diff --git a/.env.example b/.env.example
index 1a834d29c..86668314c 100644
--- a/.env.example
+++ b/.env.example
@@ -41,9 +41,15 @@ NUXT_CLOUDFLARE_API_TOKEN=
 
 # ===================================
 # Website Environment (Required)
-# API base url:
+# WolfStar bot API origin used by `$api` (legacy-style direct calls).
+# Production/internal: https://api.wolfstar.rocks (default when unset)
+# Local bot instance:  http://localhost:8282
 NUXT_PUBLIC_API_BASE_URL=http://localhost:8282
 
+# Optional: sapphire-plugin-api cookie name for SSR auth cookie injection.
+# Defaults to SAPPHIRE_AUTH. Encryption uses NUXT_OAUTH_DISCORD_CLIENT_SECRET.
+# NUXT_BOT_API_AUTH_COOKIE=SAPPHIRE_AUTH
+
 # Site URL (e.g., https://wolfstar.rocks)
 NUXT_PUBLIC_SITE_URL=
 # ===================================
diff --git a/app/components/command/SubCategory.vue b/app/components/command/SubCategory.vue
index 8cd204282..99de09ece 100644
--- a/app/components/command/SubCategory.vue
+++ b/app/components/command/SubCategory.vue
@@ -1,51 +1,20 @@
 <template>
-	<div
-		v-if="filteredCommands.length > 0"
-		role="region"
-		:aria-labelledby="`category-${categoryName.replace(/\s+/g, '-').toLowerCase()}`"
-	>
+	<div v-if="filteredCommands.length > 0" class="animate-fade-in">
 		<UAccordion
 			:items="categoryItems"
 			:ui="{
 				root: 'space-y-3',
 				item: '',
+				trigger:
+					'w-full justify-between rounded-2xl border border-base-content/10 bg-base-200/50 px-6 py-4 transition-all hover:bg-base-200/80 data-[state=open]:rounded-b-none',
 				content:
 					'rounded-2xl rounded-t-none overflow-hidden transition-all border border-t-0 border-base-content/10 bg-base-200/30',
+				label: 'truncate text-xl font-bold',
+				trailingIcon: 'size-5 shrink-0',
 			}"
-			class="animate-fade-in"
 		>
-			<template #default="{ item, open }">
-				<UButton
-					color="neutral"
-					variant="ghost"
-					class="w-full justify-between rounded-2xl border border-base-content/10 bg-base-200/50 px-6 py-4 transition-all hover:bg-base-200/80"
-					:class="{ 'rounded-b-none': open }"
-					:aria-expanded="open"
-					:aria-controls="`category-content-${item.value.replace(/\s+/g, '-').toLowerCase()}`"
-				>
-					<span
-						:id="`category-${item.value.replace(/\s+/g, '-').toLowerCase()}`"
-						class="truncate text-xl font-bold"
-					>
-						{{ item.label }}
-					</span>
-
-					<template #trailing>
-						<UIcon
-							name="i-heroicons-chevron-down-20-solid"
-							class="size-5 shrink-0 transform transition-transform duration-200"
-							:class="[open && 'rotate-180']"
-							aria-hidden="true"
-						/>
-					</template>
-				</UButton>
-			</template>
-
 			<template #body="{ item }">
-				<div
-					:id="`category-content-${item.value.replace(/\s+/g, '-').toLowerCase()}`"
-					class="space-y-3 p-4"
-				>
+				<div class="space-y-3 p-4">
 					<UAccordion
 						:items="
 							getCommandsByCategory(item.label).map((command) => ({
diff --git a/app/composables/createApiComposable.ts b/app/composables/createApiComposable.ts
index 55ee14aef..c22f711cd 100644
--- a/app/composables/createApiComposable.ts
+++ b/app/composables/createApiComposable.ts
@@ -2,6 +2,10 @@ export interface ApiComposableOptions {
 	immediate?: boolean;
 }
 
+/**
+ * Lazy-fetch composable for WolfStar bot API routes via `$api`
+ * (e.g. `/commands`, `/languages`, `/guilds/:id`).
+ */
 export function createApiComposable<T>(
 	key: string,
 	endpoint: string,
diff --git a/app/composables/useAuditLog.ts b/app/composables/useAuditLog.ts
index 136829bb1..8cb3834d1 100644
--- a/app/composables/useAuditLog.ts
+++ b/app/composables/useAuditLog.ts
@@ -30,10 +30,12 @@ export function useAuditLog({
 	const resolvedOffset = computed(() => (offset !== undefined ? toValue(offset) : undefined));
 	const resolvedFilters = computed(() => (filters !== undefined ? toValue(filters) : undefined));
 
+	const { $api } = useNuxtApp();
+
 	const asyncData = useLazyAsyncData(
 		() =>
 			`guild:${toValue(guildId)}:logs:activity:${resolvedLimit.value ?? "default"}:${resolvedOffset.value ?? 0}:${JSON.stringify(resolvedFilters.value ?? {})}`,
-		() => {
+		async () => {
 			const query: Record<string, string | number> = {};
 			if (resolvedLimit.value !== undefined) query.limit = resolvedLimit.value;
 			if (resolvedOffset.value !== undefined) query.offset = resolvedOffset.value;
@@ -44,9 +46,11 @@ export function useAuditLog({
 				if (f.to) query.to = f.to;
 				if (f.q) query.q = f.q;
 			}
-			return $fetch<AuditLogResponse>(`/api/guilds/${toValue(guildId)}/logs`, {
-				query,
-			});
+			const { data } = await $api<AuditLogResponse>(
+				`/guilds/${toValue(guildId)}/audit-logs`,
+				{ query },
+			);
+			return data;
 		},
 		{
 			immediate: immediate !== false,
diff --git a/app/composables/useCommandLog.ts b/app/composables/useCommandLog.ts
index d858d8e65..e49ef7c7e 100644
--- a/app/composables/useCommandLog.ts
+++ b/app/composables/useCommandLog.ts
@@ -30,10 +30,12 @@ export function useCommandLog({
 	const resolvedOffset = computed(() => (offset !== undefined ? toValue(offset) : undefined));
 	const resolvedFilters = computed(() => (filters !== undefined ? toValue(filters) : undefined));
 
+	const { $api } = useNuxtApp();
+
 	const asyncData = useLazyAsyncData(
 		() =>
 			`guild:${toValue(guildId)}:logs:commands:${resolvedLimit.value ?? "default"}:${resolvedOffset.value ?? 0}:${JSON.stringify(resolvedFilters.value || {})}`,
-		() => {
+		async () => {
 			const query: Record<string, string | number> = {};
 			if (resolvedLimit.value !== undefined) query.limit = resolvedLimit.value;
 			if (resolvedOffset.value !== undefined) query.offset = resolvedOffset.value;
@@ -46,9 +48,11 @@ export function useCommandLog({
 				if (f.to) query.to = f.to;
 				if (f.q) query.q = f.q;
 			}
-			return $fetch<CommandLogResponse>(`/api/guilds/${toValue(guildId)}/logs/commands`, {
-				query,
-			});
+			const { data } = await $api<CommandLogResponse>(
+				`/guilds/${toValue(guildId)}/command-logs`,
+				{ query },
+			);
+			return data;
 		},
 		{
 			immediate: immediate !== false,
diff --git a/app/composables/useCommands.ts b/app/composables/useCommands.ts
index cd3a302ce..1ff969160 100644
--- a/app/composables/useCommands.ts
+++ b/app/composables/useCommands.ts
@@ -1,3 +1,5 @@
+import type { FlattenedCommand } from "#shared/types/discord";
+
 export function useCommands(options?: ApiComposableOptions) {
 	return createApiComposable<FlattenedCommand[]>("wolfstar:commands", "/commands", [], options);
 }
diff --git a/app/layouts/dashboard.vue b/app/layouts/dashboard.vue
index 45df2d987..6d2792a2c 100644
--- a/app/layouts/dashboard.vue
+++ b/app/layouts/dashboard.vue
@@ -190,7 +190,7 @@ watch(
 	{ immediate: true },
 );
 
-const requestFetch = useRequestFetch();
+const { $api } = useNuxtApp();
 const route = useRoute();
 const refreshGuildCache = computed(() => route.query.refresh === "true");
 
@@ -200,17 +200,18 @@ const {
 	error,
 } = useAsyncData(
 	() => `dashboard:guild:${guildId.value}`,
-	() => {
+	async () => {
 		const refreshQuery = refreshGuildCache.value ? { refresh: "true" } : undefined;
-		return Promise.all([
-			requestFetch<ValuesType<NonNullable<TransformedLoginData["transformedGuilds"]>>>(
-				`/api/guilds/${guildId.value}`,
+		const [guildResult, settingsResult] = await Promise.all([
+			$api<ValuesType<NonNullable<TransformedLoginData["transformedGuilds"]>>>(
+				`/guilds/${guildId.value}`,
 				{ query: refreshQuery },
 			),
-			requestFetch<string>(`/api/guilds/${guildId.value}/settings`, {
+			$api<string>(`/guilds/${guildId.value}/settings`, {
 				query: refreshQuery,
 			}),
 		]);
+		return [guildResult.data, settingsResult.data] as const;
 	},
 );
 
@@ -472,44 +473,45 @@ function isValidGuildId(id: string | undefined | null): boolean {
 }
 
 async function submitChanges() {
-	const { data } = await useFetch(`/api/guilds/${guildId.value}/settings`, {
+	const { data: response } = await $api<string | GuildData>(`/guilds/${guildId.value}/settings`, {
 		body: {
+			guild_id: guildId.value,
 			data: objectToTuples(guildSettingsChanges.value as Partial<GuildData>),
 		},
-		transform: (response: string) => {
-			try {
-				return JSON.parse(response);
-			} catch (error) {
-				logger.error(
-					`Failed to parse response from settings update for guild Id: ${guildId.value}`,
-					parseError(error),
-				);
-				throw createError({
-					message: "Failed to update guild settings",
-					why: "Something went wrong while saving your settings.",
-					status: 500,
-					fix: "Please try again later. If the issue persists, contact support.",
-					cause: error as Error,
-				});
-			}
-		},
 		method: "PATCH",
 	});
 
-	if (!data.value) {
+	let parsed: GuildData;
+	try {
+		parsed = typeof response === "string" ? (JSON.parse(response) as GuildData) : response;
+	} catch (error) {
+		logger.error(
+			`Failed to parse response from settings update for guild Id: ${guildId.value}`,
+			parseError(error),
+		);
+		throw createError({
+			message: "Failed to update guild settings",
+			why: "Something went wrong while saving your settings.",
+			status: 500,
+			fix: "Please try again later. If the issue persists, contact support.",
+			cause: error as Error,
+		});
+	}
+
+	if (!parsed || objectValues(parsed).length === 0) {
 		return;
 	}
 
-	if (!isNullOrUndefined(data.value) && objectValues(data.value).length !== 0) {
+	if (objectValues(parsed).length !== 0) {
 		if (!document.startViewTransition || effectiveReduceMotion.value) {
-			setGuildSettings(data.value!);
+			setGuildSettings(parsed);
 			setGuildSettingsChanges(undefined);
 		} else {
 			if (document.activeViewTransition) {
 				document.activeViewTransition.skipTransition();
 			}
 			document.startViewTransition(async () => {
-				setGuildSettings(data.value!);
+				setGuildSettings(parsed);
 				setGuildSettingsChanges(undefined);
 				await nextTick();
 			});
diff --git a/app/plugins/api.ts b/app/plugins/api.ts
index e2a0b651b..c38f2c7c3 100644
--- a/app/plugins/api.ts
+++ b/app/plugins/api.ts
@@ -1,3 +1,19 @@
+import type { CachedFetchFunction } from "#shared/utils/fetch-cache-config";
+
+/**
+ * Provides `$api` for the WolfStar bot API (`NUXT_PUBLIC_API_BASE_URL`),
+ * matching the legacy dashboard `apiFetch` behavior: call the bot origin
+ * directly with `credentials: "include"`.
+ *
+ * On the server, when a Discord session exists, a sapphire `SAPPHIRE_AUTH`
+ * cookie is attached so SSR can authorize guild routes without relying on a
+ * browser cookie set on the API domain. The cookie is encrypted with
+ * `NUXT_OAUTH_DISCORD_CLIENT_SECRET` (same secret sapphire-plugin-api uses).
+ *
+ * Crypto helpers live in `server/utils/botApi` and are loaded only inside the
+ * `import.meta.server` branch so `node:crypto` never enters the client bundle.
+ * Private `discord.clientSecret` is also read only on the server.
+ */
 export default defineNuxtPlugin(() => {
 	const cachedFetch = useCachedFetch();
 	const runtimeConfig = useRuntimeConfig();
@@ -5,18 +21,43 @@ export default defineNuxtPlugin(() => {
 
 	return {
 		provide: {
-			api: <T>(
+			api: async <T>(
 				url: Parameters<CachedFetchFunction>[0],
 				options?: Parameters<CachedFetchFunction>[1],
 				ttl?: Parameters<CachedFetchFunction>[2],
 			) => {
+				const headers: Record<string, string> = {
+					"Content-Type": "application/json",
+					...(options?.headers as Record<string, string> | undefined),
+				};
+
+				if (import.meta.server) {
+					const event = useRequestEvent();
+					const authorization = event?.context.$authorization;
+					if (authorization) {
+						const [{ getOptionalBotApiAuthHeaders }, user] = await Promise.all([
+							import("~~/server/utils/botApi"),
+							authorization.resolveServerUser(),
+						]);
+						const tokens = user ? await authorization.resolveServerTokens() : null;
+						Object.assign(
+							headers,
+							getOptionalBotApiAuthHeaders({
+								accessToken: tokens?.access_token,
+								secret: runtimeConfig.discord?.clientSecret ?? "",
+								userId: user?.id,
+							}),
+						);
+					}
+				}
+
 				return cachedFetch<T>(
 					url,
 					{
 						...options,
 						baseURL: apiBaseUrl,
 						credentials: "include",
-						headers: { "Content-Type": "application/json", ...options?.headers },
+						headers,
 					},
 					ttl,
 				);
diff --git a/app/plugins/payload-cache.client.ts b/app/plugins/payload-cache.client.ts
new file mode 100644
index 000000000..668d07eb7
--- /dev/null
+++ b/app/plugins/payload-cache.client.ts
@@ -0,0 +1,21 @@
+/**
+ * When `_payload.json` returns an ISR/empty fallback, async data with defaults
+ * may skip refetch during hydration. Refresh after suspense resolves so pages
+ * re-fetch once the client is interactive.
+ */
+export default defineNuxtPlugin({
+	name: "payload-cache-refresh",
+	setup(nuxtApp) {
+		nuxtApp.payload.data ||= {};
+
+		if (
+			nuxtApp.isHydrating &&
+			nuxtApp.payload.serverRendered &&
+			!Object.keys(nuxtApp.payload.data).length
+		) {
+			nuxtApp.hooks.hookOnce("app:suspense:resolve", () => {
+				refreshNuxtData();
+			});
+		}
+	},
+});
diff --git a/app/plugins/payload-cache.server.ts b/app/plugins/payload-cache.server.ts
new file mode 100644
index 000000000..2e95aadd0
--- /dev/null
+++ b/app/plugins/payload-cache.server.ts
@@ -0,0 +1,56 @@
+// oxlint-disable no-console -- dev-only payload-cache diagnostics
+import { stringify } from "devalue";
+
+/**
+ * Serializes the Nuxt payload after SSR and stashes it on the request event.
+ *
+ * The Nitro `payload-cache` plugin picks this up in `render:response` so a
+ * later `/_payload.json` request for the same route can be served from cache
+ * without a second full Vue SSR render (same approach as npmx.dev).
+ */
+export default defineNuxtPlugin({
+	name: "payload-cache",
+	setup(nuxtApp) {
+		if (import.meta.client) return;
+
+		nuxtApp.hooks.hook("app:rendered", () => {
+			const ssrContext = nuxtApp.ssrContext;
+			if (!ssrContext) return;
+
+			if (ssrContext.noSSR || ssrContext.error || ssrContext.payload?.error) return;
+
+			const payloadData = ssrContext.payload?.data;
+			if (!payloadData || Object.keys(payloadData).length === 0) return;
+
+			try {
+				const payload = {
+					data: ssrContext.payload.data,
+					prerenderedAt: ssrContext.payload.prerenderedAt,
+				};
+				const reducers =
+					(
+						ssrContext as typeof ssrContext & {
+							"~payloadReducers"?: Record<string, (value: unknown) => unknown>;
+						}
+					)["~payloadReducers"] ?? {};
+				const body = stringify(payload, reducers);
+
+				const event = ssrContext.event;
+				if (event) {
+					event.context._cachedPayloadResponse = {
+						body,
+						headers: {
+							"content-type": "application/json;charset=utf-8",
+							"x-powered-by": "Nuxt",
+						},
+						statusCode: 200,
+					};
+				}
+			} catch (error) {
+				if (import.meta.dev) {
+					console.warn("[payload-cache] Failed to serialize payload:", error);
+				}
+			}
+		});
+	},
+});
diff --git a/app/storybook/mocks/fixtures.ts b/app/storybook/mocks/fixtures.ts
index 6aba01a60..fc24ed7aa 100644
--- a/app/storybook/mocks/fixtures.ts
+++ b/app/storybook/mocks/fixtures.ts
@@ -70,7 +70,8 @@ export const mockUser = {
 export const mockCommands: WolfCommand[] = [
 	{
 		category: "Admin",
-		alias: ["rs"],
+		aliases: ["rs"],
+		subCategory: "",
 		description: "Manage unique role sets.",
 		extendedHelp: {
 			usages: [
diff --git a/app/storybook/mocks/handlers.ts b/app/storybook/mocks/handlers.ts
index aa8b8e474..1530c943b 100644
--- a/app/storybook/mocks/handlers.ts
+++ b/app/storybook/mocks/handlers.ts
@@ -18,24 +18,16 @@ export const handlers = [
 
 	http.get("/api/guilds", () => HttpResponse.json(mockGuildList)),
 
-	// The dashboard layout fetches the single guild to hydrate guild state.
-	http.get("/api/guilds/:guildId", () => HttpResponse.json(mockGuild)),
-
-	// The dashboard activity feed (General.vue) requests the guild audit log.
-	http.get("/api/guilds/:guildId/logs", () => HttpResponse.json({ entries: [], total: 0 })),
-
-	http.get("/api/guilds/:guildId/settings", () =>
+	// `$api` hits NUXT_PUBLIC_API_BASE_URL directly (legacy-style).
+	http.get("*/guilds/:guildId", () => HttpResponse.json(mockGuild)),
+	http.get("*/guilds/:guildId/audit-logs", () => HttpResponse.json({ entries: [], total: 0 })),
+	http.get("*/guilds/:guildId/settings", () =>
 		HttpResponse.json({
 			guildId: "123456789012345678",
 			prefix: "!",
 			language: "en-US",
 		}),
 	),
-
-	// External WolfStar bot API — proxied through createApiComposable("/commands")
 	http.get(/\/commands$/, () => HttpResponse.json(mockCommands)),
-
-	// External WolfStar bot API, proxied through createApiComposable("/languages").
-	// The dashboard manage page requests this on mount for the default section.
 	http.get(/\/languages$/, () => HttpResponse.json(["en-US", "es-ES", "fr-FR"])),
 ];
diff --git a/modules/cache.ts b/modules/cache.ts
index 767792305..939b609f8 100644
--- a/modules/cache.ts
+++ b/modules/cache.ts
@@ -2,6 +2,8 @@ import { defineNuxtModule, useRuntimeConfig } from "nuxt/kit";
 import { provider } from "std-env";
 // Storage key for fetch cache - must match shared/utils/fetch-cache-config.ts
 const FETCH_CACHE_STORAGE_BASE = "fetch-cache";
+// Storage key for payload cache - must match server/plugins/payload-cache.ts
+const PAYLOAD_CACHE_STORAGE_KEY = "payload-cache";
 
 export default defineNuxtModule({
 	meta: {
@@ -32,6 +34,13 @@ export default defineNuxtModule({
 				name: FETCH_CACHE_STORAGE_BASE,
 			};
 
+			// Runtime _payload.json cache (avoids a second SSR for ISR/cache routes)
+			nitroConfig.storage[PAYLOAD_CACHE_STORAGE_KEY] = {
+				...nitroConfig.storage[PAYLOAD_CACHE_STORAGE_KEY],
+				driver: "netlifyBlobs",
+				name: PAYLOAD_CACHE_STORAGE_KEY,
+			};
+
 			nitroConfig.storage["wolfstar:ratelimiter"] = {
 				accountId: config.cloudflare.accountId,
 				apiToken: config.cloudflare.apiToken,
diff --git a/nuxt.config.ts b/nuxt.config.ts
index c12998da5..60d5d16e6 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -220,7 +220,6 @@ export default defineNuxtConfig({
 				"Vary": "Cookie, Authorization",
 			},
 		},
-
 		"/oauth/**": {
 			robots: "nosnippet,notranslate,noimageindex,noarchive,max-snippet:-1,max-image-preview:none,max-video-preview:-1",
 			security: {
@@ -313,6 +312,10 @@ export default defineNuxtConfig({
 				base: "./.cache/fetch",
 				driver: "fsLite",
 			},
+			"payload-cache": {
+				base: "./.cache/payload",
+				driver: "fsLite",
+			},
 			"wolfstar:ratelimiter": {
 				base: "./.cache/ratelimiter",
 				driver: "fsLite",
diff --git a/package.json b/package.json
index da87d7449..5ea6ad0f3 100644
--- a/package.json
+++ b/package.json
@@ -94,6 +94,7 @@
 		"better-auth": "^1.6.23",
 		"chromatic": "^17.0.0",
 		"cnfast": "^0.0.8",
+		"devalue": "^5.8.1",
 		"dotenv": "^17.3.1",
 		"evlog": "^2.14.0",
 		"feed": "^5.2.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0ca2be832..0cfe69d9c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -141,6 +141,9 @@ importers:
       cnfast:
         specifier: ^0.0.8
         version: 0.0.8
+      devalue:
+        specifier: ^5.8.1
+        version: 5.8.1
       dotenv:
         specifier: ^17.3.1
         version: 17.4.2
diff --git a/server/plugins/fetch-cache.ts b/server/plugins/fetch-cache.ts
index 168647fdd..70b1bb9a4 100644
--- a/server/plugins/fetch-cache.ts
+++ b/server/plugins/fetch-cache.ts
@@ -1,51 +1,19 @@
-import type { CachedFetchEntry, CachedFetchResult } from "#shared/utils/fetch-cache-config";
+import type {
+	CachedFetchEntry,
+	CachedFetchFunction,
+	CachedFetchResult,
+} from "#shared/utils/fetch-cache-config";
 import type { H3Event } from "h3";
 import {
 	FETCH_CACHE_DEFAULT_TTL,
 	FETCH_CACHE_STORAGE_BASE,
-	FETCH_CACHE_VERSION,
-	isAllowedDomain,
+	generateFetchCacheKey,
 	isCacheEntryStale,
+	shouldCacheFetch,
 } from "#shared/utils/fetch-cache-config";
 import { log } from "evlog";
 import { $fetch } from "ofetch";
 
-/**
- * Simple hash function for cache keys.
- */
-function simpleHash(str: string): string {
-	let hash = 0;
-	for (let i = 0; i < str.length; i++) {
-		const char = str.charCodeAt(i);
-		hash = (hash << 5) - hash + char;
-		hash &= hash;
-	}
-	return Math.abs(hash).toString(36);
-}
-
-/**
- * Generate a cache key for a fetch request.
- */
-function generateFetchCacheKey(url: string | URL, method = "GET", body?: unknown): string {
-	// Relative URLs (e.g. "/api/commands") are same-origin and cache-eligible per
-	// isAllowedDomain; resolve them against a fixed base so `new URL` doesn't throw
-	// (it requires a base for relative inputs). Absolute URLs ignore the base.
-	const urlObj = typeof url === "string" ? new URL(url, "http://localhost") : url;
-	const bodyHash = body ? simpleHash(JSON.stringify(body)) : "";
-	const searchHash = urlObj.search ? simpleHash(urlObj.search) : "";
-
-	const parts = [
-		FETCH_CACHE_VERSION,
-		urlObj.host,
-		method.toUpperCase(),
-		urlObj.pathname,
-		searchHash,
-		bodyHash,
-	].filter(Boolean);
-
-	return parts.join(":");
-}
-
 /**
  * Server plugin that attaches a cachedFetch function to the event context.
  * This allows app composables to access the cached fetch via useRequestEvent().
@@ -68,14 +36,21 @@ export default defineNitroPlugin((nitroApp) => {
 			options: Parameters<typeof $fetch>[1] = {},
 			ttl: number = FETCH_CACHE_DEFAULT_TTL,
 		): Promise<CachedFetchResult<T>> => {
+			const cacheOptions = {
+				baseURL: typeof options.baseURL === "string" ? options.baseURL : undefined,
+				body: options.body,
+				headers: options.headers,
+				method: options.method,
+				query: options.query as Record<string, unknown> | undefined,
+			};
+
 			// Check if this URL should be cached
-			if (!isAllowedDomain(url)) {
+			if (!shouldCacheFetch(url, cacheOptions)) {
 				const data = (await $fetch(url, options)) as T;
 				return { cachedAt: null, data, isStale: false };
 			}
 
-			const method = options.method || "GET";
-			const cacheKey = generateFetchCacheKey(url, method, options.body);
+			const cacheKey = generateFetchCacheKey(url, cacheOptions);
 
 			// Try to get cached response (with error handling for storage failures)
 			let cached: CachedFetchEntry<T> | null = null;
diff --git a/server/plugins/payload-cache.ts b/server/plugins/payload-cache.ts
new file mode 100644
index 000000000..a0addd5a6
--- /dev/null
+++ b/server/plugins/payload-cache.ts
@@ -0,0 +1,155 @@
+// oxlint-disable no-console -- dev-only payload-cache diagnostics
+import type { H3Event } from "h3";
+
+/**
+ * Runtime payload cache for ISR/cache-enabled public routes.
+ *
+ * Mirrors Nuxt's pre-render `payloadCache` at runtime (see npmx.dev PR #1643):
+ * - HTML SSR for cacheable routes stashes a serialized payload on the event
+ * - `_payload.json` requests check the cache first and skip a second SSR
+ */
+
+const PAYLOAD_URL_RE = /^[^?]*\/_payload\.json(?:\?.*)?$/;
+const PAYLOAD_CACHE_STORAGE_KEY = "payload-cache";
+
+/** Default TTL for cached payloads (seconds). */
+const PAYLOAD_CACHE_TTL = 60;
+
+/**
+ * Grace period beyond TTL where stale payloads are still served (seconds).
+ * Avoids a race where HTML is still cached but the payload entry just expired.
+ */
+const PAYLOAD_CACHE_STALE_TTL = PAYLOAD_CACHE_TTL * 2;
+
+interface CachedPayload {
+	body: string;
+	buildId: string;
+	cachedAt: number;
+	headers: Record<string, string>;
+	statusCode: number;
+}
+
+function getRouteFromPayloadUrl(url: string): string {
+	const withoutQuery = url.replace(/\?.*$/, "");
+	return withoutQuery.substring(0, withoutQuery.lastIndexOf("/")) || "/";
+}
+
+/**
+ * Only cache public ISR/cache routes — never authenticated dashboard payloads.
+ */
+function shouldCachePayload(event: H3Event): boolean {
+	const rules = getRouteRules(event);
+	if (rules.auth) {
+		return false;
+	}
+	return Boolean(rules.isr || rules.cache);
+}
+
+export default defineNitroPlugin((nitroApp) => {
+	const storage = useStorage(PAYLOAD_CACHE_STORAGE_KEY);
+	const buildId = String(useRuntimeConfig().app.buildId ?? "dev");
+
+	function getCacheKey(routePath: string): string {
+		return `${buildId}:${routePath}`;
+	}
+
+	nitroApp.hooks.hook("render:before", async (ctx) => {
+		if (!PAYLOAD_URL_RE.test(ctx.event.path)) return;
+		if (!shouldCachePayload(ctx.event)) return;
+
+		const routePath = getRouteFromPayloadUrl(ctx.event.path);
+		const cacheKey = getCacheKey(routePath);
+
+		try {
+			const cached = await storage.getItem<CachedPayload>(cacheKey);
+			if (!cached) return;
+			if (cached.buildId !== buildId) return;
+
+			const age = (Date.now() - cached.cachedAt) / 1000;
+			if (age > PAYLOAD_CACHE_STALE_TTL) return;
+
+			if (import.meta.dev) {
+				console.log(`[payload-cache] HIT: ${routePath} (age: ${age.toFixed(1)}s)`);
+			}
+
+			ctx.response = {
+				body: cached.body,
+				headers: cached.headers,
+				statusCode: cached.statusCode,
+				statusMessage: "OK",
+			};
+		} catch (error) {
+			if (import.meta.dev) {
+				console.warn(`[payload-cache] Cache read failed for ${routePath}:`, error);
+			}
+		}
+	});
+
+	nitroApp.hooks.hook("render:response", (response, ctx) => {
+		if (!response.statusCode || response.statusCode >= 400) return;
+		if (!shouldCachePayload(ctx.event)) return;
+
+		const isPayloadRequest = PAYLOAD_URL_RE.test(ctx.event.path);
+		const contentType = response.headers?.["content-type"];
+		const isHtmlResponse = typeof contentType === "string" && contentType.includes("text/html");
+
+		if (isPayloadRequest) {
+			if (typeof response.body !== "string") return;
+			const routePath = getRouteFromPayloadUrl(ctx.event.path);
+			cachePayload(ctx.event, routePath, {
+				body: response.body,
+				headers: {
+					"content-type": "application/json;charset=utf-8",
+					"x-powered-by": "Nuxt",
+				},
+				statusCode: response.statusCode ?? 200,
+			});
+			return;
+		}
+
+		if (!isHtmlResponse) return;
+
+		const cachedPayload = ctx.event.context._cachedPayloadResponse;
+		if (!cachedPayload) return;
+
+		const pathWithoutQuery = ctx.event.path.replace(/\?.*$/, "");
+		const routePath = pathWithoutQuery === "/" ? "/" : pathWithoutQuery.replace(/\/$/, "");
+		cachePayload(ctx.event, routePath, cachedPayload);
+		delete ctx.event.context._cachedPayloadResponse;
+	});
+
+	function cachePayload(
+		event: H3Event,
+		routePath: string,
+		payload: { body: string; headers: Record<string, string>; statusCode: number },
+	) {
+		const cacheKey = getCacheKey(routePath);
+		const entry: CachedPayload = {
+			...payload,
+			buildId,
+			cachedAt: Date.now(),
+		};
+
+		event.waitUntil?.(
+			storage.setItem(cacheKey, entry).catch((error: unknown) => {
+				if (import.meta.dev) {
+					console.warn(`[payload-cache] Cache write failed for ${routePath}:`, error);
+				}
+			}),
+		);
+
+		if (import.meta.dev) {
+			console.log(`[payload-cache] CACHED: ${routePath}`);
+		}
+	}
+});
+
+declare module "h3" {
+	interface H3EventContext {
+		_cachedPayloadResponse?: {
+			body: string;
+			headers: Record<string, string>;
+			statusCode: number;
+		};
+	}
+}
diff --git a/server/utils/botApi.ts b/server/utils/botApi.ts
new file mode 100644
index 000000000..0584a5d4a
--- /dev/null
+++ b/server/utils/botApi.ts
@@ -0,0 +1,65 @@
+import type { BotApiAuthPayload, BotApiAuthSessionInput } from "#shared/types/botApi";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+
+export const DEFAULT_BOT_API_AUTH_COOKIE = "SAPPHIRE_AUTH";
+
+export function getBotApiAuthCookieName(): string {
+	return process.env.NUXT_BOT_API_AUTH_COOKIE || DEFAULT_BOT_API_AUTH_COOKIE;
+}
+
+/**
+ * Encrypt a sapphire-plugin-api auth payload (aes-256-cbc), matching
+ * `@sapphire/plugin-api` Auth.encrypt so api.wolfstar.rocks accepts the cookie.
+ * The secret is the Discord OAuth client secret (`NUXT_OAUTH_DISCORD_CLIENT_SECRET`).
+ */
+export function encryptBotApiAuth(data: BotApiAuthPayload, secret: string): string {
+	const iv = randomBytes(16);
+	const cipher = createCipheriv("aes-256-cbc", secret, iv);
+	return `${cipher.update(JSON.stringify(data), "utf8", "base64") + cipher.final("base64")}.${iv.toString("base64")}`;
+}
+
+/**
+ * Decrypt a sapphire-plugin-api auth token. Returns null when expired or invalid.
+ */
+export function decryptBotApiAuth(token: string, secret: string): BotApiAuthPayload | null {
+	const [data, iv] = token.split(".");
+	if (!data || !iv) {
+		return null;
+	}
+	try {
+		const decipher = createDecipheriv("aes-256-cbc", secret, Buffer.from(iv, "base64"));
+		const parsed = JSON.parse(
+			decipher.update(data, "base64", "utf8") + decipher.final("utf8"),
+		) as BotApiAuthPayload;
+		return parsed.expires >= Date.now() ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * Build outbound Cookie headers for sapphire-plugin-api when session credentials exist.
+ * Returns an empty object when the user/token/secret is missing.
+ */
+export function getOptionalBotApiAuthHeaders(
+	input: BotApiAuthSessionInput,
+): Record<string, string> {
+	const { accessToken, secret, userId } = input;
+	if (!userId || !accessToken || !secret) {
+		return {};
+	}
+
+	const cookieValue = encryptBotApiAuth(
+		{
+			expires: Date.now() + (input.expiresInMs ?? 60 * 60 * 1000),
+			id: userId,
+			refresh: "",
+			token: accessToken,
+		},
+		secret,
+	);
+
+	return {
+		Cookie: `${input.cookieName ?? getBotApiAuthCookieName()}=${cookieValue}`,
+	};
+}
diff --git a/server/utils/discord/index.ts b/server/utils/discord/index.ts
index dfadbe75f..3f4fd6a62 100644
--- a/server/utils/discord/index.ts
+++ b/server/utils/discord/index.ts
@@ -1,6 +1,7 @@
 // oxlint-disable no-console
 import type { ReadonlyGuildData } from "#server/database";
 import type {
+	FlattenedCommand,
 	FlattenedGuild,
 	LoginData,
 	OauthFlattenedGuild,
@@ -476,21 +477,59 @@ export const fetchCommands = defineCachedFunction(
 		const {
 			public: { apiBaseUrl },
 		} = useRuntimeConfig();
+		if (!apiBaseUrl) {
+			throw createError({
+				message: "Bot API base URL is not configured",
+				status: 500,
+				why: "NUXT_PUBLIC_API_BASE_URL is missing",
+				fix: "Set NUXT_PUBLIC_API_BASE_URL to the WolfStar bot API origin (e.g. https://api.wolfstar.rocks)",
+			});
+		}
 		Sentry.metrics.count("bot_api.call", 1, {
 			attributes: { endpoint: "commands.fetch" },
 		});
-		const commands = await instrumentBotApiCall("commands.fetch", () =>
-			$fetch<WolfCommand[]>(`${apiBaseUrl}/commands`, {
+		return await instrumentBotApiCall("commands.fetch", () =>
+			$fetch<FlattenedCommand[]>(`${apiBaseUrl}/commands`, {
 				credentials: "include",
 				headers: {
 					"Content-Type": "application/json",
 				},
 			}),
 		);
-		return commands;
 	},
 	{
 		maxAge: hours(1),
 		getKey: () => "commands",
 	},
 );
+
+export const fetchLanguages = defineCachedFunction(
+	async () => {
+		const {
+			public: { apiBaseUrl },
+		} = useRuntimeConfig();
+		if (!apiBaseUrl) {
+			throw createError({
+				message: "Bot API base URL is not configured",
+				status: 500,
+				why: "NUXT_PUBLIC_API_BASE_URL is missing",
+				fix: "Set NUXT_PUBLIC_API_BASE_URL to the WolfStar bot API origin (e.g. https://api.wolfstar.rocks)",
+			});
+		}
+		Sentry.metrics.count("bot_api.call", 1, {
+			attributes: { endpoint: "languages.fetch" },
+		});
+		return await instrumentBotApiCall("languages.fetch", () =>
+			$fetch<string[]>(`${apiBaseUrl}/languages`, {
+				credentials: "include",
+				headers: {
+					"Content-Type": "application/json",
+				},
+			}),
+		);
+	},
+	{
+		maxAge: hours(1),
+		getKey: () => "languages",
+	},
+);
diff --git a/server/utils/runtimeConfig.ts b/server/utils/runtimeConfig.ts
index 7648cd1a2..b07ac58b2 100644
--- a/server/utils/runtimeConfig.ts
+++ b/server/utils/runtimeConfig.ts
@@ -46,7 +46,9 @@ export function generateRuntimeConfig() {
 			redirectURI: process.env.NUXT_OAUTH_DISCORD_REDIRECT_URL,
 		},
 		public: {
-			apiBaseUrl: process.env.NUXT_PUBLIC_API_BASE_URL,
+			// Internal WolfStar bot API. Production default is api.wolfstar.rocks;
+			// override with NUXT_PUBLIC_API_BASE_URL for local bot instances.
+			apiBaseUrl: process.env.NUXT_PUBLIC_API_BASE_URL || "https://api.wolfstar.rocks",
 			clientId: process.env.NUXT_OAUTH_DISCORD_CLIENT_ID,
 			environment: process.env.NODE_ENV ?? "production",
 			sentry: {
diff --git a/shared/types/botApi.ts b/shared/types/botApi.ts
new file mode 100644
index 000000000..b0745d415
--- /dev/null
+++ b/shared/types/botApi.ts
@@ -0,0 +1,18 @@
+/**
+ * Payload encrypted into the sapphire-plugin-api `SAPPHIRE_AUTH` cookie.
+ */
+export interface BotApiAuthPayload {
+	expires: number;
+	id: string;
+	refresh: string;
+	token: string;
+}
+
+export interface BotApiAuthSessionInput {
+	accessToken?: string | null;
+	cookieName?: string;
+	/** Token lifetime for the sapphire cookie. Defaults to 1 hour. */
+	expiresInMs?: number;
+	secret: string;
+	userId?: string | null;
+}
diff --git a/shared/types/index.ts b/shared/types/index.ts
index 00aae2b02..aea0c5fa6 100644
--- a/shared/types/index.ts
+++ b/shared/types/index.ts
@@ -1,4 +1,5 @@
 export * from "./audit-log";
+export * from "./botApi";
 export * from "./configurableData";
 export * from "./discord";
 export * from "./env";
diff --git a/shared/utils/fetch-cache-config.ts b/shared/utils/fetch-cache-config.ts
index e8fc73637..79c2cf643 100644
--- a/shared/utils/fetch-cache-config.ts
+++ b/shared/utils/fetch-cache-config.ts
@@ -27,13 +27,145 @@ export const FETCH_CACHE_DEFAULT_TTL = 60 * 5; // 5 minutes
  * Cache key version prefix.
  * Increment this to invalidate all cached entries (e.g., after format changes).
  */
-export const FETCH_CACHE_VERSION = "v1";
+export const FETCH_CACHE_VERSION = "v2";
 
 /**
  * Storage key prefix for fetch cache entries.
  */
 export const FETCH_CACHE_STORAGE_BASE = "fetch-cache";
 
+/**
+ * Simple hash for cache-key segments (query, body, auth headers).
+ */
+export function simpleHash(str: string): string {
+	let hash = 0;
+	for (let i = 0; i < str.length; i++) {
+		const char = str.charCodeAt(i);
+		hash = (hash << 5) - hash + char;
+		hash &= hash;
+	}
+	return Math.abs(hash).toString(36);
+}
+
+export type FetchCacheKeyOptions = {
+	method?: string;
+	body?: unknown;
+	baseURL?: string;
+	query?: Record<string, unknown>;
+	headers?: HeadersInit;
+};
+
+/**
+ * Resolve a fetch URL the same way ofetch does for cache eligibility / keys:
+ * apply `baseURL` and merge `query` into the search string.
+ */
+export function resolveFetchCacheUrl(url: string, options: FetchCacheKeyOptions = {}): URL {
+	const base = options.baseURL || "http://localhost";
+	const urlObj = new URL(url, base);
+
+	if (options.query) {
+		for (const [key, value] of Object.entries(options.query)) {
+			if (value === undefined || value === null) {
+				continue;
+			}
+			if (Array.isArray(value)) {
+				for (const entry of value) {
+					urlObj.searchParams.append(key, String(entry));
+				}
+			} else {
+				urlObj.searchParams.set(key, String(value));
+			}
+		}
+	}
+
+	return urlObj;
+}
+
+function readHeader(headers: HeadersInit | undefined, name: string): string | undefined {
+	if (!headers) {
+		return undefined;
+	}
+
+	const lower = name.toLowerCase();
+
+	if (headers instanceof Headers) {
+		return headers.get(name) ?? undefined;
+	}
+
+	if (Array.isArray(headers)) {
+		for (const [key, value] of headers) {
+			if (key.toLowerCase() === lower) {
+				return value;
+			}
+		}
+		return undefined;
+	}
+
+	for (const [key, value] of Object.entries(headers)) {
+		if (key.toLowerCase() === lower) {
+			if (Array.isArray(value)) {
+				const first = value[0];
+				return first === undefined ? undefined : String(first);
+			}
+			return value === undefined ? undefined : String(value);
+		}
+	}
+
+	return undefined;
+}
+
+/**
+ * Auth-scoped fragment for cache keys. Authenticated SSR responses must not
+ * be reused across users; public/anonymous calls share one entry.
+ */
+export function getFetchCacheAuthKey(headers: HeadersInit | undefined): string {
+	const cookie = readHeader(headers, "cookie");
+	const authorization = readHeader(headers, "authorization");
+	const material = [cookie, authorization].filter(Boolean).join("|");
+	return material ? simpleHash(material) : "";
+}
+
+/**
+ * Generate a cache key that includes host (via baseURL), query, body, and auth.
+ */
+export function generateFetchCacheKey(url: string, options: FetchCacheKeyOptions = {}): string {
+	const urlObj = resolveFetchCacheUrl(url, options);
+	const method = (options.method || "GET").toUpperCase();
+	const bodyHash = options.body ? simpleHash(JSON.stringify(options.body)) : "";
+	const searchHash = urlObj.search ? simpleHash(urlObj.search) : "";
+	const authHash = getFetchCacheAuthKey(options.headers);
+
+	return [
+		FETCH_CACHE_VERSION,
+		urlObj.host,
+		method,
+		urlObj.pathname,
+		searchHash,
+		bodyHash,
+		authHash,
+	]
+		.filter(Boolean)
+		.join(":");
+}
+
+/**
+ * Whether a fetch URL should use the SSR fetch cache.
+ *
+ * Relative URLs without `baseURL` are treated as same-origin and allowed.
+ * Relative URLs with `baseURL` (e.g. `$api`) are checked against the resolved host.
+ */
+export function shouldCacheFetch(url: string, options: FetchCacheKeyOptions = {}): boolean {
+	if (typeof url === "string" && url.startsWith("/") && !options.baseURL) {
+		return true;
+	}
+
+	try {
+		return isAllowedDomain(resolveFetchCacheUrl(url, options));
+	} catch {
+		return false;
+	}
+}
+
 /**
  * Check if a URL's host is in the allowed domains list.
  *
diff --git a/test/unit/server/utils/botApi.spec.ts b/test/unit/server/utils/botApi.spec.ts
new file mode 100644
index 000000000..b383fa963
--- /dev/null
+++ b/test/unit/server/utils/botApi.spec.ts
@@ -0,0 +1,92 @@
+import type { BotApiAuthPayload } from "#shared/types/botApi";
+import { describe, expect, it } from "vitest";
+import {
+	decryptBotApiAuth,
+	encryptBotApiAuth,
+	getOptionalBotApiAuthHeaders,
+} from "../../../../server/utils/botApi";
+
+// aes-256-cbc requires a 32-byte key — match Discord client-secret length.
+const SECRET = "0123456789abcdef0123456789abcdef";
+
+describe("botApi auth cookie crypto", () => {
+	it("round-trips a valid payload", () => {
+		const payload: BotApiAuthPayload = {
+			expires: Date.now() + 60_000,
+			id: "123456789012345678",
+			refresh: "refresh-token",
+			token: "access-token",
+		};
+
+		const encrypted = encryptBotApiAuth(payload, SECRET);
+		expect(encrypted).toContain(".");
+
+		const decrypted = decryptBotApiAuth(encrypted, SECRET);
+		expect(decrypted).toStrictEqual(payload);
+	});
+
+	it("returns null for expired payloads", () => {
+		const encrypted = encryptBotApiAuth(
+			{
+				expires: Date.now() - 1,
+				id: "1",
+				refresh: "",
+				token: "t",
+			},
+			SECRET,
+		);
+		expect(decryptBotApiAuth(encrypted, SECRET)).toBeNull();
+	});
+
+	it("returns null for tampered tokens", () => {
+		const encrypted = encryptBotApiAuth(
+			{
+				expires: Date.now() + 60_000,
+				id: "1",
+				refresh: "",
+				token: "t",
+			},
+			SECRET,
+		);
+		const [data, iv] = encrypted.split(".");
+		expect(data).toBeTruthy();
+		expect(iv).toBeTruthy();
+		const tampered = `AAAA${data!.slice(4)}.${iv}`;
+		expect(decryptBotApiAuth(tampered, SECRET)).toBeNull();
+		expect(decryptBotApiAuth("not-a-token", SECRET)).toBeNull();
+	});
+});
+
+describe("getOptionalBotApiAuthHeaders", () => {
+	it("returns an empty object when credentials are missing", () => {
+		expect(
+			getOptionalBotApiAuthHeaders({
+				accessToken: null,
+				secret: SECRET,
+				userId: "1",
+			}),
+		).toStrictEqual({});
+		expect(
+			getOptionalBotApiAuthHeaders({
+				accessToken: "token",
+				secret: "",
+				userId: "1",
+			}),
+		).toStrictEqual({});
+	});
+
+	it("builds a Cookie header that decrypts to the session payload", () => {
+		const headers = getOptionalBotApiAuthHeaders({
+			accessToken: "access-token",
+			cookieName: "SAPPHIRE_AUTH",
+			secret: SECRET,
+			userId: "123456789012345678",
+		});
+
+		expect(headers.Cookie).toMatch(/^SAPPHIRE_AUTH=.[^\n\r.\u2028\u2029]*\..+$/);
+		const token = headers.Cookie!.slice("SAPPHIRE_AUTH=".length);
+		const decrypted = decryptBotApiAuth(token, SECRET);
+		expect(decrypted?.id).toBe("123456789012345678");
+		expect(decrypted?.token).toBe("access-token");
+	});
+});
diff --git a/test/unit/shared/utils/fetch-cache-config.test.ts b/test/unit/shared/utils/fetch-cache-config.test.ts
index 10a12cce5..a78ffc330 100644
--- a/test/unit/shared/utils/fetch-cache-config.test.ts
+++ b/test/unit/shared/utils/fetch-cache-config.test.ts
@@ -4,8 +4,11 @@ import {
 	FETCH_CACHE_DEFAULT_TTL,
 	FETCH_CACHE_STORAGE_BASE,
 	FETCH_CACHE_VERSION,
+	generateFetchCacheKey,
 	isAllowedDomain,
 	isCacheEntryStale,
+	resolveFetchCacheUrl,
+	shouldCacheFetch,
 } from "#shared/utils/fetch-cache-config";
 import { describe, expect, it, vi } from "vitest";
 
@@ -115,7 +118,7 @@ describe("constants", () => {
 	});
 
 	it("should have a cache version", () => {
-		expect(FETCH_CACHE_VERSION).toBe("v1");
+		expect(FETCH_CACHE_VERSION).toBe("v2");
 	});
 
 	it("should have a storage base key", () => {
@@ -127,3 +130,80 @@ describe("constants", () => {
 		expect(FETCH_CACHE_ALLOWED_DOMAINS).toContain("api.wolfstar.rocks");
 	});
 });
+
+describe("resolveFetchCacheUrl", () => {
+	it("should apply baseURL to relative paths", () => {
+		const resolved = resolveFetchCacheUrl("/guilds/1/settings", {
+			baseURL: "https://api.wolfstar.rocks",
+		});
+		expect(resolved.href).toBe("https://api.wolfstar.rocks/guilds/1/settings");
+	});
+
+	it("should merge query options into the search string", () => {
+		const resolved = resolveFetchCacheUrl("/audit-logs", {
+			baseURL: "https://api.wolfstar.rocks",
+			query: { limit: 25, page: 2 },
+		});
+		expect(resolved.searchParams.get("limit")).toBe("25");
+		expect(resolved.searchParams.get("page")).toBe("2");
+	});
+});
+
+describe("shouldCacheFetch", () => {
+	it("should allow same-origin relative URLs without baseURL", () => {
+		expect(shouldCacheFetch("/api/users")).toBe(true);
+	});
+
+	it("should allow relative URLs when baseURL is an allowed host", () => {
+		expect(shouldCacheFetch("/commands", { baseURL: "https://api.wolfstar.rocks" })).toBe(true);
+	});
+
+	it("should reject relative URLs when baseURL is disallowed", () => {
+		expect(shouldCacheFetch("/commands", { baseURL: "https://evil.com" })).toBe(false);
+	});
+});
+
+describe("generateFetchCacheKey", () => {
+	it("should include the resolved host from baseURL", () => {
+		const key = generateFetchCacheKey("/commands", {
+			baseURL: "https://api.wolfstar.rocks",
+		});
+		expect(key).toContain("api.wolfstar.rocks");
+		expect(key).toContain("/commands");
+	});
+
+	it("should differ when query params differ", () => {
+		const a = generateFetchCacheKey("/audit-logs", {
+			baseURL: "https://api.wolfstar.rocks",
+			query: { page: 1 },
+		});
+		const b = generateFetchCacheKey("/audit-logs", {
+			baseURL: "https://api.wolfstar.rocks",
+			query: { page: 2 },
+		});
+		expect(a).not.toBe(b);
+	});
+
+	it("should differ when Cookie headers differ", () => {
+		const a = generateFetchCacheKey("/guilds/1/settings", {
+			baseURL: "https://api.wolfstar.rocks",
+			headers: { Cookie: "SAPPHIRE_AUTH=user-a" },
+		});
+		const b = generateFetchCacheKey("/guilds/1/settings", {
+			baseURL: "https://api.wolfstar.rocks",
+			headers: { Cookie: "SAPPHIRE_AUTH=user-b" },
+		});
+		expect(a).not.toBe(b);
+	});
+
+	it("should share keys for anonymous requests", () => {
+		const a = generateFetchCacheKey("/commands", {
+			baseURL: "https://api.wolfstar.rocks",
+		});
+		const b = generateFetchCacheKey("/commands", {
+			baseURL: "https://api.wolfstar.rocks",
+			headers: { "Content-Type": "application/json" },
+		});
+		expect(a).toBe(b);
+	});
+});