The `frankxai/akamoto` repository (`https://akamoto.io`) runs on Next.js `16.4.2` and React `19.2.8` (`pnpm@11.5.0`). It publishes the three canonical Prophecies (`content/prophecies.ts`), enforces strict response headers across all routes (`next.config.ts`), isolates API endpoints from search crawlers (`app/robots.ts`), and runs zero-dependency Node test suites (`package.json`).

## HTTP security headers (`next.config.ts`) [#http-security-headers-nextconfigts]

`akamoto/next.config.ts` enables `reactStrictMode: true` and attaches four defensive HTTP response headers to every route matching `source: '/(.*)'`:

| Header | Configured value | Security posture |
|---|---|---|
| `X-Content-Type-Options` | `nosniff` | Prevents MIME-sniffing of response payloads outside declared `Content-Type` |
| `X-Frame-Options` | `DENY` | Blocks clickjacking and third-party `<iframe>` embedding across all origins |
| `Referrer-Policy` | `strict-origin-when-cross-origin` | Sends full referrer on same-origin navigation and origin-only across HTTPS boundaries |
| `Permissions-Policy` | `camera=(), microphone=(), geolocation=()` | Explicitly disables browser camera, microphone, and geolocation APIs |

## Crawler and sitemap rules (`app/robots.ts`) [#crawler-and-sitemap-rules-approbotsts]

`akamoto/app/robots.ts` generates `/robots.txt` dynamically from `process.env.NEXT_PUBLIC_SITE_URL` (defaulting to `https://akamoto.io`):

- **Allowed paths:** `userAgent: '*'`, `allow: '/'` for all public pages and prophecy routes (`/prophecies/[slug]`).
- **Disallowed paths:** `disallow: ['/api/']` to keep `/api/waitlist` out of search indexes.
- **Sitemap binding:** Emits `sitemap: '${SITE}/sitemap.xml'`, verified for both the default `https://akamoto.io/sitemap.xml` origin and custom `NEXT_PUBLIC_SITE_URL` overrides in `app/robots.test.ts`.

## Sovereign prophecies and fail-closed demand capture [#sovereign-prophecies-and-fail-closed-demand-capture]

1. **Verified prophecy corpus (`content/prophecies.ts`):** Serves three numbered prophecies at `/prophecies/[slug]`, verified in `content/prophecies.test.ts`:
   - `of-the-sealing` (*Of the Sealing*, Numeral `I`)
   - `of-the-lamp-carried-backwards` (*Of the Lamp Carried Backwards*, Numeral `II`)
   - `of-what-the-dark-keeps` (*Of What the Dark Keeps*, Numeral `III`)
2. **Fail-closed waitlist register (`lib/demand-capture`):** The waitlist endpoint (`app/api/waitlist/route.ts`, product ID `akamoto-prophecies`) requires `KV_REST_API_URL`, `KV_REST_API_TOKEN`, `RESEND_API_KEY`, and `RESEND_AUDIENCE_ID` (or product override `RESEND_AUDIENCE_ID__AKAMOTO_PROPHECIES`). When those environment variables are absent, the `Register` component renders cleanly and reports that registration is not currently taking names rather than failing silently.

## Verification commands (`package.json`) [#verification-commands-packagejson]

`akamoto/package.json` uses Node's built-in test runner with native TypeScript type-stripping (`node --experimental-strip-types --test`) so unit tests execute directly against `.ts` sources without a separate test bundler:

```bash
# Install dependencies with pnpm 11.5.0
pnpm install

# Run strict TypeScript verification (tsc --noEmit)
pnpm type-check

# Run Node native TypeScript unit tests (robots.test.ts, prophecies.test.ts, questions.test.ts)
pnpm test

# Build the production Next.js 16.4.2 bundle
pnpm build
```