pages.fields.is_featured')),
+                ]),
+
+            Section::make(__('panel.pages.sections.seo'))
+                ->description(__('panel.pages.sections.seo_hint'))
+                ->collapsed()
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale) => [
+                        TextInput::make("meta_title.{$locale}")
+                            ->label(__('panel.pages.fields.meta_title'))
+                            ->maxLength(60)
+                            ->columnSpanFull(),
+
+                        Textarea::make("meta_description.{$locale}")
+                            ->label(__('panel.pages.fields.meta_description'))
+                            ->rows(2)
+                            ->maxLength(160)
+                            ->columnSpanFull(),
+                    ], label: __('panel.pages.sections.seo')),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/Pages/Tables/PagesTable.php

@@ -0,0 +1,270 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Tables;
+
+use App\Enums\PageStatus;
+use App\Filament\Support\PreviewAction;
+use App\Filament\Support\ReviewActions;
+use App\Filament\Support\ReviewStatusColumn;
+use App\Filament\Support\TranslationStatusColumn;
+use App\Filament\Support\ViewsColumn;
+use App\Models\Page;
+use App\Support\TranslationFreshness;
+use Filament\Actions\Action;
+use Filament\Actions\BulkAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\ReplicateAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Notifications\Notification;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Facades\Auth;
+
+class PagesTable
+{
+    public static function configure(Table $table): Table
+    {
+        $locale = app()->getLocale();
+
+        return $table
+            // One grouped query for the whole page of rows, so the reading
+            // figures cost the listing nothing per row.
+            ->modifyQueryUsing(fn (Builder $query) => $query->withRecentViews())
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                TextColumn::make('title')
+                    ->label(__('panel.pages.fields.title'))
+                    ->weight('medium')
+                    ->description(fn (Page $record) => $record->getTranslation('slug', $locale, false) ?: null)
+                    ->searchable(query: fn (Builder $query, string $search) => $query
+                        ->where("title->{$locale}", 'like', "%{$search}%"))
+                    ->sortable(query: fn (Builder $query, string $direction) => $query
+                        ->orderBy("title->{$locale}", $direction)),
+
+                TranslationStatusColumn::make('translations')
+                    ->label(__('panel.pages.fields.translations'))
+                    ->trackedAttribute('title'),
+
+                // The state the *site* is in, not only the one stored. A
+                // page waiting for its date, or one whose date has passed, is
+                // not "Published" however the column reads.
+                TextColumn::make('status')
+                    ->label(__('panel.pages.fields.status'))
+                    ->badge()
+                    ->formatStateUsing(fn (PageStatus $state, Page $record) => match (true) {
+                        $record->hasExpired() => __('panel.publishing.expired'),
+                        $record->isScheduled() && $state === PageStatus::Published => __('panel.publishing.scheduled'),
+                        default => $state->getLabel(),
+                    })
+                    ->color(fn (PageStatus $state, Page $record) => match (true) {
+                        $record->hasExpired() => 'gray',
+                        $record->isScheduled() && $state === PageStatus::Published => 'info',
+                        default => $state->getColor(),
+                    })
+                    ->description(fn (Page $record) => match (true) {
+                        $record->hasExpired() => __('panel.publishing.expired_at', ['time' => $record->unpublish_at->isoFormat('LLL')]),
+                        $record->isScheduled() => $record->published_at->diffForHumans(),
+                        $record->expiresSoon() => __('panel.publishing.expires_in', ['time' => $record->unpublish_at->diffForHumans()]),
+                        default => null,
+                    })
+                    ->sortable(),
+
+                ReviewStatusColumn::make('review')
+                    ->label(__('panel.reviews.column')),
+
+                TextColumn::make('category.name')
+                    ->label(__('panel.pages.fields.category'))
+                    ->badge()
+                    ->color('gray')
+                    ->toggleable(),
+
+                TextColumn::make('author.name')
+                    ->label(__('panel.pages.fields.author'))
+                    ->toggleable(isToggledHiddenByDefault: true),
+
+                IconColumn::make('is_featured')
+                    ->label(__('panel.pages.fields.is_featured'))
+                    ->boolean()
+                    ->toggleable(),
+
+                ViewsColumn::make('recent_views')
+                    ->label(__('panel.views.column'))
+                    ->tooltip(__('panel.views.column_hint')),
+
+                TextColumn::make('published_at')
+                    ->label(__('panel.pages.fields.published_at'))
+                    ->dateTime()
+                    ->sortable()
+                    ->placeholder('—'),
+            ])
+            ->filters([
+                SelectFilter::make('status')
+                    ->label(__('panel.pages.fields.status'))
+                    ->options(PageStatus::options())
+                    ->multiple(),
+
+                // The reviewer's own queue. Unaddressed requests are in it
+                // too: a review nobody was named for is everybody's.
+                Filter::make('awaiting_review')
+                    ->label(__('panel.reviews.filters.mine'))
+                    ->query(fn (Builder $query) => Auth::user()
+                        ? $query->awaitingReviewBy(Auth::user())
+                        : $query->awaitingReview()),
+
+                SelectFilter::make('category')
+                    ->label(__('panel.pages.fields.category'))
+                    ->relationship('category', 'name->'.config('locales.default'))
+                    ->searchable()
+                    ->preload(),
+
+                TernaryFilter::make('is_featured')
+                    ->label(__('panel.pages.fields.is_featured')),
+
+                // The editorial workhorse: "what still needs translating?"
+                SelectFilter::make('missing_translation')
+                    ->label(__('panel.pages.filters.missing_translation'))
+                    ->options(fn () => collect(config('locales.supported'))
+                        ->map(fn (array $meta, string $code) => $meta['native'] ?? $code)
+                        ->all())
+                    ->query(function (Builder $query, array $data): Builder {
+                        if (blank($data['value'] ?? null)) {
+                            return $query;
+                        }
+
+                        $target = $data['value'];
+
+                        return $query->where(fn (Builder $q) => $q
+                            ->whereNull("title->{$target}")
+                            ->orWhere("title->{$target}", ''));
+                    }),
+
+                // Translated and left behind by the original. Worked out
+                // from the change history rather than a column, so it is
+                // resolved here and handed to the query as a list.
+                Filter::make('stale_translation')
+                    ->label(__('panel.translations.filters.stale'))
+                    ->query(fn (Builder $query) => $query->whereIn(
+                        'id',
+                        TranslationFreshness::staleIds($query->getModel()::query()),
+                    )),
+
+                Filter::make('published')
+                    ->label(__('enums.page_status.published'))
+                    ->query(fn (Builder $query) => $query->published()),
+
+                // Published and, as far as anybody can tell, read by nobody.
+                Filter::make('unread')
+                    ->label(__('panel.views.filters.unread'))
+                    ->query(fn (Builder $query) => $query
+                        ->published()
+                        ->whereDoesntHave('views', fn (Builder $views) => $views->since(30))),
+
+                Filter::make('scheduled')
+                    ->label(__('panel.publishing.scheduled'))
+                    ->query(fn (Builder $query) => $query->scheduled()),
+
+                Filter::make('expired')
+                    ->label(__('panel.publishing.expired'))
+                    ->query(fn (Builder $query) => $query->expired()),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                ReviewActions::request(),
+                ReviewActions::returnForChanges(),
+
+                // One-click publish for users who hold the separate
+                // pages.publish permission.
+                Action::make('publish')
+                    ->label(__('panel.pages.actions.publish'))
+                    ->icon('heroicon-o-check-circle')
+                    ->color('success')
+                    ->requiresConfirmation()
+                    ->visible(fn (Page $record) => $record->status !== PageStatus::Published
+                        && Auth::user()?->can('publish', $record))
+                    ->action(fn (Page $record) => $record->update([
+                        'status' => PageStatus::Published,
+                        'published_at' => $record->published_at ?? now(),
+                    ])),
+
+                Action::make('unpublish')
+                    ->label(__('panel.pages.actions.unpublish'))
+                    ->icon('heroicon-o-eye-slash')
+                    ->color('warning')
+                    ->requiresConfirmation()
+                    ->visible(fn (Page $record) => $record->status === PageStatus::Published
+                        && Auth::user()?->can('publish', $record))
+                    ->action(fn (Page $record) => $record->update(['status' => PageStatus::Draft])),
+
+                // A near-copy is a real workflow: the third similar service,
+                // next year's call. The slug is cleared because two records
+                // cannot answer at the same URL.
+                ReplicateAction::make()
+                    ->label(__('panel.actions.duplicate'))
+                    ->icon('heroicon-o-document-duplicate')
+                    ->excludeAttributes(['slug', 'published_at', 'unpublish_at'])
+                    ->modalHeading(__('panel.actions.duplicate_heading'))
+                    ->successNotificationTitle(__('panel.actions.duplicated')),
+
+                PreviewAction::for('page'),
+
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    ReviewActions::requestBulk(Page::class),
+
+                    BulkAction::make('publish')
+                        ->label(__('panel.pages.actions.publish'))
+                        ->icon('heroicon-o-check-circle')
+                        ->color('success')
+                        ->requiresConfirmation()
+                        ->visible(fn () => Auth::user()?->can('pages.publish') ?? false)
+                        ->deselectRecordsAfterCompletion()
+                        ->action(function (Collection $records): void {
+                            $published = 0;
+
+                            // One at a time, not a single UPDATE across every
+                            // selected row: publishing fires the revision
+                            // entry and closes any pending review, and a mass
+                            // update would skip both without a sound.
+                            foreach ($records as $record) {
+                                if ($record->status === PageStatus::Published) {
+                                    continue;
+                                }
+
+                                $record->update([
+                                    'status' => PageStatus::Published,
+                                    'published_at' => $record->published_at ?? now(),
+                                ]);
+
+                                $published++;
+                            }
+
+                            Notification::make()
+                                ->title(trans_choice('panel.publishing.published_count', $published, ['count' => $published]))
+                                ->success()
+                                ->send();
+                        }),
+
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ]);
+    }
+}

app/Filament/Resources/Projects/Pages/CreateProject.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\Pages;
+
+use App\Filament\Resources\Projects\ProjectResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateProject extends CreateRecord
+{
+    protected static string $resource = ProjectResource::class;
+}

app/Filament/Resources/Projects/Pages/EditProject.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Projects\ProjectResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditProject extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = ProjectResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Projects/Pages/ListProjects.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\Pages;
+
+use App\Filament\Resources\Projects\ProjectResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListProjects extends ListRecords
+{
+    protected static string $resource = ProjectResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Projects/ProjectResource.php

@@ -0,0 +1,113 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects;
+
+use App\Filament\RelationManagers\ReviewsRelationManager;
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Projects\Pages\CreateProject;
+use App\Filament\Resources\Projects\Pages\EditProject;
+use App\Filament\Resources\Projects\Pages\ListProjects;
+use App\Filament\Resources\Projects\RelationManagers\GalleryRelationManager;
+use App\Filament\Resources\Projects\RelationManagers\RepositoriesRelationManager;
+use App\Filament\Resources\Projects\Schemas\ProjectForm;
+use App\Filament\Resources\Projects\Tables\ProjectsTable;
+use App\Models\Project;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\SoftDeletingScope;
+use UnitEnum;
+
+class ProjectResource extends Resource
+{
+    protected static ?string $model = Project::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedRocketLaunch;
+
+    protected static ?int $navigationSort = 1;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.projects.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.projects.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->getTranslation('title', app()->getLocale());
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['title->'.app()->getLocale()];
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return ProjectForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return ProjectsTable::configure($table);
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            ReviewsRelationManager::class,
+            RevisionsRelationManager::class,
+            GalleryRelationManager::class,
+            RepositoriesRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListProjects::route('/'),
+            'create' => CreateProject::route('/create'),
+            'edit' => EditProject::route('/{record}/edit'),
+        ];
+    }
+
+    public static function getRecordRouteBindingEloquentQuery(): Builder
+    {
+        return parent::getRecordRouteBindingEloquentQuery()
+            ->withoutGlobalScopes([SoftDeletingScope::class]);
+    }
+
+    /**
+     * Surfaces how many projects are asking for contributors — the number the
+     * collective most wants to act on.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        $count = static::getModel()::query()->needingHelp()->count();
+
+        return $count > 0 ? (string) $count : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'warning';
+    }
+}

app/Filament/Resources/Projects/RelationManagers/GalleryRelationManager.php

@@ -0,0 +1,142 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\RelationManagers;
+
+use App\Filament\Support\TranslatableTabs;
+use App\Models\ImageAttachment;
+use Filament\Actions\CreateAction;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\TextInput;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Schemas\Schema;
+use Filament\Tables\Columns\ImageColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * The gallery of a project.
+ *
+ * A table rather than a repeater inside the form, because the thing you need
+ * to see while editing a gallery is the images themselves, and because the
+ * order matters — it is dragged here rather than typed into a number field.
+ */
+class GalleryRelationManager extends RelationManager
+{
+    protected static string $relationship = 'images';
+
+    public static function getTitle(Model $ownerRecord, string $pageClass): string
+    {
+        return __('panel.gallery.title');
+    }
+
+    public static function getBadge(Model $ownerRecord, string $pageClass): ?string
+    {
+        $count = $ownerRecord->images()->count();
+
+        return $count > 0 ? (string) $count : null;
+    }
+
+    public function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            FileUpload::make('path')
+                ->label(__('panel.gallery.fields.image'))
+                ->image()
+                // Explicit: the default disk is private, and the frontend runs
+                // on another host.
+                ->disk(config('media.disk'))
+                ->directory('projects/gallery')
+                ->imageEditor()
+                ->required()
+                ->columnSpanFull(),
+
+            TranslatableTabs::make(fn (string $locale) => [
+                TextInput::make("alt.{$locale}")
+                    ->label(__('panel.gallery.fields.alt'))
+                    ->helperText(__('panel.gallery.fields.alt_hint'))
+                    ->maxLength(255)
+                    ->columnSpanFull(),
+
+                // Shown to everyone, unlike the alt text. "Before" and
+                // "after" belong here.
+                TextInput::make("caption.{$locale}")
+                    ->label(__('panel.gallery.fields.caption'))
+                    ->helperText(__('panel.gallery.fields.caption_hint'))
+                    ->maxLength(255)
+                    ->columnSpanFull(),
+            ])->columnSpanFull(),
+        ]);
+    }
+
+    public function table(Table $table): Table
+    {
+        $locale = app()->getLocale();
+
+        return $table
+            ->defaultSort('position')
+            ->reorderable('position')
+            // The table shows each image's real dimensions; loaded up front so
+            // that costs one query rather than one per row.
+            ->modifyQueryUsing(fn (Builder $query) => $query->with('media'))
+            ->columns([
+                ImageColumn::make('path')
+                    ->label('')
+                    ->disk(config('media.disk'))
+                    ->height(56),
+
+                TextColumn::make('caption')
+                    ->label(__('panel.gallery.fields.caption'))
+                    ->state(fn (ImageAttachment $record) => $record->getTranslation('caption', $locale, false) ?: null)
+                    ->placeholder('—')
+                    ->wrap(),
+
+                TextColumn::make('alt')
+                    ->label(__('panel.gallery.fields.alt'))
+                    ->state(fn (ImageAttachment $record) => $record->getTranslation('alt', $locale, false) ?: null)
+                    // An image nobody described is the one worth spotting from
+                    // the listing.
+                    ->placeholder(__('panel.gallery.missing_alt'))
+                    ->color(fn (ImageAttachment $record) => $record->getTranslation('alt', $locale, false)
+                        ? null
+                        : 'warning')
+                    ->wrap()
+                    ->toggleable(),
+
+                TextColumn::make('media.width')
+                    ->label(__('panel.gallery.fields.size'))
+                    ->state(fn (ImageAttachment $record) => $record->media?->width
+                        ? "{$record->media->width}×{$record->media->height}"
+                        : __('panel.gallery.pending'))
+                    ->badge()
+                    ->color(fn (ImageAttachment $record) => $record->media?->width ? 'gray' : 'warning')
+                    ->toggleable(),
+            ])
+            ->headerActions([
+                CreateAction::make()
+                    ->label(__('panel.gallery.actions.add'))
+                    // New images go at the end rather than jumping to the top.
+                    ->mutateDataUsing(function (array $data): array {
+                        $data['position'] = (int) $this->getOwnerRecord()->images()->max('position') + 1;
+
+                        return $data;
+                    }),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                DeleteBulkAction::make(),
+            ])
+            ->emptyStateHeading(__('panel.gallery.empty.heading'))
+            ->emptyStateDescription(__('panel.gallery.empty.description'))
+            ->emptyStateIcon('heroicon-o-photo');
+    }
+}

app/Filament/Resources/Projects/RelationManagers/RepositoriesRelationManager.php

@@ -0,0 +1,136 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\RelationManagers;
+
+use App\Enums\GitProvider;
+use App\Models\Repository;
+use App\Services\Git\GitException;
+use App\Services\Git\GitManager;
+use Filament\Actions\Action;
+use Filament\Actions\CreateAction;
+use Filament\Actions\DeleteAction;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Notifications\Notification;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Schemas\Schema;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+
+/**
+ * Connect repositories from inside a project, which is where the person adding
+ * them is already working.
+ *
+ * A newly attached repository is synced immediately so its stats appear at
+ * once, rather than staying blank until the hourly schedule runs.
+ */
+class RepositoriesRelationManager extends RelationManager
+{
+    protected static string $relationship = 'repositories';
+
+    public static function getTitle(Model $ownerRecord, string $pageClass): string
+    {
+        return __('panel.repositories.plural');
+    }
+
+    public function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Select::make('provider')
+                ->label(__('panel.repositories.fields.provider'))
+                ->options(GitProvider::class)
+                ->default(GitProvider::default())
+                ->required()
+                ->disableOptionWhen(fn (string $value) => ! GitProvider::from($value)->isSupported()),
+
+            TextInput::make('full_name')
+                ->label(__('panel.repositories.fields.full_name'))
+                ->placeholder('colectivo/mi-proyecto')
+                ->helperText(__('panel.repositories.fields.full_name_hint'))
+                ->required()
+                ->maxLength(255),
+
+            Toggle::make('is_primary')
+                ->label(__('panel.repositories.fields.is_primary')),
+
+            Toggle::make('show_publicly')
+                ->label(__('panel.repositories.fields.show_publicly'))
+                ->default(true),
+        ]);
+    }
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->recordTitleAttribute('full_name')
+            ->columns([
+                TextColumn::make('full_name')
+                    ->label(__('panel.repositories.fields.full_name'))
+                    ->url(fn (Repository $r) => $r->html_url, shouldOpenInNewTab: true),
+
+                TextColumn::make('primary_language')
+                    ->label(__('panel.repositories.fields.language'))
+                    ->badge()
+                    ->placeholder('—'),
+
+                TextColumn::make('stars')->label('★')->badge()->color('warning'),
+
+                TextColumn::make('good_first_issues_count')
+                    ->label(__('panel.repositories.fields.good_first_issues'))
+                    ->counts('goodFirstIssues')
+                    ->badge(),
+
+                TextColumn::make('pushed_at')
+                    ->label(__('panel.repositories.fields.pushed_at'))
+                    ->since()
+                    ->color(fn (Repository $r) => $r->isDormant() ? 'danger' : null)
+                    ->placeholder('—'),
+            ])
+            ->headerActions([
+                CreateAction::make()
+                    // Sync straight away so the stats are not blank until the
+                    // next scheduled run.
+                    ->after(function (Repository $record, GitManager $git): void {
+                        try {
+                            $git->sync($record);
+                        } catch (GitException $e) {
+                            Notification::make()
+                                ->warning()
+                                ->title(__('panel.repositories.notifications.sync_failed'))
+                                ->body($e->getMessage())
+                                ->send();
+                        }
+                    }),
+            ])
+            ->recordActions([
+                Action::make('sync')
+                    ->label(__('panel.repositories.actions.sync'))
+                    ->icon('heroicon-o-arrow-path')
+                    ->color('gray')
+                    ->visible(fn () => Auth::user()?->can('repositories.sync'))
+                    ->action(function (Repository $record, GitManager $git): void {
+                        try {
+                            $git->sync($record);
+
+                            Notification::make()
+                                ->success()
+                                ->title(__('panel.repositories.notifications.synced'))
+                                ->send();
+                        } catch (GitException $e) {
+                            Notification::make()
+                                ->danger()
+                                ->title(__('panel.repositories.notifications.sync_failed'))
+                                ->body($e->getMessage())
+                                ->send();
+                        }
+                    }),
+
+                DeleteAction::make(),
+            ]);
+    }
+}

app/Filament/Resources/Projects/Schemas/ProjectForm.php

@@ -0,0 +1,226 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\Schemas;
+
+use App\Enums\ProjectStatus;
+use App\Filament\Resources\Projects\ProjectResource;
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Project;
+use App\Rules\UniqueTranslatedSlug;
+use App\Support\DuplicateTitles;
+use Filament\Forms\Components\DatePicker;
+use Filament\Forms\Components\DateTimePicker;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\RichEditor;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Str;
+
+class ProjectForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make(__('panel.projects.sections.content'))
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale, bool $isDefault) => [
+                        TextInput::make("title.{$locale}")
+                            ->label(__('panel.projects.fields.title'))
+                            ->required($isDefault)
+                            ->maxLength(255)
+                            ->columnSpanFull()
+                            ->live(onBlur: true)
+                            ->afterStateUpdated(function (?string $state, ?Model $record, callable $get, callable $set) use ($locale, $isDefault) {
+                                if (blank($get("slug.{$locale}"))) {
+                                    $set("slug.{$locale}", Str::slug((string) $state));
+                                }
+
+                                if ($isDefault) {
+                                    DuplicateTitles::warnIfSimilar(
+                                        Project::class,
+                                        ProjectResource::class,
+                                        $state,
+                                        $locale,
+                                        $record?->getKey(),
+                                    );
+                                }
+                            }),
+
+                        TextInput::make("slug.{$locale}")
+                            ->label(__('panel.projects.fields.slug'))
+                            ->required($isDefault)
+                            ->maxLength(255)
+                            ->columnSpanFull()
+                            ->rules(fn ($record) => [new UniqueTranslatedSlug(Project::class, $record?->id)]),
+
+                        Textarea::make("tagline.{$locale}")
+                            ->label(__('panel.projects.fields.tagline'))
+                            ->rows(2)
+                            ->maxLength(300)
+                            ->columnSpanFull(),
+
+                        RichEditor::make("description.{$locale}")
+                            ->label(__('panel.projects.fields.description'))
+                            ->columnSpanFull(),
+                    ]),
+                ]),
+
+            // The part that makes a project worth reading rather than just
+            // looking at. Collapsed by default so it never blocks publishing.
+            Section::make(__('panel.projects.sections.writeup'))
+                ->description(__('panel.projects.sections.writeup_hint'))
+                ->collapsed()
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale) => [
+                        RichEditor::make("decisions.{$locale}")
+                            ->label(__('panel.projects.fields.decisions'))
+                            ->helperText(__('panel.projects.fields.decisions_hint'))
+                            ->columnSpanFull(),
+
+                        RichEditor::make("postmortem.{$locale}")
+                            ->label(__('panel.projects.fields.postmortem'))
+                            ->helperText(__('panel.projects.fields.postmortem_hint'))
+                            ->columnSpanFull(),
+                    ], label: __('panel.projects.sections.writeup')),
+                ]),
+
+            Section::make(__('panel.projects.sections.details'))
+                ->columns(2)
+                ->schema([
+                    Select::make('status')
+                        ->label(__('panel.projects.fields.status'))
+                        ->options(ProjectStatus::class)
+                        ->default(ProjectStatus::Idea)
+                        ->required(),
+
+                    DateTimePicker::make('published_at')
+                        ->label(__('panel.projects.fields.published_at'))
+                        ->seconds(false)
+                        ->helperText(__('panel.projects.fields.published_at_hint'))
+                        ->disabled(fn () => Auth::user()?->cannot('projects.publish'))
+                        ->dehydrated(),
+
+                    DateTimePicker::make('unpublish_at')
+                        ->label(__('panel.projects.fields.unpublish_at'))
+                        ->helperText(__('panel.projects.fields.unpublish_at_hint'))
+                        ->seconds(false)
+                        ->after('published_at')
+                        ->disabled(fn () => Auth::user()?->cannot('projects.publish'))
+                        ->dehydrated(),
+
+                    Select::make('technologies')
+                        ->label(__('panel.projects.fields.technologies'))
+                        ->relationship('technologies', 'name')
+                        ->multiple()
+                        ->preload()
+                        ->searchable()
+                        ->columnSpanFull(),
+
+                    Select::make('lead_member_id')
+                        ->label(__('panel.projects.fields.lead'))
+                        ->relationship('lead', 'name')
+                        ->searchable()
+                        ->preload(),
+
+                    Select::make('members')
+                        ->label(__('panel.projects.fields.members'))
+                        ->relationship('members', 'name')
+                        ->multiple()
+                        ->preload()
+                        ->searchable(),
+
+                    // Was two free-text fields, which made the same
+                    // association two entities and left the logo nowhere to
+                    // live. New ones can still be added without leaving the
+                    // project.
+                    Select::make('client_id')
+                        ->label(__('panel.projects.fields.client'))
+                        ->helperText(__('panel.projects.fields.client_hint'))
+                        ->relationship('client', 'name')
+                        ->searchable()
+                        ->preload()
+                        ->createOptionForm([
+                            TextInput::make('name')
+                                ->label(__('panel.clients.fields.name'))
+                                ->required()
+                                ->maxLength(255),
+
+                            TextInput::make('slug')
+                                ->label(__('panel.clients.fields.slug'))
+                                ->required()
+                                ->maxLength(255)
+                                ->rules(['unique:clients,slug']),
+
+                            TextInput::make('url')
+                                ->label(__('panel.clients.fields.url'))
+                                ->url()
+                                ->maxLength(2048),
+                        ]),
+
+                    Select::make('services')
+                        ->label(__('panel.projects.fields.services'))
+                        // The order is given explicitly because Filament
+                        // would otherwise sort a `select distinct` by a JSON
+                        // path, and Postgres refuses an ORDER BY expression
+                        // that is not in the select list.
+                        ->relationship(
+                            name: 'services',
+                            titleAttribute: 'title->'.config('locales.default'),
+                            modifyQueryUsing: fn (Builder $query) => $query->orderBy('position'),
+                        )
+                        ->multiple()
+                        ->preload()
+                        ->searchable(),
+
+                    TextInput::make('demo_url')
+                        ->label(__('panel.projects.fields.demo_url'))
+                        ->url()
+                        ->maxLength(2048),
+
+                    FileUpload::make('cover_image')
+                        ->label(__('panel.projects.fields.cover_image'))
+                        ->image()
+                        // Explicit: the default disk is private, and the
+                        // frontend runs on another host.
+                        ->disk(config('media.disk'))
+                        ->directory('projects')
+                        ->imageEditor()
+                        ->live(),
+
+                    TranslatableTabs::make(fn (string $locale) => [
+                        TextInput::make("cover_image_alt.{$locale}")
+                            ->label(__('panel.projects.fields.cover_image_alt'))
+                            ->helperText(__('panel.projects.fields.cover_image_alt_hint'))
+                            ->maxLength(255)
+                            ->columnSpanFull(),
+                    ])
+                        ->visible(fn (callable $get) => filled($get('cover_image')))
+                        ->columnSpanFull(),
+
+                    DatePicker::make('started_at')
+                        ->label(__('panel.projects.fields.started_at')),
+
+                    DatePicker::make('ended_at')
+                        ->label(__('panel.projects.fields.ended_at')),
+
+                    Toggle::make('is_featured')
+                        ->label(__('panel.projects.fields.is_featured')),
+
+                    // Drives the "we need help" listings on the public site,
+                    // which is the main thing the site is trying to achieve.
+                    Toggle::make('needs_help')
+                        ->label(__('panel.projects.fields.needs_help'))
+                        ->helperText(__('panel.projects.fields.needs_help_hint')),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/Projects/Tables/ProjectsTable.php

@@ -0,0 +1,254 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\Tables;
+
+use App\Enums\ProjectStatus;
+use App\Filament\Support\PreviewAction;
+use App\Filament\Support\ReviewActions;
+use App\Filament\Support\ReviewStatusColumn;
+use App\Filament\Support\TranslationStatusColumn;
+use App\Filament\Support\ViewsColumn;
+use App\Models\Project;
+use App\Support\TranslationFreshness;
+use Filament\Actions\Action;
+use Filament\Actions\BulkAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\ReplicateAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Notifications\Notification;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Facades\Auth;
+
+class ProjectsTable
+{
+    public static function configure(Table $table): Table
+    {
+        $locale = app()->getLocale();
+
+        return $table
+            // One grouped query for the whole page of rows, so the reading
+            // figures cost the listing nothing per row.
+            ->modifyQueryUsing(fn (Builder $query) => $query->withRecentViews())
+            ->defaultSort('position')
+            ->reorderable('position')
+            ->columns([
+                TextColumn::make('title')
+                    ->label(__('panel.projects.fields.title'))
+                    ->weight('medium')
+                    ->description(fn (Project $record) => $record->getTranslation('tagline', $locale, false) ?: null)
+                    ->wrap()
+                    ->searchable(query: fn (Builder $q, string $search) => $q
+                        ->where("title->{$locale}", 'like', "%{$search}%"))
+                    ->sortable(query: fn (Builder $q, string $direction) => $q
+                        ->orderBy("title->{$locale}", $direction)),
+
+                TranslationStatusColumn::make('translations')
+                    ->label(__('panel.pages.fields.translations'))
+                    ->trackedAttribute('title'),
+
+                TextColumn::make('status')
+                    ->label(__('panel.projects.fields.status'))
+                    ->badge()
+                    ->sortable(),
+
+                TextColumn::make('technologies.name')
+                    ->label(__('panel.projects.fields.technologies'))
+                    ->badge()
+                    ->color('gray')
+                    ->limitList(3)
+                    ->expandableLimitedList()
+                    ->toggleable(),
+
+                // Live repository activity, so the panel shows the same signs
+                // of life the public site does.
+                TextColumn::make('repositories_sum_stars')
+                    ->label('★')
+                    ->sum('repositories', 'stars')
+                    ->badge()
+                    ->color('warning')
+                    ->toggleable(),
+
+                IconColumn::make('needs_help')
+                    ->label(__('panel.projects.fields.needs_help'))
+                    ->boolean()
+                    ->trueIcon('heroicon-o-hand-raised')
+                    ->falseIcon('heroicon-o-minus-small')
+                    ->trueColor('warning')
+                    ->falseColor('gray')
+                    ->sortable(),
+
+                IconColumn::make('is_featured')
+                    ->label(__('panel.projects.fields.is_featured'))
+                    ->boolean()
+                    ->toggleable(),
+
+                // A project's status is its lifecycle, not its visibility —
+                // those are different questions, so the window gets its own
+                // column rather than overwriting the answer to the first.
+                ViewsColumn::make('recent_views')
+                    ->label(__('panel.views.column'))
+                    ->tooltip(__('panel.views.column_hint')),
+
+                ReviewStatusColumn::make('review')
+                    ->label(__('panel.reviews.column')),
+
+                TextColumn::make('published_at')
+                    ->label(__('panel.projects.fields.published_at'))
+                    ->badge()
+                    ->formatStateUsing(fn (?string $state, Project $record) => match (true) {
+                        $record->hasExpired() => __('panel.publishing.expired'),
+                        $record->isScheduled() => __('panel.publishing.scheduled'),
+                        blank($state) => __('panel.publishing.unpublished'),
+                        default => __('panel.publishing.live'),
+                    })
+                    ->color(fn (?string $state, Project $record) => match (true) {
+                        $record->hasExpired() => 'gray',
+                        $record->isScheduled() => 'info',
+                        blank($state) => 'gray',
+                        default => 'success',
+                    })
+                    ->description(fn (Project $record) => match (true) {
+                        $record->hasExpired() => __('panel.publishing.expired_at', ['time' => $record->unpublish_at->isoFormat('LLL')]),
+                        $record->isScheduled() => $record->published_at->diffForHumans(),
+                        $record->expiresSoon() => __('panel.publishing.expires_in', ['time' => $record->unpublish_at->diffForHumans()]),
+                        default => $record->published_at?->isoFormat('LL'),
+                    })
+                    ->sortable()
+                    ->placeholder('—'),
+            ])
+            ->filters([
+                // The reviewer's own queue. Unaddressed requests are in it
+                // too: a review nobody was named for is everybody's.
+                Filter::make('awaiting_review')
+                    ->label(__('panel.reviews.filters.mine'))
+                    ->query(fn (Builder $query) => Auth::user()
+                        ? $query->awaitingReviewBy(Auth::user())
+                        : $query->awaitingReview()),
+
+                Filter::make('scheduled')
+                    ->label(__('panel.publishing.scheduled'))
+                    ->query(fn (Builder $query) => $query->scheduled()),
+
+                Filter::make('expired')
+                    ->label(__('panel.publishing.expired'))
+                    ->query(fn (Builder $query) => $query->expired()),
+
+                SelectFilter::make('status')
+                    ->label(__('panel.projects.fields.status'))
+                    ->options(ProjectStatus::options())
+                    ->multiple(),
+
+                SelectFilter::make('technologies')
+                    ->label(__('panel.projects.fields.technologies'))
+                    ->relationship('technologies', 'name')
+                    ->multiple()
+                    ->preload(),
+
+                TernaryFilter::make('needs_help')
+                    ->label(__('panel.projects.fields.needs_help')),
+
+                // Published and, as far as anybody can tell, read by nobody.
+                Filter::make('unread')
+                    ->label(__('panel.views.filters.unread'))
+                    ->query(fn (Builder $query) => $query
+                        ->published()
+                        ->whereDoesntHave('views', fn (Builder $views) => $views->since(30))),
+
+                // Translated and left behind by the original. Worked out
+                // from the change history rather than a column, so it is
+                // resolved here and handed to the query as a list.
+                Filter::make('stale_translation')
+                    ->label(__('panel.translations.filters.stale'))
+                    ->query(fn (Builder $query) => $query->whereIn(
+                        'id',
+                        TranslationFreshness::staleIds($query->getModel()::query()),
+                    )),
+
+                Filter::make('unpublished')
+                    ->label(__('panel.projects.filters.unpublished'))
+                    ->query(fn (Builder $q) => $q->whereNull('published_at')),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                ReviewActions::request(),
+                ReviewActions::returnForChanges(),
+
+                Action::make('publish')
+                    ->label(__('panel.projects.actions.publish'))
+                    ->icon('heroicon-o-globe-alt')
+                    ->color('success')
+                    ->requiresConfirmation()
+                    ->visible(fn (Project $record) => $record->published_at === null
+                        && Auth::user()?->can('publish', $record))
+                    ->action(fn (Project $record) => $record->update(['published_at' => now()])),
+
+                // A near-copy is a real workflow: the third similar service,
+                // next year's call. The slug is cleared because two records
+                // cannot answer at the same URL.
+                ReplicateAction::make()
+                    ->label(__('panel.actions.duplicate'))
+                    ->icon('heroicon-o-document-duplicate')
+                    ->excludeAttributes(['slug', 'published_at', 'unpublish_at'])
+                    ->modalHeading(__('panel.actions.duplicate_heading'))
+                    ->successNotificationTitle(__('panel.actions.duplicated')),
+
+                PreviewAction::for('project'),
+
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    ReviewActions::requestBulk(Project::class),
+
+                    BulkAction::make('publish')
+                        ->label(__('panel.projects.actions.publish'))
+                        ->icon('heroicon-o-globe-alt')
+                        ->color('success')
+                        ->requiresConfirmation()
+                        ->visible(fn () => Auth::user()?->can('projects.publish') ?? false)
+                        ->deselectRecordsAfterCompletion()
+                        ->action(function (Collection $records): void {
+                            $published = 0;
+
+                            // One at a time: publishing fires the revision
+                            // entry and closes any pending review, and a mass
+                            // update would skip both without a sound.
+                            foreach ($records as $record) {
+                                if ($record->published_at !== null) {
+                                    continue;
+                                }
+
+                                $record->update(['published_at' => now()]);
+
+                                $published++;
+                            }
+
+                            Notification::make()
+                                ->title(trans_choice('panel.publishing.published_count', $published, ['count' => $published]))
+                                ->success()
+                                ->send();
+                        }),
+
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ]);
+    }
+}

app/Filament/Resources/Redirects/Pages/CreateRedirect.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Redirects\Pages;
+
+use App\Filament\Resources\Redirects\RedirectResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateRedirect extends CreateRecord
+{
+    protected static string $resource = RedirectResource::class;
+}

app/Filament/Resources/Redirects/Pages/EditRedirect.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Redirects\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Redirects\RedirectResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditRedirect extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = RedirectResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Redirects/Pages/ListRedirects.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Redirects\Pages;
+
+use App\Filament\Resources\Redirects\RedirectResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListRedirects extends ListRecords
+{
+    protected static string $resource = RedirectResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Redirects/RedirectResource.php

@@ -0,0 +1,210 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Redirects;
+
+use App\Filament\Resources\Redirects\Pages\CreateRedirect;
+use App\Filament\Resources\Redirects\Pages\EditRedirect;
+use App\Filament\Resources\Redirects\Pages\ListRedirects;
+use App\Models\Redirect;
+use BackedEnum;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use UnitEnum;
+
+/**
+ * URLs that used to work, and where they go now.
+ *
+ * Most of this list is never typed by anybody: renaming a slug writes an entry
+ * on the way past, because that is the only moment the old address is still
+ * known. The rest is for the links that existed before this application did.
+ */
+class RedirectResource extends Resource
+{
+    protected static ?string $model = Redirect::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedArrowsRightLeft;
+
+    protected static ?int $navigationSort = 85;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.redirects.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.redirects.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->from;
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()
+                ->description(__('panel.redirects.hint'))
+                ->columns(2)
+                ->schema([
+                    TextInput::make('from')
+                        ->label(__('panel.redirects.fields.from'))
+                        ->helperText(__('panel.redirects.fields.from_hint'))
+                        ->required()
+                        ->maxLength(500)
+                        ->placeholder('/proyectos/nombre-viejo')
+                        // Normalised on the way in so a rule typed by hand
+                        // matches one written automatically.
+                        ->dehydrateStateUsing(fn (string $state) => Redirect::normalise($state)),
+
+                    TextInput::make('to')
+                        ->label(__('panel.redirects.fields.to'))
+                        ->required()
+                        ->maxLength(500)
+                        ->placeholder('/proyectos/nombre-nuevo')
+                        ->dehydrateStateUsing(fn (string $state) => Redirect::normalise($state))
+                        ->different('from'),
+
+                    Select::make('status')
+                        ->label(__('panel.redirects.fields.status'))
+                        ->helperText(__('panel.redirects.fields.status_hint'))
+                        ->options([
+                            301 => __('panel.redirects.statuses.301'),
+                            302 => __('panel.redirects.statuses.302'),
+                        ])
+                        ->default(301)
+                        ->required(),
+
+                    Select::make('locale')
+                        ->label(__('panel.redirects.fields.locale'))
+                        ->helperText(__('panel.redirects.fields.locale_hint'))
+                        ->options(fn () => collect(config('locales.supported'))
+                            ->map(fn (array $meta, string $code) => $meta['native'] ?? $code)
+                            ->all())
+                        ->placeholder(__('panel.redirects.every_locale')),
+
+                    Toggle::make('is_enabled')
+                        ->label(__('panel.redirects.fields.is_enabled'))
+                        ->default(true),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                TextColumn::make('from')
+                    ->label(__('panel.redirects.fields.from'))
+                    ->fontFamily('mono')
+                    ->searchable()
+                    ->wrap(),
+
+                TextColumn::make('to')
+                    ->label(__('panel.redirects.fields.to'))
+                    ->fontFamily('mono')
+                    ->searchable()
+                    ->wrap()
+                    // A rule pointing at its own source would send a browser
+                    // round in circles.
+                    ->color(fn (Redirect $record) => $record->isCircular() ? 'danger' : null),
+
+                TextColumn::make('status')
+                    ->label(__('panel.redirects.fields.status'))
+                    ->badge()
+                    ->color(fn (int $state) => $state === 301 ? 'gray' : 'info'),
+
+                TextColumn::make('locale')
+                    ->label(__('panel.redirects.fields.locale'))
+                    ->badge()
+                    ->color('gray')
+                    ->placeholder(__('panel.redirects.every_locale'))
+                    ->toggleable(),
+
+                // The number that decides whether a rule can ever be deleted:
+                // is anybody still following it?
+                TextColumn::make('hits')
+                    ->label(__('panel.redirects.fields.hits'))
+                    ->badge()
+                    ->color(fn (int $state) => $state > 0 ? 'success' : 'gray')
+                    ->description(fn (Redirect $record) => $record->last_used_at?->diffForHumans())
+                    ->sortable(),
+
+                TextColumn::make('source_type')
+                    ->label(__('panel.redirects.fields.origin'))
+                    ->badge()
+                    ->color('gray')
+                    ->formatStateUsing(fn (?string $state) => $state
+                        ? __('panel.redirects.automatic')
+                        : __('panel.redirects.manual'))
+                    ->toggleable(),
+
+                IconColumn::make('is_enabled')
+                    ->label(__('panel.redirects.fields.is_enabled'))
+                    ->boolean(),
+            ])
+            ->filters([
+                TernaryFilter::make('is_enabled')->label(__('panel.redirects.fields.is_enabled')),
+
+                Filter::make('automatic')
+                    ->label(__('panel.redirects.automatic'))
+                    ->query(fn (Builder $query) => $query->whereNotNull('source_type')),
+
+                Filter::make('unused')
+                    ->label(__('panel.redirects.filters.unused'))
+                    ->query(fn (Builder $query) => $query->where('hits', 0)),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([DeleteBulkAction::make()]),
+            ])
+            ->emptyStateHeading(__('panel.redirects.empty.heading'))
+            ->emptyStateDescription(__('panel.redirects.empty.description'))
+            ->emptyStateIcon('heroicon-o-arrows-right-left');
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['from', 'to'];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListRedirects::route('/'),
+            'create' => CreateRedirect::route('/create'),
+            'edit' => EditRedirect::route('/{record}/edit'),
+        ];
+    }
+}

app/Filament/Resources/Repositories/Pages/CreateRepository.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Repositories\Pages;
+
+use App\Filament\Resources\Repositories\RepositoryResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateRepository extends CreateRecord
+{
+    protected static string $resource = RepositoryResource::class;
+}

app/Filament/Resources/Repositories/Pages/EditRepository.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Repositories\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Repositories\RepositoryResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditRepository extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = RepositoryResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Repositories/Pages/ListRepositories.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Repositories\Pages;
+
+use App\Filament\Resources\Repositories\RepositoryResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListRepositories extends ListRecords
+{
+    protected static string $resource = RepositoryResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Repositories/RepositoryResource.php

@@ -0,0 +1,135 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Repositories;
+
+use App\Enums\GitProvider;
+use App\Filament\Resources\Repositories\Pages\CreateRepository;
+use App\Filament\Resources\Repositories\Pages\EditRepository;
+use App\Filament\Resources\Repositories\Pages\ListRepositories;
+use App\Filament\Resources\Repositories\Tables\RepositoriesTable;
+use App\Models\Repository;
+use BackedEnum;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use UnitEnum;
+
+/**
+ * Git repositories connected to the collective's projects.
+ *
+ * The form is intentionally tiny: a repository is identified by its provider
+ * and "owner/repo", and everything else — stars, languages, contributors,
+ * newcomer-friendly issues — arrives from the provider on each sync. Nothing
+ * synced is editable, because a hand-typed star count is a lie waiting to
+ * happen.
+ */
+class RepositoryResource extends Resource
+{
+    protected static ?string $model = Repository::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedCodeBracketSquare;
+
+    protected static ?int $navigationSort = 5;
+
+    protected static ?string $recordTitleAttribute = 'full_name';
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.repositories.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.repositories.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()
+                ->columns(2)
+                ->schema([
+                    Select::make('provider')
+                        ->label(__('panel.repositories.fields.provider'))
+                        ->options(GitProvider::class)
+                        ->default(GitProvider::default())
+                        ->required()
+                        // Only providers with a driver registered in
+                        // config/git.php can actually be synced.
+                        ->disableOptionWhen(fn (string $value) => ! GitProvider::from($value)->isSupported()),
+
+                    TextInput::make('full_name')
+                        ->label(__('panel.repositories.fields.full_name'))
+                        ->placeholder('colectivo/mi-proyecto')
+                        ->helperText(__('panel.repositories.fields.full_name_hint'))
+                        ->required()
+                        ->maxLength(255)
+                        ->rules(['regex:/^[\w.-]+\/[\w.-]+$|^[\w.-]+$/']),
+
+                    Select::make('project_id')
+                        ->label(__('panel.repositories.fields.project'))
+                        ->relationship('project', 'title->'.config('locales.default'))
+                        ->searchable()
+                        ->preload(),
+
+                    Toggle::make('is_primary')
+                        ->label(__('panel.repositories.fields.is_primary'))
+                        ->helperText(__('panel.repositories.fields.is_primary_hint')),
+
+                    Toggle::make('show_publicly')
+                        ->label(__('panel.repositories.fields.show_publicly'))
+                        ->default(true),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return RepositoriesTable::configure($table);
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['full_name'];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListRepositories::route('/'),
+            'create' => CreateRepository::route('/create'),
+            'edit' => EditRepository::route('/{record}/edit'),
+        ];
+    }
+
+    /**
+     * Flags repositories whose sync keeps failing — usually renamed or deleted
+     * upstream — so stale numbers do not sit on the public site unnoticed.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        $failing = static::getModel()::query()->failing()->count();
+
+        return $failing > 0 ? (string) $failing : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'danger';
+    }
+}

app/Filament/Resources/Repositories/Tables/RepositoriesTable.php

@@ -0,0 +1,178 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Repositories\Tables;
+
+use App\Jobs\SyncRepository;
+use App\Models\Repository;
+use App\Services\Git\GitException;
+use App\Services\Git\GitManager;
+use Filament\Actions\Action;
+use Filament\Actions\BulkAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Notifications\Notification;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Auth;
+
+class RepositoriesTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->defaultSort('stars', 'desc')
+            ->columns([
+                TextColumn::make('full_name')
+                    ->label(__('panel.repositories.fields.full_name'))
+                    ->weight('medium')
+                    ->description(fn (Repository $r) => $r->description)
+                    ->wrap()
+                    ->url(fn (Repository $r) => $r->html_url, shouldOpenInNewTab: true)
+                    ->searchable()
+                    ->sortable(),
+
+                TextColumn::make('project.title')
+                    ->label(__('panel.repositories.fields.project'))
+                    ->badge()
+                    ->color('gray')
+                    ->placeholder('—')
+                    ->toggleable(),
+
+                TextColumn::make('primary_language')
+                    ->label(__('panel.repositories.fields.language'))
+                    ->badge()
+                    ->placeholder('—'),
+
+                TextColumn::make('stars')
+                    ->label('★')
+                    ->badge()
+                    ->color('warning')
+                    ->sortable(),
+
+                TextColumn::make('contributors_count')
+                    ->label(__('panel.repositories.fields.contributors'))
+                    ->badge()
+                    ->color('gray')
+                    ->sortable(),
+
+                TextColumn::make('good_first_issues_count')
+                    ->label(__('panel.repositories.fields.good_first_issues'))
+                    ->counts('goodFirstIssues')
+                    ->badge()
+                    ->color(fn ($state) => $state > 0 ? 'success' : 'gray'),
+
+                TextColumn::make('pushed_at')
+                    ->label(__('panel.repositories.fields.pushed_at'))
+                    ->since()
+                    // A repository nobody has touched in months is worth
+                    // spotting: it is what makes a site look abandoned.
+                    ->color(fn (Repository $r) => $r->isDormant() ? 'danger' : null)
+                    ->placeholder('—')
+                    ->sortable(),
+
+                IconColumn::make('show_publicly')
+                    ->label(__('panel.repositories.fields.show_publicly'))
+                    ->boolean()
+                    ->toggleable(),
+
+                TextColumn::make('last_synced_at')
+                    ->label(__('panel.repositories.fields.last_synced_at'))
+                    ->since()
+                    ->description(fn (Repository $r) => $r->sync_error
+                        ? str($r->sync_error)->limit(60)->toString()
+                        : null)
+                    ->color(fn (Repository $r) => $r->sync_error ? 'danger' : 'gray')
+                    ->placeholder(__('panel.repositories.never_synced')),
+            ])
+            ->filters([
+                TernaryFilter::make('show_publicly')
+                    ->label(__('panel.repositories.fields.show_publicly')),
+
+                Filter::make('failing')
+                    ->label(__('panel.repositories.filters.failing'))
+                    ->query(fn (Builder $q) => $q->failing()),
+
+                Filter::make('dormant')
+                    ->label(__('panel.repositories.filters.dormant'))
+                    ->query(fn (Builder $q) => $q->where(fn (Builder $sub) => $sub
+                        ->whereNull('pushed_at')
+                        ->orWhere('pushed_at', '<', now()->subDays(180)))),
+            ])
+            ->recordActions([
+                self::syncAction(),
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    self::syncBulkAction(),
+                    DeleteBulkAction::make(),
+                ]),
+            ]);
+    }
+
+    /**
+     * Runs inline rather than queueing, so the person who clicked sees the
+     * result — including the reason when it fails.
+     */
+    protected static function syncAction(): Action
+    {
+        return Action::make('sync')
+            ->label(__('panel.repositories.actions.sync'))
+            ->icon('heroicon-o-arrow-path')
+            ->color('gray')
+            ->visible(fn () => Auth::user()?->can('repositories.sync'))
+            ->action(function (Repository $record, GitManager $git): void {
+                try {
+                    $record = $git->sync($record);
+
+                    Notification::make()
+                        ->success()
+                        ->title(__('panel.repositories.notifications.synced'))
+                        ->body(__('panel.repositories.notifications.synced_body', [
+                            'stars' => $record->stars,
+                            'issues' => $record->goodFirstIssues()->count(),
+                        ]))
+                        ->send();
+                } catch (GitException $e) {
+                    Notification::make()
+                        ->danger()
+                        ->title(__('panel.repositories.notifications.sync_failed'))
+                        ->body($e->getMessage())
+                        ->persistent()
+                        ->send();
+                }
+            });
+    }
+
+    /**
+     * Syncing many repositories at once can exhaust the provider's rate limit,
+     * so this one goes through the queue instead of blocking the request.
+     */
+    protected static function syncBulkAction(): BulkAction
+    {
+        return BulkAction::make('syncAll')
+            ->label(__('panel.repositories.actions.sync_selected'))
+            ->icon('heroicon-o-arrow-path')
+            ->requiresConfirmation()
+            ->visible(fn () => Auth::user()?->can('repositories.sync'))
+            ->action(function (Collection $records): void {
+                $records->each(fn (Repository $r) => SyncRepository::dispatch($r));
+
+                Notification::make()
+                    ->success()
+                    ->title(__('panel.repositories.notifications.queued', ['count' => $records->count()]))
+                    ->send();
+            })
+            ->deselectRecordsAfterCompletion();
+    }
+}

app/Filament/Resources/RepositoryIssuesResource.php

@@ -0,0 +1,75 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources;
+
+use App\Filament\Resources\RepositoryIssuesResource\Pages\EditRepositoryIssue;
+use App\Filament\Resources\RepositoryIssuesResource\Pages\ListRepositoryIssues;
+use App\Filament\Resources\RepositoryIssuesResource\Schemas\RepositoryIssueForm;
+use App\Filament\Resources\RepositoryIssuesResource\Tables\RepositoryIssuesTable;
+use App\Models\RepositoryIssue;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use UnitEnum;
+
+class RepositoryIssuesResource extends Resource
+{
+    protected static ?string $model = RepositoryIssue::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedBugAnt;
+
+    protected static ?int $navigationSort = 3;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.issues.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.issues.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->title;
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return RepositoryIssueForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return RepositoryIssuesTable::configure($table);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListRepositoryIssues::route('/'),
+            'edit' => EditRepositoryIssue::route('/{record}/edit'),
+        ];
+    }
+
+    public static function canCreate(): bool
+    {
+        return false;
+    }
+
+    public static function canDelete($record): bool
+    {
+        return true;
+    }
+}

app/Filament/Resources/RepositoryIssuesResource/Pages/EditRepositoryIssue.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\RepositoryIssuesResource\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\RepositoryIssuesResource;
+use Filament\Resources\Pages\EditRecord;
+
+class EditRepositoryIssue extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = RepositoryIssuesResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [];
+    }
+}

app/Filament/Resources/RepositoryIssuesResource/Pages/ListRepositoryIssues.php

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\RepositoryIssuesResource\Pages;
+
+use App\Filament\Resources\RepositoryIssuesResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListRepositoryIssues extends ListRecords
+{
+    protected static string $resource = RepositoryIssuesResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [];
+    }
+}

app/Filament/Resources/RepositoryIssuesResource/Schemas/RepositoryIssueForm.php

@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\RepositoryIssuesResource\Schemas;
+
+use Filament\Forms\Components\DateTimePicker;
+use Filament\Forms\Components\Placeholder;
+use Filament\Forms\Components\Section;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Schema;
+
+class RepositoryIssueForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make(__('panel.issues.sections.details'))
+                ->schema([
+                    Placeholder::make('number')
+                        ->label(__('panel.issues.fields.number'))
+                        ->content(fn ($record) => $record?->number ? "#{$record->number}" : '—'),
+
+                    TextInput::make('title')
+                        ->label(__('panel.issues.fields.title'))
+                        ->disabled()
+                        ->columnSpanFull(),
+
+                    Select::make('repository_id')
+                        ->label(__('panel.issues.fields.repository'))
+                        ->relationship('repository', 'full_name')
+                        ->disabled()
+                        ->searchable(),
+
+                    TextInput::make('author')
+                        ->label(__('panel.issues.fields.author'))
+                        ->disabled(),
+
+                    TextInput::make('assignee')
+                        ->label(__('panel.issues.fields.assignee'))
+                        ->helperText(__('panel.issues.fields.assignee_hint')),
+
+                    TextInput::make('html_url')
+                        ->label(__('panel.issues.fields.url'))
+                        ->disabled()
+                        ->url()
+                        ->columnSpanFull(),
+                ]),
+
+            Section::make(__('panel.issues.sections.classification'))
+                ->schema([
+                    Toggle::make('is_good_first_issue')
+                        ->label(__('panel.issues.fields.is_good_first_issue'))
+                        ->helperText(__('panel.issues.fields.is_good_first_issue_hint')),
+
+                    Toggle::make('is_help_wanted')
+                        ->label(__('panel.issues.fields.is_help_wanted'))
+                        ->helperText(__('panel.issues.fields.is_help_wanted_hint')),
+                ]),
+
+            Section::make(__('panel.issues.sections.metadata'))
+                ->collapsed()
+                ->schema([
+                    TextInput::make('comments')
+                        ->label(__('panel.issues.fields.comments'))
+                        ->disabled()
+                        ->numeric(),
+
+                    DateTimePicker::make('issue_created_at')
+                        ->label(__('panel.issues.fields.issue_created_at'))
+                        ->disabled(),
+
+                    DateTimePicker::make('issue_updated_at')
+                        ->label(__('panel.issues.fields.issue_updated_at'))
+                        ->disabled(),
+
+                    Textarea::make('labels')
+                        ->label(__('panel.issues.fields.labels'))
+                        ->disabled()
+                        ->rows(3)
+                        ->columnSpanFull(),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/RepositoryIssuesResource/Tables/RepositoryIssuesTable.php

@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\RepositoryIssuesResource\Tables;
+
+use Filament\Actions\DeleteAction;
+use Filament\Actions\EditAction;
+use Filament\Tables\Columns\BadgeColumn;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+
+class RepositoryIssuesTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('number')
+                    ->label(__('panel.issues.fields.number'))
+                    ->formatStateUsing(fn ($state) => "#{$state}")
+                    ->sortable()
+                    ->width('80px'),
+
+                TextColumn::make('title')
+                    ->label(__('panel.issues.fields.title'))
+                    ->weight('medium')
+                    ->searchable()
+                    ->wrap()
+                    ->limit(60),
+
+                TextColumn::make('repository.full_name')
+                    ->label(__('panel.issues.fields.repository'))
+                    ->searchable()
+                    ->sortable(),
+
+                IconColumn::make('is_good_first_issue')
+                    ->label(__('panel.issues.fields.is_good_first_issue'))
+                    ->boolean()
+                    ->trueIcon('heroicon-o-check-circle')
+                    ->falseIcon('heroicon-o-x-circle'),
+
+                IconColumn::make('is_help_wanted')
+                    ->label(__('panel.issues.fields.is_help_wanted'))
+                    ->boolean()
+                    ->trueIcon('heroicon-o-check-circle')
+                    ->falseIcon('heroicon-o-x-circle'),
+
+                BadgeColumn::make('assignee')
+                    ->label(__('panel.issues.fields.assignee'))
+                    ->color(fn ($state) => $state ? 'success' : 'gray')
+                    ->formatStateUsing(fn ($state) => $state ?? __('panel.issues.fields.unassigned')),
+
+                TextColumn::make('issue_created_at')
+                    ->label(__('panel.issues.fields.issue_created_at'))
+                    ->dateTime()
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->actions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->filters([
+                SelectFilter::make('repository_id')
+                    ->label(__('panel.issues.filters.repository'))
+                    ->relationship('repository', 'full_name'),
+
+                Filter::make('is_good_first_issue')
+                    ->label(__('panel.issues.filters.good_first_issue'))
+                    ->toggle()
+                    ->query(fn (Builder $q) => $q->where('is_good_first_issue', true)),
+
+                Filter::make('is_help_wanted')
+                    ->label(__('panel.issues.filters.help_wanted'))
+                    ->toggle()
+                    ->query(fn (Builder $q) => $q->where('is_help_wanted', true)),
+
+                Filter::make('unclaimed')
+                    ->label(__('panel.issues.filters.unclaimed'))
+                    ->toggle()
+                    ->query(fn (Builder $q) => $q->whereNull('assignee')),
+
+                Filter::make('claimed')
+                    ->label(__('panel.issues.filters.claimed'))
+                    ->toggle()
+                    ->query(fn (Builder $q) => $q->whereNotNull('assignee')),
+            ])
+            ->defaultSort('issue_created_at', 'desc');
+    }
+}

app/Filament/Resources/Roles/Pages/CreateRole.php

@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Roles\Pages;
+
+use App\Filament\Resources\Roles\RoleResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateRole extends CreateRecord
+{
+    use HandlesRolePermissions;
+
+    protected static string $resource = RoleResource::class;
+}

app/Filament/Resources/Roles/Pages/EditRole.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Roles\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Roles\RoleResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditRole extends EditRecord
+{
+    use HandlesRolePermissions, WarnsOfConcurrentEditing;
+
+    protected static string $resource = RoleResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Roles/Pages/HandlesRolePermissions.php

@@ -0,0 +1,100 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Roles\Pages;
+
+use App\Support\Permissions;
+use Spatie\Permission\PermissionRegistrar;
+
+/**
+ * Bridges the form's per-group checkbox state and the role's single
+ * `permissions` relationship.
+ *
+ * The form splits permissions across one component per resource for
+ * readability; the database wants one flat set. This trait converts in both
+ * directions and keeps the two in step.
+ */
+trait HandlesRolePermissions
+{
+    /**
+     * Permission names captured on the way to saving, held here because the
+     * relationship can only be synced once the role row exists.
+     *
+     * @var array<int, string>
+     */
+    protected array $selectedPermissions = [];
+
+    /**
+     * Expand the role's flat permission set into the form's grouped shape.
+     *
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function mutateFormDataBeforeFill(array $data): array
+    {
+        $held = $this->getRecord()->permissions->pluck('name')->all();
+
+        foreach (Permissions::grouped() as $group => $permissions) {
+            $data['permission_groups'][$group] = array_values(array_intersect($permissions, $held));
+        }
+
+        return $data;
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function mutateFormDataBeforeSave(array $data): array
+    {
+        return $this->extractPermissions($data);
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function mutateFormDataBeforeCreate(array $data): array
+    {
+        return $this->extractPermissions($data);
+    }
+
+    protected function afterSave(): void
+    {
+        $this->syncSelectedPermissions();
+    }
+
+    protected function afterCreate(): void
+    {
+        $this->syncSelectedPermissions();
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function extractPermissions(array $data): array
+    {
+        $groups = $data['permission_groups'] ?? [];
+        unset($data['permission_groups']);
+
+        // Intersecting with the catalogue means a stale or hand-crafted value
+        // in the payload cannot grant a permission the app does not define.
+        $this->selectedPermissions = array_values(array_intersect(
+            array_merge(...array_values(array_map(fn ($v) => (array) $v, $groups)) ?: [[]]),
+            Permissions::all(),
+        ));
+
+        return $data;
+    }
+
+    protected function syncSelectedPermissions(): void
+    {
+        $this->getRecord()->syncPermissions($this->selectedPermissions);
+
+        // spatie caches the permission map; without this the change would not
+        // take effect until the cache expired.
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+    }
+}

app/Filament/Resources/Roles/Pages/ListRoles.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Roles\Pages;
+
+use App\Filament\Resources\Roles\RoleResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListRoles extends ListRecords
+{
+    protected static string $resource = RoleResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Roles/RoleResource.php

@@ -0,0 +1,69 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Roles;
+
+use App\Filament\Resources\Roles\Pages\CreateRole;
+use App\Filament\Resources\Roles\Pages\EditRole;
+use App\Filament\Resources\Roles\Pages\ListRoles;
+use App\Filament\Resources\Roles\Schemas\RoleForm;
+use App\Filament\Resources\Roles\Tables\RolesTable;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Spatie\Permission\Models\Role;
+use UnitEnum;
+
+/**
+ * The authorisation model, editable in the panel.
+ *
+ * This is where "who may do what in this app" is decided — the identity server
+ * has no say in it.
+ */
+class RoleResource extends Resource
+{
+    protected static ?string $model = Role::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedShieldCheck;
+
+    protected static ?int $navigationSort = 40;
+
+    protected static ?string $recordTitleAttribute = 'name';
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.roles.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.roles.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return RoleForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return RolesTable::configure($table);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListRoles::route('/'),
+            'create' => CreateRole::route('/create'),
+            'edit' => EditRole::route('/{record}/edit'),
+        ];
+    }
+}