fix(maintenance): add skill version privacy removal

Fixes #1195.

Fixes #1182.

.agents/skills/blacksmith-testbox/SKILL.md

@@ -0,0 +1,347 @@
+---
+name: blacksmith-testbox
+description: Run Blacksmith Testbox for ClawHub CI-parity checks, hosted services, broad Bun gates, or builds local cannot reproduce without hurting developer machines.
+---
+
+# Blacksmith Testbox
+
+## Scope
+
+Use Testbox when you need remote CI parity, injected secrets, hosted services,
+or an OS/runtime image that your local machine cannot provide cheaply.
+
+Do not default to Testbox for every local test/build loop. If the repo has
+documented local commands for normal iteration, use those first so you keep
+warm caches, local build state, and fast feedback.
+
+Testbox is the expensive path. Reach for it deliberately.
+
+ClawHub maintainers can opt into Testbox-first validation by setting
+`CLAWHUB_TESTBOX=1` in their environment or standing agent rules. This mode is
+maintainers-only and requires Blacksmith access.
+
+When `CLAWHUB_TESTBOX=1` is set in ClawHub:
+
+- Pre-warm a Testbox early for longer, wider, or uncertain work.
+- Prefer Testbox for broad Bun gates, e2e, Convex-ish deploy parity, package
+  proof, and expensive validation.
+- Reuse the same Testbox ID for every run command in the same task/session.
+- Use local commands only when the task explicitly sets
+  `CLAWHUB_LOCAL_CHECK_MODE=throttled|full`, or when the user asks for local
+  proof.
+
+## Install The CLI
+
+If `blacksmith` is not installed, install it:
+
+```bash
+curl -fsSL https://get.blacksmith.sh | sh
+```
+
+For the canary channel:
+
+```bash
+BLACKSMITH_CHANNEL=canary sh -c 'curl -fsSL https://get.blacksmith.sh | sh'
+```
+
+Then authenticate:
+
+```bash
+blacksmith auth login
+```
+
+## Agent-Triggered Browser Auth
+
+When an agent needs to ensure the user is authenticated before running Testbox
+commands, use browser-based auth with non-interactive mode. This opens the
+browser for the user to sign in; the agent does not interact with the browser.
+
+`--organization` is required with `--non-interactive`:
+
+```bash
+blacksmith auth login --non-interactive --organization <org-slug>
+```
+
+The org slug can come from `BLACKSMITH_ORG` or the `--org` global flag. Do not
+use `--api-token` for this browser flow; that is for headless/token auth.
+
+## Decide First: Local Or Testbox
+
+Before warming anything up, check the repo's own instructions.
+
+Prefer local commands when:
+
+- the repo documents a supported local test/build workflow
+- you are iterating on unit tests, lint, typecheck, formatting, or other
+  local-only validation
+- the value comes from warm local caches and fast repeat runs
+- the command does not need remote secrets, hosted services, or CI-only images
+
+Prefer Testbox when:
+
+- `CLAWHUB_TESTBOX=1` is set by the user, agent environment, or standing rules
+- the repo explicitly requires CI-parity or remote validation
+- the command needs secrets, service containers, or provisioned infra
+- you are reproducing CI-only failures
+- you need the exact workflow image/job environment from GitHub Actions
+
+For ClawHub specifically, normal local iteration stays local unless maintainer
+Testbox mode is enabled with `CLAWHUB_TESTBOX=1`:
+
+- `bun run format:check`
+- `bun run lint`
+- `bun run test`
+- `bun run coverage`
+- `bunx tsc --noEmit`
+- `bun run build`
+
+If `CLAWHUB_TESTBOX=1` is enabled, run those same repo commands inside the warm
+Testbox. If the user wants laptop-friendly local proof for one command, use the
+explicit escape hatch `CLAWHUB_LOCAL_CHECK_MODE=throttled`.
+
+In `.codex` worktrees without a `node_modules` symlink, do not run
+`bun install` just to validate locally. Use syntax checks or Testbox.
+
+## Setup: Warmup Before Coding
+
+If you decided Testbox is warranted, warm one up early. This returns an ID
+instantly and boots the CI environment in the background while you work:
+
+```bash
+blacksmith testbox warmup ci-check-testbox.yml --ref main --idle-timeout 90
+# -> tbx_01jkz5b3t9...
+```
+
+Save this ID in the current session. You need it for every `run` command.
+Treat `blacksmith testbox list` as diagnostics, not a reusable work queue.
+Listed boxes can be visible at the org/repo level while still being unusable or
+stale for the current local agent lane.
+
+For ClawHub maintainer Testbox mode, claim the ID in the current checkout:
+
+```bash
+bun run testbox:claim -- --id <ID>
+```
+
+Warmup dispatches `.github/workflows/ci-check-testbox.yml`, which provisions a
+VM with Bun, Node, dependency install/cache, and a clean checkout of the repo at
+the chosen ref.
+
+Bootstrap note: GitHub only exposes `workflow_dispatch` workflows through the
+Actions API after the workflow file exists on the default branch. If a brand-new
+Testbox workflow exists only on a feature branch, `blacksmith testbox warmup
+ci-check-testbox.yml --ref <branch>` can return a GitHub 404 even though the
+file exists on that branch. Land the workflow bootstrap first, then dispatch
+branch refs normally.
+
+Options:
+
+```text
+--ref <branch|tag>     Git ref to dispatch against
+--job <name>           Specific job within the workflow, if it has multiple
+--idle-timeout <min>   Idle timeout in minutes
+```
+
+## Critical: Always Run From The Repo Root
+
+Always invoke `blacksmith testbox` commands from the root of the git
+repository. The CLI syncs the current working directory to the testbox using
+rsync with `--delete`. If you run from a subdirectory, rsync mirrors only that
+subdirectory and can delete everything else on the testbox.
+
+Correct:
+
+```bash
+blacksmith testbox run --id <ID> "bun run test"
+blacksmith testbox run --id <ID> "cd packages/clawhub && bun run verify"
+```
+
+Wrong:
+
+```bash
+cd packages/clawhub && blacksmith testbox run --id <ID> "bun run verify"
+```
+
+If your shell is in a subdirectory, move back first:
+
+```bash
+cd "$(git rev-parse --show-toplevel)"
+```
+
+## Running Commands
+
+Raw Blacksmith form:
+
+```bash
+blacksmith testbox run --id <ID> "<command>"
+```
+
+The `run` command waits for the testbox to become ready if it is still booting,
+so you can call `run` immediately after warmup.
+
+In ClawHub, prefer the guarded runner wrapper so stale/reused ids fail before
+the Blacksmith CLI spends time syncing or emits a confusing missing-key error:
+
+```bash
+bun run testbox:run -- --id <ID> -- bun run lint
+bun run testbox:run -- --id <ID> -- bun run test
+bun run testbox:run -- --id <ID> -- bun run build
+```
+
+The wrapper refuses to run when the local per-Testbox key is missing or when
+the id was not claimed by this ClawHub checkout with:
+
+```bash
+bun run testbox:claim -- --id <ID>
+```
+
+Treat that as the expected remediation, not as a GitHub account or normal
+SSH-key problem. A local key alone is not enough; a ready box may still carry
+stale rsync state from another lane.
+
+If the agent crashes, the remote box relies on Blacksmith's idle timeout. The
+local ClawHub claim marker is not deleted automatically, so the wrapper treats
+claims older than 12 hours as stale. Override only for intentional long-running
+work with:
+
+```bash
+CLAWHUB_TESTBOX_CLAIM_TTL_MINUTES=<minutes>
+```
+
+Before spending a broad gate on a manually assembled command, run:
+
+```bash
+bun run testbox:sanity -- --id <ID>
+```
+
+## Downloading Files From A Testbox
+
+Use the `download` command to retrieve files or directories from a running
+testbox to your local machine. This is useful for fetching build artifacts,
+test results, coverage reports, or any output generated on the testbox.
+
+```bash
+blacksmith testbox download --id <ID> <remote-path> [local-path]
+```
+
+The remote path is relative to the testbox working directory. If no local path
+is specified, the file is saved to the current directory using the same base
+name.
+
+Examples:
+
+```bash
+blacksmith testbox download --id <ID> coverage/lcov-report/ ./coverage/
+blacksmith testbox download --id <ID> test-results/ ./test-results/
+blacksmith testbox download --id <ID> dist/ ./dist/
+```
+
+## How File Sync Works
+
+Understanding this model is critical for using Testbox correctly.
+
+When you call `run`, the CLI performs a delta sync of your local changes to the
+remote testbox before executing your command:
+
+1. The testbox VM starts from a clean checkout at the warmup ref. The workflow
+   setup steps run during warmup and populate dependency directories on the
+   remote VM.
+2. On each `run`, the CLI uses git to detect which files changed locally since
+   the last sync. It syncs only tracked files and untracked non-ignored files.
+3. `.gitignore`'d directories are never synced. `node_modules/`, `.bun/`,
+   `.vite/`, `dist/`, `.output/`, `.nitro/`, and coverage outputs stay local.
+   The testbox uses its own copies populated by the warmup workflow.
+4. If nothing has changed since the last sync, the sync is skipped.
+
+Why this matters:
+
+- If you modify `package.json` or `bun.lock`, re-run install on the testbox:
+
+  ```bash
+  bun run testbox:run -- --id <ID> -- bun install --frozen-lockfile
+  ```
+
+- If tests depend on generated/build output, re-run the build on the testbox.
+- New untracked files sync as long as they are not gitignored.
+- Deleted files are also deleted on the remote testbox.
+
+## Critical: Do Not Ban Local Tests
+
+Do not assume local validation is forbidden. Many repos intentionally invest in
+fast, warm local loops, and forcing every run through Testbox destroys that
+advantage.
+
+Use Testbox for checks that actually need it: remote parity, secrets, services,
+CI-only runners, expensive broad gates, or reproducibility against the workflow
+image.
+
+ClawHub maintainer exception: if `CLAWHUB_TESTBOX=1` is set by the user or
+agent environment, treat Testbox as the normal validation path for this repo.
+Use `CLAWHUB_LOCAL_CHECK_MODE=throttled|full` as the explicit local escape
+hatch.
+
+## Workflow
+
+1. Decide whether the repo's local loop is the right default. For ClawHub,
+   `CLAWHUB_TESTBOX=1` makes Testbox the maintainer default.
+2. If Testbox is warranted, warm up early:
+   `blacksmith testbox warmup ci-check-testbox.yml --ref main --idle-timeout 90`.
+3. Save the ID, then claim it:
+   `bun run testbox:claim -- --id <ID>`.
+4. Write code while the testbox boots in the background.
+5. Run sanity before broad checks:
+   `bun run testbox:sanity -- --id <ID>`.
+6. Run the remote command:
+   `bun run testbox:run -- --id <ID> -- bun run lint`.
+7. If tests fail, fix code and re-run against the same warm box.
+8. If dependency manifests changed, run install in the box before testing.
+9. If you need artifacts, download them with `blacksmith testbox download`.
+10. Stop the box when done if it is no longer needed:
+    `blacksmith testbox stop --id <ID>`.
+
+## ClawHub Broad Gate
+
+For a broad ClawHub proof in maintainer Testbox mode, use the repo package
+manager and keep the commands explicit:
+
+```bash
+bun run testbox:run -- --id <ID> -- bun run format:check
+bun run testbox:run -- --id <ID> -- bun run lint
+bun run testbox:run -- --id <ID> -- bun run test
+bun run testbox:run -- --id <ID> -- bunx tsc --noEmit
+bun run testbox:run -- --id <ID> -- bunx tsc -p packages/schema/tsconfig.json --noEmit
+bun run testbox:run -- --id <ID> -- bunx tsc -p packages/clawhub/tsconfig.json --noEmit
+bun run testbox:run -- --id <ID> -- bun run build
+```
+
+For e2e:
+
+```bash
+bun run testbox:run -- --id <ID> -- bun run test:e2e
+bun run testbox:run -- --id <ID> -- bun run test:pw
+```
+
+## Waiting For Readiness
+
+The `run` command automatically waits for the testbox, so explicit waiting is
+usually unnecessary. If you do need to check readiness separately, use
+`--wait`. Do not use a sleep-and-recheck loop.
+
+```bash
+blacksmith testbox status --id <ID> --wait --wait-timeout 5m
+```
+
+## Managing Testboxes
+
+```bash
+blacksmith testbox status --id <ID>
+blacksmith testbox list
+blacksmith testbox stop --id <ID>
+```
+
+Testboxes automatically shut down after being idle. For ClawHub maintainer
+work, use 90 minutes for long-running sessions:
+
+```bash
+blacksmith testbox warmup ci-check-testbox.yml --idle-timeout 90
+```

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[Makefile]
+indent_style = tab

.gitattributes

@@ -0,0 +1,12 @@
+* text=auto eol=lf
+
+*.avif binary
+*.gif binary
+*.ico binary
+*.jpg binary
+*.jpeg binary
+*.png binary
+*.webp binary
+
+*.woff binary
+*.woff2 binary

.github/CODEOWNERS

@@ -0,0 +1,113 @@
+# Protect the ownership rules themselves.
+/.github/CODEOWNERS @openclaw/openclaw-secops
+
+# WARNING: GitHub CODEOWNERS uses last-match-wins semantics.
+# If you add overlapping rules below the secops block, include @openclaw/openclaw-secops
+# on those entries too or you can silently remove required secops review.
+# Security-sensitive code, config, workflows, and docs require secops review.
+/.github/codeql/ @openclaw/openclaw-secops
+/.github/workflows/ @openclaw/openclaw-secops
+/scripts/check-staged-secrets.mjs @openclaw/openclaw-secops
+/scripts/clawhub-cli-npm-publish.sh @openclaw/openclaw-secops
+/scripts/clawhub-cli-npm-release-check.mjs @openclaw/openclaw-secops
+/scripts/github/clawhub-rescan-auto-response.mjs @openclaw/openclaw-secops
+
+# Backend auth, API, publish, upload, moderation, and scan enforcement.
+/convex/schema.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/auth.config.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/auth.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/commentModeration.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/http.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/httpApi.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/httpApiV1/ @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/packagePublishTokens.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/packages.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/publishers.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/rateLimits.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/rescanRequests.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/skills.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/skillTransfers.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/tokens.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/uploads.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/vt.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/webhooks.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/access.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/apiTokenAuth.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/commentScamPrompt.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/githubActionsOidc.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/httpHeaders.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/httpRateLimit.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/manualOverrides.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/moderation.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/moderationEngine.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/moderationReasonCodes.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/packageRegistry.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/packageSecurity.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/publishers.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/publishLimits.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/reporting.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/securityPrompt.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/skillCapabilityTags.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/skillPublish.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/skillSafety.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/staticPublishScan.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/tokens.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/lib/webhooks.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/model/packages/rescans.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/model/rescans/policy.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/convex/model/skills/rescans.ts @openclaw/openclaw-secops @Patrick-Erichsen
+
+# Frontend auth, admin, publish, upload, and security-review surfaces.
+/src/lib/packageApi.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/src/lib/packageUpload.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/src/lib/roles.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/src/lib/uploadFiles.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/src/lib/uploadUtils.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/src/routes/admin.tsx @openclaw/openclaw-secops @Patrick-Erichsen
+/src/routes/cli/auth.tsx @openclaw/openclaw-secops @Patrick-Erichsen
+/src/routes/packages/new.tsx @openclaw/openclaw-secops @Patrick-Erichsen
+/src/routes/publish-plugin.tsx @openclaw/openclaw-secops @Patrick-Erichsen
+/src/routes/publish-skill.tsx @openclaw/openclaw-secops @Patrick-Erichsen
+/src/routes/upload.tsx @openclaw/openclaw-secops @Patrick-Erichsen
+/src/routes/upload/ @openclaw/openclaw-secops @Patrick-Erichsen
+/src/routes/$owner/$slug/security/ @openclaw/openclaw-secops @Patrick-Erichsen
+/src/routes/plugins/$name/security/ @openclaw/openclaw-secops @Patrick-Erichsen
+
+# CLI auth, admin, publishing, ownership, and package-contract surfaces.
+/packages/clawhub/src/browserAuth.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/http.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/adminHelp.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/authToken.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/clawdbotConfig.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/commands/auth.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/commands/delete.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/commands/github.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/commands/moderation.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/commands/ownership.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/commands/packages.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/commands/publish.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/commands/rescan.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/commands/transfer.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/commands/sync.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/cli/scanSkills.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/schema/openclawContract.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/schema/packages.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/schema/routes.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/schema/schemas.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/clawhub/src/schema/textFiles.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/schema/src/openclawContract.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/schema/src/packages.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/schema/src/routes.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/schema/src/schemas.ts @openclaw/openclaw-secops @Patrick-Erichsen
+/packages/schema/src/textFiles.ts @openclaw/openclaw-secops @Patrick-Erichsen
+
+# Security, auth, API, webhook, and deployment documentation.
+/docs/acceptable-usage.md @openclaw/openclaw-secops @Patrick-Erichsen
+/docs/api.md @openclaw/openclaw-secops @Patrick-Erichsen
+/docs/auth.md @openclaw/openclaw-secops @Patrick-Erichsen
+/docs/deploy.md @openclaw/openclaw-secops @Patrick-Erichsen
+/docs/github-import.md @openclaw/openclaw-secops @Patrick-Erichsen
+/docs/http-api.md @openclaw/openclaw-secops @Patrick-Erichsen
+/docs/security.md @openclaw/openclaw-secops @Patrick-Erichsen
+/docs/webhook.md @openclaw/openclaw-secops @Patrick-Erichsen
+/public/api/v1/openapi.json @openclaw/openclaw-secops @Patrick-Erichsen

.github/actionlint.yaml

@@ -0,0 +1,10 @@
+# actionlint configuration
+# https://github.com/rhysd/actionlint/blob/main/docs/config.md
+
+self-hosted-runner:
+  labels:
+    # Blacksmith CI runners
+    - blacksmith-4vcpu-ubuntu-2404
+    - blacksmith-8vcpu-ubuntu-2404
+    - blacksmith-16vcpu-ubuntu-2404
+    - blacksmith-32vcpu-ubuntu-2404

.github/codeql/codeql-actions-security.yml

@@ -0,0 +1,16 @@
+name: clawhub-codeql-actions-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  - include:
+      precision:
+        - high
+        - very-high
+      tags contain: security
+
+paths:
+  - .github/workflows

.github/codeql/codeql-backend-api-security.yml

@@ -0,0 +1,76 @@
+name: clawhub-codeql-backend-api-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  - include:
+      precision:
+        - high
+        - very-high
+      tags contain: security
+      security-severity: /([7-9]|10)\.(\d)+/
+
+paths:
+  - convex/auth.config.ts
+  - convex/auth.ts
+  - convex/commentModeration.ts
+  - convex/http.ts
+  - convex/httpApi.ts
+  - convex/httpApiV1
+  - convex/packagePublishTokens.ts
+  - convex/packages.ts
+  - convex/publishers.ts
+  - convex/rateLimits.ts
+  - convex/rescanRequests.ts
+  - convex/skills.ts
+  - convex/skillTransfers.ts
+  - convex/tokens.ts
+  - convex/uploads.ts
+  - convex/vt.ts
+  - convex/webhooks.ts
+  - convex/lib/access.ts
+  - convex/lib/apiTokenAuth.ts
+  - convex/lib/commentScamPrompt.ts
+  - convex/lib/githubActionsOidc.ts
+  - convex/lib/httpHeaders.ts
+  - convex/lib/httpRateLimit.ts
+  - convex/lib/httpUtils.ts
+  - convex/lib/manualOverrides.ts
+  - convex/lib/moderation.ts
+  - convex/lib/moderationEngine.ts
+  - convex/lib/moderationReasonCodes.ts
+  - convex/lib/packageRegistry.ts
+  - convex/lib/packageSecurity.ts
+  - convex/lib/publishers.ts
+  - convex/lib/publishLimits.ts
+  - convex/lib/reporting.ts
+  - convex/lib/securityPrompt.ts
+  - convex/lib/skillPublish.ts
+  - convex/lib/skillSafety.ts
+  - convex/lib/staticPublishScan.ts
+  - convex/lib/tokens.ts
+  - convex/lib/webhooks.ts
+  - convex/model/packages/rescans.ts
+  - convex/model/rescans/policy.ts
+  - convex/model/skills/rescans.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/dist"
+  - "**/dist/**"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"
+  - "convex/_generated/**"

.github/codeql/codeql-cli-package-security.yml

@@ -0,0 +1,59 @@
+name: clawhub-codeql-cli-package-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  - include:
+      precision:
+        - high
+        - very-high
+      tags contain: security
+      security-severity: /([7-9]|10)\.(\d)+/
+
+paths:
+  - packages/clawhub/src/browserAuth.ts
+  - packages/clawhub/src/http.ts
+  - packages/clawhub/src/cli/adminHelp.ts
+  - packages/clawhub/src/cli/authToken.ts
+  - packages/clawhub/src/cli/clawdbotConfig.ts
+  - packages/clawhub/src/cli/commands/auth.ts
+  - packages/clawhub/src/cli/commands/delete.ts
+  - packages/clawhub/src/cli/commands/github.ts
+  - packages/clawhub/src/cli/commands/moderation.ts
+  - packages/clawhub/src/cli/commands/ownership.ts
+  - packages/clawhub/src/cli/commands/packages.ts
+  - packages/clawhub/src/cli/commands/publish.ts
+  - packages/clawhub/src/cli/commands/rescan.ts
+  - packages/clawhub/src/cli/commands/sync.ts
+  - packages/clawhub/src/cli/commands/transfer.ts
+  - packages/clawhub/src/cli/scanSkills.ts
+  - packages/clawhub/src/schema/openclawContract.ts
+  - packages/clawhub/src/schema/packages.ts
+  - packages/clawhub/src/schema/routes.ts
+  - packages/clawhub/src/schema/schemas.ts
+  - packages/clawhub/src/schema/textFiles.ts
+  - packages/schema/src/openclawContract.ts
+  - packages/schema/src/packages.ts
+  - packages/schema/src/routes.ts
+  - packages/schema/src/schemas.ts
+  - packages/schema/src/textFiles.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/dist"
+  - "**/dist/**"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-frontend-publish-security.yml

@@ -0,0 +1,57 @@
+name: clawhub-codeql-frontend-publish-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  - include:
+      precision:
+        - high
+        - very-high
+      tags contain: security
+      security-severity: /([7-9]|10)\.(\d)+/
+
+paths:
+  - src/components/DetailSecuritySummary.tsx
+  - src/components/MarkdownPreview.tsx
+  - src/components/PackageSourceChooser.tsx
+  - src/components/SecurityScannerPage.tsx
+  - src/components/SkillSecurityScanResults.tsx
+  - src/lib/authErrorMessage.ts
+  - src/lib/packageApi.ts
+  - src/lib/packageUpload.ts
+  - src/lib/pluginPublishPrefill.ts
+  - src/lib/rehypeProxyImages.ts
+  - src/lib/roles.ts
+  - src/lib/uploadFiles.ts
+  - src/lib/uploadUtils.ts
+  - src/lib/useAuthError.ts
+  - src/lib/useAuthStatus.ts
+  - src/routes/admin.tsx
+  - src/routes/cli/auth.tsx
+  - src/routes/packages/new.tsx
+  - src/routes/publish-plugin.tsx
+  - src/routes/publish-skill.tsx
+  - src/routes/upload.tsx
+  - src/routes/upload
+  - src/routes/$owner/$slug/security
+  - src/routes/plugins/$name/security
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/dist"
+  - "**/dist/**"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/codeql/codeql-repository-automation-security.yml

@@ -0,0 +1,39 @@
+name: clawhub-codeql-repository-automation-security
+
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  - include:
+      precision:
+        - high
+        - very-high
+      tags contain: security
+      security-severity: /([7-9]|10)\.(\d)+/
+
+paths:
+  - scripts/check-staged-secrets.mjs
+  - scripts/clawhub-cli-npm-release-check.mjs
+  - scripts/github
+  - scripts/verify-convex-contract.ts
+  - scripts/copy-og-assets.ts
+  - scripts/check-peer-deps.ts
+
+paths-ignore:
+  - "**/node_modules"
+  - "**/coverage"
+  - "**/dist"
+  - "**/dist/**"
+  - "**/*.generated.ts"
+  - "**/*.bundle.js"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.e2e.test.ts"
+  - "**/*.e2e.test.tsx"
+  - "**/*test-support*"
+  - "**/*test-helper*"
+  - "**/*mock*"
+  - "**/*fixture*"
+  - "**/*bench*"

.github/dependabot.yml

@@ -0,0 +1,41 @@
+version: 2
+updates:
+  - package-ecosystem: "bun"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "America/Los_Angeles"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "@auth/core"
+        update-types:
+          - "version-update:semver-minor"
+          - "version-update:semver-major"
+      - dependency-name: "undici"
+        update-types:
+          - "version-update:semver-major"
+    groups:
+      production-minor-and-patch:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"
+      development-minor-and-patch:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "America/Los_Angeles"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/auto-response.yml

@@ -0,0 +1,59 @@
+name: Auto response
+
+on:
+  issues:
+    types: [opened, edited, labeled]
+  issue_comment:
+    types: [created]
+  pull_request_target: # zizmor: ignore[dangerous-triggers] trusted base checkout only; no untrusted PR code execution
+    types: [opened, edited, synchronize, reopened, labeled]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request_target' }}
+
+permissions: {}
+
+jobs:
+  auto-response:
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        continue-on-error: true
+        with:
+          app-id: "2729701"
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - uses: actions/create-github-app-token@v3
+        id: app-token-fallback
+        continue-on-error: true
+        if: steps.app-token.outcome == 'failure'
+        with:
+          app-id: "2971289"
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY_FALLBACK }}
+
+      - name: Run Barnacle auto-response
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ steps.app-token.outputs.token || steps.app-token-fallback.outputs.token || github.token }}
+          script: |
+            const { pathToFileURL } = require("node:url");
+            const moduleUrl = pathToFileURL(
+              `${process.env.GITHUB_WORKSPACE}/scripts/github/barnacle-auto-response.mjs`,
+            );
+            const { runBarnacleAutoResponse } = await import(moduleUrl.href);
+
+            await runBarnacleAutoResponse({ github, context, core });

.github/workflows/ci-check-testbox.yml

@@ -0,0 +1,80 @@
+name: Blacksmith Testbox
+
+on:
+  workflow_dispatch:
+    inputs:
+      testbox_id:
+        type: string
+        description: "Testbox session ID"
+        required: true
+
+permissions:
+  contents: read
+
+env:
+  BUN_VERSION: "1.3.10"
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  check:
+    name: "check"
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 30
+    steps:
+      - name: Begin Testbox
+        uses: useblacksmith/begin-testbox@d0e04585c26905fdd92c94a09c159544c7ee1b67
+        with:
+          testbox_id: ${{ inputs.testbox_id }}
+
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 50
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: Restore Bun install cache
+        id: bun-cache
+        uses: actions/cache/restore@v5
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ env.BUN_VERSION }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-${{ env.BUN_VERSION }}-
+
+      - name: Install
+        run: bun install --frozen-lockfile
+
+      - name: Save Bun install cache
+        if: steps.bun-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        continue-on-error: true
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ steps.bun-cache.outputs.cache-primary-key }}
+
+      - name: Prepare Testbox shell
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          git fetch --no-tags --depth=50 origin "+refs/heads/main:refs/remotes/origin/main"
+
+          bun_bin="$(command -v bun)"
+          sudo ln -sf "$bun_bin" /usr/local/bin/bun
+
+          if command -v bunx >/dev/null 2>&1; then
+            sudo ln -sf "$(command -v bunx)" /usr/local/bin/bunx
+          fi
+
+          node_bin="$(dirname "$(node -p 'process.execPath')")"
+          sudo ln -sf "$node_bin/node" /usr/local/bin/node
+          sudo ln -sf "$node_bin/npm" /usr/local/bin/npm
+          sudo ln -sf "$node_bin/npx" /usr/local/bin/npx
+
+      - name: Run Testbox
+        uses: useblacksmith/run-testbox@5ca05834db1d3813554d1dd109e5f2087a8d7cbc
+        if: always()
+        env:
+          FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -12,8 +15,10 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
-      - uses: oven-sh/setup-bun@e3914758a49697077f7bcd190d36582a61667aad
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
           bun-version: 1.3.10
 
@@ -21,6 +26,26 @@ jobs:
         run: bun install --frozen-lockfile
       - name: Peer deps
         run: bun run check:peers
+      - name: Audit dependencies
+        run: bun audit
+
+      - name: Format
+        if: github.event_name == 'pull_request'
+        run: |
+          mapfile -d '' changed_files < <(
+            git diff --name-only --diff-filter=ACMR -z \
+              "${{ github.event.pull_request.base.sha }}" \
+              "${{ github.event.pull_request.head.sha }}" \
+              -- \
+              '*.css' '*.js' '*.jsx' '*.json' '*.md' '*.mjs' '*.ts' '*.tsx' '*.yaml' '*.yml'
+          )
+
+          if (( ${#changed_files[@]} == 0 )); then
+            echo "No changed files supported by oxfmt."
+            exit 0
+          fi
+
+          bun run format:check -- "${changed_files[@]}"
 
       - name: Lint
         run: bun run lint

.github/workflows/clawhub-cli-npm-release.yml

@@ -52,7 +52,7 @@ jobs:
           registry-url: https://registry.npmjs.org
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@e3914758a49697077f7bcd190d36582a61667aad
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
           bun-version: ${{ env.BUN_VERSION }}
 
@@ -233,6 +233,7 @@ jobs:
         run: |
           set -euo pipefail
           RUN_JSON="$(gh run view "$PREFLIGHT_RUN_ID" --repo "$GITHUB_REPOSITORY" --json workflowName,headBranch,event,conclusion,url)"
+          # shellcheck disable=SC2016
           printf '%s' "$RUN_JSON" | node --input-type=module -e 'const chunks=[]; process.stdin.on("data", (chunk) => chunks.push(chunk)); process.stdin.on("end", () => { const run = JSON.parse(Buffer.concat(chunks).toString("utf8")); const checks = [["workflowName", "ClawHub CLI NPM Release"], ["headBranch", "main"], ["event", "workflow_dispatch"], ["conclusion", "success"]]; for (const [key, expected] of checks) { if (run[key] !== expected) { console.error(`Referenced npm preflight run ${process.env.PREFLIGHT_RUN_ID} must have ${key}=${expected}, got ${run[key] ?? "<missing>"}.`); process.exit(1); } } console.log(`Using npm preflight run ${process.env.PREFLIGHT_RUN_ID}: ${run.url}`); });'
 
       - name: Download prepared npm tarball

.github/workflows/clawhub-rescan-guidance.yml

@@ -0,0 +1,57 @@
+name: ClawHub Rescan Guidance
+
+on:
+  issues:
+    types: [labeled]
+  workflow_dispatch:
+    inputs:
+      issue:
+        description: "Issue number to check"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  issues: write
+
+concurrency:
+  group: clawhub-rescan-guidance-${{ github.event.issue.number || github.event.inputs.issue }}
+  cancel-in-progress: false
+
+jobs:
+  rescan-guidance:
+    runs-on: ubuntu-latest
+    if: "${{ github.event_name == 'workflow_dispatch' || github.event.label.name == 'r: rescan-guidance' }}"
+    env:
+      CLAWHUB_RESCAN_GUIDANCE_APPLY: "1"
+      ISSUE_NUMBER: ${{ github.event.issue.number || github.event.inputs.issue }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        continue-on-error: true
+        with:
+          app-id: "2729701"
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - uses: actions/create-github-app-token@v3
+        id: app-token-fallback
+        continue-on-error: true
+        if: steps.app-token.outcome == 'failure'
+        with:
+          app-id: "2971289"
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY_FALLBACK }}
+
+      - name: Comment when rescan guidance label is present
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token || steps.app-token-fallback.outputs.token || github.token }}
+        run: |
+          node scripts/github/clawhub-rescan-auto-response.mjs \
+            --repo "$GITHUB_REPOSITORY" \
+            --issue "$ISSUE_NUMBER" \
+            --comment-for-labeled-issue \
+            --apply

.github/workflows/codeql-light.yml

@@ -0,0 +1,100 @@
+name: CodeQL Light
+
+on:
+  workflow_dispatch:
+    inputs:
+      profile:
+        description: CodeQL light profile to run
+        required: false
+        default: all
+        type: choice
+        options:
+          - all
+          - backend-api
+          - frontend-publish
+          - cli-package
+          - repository-automation
+          - actions
+  push:
+    branches: [main]
+    paths:
+      - ".github/codeql/**"
+      - ".github/workflows/**"
+      - "convex/**"
+      - "packages/clawhub/**"
+      - "packages/schema/**"
+      - "scripts/**"
+      - "src/**"
+      - "bun.lock"
+      - "package.json"
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - ".github/codeql/**"
+      - ".github/workflows/**"
+      - "convex/**"
+      - "packages/clawhub/**"
+      - "packages/schema/**"
+      - "scripts/**"
+      - "src/**"
+      - "bun.lock"
+      - "package.json"
+  schedule:
+    - cron: "17 7 * * *"
+
+concurrency:
+  group: codeql-light-${{ github.event_name == 'workflow_dispatch' && github.run_id || github.event_name == 'pull_request' && github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.category }})
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript-typescript
+            category: backend-api
+            config_file: ./.github/codeql/codeql-backend-api-security.yml
+          - language: javascript-typescript
+            category: frontend-publish
+            config_file: ./.github/codeql/codeql-frontend-publish-security.yml
+          - language: javascript-typescript
+            category: cli-package
+            config_file: ./.github/codeql/codeql-cli-package-security.yml
+          - language: javascript-typescript
+            category: repository-automation
+            config_file: ./.github/codeql/codeql-repository-automation-security.yml
+          - language: actions
+            category: actions
+            config_file: ./.github/codeql/codeql-actions-security.yml
+    steps:
+      - name: Checkout
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == matrix.category }}
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          submodules: false
+
+      - name: Initialize CodeQL
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == matrix.category }}
+        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+        with:
+          languages: ${{ matrix.language }}
+          config-file: ${{ matrix.config_file }}
+
+      - name: Analyze
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == matrix.category }}
+        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+        with:
+          category: "/codeql-light/${{ matrix.category }}"

.github/workflows/deploy.yml

@@ -17,6 +17,10 @@ concurrency:
   group: deploy-production
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  statuses: read
+
 jobs:
   validate-deploy-request:
     runs-on: ubuntu-latest
@@ -97,7 +101,7 @@ jobs:
 
       - uses: actions/checkout@v6
 
-      - uses: oven-sh/setup-bun@e3914758a49697077f7bcd190d36582a61667aad
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
           bun-version: 1.3.10
 
@@ -133,7 +137,7 @@ jobs:
             if ! state="$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/status" \
               --jq '.statuses[] | select(.context == env.VERCEL_STATUS_CONTEXT) | .state' \
               2>/dev/null | head -n1)"; then
-              echo "GitHub status check failed for $GITHUB_SHA; retrying..."
+              echo "GitHub status check failed for $GITHUB_SHA on attempt $attempt; retrying..."
               sleep 10
               continue
             fi
@@ -148,10 +152,10 @@ jobs:
                 exit 1
                 ;;
               pending)
-                echo "Vercel deployment pending for $GITHUB_SHA; waiting..."
+                echo "Vercel deployment pending for $GITHUB_SHA on attempt $attempt; waiting..."
                 ;;
               *)
-                echo "Vercel status for $GITHUB_SHA not published yet; waiting..."
+                echo "Vercel status for $GITHUB_SHA not published yet on attempt $attempt; waiting..."
                 ;;
             esac
 
@@ -165,12 +169,16 @@ jobs:
         if: needs.validate-deploy-request.outputs.run_smoke == 'true'
         run: bunx playwright install --with-deps chromium webkit
 
+      - name: Smoke test production HTTP
+        if: needs.validate-deploy-request.outputs.run_smoke == 'true'
+        run: bun run test:e2e:prod-http
+
       - name: Write authenticated storage state
         if: needs.validate-deploy-request.outputs.run_smoke == 'true' && env.PLAYWRIGHT_AUTH_STORAGE_STATE_JSON != ''
         run: |
           echo "$PLAYWRIGHT_AUTH_STORAGE_STATE_JSON" > "$RUNNER_TEMP/playwright-auth.json"
           echo "PLAYWRIGHT_AUTH_STORAGE_STATE=$RUNNER_TEMP/playwright-auth.json" >> "$GITHUB_ENV"
 
-      - name: Smoke test production
+      - name: Smoke test production UI
         if: needs.validate-deploy-request.outputs.run_smoke == 'true'
-        run: bunx playwright test e2e/menu-smoke.pw.test.ts e2e/upload-auth-smoke.pw.test.ts
+        run: bunx playwright test e2e/menu-smoke.pw.test.ts e2e/publish-entry-workflows.pw.test.ts e2e/upload-auth-smoke.pw.test.ts

.github/workflows/package-publish.yml

@@ -73,6 +73,9 @@ on:
         description: Published release id when dry_run is false.
         value: ${{ jobs.publish.outputs.release_id }}
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -88,7 +91,7 @@ jobs:
         with:
           ref: ${{ github.sha }}
 
-      - uses: oven-sh/setup-bun@e3914758a49697077f7bcd190d36582a61667aad
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
           bun-version: 1.3.10
 
@@ -334,7 +337,7 @@ jobs:
           PY
 
       - name: Upload publish JSON artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: clawhub-package-publish-json
           path: ${{ runner.temp }}/package-publish.json

.github/workflows/secret-scan.yml

@@ -49,7 +49,7 @@ jobs:
         id: trufflehog
         # Use a concrete released ref that resolves in upstream action registry.
         # v3 (major tag) is not published by trufflesecurity/trufflehog.
-        uses: trufflesecurity/trufflehog@v3.93.8
+        uses: trufflesecurity/trufflehog@v3.95.2
         with:
           path: ./
           base: ${{ steps.scan_range.outputs.base }}

.github/workflows/stale.yml

@@ -0,0 +1,171 @@
+name: Stale
+
+on:
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+permissions: {}
+
+jobs:
+  stale:
+    permissions:
+      issues: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Mark stale unassigned issues and pull requests
+        uses: actions/stale@v10
+        with:
+          repo-token: ${{ github.token }}
+          days-before-issue-stale: 14
+          days-before-issue-close: 7
+          days-before-pr-stale: 7
+          days-before-pr-close: 5
+          stale-issue-label: stale
+          stale-pr-label: stale
+          exempt-issue-labels: enhancement,maintainer,pinned,security,no-stale,bad-barnacle
+          exempt-pr-labels: maintainer,no-stale,bad-barnacle
+          operations-per-run: 1000
+          ascending: true
+          exempt-all-assignees: true
+          remove-stale-when-updated: true
+          stale-issue-message: |
+            This issue has been automatically marked as stale due to inactivity.
+            Please add updated ClawHub details or it will be closed.
+          stale-pr-message: |
+            This pull request has been automatically marked as stale due to inactivity.
+            Please update it or it will be closed.
+          close-issue-message: |
+            Closing due to inactivity.
+            If this still affects ClawHub, reopen or file a new issue with the current URL, skill/package name, and fresh reproduction details.
+          close-issue-reason: not_planned
+          close-pr-message: |
+            Closing due to inactivity.
+            If this PR should be revived, reopen it with current context and a fresh validation plan.
+
+      - name: Mark stale assigned issues
+        uses: actions/stale@v10
+        with:
+          repo-token: ${{ github.token }}
+          days-before-issue-stale: 30
+          days-before-issue-close: 10
+          days-before-pr-stale: -1
+          days-before-pr-close: -1
+          stale-issue-label: stale
+          exempt-issue-labels: enhancement,maintainer,pinned,security,no-stale,bad-barnacle
+          operations-per-run: 1000
+          ascending: true
+          include-only-assigned: true
+          remove-stale-when-updated: true
+          stale-issue-message: |
+            This assigned issue has been automatically marked as stale after 30 days of inactivity.
+            Please add an update or it will be closed.
+          close-issue-message: |
+            Closing due to inactivity.
+            If this still affects ClawHub, reopen or file a new issue with current evidence.
+          close-issue-reason: not_planned
+
+      - name: Mark stale assigned pull requests
+        uses: actions/stale@v10
+        with:
+          repo-token: ${{ github.token }}
+          days-before-issue-stale: -1
+          days-before-issue-close: -1
+          days-before-pr-stale: 27
+          days-before-pr-close: 5
+          stale-pr-label: stale
+          exempt-pr-labels: maintainer,no-stale,bad-barnacle
+          operations-per-run: 1000
+          ascending: true
+          include-only-assigned: true
+          ignore-pr-updates: true
+          remove-stale-when-updated: true
+          stale-pr-message: |
+            This assigned pull request has been automatically marked as stale after being open for 27 days.
+            Please add an update or it will be closed.
+          close-pr-message: |
+            Closing due to inactivity.
+            If this PR should be revived, reopen it with current context and a fresh validation plan.
+
+  lock-closed-issues:
+    permissions:
+      issues: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Lock closed issues after 48h of no comments
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ github.token }}
+          script: |
+            const lockAfterHours = 48;
+            const lockAfterMs = lockAfterHours * 60 * 60 * 1000;
+            const cutoffMs = Date.now() - lockAfterMs;
+            const { owner, repo } = context.repo;
+
+            let locked = 0;
+            let inspected = 0;
+            let page = 1;
+
+            while (true) {
+              const { data: issues } = await github.rest.issues.listForRepo({
+                owner,
+                repo,
+                state: "closed",
+                sort: "updated",
+                direction: "desc",
+                per_page: 100,
+                page,
+              });
+
+              if (issues.length === 0) {
+                break;
+              }
+
+              for (const issue of issues) {
+                if (issue.pull_request || issue.locked || !issue.closed_at) {
+                  continue;
+                }
+
+                inspected += 1;
+                const closedAtMs = Date.parse(issue.closed_at);
+                if (!Number.isFinite(closedAtMs) || closedAtMs > cutoffMs) {
+                  continue;
+                }
+
+                let lastCommentMs = 0;
+                if (issue.comments > 0) {
+                  const { data: comments } = await github.rest.issues.listComments({
+                    owner,
+                    repo,
+                    issue_number: issue.number,
+                    per_page: 1,
+                    page: 1,
+                    sort: "created",
+                    direction: "desc",
+                  });
+                  if (comments.length > 0) {
+                    lastCommentMs = Date.parse(comments[0].created_at);
+                  }
+                }
+
+                if (Math.max(closedAtMs, lastCommentMs || 0) > cutoffMs) {
+                  continue;
+                }
+
+                await github.rest.issues.lock({
+                  owner,
+                  repo,
+                  issue_number: issue.number,
+                  lock_reason: "resolved",
+                });
+                locked += 1;
+              }
+
+              page += 1;
+            }
+
+            core.info(`Inspected ${inspected} closed issues; locked ${locked}.`);

.github/workflows/update-convex-ai-files.yml

@@ -28,7 +28,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@e3914758a49697077f7bcd190d36582a61667aad
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
           bun-version: ${{ env.BUN_VERSION }}
 
@@ -85,6 +85,7 @@ jobs:
             printf '\n'
             printf '%s\n' '## Validation'
             printf '\n'
+            # shellcheck disable=SC2016
             printf '%s\n' '- `$(bun pm bin)/convex ai-files status`'
           } > "$body_file"
 

.gitignore

@@ -2,6 +2,7 @@ node_modules
 .DS_Store
 .bun-build
 *.bun-build
+.data/
 bin/docs-list
 dist
 dist-ssr
@@ -23,6 +24,8 @@ todos.json
 .vscode
 .env*.local
 coverage
+eval/cache/
+eval/results/
 playwright-report
 test-results
 .playwright
@@ -36,5 +39,7 @@ skills-lock.json
 !.agents/skills/
 !.agents/skills/convex*/
 !.agents/skills/convex*/**
+!.agents/skills/blacksmith-testbox/
+!.agents/skills/blacksmith-testbox/**
 skills/*
 .codex/*

.oxlintrc.json

@@ -1,37 +1,38 @@
 {
-  "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "plugins": ["unicorn", "typescript", "oxc"],
-  "categories": {
-    "correctness": "error",
-    "perf": "error",
-    "suspicious": "error"
-  },
-  "rules": {
-    "curly": "off",
-    "eslint-plugin-unicorn/prefer-array-find": "off",
-    "eslint-plugin-unicorn/no-array-sort": "off",
-    "eslint/no-await-in-loop": "off",
-    "eslint/no-new": "off",
-    "oxc/no-accumulating-spread": "off",
-    "oxc/no-async-endpoint-handlers": "off",
-    "oxc/no-map-spread": "off",
-    "typescript/no-explicit-any": "error",
-    "typescript/no-extraneous-class": "off",
-    "typescript/no-unnecessary-boolean-literal-compare": "off",
-    "typescript/no-unnecessary-type-assertion": "off",
-    "typescript/no-unsafe-type-assertion": "off",
-    "unicorn/consistent-function-scoping": "off",
-    "unicorn/require-post-message-target-origin": "off"
-  },
-  "ignorePatterns": [
-    ".output/",
-    ".tanstack/",
-    "convex/_generated/",
-    "coverage/",
-    "dist/",
-    "node_modules/",
-    "public/",
-    "src/routeTree.gen.ts",
-    "test-results/"
-  ]
+	"$schema": "./node_modules/oxlint/configuration_schema.json",
+	"plugins": ["unicorn", "typescript", "oxc"],
+	"categories": {
+		"correctness": "error",
+		"perf": "error",
+		"suspicious": "error"
+	},
+	"rules": {
+		"curly": "off",
+		"eslint-plugin-unicorn/prefer-array-find": "off",
+		"eslint-plugin-unicorn/no-array-sort": "off",
+		"eslint/no-await-in-loop": "off",
+		"eslint/no-underscore-dangle": "off",
+		"eslint/no-new": "off",
+		"oxc/no-accumulating-spread": "off",
+		"oxc/no-async-endpoint-handlers": "off",
+		"oxc/no-map-spread": "off",
+		"typescript/no-explicit-any": "error",
+		"typescript/no-extraneous-class": "off",
+		"typescript/no-unnecessary-boolean-literal-compare": "off",
+		"typescript/no-unnecessary-type-assertion": "off",
+		"typescript/no-unsafe-type-assertion": "off",
+		"unicorn/consistent-function-scoping": "off",
+		"unicorn/require-post-message-target-origin": "off"
+	},
+	"ignorePatterns": [
+		".output/",
+		".tanstack/",
+		"convex/_generated/",
+		"coverage/",
+		"dist/",
+		"node_modules/",
+		"public/",
+		"src/routeTree.gen.ts",
+		"test-results/"
+	]
 }

AGENTS.md

@@ -15,6 +15,7 @@
 - `bun run preview` — preview built app.
 - `bunx convex dev` — Convex dev deployment + function watcher.
 - `bunx convex codegen` — regenerate `convex/_generated`.
+- `bun run format:check` — formatting check.
 - `bun run lint` — Biome + oxlint (type-aware).
 - `bun run test` — Vitest (unit tests).
 - `bun run coverage` — coverage run; keep global >= 80%.
@@ -37,6 +38,7 @@
 
 - Commit messages: Conventional Commits (`feat:`, `fix:`, `chore:`, `docs:`…).
 - Keep changes scoped; avoid repo-wide search/replace.
+- Before commit/PR handoff, run `bun run format:check` and `bun run lint`; include commands run in the PR summary.
 - PRs: include summary + test commands run. Add screenshots for UI changes.
 - Before merging any PR, verify TypeScript cleanly with `bunx tsc -p packages/schema/tsconfig.json --noEmit` and `bunx tsc -p packages/clawhub/tsconfig.json --noEmit`; if Convex code changed, also run the repo typecheck path used by deploy so `bunx convex deploy` will not fail on `tsc`.
 - GitHub comments: for multiline `gh` comments/close messages, use `--body-file`, `--input`, or stdin/heredoc with real newlines; never pass literal `\\n` in shell strings.
@@ -90,11 +92,13 @@
 - **Before writing or reviewing Convex queries, check deployment health.** Run `bunx convex insights` to check for OCC conflicts, `bytesReadLimit`, and `documentsReadLimit` errors. Run `bunx convex logs --failure` to see individual error messages and stack traces. This helps identify which functions are causing bandwidth issues so you can prioritize fixes.
 
 <!-- convex-ai-start -->
+
 This project uses [Convex](https://convex.dev) as its backend.
 
 When working on Convex code, **always read `convex/_generated/ai/guidelines.md` first** for important guidelines on how to correctly use Convex APIs and patterns. The file contains rules that override what you may have learned about Convex from training data.
 
 Convex agent skills for common tasks can be installed by running `npx convex ai-files install`.
+
 <!-- convex-ai-end -->
 
 ## Stat Field Migration Rules
@@ -102,11 +106,11 @@ Convex agent skills for common tasks can be installed by running `npx convex ai-
 The `skills` table maintains two parallel sets of stat fields as part of an in-progress field migration:
 
 | Legacy (nested, `@deprecated`) | Top-level (source of truth, indexable) |
-|---|---|
-| `stats.downloads` | `statsDownloads` |
-| `stats.stars` | `statsStars` |
-| `stats.installsCurrent` | `statsInstallsCurrent` |
-| `stats.installsAllTime` | `statsInstallsAllTime` |
+| ------------------------------ | -------------------------------------- |
+| `stats.downloads`              | `statsDownloads`                       |
+| `stats.stars`                  | `statsStars`                           |
+| `stats.installsCurrent`        | `statsInstallsCurrent`                 |
+| `stats.installsAllTime`        | `statsInstallsAllTime`                 |
 
 **Rules:**
 

CONTRIBUTING.md

@@ -87,7 +87,7 @@ bunx convex run --no-push devSeed:seedNixSkills
 bunx convex run --no-push devSeedExtra:seedExtraSkillsInternal
 
 # Refresh the cached skills count (required after seeding)
-bunx convex run --no-push statsMaintenance:updateGlobalStatsInternal
+bunx convex run --no-push statsMaintenance:updateGlobalStatsAction
 ```
 
 To reset and re-seed:
@@ -153,6 +153,30 @@ bun run --cwd packages/clawhub verify
 
 These are the same checks that run in CI (`.github/workflows/ci.yml`).
 
+### Blacksmith Testbox checks
+
+Maintainers with Blacksmith access can run the same checks in a warmed Testbox
+instead of spending local CPU:
+
+```bash
+export CLAWHUB_TESTBOX=1
+blacksmith testbox warmup ci-check-testbox.yml --ref main --idle-timeout 90
+bun run testbox:claim -- --id <tbx_id>
+bun run testbox:sanity -- --id <tbx_id>
+bun run testbox:run -- --id <tbx_id> -- bun run lint
+bun run testbox:run -- --id <tbx_id> -- bun run test
+bun run testbox:run -- --id <tbx_id> -- bun run build
+```
+
+Use the `tbx_...` id from the current warmup output. The wrapper refuses ids
+that are missing the local SSH key or were claimed by a different checkout.
+Use `CLAWHUB_LOCAL_CHECK_MODE=throttled` or `CLAWHUB_LOCAL_CHECK_MODE=full` as
+the explicit local escape hatch when you intentionally want laptop-side proof.
+If Blacksmith auth/org access is missing, report that instead of falling back
+to a broad local gate that can bog down a dev machine.
+For the initial bootstrap only, the Testbox workflow must land on `main` before
+`blacksmith testbox warmup ci-check-testbox.yml --ref <branch>` can dispatch it.
+
 **PR guidelines:**
 
 - Keep PRs focused — one concern per PR.

bun.lock

@@ -6,7 +6,7 @@
       "name": "clawhub",
       "dependencies": {
         "@auth/core": "^0.37.4",
-        "@convex-dev/auth": "^0.0.91",
+        "@convex-dev/auth": "0.0.92",
         "@create-markdown/core": "^2.0.2",
         "@create-markdown/preview": "^2.0.2",
         "@fontsource/bricolage-grotesque": "^5.2.10",
@@ -32,27 +32,27 @@
         "@radix-ui/react-tooltip": "^1.2.8",
         "@resvg/resvg-wasm": "^2.6.2",
         "@shikijs/rehype": "^4.0.2",
-        "@tailwindcss/vite": "^4.2.2",
-        "@tanstack/react-devtools": "0.10.0",
-        "@tanstack/react-router": "1.168.1",
-        "@tanstack/react-router-devtools": "1.166.10",
-        "@tanstack/react-start": "1.167.2",
+        "@tailwindcss/vite": "^4.2.4",
+        "@tanstack/react-devtools": "0.10.2",
+        "@tanstack/react-router": "1.168.26",
+        "@tanstack/react-router-devtools": "1.166.13",
+        "@tanstack/react-start": "1.167.52",
         "@tanstack/react-table": "^8.21.3",
-        "@tanstack/router-plugin": "1.167.2",
+        "@tanstack/router-plugin": "1.167.29",
         "@vercel/analytics": "^2.0.1",
         "class-variance-authority": "^0.7.1",
         "clawhub-schema": "workspace:*",
         "clsx": "^2.1.1",
         "cmdk": "^1.1.1",
-        "convex": "^1.34.1",
-        "convex-helpers": "^0.1.114",
+        "convex": "^1.36.1",
+        "convex-helpers": "^0.1.115",
         "fflate": "^0.8.2",
-        "h3": "2.0.1-rc.18",
+        "h3": "2.0.1-rc.21",
         "ignore": "^7.0.5",
-        "lucide-react": "^0.577.0",
+        "lucide-react": "1.14.0",
         "monaco-editor": "^0.55.1",
         "next-themes": "^0.4.6",
-        "nitro": "3.0.260311-beta",
+        "nitro": "3.0.260429-beta",
         "react": "^19.2.4",
         "react-dom": "^19.2.4",
         "react-markdown": "^10.1.0",
@@ -63,12 +63,12 @@
         "shiki": "^4.0.2",
         "sonner": "^2.0.7",
         "tailwind-merge": "^3.5.0",
-        "tailwindcss": "^4.2.2",
+        "tailwindcss": "^4.2.4",
         "tw-animate-css": "^1.4.0",
         "unist-util-visit": "^5.1.0",
         "vite-tsconfig-paths": "^6.1.1",
         "yaml": "^2.8.3",
-        "zod": "^4.3.6",
+        "zod": "^4.4.1",
       },
       "devDependencies": {
         "@playwright/test": "^1.59.1",
@@ -80,41 +80,41 @@
         "@types/react-dom": "^19.2.3",
         "@types/semver": "^7.7.1",
         "@vitejs/plugin-react": "6.0.1",
-        "@vitest/coverage-v8": "^4.1.2",
-        "jsdom": "^29.0.1",
+        "@vitest/coverage-v8": "^4.1.5",
+        "jsdom": "^29.1.0",
         "only-allow": "^1.2.2",
-        "oxfmt": "0.41.0",
-        "oxlint": "^1.58.0",
-        "oxlint-tsgolint": "^0.17.4",
-        "typescript": "^5.9.3",
-        "undici": "^7.24.7",
-        "vite": "8.0.5",
-        "vitest": "^4.1.2",
+        "oxfmt": "0.47.0",
+        "oxlint": "^1.62.0",
+        "oxlint-tsgolint": "0.22.1",
+        "typescript": "6.0.3",
+        "undici": "7.25.0",
+        "vite": "8.0.10",
+        "vitest": "^4.1.5",
       },
     },
     "packages/clawhub": {
       "name": "clawhub",
-      "version": "0.11.0",
+      "version": "0.12.0",
       "bin": {
         "clawdhub": "bin/clawdhub.js",
         "clawhub": "bin/clawdhub.js",
       },
       "dependencies": {
-        "@clack/prompts": "^1.1.0",
+        "@clack/prompts": "^1.3.0",
         "arktype": "^2.2.0",
         "commander": "^14.0.3",
         "fflate": "^0.8.2",
         "ignore": "^7.0.5",
         "json5": "^2.2.3",
         "mime": "^4.1.0",
-        "ora": "^9.3.0",
-        "p-retry": "^7.1.1",
+        "ora": "^9.4.0",
+        "p-retry": "8.0.0",
         "semver": "^7.7.4",
-        "undici": "^7.24.0",
+        "undici": "7.25.0",
       },
       "devDependencies": {
         "@types/node": "^25.5.0",
-        "typescript": "^5.9.3",
+        "typescript": "6.0.3",
       },
     },
     "packages/schema": {
@@ -124,18 +124,24 @@
         "arktype": "^2.2.0",
       },
       "devDependencies": {
-        "typescript": "^5.9.3",
+        "typescript": "6.0.3",
       },
     },
   },
+  "overrides": {
+    "dompurify": "3.4.1",
+    "postcss": "8.5.12",
+  },
   "packages": {
     "@ark/schema": ["@ark/schema@0.56.0", "", { "dependencies": { "@ark/util": "0.56.0" } }, "sha512-ECg3hox/6Z/nLajxXqNhgPtNdHWC9zNsDyskwO28WinoFEnWow4IsERNz9AnXRhTZJnYIlAJ4uGn3nlLk65vZA=="],
 
     "@ark/util": ["@ark/util@0.56.0", "", {}, "sha512-BghfRC8b9pNs3vBoDJhcta0/c1J1rsoS1+HgVUreMFPdhz/CRAKReAu57YEllNaSy98rWAdY1gE+gFup7OXpgA=="],
 
-    "@asamuzakjp/css-color": ["@asamuzakjp/css-color@5.1.10", "", { "dependencies": { "@csstools/css-calc": "^3.1.1", "@csstools/css-color-parser": "^4.0.2", "@csstools/css-parser-algorithms": "^4.0.0", "@csstools/css-tokenizer": "^4.0.0" } }, "sha512-02OhhkKtgNRuicQ/nF3TRnGsxL9wp0r3Y7VlKWyOHHGmGyvXv03y+PnymU8FKFJMTjIr1Bk8U2g1HWSLrpAHww=="],
+    "@asamuzakjp/css-color": ["@asamuzakjp/css-color@5.1.11", "", { "dependencies": { "@asamuzakjp/generational-cache": "^1.0.1", "@csstools/css-calc": "^3.2.0", "@csstools/css-color-parser": "^4.1.0", "@csstools/css-parser-algorithms": "^4.0.0", "@csstools/css-tokenizer": "^4.0.0" } }, "sha512-KVw6qIiCTUQhByfTd78h2yD1/00waTmm9uy/R7Ck/ctUyAPj+AEDLkQIdJW0T8+qGgj3j5bpNKK7Q3G+LedJWg=="],
 
-    "@asamuzakjp/dom-selector": ["@asamuzakjp/dom-selector@7.0.9", "", { "dependencies": { "@asamuzakjp/nwsapi": "^2.3.9", "bidi-js": "^1.0.3", "css-tree": "^3.2.1", "is-potential-custom-element-name": "^1.0.1" } }, "sha512-r3ElRr7y8ucyN2KdICwGsmj19RoN13CLCa/pvGydghWK6ZzeKQ+TcDjVdtEZz2ElpndM5jXw//B9CEee0mWnVg=="],
+    "@asamuzakjp/dom-selector": ["@asamuzakjp/dom-selector@7.1.1", "", { "dependencies": { "@asamuzakjp/generational-cache": "^1.0.1", "@asamuzakjp/nwsapi": "^2.3.9", "bidi-js": "^1.0.3", "css-tree": "^3.2.1", "is-potential-custom-element-name": "^1.0.1" } }, "sha512-67RZDnYRc8H/8MLDgQCDE//zoqVFwajkepHZgmXrbwybzXOEwOWGPYGmALYl9J2DOLfFPPs6kKCqmbzV895hTQ=="],
+
+    "@asamuzakjp/generational-cache": ["@asamuzakjp/generational-cache@1.0.1", "", {}, "sha512-wajfB8KqzMCN2KGNFdLkReeHncd0AslUSrvHVvvYWuU8ghncRJoA50kT3zP9MVL0+9g4/67H+cdvBskj9THPzg=="],
 
     "@asamuzakjp/nwsapi": ["@asamuzakjp/nwsapi@2.3.9", "", {}, "sha512-n8GuYSrI9bF7FFZ/SjhwevlHc8xaVlb/7HmHelnc/PZXBD2ZR49NnN9sMMuDdEGPeeRQ5d0hqlSlEpgCX3Wl0Q=="],
 
@@ -185,11 +191,11 @@
 
     "@bramus/specificity": ["@bramus/specificity@2.4.2", "", { "dependencies": { "css-tree": "^3.0.0" }, "bin": { "specificity": "bin/cli.js" } }, "sha512-ctxtJ/eA+t+6q2++vj5j7FYX3nRu311q1wfYH3xjlLOsczhlhxAg2FWNUXhpGvAw3BWo1xBcvOV6/YLc2r5FJw=="],
 
-    "@clack/core": ["@clack/core@1.2.0", "", { "dependencies": { "fast-wrap-ansi": "^0.1.3", "sisteransi": "^1.0.5" } }, "sha512-qfxof/3T3t9DPU/Rj3OmcFyZInceqj/NVtO9rwIuJqCUgh32gwPjpFQQp/ben07qKlhpwq7GzfWpST4qdJ5Drg=="],
+    "@clack/core": ["@clack/core@1.3.0", "", { "dependencies": { "fast-wrap-ansi": "^0.2.0", "sisteransi": "^1.0.5" } }, "sha512-xJPHpAmEQUBrXSLx0gF+q5K/IyihXpsHZcha+jB+tyahsKRK3Dxo4D0coZDewHo12NhiuzC3dTtMPbm53GEAAA=="],
 
-    "@clack/prompts": ["@clack/prompts@1.2.0", "", { "dependencies": { "@clack/core": "1.2.0", "fast-string-width": "^1.1.0", "fast-wrap-ansi": "^0.1.3", "sisteransi": "^1.0.5" } }, "sha512-4jmztR9fMqPMjz6H/UZXj0zEmE43ha1euENwkckKKel4XpSfokExPo5AiVStdHSAlHekz4d0CA/r45Ok1E4D3w=="],
+    "@clack/prompts": ["@clack/prompts@1.3.0", "", { "dependencies": { "@clack/core": "1.3.0", "fast-string-width": "^3.0.2", "fast-wrap-ansi": "^0.2.0", "sisteransi": "^1.0.5" } }, "sha512-GgcWwRCs/xPtaqlMy8qRhPnZf9vlWcWZNHAitnVQ3yk7JmSralSiq5q07yaffYE8SogtDm7zFeKccx1QNVARpw=="],
 
-    "@convex-dev/auth": ["@convex-dev/auth@0.0.91", "", { "dependencies": { "@oslojs/crypto": "^1.0.1", "@oslojs/encoding": "^1.1.0", "cookie": "^1.0.1", "is-network-error": "^1.1.0", "jose": "^5.2.2", "jwt-decode": "^4.0.0", "lucia": "^3.2.0", "oauth4webapi": "^3.1.2", "path-to-regexp": "^6.3.0", "server-only": "^0.0.1" }, "peerDependencies": { "@auth/core": "^0.37.0", "convex": "^1.17.0", "react": "^18.2.0 || ^19.0.0-0" }, "optionalPeers": ["react"], "bin": { "auth": "dist/bin.cjs" } }, "sha512-wLD4hszo3IhhMkwPs6ozWf0cUauwmhOvjUVn0g//kC338n/jApOjeDYWKCrn/qYUkveyDsbag5zrY8mVzA09Qg=="],
+    "@convex-dev/auth": ["@convex-dev/auth@0.0.92", "", { "dependencies": { "@oslojs/crypto": "^1.0.1", "@oslojs/encoding": "^1.1.0", "cookie": "^1.0.1", "is-network-error": "^1.1.0", "jose": "^5.2.2", "jwt-decode": "^4.0.0", "lucia": "^3.2.0", "oauth4webapi": "^3.1.2", "path-to-regexp": "^6.3.0", "server-only": "^0.0.1" }, "peerDependencies": { "@auth/core": "^0.37.0", "convex": "^1.17.0", "react": "^18.2.0 || ^19.0.0-0" }, "optionalPeers": ["react"], "bin": { "auth": "dist/bin.cjs" } }, "sha512-tNRIMTDxi2vrbT+3vz1FgNR1321IfIBDDBy59zul7E1DyzWQKoU0OzgFqWbiVm3o8gn0eQsYTU3UHNRX9kp3wQ=="],
 
     "@create-markdown/core": ["@create-markdown/core@2.0.3", "", {}, "sha512-qAYukvE603z42OGZF1LzwxxkOVDksB76wXu+fnlKBzGizhR7uN3xHQO8PFFZDqjkZpaTrmtDd768qzl+Ir+3pQ=="],
 
@@ -207,9 +213,9 @@
 
     "@csstools/css-tokenizer": ["@csstools/css-tokenizer@4.0.0", "", {}, "sha512-QxULHAm7cNu72w97JUNCBFODFaXpbDg+dP8b/oWFAZ2MTRppA3U00Y2L1HqaS4J6yBqxwa/Y3nMBaxVKbB/NsA=="],
 
-    "@emnapi/core": ["@emnapi/core@1.9.2", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-UC+ZhH3XtczQYfOlu3lNEkdW/p4dsJ1r/bP7H8+rhao3TTTMO1ATq/4DdIi23XuGoFY+Cz0JmCbdVl0hz9jZcA=="],
+    "@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
 
-    "@emnapi/runtime": ["@emnapi/runtime@1.9.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-3U4+MIWHImeyu1wnmVygh5WlgfYDtyf0k8AbLhMFxOipihf6nrWC4syIm/SwEeec0mNSafiiNnMJwbza/Is6Lw=="],
+    "@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
 
     "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
 
@@ -345,7 +351,7 @@
 
     "@monaco-editor/react": ["@monaco-editor/react@4.7.0", "", { "dependencies": { "@monaco-editor/loader": "^1.5.0" }, "peerDependencies": { "monaco-editor": ">= 0.25.0 < 1", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-cyzXQCtO47ydzxpQtCGSQGOC8Gk3ZUeBXFAxD+CWXYFo5OqZyZUonFl0DwUlTyAfRHntBfw2p3w4s9R6oe1eCA=="],
 
-    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.3", "", { "dependencies": { "@tybys/wasm-util": "^0.10.1" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-xK9sGVbJWYb08+mTJt3/YV24WxvxpXcXtP6B172paPZ+Ts69Re9dAr7lKwJoeIx8OoeuimEiRZ7umkiUVClmmQ=="],
+    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.4", "", { "dependencies": { "@tybys/wasm-util": "^0.10.1" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow=="],
 
     "@next/env": ["@next/env@16.2.3", "", {}, "sha512-ZWXyj4uNu4GCWQw9cjRxWlbD+33mcDszIo9iQxFnBX3Wmgq9ulaSJcl6VhuWx5pCWqqD+9W6Wfz7N0lM5lYPMA=="],
 
@@ -381,95 +387,95 @@
 
     "@oslojs/encoding": ["@oslojs/encoding@1.1.0", "", {}, "sha512-70wQhgYmndg4GCPxPPxPGevRKqTIJ2Nh4OkiMWmDAVYsTQ+Ta7Sq+rPevXyXGdzr30/qZBnyOalCszoMxlyldQ=="],
 
-    "@oxc-project/types": ["@oxc-project/types@0.122.0", "", {}, "sha512-oLAl5kBpV4w69UtFZ9xqcmTi+GENWOcPF7FCrczTiBbmC0ibXxCwyvZGbO39rCVEuLGAZM84DH0pUIyyv/YJzA=="],
+    "@oxc-project/types": ["@oxc-project/types@0.127.0", "", {}, "sha512-aIYXQBo4lCbO4z0R3FHeucQHpF46l2LbMdxRvqvuRuW2OxdnSkcng5B8+K12spgLDj93rtN3+J2Vac/TIO+ciQ=="],
 
-    "@oxfmt/binding-android-arm-eabi": ["@oxfmt/binding-android-arm-eabi@0.41.0", "", { "os": "android", "cpu": "arm" }, "sha512-REfrqeMKGkfMP+m/ScX4f5jJBSmVNYcpoDF8vP8f8eYPDuPGZmzp56NIUsYmx3h7f6NzC6cE3gqh8GDWrJHCKw=="],
+    "@oxfmt/binding-android-arm-eabi": ["@oxfmt/binding-android-arm-eabi@0.47.0", "", { "os": "android", "cpu": "arm" }, "sha512-KrMQRdMi/upr81qT4ijK6X6BNp6jqpMY7FwILQnwIy9QLc3qpnhUx5rsCLGzn4ewsCQ0CNAspN2ogmP1GXLyLw=="],
 
-    "@oxfmt/binding-android-arm64": ["@oxfmt/binding-android-arm64@0.41.0", "", { "os": "android", "cpu": "arm64" }, "sha512-s0b1dxNgb2KomspFV2LfogC2XtSJB42POXF4bMCLJyvQmAGos4ZtjGPfQreToQEaY0FQFjz3030ggI36rF1q5g=="],
+    "@oxfmt/binding-android-arm64": ["@oxfmt/binding-android-arm64@0.47.0", "", { "os": "android", "cpu": "arm64" }, "sha512-r4ixS/PeUpAFKgrpDoZ5pSkthjZzVzKd95525Aazj+aOv9H4ulK5zYHGb7wFY5n5kZxHK8TbOJUZgoEb1ohddQ=="],
 
-    "@oxfmt/binding-darwin-arm64": ["@oxfmt/binding-darwin-arm64@0.41.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-EGXGualADbv/ZmamE7/2DbsrYmjoPlAmHEpTL4vapLF4EfVD6fr8/uQDFnPJkUBjiSWFJZtFNsGeN1B6V3owmA=="],
+    "@oxfmt/binding-darwin-arm64": ["@oxfmt/binding-darwin-arm64@0.47.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-CLWxiKpMl+195cm09CuaWEhJK0CirRkoMa07aR9+9AFPat2LfIKtwx1JqxZM0MTvcMe6+adlJNdVL6jdInvq3g=="],
 
-    "@oxfmt/binding-darwin-x64": ["@oxfmt/binding-darwin-x64@0.41.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-WxySJEvdQQYMmyvISH3qDpTvoS0ebnIP63IMxLLWowJyPp/AAH0hdWtlo+iGNK5y3eVfa5jZguwNaQkDKWpGSw=="],
+    "@oxfmt/binding-darwin-x64": ["@oxfmt/binding-darwin-x64@0.47.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-Xq5fjTYDC50faUeLSm0rZdBqoTgleXEdD7NpJdARtQIczkCJn3xNjMUSQQkUmh4CtxkKTNL68lytcOK3e/osgg=="],
 
-    "@oxfmt/binding-freebsd-x64": ["@oxfmt/binding-freebsd-x64@0.41.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-Y2kzMkv3U3oyuYaR4wTfGjOTYTXiFC/hXmG0yVASKkbh02BJkvD98Ij8bIevr45hNZ0DmZEgqiXF+9buD4yMYQ=="],
+    "@oxfmt/binding-freebsd-x64": ["@oxfmt/binding-freebsd-x64@0.47.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-QOU9ZIJ52p5askcEC0QJvvr8trHAWoonul8bgISo6gYUL3s50zkqafBYcNAr9LJZQbsZtPfIWHk9+5+nUp1qJQ=="],
 
-    "@oxfmt/binding-linux-arm-gnueabihf": ["@oxfmt/binding-linux-arm-gnueabihf@0.41.0", "", { "os": "linux", "cpu": "arm" }, "sha512-ptazDjdUyhket01IjPTT6ULS1KFuBfTUU97osTP96X5y/0oso+AgAaJzuH81oP0+XXyrWIHbRzozSAuQm4p48g=="],
+    "@oxfmt/binding-linux-arm-gnueabihf": ["@oxfmt/binding-linux-arm-gnueabihf@0.47.0", "", { "os": "linux", "cpu": "arm" }, "sha512-oJxDM1aBhPvz9gmElBv8UpxyiqhwfjcbrSxT5F0xtuUzY6dQI27/AQPIt3eu3Z5Yvn0kQl5R7MA3Z+MbnRvCBw=="],
 
-    "@oxfmt/binding-linux-arm-musleabihf": ["@oxfmt/binding-linux-arm-musleabihf@0.41.0", "", { "os": "linux", "cpu": "arm" }, "sha512-UkoL2OKxFD+56bPEBcdGn+4juTW4HRv/T6w1dIDLnvKKWr6DbarB/mtHXlADKlFiJubJz8pRkttOR7qjYR6lTA=="],
+    "@oxfmt/binding-linux-arm-musleabihf": ["@oxfmt/binding-linux-arm-musleabihf@0.47.0", "", { "os": "linux", "cpu": "arm" }, "sha512-g8Lh50VS4ibGz2q6v7r9UZY4D0dM16SdrFYOMzhqIoCwGcai8VMIRUAcqn1/jlCsOOzUXJ741+kCeJt0cofakQ=="],
 
-    "@oxfmt/binding-linux-arm64-gnu": ["@oxfmt/binding-linux-arm64-gnu@0.41.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-gofu0PuumSOHYczD8p62CPY4UF6ee+rSLZJdUXkpwxg6pILiwSDBIouPskjF/5nF3A7QZTz2O9KFNkNxxFN9tA=="],
+    "@oxfmt/binding-linux-arm64-gnu": ["@oxfmt/binding-linux-arm64-gnu@0.47.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-YrNT1vQ0asaXoRbrvYENPqmBfOQ9Xr8enPNOULeYfg44VjCcrUowFy5QZr+WawE0zyP8cH9e9Gxxg0fDEFzhcg=="],
 
-    "@oxfmt/binding-linux-arm64-musl": ["@oxfmt/binding-linux-arm64-musl@0.41.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-VfVZxL0+6RU86T8F8vKiDBa+iHsr8PAjQmKGBzSCAX70b6x+UOMFl+2dNihmKmUwqkCazCPfYjt6SuAPOeQJ3g=="],
+    "@oxfmt/binding-linux-arm64-musl": ["@oxfmt/binding-linux-arm64-musl@0.47.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-IxtQC/sbBi4ubbY+MdwdanRWrG9InQJVZqyMsBa5IUaQcnSg86gQme574HxXMC1p4bo4YhV99zQ+wNnGCvEgzw=="],
 
-    "@oxfmt/binding-linux-ppc64-gnu": ["@oxfmt/binding-linux-ppc64-gnu@0.41.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-bwzokz2eGvdfJbc0i+zXMJ4BBjQPqg13jyWpEEZDOrBCQ91r8KeY2Mi2kUeuMTZNFXju+jcAbAbpyJxRGla0eg=="],
+    "@oxfmt/binding-linux-ppc64-gnu": ["@oxfmt/binding-linux-ppc64-gnu@0.47.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-EWXEhOMbWO0q6eJSbu0QLkU8cKi0ljlYLngeDs2Ocu/pm1rrLwyQiYzlFbdnMRURI4w9ndr1sI9rSbhlJ5o23Q=="],
 
-    "@oxfmt/binding-linux-riscv64-gnu": ["@oxfmt/binding-linux-riscv64-gnu@0.41.0", "", { "os": "linux", "cpu": "none" }, "sha512-POLM//PCH9uqDeNDwWL3b3DkMmI3oI2cU6hwc2lnztD1o7dzrQs3R9nq555BZ6wI7t2lyhT9CS+CRaz5X0XqLA=="],
+    "@oxfmt/binding-linux-riscv64-gnu": ["@oxfmt/binding-linux-riscv64-gnu@0.47.0", "", { "os": "linux", "cpu": "none" }, "sha512-tZrjS11TUiDuEpRaqdk8K9F9xETRyKXfuZKmdeW+Gj7coBnm7+8sBEfyt033EAFEQSlkniAXvBLh+Qja2ioGBQ=="],
 
-    "@oxfmt/binding-linux-riscv64-musl": ["@oxfmt/binding-linux-riscv64-musl@0.41.0", "", { "os": "linux", "cpu": "none" }, "sha512-NNK7PzhFqLUwx/G12Xtm6scGv7UITvyGdAR5Y+TlqsG+essnuRWR4jRNODWRjzLZod0T3SayRbnkSIWMBov33w=="],
+    "@oxfmt/binding-linux-riscv64-musl": ["@oxfmt/binding-linux-riscv64-musl@0.47.0", "", { "os": "linux", "cpu": "none" }, "sha512-KBFy+2CFKUCZzYwX2ZOPQKck1vjQbz+hextuc19G4r0WRJwadfAeuQMQRQvB+Ivc8brlbOVg7et8K7E467440g=="],
 
-    "@oxfmt/binding-linux-s390x-gnu": ["@oxfmt/binding-linux-s390x-gnu@0.41.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-qVf/zDC5cN9eKe4qI/O/m445er1IRl6swsSl7jHkqmOSVfknwCe5JXitYjZca+V/cNJSU/xPlC5EFMabMMFDpw=="],
+    "@oxfmt/binding-linux-s390x-gnu": ["@oxfmt/binding-linux-s390x-gnu@0.47.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-REUPFKVGSiK99B+9eaPhluEVglzaoj/SMykNC5SUiV2RSsBfV5lWN7Y0iCIc251Wz3GaeAGZsJ/zj3gjarxdFg=="],
 
-    "@oxfmt/binding-linux-x64-gnu": ["@oxfmt/binding-linux-x64-gnu@0.41.0", "", { "os": "linux", "cpu": "x64" }, "sha512-ojxYWu7vUb6ysYqVCPHuAPVZHAI40gfZ0PDtZAMwVmh2f0V8ExpPIKoAKr7/8sNbAXJBBpZhs2coypIo2jJX4w=="],
+    "@oxfmt/binding-linux-x64-gnu": ["@oxfmt/binding-linux-x64-gnu@0.47.0", "", { "os": "linux", "cpu": "x64" }, "sha512-KVftVSVEDeIfRW3TIeLe3aNI/iY4m1fu5mDwHcisKMZSCMKLkrhFsjowC7o9RoqNPxbbglm2+/6KAKBIts2t0Q=="],
 
-    "@oxfmt/binding-linux-x64-musl": ["@oxfmt/binding-linux-x64-musl@0.41.0", "", { "os": "linux", "cpu": "x64" }, "sha512-O2exZLBxoCMIv2vlvcbkdedazJPTdG0VSup+0QUCfYQtx751zCZNboX2ZUOiQ/gDTdhtXvSiot0h6GEGkOyalA=="],
+    "@oxfmt/binding-linux-x64-musl": ["@oxfmt/binding-linux-x64-musl@0.47.0", "", { "os": "linux", "cpu": "x64" }, "sha512-DTsmGEaA2860Aq5VUyDO8/MT9NFxwVL93RnRYmpMwK6DsSkThmvEpqoUDDljziEpAedMRG19SCogrNbINSbLUQ=="],
 
-    "@oxfmt/binding-openharmony-arm64": ["@oxfmt/binding-openharmony-arm64@0.41.0", "", { "os": "none", "cpu": "arm64" }, "sha512-N+31/VoL+z+NNBt8viy3I4NaIdPbiYeOnB884LKqvXldaE2dRztdPv3q5ipfZYv0RwFp7JfqS4I27K/DSHCakg=="],
+    "@oxfmt/binding-openharmony-arm64": ["@oxfmt/binding-openharmony-arm64@0.47.0", "", { "os": "none", "cpu": "arm64" }, "sha512-8r5BDro7fLOBoq1JXHLVSs55OlrxQhEso4HVo0TcY7OXJUPYfjPoOaYL5us+yIwqyP9rQwN+rxuiNFSmaxSuOQ=="],
 
-    "@oxfmt/binding-win32-arm64-msvc": ["@oxfmt/binding-win32-arm64-msvc@0.41.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-Z7NAtu/RN8kjCQ1y5oDD0nTAeRswh3GJ93qwcW51srmidP7XPBmZbLlwERu1W5veCevQJtPS9xmkpcDTYsGIwQ=="],
+    "@oxfmt/binding-win32-arm64-msvc": ["@oxfmt/binding-win32-arm64-msvc@0.47.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-qtz/gzm8IjSPUlseZ0ofW8zyHLoZsuP5HTfcGGkWkUblB89JT8GNYH3ICqjbDsqsGqXum0/ZndXTFplSdXFIcg=="],
 
-    "@oxfmt/binding-win32-ia32-msvc": ["@oxfmt/binding-win32-ia32-msvc@0.41.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-uNxxP3l4bJ6VyzIeRqCmBU2Q0SkCFgIhvx9/9dJ9V8t/v+jP1IBsuaLwCXGR8JPHtkj4tFp+RHtUmU2ZYAUpMA=="],
+    "@oxfmt/binding-win32-ia32-msvc": ["@oxfmt/binding-win32-ia32-msvc@0.47.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-5vIcdcIDE7nCx+MXN6sm8kbC4zajDB31E86rez4i45iHNH/2NjdKlJ720xcHTr3eeiMcttCGPHPhE1TjtBDGZw=="],
 
-    "@oxfmt/binding-win32-x64-msvc": ["@oxfmt/binding-win32-x64-msvc@0.41.0", "", { "os": "win32", "cpu": "x64" }, "sha512-49ZSpbZ1noozyPapE8SUOSm3IN0Ze4b5nkO+4+7fq6oEYQQJFhE0saj5k/Gg4oewVPdjn0L3ZFeWk2Vehjcw7A=="],
+    "@oxfmt/binding-win32-x64-msvc": ["@oxfmt/binding-win32-x64-msvc@0.47.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Sr59Y5ms54ONBjxFeWhVlGyQcHXxcl9DxC23f6yXlRkcos7LXBLoO+KDfxexjHIOZh7cWqrWduzvUjJ+pHp8cQ=="],
 
-    "@oxlint-tsgolint/darwin-arm64": ["@oxlint-tsgolint/darwin-arm64@0.17.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-XEA7vl/T1+wiVnMq2MR6u5OYr2pwKHiAPgklxpK8tPrjQ1ci/amNmwI8ECn6TPXSCsC8SJsSN5xvzXm5H3dTfw=="],
+    "@oxlint-tsgolint/darwin-arm64": ["@oxlint-tsgolint/darwin-arm64@0.22.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-4150Lpgc1YM09GcjA6GSrra1JoPjC7aOpfywLjWEY4vW0Sd1qKzqHF1WRaiw0/qUZ40OATYdv3aRd7ipPkWQbw=="],
 
-    "@oxlint-tsgolint/darwin-x64": ["@oxlint-tsgolint/darwin-x64@0.17.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-EY2wmHWqkz72B0/ddMiAM564ZXpEuN1i7JqJJhLmDUQfiHX0/X0EqK3xlSScMCFcVicitOxbKO9oqbde3658yg=="],
+    "@oxlint-tsgolint/darwin-x64": ["@oxlint-tsgolint/darwin-x64@0.22.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-vFWcPWYOgZs4HWcgS1EjUZg33NLcNfEYU49KGImmCfZWkflENrmBYV4HN/C0YeAPum6ZZ/goPSvQrB/cOD+NfA=="],
 
-    "@oxlint-tsgolint/linux-arm64": ["@oxlint-tsgolint/linux-arm64@0.17.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-XL2X8hgp3/TZWeHFLUnWrveTCBPxy1kNtpzfvVkLtBgyoaRyopPYL0Mnm+ypXKgGvUdcjDaiJhnRjFHWmqZkew=="],
+    "@oxlint-tsgolint/linux-arm64": ["@oxlint-tsgolint/linux-arm64@0.22.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-6LiUpP0Zir3+29FvBm7Y28q/dBjSHqTZ5MhG1Ckw4fGhI4cAvbcwXaKvbjx1TP7rRmBNOoq/M5xdpHjTb+GAew=="],
 
-    "@oxlint-tsgolint/linux-x64": ["@oxlint-tsgolint/linux-x64@0.17.4", "", { "os": "linux", "cpu": "x64" }, "sha512-jT+aWtQuU8jefwfBLAZu16p4t8xUDjxL6KKlOeuwX3cS6NO60ITJ4Glm8eQYq5cGsOmYIKXNIe4ckPpL5LC+5g=="],
+    "@oxlint-tsgolint/linux-x64": ["@oxlint-tsgolint/linux-x64@0.22.1", "", { "os": "linux", "cpu": "x64" }, "sha512-fuX1hEQfpHauUbXADsfqVhRzrUrGabzGXbj5wsp2vKhV5uk/Rze8Mba9GdjFGECzvXudMGqHqxB4r6jGRdhxVA=="],
 
-    "@oxlint-tsgolint/win32-arm64": ["@oxlint-tsgolint/win32-arm64@0.17.4", "", { "os": "win32", "cpu": "arm64" }, "sha512-pnnkBaI5tHBFhx+EhmpUHccBT3VOAXTgWK2eQBVLE4a/ywhpHN+8D6/QQN+ZTaA4LTkKowvlGD6vDOVP5KRPvw=="],
+    "@oxlint-tsgolint/win32-arm64": ["@oxlint-tsgolint/win32-arm64@0.22.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-8SZidAj+jrbZf9ZjBEYW0tiNZ+KasqB2zgW26qdiPpQSF/DzURnPmXz651IeA9YsmbVdHGIooEHUmev6QJdquA=="],
 
-    "@oxlint-tsgolint/win32-x64": ["@oxlint-tsgolint/win32-x64@0.17.4", "", { "os": "win32", "cpu": "x64" }, "sha512-JxT81aEUBNA/s01Ql2OQ2DLAsuM0M+mK9iLHunukOdPMhjA6NvFE/GtTablBYJKScK21d/xTvnoSLgQU3l22Cw=="],
+    "@oxlint-tsgolint/win32-x64": ["@oxlint-tsgolint/win32-x64@0.22.1", "", { "os": "win32", "cpu": "x64" }, "sha512-QweSk9H5lFh5Y+WUf2Kq/OAN88V6+62ZwGhP38gqdRotI90luXSMkruFTj7Q2rYrzH4ZVNaSqx7NY8JpSfIzqg=="],
 
-    "@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.60.0", "", { "os": "android", "cpu": "arm" }, "sha512-YdeJKaZckDQL1qa62a1aKq/goyq48aX3yOxaaWqWb4sau4Ee4IiLbamftNLU3zbePky6QsDj6thnSSzHRBjDfA=="],
+    "@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.62.0", "", { "os": "android", "cpu": "arm" }, "sha512-pKsthNECyvJh8lPTICz6VcwVy2jOqdhhsp1rlxCkhgZR47aKvXPmaRWQDv+zlXpRae4qm1MaaTnutkaOk5aofg=="],
 
-    "@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.60.0", "", { "os": "android", "cpu": "arm64" }, "sha512-7ANS7PpXCfq84xZQ8E5WPs14gwcuPcl+/8TFNXfpSu0CQBXz3cUo2fDpHT8v8HJN+Ut02eacvMAzTnc9s6X4tw=="],
+    "@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.62.0", "", { "os": "android", "cpu": "arm64" }, "sha512-b1AUNViByvgmR2xJDubvLIr+dSuu3uraG7bsAoKo+xrpspPvu6RIn6Fhr2JUhobfep3jwUTy18Huco6GkwdvGQ=="],
 
-    "@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.60.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-pJsgd9AfplLGBm1fIr25V6V14vMrayhx4uIQvlfH7jWs2SZwSrvi3TfgfJySB8T+hvyEH8K2zXljQiUnkgUnfQ=="],
+    "@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.62.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-iG+Tvf70UJ6otfwFYIHk36Sjq9cpPP5YLxkoggANNRtzgi3Tj3g8q6Ybqi6AtkU3+yg9QwF7bDCkCS6bbL4PCg=="],
 
-    "@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.60.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-Ue1aXHX49ivwflKqGJc7zcd/LeLgbhaTcDCQStgx5x06AXgjEAZmvrlMuIkWd4AL4FHQe6QJ9f33z04Cg448VQ=="],
+    "@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.62.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-oOWI6YPPr5AJUx+yIDlxmuUbQjS5gZX3OH3QisawYvsZgLiQVvZtR0rPBcJTxLWqt2ClrWg0DlSrlUiG5SQNHg=="],
 
-    "@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.60.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-YCyQzsQtusQw+gNRW9rRTifSO+Dt/+dtCl2NHoDMZqJlRTEZ/Oht9YnuporI9yiTx7+cB+eqzX3MtHHVHGIWhg=="],
+    "@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.62.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-dLP33T7VLCmLVv4cvjkVX+rmkcwNk2UfxmsZPNur/7BQHoQR60zJ7XLiRvNUawlzn0u8ngCa3itjEG73MAMa/w=="],
 
-    "@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.60.0", "", { "os": "linux", "cpu": "arm" }, "sha512-c7dxM2Zksa45Qw16i2iGY3Fti2NirJ38FrsBsKw+qcJ0OtqTsBgKJLF0xV+yLG56UH01Z8WRPgsw31e0MoRoGQ=="],
+    "@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.62.0", "", { "os": "linux", "cpu": "arm" }, "sha512-fl//LWNks6qo9chNY60UDYyIwtp7a5cEx4Y/rHPjaarhuwqx6jtbzEpD5V5AqmdL4a6Y5D8zeXg5HF2Cr0QmSQ=="],
 
-    "@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.60.0", "", { "os": "linux", "cpu": "arm" }, "sha512-ZWALoA42UYqBEP1Tbw9OWURgFGS1nWj2AAvLdY6ZcGx/Gj93qVCBKjcvwXMupZibYwFbi9s/rzqkZseb/6gVtQ=="],
+    "@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.62.0", "", { "os": "linux", "cpu": "arm" }, "sha512-i5vkAuxvueTODV3J2dL61/TXewDHhMFKvtD156cIsk7GsdfiAu7zW7kY0NJXhKeFHeiMZIh7eFNjkPYH6J47HQ=="],
 
-    "@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.60.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-tpy+1w4p9hN5CicMCxqNy6ymfRtV5ayE573vFNjp1k1TN/qhLFgflveZoE/0++RlkHikBz2vY545NWm/hp7big=="],
+    "@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.62.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-QwN19LLuIGuOjEflSeJkZmOTfBdBMlTmW8xbMf8TZhjd//cxVNYQPq75q7oKZBJc6hRx3gY7sX0Egc8cEIFZYg=="],
 
-    "@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.60.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-eDYDXZGhQAXyn6GwtwiX/qcLS0HlOLPJ/+iiIY8RYr+3P8oKBmgKxADLlniL6FtWfE7pPk7IGN9/xvDEvDvFeg=="],
+    "@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.62.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-8eCy3FCDuWUM5hWujAv6heMvfZPbcCOU3SdQUAkixZLu5bSzOkNfirJiLGoQFO943xceOKkiQRMQNzH++jM3WA=="],
 
-    "@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.60.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-nxehly5XYBHUWI9VJX1bqCf9j/B43DaK/aS/T1fcxCpX3PA4Rm9BB54nPD1CKayT8xg6REN1ao+01hSRNgy8OA=="],
+    "@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.62.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-NjQ7K7tpTPDe9J+yq8p/s/J0E7lRCkK2uDBDqvT4XIT6f4Z0tlnr59OBg/WcrmVHER1AbrcfyxhGTXgcG8ytWg=="],
 
-    "@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.60.0", "", { "os": "linux", "cpu": "none" }, "sha512-j1qf/NaUfOWQutjeoooNG1Q0zsK0XGmSu1uDLq3cctquRF3j7t9Hxqf/76ehCc5GEUAanth2W4Fa+XT1RFg/nw=="],
+    "@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.62.0", "", { "os": "linux", "cpu": "none" }, "sha512-oKZed9gmSwze29dEt3/Wnsv6l/Ygw/FUst+8Kfpv2SGeS/glEoTGZAMQw37SVyzFV76UTHJN2snGgxK2t2+8ow=="],
 
-    "@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.60.0", "", { "os": "linux", "cpu": "none" }, "sha512-YELKPRefQ/q/h3RUmeRfPCUhh2wBvgV1RyZ/F9M9u8cDyXsQW2ojv1DeWQTt466yczDITjZnIOg/s05pk7Ve2A=="],
+    "@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.62.0", "", { "os": "linux", "cpu": "none" }, "sha512-gBjBxQ+9lGpAYq+ELqw0w8QXsBnkZclFc7GRX2r0LnEVn3ZTEqeIKpKcGjucmp76Q53bvJD0i4qBWBhcfhSfGA=="],
 
-    "@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.60.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-JkO3C6Gki7Y6h/MiIkFKvHFOz98/YWvQ4WYbK9DLXACMP2rjULzkeGyAzorJE5S1dzLQGFgeqvN779kSFwoV1g=="],
+    "@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.62.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-Ew2Kxs9EQ9/mbAIJ2hvocMC0wsOu6YKzStI2eFBDt+Td5O8seVC/oxgRIHqCcl5sf5ratA1nozQBAuv7tphkHg=="],
 
-    "@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.60.0", "", { "os": "linux", "cpu": "x64" }, "sha512-XjKHdFVCpZZZSWBCKyyqCq65s2AKXykMXkjLoKYODrD+f5toLhlwsMESscu8FbgnJQ4Y/dpR/zdazsahmgBJIA=="],
+    "@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.62.0", "", { "os": "linux", "cpu": "x64" }, "sha512-5z25jcAA0gfKyVwz71A0VXgaPlocPoTAxhlv/hgoK6tlCrfoNuw7haWbDHvGMfjXhdic4EqVXGRv5XsTqFnbRQ=="],
 
-    "@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.60.0", "", { "os": "linux", "cpu": "x64" }, "sha512-js29ZWIuPhNWzY8NC7KoffEMEeWG105vbmm+8EOJsC+T/jHBiKIJEUF78+F/IrgEWMMP9N0kRND4Pp75+xAhKg=="],
+    "@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.62.0", "", { "os": "linux", "cpu": "x64" }, "sha512-IWpHmMB6ZDllPvqWDkG6AmXrN7JF5e/c4g/0PuURsmlK+vHoYZPB70rr4u1bn3I4LsKCSpqqfveyx6UCOC8wdg=="],
 
-    "@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.60.0", "", { "os": "none", "cpu": "arm64" }, "sha512-H+PUITKHk04stFpWj3x3Kg08Afp/bcXSBi0EhasR5a0Vw7StXHTzdl655PUI0fB4qdh2Wsu6Dsi+3ACxPoyQnA=="],
+    "@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.62.0", "", { "os": "none", "cpu": "arm64" }, "sha512-fjlSxxrD5pA594vkyikCS9MnPRjQawW6/BLgyTYkO+73wwPlYjkcZ7LSd974l0Q2zkHQmu4DPvJFLYA7o8xrxQ=="],
 
-    "@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.60.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-WA/yc7f7ZfCefBXVzNHn1Ztulb1EFwNBb4jMZ6pjML0zz6pHujlF3Q3jySluz3XHl/GNeMTntG1seUBWVMlMag=="],
+    "@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.62.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-EiFXr8loNS0Ul3Gu80+9nr1T8jRmnKocqmHHg16tj5ZqTgUXyb97l2rrspVHdDluyFn9JfR4PoJFdNzw4paHww=="],
 
-    "@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.60.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-33YxL1sqwYNZXtn3MD/4dno6s0xeedXOJlT1WohkVD565WvohClZUr7vwKdAk954n4xiEWJkewiCr+zLeq7AeA=="],
+    "@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.62.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-IgOFvL73li1bFgab+hThXYA0N2Xms2kV2MvZN95cebV+fmrZ9AVui1JSxfeeqRLo3CpPxKZlzhyq4G0cnaAvIw=="],
 
-    "@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.60.0", "", { "os": "win32", "cpu": "x64" }, "sha512-JOro4ZcfBLamJCyfURQmOQByoorgOdx3ZjAkSqnb/CyG/i+lN3KoV5LAgk5ZAW6DPq7/Cx7n23f8DuTWXTWgyQ=="],
+    "@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.62.0", "", { "os": "win32", "cpu": "x64" }, "sha512-6hMpyDWQ2zGA1OXFKBrdYMUveUCO8UJhkO6JdwZPd78xIdHZNhjx+pib+4fC2Cljuhjyl0QwA2F3df/bs4Bp6A=="],
 
     "@panva/hkdf": ["@panva/hkdf@1.2.1", "", {}, "sha512-6oclG6Y3PiDFcoyk8srjLfVKyMfVCKJ27JwNPViuXziFpmdz+MZnZN/aKY0JGXgYuO/VghU0jcOAZgWXZ1Dmrw=="],
 
@@ -569,35 +575,35 @@
 
     "@resvg/resvg-wasm": ["@resvg/resvg-wasm@2.6.2", "", {}, "sha512-FqALmHI8D4o6lk/LRWDnhw95z5eO+eAa6ORjVg09YRR7BkcM6oPHU9uyC0gtQG5vpFLvgpeU4+zEAz2H8APHNw=="],
 
-    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.0-rc.12", "", { "os": "android", "cpu": "arm64" }, "sha512-pv1y2Fv0JybcykuiiD3qBOBdz6RteYojRFY1d+b95WVuzx211CRh+ytI/+9iVyWQ6koTh5dawe4S/yRfOFjgaA=="],
+    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.0-rc.17", "", { "os": "android", "cpu": "arm64" }, "sha512-s70pVGhw4zqGeFnXWvAzJDlvxhlRollagdCCKRgOsgUOH3N1l0LIxf83AtGzmb5SiVM4Hjl5HyarMRfdfj3DaQ=="],
 
-    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.0-rc.12", "", { "os": "darwin", "cpu": "arm64" }, "sha512-cFYr6zTG/3PXXF3pUO+umXxt1wkRK/0AYT8lDwuqvRC+LuKYWSAQAQZjCWDQpAH172ZV6ieYrNnFzVVcnSflAg=="],
+    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.0-rc.17", "", { "os": "darwin", "cpu": "arm64" }, "sha512-4ksWc9n0mhlZpZ9PMZgTGjeOPRu8MB1Z3Tz0Mo02eWfWCHMW1zN82Qz/pL/rC+yQa+8ZnutMF0JjJe7PjwasYw=="],
 
-    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.0.0-rc.12", "", { "os": "darwin", "cpu": "x64" }, "sha512-ZCsYknnHzeXYps0lGBz8JrF37GpE9bFVefrlmDrAQhOEi4IOIlcoU1+FwHEtyXGx2VkYAvhu7dyBf75EJQffBw=="],
+    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.0.0-rc.17", "", { "os": "darwin", "cpu": "x64" }, "sha512-SUSDOI6WwUVNcWxd02QEBjLdY1VPHvlEkw6T/8nYG322iYWCTxRb1vzk4E+mWWYehTp7ERibq54LSJGjmouOsw=="],
 
-    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.0.0-rc.12", "", { "os": "freebsd", "cpu": "x64" }, "sha512-dMLeprcVsyJsKolRXyoTH3NL6qtsT0Y2xeuEA8WQJquWFXkEC4bcu1rLZZSnZRMtAqwtrF/Ib9Ddtpa/Gkge9Q=="],
+    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.0.0-rc.17", "", { "os": "freebsd", "cpu": "x64" }, "sha512-hwnz3nw9dbJ05EDO/PvcjaaewqqDy7Y1rn1UO81l8iIK1GjenME75dl16ajbvSSMfv66WXSRCYKIqfgq2KCfxw=="],
 
-    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.0.0-rc.12", "", { "os": "linux", "cpu": "arm" }, "sha512-YqWjAgGC/9M1lz3GR1r1rP79nMgo3mQiiA+Hfo+pvKFK1fAJ1bCi0ZQVh8noOqNacuY1qIcfyVfP6HoyBRZ85Q=="],
+    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.0.0-rc.17", "", { "os": "linux", "cpu": "arm" }, "sha512-IS+W7epTcwANmFSQFrS1SivEXHtl1JtuQA9wlxrZTcNi6mx+FDOYrakGevvvTwgj2JvWiK8B29/qD9BELZPyXQ=="],
 
-    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.0.0-rc.12", "", { "os": "linux", "cpu": "arm64" }, "sha512-/I5AS4cIroLpslsmzXfwbe5OmWvSsrFuEw3mwvbQ1kDxJ822hFHIx+vsN/TAzNVyepI/j/GSzrtCIwQPeKCLIg=="],
+    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.0.0-rc.17", "", { "os": "linux", "cpu": "arm64" }, "sha512-e6usGaHKW5BMNZOymS1UcEYGowQMWcgZ71Z17Sl/h2+ZziNJ1a9n3Zvcz6LdRyIW5572wBCTH/Z+bKuZouGk9Q=="],
 
-    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.0.0-rc.12", "", { "os": "linux", "cpu": "arm64" }, "sha512-V6/wZztnBqlx5hJQqNWwFdxIKN0m38p8Jas+VoSfgH54HSj9tKTt1dZvG6JRHcjh6D7TvrJPWFGaY9UBVOaWPw=="],
+    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.0.0-rc.17", "", { "os": "linux", "cpu": "arm64" }, "sha512-b/CgbwAJpmrRLp02RPfhbudf5tZnN9nsPWK82znefso832etkem8H7FSZwxrOI9djcdTP7U6YfNhbRnh7djErg=="],
 
-    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.0.0-rc.12", "", { "os": "linux", "cpu": "ppc64" }, "sha512-AP3E9BpcUYliZCxa3w5Kwj9OtEVDYK6sVoUzy4vTOJsjPOgdaJZKFmN4oOlX0Wp0RPV2ETfmIra9x1xuayFB7g=="],
+    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.0.0-rc.17", "", { "os": "linux", "cpu": "ppc64" }, "sha512-4EII1iNGRUN5WwGbF/kOh/EIkoDN9HsupgLQoXfY+D1oyJm7/F4t5PYU5n8SWZgG0FEwakyM8pGgwcBYruGTlA=="],
 
-    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.0.0-rc.12", "", { "os": "linux", "cpu": "s390x" }, "sha512-nWwpvUSPkoFmZo0kQazZYOrT7J5DGOJ/+QHHzjvNlooDZED8oH82Yg67HvehPPLAg5fUff7TfWFHQS8IV1n3og=="],
+    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.0.0-rc.17", "", { "os": "linux", "cpu": "s390x" }, "sha512-AH8oq3XqQo4IibpVXvPeLDI5pzkpYn0WiZAfT05kFzoJ6tQNzwRdDYQ45M8I/gslbodRZwW8uxLhbSBbkv96rA=="],
 
-    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.0.0-rc.12", "", { "os": "linux", "cpu": "x64" }, "sha512-RNrafz5bcwRy+O9e6P8Z/OCAJW/A+qtBczIqVYwTs14pf4iV1/+eKEjdOUta93q2TsT/FI0XYDP3TCky38LMAg=="],
+    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.0.0-rc.17", "", { "os": "linux", "cpu": "x64" }, "sha512-cLnjV3xfo7KslbU41Z7z8BH/E1y5mzUYzAqih1d1MDaIGZRCMqTijqLv76/P7fyHuvUcfGsIpqCdddbxLLK9rA=="],
 
-    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.0.0-rc.12", "", { "os": "linux", "cpu": "x64" }, "sha512-Jpw/0iwoKWx3LJ2rc1yjFrj+T7iHZn2JDg1Yny1ma0luviFS4mhAIcd1LFNxK3EYu3DHWCps0ydXQ5i/rrJ2ig=="],
+    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.0.0-rc.17", "", { "os": "linux", "cpu": "x64" }, "sha512-0phclDw1spsL7dUB37sIARuis2tAgomCJXAHZlpt8PXZ4Ba0dRP1e+66lsRqrfhISeN9bEGNjQs+T/Fbd7oYGw=="],
 
-    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.0.0-rc.12", "", { "os": "none", "cpu": "arm64" }, "sha512-vRugONE4yMfVn0+7lUKdKvN4D5YusEiPilaoO2sgUWpCvrncvWgPMzK00ZFFJuiPgLwgFNP5eSiUlv2tfc+lpA=="],
+    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.0.0-rc.17", "", { "os": "none", "cpu": "arm64" }, "sha512-0ag/hEgXOwgw4t8QyQvUCxvEg+V0KBcA6YuOx9g0r02MprutRF5dyljgm3EmR02O292UX7UeS6HzWHAl6KgyhA=="],
 
-    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.0.0-rc.12", "", { "dependencies": { "@napi-rs/wasm-runtime": "^1.1.1" }, "cpu": "none" }, "sha512-ykGiLr/6kkiHc0XnBfmFJuCjr5ZYKKofkx+chJWDjitX+KsJuAmrzWhwyOMSHzPhzOHOy7u9HlFoa5MoAOJ/Zg=="],
+    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.0.0-rc.17", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-LEXei6vo0E5wTGwpkJ4KoT3OZJRnglwldt5ziLzOlc6qqb55z4tWNq2A+PFqCJuvWWdP53CVhG1Z9NtToDPJrA=="],
 
-    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.0.0-rc.12", "", { "os": "win32", "cpu": "arm64" }, "sha512-5eOND4duWkwx1AzCxadcOrNeighiLwMInEADT0YM7xeEOOFcovWZCq8dadXgcRHSf3Ulh1kFo/qvzoFiCLOL1Q=="],
+    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.0.0-rc.17", "", { "os": "win32", "cpu": "arm64" }, "sha512-gUmyzBl3SPMa6hrqFUth9sVfcLBlYsbMzBx5PlexMroZStgzGqlZ26pYG89rBb45Mnia+oil6YAIFeEWGWhoZA=="],
 
-    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.0.0-rc.12", "", { "os": "win32", "cpu": "x64" }, "sha512-PyqoipaswDLAZtot351MLhrlrh6lcZPo2LSYE+VDxbVk24LVKAGOuE4hb8xZQmrPAuEtTZW8E6D2zc5EUZX4Lw=="],
+    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.0.0-rc.17", "", { "os": "win32", "cpu": "x64" }, "sha512-3hkiolcUAvPB9FLb3UZdfjVVNWherN1f/skkGWJP/fgSQhYUZpSIRr0/I8ZK9TkF3F7kxvJAk0+IcKvPHk9qQg=="],
 
     "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.7", "", {}, "sha512-qujRfC8sFVInYSPPMLQByRh7zhwkGFS4+tyMQ83srV1qrxL4g8E2tyxVVyxd0+8QeBM1mIk9KbWxkegRr76XzA=="],
 
@@ -635,37 +641,37 @@
 
     "@swc/helpers": ["@swc/helpers@0.5.15", "", { "dependencies": { "tslib": "^2.8.0" } }, "sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g=="],
 
-    "@tailwindcss/node": ["@tailwindcss/node@4.2.2", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "enhanced-resolve": "^5.19.0", "jiti": "^2.6.1", "lightningcss": "1.32.0", "magic-string": "^0.30.21", "source-map-js": "^1.2.1", "tailwindcss": "4.2.2" } }, "sha512-pXS+wJ2gZpVXqFaUEjojq7jzMpTGf8rU6ipJz5ovJV6PUGmlJ+jvIwGrzdHdQ80Sg+wmQxUFuoW1UAAwHNEdFA=="],
+    "@tailwindcss/node": ["@tailwindcss/node@4.2.4", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "enhanced-resolve": "^5.19.0", "jiti": "^2.6.1", "lightningcss": "1.32.0", "magic-string": "^0.30.21", "source-map-js": "^1.2.1", "tailwindcss": "4.2.4" } }, "sha512-Ai7+yQPxz3ddrDQzFfBKdHEVBg0w3Zl83jnjuwxnZOsnH9pGn93QHQtpU0p/8rYWxvbFZHneni6p1BSLK4DkGA=="],
 
-    "@tailwindcss/oxide": ["@tailwindcss/oxide@4.2.2", "", { "optionalDependencies": { "@tailwindcss/oxide-android-arm64": "4.2.2", "@tailwindcss/oxide-darwin-arm64": "4.2.2", "@tailwindcss/oxide-darwin-x64": "4.2.2", "@tailwindcss/oxide-freebsd-x64": "4.2.2", "@tailwindcss/oxide-linux-arm-gnueabihf": "4.2.2", "@tailwindcss/oxide-linux-arm64-gnu": "4.2.2", "@tailwindcss/oxide-linux-arm64-musl": "4.2.2", "@tailwindcss/oxide-linux-x64-gnu": "4.2.2", "@tailwindcss/oxide-linux-x64-musl": "4.2.2", "@tailwindcss/oxide-wasm32-wasi": "4.2.2", "@tailwindcss/oxide-win32-arm64-msvc": "4.2.2", "@tailwindcss/oxide-win32-x64-msvc": "4.2.2" } }, "sha512-qEUA07+E5kehxYp9BVMpq9E8vnJuBHfJEC0vPC5e7iL/hw7HR61aDKoVoKzrG+QKp56vhNZe4qwkRmMC0zDLvg=="],
+    "@tailwindcss/oxide": ["@tailwindcss/oxide@4.2.4", "", { "optionalDependencies": { "@tailwindcss/oxide-android-arm64": "4.2.4", "@tailwindcss/oxide-darwin-arm64": "4.2.4", "@tailwindcss/oxide-darwin-x64": "4.2.4", "@tailwindcss/oxide-freebsd-x64": "4.2.4", "@tailwindcss/oxide-linux-arm-gnueabihf": "4.2.4", "@tailwindcss/oxide-linux-arm64-gnu": "4.2.4", "@tailwindcss/oxide-linux-arm64-musl": "4.2.4", "@tailwindcss/oxide-linux-x64-gnu": "4.2.4", "@tailwindcss/oxide-linux-x64-musl": "4.2.4", "@tailwindcss/oxide-wasm32-wasi": "4.2.4", "@tailwindcss/oxide-win32-arm64-msvc": "4.2.4", "@tailwindcss/oxide-win32-x64-msvc": "4.2.4" } }, "sha512-9El/iI069DKDSXwTvB9J4BwdO5JhRrOweGaK25taBAvBXyXqJAX+Jqdvs8r8gKpsI/1m0LeJLyQYTf/WLrBT1Q=="],
 
-    "@tailwindcss/oxide-android-arm64": ["@tailwindcss/oxide-android-arm64@4.2.2", "", { "os": "android", "cpu": "arm64" }, "sha512-dXGR1n+P3B6748jZO/SvHZq7qBOqqzQ+yFrXpoOWWALWndF9MoSKAT3Q0fYgAzYzGhxNYOoysRvYlpixRBBoDg=="],
+    "@tailwindcss/oxide-android-arm64": ["@tailwindcss/oxide-android-arm64@4.2.4", "", { "os": "android", "cpu": "arm64" }, "sha512-e7MOr1SAn9U8KlZzPi1ZXGZHeC5anY36qjNwmZv9pOJ8E4Q6jmD1vyEHkQFmNOIN7twGPEMXRHmitN4zCMN03g=="],
 
-    "@tailwindcss/oxide-darwin-arm64": ["@tailwindcss/oxide-darwin-arm64@4.2.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-iq9Qjr6knfMpZHj55/37ouZeykwbDqF21gPFtfnhCCKGDcPI/21FKC9XdMO/XyBM7qKORx6UIhGgg6jLl7BZlg=="],
+    "@tailwindcss/oxide-darwin-arm64": ["@tailwindcss/oxide-darwin-arm64@4.2.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-tSC/Kbqpz/5/o/C2sG7QvOxAKqyd10bq+ypZNf+9Fi2TvbVbv1zNpcEptcsU7DPROaSbVgUXmrzKhurFvo5eDg=="],
 
-    "@tailwindcss/oxide-darwin-x64": ["@tailwindcss/oxide-darwin-x64@4.2.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-BlR+2c3nzc8f2G639LpL89YY4bdcIdUmiOOkv2GQv4/4M0vJlpXEa0JXNHhCHU7VWOKWT/CjqHdTP8aUuDJkuw=="],
+    "@tailwindcss/oxide-darwin-x64": ["@tailwindcss/oxide-darwin-x64@4.2.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-yPyUXn3yO/ufR6+Kzv0t4fCg2qNr90jxXc5QqBpjlPNd0NqyDXcmQb/6weunH/MEDXW5dhyEi+agTDiqa3WsGg=="],
 
-    "@tailwindcss/oxide-freebsd-x64": ["@tailwindcss/oxide-freebsd-x64@4.2.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-YUqUgrGMSu2CDO82hzlQ5qSb5xmx3RUrke/QgnoEx7KvmRJHQuZHZmZTLSuuHwFf0DJPybFMXMYf+WJdxHy/nQ=="],
+    "@tailwindcss/oxide-freebsd-x64": ["@tailwindcss/oxide-freebsd-x64@4.2.4", "", { "os": "freebsd", "cpu": "x64" }, "sha512-BoMIB4vMQtZsXdGLVc2z+P9DbETkiopogfWZKbWwM8b/1Vinbs4YcUwo+kM/KeLkX3Ygrf4/PsRndKaYhS8Eiw=="],
 
-    "@tailwindcss/oxide-linux-arm-gnueabihf": ["@tailwindcss/oxide-linux-arm-gnueabihf@4.2.2", "", { "os": "linux", "cpu": "arm" }, "sha512-FPdhvsW6g06T9BWT0qTwiVZYE2WIFo2dY5aCSpjG/S/u1tby+wXoslXS0kl3/KXnULlLr1E3NPRRw0g7t2kgaQ=="],
+    "@tailwindcss/oxide-linux-arm-gnueabihf": ["@tailwindcss/oxide-linux-arm-gnueabihf@4.2.4", "", { "os": "linux", "cpu": "arm" }, "sha512-7pIHBLTHYRAlS7V22JNuTh33yLH4VElwKtB3bwchK/UaKUPpQ0lPQiOWcbm4V3WP2I6fNIJ23vABIvoy2izdwA=="],
 
-    "@tailwindcss/oxide-linux-arm64-gnu": ["@tailwindcss/oxide-linux-arm64-gnu@4.2.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-4og1V+ftEPXGttOO7eCmW7VICmzzJWgMx+QXAJRAhjrSjumCwWqMfkDrNu1LXEQzNAwz28NCUpucgQPrR4S2yw=="],
+    "@tailwindcss/oxide-linux-arm64-gnu": ["@tailwindcss/oxide-linux-arm64-gnu@4.2.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-+E4wxJ0ZGOzSH325reXTWB48l42i93kQqMvDyz5gqfRzRZ7faNhnmvlV4EPGJU3QJM/3Ab5jhJ5pCRUsKn6OQw=="],
 
-    "@tailwindcss/oxide-linux-arm64-musl": ["@tailwindcss/oxide-linux-arm64-musl@4.2.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-oCfG/mS+/+XRlwNjnsNLVwnMWYH7tn/kYPsNPh+JSOMlnt93mYNCKHYzylRhI51X+TbR+ufNhhKKzm6QkqX8ag=="],
+    "@tailwindcss/oxide-linux-arm64-musl": ["@tailwindcss/oxide-linux-arm64-musl@4.2.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-bBADEGAbo4ASnppIziaQJelekCxdMaxisrk+fB7Thit72IBnALp9K6ffA2G4ruj90G9XRS2VQ6q2bCKbfFV82g=="],
 
-    "@tailwindcss/oxide-linux-x64-gnu": ["@tailwindcss/oxide-linux-x64-gnu@4.2.2", "", { "os": "linux", "cpu": "x64" }, "sha512-rTAGAkDgqbXHNp/xW0iugLVmX62wOp2PoE39BTCGKjv3Iocf6AFbRP/wZT/kuCxC9QBh9Pu8XPkv/zCZB2mcMg=="],
+    "@tailwindcss/oxide-linux-x64-gnu": ["@tailwindcss/oxide-linux-x64-gnu@4.2.4", "", { "os": "linux", "cpu": "x64" }, "sha512-7Mx25E4WTfnht0TVRTyC00j3i0M+EeFe7wguMDTlX4mRxafznw0CA8WJkFjWYH5BlgELd1kSjuU2JiPnNZbJDA=="],
 
-    "@tailwindcss/oxide-linux-x64-musl": ["@tailwindcss/oxide-linux-x64-musl@4.2.2", "", { "os": "linux", "cpu": "x64" }, "sha512-XW3t3qwbIwiSyRCggeO2zxe3KWaEbM0/kW9e8+0XpBgyKU4ATYzcVSMKteZJ1iukJ3HgHBjbg9P5YPRCVUxlnQ=="],
+    "@tailwindcss/oxide-linux-x64-musl": ["@tailwindcss/oxide-linux-x64-musl@4.2.4", "", { "os": "linux", "cpu": "x64" }, "sha512-2wwJRF7nyhOR0hhHoChc04xngV3iS+akccHTGtz965FwF0up4b2lOdo6kI1EbDaEXKgvcrFBYcYQQ/rrnWFVfA=="],
 
-    "@tailwindcss/oxide-wasm32-wasi": ["@tailwindcss/oxide-wasm32-wasi@4.2.2", "", { "dependencies": { "@emnapi/core": "^1.8.1", "@emnapi/runtime": "^1.8.1", "@emnapi/wasi-threads": "^1.1.0", "@napi-rs/wasm-runtime": "^1.1.1", "@tybys/wasm-util": "^0.10.1", "tslib": "^2.8.1" }, "cpu": "none" }, "sha512-eKSztKsmEsn1O5lJ4ZAfyn41NfG7vzCg496YiGtMDV86jz1q/irhms5O0VrY6ZwTUkFy/EKG3RfWgxSI3VbZ8Q=="],
+    "@tailwindcss/oxide-wasm32-wasi": ["@tailwindcss/oxide-wasm32-wasi@4.2.4", "", { "dependencies": { "@emnapi/core": "^1.8.1", "@emnapi/runtime": "^1.8.1", "@emnapi/wasi-threads": "^1.1.0", "@napi-rs/wasm-runtime": "^1.1.1", "@tybys/wasm-util": "^0.10.1", "tslib": "^2.8.1" }, "cpu": "none" }, "sha512-FQsqApeor8Fo6gUEklzmaa9994orJZZDBAlQpK2Mq+DslRKFJeD6AjHpBQ0kZFQohVr8o85PPh8eOy86VlSCmw=="],
 
-    "@tailwindcss/oxide-win32-arm64-msvc": ["@tailwindcss/oxide-win32-arm64-msvc@4.2.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-qPmaQM4iKu5mxpsrWZMOZRgZv1tOZpUm+zdhhQP0VhJfyGGO3aUKdbh3gDZc/dPLQwW4eSqWGrrcWNBZWUWaXQ=="],
+    "@tailwindcss/oxide-win32-arm64-msvc": ["@tailwindcss/oxide-win32-arm64-msvc@4.2.4", "", { "os": "win32", "cpu": "arm64" }, "sha512-L9BXqxC4ToVgwMFqj3pmZRqyHEztulpUJzCxUtLjobMCzTPsGt1Fa9enKbOpY2iIyVtaHNeNvAK8ERP/64sqGQ=="],
 
-    "@tailwindcss/oxide-win32-x64-msvc": ["@tailwindcss/oxide-win32-x64-msvc@4.2.2", "", { "os": "win32", "cpu": "x64" }, "sha512-1T/37VvI7WyH66b+vqHj/cLwnCxt7Qt3WFu5Q8hk65aOvlwAhs7rAp1VkulBJw/N4tMirXjVnylTR72uI0HGcA=="],
+    "@tailwindcss/oxide-win32-x64-msvc": ["@tailwindcss/oxide-win32-x64-msvc@4.2.4", "", { "os": "win32", "cpu": "x64" }, "sha512-ESlKG0EpVJQwRjXDDa9rLvhEAh0mhP1sF7sap9dNZT0yyl9SAG6T7gdP09EH0vIv0UNTlo6jPWyujD6559fZvw=="],
 
-    "@tailwindcss/vite": ["@tailwindcss/vite@4.2.2", "", { "dependencies": { "@tailwindcss/node": "4.2.2", "@tailwindcss/oxide": "4.2.2", "tailwindcss": "4.2.2" }, "peerDependencies": { "vite": "^5.2.0 || ^6 || ^7 || ^8" } }, "sha512-mEiF5HO1QqCLXoNEfXVA1Tzo+cYsrqV7w9Juj2wdUFyW07JRenqMG225MvPwr3ZD9N1bFQj46X7r33iHxLUW0w=="],
+    "@tailwindcss/vite": ["@tailwindcss/vite@4.2.4", "", { "dependencies": { "@tailwindcss/node": "4.2.4", "@tailwindcss/oxide": "4.2.4", "tailwindcss": "4.2.4" }, "peerDependencies": { "vite": "^5.2.0 || ^6 || ^7 || ^8" } }, "sha512-pCvohwOCspk3ZFn6eJzrrX3g4n2JY73H6MmYC87XfGPyTty4YsCjYTMArRZm/zOI8dIt3+EcrLHAFPe5A4bgtw=="],
 
-    "@tanstack/devtools": ["@tanstack/devtools@0.11.0", "", { "dependencies": { "@solid-primitives/event-listener": "^2.4.3", "@solid-primitives/keyboard": "^1.3.3", "@solid-primitives/resize-observer": "^2.1.3", "@tanstack/devtools-client": "0.0.6", "@tanstack/devtools-event-bus": "0.4.1", "@tanstack/devtools-ui": "0.5.1", "clsx": "^2.1.1", "goober": "^2.1.16", "solid-js": "^1.9.9" }, "bin": { "intent": "bin/intent.js" } }, "sha512-ARRAnEm0HYjKlB2adC9YyDG3fbq5LVjpxPe6Jz583SanXRM1aKrZIGHIA//oRldX3mWIpM4kB6mCyd+CXCLqhA=="],
+    "@tanstack/devtools": ["@tanstack/devtools@0.11.2", "", { "dependencies": { "@solid-primitives/event-listener": "^2.4.3", "@solid-primitives/keyboard": "^1.3.3", "@solid-primitives/resize-observer": "^2.1.3", "@tanstack/devtools-client": "0.0.6", "@tanstack/devtools-event-bus": "0.4.1", "@tanstack/devtools-ui": "0.5.1", "clsx": "^2.1.1", "goober": "^2.1.16", "solid-js": "^1.9.9" }, "bin": { "intent": "bin/intent.js" } }, "sha512-K8+tsBx+ptTLqqd4dOF10B6laj1g+XYImqYZL9n0jBINGaT+sOf17PKV9pbBt8kdbZeIGsHaJ5OZWCyZoHqN4A=="],
 
     "@tanstack/devtools-client": ["@tanstack/devtools-client@0.0.6", "", { "dependencies": { "@tanstack/devtools-event-client": "^0.4.1" } }, "sha512-f85ZJXJnDIFOoykG/BFIixuAevJovCvJF391LPs6YjBAPhGYC50NWlx1y4iF/UmK5/cCMx+/JqI5SBOz7FanQQ=="],
 
@@ -679,41 +685,43 @@
 
     "@tanstack/history": ["@tanstack/history@1.161.6", "", {}, "sha512-NaOGLRrddszbQj9upGat6HG/4TKvXLvu+osAIgfxPYA+eIvYKv8GKDJOrY2D3/U9MRnKfMWD7bU4jeD4xmqyIg=="],
 
-    "@tanstack/react-devtools": ["@tanstack/react-devtools@0.10.0", "", { "dependencies": { "@tanstack/devtools": "0.11.0" }, "peerDependencies": { "@types/react": ">=16.8", "@types/react-dom": ">=16.8", "react": ">=16.8", "react-dom": ">=16.8" } }, "sha512-cUMzOQb1IHmkb8MsD0TrxHT8EL92Rx3G0Huq+IFkWeoaZPGlIiaIcGTpS5VvQDeI4BVUT+ZGt6CQTpx8oSTECg=="],
+    "@tanstack/react-devtools": ["@tanstack/react-devtools@0.10.2", "", { "dependencies": { "@tanstack/devtools": "0.11.2" }, "peerDependencies": { "@types/react": ">=16.8", "@types/react-dom": ">=16.8", "react": ">=16.8", "react-dom": ">=16.8" } }, "sha512-1BmZyxOrI5SqmRJ5MgkYZNNdnlLsJxQRI2YgorrAvcF2MxK6x5RcuStvD8+YlXoMw3JtNukPxoITirKAnKYDQA=="],
 
-    "@tanstack/react-router": ["@tanstack/react-router@1.168.1", "", { "dependencies": { "@tanstack/history": "1.161.6", "@tanstack/react-store": "^0.9.2", "@tanstack/router-core": "1.168.1", "isbot": "^5.1.22", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-DsQzbfwcr2Xugqs4G8yShUO9hVQ/tbWhIiLNJSxmZZOgaZCB3JP+ngN1EJBYZz+JBQdvyVHfiEsPXy0P1h3yVA=="],
+    "@tanstack/react-router": ["@tanstack/react-router@1.168.26", "", { "dependencies": { "@tanstack/history": "1.161.6", "@tanstack/react-store": "^0.9.3", "@tanstack/router-core": "1.168.18", "isbot": "^5.1.22" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-+MV+U5KfMUQGZIU/x8MU3FMRSujxLs678v2jhu1Y8P9ndQBKLVOBYKFY+vv/ypxBUYiyDiOsZkDxPJC8UPo/Ig=="],
 
-    "@tanstack/react-router-devtools": ["@tanstack/react-router-devtools@1.166.10", "", { "dependencies": { "@tanstack/router-devtools-core": "1.167.0" }, "peerDependencies": { "@tanstack/react-router": "^1.168.0", "@tanstack/router-core": "^1.168.0", "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" }, "optionalPeers": ["@tanstack/router-core"] }, "sha512-+C4doh9D+ag8yA4WjR3Og4RGvuwvwwqN0j67Pg+Hu1I1ebZAKowtUREH8iT4acUxgtH6hzt8pAuzMVskdLc4SQ=="],
+    "@tanstack/react-router-devtools": ["@tanstack/react-router-devtools@1.166.13", "", { "dependencies": { "@tanstack/router-devtools-core": "1.167.3" }, "peerDependencies": { "@tanstack/react-router": "^1.168.15", "@tanstack/router-core": "^1.168.11", "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" }, "optionalPeers": ["@tanstack/router-core"] }, "sha512-6yKRFFJrEEOiGp5RAAuGCYsl81M4XAhJmLcu9PKj+HZle4A3dsP60lwHoqQYWHMK9nKKFkdXR+D8qxzxqtQbEA=="],
 
-    "@tanstack/react-start": ["@tanstack/react-start@1.167.2", "", { "dependencies": { "@tanstack/react-router": "1.168.1", "@tanstack/react-start-client": "1.166.16", "@tanstack/react-start-server": "1.166.16", "@tanstack/router-utils": "^1.161.6", "@tanstack/start-client-core": "1.167.1", "@tanstack/start-plugin-core": "1.167.5", "@tanstack/start-server-core": "1.167.1", "pathe": "^2.0.3" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0", "vite": ">=7.0.0" }, "bin": { "intent": "bin/intent.js" } }, "sha512-7jOKpfKEmKq7eJVqJWoyP6UuT5ci/t/ppVD0bjCC405WemQHT9Sp7A5DOV2Qjkne9BSVkx2Eyvu3X5JAkjBq9g=="],
+    "@tanstack/react-start": ["@tanstack/react-start@1.167.52", "", { "dependencies": { "@tanstack/react-router": "1.168.26", "@tanstack/react-start-client": "1.166.44", "@tanstack/react-start-rsc": "0.0.31", "@tanstack/react-start-server": "1.166.45", "@tanstack/router-utils": "1.161.7", "@tanstack/start-client-core": "1.167.21", "@tanstack/start-plugin-core": "1.169.7", "@tanstack/start-server-core": "1.167.23", "pathe": "^2.0.3" }, "peerDependencies": { "@rsbuild/core": "^2.0.0", "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0", "vite": ">=7.0.0" }, "optionalPeers": ["@rsbuild/core", "vite"], "bin": { "intent": "bin/intent.js" } }, "sha512-MQk/kmhI7ONoUo8U/MAXniwKLp+y4qiaCOHzPVK4QA1HiQm1C5X0P3QGK/wSBpzTgCBRG3lcCZbJyt3iM9OZ0w=="],
 
-    "@tanstack/react-start-client": ["@tanstack/react-start-client@1.166.16", "", { "dependencies": { "@tanstack/react-router": "1.168.1", "@tanstack/router-core": "1.168.1", "@tanstack/start-client-core": "1.167.1", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-ZcNog3CfXpEsWenWk3sOf2qWr/+50/izGp+1Y0lJgSFdvIo26TRs8X44zT6yucXiYWM5FtyLsB7kbhOcfvK1eA=="],
+    "@tanstack/react-start-client": ["@tanstack/react-start-client@1.166.44", "", { "dependencies": { "@tanstack/react-router": "1.168.26", "@tanstack/router-core": "1.168.18", "@tanstack/start-client-core": "1.167.21" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-ZZeELCY5KKUccjD9Dlz1BAT9Bjorz+m8gAI1GLAmSrAXskLsu03kTaeiMc5ZV7lcuiynLSMwa+/dM2LHk/Roiw=="],
 
-    "@tanstack/react-start-server": ["@tanstack/react-start-server@1.166.16", "", { "dependencies": { "@tanstack/history": "1.161.6", "@tanstack/react-router": "1.168.1", "@tanstack/router-core": "1.168.1", "@tanstack/start-client-core": "1.167.1", "@tanstack/start-server-core": "1.167.1" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-YEuM5XSxNQhLr30e6uyep7m5yZHtZwCeEeQVyo7CSWKmUpkBtN60+bg4T2/nLY0MXrwo6DTK1Crsu80ZZLkPAA=="],
+    "@tanstack/react-start-rsc": ["@tanstack/react-start-rsc@0.0.31", "", { "dependencies": { "@tanstack/react-router": "1.168.26", "@tanstack/react-start-server": "1.166.45", "@tanstack/router-core": "1.168.18", "@tanstack/router-utils": "1.161.7", "@tanstack/start-client-core": "1.167.21", "@tanstack/start-fn-stubs": "1.161.6", "@tanstack/start-plugin-core": "1.169.7", "@tanstack/start-server-core": "1.167.23", "@tanstack/start-storage-context": "1.166.32", "pathe": "^2.0.3" }, "peerDependencies": { "@rspack/core": ">=2.0.0-0", "@vitejs/plugin-rsc": ">=0.5.20", "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0", "react-server-dom-rspack": ">=0.0.2" }, "optionalPeers": ["@rspack/core", "@vitejs/plugin-rsc", "react-server-dom-rspack"] }, "sha512-s4t/m/XULuYYljSwBPozNmOwMuLI06kwLnwpipxy9xxT0iLo0ELUSmYhCegqSjLI2yNoBgCPj7NaEbrE7LmnlA=="],
+
+    "@tanstack/react-start-server": ["@tanstack/react-start-server@1.166.45", "", { "dependencies": { "@tanstack/history": "1.161.6", "@tanstack/react-router": "1.168.26", "@tanstack/router-core": "1.168.18", "@tanstack/start-client-core": "1.167.21", "@tanstack/start-server-core": "1.167.23" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-usmRCOOmtHZMbWBBV6QDq28ULPe9jMo3uNYrqVVY35D6WLB8FO/et1Ck5ySaenQOjOI2wHowX4al0KY3sIhtDQ=="],
 
     "@tanstack/react-store": ["@tanstack/react-store@0.9.3", "", { "dependencies": { "@tanstack/store": "0.9.3", "use-sync-external-store": "^1.6.0" }, "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-y2iHd/N9OkoQbFJLUX1T9vbc2O9tjH0pQRgTcx1/Nz4IlwLvkgpuglXUx+mXt0g5ZDFrEeDnONPqkbfxXJKwRg=="],
 
     "@tanstack/react-table": ["@tanstack/react-table@8.21.3", "", { "dependencies": { "@tanstack/table-core": "8.21.3" }, "peerDependencies": { "react": ">=16.8", "react-dom": ">=16.8" } }, "sha512-5nNMTSETP4ykGegmVkhjcS8tTLW6Vl4axfEGQN3v0zdHYbK4UfoqfPChclTrJ4EoK9QynqAu9oUf8VEmrpZ5Ww=="],
 
-    "@tanstack/router-core": ["@tanstack/router-core@1.168.1", "", { "dependencies": { "@tanstack/history": "1.161.6", "cookie-es": "^2.0.0", "seroval": "^1.4.2", "seroval-plugins": "^1.4.2", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" }, "bin": { "intent": "bin/intent.js" } }, "sha512-RtpshTLZsMOkwW7rI52WFWGZSSfMAyDR1zWP9kVm91UX28gedc+LXih1CTP6TchS+TvxK4q8oW7ApMTvnpiY1w=="],
+    "@tanstack/router-core": ["@tanstack/router-core@1.168.18", "", { "dependencies": { "@tanstack/history": "1.161.6", "cookie-es": "^3.0.0", "seroval": "^1.5.0", "seroval-plugins": "^1.5.0" }, "bin": { "intent": "bin/intent.js" } }, "sha512-rheeg/+hIHSVw9IDzcc5NJlKamKtKJN/c8rPG9XEmLwHvA4C1WRN/yjMTGgoGNU0xKKjL2AzvUhYMSaBdelbEA=="],
 
-    "@tanstack/router-devtools-core": ["@tanstack/router-devtools-core@1.167.0", "", { "dependencies": { "clsx": "^2.1.1", "goober": "^2.1.16", "tiny-invariant": "^1.3.3" }, "peerDependencies": { "@tanstack/router-core": "^1.168.0", "csstype": "^3.0.10" }, "optionalPeers": ["csstype"] }, "sha512-icgcpE7CQqOzZs4hbFfmICvwk4k7R8ErhUUuUHIKbAYioowQWKm1F3oJhkv6CtoTiofzplUrv9Jy8KE+U/sTKA=="],
+    "@tanstack/router-devtools-core": ["@tanstack/router-devtools-core@1.167.3", "", { "dependencies": { "clsx": "^2.1.1", "goober": "^2.1.16" }, "peerDependencies": { "@tanstack/router-core": "^1.168.11", "csstype": "^3.0.10" }, "optionalPeers": ["csstype"] }, "sha512-fJ1VMhyQgnoashTrP763c2HRc9kofgF61L7Jb3F6eTHAmCKtGVx8BRtiFt37sr3U0P0jmaaiiSPGP6nT5JtVNg=="],
 
-    "@tanstack/router-generator": ["@tanstack/router-generator@1.166.15", "", { "dependencies": { "@tanstack/router-core": "1.168.1", "@tanstack/router-utils": "1.161.6", "@tanstack/virtual-file-routes": "1.161.7", "prettier": "^3.5.0", "recast": "^0.23.11", "source-map": "^0.7.4", "tsx": "^4.19.2", "zod": "^3.24.2" } }, "sha512-W8ybCktgN/45fc7ohWJKAyG5Al1pnTg7V8Z6RiG8NkSrN7Igo4BqanUmXULnhnkdCID5XhMbkhP84r2hzkXbPw=="],
+    "@tanstack/router-generator": ["@tanstack/router-generator@1.166.37", "", { "dependencies": { "@babel/types": "^7.28.5", "@tanstack/router-core": "1.168.18", "@tanstack/router-utils": "1.161.7", "@tanstack/virtual-file-routes": "1.161.7", "jiti": "^2.6.1", "magic-string": "^0.30.21", "prettier": "^3.5.0", "zod": "^3.24.2" } }, "sha512-uj5t0IzKzvwzySiTSrF2JLdxs5xwo3dbKJ3/BpLrJyrUC978VAupNP0kQlvps8VMKrGk9x9s1ogpO5qNu29Qpw=="],
 
-    "@tanstack/router-plugin": ["@tanstack/router-plugin@1.167.2", "", { "dependencies": { "@babel/core": "^7.28.5", "@babel/plugin-syntax-jsx": "^7.27.1", "@babel/plugin-syntax-typescript": "^7.27.1", "@babel/template": "^7.27.2", "@babel/traverse": "^7.28.5", "@babel/types": "^7.28.5", "@tanstack/router-core": "1.168.1", "@tanstack/router-generator": "1.166.15", "@tanstack/router-utils": "1.161.6", "@tanstack/virtual-file-routes": "1.161.7", "chokidar": "^3.6.0", "unplugin": "^2.1.2", "zod": "^3.24.2" }, "peerDependencies": { "@rsbuild/core": ">=1.0.2", "@tanstack/react-router": "^1.168.1", "vite": ">=5.0.0 || >=6.0.0 || >=7.0.0", "vite-plugin-solid": "^2.11.10", "webpack": ">=5.92.0" }, "optionalPeers": ["@rsbuild/core", "@tanstack/react-router", "vite", "vite-plugin-solid", "webpack"], "bin": { "intent": "bin/intent.js" } }, "sha512-33KSngqHzFTMFz7rPIIeroVi0x+GzbCOch1goEdH71s1MbdyNhCTPuzKFO3QOkT+aqirCXkCgSgHVoU//Zletw=="],
+    "@tanstack/router-plugin": ["@tanstack/router-plugin@1.167.29", "", { "dependencies": { "@babel/core": "^7.28.5", "@babel/plugin-syntax-jsx": "^7.27.1", "@babel/plugin-syntax-typescript": "^7.27.1", "@babel/template": "^7.27.2", "@babel/traverse": "^7.28.5", "@babel/types": "^7.28.5", "@tanstack/router-core": "1.168.18", "@tanstack/router-generator": "1.166.37", "@tanstack/router-utils": "1.161.7", "@tanstack/virtual-file-routes": "1.161.7", "chokidar": "^3.6.0", "unplugin": "^3.0.0", "zod": "^3.24.2" }, "peerDependencies": { "@rsbuild/core": ">=1.0.2 || ^2.0.0", "@tanstack/react-router": "^1.168.26", "vite": ">=5.0.0 || >=6.0.0 || >=7.0.0 || >=8.0.0", "vite-plugin-solid": "^2.11.10 || ^3.0.0-0", "webpack": ">=5.92.0" }, "optionalPeers": ["@rsbuild/core", "@tanstack/react-router", "vite", "vite-plugin-solid", "webpack"], "bin": { "intent": "bin/intent.js" } }, "sha512-Rl5TWqXgn1dbs82IqpswP63WTODdYAmQ4kU/mulNzmCsgMKSer3bjKPFrE1g2dnxBxfoF6iwfDGdAwdreK4mvA=="],
 
-    "@tanstack/router-utils": ["@tanstack/router-utils@1.161.6", "", { "dependencies": { "@babel/core": "^7.28.5", "@babel/generator": "^7.28.5", "@babel/parser": "^7.28.5", "@babel/types": "^7.28.5", "ansis": "^4.1.0", "babel-dead-code-elimination": "^1.0.12", "diff": "^8.0.2", "pathe": "^2.0.3", "tinyglobby": "^0.2.15" } }, "sha512-nRcYw+w2OEgK6VfjirYvGyPLOK+tZQz1jkYcmH5AjMamQ9PycnlxZF2aEZtPpNoUsaceX2bHptn6Ub5hGXqNvw=="],
+    "@tanstack/router-utils": ["@tanstack/router-utils@1.161.7", "", { "dependencies": { "@babel/core": "^7.28.5", "@babel/generator": "^7.28.5", "@babel/parser": "^7.28.5", "@babel/types": "^7.28.5", "ansis": "^4.1.0", "babel-dead-code-elimination": "^1.0.12", "diff": "^8.0.2", "pathe": "^2.0.3", "tinyglobby": "^0.2.15" } }, "sha512-VkY0u7ax/GD0qU6ZLLnfPC+UMxVzxRbvZp4yV4iUSXjgJZ/siAT5/QlLm9FEDJ9QDoC0VD9W7f00tKKreUI7Ng=="],
 
-    "@tanstack/start-client-core": ["@tanstack/start-client-core@1.167.1", "", { "dependencies": { "@tanstack/router-core": "1.168.1", "@tanstack/start-fn-stubs": "1.161.6", "@tanstack/start-storage-context": "1.166.15", "seroval": "^1.4.2", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" }, "bin": { "intent": "bin/intent.js" } }, "sha512-6oVxTwGoXo+Gcs5aDuzJQIdXCBfvvfIbv9tl4z8pH+bRCRM8CzKXqb4JBt8i7G8G7fAJQCOcoldpbVv3JsWGwA=="],
+    "@tanstack/start-client-core": ["@tanstack/start-client-core@1.167.21", "", { "dependencies": { "@tanstack/router-core": "1.168.18", "@tanstack/start-fn-stubs": "1.161.6", "@tanstack/start-storage-context": "1.166.32", "seroval": "^1.5.0" }, "bin": { "intent": "bin/intent.js" } }, "sha512-NZtE6Dmd3luHQBdOolzgD9kzi0bzVWbXmlNVHZT+iHZ/DP+ZLTj/xd0Cnnc0kf8X1hjwqJsNTbbr3yM9pRIjlQ=="],
 
     "@tanstack/start-fn-stubs": ["@tanstack/start-fn-stubs@1.161.6", "", {}, "sha512-Y6QSlGiLga8cHfvxGGaonXIlt2bIUTVdH6AMjmpMp7+ANNCp+N96GQbjjhLye3JkaxDfP68x5iZA8NK4imgRig=="],
 
-    "@tanstack/start-plugin-core": ["@tanstack/start-plugin-core@1.167.5", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.28.5", "@babel/types": "^7.28.5", "@rolldown/pluginutils": "1.0.0-beta.40", "@tanstack/router-core": "1.168.1", "@tanstack/router-generator": "1.166.15", "@tanstack/router-plugin": "1.167.2", "@tanstack/router-utils": "1.161.6", "@tanstack/start-client-core": "1.167.1", "@tanstack/start-server-core": "1.167.1", "cheerio": "^1.0.0", "exsolve": "^1.0.7", "pathe": "^2.0.3", "picomatch": "^4.0.3", "source-map": "^0.7.6", "srvx": "^0.11.9", "tinyglobby": "^0.2.15", "ufo": "^1.5.4", "vitefu": "^1.1.1", "xmlbuilder2": "^4.0.3", "zod": "^3.24.2" }, "peerDependencies": { "vite": ">=7.0.0" } }, "sha512-HmKXIuCyx/YoHuCpY9EBffHk1JLEE2oLGr7saQ8bwFCzeLaQ1z6ch440JHFVD9YcQmvUsch9eUX0a8QEpLWDdw=="],
+    "@tanstack/start-plugin-core": ["@tanstack/start-plugin-core@1.169.7", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.28.5", "@babel/types": "^7.28.5", "@rolldown/pluginutils": "1.0.0-beta.40", "@tanstack/router-core": "1.168.18", "@tanstack/router-generator": "1.166.37", "@tanstack/router-plugin": "1.167.29", "@tanstack/router-utils": "1.161.7", "@tanstack/start-client-core": "1.167.21", "@tanstack/start-server-core": "1.167.23", "cheerio": "^1.0.0", "exsolve": "^1.0.7", "lightningcss": "^1.32.0", "pathe": "^2.0.3", "picomatch": "^4.0.3", "seroval": "^1.5.0", "source-map": "^0.7.6", "srvx": "^0.11.9", "tinyglobby": "^0.2.15", "ufo": "^1.5.4", "vitefu": "^1.1.1", "xmlbuilder2": "^4.0.3", "zod": "^3.24.2" }, "peerDependencies": { "@rsbuild/core": "^2.0.0", "vite": ">=7.0.0" }, "optionalPeers": ["@rsbuild/core", "vite"] }, "sha512-VNEJz8nCMeLPoa8MaDVGqC54FHldxh6vDQ2uXxMzdBFsOkV75cidLutcp76F4pVjKsJHchX6r5+OJOAu5X/dsQ=="],
 
-    "@tanstack/start-server-core": ["@tanstack/start-server-core@1.167.1", "", { "dependencies": { "@tanstack/history": "1.161.6", "@tanstack/router-core": "1.168.1", "@tanstack/start-client-core": "1.167.1", "@tanstack/start-storage-context": "1.166.15", "h3-v2": "npm:h3@2.0.1-rc.16", "seroval": "^1.4.2", "tiny-invariant": "^1.3.3" }, "bin": { "intent": "bin/intent.js" } }, "sha512-Cwl3Z2qJQi2+V6tkmQ3YHLkj7g+QjIsDVgsYRpJPL93hxb4bb3sOQggz9PaGMxUyzkiFyeRNO8R/3AgW7mr5ig=="],
+    "@tanstack/start-server-core": ["@tanstack/start-server-core@1.167.23", "", { "dependencies": { "@tanstack/history": "1.161.6", "@tanstack/router-core": "1.168.18", "@tanstack/start-client-core": "1.167.21", "@tanstack/start-storage-context": "1.166.32", "h3-v2": "npm:h3@2.0.1-rc.20", "seroval": "^1.5.0" }, "bin": { "intent": "bin/intent.js" } }, "sha512-ngOTJ52o4QfNXpAAey+44VPZLwXXVZ/XnVv45pYiypjST3kMAmYEP9r15N2ygZG5Hw5fVpqrv6zaIx1UPQodFw=="],
 
-    "@tanstack/start-storage-context": ["@tanstack/start-storage-context@1.166.15", "", { "dependencies": { "@tanstack/router-core": "1.168.1" } }, "sha512-mGDNfJo/eFtwgFFBrJ85rNdIBNTroE3zy5zbwHZ/FV0HPYOawnev7KscDjKBuVxBGY2jl0fQLrRNUO/Sjqy3cg=="],
+    "@tanstack/start-storage-context": ["@tanstack/start-storage-context@1.166.32", "", { "dependencies": { "@tanstack/router-core": "1.168.18" } }, "sha512-eId04y3x5ebliUxyR1bkUyq2p68vdNOVE0BS9aJDmdShS8PTpSZac02QUjOqZ89BmxxWyKEvST8zZBwixfRAWQ=="],
 
     "@tanstack/store": ["@tanstack/store@0.9.3", "", {}, "sha512-8reSzl/qGWGGVKhBoxXPMWzATSbZLZFWhwBAFO9NAyp0TxzfBP0mIrGb8CP8KrQTmvzXlR/vFPPUrHTLBGyFyw=="],
 
@@ -763,23 +771,21 @@
 
     "@vitejs/plugin-react": ["@vitejs/plugin-react@6.0.1", "", { "dependencies": { "@rolldown/pluginutils": "1.0.0-rc.7" }, "peerDependencies": { "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0", "babel-plugin-react-compiler": "^1.0.0", "vite": "^8.0.0" }, "optionalPeers": ["@rolldown/plugin-babel", "babel-plugin-react-compiler"] }, "sha512-l9X/E3cDb+xY3SWzlG1MOGt2usfEHGMNIaegaUGFsLkb3RCn/k8/TOXBcab+OndDI4TBtktT8/9BwwW8Vi9KUQ=="],
 
-    "@vitest/coverage-v8": ["@vitest/coverage-v8@4.1.4", "", { "dependencies": { "@bcoe/v8-coverage": "^1.0.2", "@vitest/utils": "4.1.4", "ast-v8-to-istanbul": "^1.0.0", "istanbul-lib-coverage": "^3.2.2", "istanbul-lib-report": "^3.0.1", "istanbul-reports": "^3.2.0", "magicast": "^0.5.2", "obug": "^2.1.1", "std-env": "^4.0.0-rc.1", "tinyrainbow": "^3.1.0" }, "peerDependencies": { "@vitest/browser": "4.1.4", "vitest": "4.1.4" }, "optionalPeers": ["@vitest/browser"] }, "sha512-x7FptB5oDruxNPDNY2+S8tCh0pcq7ymCe1gTHcsp733jYjrJl8V1gMUlVysuCD9Kz46Xz9t1akkv08dPcYDs1w=="],
+    "@vitest/coverage-v8": ["@vitest/coverage-v8@4.1.5", "", { "dependencies": { "@bcoe/v8-coverage": "^1.0.2", "@vitest/utils": "4.1.5", "ast-v8-to-istanbul": "^1.0.0", "istanbul-lib-coverage": "^3.2.2", "istanbul-lib-report": "^3.0.1", "istanbul-reports": "^3.2.0", "magicast": "^0.5.2", "obug": "^2.1.1", "std-env": "^4.0.0-rc.1", "tinyrainbow": "^3.1.0" }, "peerDependencies": { "@vitest/browser": "4.1.5", "vitest": "4.1.5" }, "optionalPeers": ["@vitest/browser"] }, "sha512-38C0/Ddb7HcRG0Z4/DUem8x57d2p9jYgp18mkaYswEOQBGsI1CG4f/hjm0ZCeaJfWhSZ4k7jgs29V1Zom7Ki9A=="],
 
-    "@vitest/expect": ["@vitest/expect@4.1.4", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.4", "@vitest/utils": "4.1.4", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-iPBpra+VDuXmBFI3FMKHSFXp3Gx5HfmSCE8X67Dn+bwephCnQCaB7qWK2ldHa+8ncN8hJU8VTMcxjPpyMkUjww=="],
+    "@vitest/expect": ["@vitest/expect@4.1.5", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.5", "@vitest/utils": "4.1.5", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-PWBaRY5JoKuRnHlUHfpV/KohFylaDZTupcXN1H9vYryNLOnitSw60Mw9IAE2r67NbwwzBw/Cc/8q9BK3kIX8Kw=="],
 
-    "@vitest/mocker": ["@vitest/mocker@4.1.4", "", { "dependencies": { "@vitest/spy": "4.1.4", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["msw", "vite"] }, "sha512-R9HTZBhW6yCSGbGQnDnH3QHfJxokKN4KB+Yvk9Q1le7eQNYwiCyKxmLmurSpFy6BzJanSLuEUDrD+j97Q+ZLPg=="],
+    "@vitest/mocker": ["@vitest/mocker@4.1.5", "", { "dependencies": { "@vitest/spy": "4.1.5", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["msw", "vite"] }, "sha512-/x2EmFC4mT4NNzqvC3fmesuV97w5FC903KPmey4gsnJiMQ3Be1IlDKVaDaG8iqaLFHqJ2FVEkxZk5VmeLjIItw=="],
 
-    "@vitest/pretty-format": ["@vitest/pretty-format@4.1.4", "", { "dependencies": { "tinyrainbow": "^3.1.0" } }, "sha512-ddmDHU0gjEUyEVLxtZa7xamrpIefdEETu3nZjWtHeZX4QxqJ7tRxSteHVXJOcr8jhiLoGAhkK4WJ3WqBpjx42A=="],
+    "@vitest/pretty-format": ["@vitest/pretty-format@4.1.5", "", { "dependencies": { "tinyrainbow": "^3.1.0" } }, "sha512-7I3q6l5qr03dVfMX2wCo9FxwSJbPdwKjy2uu/YPpU3wfHvIL4QHwVRp57OfGrDFeUJ8/8QdfBKIV12FTtLn00g=="],
 
-    "@vitest/runner": ["@vitest/runner@4.1.4", "", { "dependencies": { "@vitest/utils": "4.1.4", "pathe": "^2.0.3" } }, "sha512-xTp7VZ5aXP5ZJrn15UtJUWlx6qXLnGtF6jNxHepdPHpMfz/aVPx+htHtgcAL2mDXJgKhpoo2e9/hVJsIeFbytQ=="],
+    "@vitest/runner": ["@vitest/runner@4.1.5", "", { "dependencies": { "@vitest/utils": "4.1.5", "pathe": "^2.0.3" } }, "sha512-2D+o7Pr82IEO46YPpoA/YU0neeyr6FTerQb5Ro7BUnBuv6NQtT/kmVnczngiMEBhzgqz2UZYl5gArejsyERDSQ=="],
 
-    "@vitest/snapshot": ["@vitest/snapshot@4.1.4", "", { "dependencies": { "@vitest/pretty-format": "4.1.4", "@vitest/utils": "4.1.4", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-MCjCFgaS8aZz+m5nTcEcgk/xhWv0rEH4Yl53PPlMXOZ1/Ka2VcZU6CJ+MgYCZbcJvzGhQRjVrGQNZqkGPttIKw=="],
+    "@vitest/snapshot": ["@vitest/snapshot@4.1.5", "", { "dependencies": { "@vitest/pretty-format": "4.1.5", "@vitest/utils": "4.1.5", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-zypXEt4KH/XgKGPUz4eC2AvErYx0My5hfL8oDb1HzGFpEk1P62bxSohdyOmvz+d9UJwanI68MKwr2EquOaOgMQ=="],
 
-    "@vitest/spy": ["@vitest/spy@4.1.4", "", {}, "sha512-XxNdAsKW7C+FLydqFJLb5KhJtl3PGCMmYwFRfhvIgxJvLSXhhVI1zM8f1qD3Zg7RCjTSzDVyct6sghs9UEgBEQ=="],
+    "@vitest/spy": ["@vitest/spy@4.1.5", "", {}, "sha512-2lNOsh6+R2Idnf1TCZqSwYlKN2E/iDlD8sgU59kYVl+OMDmvldO1VDk39smRfpUNwYpNRVn3w4YfuC7KfbBnkQ=="],
 
-    "@vitest/utils": ["@vitest/utils@4.1.4", "", { "dependencies": { "@vitest/pretty-format": "4.1.4", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.1.0" } }, "sha512-13QMT+eysM5uVGa1rG4kegGYNp6cnQcsTc67ELFbhNLQO+vgsygtYJx2khvdt4gVQqSSpC/KT5FZZxUpP3Oatw=="],
-
-    "acorn": ["acorn@8.16.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw=="],
+    "@vitest/utils": ["@vitest/utils@4.1.5", "", { "dependencies": { "@vitest/pretty-format": "4.1.5", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.1.0" } }, "sha512-76wdkrmfXfqGjueGgnb45ITPyUi1ycZ4IHgC2bhPDUfWHklY/q3MdLOAB+TF1e6xfl8NxNY0ZYaPCFNWSsw3Ug=="],
 
     "ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
 
@@ -801,8 +807,6 @@
 
     "assertion-error": ["assertion-error@2.0.1", "", {}, "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA=="],
 
-    "ast-types": ["ast-types@0.16.1", "", { "dependencies": { "tslib": "^2.0.1" } }, "sha512-6t10qk83GOG8p0vKmaCr8eiilZwO171AvbROMtvvNiwrTly62t+7XkA8RdIIVbpMhCASAsxgAzdRSwh6nw/5Dg=="],
-
     "ast-v8-to-istanbul": ["ast-v8-to-istanbul@1.0.0", "", { "dependencies": { "@jridgewell/trace-mapping": "^0.3.31", "estree-walker": "^3.0.3", "js-tokens": "^10.0.0" } }, "sha512-1fSfIwuDICFA4LKkCzRPO7F0hzFf0B7+Xqrl27ynQaa+Rh0e1Es0v6kWHPott3lU10AyAr7oKHa65OppjLn3Rg=="],
 
     "babel-dead-code-elimination": ["babel-dead-code-elimination@1.0.12", "", { "dependencies": { "@babel/core": "^7.23.7", "@babel/parser": "^7.23.6", "@babel/traverse": "^7.23.7", "@babel/types": "^7.23.6" } }, "sha512-GERT7L2TiYcYDtYk1IpD+ASAYXjKbLTDPhBtYj7X1NuRMDTMtAx9kyBenub1Ev41lo91OHCKdmP+egTDmfQ7Ig=="],
@@ -867,13 +871,13 @@
 
     "convert-source-map": ["convert-source-map@2.0.0", "", {}, "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg=="],
 
-    "convex": ["convex@1.35.1", "", { "dependencies": { "esbuild": "0.27.0", "prettier": "^3.0.0", "ws": "8.18.0" }, "peerDependencies": { "@auth0/auth0-react": "^2.0.1", "@clerk/clerk-react": "^4.12.8 || ^5.0.0", "@clerk/react": "^6.0.0", "react": "^18.0.0 || ^19.0.0-0 || ^19.0.0" }, "optionalPeers": ["@auth0/auth0-react", "@clerk/clerk-react", "@clerk/react", "react"], "bin": { "convex": "bin/main.js" } }, "sha512-g23KrTjBiXqRHzWIN0PVFagKjrmFxWUaOSiBsAWPTpXX2rXl0L1F4PR0YpAcMJEzMgfZR9AGymJvLTM+KA6lsQ=="],
+    "convex": ["convex@1.36.1", "", { "dependencies": { "esbuild": "0.27.0", "prettier": "^3.0.0", "ws": "8.18.0" }, "peerDependencies": { "@auth0/auth0-react": "^2.0.1", "@clerk/clerk-react": "^4.12.8 || ^5.0.0", "@clerk/react": "^6.4.3", "react": "^18.0.0 || ^19.0.0-0 || ^19.0.0" }, "optionalPeers": ["@auth0/auth0-react", "@clerk/clerk-react", "@clerk/react", "react"], "bin": { "convex": "bin/main.js" } }, "sha512-NVnwNqU+h8jyPuS0Itvj4MPH9c2yF+tA/RNoSDpCqiLhmYD4+kZxm0dDkVM0QDzz66wem9NqheBb9YQGsHwzBQ=="],
 
-    "convex-helpers": ["convex-helpers@0.1.114", "", { "peerDependencies": { "@standard-schema/spec": "^1.0.0", "convex": "^1.32.0", "hono": "^4.0.5", "react": "^17.0.2 || ^18.0.0 || ^19.0.0", "typescript": "^5.5", "zod": "^3.25.0 || ^4.0.0" }, "optionalPeers": ["@standard-schema/spec", "hono", "react", "typescript", "zod"], "bin": { "convex-helpers": "bin.cjs" } }, "sha512-elEdh+gG6BDv2dWIWVvBeJPbHnDQS5+WexUuwlGVJXz1EbMkXz/UIQwFIfLMZIXUwW6ot4JYf/1JJKNStrE6lg=="],
+    "convex-helpers": ["convex-helpers@0.1.115", "", { "peerDependencies": { "@standard-schema/spec": "^1.0.0", "convex": "^1.32.0", "hono": "^4.0.5", "react": "^17.0.2 || ^18.0.0 || ^19.0.0", "typescript": "^5.5 || ^6.0.0", "zod": "^3.25.0 || ^4.0.0" }, "optionalPeers": ["@standard-schema/spec", "hono", "react", "typescript", "zod"], "bin": { "convex-helpers": "bin.cjs" } }, "sha512-f9gyJO+hzNBfSNV9moW7HaLY6bWFpOQR6EAXtD9yPbuPX8xGm0H1dtce1GjdVHhZgUam/svmutpbZssJ1z3t1A=="],
 
     "cookie": ["cookie@1.1.1", "", {}, "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ=="],
 
-    "cookie-es": ["cookie-es@2.0.1", "", {}, "sha512-aVf4A4hI2w70LnF7GG+7xDQUkliwiXWXFvTjkip4+b64ygDQ2sJPRSKFDHbxn8o0xu9QzPkMuuiWIXyFSE2slA=="],
+    "cookie-es": ["cookie-es@3.1.1", "", {}, "sha512-UaXxwISYJPTr9hwQxMFYZ7kNhSXboMXP+Z3TRX6f1/NyaGPfuNUZOWP1pUEb75B2HjfklIYLVRfWiFZJyC6Npg=="],
 
     "crossws": ["crossws@0.4.5", "", { "peerDependencies": { "srvx": ">=0.11.5" }, "optionalPeers": ["srvx"] }, "sha512-wUR89x/Rw7/8t+vn0CmGDYM9TD6VtARGb0LD5jq2wjtMy1vCP4M+sm6N6TigWeTYvnA8MoW29NqqXD0ep0rfBA=="],
 
@@ -915,7 +919,7 @@
 
     "domhandler": ["domhandler@5.0.3", "", { "dependencies": { "domelementtype": "^2.3.0" } }, "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w=="],
 
-    "dompurify": ["dompurify@3.2.7", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-WhL/YuveyGXJaerVlMYGWhvQswa7myDG17P7Vu65EWC05o8vfeNbvNf4d/BOvH99+ZW+LlQsc1GDKMa1vNK6dw=="],
+    "dompurify": ["dompurify@3.4.1", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-JahakDAIg1gyOm7dlgWSDjV4n7Ip2PKR55NIT6jrMfIgLFgWo81vdr1/QGqWtFNRqXP9UV71oVePtjqS2ebnPw=="],
 
     "domutils": ["domutils@3.2.2", "", { "dependencies": { "dom-serializer": "^2.0.0", "domelementtype": "^2.3.0", "domhandler": "^5.0.3" } }, "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw=="],
 
@@ -925,7 +929,7 @@
 
     "enhanced-resolve": ["enhanced-resolve@5.20.1", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.0" } }, "sha512-Qohcme7V1inbAfvjItgw0EaxVX5q2rdVEZHRBrEQdRZTssLDGsL8Lwrznl8oQ/6kuTJONLaDcGjkNP247XEhcA=="],
 
-    "entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
+    "entities": ["entities@8.0.0", "", {}, "sha512-zwfzJecQ/Uej6tusMqwAqU/6KL2XaB2VZ2Jg54Je6ahNBGNH6Ek6g3jjNCF0fG9EWQKGZNddNjU5F1ZQn/sBnA=="],
 
     "env-runner": ["env-runner@0.1.7", "", { "dependencies": { "crossws": "^0.4.4", "exsolve": "^1.0.8", "httpxy": "^0.5.0", "srvx": "^0.11.13" }, "peerDependencies": { "@netlify/runtime": "^4", "miniflare": "^4.20260317.3" }, "optionalPeers": ["@netlify/runtime", "miniflare"], "bin": { "env-runner": "dist/cli.mjs" } }, "sha512-i7h96jxETJYhXy5grgHNJ9xNzCzWIn9Ck/VkkYgOlE4gOqknsLX3CmlVb5LmwNex8sOoLFVZLz+TIw/+b5rktA=="],
 
@@ -937,8 +941,6 @@
 
     "escape-string-regexp": ["escape-string-regexp@5.0.0", "", {}, "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw=="],
 
-    "esprima": ["esprima@4.0.1", "", { "bin": { "esparse": "./bin/esparse.js", "esvalidate": "./bin/esvalidate.js" } }, "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A=="],
-
     "estree-util-is-identifier-name": ["estree-util-is-identifier-name@3.0.0", "", {}, "sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg=="],
 
     "estree-walker": ["estree-walker@3.0.3", "", { "dependencies": { "@types/estree": "^1.0.0" } }, "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g=="],
@@ -949,11 +951,11 @@
 
     "extend": ["extend@3.0.2", "", {}, "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g=="],
 
-    "fast-string-truncated-width": ["fast-string-truncated-width@1.2.1", "", {}, "sha512-Q9acT/+Uu3GwGj+5w/zsGuQjh9O1TyywhIwAxHudtWrgF09nHOPrvTLhQevPbttcxjr/SNN7mJmfOw/B1bXgow=="],
+    "fast-string-truncated-width": ["fast-string-truncated-width@3.0.3", "", {}, "sha512-0jjjIEL6+0jag3l2XWWizO64/aZVtpiGE3t0Zgqxv0DPuxiMjvB3M24fCyhZUO4KomJQPj3LTSUnDP3GpdwC0g=="],
 
-    "fast-string-width": ["fast-string-width@1.1.0", "", { "dependencies": { "fast-string-truncated-width": "^1.2.0" } }, "sha512-O3fwIVIH5gKB38QNbdg+3760ZmGz0SZMgvwJbA1b2TGXceKE6A2cOlfogh1iw8lr049zPyd7YADHy+B7U4W9bQ=="],
+    "fast-string-width": ["fast-string-width@3.0.2", "", { "dependencies": { "fast-string-truncated-width": "^3.0.2" } }, "sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg=="],
 
-    "fast-wrap-ansi": ["fast-wrap-ansi@0.1.6", "", { "dependencies": { "fast-string-width": "^1.1.0" } }, "sha512-HlUwET7a5gqjURj70D5jl7aC3Zmy4weA1SHUfM0JFI0Ptq987NH2TwbBFLoERhfwk+E+eaq4EK3jXoT+R3yp3w=="],
+    "fast-wrap-ansi": ["fast-wrap-ansi@0.2.0", "", { "dependencies": { "fast-string-width": "^3.0.2" } }, "sha512-rLV8JHxTyhVmFYhBJuMujcrHqOT2cnO5Zxj37qROj23CP39GXubJRBUFF0z8KFK77Uc0SukZUf7JZhsVEQ6n8w=="],
 
     "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="],
 
@@ -969,8 +971,6 @@
 
     "get-nonce": ["get-nonce@1.0.1", "", {}, "sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q=="],
 
-    "get-tsconfig": ["get-tsconfig@4.13.7", "", { "dependencies": { "resolve-pkg-maps": "^1.0.0" } }, "sha512-7tN6rFgBlMgpBML5j8typ92BKFi2sFQvIdpAqLA2beia5avZDrMs0FLZiM5etShWq5irVyGcGMEA1jcDaK7A/Q=="],
-
     "glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
 
     "globrex": ["globrex@0.1.2", "", {}, "sha512-uHJgbwAMwNFf5mLst7IWLNg14x1CkeqglJb/K3doi4dw6q2IvAAmM/Y81kevy83wP+Sst+nutFTYOGg3d1lsxg=="],
@@ -979,9 +979,9 @@
 
     "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],
 
-    "h3": ["h3@2.0.1-rc.18", "", { "dependencies": { "rou3": "^0.8.1", "srvx": "^0.11.12" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"], "bin": { "h3": "bin/h3.mjs" } }, "sha512-2EdYEOIJwZHfhfdxvqZsmmUz4tgwzQSuzre+l50j+voHJV4m7j3zw2lYLgHoyfkCF9EAZcaH4ea0zH/hgcs9Yg=="],
+    "h3": ["h3@2.0.1-rc.21", "", { "dependencies": { "rou3": "^0.8.1", "srvx": "^0.11.15" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"], "bin": { "h3": "bin/h3.mjs" } }, "sha512-lDeqAgCQXWT7C+5Zs3ler2phZPeX5yTk9KqQuL8taSSngIhcPR0r83TZyYwTO/cLogm6a4+9slZcngrfdyZtrQ=="],
 
-    "h3-v2": ["h3@2.0.1-rc.16", "", { "dependencies": { "rou3": "^0.8.0", "srvx": "^0.11.9" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"], "bin": { "h3": "bin/h3.mjs" } }, "sha512-h+pjvyujdo9way8qj6FUbhaQcHlR8FEq65EhTX9ViT5pK8aLj68uFl4hBkF+hsTJAH+H1END2Yv6hTIsabGfag=="],
+    "h3-v2": ["h3@2.0.1-rc.20", "", { "dependencies": { "rou3": "^0.8.1", "srvx": "^0.11.13" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"], "bin": { "h3": "bin/h3.mjs" } }, "sha512-28ljodXuUp0fZovdiSRq4G9OgrxCztrJe5VdYzXAB7ueRvI7pIUqLU14Xi3XqdYJ/khXjfpUOOD2EQa6CmBgsg=="],
 
     "has-flag": ["has-flag@4.0.0", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
 
@@ -1005,7 +1005,7 @@
 
     "hastscript": ["hastscript@9.0.1", "", { "dependencies": { "@types/hast": "^3.0.0", "comma-separated-tokens": "^2.0.0", "hast-util-parse-selector": "^4.0.0", "property-information": "^7.0.0", "space-separated-tokens": "^2.0.0" } }, "sha512-g7df9rMFX/SPi34tyGCyUBREQoKkapwdY/T04Qn9TDWfHhAYt4/I0gMVirzK5wEzeUqIjEB+LXC/ypb7Aqno5w=="],
 
-    "hookable": ["hookable@6.1.0", "", {}, "sha512-ZoKZSJgu8voGK2geJS+6YtYjvIzu9AOM/KZXsBxr83uhLL++e9pEv/dlgwgy3dvHg06kTz6JOh1hk3C8Ceiymw=="],
+    "hookable": ["hookable@6.1.1", "", {}, "sha512-U9LYDy1CwhMCnprUfeAZWZGByVbhd54hwepegYTK7Pi5NvqEj63ifz5z+xukznehT7i6NIZRu89Ay1AZmRsLEQ=="],
 
     "html-encoding-sniffer": ["html-encoding-sniffer@6.0.0", "", { "dependencies": { "@exodus/bytes": "^1.6.0" } }, "sha512-CV9TW3Y3f8/wT0BRFc1/KAVQ3TUHiXmaAb6VW9vtiMFf7SLoMd1PdAc4W3KFOFETBJUb90KatHqlsZMWV+R9Gg=="],
 
@@ -1067,7 +1067,7 @@
 
     "js-yaml": ["js-yaml@4.1.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA=="],
 
-    "jsdom": ["jsdom@29.0.2", "", { "dependencies": { "@asamuzakjp/css-color": "^5.1.5", "@asamuzakjp/dom-selector": "^7.0.6", "@bramus/specificity": "^2.4.2", "@csstools/css-syntax-patches-for-csstree": "^1.1.1", "@exodus/bytes": "^1.15.0", "css-tree": "^3.2.1", "data-urls": "^7.0.0", "decimal.js": "^10.6.0", "html-encoding-sniffer": "^6.0.0", "is-potential-custom-element-name": "^1.0.1", "lru-cache": "^11.2.7", "parse5": "^8.0.0", "saxes": "^6.0.0", "symbol-tree": "^3.2.4", "tough-cookie": "^6.0.1", "undici": "^7.24.5", "w3c-xmlserializer": "^5.0.0", "webidl-conversions": "^8.0.1", "whatwg-mimetype": "^5.0.0", "whatwg-url": "^16.0.1", "xml-name-validator": "^5.0.0" }, "peerDependencies": { "canvas": "^3.0.0" }, "optionalPeers": ["canvas"] }, "sha512-9VnGEBosc/ZpwyOsJBCQ/3I5p7Q5ngOY14a9bf5btenAORmZfDse1ZEheMiWcJ3h81+Fv7HmJFdS0szo/waF2w=="],
+    "jsdom": ["jsdom@29.1.0", "", { "dependencies": { "@asamuzakjp/css-color": "^5.1.11", "@asamuzakjp/dom-selector": "^7.1.1", "@bramus/specificity": "^2.4.2", "@csstools/css-syntax-patches-for-csstree": "^1.1.3", "@exodus/bytes": "^1.15.0", "css-tree": "^3.2.1", "data-urls": "^7.0.0", "decimal.js": "^10.6.0", "html-encoding-sniffer": "^6.0.0", "is-potential-custom-element-name": "^1.0.1", "lru-cache": "^11.3.5", "parse5": "^8.0.1", "saxes": "^6.0.0", "symbol-tree": "^3.2.4", "tough-cookie": "^6.0.1", "undici": "^7.25.0", "w3c-xmlserializer": "^5.0.0", "webidl-conversions": "^8.0.1", "whatwg-mimetype": "^5.0.0", "whatwg-url": "^16.0.1", "xml-name-validator": "^5.0.0" }, "peerDependencies": { "canvas": "^3.0.0" }, "optionalPeers": ["canvas"] }, "sha512-YNUc7fB9QuvSSQWfrH0xF+TyABkxUwx8sswgIDaCrw4Hol8BghdZDkITtZheRJeMtzWlnTfsM3bBBusRvpO1wg=="],
 
     "jsesc": ["jsesc@3.1.0", "", { "bin": { "jsesc": "bin/jsesc" } }, "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA=="],
 
@@ -1109,7 +1109,7 @@
 
     "lucia": ["lucia@3.2.2", "", { "dependencies": { "@oslojs/crypto": "^1.0.1", "@oslojs/encoding": "^1.1.0" } }, "sha512-P1FlFBGCMPMXu+EGdVD9W4Mjm0DqsusmKgO7Xc33mI5X1bklmsQb0hfzPhXomQr9waWIBDsiOjvr1e6BTaUqpA=="],
 
-    "lucide-react": ["lucide-react@0.577.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-4LjoFv2eEPwYDPg/CUdBJQSDfPyzXCRrVW1X7jrx/trgxnxkHFjnVZINbzvzxjN70dxychOfg+FTYwBiS3pQ5A=="],
+    "lucide-react": ["lucide-react@1.14.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-+1mdWcfSJVUsaTIjN9zoezmUhfXo5l0vP7ekBMPo3jcS/aIkxHnXqAPsByszMZx/Y8oQBRJxJx5xg+RH3urzxA=="],
 
     "lz-string": ["lz-string@1.5.0", "", { "bin": { "lz-string": "bin/bin.js" } }, "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ=="],
 
@@ -1227,7 +1227,7 @@
 
     "nf3": ["nf3@0.3.16", "", {}, "sha512-Gs0xRPpUm2nDkqbi40NJ9g7qDIcjcJzgExiydnq6LAyqhI2jfno8wG3NKTL+IiJsx799UHOb1CnSd4Wg4SG4Pw=="],
 
-    "nitro": ["nitro@3.0.260311-beta", "", { "dependencies": { "consola": "^3.4.2", "crossws": "^0.4.4", "db0": "^0.3.4", "env-runner": "^0.1.6", "h3": "^2.0.1-rc.16", "hookable": "^6.0.1", "nf3": "^0.3.11", "ocache": "^0.1.2", "ofetch": "^2.0.0-alpha.3", "ohash": "^2.0.11", "rolldown": "^1.0.0-rc.8", "srvx": "^0.11.9", "unenv": "^2.0.0-rc.24", "unstorage": "^2.0.0-alpha.6" }, "peerDependencies": { "dotenv": "*", "giget": "*", "jiti": "^2.6.1", "rollup": "^4.59.0", "vite": "^7 || ^8 || >=8.0.0-0", "xml2js": "^0.6.2", "zephyr-agent": "^0.1.15" }, "optionalPeers": ["dotenv", "giget", "jiti", "rollup", "vite", "xml2js", "zephyr-agent"], "bin": { "nitro": "dist/cli/index.mjs" } }, "sha512-0o0fJ9LUh4WKUqJNX012jyieUOtMCnadkNDWr0mHzdraoHpJP/1CGNefjRyZyMXSpoJfwoWdNEZu2iGf35TUvQ=="],
+    "nitro": ["nitro@3.0.260429-beta", "", { "dependencies": { "consola": "^3.4.2", "crossws": "^0.4.5", "db0": "^0.3.4", "env-runner": "^0.1.7", "h3": "^2.0.1-rc.20", "hookable": "^6.1.1", "nf3": "^0.3.16", "ocache": "^0.1.4", "ofetch": "^2.0.0-alpha.3", "ohash": "^2.0.11", "rolldown": "^1.0.0-rc.17", "srvx": "^0.11.15", "unenv": "^2.0.0-rc.24", "unstorage": "^2.0.0-alpha.7" }, "peerDependencies": { "@vercel/queue": "^0.1.6", "dotenv": "*", "giget": "*", "jiti": "^2.6.1", "rollup": "^4.60.2", "vite": "^7 || ^8", "xml2js": "^0.6.2", "zephyr-agent": "^0.2.0" }, "optionalPeers": ["@vercel/queue", "dotenv", "giget", "jiti", "rollup", "vite", "xml2js", "zephyr-agent"], "bin": { "nitro": "dist/cli/index.mjs" } }, "sha512-KweLVCUN5X9v9g+4yxAyRcz3FcOlnjmt9FyrAIWDxJETJmNT7I0JV0clgsONjo2nI0U5gwedXYA3RaNtF5XWzg=="],
 
     "node-releases": ["node-releases@2.0.37", "", {}, "sha512-1h5gKZCF+pO/o3Iqt5Jp7wc9rH3eJJ0+nh/CIoiRwjRxde/hAHyLPXYN4V3CqKAbiZPSeJFSWHmJsbkicta0Eg=="],
 
@@ -1253,19 +1253,19 @@
 
     "only-allow": ["only-allow@1.2.2", "", { "dependencies": { "which-pm-runs": "1.1.0" }, "bin": { "only-allow": "bin.js" } }, "sha512-uxyNYDsCh5YIJ780G7hC5OHjVUr9reHsbZNMM80L9tZlTpb3hUzb36KXgW4ZUGtJKQnGA3xegmWg1BxhWV0jJA=="],
 
-    "ora": ["ora@9.3.0", "", { "dependencies": { "chalk": "^5.6.2", "cli-cursor": "^5.0.0", "cli-spinners": "^3.2.0", "is-interactive": "^2.0.0", "is-unicode-supported": "^2.1.0", "log-symbols": "^7.0.1", "stdin-discarder": "^0.3.1", "string-width": "^8.1.0" } }, "sha512-lBX72MWFduWEf7v7uWf5DHp9Jn5BI8bNPGuFgtXMmr2uDz2Gz2749y3am3agSDdkhHPHYmmxEGSKH85ZLGzgXw=="],
+    "ora": ["ora@9.4.0", "", { "dependencies": { "chalk": "^5.6.2", "cli-cursor": "^5.0.0", "cli-spinners": "^3.2.0", "is-interactive": "^2.0.0", "is-unicode-supported": "^2.1.0", "log-symbols": "^7.0.1", "stdin-discarder": "^0.3.2", "string-width": "^8.1.0" } }, "sha512-84cglkRILFxdtA8hAvLNdMrtBpPNBTrQ9/ulg0FA7xLMnD6mifv+enAIeRmvtv+WgdCE+LPGOfQmtJRrVaIVhQ=="],
 
-    "oxfmt": ["oxfmt@0.41.0", "", { "dependencies": { "tinypool": "2.1.0" }, "optionalDependencies": { "@oxfmt/binding-android-arm-eabi": "0.41.0", "@oxfmt/binding-android-arm64": "0.41.0", "@oxfmt/binding-darwin-arm64": "0.41.0", "@oxfmt/binding-darwin-x64": "0.41.0", "@oxfmt/binding-freebsd-x64": "0.41.0", "@oxfmt/binding-linux-arm-gnueabihf": "0.41.0", "@oxfmt/binding-linux-arm-musleabihf": "0.41.0", "@oxfmt/binding-linux-arm64-gnu": "0.41.0", "@oxfmt/binding-linux-arm64-musl": "0.41.0", "@oxfmt/binding-linux-ppc64-gnu": "0.41.0", "@oxfmt/binding-linux-riscv64-gnu": "0.41.0", "@oxfmt/binding-linux-riscv64-musl": "0.41.0", "@oxfmt/binding-linux-s390x-gnu": "0.41.0", "@oxfmt/binding-linux-x64-gnu": "0.41.0", "@oxfmt/binding-linux-x64-musl": "0.41.0", "@oxfmt/binding-openharmony-arm64": "0.41.0", "@oxfmt/binding-win32-arm64-msvc": "0.41.0", "@oxfmt/binding-win32-ia32-msvc": "0.41.0", "@oxfmt/binding-win32-x64-msvc": "0.41.0" }, "bin": { "oxfmt": "bin/oxfmt" } }, "sha512-sKLdJZdQ3bw6x9qKiT7+eID4MNEXlDHf5ZacfIircrq6Qwjk0L6t2/JQlZZrVHTXJawK3KaMuBoJnEJPcqCEdg=="],
+    "oxfmt": ["oxfmt@0.47.0", "", { "dependencies": { "tinypool": "2.1.0" }, "optionalDependencies": { "@oxfmt/binding-android-arm-eabi": "0.47.0", "@oxfmt/binding-android-arm64": "0.47.0", "@oxfmt/binding-darwin-arm64": "0.47.0", "@oxfmt/binding-darwin-x64": "0.47.0", "@oxfmt/binding-freebsd-x64": "0.47.0", "@oxfmt/binding-linux-arm-gnueabihf": "0.47.0", "@oxfmt/binding-linux-arm-musleabihf": "0.47.0", "@oxfmt/binding-linux-arm64-gnu": "0.47.0", "@oxfmt/binding-linux-arm64-musl": "0.47.0", "@oxfmt/binding-linux-ppc64-gnu": "0.47.0", "@oxfmt/binding-linux-riscv64-gnu": "0.47.0", "@oxfmt/binding-linux-riscv64-musl": "0.47.0", "@oxfmt/binding-linux-s390x-gnu": "0.47.0", "@oxfmt/binding-linux-x64-gnu": "0.47.0", "@oxfmt/binding-linux-x64-musl": "0.47.0", "@oxfmt/binding-openharmony-arm64": "0.47.0", "@oxfmt/binding-win32-arm64-msvc": "0.47.0", "@oxfmt/binding-win32-ia32-msvc": "0.47.0", "@oxfmt/binding-win32-x64-msvc": "0.47.0" }, "bin": { "oxfmt": "bin/oxfmt" } }, "sha512-OFbkbzxKCpooQEnRmpTDnuwTX8KHXzZTQ4Df/hz85fpS67Pl+lxPEFvUtin56HIIS0B1k4X8oIzTXRZPufA2CA=="],
 
-    "oxlint": ["oxlint@1.60.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.60.0", "@oxlint/binding-android-arm64": "1.60.0", "@oxlint/binding-darwin-arm64": "1.60.0", "@oxlint/binding-darwin-x64": "1.60.0", "@oxlint/binding-freebsd-x64": "1.60.0", "@oxlint/binding-linux-arm-gnueabihf": "1.60.0", "@oxlint/binding-linux-arm-musleabihf": "1.60.0", "@oxlint/binding-linux-arm64-gnu": "1.60.0", "@oxlint/binding-linux-arm64-musl": "1.60.0", "@oxlint/binding-linux-ppc64-gnu": "1.60.0", "@oxlint/binding-linux-riscv64-gnu": "1.60.0", "@oxlint/binding-linux-riscv64-musl": "1.60.0", "@oxlint/binding-linux-s390x-gnu": "1.60.0", "@oxlint/binding-linux-x64-gnu": "1.60.0", "@oxlint/binding-linux-x64-musl": "1.60.0", "@oxlint/binding-openharmony-arm64": "1.60.0", "@oxlint/binding-win32-arm64-msvc": "1.60.0", "@oxlint/binding-win32-ia32-msvc": "1.60.0", "@oxlint/binding-win32-x64-msvc": "1.60.0" }, "peerDependencies": { "oxlint-tsgolint": ">=0.18.0" }, "optionalPeers": ["oxlint-tsgolint"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-tnRzTWiWJ9pg3ftRWnD0+Oqh78L6ZSwcEudvCZaER0PIqiAnNyXj5N1dPwjmNpDalkKS9m/WMLN1CTPUBPmsgw=="],
+    "oxlint": ["oxlint@1.62.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.62.0", "@oxlint/binding-android-arm64": "1.62.0", "@oxlint/binding-darwin-arm64": "1.62.0", "@oxlint/binding-darwin-x64": "1.62.0", "@oxlint/binding-freebsd-x64": "1.62.0", "@oxlint/binding-linux-arm-gnueabihf": "1.62.0", "@oxlint/binding-linux-arm-musleabihf": "1.62.0", "@oxlint/binding-linux-arm64-gnu": "1.62.0", "@oxlint/binding-linux-arm64-musl": "1.62.0", "@oxlint/binding-linux-ppc64-gnu": "1.62.0", "@oxlint/binding-linux-riscv64-gnu": "1.62.0", "@oxlint/binding-linux-riscv64-musl": "1.62.0", "@oxlint/binding-linux-s390x-gnu": "1.62.0", "@oxlint/binding-linux-x64-gnu": "1.62.0", "@oxlint/binding-linux-x64-musl": "1.62.0", "@oxlint/binding-openharmony-arm64": "1.62.0", "@oxlint/binding-win32-arm64-msvc": "1.62.0", "@oxlint/binding-win32-ia32-msvc": "1.62.0", "@oxlint/binding-win32-x64-msvc": "1.62.0" }, "peerDependencies": { "oxlint-tsgolint": ">=0.18.0" }, "optionalPeers": ["oxlint-tsgolint"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-1uFkg6HakjsGIpW9wNdeW4/2LOHW9MEkoWjZUTUfQtIHyLIZPYt00w3Sg+H3lH+206FgBPHBbW5dVE5l2ExECQ=="],
 
-    "oxlint-tsgolint": ["oxlint-tsgolint@0.17.4", "", { "optionalDependencies": { "@oxlint-tsgolint/darwin-arm64": "0.17.4", "@oxlint-tsgolint/darwin-x64": "0.17.4", "@oxlint-tsgolint/linux-arm64": "0.17.4", "@oxlint-tsgolint/linux-x64": "0.17.4", "@oxlint-tsgolint/win32-arm64": "0.17.4", "@oxlint-tsgolint/win32-x64": "0.17.4" }, "bin": { "tsgolint": "bin/tsgolint.js" } }, "sha512-4F/NXJiK2KnK4LQiULUPXRzVq0LOfextGvwCVRW1VKQbF5epI3MDMEGVAl5XjAGL6IFc7xBc/eVA95wczPeEQg=="],
+    "oxlint-tsgolint": ["oxlint-tsgolint@0.22.1", "", { "optionalDependencies": { "@oxlint-tsgolint/darwin-arm64": "0.22.1", "@oxlint-tsgolint/darwin-x64": "0.22.1", "@oxlint-tsgolint/linux-arm64": "0.22.1", "@oxlint-tsgolint/linux-x64": "0.22.1", "@oxlint-tsgolint/win32-arm64": "0.22.1", "@oxlint-tsgolint/win32-x64": "0.22.1" }, "bin": { "tsgolint": "bin/tsgolint.js" } }, "sha512-YUSGSLUnoolsu8gxISEDio3q1rtsCozwfOzASUn3DT2mR2EeQ93uEEnen7s+6LpF+lyTQFln1pQfqwBh/fsVEg=="],
 
-    "p-retry": ["p-retry@7.1.1", "", { "dependencies": { "is-network-error": "^1.1.0" } }, "sha512-J5ApzjyRkkf601HpEeykoiCvzHQjWxPAHhyjFcEUP2SWq0+35NKh8TLhpLw+Dkq5TZBFvUM6UigdE9hIVYTl5w=="],
+    "p-retry": ["p-retry@8.0.0", "", { "dependencies": { "is-network-error": "^1.3.0" } }, "sha512-kFVqH1HxOHp8LupNsOys7bSV09VYTRLxarH/mokO4Rqhk6wGi70E0jh4VzvVGXfEVNggHoHLAMWsQqHyU1Ey9A=="],
 
     "parse-entities": ["parse-entities@4.0.2", "", { "dependencies": { "@types/unist": "^2.0.0", "character-entities-legacy": "^3.0.0", "character-reference-invalid": "^2.0.0", "decode-named-character-reference": "^1.0.0", "is-alphanumerical": "^2.0.0", "is-decimal": "^2.0.0", "is-hexadecimal": "^2.0.0" } }, "sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw=="],
 
-    "parse5": ["parse5@8.0.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-9m4m5GSgXjL4AjumKzq1Fgfp3Z8rsvjRNbnkVwfu2ImRqE5D0LnY2QfDen18FSY9C573YU5XxSapdHZTZ2WolA=="],
+    "parse5": ["parse5@8.0.1", "", { "dependencies": { "entities": "^8.0.0" } }, "sha512-z1e/HMG90obSGeidlli3hj7cbocou0/wa5HacvI3ASx34PecNjNQeaHNo5WIZpWofN9kgkqV1q5YvXe3F0FoPw=="],
 
     "parse5-htmlparser2-tree-adapter": ["parse5-htmlparser2-tree-adapter@7.1.0", "", { "dependencies": { "domhandler": "^5.0.3", "parse5": "^7.0.0" } }, "sha512-ruw5xyKs6lrpo9x9rCZqZZnIUntICjQAd0Wsmp396Ul9lN/h+ifgVV1x1gZHi8euej6wTfpqX8j+BFQxF0NS/g=="],
 
@@ -1283,7 +1283,7 @@
 
     "playwright-core": ["playwright-core@1.59.1", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-HBV/RJg81z5BiiZ9yPzIiClYV/QMsDCKUyogwH9p3MCP6IYjUFu/MActgYAvK0oWyV9NlwM3GLBjADyWgydVyg=="],
 
-    "postcss": ["postcss@8.5.9", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-7a70Nsot+EMX9fFU3064K/kdHWZqGVY+BADLyXc8Dfv+mTLLVl6JzJpPaCZ2kQL9gIJvKXSLMHhqdRRjwQeFtw=="],
+    "postcss": ["postcss@8.5.12", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA=="],
 
     "preact": ["preact@10.24.3", "", {}, "sha512-Z2dPnBnMUfyQfSQ+GBdsGa16hz35YmLmtTLhM169uW944hYL6xzTYkJjC07j+Wosz733pMWx0fgON3JNw1jJQA=="],
 
@@ -1313,8 +1313,6 @@
 
     "readdirp": ["readdirp@3.6.0", "", { "dependencies": { "picomatch": "^2.2.1" } }, "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA=="],
 
-    "recast": ["recast@0.23.11", "", { "dependencies": { "ast-types": "^0.16.1", "esprima": "~4.0.0", "source-map": "~0.6.1", "tiny-invariant": "^1.3.3", "tslib": "^2.0.1" } }, "sha512-YTUo+Flmw4ZXiWfQKGcwwc11KnoRAYgzAE2E7mXKCjSviTKShtxBsN6YUUBB2gtaBzKzeKunxhUwNHQuRryhWA=="],
-
     "regex": ["regex@6.1.0", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-6VwtthbV4o/7+OaAF9I5L5V3llLEsoPyq9P1JVXkedTP33c7MfCG0/5NOPcSJn0TzXcG9YUrR0gQSWioew3LDg=="],
 
     "regex-recursion": ["regex-recursion@6.0.2", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-0YCaSCq2VRIebiaUviZNs0cBz1kg5kVS2UKUfNIx8YVs1cN3AV7NTctO5FOKBA+UT2BPJIWZauYHPqJODG50cg=="],
@@ -1335,11 +1333,9 @@
 
     "require-from-string": ["require-from-string@2.0.2", "", {}, "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw=="],
 
-    "resolve-pkg-maps": ["resolve-pkg-maps@1.0.0", "", {}, "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw=="],
-
     "restore-cursor": ["restore-cursor@5.1.0", "", { "dependencies": { "onetime": "^7.0.0", "signal-exit": "^4.1.0" } }, "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA=="],
 
-    "rolldown": ["rolldown@1.0.0-rc.12", "", { "dependencies": { "@oxc-project/types": "=0.122.0", "@rolldown/pluginutils": "1.0.0-rc.12" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.0-rc.12", "@rolldown/binding-darwin-arm64": "1.0.0-rc.12", "@rolldown/binding-darwin-x64": "1.0.0-rc.12", "@rolldown/binding-freebsd-x64": "1.0.0-rc.12", "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.12", "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.12", "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.12", "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.12", "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.12", "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.12", "@rolldown/binding-linux-x64-musl": "1.0.0-rc.12", "@rolldown/binding-openharmony-arm64": "1.0.0-rc.12", "@rolldown/binding-wasm32-wasi": "1.0.0-rc.12", "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.12", "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.12" }, "bin": { "rolldown": "bin/cli.mjs" } }, "sha512-yP4USLIMYrwpPHEFB5JGH1uxhcslv6/hL0OyvTuY+3qlOSJvZ7ntYnoWpehBxufkgN0cvXxppuTu5hHa/zPh+A=="],
+    "rolldown": ["rolldown@1.0.0-rc.17", "", { "dependencies": { "@oxc-project/types": "=0.127.0", "@rolldown/pluginutils": "1.0.0-rc.17" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.0-rc.17", "@rolldown/binding-darwin-arm64": "1.0.0-rc.17", "@rolldown/binding-darwin-x64": "1.0.0-rc.17", "@rolldown/binding-freebsd-x64": "1.0.0-rc.17", "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.17", "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.17", "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.17", "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.17", "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.17", "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.17", "@rolldown/binding-linux-x64-musl": "1.0.0-rc.17", "@rolldown/binding-openharmony-arm64": "1.0.0-rc.17", "@rolldown/binding-wasm32-wasi": "1.0.0-rc.17", "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.17", "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.17" }, "bin": { "rolldown": "bin/cli.mjs" } }, "sha512-ZrT53oAKrtA4+YtBWPQbtPOxIbVDbxT0orcYERKd63VJTF13zPcgXTvD4843L8pcsI7M6MErt8QtON6lrB9tyA=="],
 
     "rou3": ["rou3@0.8.1", "", {}, "sha512-ePa+XGk00/3HuCqrEnK3LxJW7I0SdNg6EFzKUJG73hMAdDcOUC/i/aSz7LSDwLrGr33kal/rqOGydzwl6U7zBA=="],
 
@@ -1387,7 +1383,7 @@
 
     "std-env": ["std-env@4.0.0", "", {}, "sha512-zUMPtQ/HBY3/50VbpkupYHbRroTRZJPRLvreamgErJVys0ceuzMkD44J/QjqhHjOzK42GQ3QZIeFG1OYfOtKqQ=="],
 
-    "stdin-discarder": ["stdin-discarder@0.3.1", "", {}, "sha512-reExS1kSGoElkextOcPkel4NE99S0BWxjUHQeDFnR8S993JxpPX7KU4MNmO19NXhlJp+8dmdCbKQVNgLJh2teA=="],
+    "stdin-discarder": ["stdin-discarder@0.3.2", "", {}, "sha512-eCPu1qRxPVkl5605OTWF8Wz40b4Mf45NY5LQmVPQ599knfs5QhASUm9GbJ5BDMDOXgrnh0wyEdvzmL//YMlw0A=="],
 
     "string-width": ["string-width@8.2.0", "", { "dependencies": { "get-east-asian-width": "^1.5.0", "strip-ansi": "^7.1.2" } }, "sha512-6hJPQ8N0V0P3SNmP6h2J99RLuzrWz2gvT7VnK5tKvrNqJoyS9W4/Fb8mo31UiPvy00z7DQXkP2hnKBVav76thw=="],
 
@@ -1407,14 +1403,10 @@
 
     "tailwind-merge": ["tailwind-merge@3.5.0", "", {}, "sha512-I8K9wewnVDkL1NTGoqWmVEIlUcB9gFriAEkXkfCjX5ib8ezGxtR3xD7iZIxrfArjEsH7F1CHD4RFUtxefdqV/A=="],
 
-    "tailwindcss": ["tailwindcss@4.2.2", "", {}, "sha512-KWBIxs1Xb6NoLdMVqhbhgwZf2PGBpPEiwOqgI4pFIYbNTfBXiKYyWoTsXgBQ9WFg/OlhnvHaY+AEpW7wSmFo2Q=="],
+    "tailwindcss": ["tailwindcss@4.2.4", "", {}, "sha512-HhKppgO81FQof5m6TEnuBWCZGgfRAWbaeOaGT00KOy/Pf/j6oUihdvBpA7ltCeAvZpFhW3j0PTclkxsd4IXYDA=="],
 
     "tapable": ["tapable@2.3.2", "", {}, "sha512-1MOpMXuhGzGL5TTCZFItxCc0AARf1EZFQkGqMm7ERKj8+Hgr5oLvJOVFcC+lRmR8hCe2S3jC4T5D7Vg/d7/fhA=="],
 
-    "tiny-invariant": ["tiny-invariant@1.3.3", "", {}, "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg=="],
-
-    "tiny-warning": ["tiny-warning@1.0.3", "", {}, "sha512-lBN9zLN/oAf68o3zNXYrdCt1kP8WsiGW8Oo2ka41b2IM5JL/S1CTyX1rW0mb/zSuJun0ZUrDxx4sqvYS2FWzPA=="],
-
     "tinybench": ["tinybench@2.9.0", "", {}, "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg=="],
 
     "tinyexec": ["tinyexec@1.1.1", "", {}, "sha512-VKS/ZaQhhkKFMANmAOhhXVoIfBXblQxGX1myCQ2faQrfmobMftXeJPcZGp0gS07ocvGJWDLZGyOZDadDBqYIJg=="],
@@ -1443,11 +1435,9 @@
 
     "tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
 
-    "tsx": ["tsx@4.21.0", "", { "dependencies": { "esbuild": "~0.27.0", "get-tsconfig": "^4.7.5" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "bin": { "tsx": "dist/cli.mjs" } }, "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw=="],
-
     "tw-animate-css": ["tw-animate-css@1.4.0", "", {}, "sha512-7bziOlRqH0hJx80h/3mbicLW7o8qLsH5+RaLR2t+OHM3D0JlWGODQKQ4cxbK7WlvmUxpcj6Kgu6EKqjrGFe3QQ=="],
 
-    "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
+    "typescript": ["typescript@6.0.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw=="],
 
     "ufo": ["ufo@1.6.3", "", {}, "sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q=="],
 
@@ -1469,7 +1459,7 @@
 
     "unist-util-visit-parents": ["unist-util-visit-parents@6.0.2", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-is": "^6.0.0" } }, "sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ=="],
 
-    "unplugin": ["unplugin@2.3.11", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "acorn": "^8.15.0", "picomatch": "^4.0.3", "webpack-virtual-modules": "^0.6.2" } }, "sha512-5uKD0nqiYVzlmCRs01Fhs2BdkEgBS3SAVP6ndrBsuK42iC2+JHyxM05Rm9G8+5mkmRtzMZGY8Ct5+mliZxU/Ww=="],
+    "unplugin": ["unplugin@3.0.0", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "picomatch": "^4.0.3", "webpack-virtual-modules": "^0.6.2" } }, "sha512-0Mqk3AT2TZCXWKdcoaufeXNukv2mTrEZExeXlHIOZXdqYoHHr4n51pymnwV8x2BOVxwXbK2HLlI7usrqMpycdg=="],
 
     "unstorage": ["unstorage@2.0.0-alpha.7", "", { "peerDependencies": { "@azure/app-configuration": "^1.11.0", "@azure/cosmos": "^4.9.1", "@azure/data-tables": "^13.3.2", "@azure/identity": "^4.13.0", "@azure/keyvault-secrets": "^4.10.0", "@azure/storage-blob": "^12.31.0", "@capacitor/preferences": "^6 || ^7 || ^8", "@deno/kv": ">=0.13.0", "@netlify/blobs": "^6.5.0 || ^7.0.0 || ^8.1.0 || ^9.0.0 || ^10.0.0", "@planetscale/database": "^1.19.0", "@upstash/redis": "^1.36.2", "@vercel/blob": ">=0.27.3", "@vercel/functions": "^2.2.12 || ^3.0.0", "@vercel/kv": "^1.0.1", "aws4fetch": "^1.0.20", "chokidar": "^4 || ^5", "db0": ">=0.3.4", "idb-keyval": "^6.2.2", "ioredis": "^5.9.3", "lru-cache": "^11.2.6", "mongodb": "^6 || ^7", "ofetch": "*", "uploadthing": "^7.7.4" }, "optionalPeers": ["@azure/app-configuration", "@azure/cosmos", "@azure/data-tables", "@azure/identity", "@azure/keyvault-secrets", "@azure/storage-blob", "@capacitor/preferences", "@deno/kv", "@netlify/blobs", "@planetscale/database", "@upstash/redis", "@vercel/blob", "@vercel/functions", "@vercel/kv", "aws4fetch", "chokidar", "db0", "idb-keyval", "ioredis", "lru-cache", "mongodb", "ofetch", "uploadthing"] }, "sha512-ELPztchk2zgFJnakyodVY3vJWGW9jy//keJ32IOJVGUMyaPydwcA1FtVvWqT0TNRch9H+cMNEGllfVFfScImog=="],
 
@@ -1487,13 +1477,13 @@
 
     "vfile-message": ["vfile-message@4.0.3", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-stringify-position": "^4.0.0" } }, "sha512-QTHzsGd1EhbZs4AsQ20JX1rC3cOlt/IWJruk893DfLRr57lcnOeMaWG4K0JrRta4mIJZKth2Au3mM3u03/JWKw=="],
 
-    "vite": ["vite@8.0.5", "", { "dependencies": { "lightningcss": "^1.32.0", "picomatch": "^4.0.4", "postcss": "^8.5.8", "rolldown": "1.0.0-rc.12", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.1.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-nmu43Qvq9UopTRfMx2jOYW5l16pb3iDC1JH6yMuPkpVbzK0k+L7dfsEDH4jRgYFmsg0sTAqkojoZgzLMlwHsCQ=="],
+    "vite": ["vite@8.0.10", "", { "dependencies": { "lightningcss": "^1.32.0", "picomatch": "^4.0.4", "postcss": "^8.5.10", "rolldown": "1.0.0-rc.17", "tinyglobby": "^0.2.16" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.1.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-rZuUu9j6J5uotLDs+cAA4O5H4K1SfPliUlQwqa6YEwSrWDZzP4rhm00oJR5snMewjxF5V/K3D4kctsUTsIU9Mw=="],
 
     "vite-tsconfig-paths": ["vite-tsconfig-paths@6.1.1", "", { "dependencies": { "debug": "^4.1.1", "globrex": "^0.1.2", "tsconfck": "^3.0.3" }, "peerDependencies": { "vite": "*" } }, "sha512-2cihq7zliibCCZ8P9cKJrQBkfgdvcFkOOc3Y02o3GWUDLgqjWsZudaoiuOwO/gzTzy17cS5F7ZPo4bsnS4DGkg=="],
 
     "vitefu": ["vitefu@1.1.3", "", { "peerDependencies": { "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["vite"] }, "sha512-ub4okH7Z5KLjb6hDyjqrGXqWtWvoYdU3IGm/NorpgHncKoLTCfRIbvlhBm7r0YstIaQRYlp4yEbFqDcKSzXSSg=="],
 
-    "vitest": ["vitest@4.1.4", "", { "dependencies": { "@vitest/expect": "4.1.4", "@vitest/mocker": "4.1.4", "@vitest/pretty-format": "4.1.4", "@vitest/runner": "4.1.4", "@vitest/snapshot": "4.1.4", "@vitest/spy": "4.1.4", "@vitest/utils": "4.1.4", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.4", "@vitest/browser-preview": "4.1.4", "@vitest/browser-webdriverio": "4.1.4", "@vitest/coverage-istanbul": "4.1.4", "@vitest/coverage-v8": "4.1.4", "@vitest/ui": "4.1.4", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/coverage-istanbul", "@vitest/coverage-v8", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-tFuJqTxKb8AvfyqMfnavXdzfy3h3sWZRWwfluGbkeR7n0HUev+FmNgZ8SDrRBTVrVCjgH5cA21qGbCffMNtWvg=="],
+    "vitest": ["vitest@4.1.5", "", { "dependencies": { "@vitest/expect": "4.1.5", "@vitest/mocker": "4.1.5", "@vitest/pretty-format": "4.1.5", "@vitest/runner": "4.1.5", "@vitest/snapshot": "4.1.5", "@vitest/spy": "4.1.5", "@vitest/utils": "4.1.5", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.5", "@vitest/browser-preview": "4.1.5", "@vitest/browser-webdriverio": "4.1.5", "@vitest/coverage-istanbul": "4.1.5", "@vitest/coverage-v8": "4.1.5", "@vitest/ui": "4.1.5", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/coverage-istanbul", "@vitest/coverage-v8", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-9Xx1v3/ih3m9hN+SbfkUyy0JAs72ap3r7joc87XL6jwF0jGg6mFBvQ1SrwaX+h8BlkX6Hz9shdd1uo6AF+ZGpg=="],
 
     "w3c-xmlserializer": ["w3c-xmlserializer@5.0.0", "", { "dependencies": { "xml-name-validator": "^5.0.0" } }, "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA=="],
 
@@ -1527,7 +1517,7 @@
 
     "yoctocolors": ["yoctocolors@2.1.2", "", {}, "sha512-CzhO+pFNo8ajLM2d2IW/R93ipy99LWjtwblvC1RsoSUMZgyLbYFr221TnSNT7GjGdYui6P459mw9JH/g/zW2ug=="],
 
-    "zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
+    "zod": ["zod@4.4.1", "", {}, "sha512-a6ENMBBGZBsnlSebQ/eKCguSBeGKSf4O7BPnqVPmYGtpBYI7VSqoVqw+QcB7kPRjbqPwhYTpFbVj/RqNz/CT0Q=="],
 
     "zwitch": ["zwitch@2.0.4", "", {}, "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A=="],
 
@@ -1537,6 +1527,8 @@
 
     "@babel/helper-compilation-targets/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
+    "@img/sharp-wasm32/@emnapi/runtime": ["@emnapi/runtime@1.9.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-3U4+MIWHImeyu1wnmVygh5WlgfYDtyf0k8AbLhMFxOipihf6nrWC4syIm/SwEeec0mNSafiiNnMJwbza/Is6Lw=="],
+
     "@radix-ui/react-alert-dialog/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
 
     "@radix-ui/react-avatar/@radix-ui/react-context": ["@radix-ui/react-context@1.1.3", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-ieIFACdMpYfMEjF0rEf5KLvfVyIkOz6PDGyNnP+u+4xQ6jny3VCgA4OgXOwNx2aUkxn8zx9fiVcM8CfFYv9Lxw=="],
@@ -1561,13 +1553,13 @@
 
     "@radix-ui/react-tooltip/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
 
-    "@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.9.2", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" }, "bundled": true }, "sha512-UC+ZhH3XtczQYfOlu3lNEkdW/p4dsJ1r/bP7H8+rhao3TTTMO1ATq/4DdIi23XuGoFY+Cz0JmCbdVl0hz9jZcA=="],
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" }, "bundled": true }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
 
-    "@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.9.2", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-3U4+MIWHImeyu1wnmVygh5WlgfYDtyf0k8AbLhMFxOipihf6nrWC4syIm/SwEeec0mNSafiiNnMJwbza/Is6Lw=="],
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
 
     "@tailwindcss/oxide-wasm32-wasi/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
 
-    "@tailwindcss/oxide-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.3", "", { "dependencies": { "@tybys/wasm-util": "^0.10.1" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" }, "bundled": true }, "sha512-xK9sGVbJWYb08+mTJt3/YV24WxvxpXcXtP6B172paPZ+Ts69Re9dAr7lKwJoeIx8OoeuimEiRZ7umkiUVClmmQ=="],
+    "@tailwindcss/oxide-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.4", "", { "dependencies": { "@tybys/wasm-util": "^0.10.1" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" }, "bundled": true }, "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow=="],
 
     "@tailwindcss/oxide-wasm32-wasi/@tybys/wasm-util": ["@tybys/wasm-util@0.10.1", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg=="],
 
@@ -1601,8 +1593,6 @@
 
     "htmlparser2/entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
 
-    "next/postcss": ["postcss@8.4.31", "", { "dependencies": { "nanoid": "^3.3.6", "picocolors": "^1.0.0", "source-map-js": "^1.0.2" } }, "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ=="],
-
     "parse-entities/@types/unist": ["@types/unist@2.0.11", "", {}, "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA=="],
 
     "parse5-htmlparser2-tree-adapter/parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
@@ -1613,10 +1603,16 @@
 
     "readdirp/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
 
-    "recast/source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
-
-    "rolldown/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.12", "", {}, "sha512-HHMwmarRKvoFsJorqYlFeFRzXZqCt2ETQlEDOb9aqssrnVBB1/+xgTGtuTrIk5vzLNX1MjMtTf7W9z3tsSbrxw=="],
+    "rolldown/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.17", "", {}, "sha512-n8iosDOt6Ig1UhJ2AYqoIhHWh/isz0xpicHTzpKBeotdVsTEcxsSA/i3EVM7gQAj0rU27OLAxCjzlj15IWY7bg=="],
 
     "strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
+
+    "cheerio/parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
+
+    "hast-util-raw/parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
+
+    "parse5-htmlparser2-tree-adapter/parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
+
+    "parse5-parser-stream/parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
   }
 }

convex/_generated/api.d.ts

@@ -13,6 +13,7 @@ import type * as auth from "../auth.js";
 import type * as commentModeration from "../commentModeration.js";
 import type * as comments from "../comments.js";
 import type * as crons from "../crons.js";
+import type * as depRegistryScan from "../depRegistryScan.js";
 import type * as devSeed from "../devSeed.js";
 import type * as devSeedExtra from "../devSeedExtra.js";
 import type * as downloads from "../downloads.js";
@@ -45,6 +46,7 @@ import type * as lib_batching from "../lib/batching.js";
 import type * as lib_changelog from "../lib/changelog.js";
 import type * as lib_commentScamPrompt from "../lib/commentScamPrompt.js";
 import type * as lib_contentTypes from "../lib/contentTypes.js";
+import type * as lib_depRegistryScan from "../lib/depRegistryScan.js";
 import type * as lib_embeddingVisibility from "../lib/embeddingVisibility.js";
 import type * as lib_embeddings from "../lib/embeddings.js";
 import type * as lib_githubAccount from "../lib/githubAccount.js";
@@ -104,6 +106,8 @@ import type * as publishers from "../publishers.js";
 import type * as rateLimits from "../rateLimits.js";
 import type * as rescanRequests from "../rescanRequests.js";
 import type * as search from "../search.js";
+import type * as securityDataset from "../securityDataset.js";
+import type * as securityDatasetNode from "../securityDatasetNode.js";
 import type * as seed from "../seed.js";
 import type * as seedSouls from "../seedSouls.js";
 import type * as skillStatEvents from "../skillStatEvents.js";
@@ -134,6 +138,7 @@ declare const fullApi: ApiFromModules<{
   commentModeration: typeof commentModeration;
   comments: typeof comments;
   crons: typeof crons;
+  depRegistryScan: typeof depRegistryScan;
   devSeed: typeof devSeed;
   devSeedExtra: typeof devSeedExtra;
   downloads: typeof downloads;
@@ -166,6 +171,7 @@ declare const fullApi: ApiFromModules<{
   "lib/changelog": typeof lib_changelog;
   "lib/commentScamPrompt": typeof lib_commentScamPrompt;
   "lib/contentTypes": typeof lib_contentTypes;
+  "lib/depRegistryScan": typeof lib_depRegistryScan;
   "lib/embeddingVisibility": typeof lib_embeddingVisibility;
   "lib/embeddings": typeof lib_embeddings;
   "lib/githubAccount": typeof lib_githubAccount;
@@ -225,6 +231,8 @@ declare const fullApi: ApiFromModules<{
   rateLimits: typeof rateLimits;
   rescanRequests: typeof rescanRequests;
   search: typeof search;
+  securityDataset: typeof securityDataset;
+  securityDatasetNode: typeof securityDatasetNode;
   seed: typeof seed;
   seedSouls: typeof seedSouls;
   skillStatEvents: typeof skillStatEvents;

convex/depRegistryScan.ts

@@ -0,0 +1,270 @@
+import { v } from "convex/values";
+import { internal } from "./_generated/api";
+import type { Doc, Id } from "./_generated/dataModel";
+import type { ActionCtx } from "./_generated/server";
+import { internalAction, internalMutation, internalQuery } from "./functions";
+import {
+  dedupeDeps,
+  depRegistryUrl,
+  parseDependencyFile,
+  SUPPORTED_DEP_REGISTRIES,
+  summarizeDepRegistryChecks,
+  type DepEntry,
+  type DepRegistryResult,
+  type DepRegistryUnresolved,
+  type SupportedDepRegistry,
+} from "./lib/depRegistryScan";
+import { readStorageText } from "./lib/packageRegistry";
+
+const REQUEST_TIMEOUT_MS = 8_000;
+const MAX_RETRIES = 2;
+const BACKOFF_BASE_MS = 750;
+const INTER_REQUEST_DELAY_MS = 100;
+const MAX_DEPENDENCIES_PER_SCAN = 120;
+const CACHE_TTL_EXISTS_MS = 30 * 24 * 60 * 60 * 1_000;
+const CACHE_TTL_NOT_EXISTS_MS = 7 * 24 * 60 * 60 * 1_000;
+
+const registryValidator = v.union(v.literal("pypi"), v.literal("npm"), v.literal("cargo"));
+
+type RegistryCheck =
+  | { kind: "found"; httpStatus: number }
+  | { kind: "missing"; httpStatus: number }
+  | { kind: "unresolved"; reason: string };
+
+function isSupportedRegistry(value: string): value is SupportedDepRegistry {
+  return (SUPPORTED_DEP_REGISTRIES as readonly string[]).includes(value);
+}
+
+async function wait(ms: number) {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function checkRegistry(dep: DepEntry): Promise<RegistryCheck> {
+  const headers: Record<string, string> = { Accept: "application/json" };
+  if (dep.registry === "cargo") {
+    headers["User-Agent"] = "ClawHub-DepRegistryScan/1.0 (https://clawhub.ai)";
+  }
+
+  let lastStatus: number | undefined;
+  for (let attempt = 0; attempt <= MAX_RETRIES; attempt += 1) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+      const response = await fetch(depRegistryUrl(dep.registry, dep.name), {
+        method: "GET",
+        headers,
+        signal: controller.signal,
+      });
+      clearTimeout(timeout);
+      lastStatus = response.status;
+      if (response.status === 200) return { kind: "found", httpStatus: response.status };
+      if (response.status === 404) return { kind: "missing", httpStatus: response.status };
+      if (response.status !== 429 && response.status < 500) {
+        return {
+          kind: "unresolved",
+          reason: `unexpected HTTP ${response.status}`,
+        };
+      }
+    } catch (error) {
+      clearTimeout(timeout);
+      if (attempt === MAX_RETRIES) {
+        return {
+          kind: "unresolved",
+          reason: error instanceof Error ? error.message : "network error",
+        };
+      }
+    }
+
+    if (attempt < MAX_RETRIES) {
+      await wait(2 ** attempt * BACKOFF_BASE_MS);
+    }
+  }
+
+  return {
+    kind: "unresolved",
+    reason: lastStatus ? `HTTP ${lastStatus}` : "network error",
+  };
+}
+
+async function extractDependencies(ctx: Pick<ActionCtx, "storage">, version: Doc<"skillVersions">) {
+  const entries: DepEntry[] = [];
+  for (const file of version.files) {
+    const basename = file.path.split("/").pop()?.toLowerCase() ?? "";
+    if (
+      basename !== "requirements.txt" &&
+      basename !== "requirements-dev.txt" &&
+      basename !== "requirements_dev.txt" &&
+      basename !== "requirements-test.txt" &&
+      basename !== "requirements_test.txt" &&
+      basename !== "package.json" &&
+      basename !== "cargo.toml" &&
+      basename !== "pyproject.toml"
+    ) {
+      continue;
+    }
+    const content = await readStorageText(ctx, file.storageId);
+    entries.push(...parseDependencyFile(file.path, content));
+  }
+  return dedupeDeps(entries);
+}
+
+export const lookupCacheInternal = internalQuery({
+  args: {
+    registry: registryValidator,
+    name: v.string(),
+  },
+  handler: async (ctx, args): Promise<Doc<"depRegistryCache"> | null> => {
+    return ctx.db
+      .query("depRegistryCache")
+      .withIndex("by_registry_name", (q) => q.eq("registry", args.registry).eq("name", args.name))
+      .unique();
+  },
+});
+
+export const upsertCacheInternal = internalMutation({
+  args: {
+    registry: registryValidator,
+    name: v.string(),
+    exists: v.boolean(),
+    httpStatus: v.number(),
+    checkedAt: v.number(),
+  },
+  handler: async (ctx, args) => {
+    const existing = await ctx.db
+      .query("depRegistryCache")
+      .withIndex("by_registry_name", (q) => q.eq("registry", args.registry).eq("name", args.name))
+      .unique();
+    const patch = {
+      registry: args.registry,
+      name: args.name,
+      exists: args.exists,
+      httpStatus: args.httpStatus,
+      checkedAt: args.checkedAt,
+    };
+    if (existing) {
+      await ctx.db.patch(existing._id, patch);
+    } else {
+      await ctx.db.insert("depRegistryCache", patch);
+    }
+  },
+});
+
+export const getRetryableVersionIdsInternal = internalQuery({
+  args: {
+    limit: v.optional(v.number()),
+  },
+  handler: async (ctx, args) => {
+    const limit = Math.min(Math.max(args.limit ?? 25, 1), 100);
+    const versions = await ctx.db
+      .query("skillVersions")
+      .withIndex("by_dep_registry_scan_status_and_created", (q) =>
+        q.eq("depRegistryScanStatus", "error"),
+      )
+      .order("desc")
+      .take(limit);
+    return versions.map((version) => version._id);
+  },
+});
+
+async function checkWithCache(ctx: ActionCtx, dep: DepEntry) {
+  const now = Date.now();
+  const cached = (await ctx.runQuery(internal.depRegistryScan.lookupCacheInternal, {
+    registry: dep.registry,
+    name: dep.name,
+  })) as Doc<"depRegistryCache"> | null;
+  if (cached) {
+    const ttl = cached.exists ? CACHE_TTL_EXISTS_MS : CACHE_TTL_NOT_EXISTS_MS;
+    if (now - cached.checkedAt < ttl) {
+      return cached.exists
+        ? ({ kind: "found", httpStatus: cached.httpStatus } as const)
+        : ({ kind: "missing", httpStatus: cached.httpStatus } as const);
+    }
+  }
+
+  const check = await checkRegistry(dep);
+  if (check.kind !== "unresolved") {
+    await ctx.runMutation(internal.depRegistryScan.upsertCacheInternal, {
+      registry: dep.registry,
+      name: dep.name,
+      exists: check.kind === "found",
+      httpStatus: check.httpStatus,
+      checkedAt: now,
+    });
+  }
+  return check;
+}
+
+export const checkDependencyRegistries = internalAction({
+  args: { versionId: v.id("skillVersions") },
+  handler: async (ctx, args) => {
+    const version = (await ctx.runQuery(internal.skills.getVersionByIdInternal, {
+      versionId: args.versionId,
+    })) as Doc<"skillVersions"> | null;
+    if (!version) return null;
+    if (version.depRegistryAnalysis && version.depRegistryAnalysis.status !== "error") {
+      return version.depRegistryAnalysis;
+    }
+
+    const deps = await extractDependencies(ctx, version);
+    const checkableDeps = deps.slice(0, MAX_DEPENDENCIES_PER_SCAN);
+    const deferredDeps = deps.slice(MAX_DEPENDENCIES_PER_SCAN);
+    const results: DepRegistryResult[] = [];
+    const unresolved: DepRegistryUnresolved[] = deferredDeps.map((dep) => ({
+      ...dep,
+      reason: "dependency scan limit reached",
+    }));
+
+    for (const dep of checkableDeps) {
+      if (!isSupportedRegistry(dep.registry)) continue;
+      const check = await checkWithCache(ctx, dep);
+      if (check.kind === "unresolved") {
+        unresolved.push({ ...dep, reason: check.reason });
+      } else {
+        results.push({
+          ...dep,
+          exists: check.kind === "found",
+          httpStatus: check.httpStatus,
+        });
+      }
+      await wait(INTER_REQUEST_DELAY_MS);
+    }
+
+    const analysis = summarizeDepRegistryChecks({
+      results,
+      unresolved,
+      checkedAt: Date.now(),
+    });
+
+    await ctx.runMutation(internal.skills.updateVersionDepRegistryAnalysisInternal, {
+      versionId: args.versionId,
+      depRegistryAnalysis: analysis,
+    });
+
+    return analysis;
+  },
+});
+
+export const rescanErrorDepRegistryVersions = internalAction({
+  args: {
+    batchSize: v.optional(v.number()),
+  },
+  handler: async (ctx, args) => {
+    const versionIds = (await ctx.runQuery(
+      internal.depRegistryScan.getRetryableVersionIdsInternal,
+      { limit: args.batchSize ?? 25 },
+    )) as Id<"skillVersions">[];
+
+    let scheduled = 0;
+    for (const versionId of versionIds) {
+      await ctx.scheduler.runAfter(
+        scheduled * 2_000,
+        internal.depRegistryScan.checkDependencyRegistries,
+        {
+          versionId,
+        },
+      );
+      scheduled += 1;
+    }
+    return { scheduled };
+  },
+});

convex/devSeed.rescanFixtures.test.ts

@@ -76,6 +76,8 @@ describe("devSeed rescan UX fixtures", () => {
     const args = {
       flaggedSkillStorageId: "storage:skill",
       flaggedSkillMd: "# Flagged skill",
+      scannedSkillStorageId: "storage:scanned-skill",
+      scannedSkillMd: "# Scanned skill",
       flaggedPluginStorageId: "storage:plugin",
       flaggedPluginReadme: "# Flagged plugin",
       scannedPluginStorageId: "storage:scanned-plugin",
@@ -89,8 +91,8 @@ describe("devSeed rescan UX fixtures", () => {
     expect(tables.users).toHaveLength(1);
     expect(tables.users?.[0]).toEqual(expect.objectContaining({ handle: "local" }));
     expect(tables.publishers).toHaveLength(1);
-    expect(tables.skills).toHaveLength(1);
-    expect(tables.skills?.[0]).toEqual(
+    expect(tables.skills).toHaveLength(2);
+    expect(tables.skills?.find((skill) => skill.slug === "local-flagged-wallet-sync")).toEqual(
       expect.objectContaining({
         ownerUserId: tables.users?.[0]?._id,
         ownerPublisherId: tables.publishers?.[0]?._id,
@@ -98,6 +100,14 @@ describe("devSeed rescan UX fixtures", () => {
         moderationVerdict: "malicious",
       }),
     );
+    expect(tables.skills?.find((skill) => skill.slug === "local-agentic-risk-demo")).toEqual(
+      expect.objectContaining({
+        ownerUserId: tables.users?.[0]?._id,
+        ownerPublisherId: tables.publishers?.[0]?._id,
+        moderationStatus: "active",
+        moderationVerdict: "suspicious",
+      }),
+    );
     expect(tables.packages).toHaveLength(2);
     expect(tables.packages?.find((pkg) => pkg.name === "local-flagged-runtime-plugin")).toEqual(
       expect.objectContaining({
@@ -129,6 +139,32 @@ describe("devSeed rescan UX fixtures", () => {
       }),
     );
 
+    const scannedSkill = tables.skills?.find((skill) => skill.slug === "local-agentic-risk-demo");
+    const scannedSkillVersion = tables.skillVersions?.find(
+      (version) => version.skillId === scannedSkill?._id,
+    );
+    expect(scannedSkillVersion).toEqual(
+      expect.objectContaining({
+        sha256hash: "seeded-agentic-risk-skill-hash",
+        vtAnalysis: expect.objectContaining({ status: "clean" }),
+        llmAnalysis: expect.objectContaining({
+          status: "suspicious",
+          riskSummary: expect.objectContaining({
+            sensitive_data_protection: expect.objectContaining({ status: "concern" }),
+          }),
+          agenticRiskFindings: expect.arrayContaining([
+            expect.objectContaining({
+              categoryId: "ASI06",
+              riskBucket: "sensitive_data_protection",
+              status: "concern",
+              evidence: expect.objectContaining({ path: "SKILL.md" }),
+            }),
+          ]),
+        }),
+        staticScan: expect.objectContaining({ status: "suspicious" }),
+      }),
+    );
+
     const skillRequests =
       tables.rescanRequests?.filter((request) => request.targetKind === "skill") ?? [];
     const pluginRequests =

convex/functions.test.ts

@@ -3,13 +3,86 @@
 import { describe, expect, it, vi } from "vitest";
 import { internal } from "./_generated/api";
 import {
+  isGitHubMirrorEligibleSkillDoc,
   repointPackageLatestRelease,
+  scheduleGitHubBackupDeletionForSkill,
   scheduleOwnerPublisherDigestSync,
   syncPackageSearchDigestForPackageId,
+  syncPackageSearchDigestsForOwnerPublisherId,
   syncPackageSearchDigestsForOwnerUserId,
+  syncSkillSearchDigestsForOwnerPublisherId,
 } from "./functions";
 
 describe("package digest sync", () => {
+  it("identifies GitHub mirror eligibility from skill visibility fields", () => {
+    expect(isGitHubMirrorEligibleSkillDoc({ softDeletedAt: undefined })).toBe(true);
+    expect(
+      isGitHubMirrorEligibleSkillDoc({
+        softDeletedAt: undefined,
+        moderationStatus: "active",
+      }),
+    ).toBe(true);
+    expect(
+      isGitHubMirrorEligibleSkillDoc({
+        softDeletedAt: undefined,
+        moderationStatus: "hidden",
+      }),
+    ).toBe(false);
+    expect(
+      isGitHubMirrorEligibleSkillDoc({
+        softDeletedAt: undefined,
+        moderationStatus: "removed",
+      }),
+    ).toBe(false);
+    expect(isGitHubMirrorEligibleSkillDoc({ softDeletedAt: 123 })).toBe(false);
+  });
+
+  it("schedules GitHub mirror deletion for a skill using the owner handle", async () => {
+    const ctx = {
+      db: {
+        get: vi.fn(async (id: string) => {
+          if (id === "users:owner") {
+            return {
+              _id: "users:owner",
+              handle: "alice",
+              deletedAt: undefined,
+              deactivatedAt: undefined,
+            };
+          }
+          return null;
+        }),
+        query: vi.fn(() => ({
+          withIndex: vi.fn(() => ({
+            unique: vi.fn().mockResolvedValue(null),
+          })),
+        })),
+      },
+      scheduler: {
+        runAfter: vi.fn(),
+      },
+    };
+
+    await scheduleGitHubBackupDeletionForSkill(
+      ctx as never,
+      {
+        slug: "hidden-skill",
+        ownerUserId: "users:owner",
+        ownerPublisherId: undefined,
+        softDeletedAt: 123,
+        moderationStatus: "hidden",
+      } as never,
+    );
+
+    expect(ctx.scheduler.runAfter).toHaveBeenCalledWith(
+      0,
+      internal.githubBackupsNode.deleteGitHubBackupForSlugInternal,
+      {
+        ownerHandle: "alice",
+        slug: "hidden-skill",
+      },
+    );
+  });
+
   it("clears latestVersion when the current package release is soft-deleted", async () => {
     const pkg = {
       _id: "packages:demo",
@@ -523,4 +596,68 @@ describe("publisher digest scheduling", () => {
       scheduleOwnerPublisherDigestSync({} as never, "publishers:demo" as never),
     ).resolves.toBeUndefined();
   });
+
+  it("continues owner-publisher package digest sync one page at a time", async () => {
+    const paginate = vi.fn().mockResolvedValue({
+      page: [],
+      isDone: false,
+      continueCursor: "next-packages",
+    });
+    const ctx = {
+      db: {
+        query: vi.fn(() => ({
+          withIndex: vi.fn(() => ({ paginate })),
+        })),
+      },
+      scheduler: {
+        runAfter: vi.fn().mockResolvedValue(undefined),
+      },
+    };
+
+    await syncPackageSearchDigestsForOwnerPublisherId(
+      ctx as never,
+      "publishers:demo" as never,
+      "current-packages",
+    );
+
+    expect(paginate).toHaveBeenCalledTimes(1);
+    expect(paginate).toHaveBeenCalledWith({ cursor: "current-packages", numItems: 100 });
+    expect(ctx.scheduler.runAfter).toHaveBeenCalledWith(
+      0,
+      internal.functions.syncPackageSearchDigestsForOwnerPublisherIdInternal,
+      { ownerPublisherId: "publishers:demo", cursor: "next-packages" },
+    );
+  });
+
+  it("continues owner-publisher skill digest sync one page at a time", async () => {
+    const paginate = vi.fn().mockResolvedValue({
+      page: [],
+      isDone: false,
+      continueCursor: "next-skills",
+    });
+    const ctx = {
+      db: {
+        query: vi.fn(() => ({
+          withIndex: vi.fn(() => ({ paginate })),
+        })),
+      },
+      scheduler: {
+        runAfter: vi.fn().mockResolvedValue(undefined),
+      },
+    };
+
+    await syncSkillSearchDigestsForOwnerPublisherId(
+      ctx as never,
+      "publishers:demo" as never,
+      "current-skills",
+    );
+
+    expect(paginate).toHaveBeenCalledTimes(1);
+    expect(paginate).toHaveBeenCalledWith({ cursor: "current-skills", numItems: 100 });
+    expect(ctx.scheduler.runAfter).toHaveBeenCalledWith(
+      0,
+      internal.functions.syncSkillSearchDigestsForOwnerPublisherIdInternal,
+      { ownerPublisherId: "publishers:demo", cursor: "next-skills" },
+    );
+  });
 });

convex/functions.ts

@@ -33,6 +33,8 @@ function isMissingTableError(error: unknown, table: string) {
 
 type PackageDigestSyncCtx = Pick<MutationCtx, "db">;
 type OwnerPublisherDigestScheduleCtx = Pick<Partial<MutationCtx>, "scheduler">;
+type GitHubBackupDeletionCtx = Pick<MutationCtx, "db" | "scheduler">;
+const OWNER_PUBLISHER_DIGEST_PAGE_SIZE = 100;
 type LatestPackageRelease = Pick<
   Doc<"packageReleases">,
   | "_id"
@@ -170,22 +172,25 @@ export async function syncPackageSearchDigestsForOwnerUserId(
 }
 
 export async function syncPackageSearchDigestsForOwnerPublisherId(
-  ctx: PackageDigestSyncCtx,
+  ctx: PackageDigestSyncCtx & OwnerPublisherDigestScheduleCtx,
   ownerPublisherId: Id<"publishers"> | null | undefined,
+  cursor: string | null = null,
 ) {
   if (!ownerPublisherId) return;
-  let cursor: string | null = null;
   try {
-    while (true) {
-      const page = await ctx.db
-        .query("packages")
-        .withIndex("by_owner_publisher", (q) => q.eq("ownerPublisherId", ownerPublisherId))
-        .paginate({ cursor, numItems: 100 });
-      for (const pkg of page.page) {
-        await syncPackageSearchDigest(ctx, pkg);
-      }
-      if (page.isDone) break;
-      cursor = page.continueCursor;
+    const page = await ctx.db
+      .query("packages")
+      .withIndex("by_owner_publisher", (q) => q.eq("ownerPublisherId", ownerPublisherId))
+      .paginate({ cursor, numItems: OWNER_PUBLISHER_DIGEST_PAGE_SIZE });
+    for (const pkg of page.page) {
+      await syncPackageSearchDigest(ctx, pkg);
+    }
+    if (!page.isDone && ctx.scheduler && page.continueCursor) {
+      await ctx.scheduler.runAfter(
+        0,
+        internal.functions.syncPackageSearchDigestsForOwnerPublisherIdInternal,
+        { ownerPublisherId, cursor: page.continueCursor },
+      );
     }
   } catch (error) {
     if (isMissingTableError(error, "packages")) return;
@@ -213,23 +218,55 @@ async function syncSkillSearchDigestForSkill(
   });
 }
 
+export function isGitHubMirrorEligibleSkillDoc(
+  skill: Pick<Doc<"skills">, "softDeletedAt" | "moderationStatus"> | null | undefined,
+) {
+  if (!skill || skill.softDeletedAt) return false;
+  return (
+    skill.moderationStatus === undefined ||
+    skill.moderationStatus === null ||
+    skill.moderationStatus === "active"
+  );
+}
+
+export async function scheduleGitHubBackupDeletionForSkill(
+  ctx: GitHubBackupDeletionCtx,
+  skill: Pick<
+    Doc<"skills">,
+    "slug" | "ownerPublisherId" | "ownerUserId" | "softDeletedAt" | "moderationStatus"
+  >,
+) {
+  const owner = await getOwnerPublisher(ctx, {
+    ownerPublisherId: skill.ownerPublisherId,
+    ownerUserId: skill.ownerUserId,
+  });
+  const ownerHandle = owner?.handle ?? String(skill.ownerPublisherId ?? skill.ownerUserId);
+  await ctx.scheduler.runAfter(0, internal.githubBackupsNode.deleteGitHubBackupForSlugInternal, {
+    ownerHandle,
+    slug: skill.slug,
+  });
+}
+
 export async function syncSkillSearchDigestsForOwnerPublisherId(
-  ctx: PackageDigestSyncCtx,
+  ctx: PackageDigestSyncCtx & OwnerPublisherDigestScheduleCtx,
   ownerPublisherId: Id<"publishers"> | null | undefined,
+  cursor: string | null = null,
 ) {
   if (!ownerPublisherId) return;
-  let cursor: string | null = null;
   try {
-    while (true) {
-      const page = await ctx.db
-        .query("skills")
-        .withIndex("by_owner_publisher", (q) => q.eq("ownerPublisherId", ownerPublisherId))
-        .paginate({ cursor, numItems: 100 });
-      for (const skill of page.page) {
-        await syncSkillSearchDigestForSkill(ctx, skill);
-      }
-      if (page.isDone) break;
-      cursor = page.continueCursor;
+    const page = await ctx.db
+      .query("skills")
+      .withIndex("by_owner_publisher", (q) => q.eq("ownerPublisherId", ownerPublisherId))
+      .paginate({ cursor, numItems: OWNER_PUBLISHER_DIGEST_PAGE_SIZE });
+    for (const skill of page.page) {
+      await syncSkillSearchDigestForSkill(ctx, skill);
+    }
+    if (!page.isDone && ctx.scheduler && page.continueCursor) {
+      await ctx.scheduler.runAfter(
+        0,
+        internal.functions.syncSkillSearchDigestsForOwnerPublisherIdInternal,
+        { ownerPublisherId, cursor: page.continueCursor },
+      );
     }
   } catch (error) {
     if (isMissingTableError(error, "skills")) return;
@@ -257,18 +294,28 @@ export async function scheduleOwnerPublisherDigestSync(
 export const syncPackageSearchDigestsForOwnerPublisherIdInternal = rawInternalMutation({
   args: {
     ownerPublisherId: v.id("publishers"),
+    cursor: v.optional(v.union(v.string(), v.null())),
   },
   handler: async (ctx, args) => {
-    await syncPackageSearchDigestsForOwnerPublisherId(ctx, args.ownerPublisherId);
+    await syncPackageSearchDigestsForOwnerPublisherId(
+      ctx,
+      args.ownerPublisherId,
+      args.cursor ?? null,
+    );
   },
 });
 
 export const syncSkillSearchDigestsForOwnerPublisherIdInternal = rawInternalMutation({
   args: {
     ownerPublisherId: v.id("publishers"),
+    cursor: v.optional(v.union(v.string(), v.null())),
   },
   handler: async (ctx, args) => {
-    await syncSkillSearchDigestsForOwnerPublisherId(ctx, args.ownerPublisherId);
+    await syncSkillSearchDigestsForOwnerPublisherId(
+      ctx,
+      args.ownerPublisherId,
+      args.cursor ?? null,
+    );
   },
 });
 
@@ -324,12 +371,20 @@ export async function repointPackageLatestRelease(
 
 triggers.register("skills", async (ctx, change) => {
   if (change.operation === "delete") {
+    await scheduleGitHubBackupDeletionForSkill(ctx, change.oldDoc);
     const existing = await ctx.db
       .query("skillSearchDigest")
       .withIndex("by_skill", (q) => q.eq("skillId", change.id))
       .unique();
     if (existing) await ctx.db.delete(existing._id);
   } else {
+    if (
+      change.operation === "update" &&
+      isGitHubMirrorEligibleSkillDoc(change.oldDoc) &&
+      !isGitHubMirrorEligibleSkillDoc(change.newDoc)
+    ) {
+      await scheduleGitHubBackupDeletionForSkill(ctx, change.oldDoc);
+    }
     await syncSkillSearchDigestForSkill(ctx, change.newDoc);
   }
 });

convex/githubBackups.test.ts

@@ -4,69 +4,77 @@ import { getGitHubBackupPageInternal } from "./githubBackups";
 const handler = (getGitHubBackupPageInternal as unknown as { _handler: Function })._handler;
 
 describe("githubBackups page filtering", () => {
-  it("skips non-public skills (soft-deleted, hidden, removed)", async () => {
-    const activeSkill = {
-      _id: "skills:active",
+  it("skips non-public digests (soft-deleted, hidden, removed)", async () => {
+    const activeDigest = {
+      _id: "skillSearchDigest:active",
+      skillId: "skills:active",
       slug: "active-skill",
       displayName: "Active Skill",
       ownerUserId: "users:active",
+      ownerHandle: "alice",
       latestVersionId: "skillVersions:active",
+      latestVersionSummary: {
+        version: "1.0.0",
+        createdAt: 1_700_000_000_000,
+        changelog: "init",
+      },
       softDeletedAt: undefined,
       moderationStatus: "active",
     };
 
-    const hiddenSkill = {
-      _id: "skills:hidden",
+    const hiddenDigest = {
+      _id: "skillSearchDigest:hidden",
+      skillId: "skills:hidden",
       slug: "hidden-skill",
       displayName: "Hidden Skill",
       ownerUserId: "users:hidden",
+      ownerHandle: "bob",
       latestVersionId: "skillVersions:hidden",
+      latestVersionSummary: {
+        version: "1.0.0",
+        createdAt: 1_700_000_000_000,
+        changelog: "init",
+      },
       softDeletedAt: undefined,
       moderationStatus: "hidden",
     };
 
-    const removedSkill = {
-      _id: "skills:removed",
+    const removedDigest = {
+      _id: "skillSearchDigest:removed",
+      skillId: "skills:removed",
       slug: "removed-skill",
       displayName: "Removed Skill",
       ownerUserId: "users:removed",
+      ownerHandle: "carol",
       latestVersionId: "skillVersions:removed",
+      latestVersionSummary: {
+        version: "1.0.0",
+        createdAt: 1_700_000_000_000,
+        changelog: "init",
+      },
       softDeletedAt: undefined,
       moderationStatus: "removed",
     };
 
-    const softDeletedSkill = {
-      _id: "skills:soft",
+    const softDeletedDigest = {
+      _id: "skillSearchDigest:soft",
+      skillId: "skills:soft",
       slug: "soft-skill",
       displayName: "Soft Skill",
       ownerUserId: "users:soft",
+      ownerHandle: "dave",
       latestVersionId: "skillVersions:soft",
+      latestVersionSummary: {
+        version: "1.0.0",
+        createdAt: 1_700_000_000_000,
+        changelog: "init",
+      },
       softDeletedAt: 1,
       moderationStatus: "active",
     };
 
-    const get = vi.fn(async (id: string) => {
-      if (id === "skillVersions:active") {
-        return {
-          _id: "skillVersions:active",
-          version: "1.0.0",
-          files: [{ path: "SKILL.md", size: 10, storageId: "storage:1", sha256: "abc" }],
-          createdAt: 1_700_000_000_000,
-        };
-      }
-      if (id === "users:active") {
-        return {
-          _id: "users:active",
-          handle: "alice",
-          deletedAt: undefined,
-          deactivatedAt: undefined,
-        };
-      }
-      return null;
-    });
-
     const paginate = vi.fn().mockResolvedValue({
-      page: [activeSkill, hiddenSkill, removedSkill, softDeletedSkill],
+      page: [activeDigest, hiddenDigest, removedDigest, softDeletedDigest],
       isDone: true,
       continueCursor: null,
     });
@@ -75,14 +83,12 @@ describe("githubBackups page filtering", () => {
 
     const result = await handler(
       {
-        db: {
-          query,
-          get,
-        },
+        db: { query },
       } as never,
       { batchSize: 50 },
     );
 
+    expect(query).toHaveBeenCalledWith("skillSearchDigest");
     expect(result).toMatchObject({
       isDone: true,
       cursor: null,
@@ -95,42 +101,28 @@ describe("githubBackups page filtering", () => {
         },
       ],
     });
-    expect(get).toHaveBeenCalledTimes(2);
   });
 
-  it("keeps legacy skills with undefined moderationStatus eligible", async () => {
-    const legacySkill = {
-      _id: "skills:legacy",
+  it("keeps legacy digests with undefined moderationStatus eligible", async () => {
+    const legacyDigest = {
+      _id: "skillSearchDigest:legacy",
+      skillId: "skills:legacy",
       slug: "legacy-skill",
       displayName: "Legacy Skill",
       ownerUserId: "users:legacy",
+      ownerHandle: "",
       latestVersionId: "skillVersions:legacy",
+      latestVersionSummary: {
+        version: "2.0.0",
+        createdAt: 1_700_000_000_100,
+        changelog: "update",
+      },
       softDeletedAt: undefined,
       moderationStatus: undefined,
     };
 
-    const get = vi.fn(async (id: string) => {
-      if (id === "skillVersions:legacy") {
-        return {
-          _id: "skillVersions:legacy",
-          version: "2.0.0",
-          files: [{ path: "SKILL.md", size: 20, storageId: "storage:2", sha256: "def" }],
-          createdAt: 1_700_000_000_100,
-        };
-      }
-      if (id === "users:legacy") {
-        return {
-          _id: "users:legacy",
-          handle: null,
-          deletedAt: undefined,
-          deactivatedAt: undefined,
-        };
-      }
-      return null;
-    });
-
     const paginate = vi.fn().mockResolvedValue({
-      page: [legacySkill],
+      page: [legacyDigest],
       isDone: true,
       continueCursor: null,
     });
@@ -139,10 +131,7 @@ describe("githubBackups page filtering", () => {
 
     const result = await handler(
       {
-        db: {
-          query,
-          get,
-        },
+        db: { query },
       } as never,
       {},
     );
@@ -155,4 +144,61 @@ describe("githubBackups page filtering", () => {
       version: "2.0.0",
     });
   });
+
+  it("skips digests without ownerHandle or latestVersionSummary", async () => {
+    const noOwnerHandle = {
+      _id: "skillSearchDigest:no-owner",
+      skillId: "skills:no-owner",
+      slug: "no-owner",
+      displayName: "No Owner",
+      ownerUserId: "users:no-owner",
+      ownerHandle: undefined,
+      latestVersionId: "skillVersions:no-owner",
+      latestVersionSummary: { version: "1.0.0", createdAt: 1, changelog: "init" },
+      softDeletedAt: undefined,
+      moderationStatus: "active",
+    };
+    const noVersion = {
+      _id: "skillSearchDigest:no-version",
+      skillId: "skills:no-version",
+      slug: "no-version",
+      displayName: "No Version",
+      ownerUserId: "users:no-version",
+      ownerHandle: "frank",
+      latestVersionId: undefined,
+      latestVersionSummary: undefined,
+      softDeletedAt: undefined,
+      moderationStatus: "active",
+    };
+
+    const paginate = vi.fn().mockResolvedValue({
+      page: [noOwnerHandle, noVersion],
+      isDone: true,
+      continueCursor: null,
+    });
+    const order = vi.fn().mockReturnValue({ paginate });
+    const query = vi.fn().mockReturnValue({ order });
+
+    const result = await handler({ db: { query } } as never, {});
+
+    expect(result.items).toEqual([
+      { kind: "missingOwner", skillId: "skills:no-owner", ownerUserId: "users:no-owner" },
+      { kind: "missingLatestVersion", skillId: "skills:no-version" },
+    ]);
+  });
+
+  it("resets stale skills-table cursors after switching to digest pagination", async () => {
+    const paginate = vi
+      .fn()
+      .mockRejectedValueOnce(new Error("cursor is from a different query"))
+      .mockResolvedValueOnce({ page: [], isDone: true, continueCursor: null });
+    const order = vi.fn().mockReturnValue({ paginate });
+    const query = vi.fn().mockReturnValue({ order });
+
+    const result = await handler({ db: { query } } as never, { cursor: "stale-cursor" });
+
+    expect(result).toMatchObject({ items: [], isDone: true, cursor: null });
+    expect(paginate).toHaveBeenNthCalledWith(1, { cursor: "stale-cursor", numItems: 50 });
+    expect(paginate).toHaveBeenNthCalledWith(2, { cursor: null, numItems: 50 });
+  });
 });

convex/githubBackups.ts

@@ -1,6 +1,6 @@
 import { v } from "convex/values";
 import { internal } from "./_generated/api";
-import type { Doc, Id } from "./_generated/dataModel";
+import type { Id } from "./_generated/dataModel";
 import { action, internalMutation, internalQuery } from "./functions";
 import { assertRole, requireUserFromAction } from "./lib/access";
 
@@ -17,11 +17,9 @@ type BackupPageItem =
       displayName: string;
       version: string;
       ownerHandle: string;
-      files: Doc<"skillVersions">["files"];
       publishedAt: number;
     }
   | { kind: "missingLatestVersion"; skillId: Id<"skills"> }
-  | { kind: "missingVersionDoc"; skillId: Id<"skills">; versionId: Id<"skillVersions"> }
   | { kind: "missingOwner"; skillId: Id<"skills">; ownerUserId: Id<"users"> };
 
 type BackupPageResult = {
@@ -57,49 +55,52 @@ export const getGitHubBackupPageInternal = internalQuery({
   },
   handler: async (ctx, args): Promise<BackupPageResult> => {
     const batchSize = clampInt(args.batchSize ?? DEFAULT_BATCH_SIZE, 1, MAX_BATCH_SIZE);
-    const { page, isDone, continueCursor } = await ctx.db
-      .query("skills")
-      .order("asc")
-      .paginate({ cursor: args.cursor ?? null, numItems: batchSize });
+    let pageResult;
+    try {
+      pageResult = await ctx.db
+        .query("skillSearchDigest")
+        .order("asc")
+        .paginate({ cursor: args.cursor ?? null, numItems: batchSize });
+    } catch (error) {
+      if (!args.cursor || !isStaleCursorError(error)) throw error;
+      pageResult = await ctx.db
+        .query("skillSearchDigest")
+        .order("asc")
+        .paginate({ cursor: null, numItems: batchSize });
+    }
 
     const items: BackupPageItem[] = [];
-    for (const skill of page) {
-      if (!isPubliclyAvailableSkill(skill)) continue;
-      if (!skill.latestVersionId) {
-        items.push({ kind: "missingLatestVersion", skillId: skill._id });
+    for (const digest of pageResult.page) {
+      if (!isPubliclyAvailableSkill(digest)) continue;
+      if (!digest.latestVersionId || !digest.latestVersionSummary) {
+        items.push({ kind: "missingLatestVersion", skillId: digest.skillId });
         continue;
       }
 
-      const version = await ctx.db.get(skill.latestVersionId);
-      if (!version) {
+      if (digest.ownerHandle === undefined) {
         items.push({
-          kind: "missingVersionDoc",
-          skillId: skill._id,
-          versionId: skill.latestVersionId,
+          kind: "missingOwner",
+          skillId: digest.skillId,
+          ownerUserId: digest.ownerUserId,
         });
         continue;
       }
 
-      const owner = await ctx.db.get(skill.ownerUserId);
-      if (!owner || owner.deletedAt || owner.deactivatedAt) {
-        items.push({ kind: "missingOwner", skillId: skill._id, ownerUserId: skill.ownerUserId });
-        continue;
-      }
-
+      const ownerHandle =
+        digest.ownerHandle || String(digest.ownerPublisherId ?? digest.ownerUserId);
       items.push({
         kind: "ok",
-        skillId: skill._id,
-        versionId: version._id,
-        slug: skill.slug,
-        displayName: skill.displayName,
-        version: version.version,
-        ownerHandle: owner.handle ?? owner._id,
-        files: version.files,
-        publishedAt: version.createdAt,
+        skillId: digest.skillId,
+        versionId: digest.latestVersionId,
+        slug: digest.slug,
+        displayName: digest.displayName,
+        version: digest.latestVersionSummary.version,
+        ownerHandle,
+        publishedAt: digest.latestVersionSummary.createdAt,
       });
     }
 
-    return { items, cursor: continueCursor, isDone };
+    return { items, cursor: pageResult.continueCursor, isDone: pageResult.isDone };
   },
 });
 
@@ -115,6 +116,19 @@ function isPubliclyAvailableSkill(skill: {
   );
 }
 
+function isStaleCursorError(error: unknown) {
+  const message =
+    typeof error === "string"
+      ? error
+      : error && typeof error === "object" && "message" in error
+        ? String((error as { message?: unknown }).message)
+        : "";
+  return (
+    message.includes("Failed to parse cursor") ||
+    message.includes("cursor is from a different query")
+  );
+}
+
 export const getGitHubBackupSyncStateInternal = internalQuery({
   args: {},
   handler: async (ctx): Promise<BackupSyncState> => {

convex/githubBackupsNode.ts

@@ -25,15 +25,14 @@ const MAX_PRUNE_BATCH_SIZE = 100;
 type BackupPageItem =
   | {
       kind: "ok";
+      versionId: Doc<"skillVersions">["_id"];
       slug: string;
       version: string;
       displayName: string;
       ownerHandle: string;
-      files: Doc<"skillVersions">["files"];
       publishedAt: number;
     }
   | { kind: "missingLatestVersion" }
-  | { kind: "missingVersionDoc" }
   | { kind: "missingOwner" };
 
 export type GitHubBackupSyncStats = {
@@ -136,7 +135,7 @@ export async function syncGitHubBackupsInternalHandler(
 
     for (const item of page.items) {
       if (item.kind !== "ok") {
-        if (item.kind === "missingLatestVersion" || item.kind === "missingVersionDoc") {
+        if (item.kind === "missingLatestVersion") {
           stats.skillsMissingVersion += 1;
         } else if (item.kind === "missingOwner") {
           stats.skillsMissingOwner += 1;
@@ -152,6 +151,14 @@ export async function syncGitHubBackupsInternalHandler(
           continue;
         }
 
+        const version = (await ctx.runQuery(internal.skills.getVersionByIdInternal, {
+          versionId: item.versionId,
+        })) as Doc<"skillVersions"> | null;
+        if (!version) {
+          stats.skillsMissingVersion += 1;
+          continue;
+        }
+
         if (!dryRun) {
           await backupSkillToGitHub(
             ctx,
@@ -160,7 +167,7 @@ export async function syncGitHubBackupsInternalHandler(
               version: item.version,
               displayName: item.displayName,
               ownerHandle: item.ownerHandle,
-              files: item.files,
+              files: version.files,
               publishedAt: item.publishedAt,
             },
             context,

convex/httpApi.handlers.test.ts

@@ -422,13 +422,8 @@ describe("httpApi handlers", () => {
     expect(json.skillId).toBe("s");
   });
 
-  it("cliPublishHttp accepts legacy clients that omit license terms", async () => {
+  it("cliPublishHttp rejects omitted license terms", async () => {
     vi.mocked(requireApiTokenUser).mockResolvedValueOnce({ userId: "user1" } as never);
-    vi.mocked(publishVersionForUser).mockResolvedValueOnce({
-      skillId: "s",
-      versionId: "v",
-      embeddingId: "e",
-    } as never);
     const request = new Request("https://x/api/cli/publish", {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -441,7 +436,9 @@ describe("httpApi handlers", () => {
       }),
     });
     const response = await __handlers.cliPublishHandler(makeCtx({}), request);
-    expect(response.status).toBe(200);
+    expect(response.status).toBe(400);
+    expect(await response.text()).toMatch(/license terms must be accepted/i);
+    expect(publishVersionForUser).not.toHaveBeenCalled();
   });
 
   it("cliPublishHttp rejects explicit license refusal", async () => {

convex/httpApi.ts

@@ -183,7 +183,7 @@ async function cliPublishHandler(ctx: ActionCtx, request: Request) {
 }
 
 function hasAcceptedLegacyLicenseTerms(acceptLicenseTerms: boolean | undefined) {
-  return acceptLicenseTerms !== false;
+  return acceptLicenseTerms === true;
 }
 
 export const cliPublishHttp = httpAction(cliPublishHandler);

convex/httpApiV1.handlers.test.ts

@@ -724,6 +724,9 @@ describe("httpApiV1 handlers", () => {
 
   it("lists skills supports sort aliases", async () => {
     const checks: Array<[string, string | null]> = [
+      ["createdAt", "newest"],
+      ["created-at", "newest"],
+      ["newest", "newest"],
       ["rating", "stars"],
       ["installs", "installs"],
       ["installs-all-time", "installs"],
@@ -1923,16 +1926,11 @@ describe("httpApiV1 handlers", () => {
     expect(publishVersionForUser).toHaveBeenCalled();
   });
 
-  it("publish json accepts legacy clients that omit license terms", async () => {
+  it("publish json rejects omitted license terms", async () => {
     vi.mocked(requireApiTokenUser).mockResolvedValueOnce({
       userId: "users:1",
       user: { handle: "p" },
     } as never);
-    vi.mocked(publishVersionForUser).mockResolvedValueOnce({
-      skillId: "s",
-      versionId: "v",
-      embeddingId: "e",
-    } as never);
     const runMutation = vi.fn().mockResolvedValue(okRate());
     const body = JSON.stringify({
       slug: "demo",
@@ -1957,7 +1955,9 @@ describe("httpApiV1 handlers", () => {
         body,
       }),
     );
-    expect(response.status).toBe(200);
+    expect(response.status).toBe(400);
+    expect(await response.text()).toMatch(/license terms must be accepted/i);
+    expect(publishVersionForUser).not.toHaveBeenCalled();
   });
 
   it("publish multipart succeeds", async () => {
@@ -1997,16 +1997,11 @@ describe("httpApiV1 handlers", () => {
     }
   });
 
-  it("publish multipart accepts legacy clients that omit license terms", async () => {
+  it("publish multipart rejects omitted license terms", async () => {
     vi.mocked(requireApiTokenUser).mockResolvedValueOnce({
       userId: "users:1",
       user: { handle: "p" },
     } as never);
-    vi.mocked(publishVersionForUser).mockResolvedValueOnce({
-      skillId: "s",
-      versionId: "v",
-      embeddingId: "e",
-    } as never);
     const runMutation = vi.fn().mockResolvedValue(okRate());
     const form = new FormData();
     form.set(
@@ -2028,7 +2023,9 @@ describe("httpApiV1 handlers", () => {
         body: form,
       }),
     );
-    expect(response.status).toBe(200);
+    expect(response.status).toBe(400);
+    expect(await response.text()).toMatch(/license terms must be accepted/i);
+    expect(publishVersionForUser).not.toHaveBeenCalled();
   });
 
   it("publish rejects explicit license refusal", async () => {
@@ -2504,6 +2501,71 @@ describe("httpApiV1 handlers", () => {
     );
   });
 
+  it("unban user requires auth", async () => {
+    vi.mocked(requireApiTokenUser).mockRejectedValueOnce(new Error("Unauthorized"));
+    const runMutation = vi.fn().mockResolvedValue(okRate());
+    const response = await __handlers.usersPostRouterV1Handler(
+      makeCtx({ runMutation }),
+      new Request("https://example.com/api/v1/users/unban", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ handle: "demo" }),
+      }),
+    );
+    expect(response.status).toBe(401);
+  });
+
+  it("unban user succeeds with handle", async () => {
+    vi.mocked(requireApiTokenUser).mockResolvedValue({
+      userId: "users:1",
+      user: { handle: "p" },
+    } as never);
+    const runQuery = vi.fn().mockResolvedValue({ _id: "users:2" });
+    const runMutation = vi
+      .fn()
+      .mockResolvedValueOnce(okRate())
+      .mockResolvedValueOnce({ ok: true, alreadyUnbanned: false, restoredSkills: 2 });
+    const response = await __handlers.usersPostRouterV1Handler(
+      makeCtx({ runQuery, runMutation }),
+      new Request("https://example.com/api/v1/users/unban", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ handle: "demo" }),
+      }),
+    );
+    expect(response.status).toBe(200);
+    const json = await response.json();
+    expect(json.restoredSkills).toBe(2);
+  });
+
+  it("unban user forwards reason", async () => {
+    vi.mocked(requireApiTokenUser).mockResolvedValue({
+      userId: "users:1",
+      user: { handle: "p" },
+    } as never);
+    const runQuery = vi.fn().mockResolvedValue({ _id: "users:2" });
+    const runMutation = vi
+      .fn()
+      .mockResolvedValueOnce(okRate())
+      .mockResolvedValueOnce({ ok: true, alreadyUnbanned: false, restoredSkills: 0 });
+    await __handlers.usersPostRouterV1Handler(
+      makeCtx({ runQuery, runMutation }),
+      new Request("https://example.com/api/v1/users/unban", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ handle: "demo", reason: "appeal accepted" }),
+      }),
+    );
+    expect(runMutation).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        actorUserId: "users:1",
+        targetUserId: "users:2",
+        reason: "appeal accepted",
+      }),
+    );
+  });
+
   it("set role requires auth", async () => {
     vi.mocked(requireApiTokenUser).mockRejectedValueOnce(new Error("Unauthorized"));
     const runMutation = vi.fn().mockResolvedValue(okRate());
@@ -3628,6 +3690,9 @@ describe("httpApiV1 handlers", () => {
       "package/package.json",
     ]);
     expect(zipEntries["_meta.json"]).toBeUndefined();
+    expect(runMutation).toHaveBeenCalledWith(internal.packages.recordPackageDownloadInternal, {
+      packageId: "packages:1",
+    });
   });
 
   it("package download fails when any stored file is missing", async () => {

convex/httpApiV1/packagesV1.ts

@@ -7,8 +7,8 @@ import {
 import { api, internal } from "../_generated/api";
 import type { Doc, Id } from "../_generated/dataModel";
 import type { ActionCtx } from "../_generated/server";
-import { getOptionalApiTokenUserId } from "../lib/apiTokenAuth";
 import { getOptionalActiveAuthUserIdFromAction } from "../lib/access";
+import { getOptionalApiTokenUserId } from "../lib/apiTokenAuth";
 import {
   fetchGitHubRepositoryIdentity,
   verifyGitHubActionsTrustedPublishJwt,
@@ -62,6 +62,7 @@ const internalRefs = internal as unknown as {
     getReleaseByPackageAndVersionInternal: unknown;
     getReleaseByIdInternal: unknown;
     insertAuditLogInternal: unknown;
+    recordPackageDownloadInternal: unknown;
     requestRescanForApiTokenInternal: unknown;
     softDeletePackageInternal: unknown;
   };
@@ -104,6 +105,7 @@ type PackageListQueryArgs = {
   family?: "skill" | "code-plugin" | "bundle-plugin";
   channel?: "official" | "community" | "private";
   isOfficial?: boolean;
+  highlightedOnly?: boolean;
   executesCode?: boolean;
   capabilityTag?: string;
   viewerUserId?: Id<"users">;
@@ -458,6 +460,7 @@ async function searchPackageCatalogByListing(
     family?: "skill" | "code-plugin" | "bundle-plugin";
     channel?: "official" | "community" | "private";
     isOfficial?: boolean;
+    highlightedOnly?: boolean;
     executesCode?: boolean;
     capabilityTag?: string;
     viewerUserId?: Id<"users">;
@@ -482,6 +485,7 @@ async function searchPackageCatalogByListing(
       family: args.family,
       channel: args.channel,
       isOfficial: args.isOfficial,
+      highlightedOnly: args.highlightedOnly,
       executesCode: args.executesCode,
       capabilityTag: args.capabilityTag,
       viewerUserId: args.viewerUserId,
@@ -650,6 +654,11 @@ async function listPackages(
   const channelRaw = url.searchParams.get("channel")?.trim();
   const capabilityTag = url.searchParams.get("capabilityTag")?.trim() || undefined;
   const isOfficialRaw = url.searchParams.get("isOfficial");
+  const highlightedOnly =
+    url.searchParams.get("featured") === "true" ||
+    url.searchParams.get("featured") === "1" ||
+    url.searchParams.get("highlightedOnly") === "true" ||
+    url.searchParams.get("highlightedOnly") === "1";
   const executesCodeRaw = url.searchParams.get("executesCode");
   const effectiveFamily =
     family ??
@@ -674,6 +683,7 @@ async function listPackages(
     }>(ctx, apiRefs.skills.listPackageCatalogPage, {
       channel,
       isOfficial,
+      highlightedOnly: highlightedOnly || undefined,
       executesCode,
       capabilityTag,
       paginationOpts: { cursor, numItems: limit },
@@ -701,6 +711,7 @@ async function listPackages(
           }>(ctx, internalRefs.packages.listPageForViewerInternal, {
             channel,
             isOfficial,
+            highlightedOnly: highlightedOnly || undefined,
             executesCode,
             capabilityTag,
             viewerUserId: viewerUserId ?? undefined,
@@ -720,6 +731,7 @@ async function listPackages(
           }>(ctx, apiRefs.skills.listPackageCatalogPage, {
             channel,
             isOfficial,
+            highlightedOnly: highlightedOnly || undefined,
             executesCode,
             capabilityTag,
             paginationOpts: { cursor: pageCursor, numItems },
@@ -783,6 +795,7 @@ async function listPackages(
         family: pluginFamily,
         channel,
         isOfficial,
+        highlightedOnly: highlightedOnly || undefined,
         executesCode,
         capabilityTag,
         viewerUserId: viewerUserId ?? undefined,
@@ -850,6 +863,7 @@ async function listPackages(
     family: effectiveFamily,
     channel,
     isOfficial,
+    highlightedOnly: highlightedOnly || undefined,
     executesCode,
     capabilityTag,
     viewerUserId: viewerUserId ?? undefined,
@@ -1279,6 +1293,11 @@ async function searchPackages(
   const familyRaw = url.searchParams.get("family");
   const channelRaw = url.searchParams.get("channel");
   const isOfficialRaw = url.searchParams.get("isOfficial");
+  const highlightedOnly =
+    url.searchParams.get("featured") === "true" ||
+    url.searchParams.get("featured") === "1" ||
+    url.searchParams.get("highlightedOnly") === "true" ||
+    url.searchParams.get("highlightedOnly") === "1";
   const executesCodeRaw = url.searchParams.get("executesCode");
   const capabilityTag = url.searchParams.get("capabilityTag")?.trim() || undefined;
   const family =
@@ -1305,6 +1324,7 @@ async function searchPackages(
         limit,
         channel,
         isOfficial,
+        highlightedOnly: highlightedOnly || undefined,
         executesCode,
         capabilityTag,
       },
@@ -1319,6 +1339,7 @@ async function searchPackages(
             family: pluginFamily,
             channel,
             isOfficial,
+            highlightedOnly: highlightedOnly || undefined,
             executesCode,
             capabilityTag,
             viewerUserId: viewerUserId ?? undefined,
@@ -1343,6 +1364,7 @@ async function searchPackages(
         family,
         channel,
         isOfficial,
+        highlightedOnly: highlightedOnly || undefined,
         executesCode,
         capabilityTag,
         viewerUserId: viewerUserId ?? undefined,
@@ -1355,6 +1377,7 @@ async function searchPackages(
         limit,
         channel,
         isOfficial,
+        highlightedOnly: highlightedOnly || undefined,
         executesCode,
         capabilityTag,
         viewerUserId: viewerUserId ?? undefined,
@@ -1364,6 +1387,7 @@ async function searchPackages(
         limit,
         channel,
         isOfficial,
+        highlightedOnly: highlightedOnly || undefined,
         executesCode,
         capabilityTag,
       }),
@@ -1666,6 +1690,13 @@ export async function packagesGetRouterV1Handler(ctx: ActionCtx, request: Reques
       });
     }
     const zip = buildDeterministicPackageZip(entries);
+    try {
+      await runMutationRef(ctx, internalRefs.packages.recordPackageDownloadInternal, {
+        packageId: publicPackage!._id,
+      });
+    } catch {
+      // Best-effort metric path; never fail package downloads.
+    }
     return new Response(new Blob([zip], { type: "application/zip" }), {
       status: 200,
       headers: mergeHeaders(

convex/httpApiV1/skillsV1.ts

@@ -5,7 +5,11 @@ import type { ActionCtx } from "../_generated/server";
 import { getOptionalApiTokenUserId, requireApiTokenUser } from "../lib/apiTokenAuth";
 import { applyRateLimit, parseBearerToken } from "../lib/httpRateLimit";
 import { parseBooleanQueryParam, resolveBooleanQueryParam } from "../lib/httpUtils";
-import type { LlmEvalDimension } from "../lib/securityPrompt";
+import type {
+  LlmAgenticRiskFinding,
+  LlmEvalDimension,
+  LlmRiskSummary,
+} from "../lib/securityPrompt";
 import { publishVersionForUser } from "../skills";
 import {
   MAX_RAW_FILE_BYTES,
@@ -225,6 +229,8 @@ type SkillSecuritySnapshot = {
       dimensions: LlmEvalDimension[] | null;
       guidance: string | null;
       findings: string | null;
+      agenticRiskFindings: LlmAgenticRiskFinding[] | null;
+      riskSummary: LlmRiskSummary | null;
       model: string | null;
       checkedAt: number | null;
     } | null;
@@ -372,6 +378,8 @@ function buildSkillSecuritySnapshot(
             dimensions: llm.dimensions ?? null,
             guidance: llm.guidance ?? null,
             findings: llm.findings ?? null,
+            agenticRiskFindings: llm.agenticRiskFindings ?? null,
+            riskSummary: llm.riskSummary ?? null,
             model: llm.model ?? null,
             checkedAt: llm.checkedAt ?? null,
           }
@@ -439,6 +447,7 @@ export async function resolveSkillVersionV1Handler(ctx: ActionCtx, request: Requ
 }
 
 type SkillListSort =
+  | "createdAt"
   | "updated"
   | "downloads"
   | "stars"
@@ -446,10 +455,13 @@ type SkillListSort =
   | "installsAllTime"
   | "trending";
 
-type PublicListSort = "updated" | "downloads" | "stars" | "installs";
+type PublicListSort = "newest" | "updated" | "downloads" | "stars" | "installs";
 
 function parseListSort(value: string | null): SkillListSort {
   const normalized = value?.trim().toLowerCase();
+  if (normalized === "createdat" || normalized === "created-at" || normalized === "newest") {
+    return "createdAt";
+  }
   if (normalized === "downloads") return "downloads";
   if (normalized === "stars" || normalized === "rating") return "stars";
   if (
@@ -468,6 +480,7 @@ function parseListSort(value: string | null): SkillListSort {
 }
 
 function toPublicListSort(sort: Exclude<SkillListSort, "trending">): PublicListSort {
+  if (sort === "createdAt") return "newest";
   if (sort === "updated") return "updated";
   if (sort === "downloads" || sort === "stars") return sort;
   return "installs";
@@ -966,7 +979,7 @@ export async function publishSkillV1Handler(ctx: ActionCtx, request: Request) {
 }
 
 function hasAcceptedLegacyLicenseTerms(acceptLicenseTerms: boolean | undefined) {
-  return acceptLicenseTerms !== false;
+  return acceptLicenseTerms === true;
 }
 
 type TransferDecisionAction = "accept" | "reject" | "cancel";

convex/httpApiV1/usersV1.ts

@@ -24,6 +24,7 @@ export async function usersPostRouterV1Handler(ctx: ActionCtx, request: Request)
   const action = segments[0];
   if (
     action !== "ban" &&
+    action !== "unban" &&
     action !== "role" &&
     action !== "restore" &&
     action !== "reclaim" &&
@@ -109,6 +110,30 @@ export async function usersPostRouterV1Handler(ctx: ActionCtx, request: Request)
     }
   }
 
+  if (action === "unban") {
+    const reason = reasonRaw.length > 0 ? reasonRaw : undefined;
+    if (reason && reason.length > 500) {
+      return text("Reason too long (max 500 chars)", 400, rate.headers);
+    }
+    try {
+      const result = await ctx.runMutation(internal.users.unbanUserInternal, {
+        actorUserId,
+        targetUserId,
+        reason,
+      });
+      return json(result, 200, rate.headers);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unban failed";
+      if (message.toLowerCase().includes("forbidden")) {
+        return text("Forbidden", 403, rate.headers);
+      }
+      if (message.toLowerCase().includes("not found")) {
+        return text(message, 404, rate.headers);
+      }
+      return text(message, 400, rate.headers);
+    }
+  }
+
   if (!role) {
     return text("Invalid role", 400, rate.headers);
   }

convex/lib/depRegistryScan.test.ts

@@ -0,0 +1,100 @@
+import { describe, expect, it } from "vitest";
+import {
+  depRegistryUrl,
+  mergeDepRegistryFinding,
+  parseDependencyFile,
+  summarizeDepRegistryChecks,
+} from "./depRegistryScan";
+import { summarizeReasonCodes, verdictFromCodes } from "./moderationReasonCodes";
+
+describe("depRegistryScan", () => {
+  it("parses registry dependency manifests and skips vendored or non-registry specs", () => {
+    expect(
+      parseDependencyFile(
+        "package.json",
+        JSON.stringify({
+          dependencies: {
+            "@types/node": "^24.0.0",
+            local: "file:../local",
+            remote: "github:owner/repo",
+          },
+          optionalDependencies: {
+            undici: "^7.0.0",
+          },
+        }),
+      ),
+    ).toEqual([
+      { name: "@types/node", registry: "npm", source: "package.json" },
+      { name: "undici", registry: "npm", source: "package.json" },
+    ]);
+
+    expect(
+      parseDependencyFile("vendor/package.json", '{"dependencies":{"phantom":"1.0.0"}}'),
+    ).toEqual([]);
+    expect(
+      parseDependencyFile(
+        "requirements.txt",
+        ["requests>=2", "demo @ git+https://example.test/demo.git", "-r dev.txt"].join("\n"),
+      ),
+    ).toEqual([{ name: "requests", registry: "pypi", source: "requirements.txt" }]);
+  });
+
+  it("keeps npm scope names compatible with registry URL lookup", () => {
+    expect(depRegistryUrl("npm", "@types/node")).toBe("https://registry.npmjs.org/@types%2Fnode");
+  });
+
+  it("does not produce clean status when registry lookups are unresolved", () => {
+    const analysis = summarizeDepRegistryChecks({
+      checkedAt: 123,
+      results: [{ name: "requests", registry: "pypi", source: "requirements.txt", exists: true }],
+      unresolved: [
+        {
+          name: "maybe-real",
+          registry: "npm",
+          source: "package.json",
+          reason: "network error",
+        },
+      ],
+    });
+
+    expect(analysis.status).toBe("error");
+    expect(analysis.notFoundPackages).toEqual([]);
+    expect(analysis.unresolvedPackages).toEqual(["maybe-real (npm)"]);
+  });
+
+  it("injects a static finding only for confirmed missing packages", () => {
+    const suspicious = summarizeDepRegistryChecks({
+      checkedAt: 456,
+      results: [
+        {
+          name: "phantom-package-xyz",
+          registry: "npm",
+          source: "package.json",
+          exists: false,
+          httpStatus: 404,
+        },
+      ],
+      unresolved: [],
+    });
+
+    const merged = mergeDepRegistryFinding({
+      staticScan: undefined,
+      analysis: suspicious,
+      statusFromCodes: verdictFromCodes,
+      summarizeCodes: summarizeReasonCodes,
+    });
+
+    expect(merged.status).toBe("suspicious");
+    expect(merged.reasonCodes).toEqual(["suspicious.dep_not_found_on_registry"]);
+    expect(merged.findings[0]?.file).toBe("Dependency manifests");
+
+    const cleanAgain = mergeDepRegistryFinding({
+      staticScan: merged,
+      analysis: summarizeDepRegistryChecks({ checkedAt: 789, results: [], unresolved: [] }),
+      statusFromCodes: verdictFromCodes,
+      summarizeCodes: summarizeReasonCodes,
+    });
+    expect(cleanAgain.status).toBe("clean");
+    expect(cleanAgain.findings).toEqual([]);
+  });
+});

convex/lib/depRegistryScan.ts

@@ -0,0 +1,321 @@
+import {
+  MODERATION_ENGINE_VERSION,
+  REASON_CODES,
+  type ModerationFinding,
+  type ModerationVerdict,
+} from "./moderationReasonCodes";
+
+export const SUPPORTED_DEP_REGISTRIES = ["pypi", "npm", "cargo"] as const;
+
+export type SupportedDepRegistry = (typeof SUPPORTED_DEP_REGISTRIES)[number];
+
+export type DepRegistryStatus = "clean" | "suspicious" | "error";
+
+export type DepEntry = {
+  name: string;
+  registry: SupportedDepRegistry;
+  source: string;
+};
+
+export type DepRegistryResult = DepEntry & {
+  exists: boolean;
+  httpStatus?: number;
+};
+
+export type DepRegistryUnresolved = DepEntry & {
+  reason: string;
+};
+
+export type DepRegistryAnalysis = {
+  status: DepRegistryStatus;
+  results: DepRegistryResult[];
+  notFoundPackages: string[];
+  unresolvedPackages: string[];
+  summary: string;
+  checkedAt: number;
+};
+
+const DEP_FILE_PARSERS: Record<string, (content: string, path: string) => DepEntry[]> = {
+  "requirements.txt": parseRequirementsTxt,
+  "requirements-dev.txt": parseRequirementsTxt,
+  "requirements_dev.txt": parseRequirementsTxt,
+  "requirements-test.txt": parseRequirementsTxt,
+  "requirements_test.txt": parseRequirementsTxt,
+  "package.json": parsePackageJson,
+  "cargo.toml": parseCargoToml,
+  "pyproject.toml": parsePyprojectToml,
+};
+
+const NON_REGISTRY_NPM_SPEC_PREFIXES = [
+  "file:",
+  "link:",
+  "git+",
+  "git://",
+  "github:",
+  "bitbucket:",
+  "gist:",
+  "http:",
+  "https:",
+  "workspace:",
+  "npm:",
+];
+
+const VENDORED_PATH_PATTERNS = [
+  /(^|\/)node_modules\//,
+  /(^|\/)vendor\//,
+  /(^|\/)__pycache__\//,
+  /(^|\/)\.venv\//,
+  /(^|\/)venv\//,
+  /(^|\/)target\//,
+  /(^|\/)\.cargo\//,
+  /(^|\/)dist\//,
+  /(^|\/)build\//,
+];
+
+function normalizeName(name: string, registry: SupportedDepRegistry) {
+  const normalized = name.trim().toLowerCase();
+  return registry === "cargo" ? normalized.replaceAll("_", "-") : normalized;
+}
+
+export function isVendoredDependencyPath(path: string) {
+  return VENDORED_PATH_PATTERNS.some((pattern) => pattern.test(path));
+}
+
+export function parseDependencyFile(path: string, content: string): DepEntry[] {
+  if (isVendoredDependencyPath(path)) return [];
+  const basename = path.split("/").pop()?.toLowerCase() ?? "";
+  const parser = DEP_FILE_PARSERS[basename];
+  return parser ? dedupeDeps(parser(content, path)) : [];
+}
+
+export function dedupeDeps(entries: DepEntry[]) {
+  const seen = new Set<string>();
+  return entries.filter((entry) => {
+    const key = `${entry.registry}:${entry.name}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
+function stripInlineComment(line: string) {
+  return line.replace(/\s+#.*$/, "").trim();
+}
+
+function parseRequirementsTxt(content: string, path: string): DepEntry[] {
+  const entries: DepEntry[] = [];
+  for (const rawLine of content.split("\n")) {
+    const line = stripInlineComment(rawLine);
+    if (!line || line.startsWith("-")) continue;
+    if (/^(?:git\+|https?:|file:|\.{0,2}\/)/i.test(line)) continue;
+    if (/\s@\s/.test(line)) continue;
+    const match = line.match(/^([a-zA-Z0-9_][a-zA-Z0-9._-]*)/);
+    if (!match) continue;
+    entries.push({ name: normalizeName(match[1], "pypi"), registry: "pypi", source: path });
+  }
+  return entries;
+}
+
+function parsePackageJson(content: string, path: string): DepEntry[] {
+  const entries: DepEntry[] = [];
+  let pkg: Record<string, unknown>;
+  try {
+    pkg = JSON.parse(content) as Record<string, unknown>;
+  } catch {
+    return entries;
+  }
+
+  for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
+    const deps = pkg[field];
+    if (!deps || typeof deps !== "object" || Array.isArray(deps)) continue;
+    for (const [rawName, rawSpec] of Object.entries(deps as Record<string, unknown>)) {
+      const spec = typeof rawSpec === "string" ? rawSpec.trim().toLowerCase() : "";
+      if (NON_REGISTRY_NPM_SPEC_PREFIXES.some((prefix) => spec.startsWith(prefix))) continue;
+      entries.push({ name: normalizeName(rawName, "npm"), registry: "npm", source: path });
+    }
+  }
+  return entries;
+}
+
+function parseCargoToml(content: string, path: string): DepEntry[] {
+  const entries: DepEntry[] = [];
+  let inDepSection = false;
+  for (const rawLine of content.split("\n")) {
+    const line = stripInlineComment(rawLine);
+    if (/^\[.*\]$/.test(line)) {
+      const section = line.replace(/[[\]\s]/g, "").toLowerCase();
+      inDepSection =
+        section === "dependencies" ||
+        section === "dev-dependencies" ||
+        section === "build-dependencies";
+      continue;
+    }
+    if (!inDepSection || !line) continue;
+    const match = line.match(/^([a-zA-Z0-9_][a-zA-Z0-9_-]*)\s*=/);
+    if (!match) continue;
+    entries.push({ name: normalizeName(match[1], "cargo"), registry: "cargo", source: path });
+  }
+  return entries;
+}
+
+function parsePyprojectToml(content: string, path: string): DepEntry[] {
+  const entries: DepEntry[] = [];
+  let inDepArray = false;
+  let inPoetryDepTable = false;
+  for (const rawLine of content.split("\n")) {
+    const line = stripInlineComment(rawLine);
+    if (/^\[.*\]$/.test(line)) {
+      inDepArray = false;
+      const section = line.replace(/[[\]\s]/g, "").toLowerCase();
+      inPoetryDepTable =
+        section === "tool.poetry.dependencies" ||
+        section === "tool.poetry.dev-dependencies" ||
+        section === "tool.poetry.group.dev.dependencies";
+      continue;
+    }
+    if (/^dependencies\s*=\s*\[/.test(line)) {
+      inDepArray = true;
+      const inline = line.match(/\[\s*(.*)\s*\]/);
+      if (inline) {
+        for (const item of extractQuotedStrings(inline[1])) addPyPiDependency(entries, item, path);
+        inDepArray = false;
+      }
+      continue;
+    }
+    if (inDepArray) {
+      if (line === "]") {
+        inDepArray = false;
+        continue;
+      }
+      const quoted = line.match(/^["']([^"']+)["']/);
+      if (quoted) addPyPiDependency(entries, quoted[1], path);
+      continue;
+    }
+    if (!inPoetryDepTable || !line) continue;
+    const match = line.match(/^([a-zA-Z0-9_][a-zA-Z0-9._-]*)\s*=/);
+    if (!match || match[1].toLowerCase() === "python") continue;
+    entries.push({ name: normalizeName(match[1], "pypi"), registry: "pypi", source: path });
+  }
+  return entries;
+}
+
+function addPyPiDependency(entries: DepEntry[], spec: string, path: string) {
+  if (/\s@\s/.test(spec)) return;
+  const match = spec.match(/^([a-zA-Z0-9_][a-zA-Z0-9._-]*)/);
+  if (!match) return;
+  entries.push({ name: normalizeName(match[1], "pypi"), registry: "pypi", source: path });
+}
+
+function extractQuotedStrings(s: string) {
+  return [...s.matchAll(/["']([^"']+)["']/g)].map((match) => match[1]);
+}
+
+export function depRegistryUrl(registry: SupportedDepRegistry, packageName: string) {
+  const encoded =
+    registry === "npm" && packageName.startsWith("@")
+      ? `@${encodeURIComponent(packageName.slice(1))}`
+      : encodeURIComponent(packageName);
+  if (registry === "pypi") return `https://pypi.org/pypi/${encoded}/json`;
+  if (registry === "npm") return `https://registry.npmjs.org/${encoded}`;
+  return `https://crates.io/api/v1/crates/${encoded}`;
+}
+
+export function summarizeDepRegistryChecks(params: {
+  results: DepRegistryResult[];
+  unresolved: DepRegistryUnresolved[];
+  checkedAt?: number;
+}): DepRegistryAnalysis {
+  const notFound = params.results.filter((result) => !result.exists);
+  const notFoundPackages = notFound.map((result) => `${result.name} (${result.registry})`);
+  const unresolvedPackages = params.unresolved.map(
+    (result) => `${result.name} (${result.registry})`,
+  );
+  const checkedAt = params.checkedAt ?? Date.now();
+
+  if (notFoundPackages.length > 0) {
+    const partial =
+      unresolvedPackages.length > 0
+        ? ` ${unresolvedPackages.length} package(s) could not be checked and will be retried.`
+        : "";
+    return {
+      status: "suspicious",
+      results: params.results,
+      notFoundPackages,
+      unresolvedPackages,
+      summary: `${notFoundPackages.length} declared dependency package(s) were not found on their public registry: ${notFoundPackages.join(", ")}.${partial}`,
+      checkedAt,
+    };
+  }
+
+  if (unresolvedPackages.length > 0) {
+    return {
+      status: "error",
+      results: params.results,
+      notFoundPackages: [],
+      unresolvedPackages,
+      summary: `${unresolvedPackages.length} dependency package(s) could not be verified due to registry lookup errors. The scan will be retried.`,
+      checkedAt,
+    };
+  }
+
+  return {
+    status: "clean",
+    results: params.results,
+    notFoundPackages: [],
+    unresolvedPackages: [],
+    summary: `All ${params.results.length} declared dependency package(s) verified as present on their public registries.`,
+    checkedAt,
+  };
+}
+
+export function buildDepRegistryFinding(analysis: DepRegistryAnalysis): ModerationFinding | null {
+  if (analysis.status !== "suspicious" || analysis.notFoundPackages.length === 0) return null;
+  return {
+    code: REASON_CODES.DEP_NOT_FOUND,
+    severity: "critical",
+    file: "Dependency manifests",
+    line: 1,
+    message: `${analysis.notFoundPackages.length} package(s) referenced in dependency files do not exist on their public registries: ${analysis.notFoundPackages.join(", ")}`,
+    evidence:
+      "An attacker could register these phantom package names and inject malicious install-time code through dependency confusion.",
+  };
+}
+
+export function mergeDepRegistryFinding(params: {
+  staticScan:
+    | {
+        status: ModerationVerdict;
+        reasonCodes: string[];
+        findings: ModerationFinding[];
+        summary: string;
+        engineVersion: string;
+        checkedAt: number;
+      }
+    | undefined;
+  analysis: DepRegistryAnalysis;
+  statusFromCodes: (codes: string[]) => ModerationVerdict;
+  summarizeCodes: (codes: string[]) => string;
+}) {
+  const base = params.staticScan ?? {
+    status: "clean" as ModerationVerdict,
+    reasonCodes: [],
+    findings: [],
+    summary: "No suspicious patterns detected.",
+    engineVersion: MODERATION_ENGINE_VERSION,
+    checkedAt: params.analysis.checkedAt,
+  };
+  const findings = base.findings.filter((finding) => finding.code !== REASON_CODES.DEP_NOT_FOUND);
+  const depFinding = buildDepRegistryFinding(params.analysis);
+  if (depFinding) findings.push(depFinding);
+  const reasonCodes = Array.from(new Set(findings.map((finding) => finding.code))).sort((a, b) =>
+    a.localeCompare(b),
+  );
+  return {
+    ...base,
+    status: params.statusFromCodes(reasonCodes),
+    reasonCodes,
+    findings,
+    summary: params.summarizeCodes(reasonCodes),
+    checkedAt: params.analysis.checkedAt,
+  };
+}

convex/lib/globalStats.ts

@@ -11,7 +11,9 @@ type SkillVisibilityFields = Pick<
 type GlobalStatsReadCtx = Pick<MutationCtx | QueryCtx, "db">;
 type GlobalStatsWriteCtx = Pick<MutationCtx, "db">;
 
-export function isPublicSkillDoc(skill: SkillVisibilityFields | null | undefined) {
+export function isPublicSkillDoc<T extends SkillVisibilityFields>(
+  skill: T | null | undefined,
+): skill is T {
   if (!skill || skill.softDeletedAt) return false;
   if (skill.moderationStatus && skill.moderationStatus !== "active") return false;
   if (skill.moderationFlags?.includes("blocked.malware")) return false;
@@ -52,18 +54,6 @@ export function isGlobalStatsStorageNotReadyError(error: unknown) {
   );
 }
 
-export async function countPublicSkillsForGlobalStats(ctx: GlobalStatsReadCtx) {
-  const digests = await ctx.db
-    .query("skillSearchDigest")
-    .withIndex("by_active_updated", (q) => q.eq("softDeletedAt", undefined))
-    .collect();
-  let count = 0;
-  for (const digest of digests) {
-    if (isPublicSkillDoc(digest)) count += 1;
-  }
-  return count;
-}
-
 export async function setGlobalPublicSkillsCount(
   ctx: GlobalStatsWriteCtx,
   count: number,
@@ -117,9 +107,8 @@ export async function adjustGlobalPublicSkillsCount(
   }
 
   if (!existing) {
-    // No baseline yet (e.g. fresh deploy). Initialize via full recount once.
-    const count = await countPublicSkillsForGlobalStats(ctx);
-    await setGlobalPublicSkillsCount(ctx, count, now);
+    // No baseline yet. The paginated stats maintenance action reconciles the full count.
+    await setGlobalPublicSkillsCount(ctx, Math.max(0, normalizedDelta), now);
     return;
   }
 

convex/lib/httpRateLimit.test.ts

@@ -268,6 +268,50 @@ describe("applyRateLimit headers", () => {
     expect(result.response.headers.get("Retry-After")).toBe("30");
   });
 
+  it("scopes anonymous download fallback buckets when client ip is missing", async () => {
+    vi.spyOn(Date, "now").mockReturnValue(4_500_000);
+    const ctx = makeRateLimitCtx({
+      ip: {
+        allowed: true,
+        remaining: 19,
+        limit: 20,
+        resetAt: 4_530_000,
+      },
+    });
+    const request = new Request(
+      "https://example.com/api/v1/packages/tickflow-assist/download?version=0.2.10",
+    );
+
+    const result = await applyRateLimit(ctx, request, "download");
+
+    expect(result.ok).toBe(true);
+    const runMutation = (ctx as unknown as { runMutation: ReturnType<typeof vi.fn> }).runMutation;
+    const consumedKeys = runMutation.mock.calls.map(([, args]) => String(args.key));
+    expect(consumedKeys).toContain(
+      "ip:unknown:download:/api/v1/packages/tickflow-assist/download?version=0.2.10",
+    );
+  });
+
+  it("keeps non-download missing-ip anonymous requests on the shared unknown bucket", async () => {
+    vi.spyOn(Date, "now").mockReturnValue(4_600_000);
+    const ctx = makeRateLimitCtx({
+      ip: {
+        allowed: true,
+        remaining: 19,
+        limit: 20,
+        resetAt: 4_630_000,
+      },
+    });
+    const request = new Request("https://example.com/api/v1/search?q=demo");
+
+    const result = await applyRateLimit(ctx, request, "read");
+
+    expect(result.ok).toBe(true);
+    const runMutation = (ctx as unknown as { runMutation: ReturnType<typeof vi.fn> }).runMutation;
+    const consumedKeys = runMutation.mock.calls.map(([, args]) => String(args.key));
+    expect(consumedKeys).toContain("ip:unknown");
+  });
+
   it("falls back to ip enforcement when bearer token is invalid", async () => {
     vi.spyOn(Date, "now").mockReturnValue(5_000_000);
     const ctx = makeRateLimitCtx({

convex/lib/httpRateLimit.ts

@@ -60,7 +60,11 @@ export async function applyRateLimit(
   }
 
   // Anonymous requests remain IP-enforced.
-  const ipResult = await checkRateLimit(ctx, `ip:${ip}`, RATE_LIMITS[kind].ip);
+  const ipResult = await checkRateLimit(
+    ctx,
+    getAnonymousRateLimitKey(request, kind, ip),
+    RATE_LIMITS[kind].ip,
+  );
   const headers = rateHeaders(ipResult);
 
   if (!ipResult.allowed) {
@@ -91,6 +95,12 @@ export async function applyRateLimit(
   return { ok: true, headers };
 }
 
+function getAnonymousRateLimitKey(request: Request, kind: keyof typeof RATE_LIMITS, ip: string) {
+  if (ip !== "unknown") return `ip:${ip}`;
+  if (kind !== "download") return "ip:unknown";
+  return `ip:unknown:download:${getDownloadRateLimitScope(request)}`;
+}
+
 export function getClientIp(request: Request) {
   const cfHeader = request.headers.get("cf-connecting-ip");
   if (cfHeader) return splitFirstIp(cfHeader);
@@ -189,10 +199,30 @@ function splitFirstIp(header: string | null) {
   return trimmed || null;
 }
 
+function getDownloadRateLimitScope(request: Request) {
+  try {
+    const url = new URL(request.url);
+    const path = normalizeRateLimitKeyPart(url.pathname.replace(/\/{2,}/g, "/") || "/");
+    const params = new URLSearchParams();
+
+    for (const name of ["slug", "version", "tag"] as const) {
+      const value = url.searchParams.get(name)?.trim();
+      if (value) params.set(name, normalizeRateLimitKeyPart(value));
+    }
+
+    const query = params.toString();
+    return query ? `${path}?${query}` : path;
+  } catch {
+    return "unknown";
+  }
+}
+
+function normalizeRateLimitKeyPart(value: string) {
+  return value.slice(0, 500);
+}
+
 function shouldTrustForwardedIps() {
-  const value = String(process.env.TRUST_FORWARDED_IPS ?? "")
-    .trim()
-    .toLowerCase();
+  const value = (process.env.TRUST_FORWARDED_IPS ?? "").trim().toLowerCase();
   // Hardening default: CF-only. Forwarded headers are trivial to spoof unless you
   // control the trusted proxy layer.
   if (!value) return false;

convex/lib/moderationEngine.ts

@@ -65,6 +65,8 @@ const MARKDOWN_EXTENSION = /\.(md|markdown|mdx)$/i;
 const CODE_EXTENSION = /\.(js|ts|mjs|cjs|mts|cts|jsx|tsx|py|sh|bash|zsh|rb|go)$/i;
 const STANDARD_PORTS = new Set([80, 443, 8080, 8443, 3000]);
 const RAW_IP_URL_PATTERN = /https?:\/\/\d{1,3}(?:\.\d{1,3}){3}(?::\d+)?(?:\/|["'])/i;
+const CGNAT_HTTP_URL_PATTERN =
+  /http:\/\/100\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.\d{1,3}\.\d{1,3}(?::\d+)?(?:\/[^\s"'`]*)?/i;
 const INSTALL_PACKAGE_PATTERN = /installer-package\s*:\s*https?:\/\/[^\s"'`]+/i;
 const GENERATED_SOURCE_PLACEHOLDER_PATTERN =
   /^\s*[A-Za-z_][A-Za-z0-9_]*\s*=.*["']\$\{[A-Za-z_][A-Za-z0-9_-]*\}["']/m;
@@ -74,10 +76,91 @@ const HARDCODED_CONNECTION_ID_PATTERN =
   /["']connection_id["']\s*:\s*["'][0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}["']/i;
 const GOOGLE_SHEETS_SPREADSHEET_URL_PATTERN =
   /https?:\/\/[^\s"'`]*\/spreadsheets\/([A-Za-z0-9_-]{20,})\/[^\s"'`]*/i;
+const DESTRUCTIVE_DELETE_PATTERN =
+  /\brm\s+-[A-Za-z]*r[A-Za-z]*f[A-Za-z]*\s+(["']?)(\/root\/\.openclaw\/|\/home\/[^/\s"'`]+\/\.openclaw\/|\/Users\/[^/\s"'`]+\/\.openclaw\/|~\/\.openclaw\/|\$HOME\/\.openclaw\/|\$\{HOME\}\/\.openclaw\/|\/etc\/|\/usr\/|\/opt\/|\/Library\/|\/Applications\/)[^\s"'`;|&)]*\1/i;
+const SHELL_POSITIONAL_ASSIGNMENT_PATTERN =
+  /^\s*([A-Z_][A-Z0-9_]*)=(["']?)\$(?:[1-9][0-9]*|@|\*)\2\s*(?:#.*)?$/gm;
 const SECRET_ASSIGNMENT_PATTERN =
-  /\b(?:api[_\s-]?(?:secret|key)|secret[_\s-]?key|access[_\s-]?token|auth[_\s-]?token|bearer[_\s-]?token|password)\b\s*[:=]\s*["'`]?([A-Za-z0-9][A-Za-z0-9._~+/=-]{15,})["'`]?/i;
+  /\b(?:[A-Za-z0-9]+[_\s-]+)*(?:(?:api|client|consumer)[_\s-]?(?:secret|key|token)|secret[_\s-]?key|access[_\s-]?(?:token|key|secret|grant)|auth[_\s-]?token|bearer(?:[_\s-]?token)?|private[_\s-]?key|service[_\s-]?role[_\s-]?key|github[_\s-]?(?:pat|token)|(?:openrouter|supabase|storj)[_\s-]?(?:key|token|secret|access[_\s-]?grant)|password)\b\s*[:=]\s*["'`]?([A-Za-z0-9][A-Za-z0-9._~+/=-]{15,})["'`]?/i;
 const AUTH_HEADER_SECRET_PATTERN =
   /\b(?:authorization|x-api-key|x-api-secret)\b\s*[:=]\s*(?:Bearer\s+)?["'`]?([A-Za-z0-9][A-Za-z0-9._~+/=-]{15,})["'`]?/i;
+const SHELL_CREDENTIAL_VARIABLE_PATTERN =
+  /\$(?:\{)?[A-Z_][A-Z0-9_]*(?:TOKEN|PAT|SECRET|KEY)[A-Z0-9_]*(?:\})?/;
+const GIT_REMOTE_CREDENTIAL_URL_PATTERN =
+  /\bgit\s+remote\s+set-url\b[^\n]*https?:\/\/[^\s"'`]*\$(?:\{)?[A-Z_][A-Z0-9_]*(?:TOKEN|PAT|SECRET|KEY)[A-Z0-9_]*(?:\})?[^\s"'`]*@/i;
+const MEMORY_CREDENTIAL_STORAGE_PATTERN =
+  /\bsave\s+(?:it|the\s+(?:token|secret|credential|key|pat))\s+to\s+(?:your\s+)?(?:memory|conversation|chat)\b/i;
+const HOST_PLATFORM_SOURCE_CONTEXT_PATTERN =
+  /\$[{]?OPENCLAW_DIR[}]?.{0,200}\/src\/|\/src\/agents\/|\/src\/tools\//is;
+const HOST_PLATFORM_PATCH_COMMAND_PATTERN =
+  /\b(?:sed\s+-i|perl\s+-0?pi|cp\s+|cat\s+>|python3?\b.{0,120}(?:write|replace))/i;
+const HOST_PLATFORM_REBUILD_PATTERN = /\b(?:pnpm\s+build|npm\s+run\s+build|bun\s+run\s+build)\b/i;
+const BROWSER_USE_PASSWORD_ARGV_PATTERN =
+  /\bbrowser-use\s+input\b[^\n]*(?:password|passwd|\$[A-Z_]*(?:PASSWORD|PASS|PWD)[A-Z0-9_]*|<password>|\{password\})/i;
+const BROWSER_USE_AUTH_EVAL_PATTERN = /\bbrowser-use\s+(?:eval|python)\b/i;
+const AUTHENTICATED_MAIL_CONTEXT_PATTERN = /\b(?:mail\.google\.com|gmail|webmail|mailbox|inbox)\b/i;
+const PERSISTENCE_SCHEDULER_PATTERN =
+  /\b(?:launchctl\s+load|crontab\b|LaunchAgents\/|systemctl\s+(?:--user\s+)?enable)\b/i;
+const SECRET_ARGV_WARNING_PATTERN =
+  /\b(?:do\s+not|don't|avoid|never|reject)\b[^\n]{0,120}\b(?:argv|argument|from-mnemonic|private[-_\s]?key|seed[-\s]?phrase|mnemonic)\b/i;
+const FROM_MNEMONIC_ARGV_PATTERN =
+  /\b(?:npx|bunx|pnpm\s+dlx|npm\s+exec|node|python3?|uvx)\b[^\n]{0,200}\bfrom-mnemonic\b[^\n]{0,200}(?:"[^"\n]{8,}"|'[^'\n]{8,}'|<[^>\n]{6,}>|\$[A-Z_][A-Z0-9_]*(?:MNEMONIC|SEED|PHRASE)[A-Z0-9_]*)/i;
+const SECRET_FLAG_ARGV_PATTERN =
+  /\b(?:npx|bunx|pnpm\s+dlx|npm\s+exec|node|python3?|uvx|docker\s+run)\b[^\n]{0,240}--(?:private-key|seed|seed-phrase|mnemonic|password|token)\s+(?:"[^"\n]{8,}"|'[^'\n]{8,}'|<[^>\n]{4,}>|\$[A-Z_][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|MNEMONIC|SEED|PHRASE)[A-Z0-9_]*)/i;
+const SECRET_ARGV_REDACTION_PATTERN =
+  /(\b(?:from-mnemonic|--(?:private-key|seed|seed-phrase|mnemonic|password|token))\s+)(["'`])([^"'`]{8,})\2/gi;
+const DYNAMIC_CODE_EXECUTION_PATTERN =
+  /\beval\s*\(|new\s+Function\s*\(|\b(?:[A-Za-z_][A-Za-z0-9_]*\.)?loader\.exec_module\s*\(/;
+const SHELL_BASE64_FILE_READ_PATTERN =
+  /(?:\bcat\s+["']?\$[A-Za-z_][A-Za-z0-9_]*["']?\s*\|\s*base64\b|\bbase64\b[^\n]{0,80}["']?\$[A-Za-z_][A-Za-z0-9_]*["']?)/i;
+const SHELL_NETWORK_UPLOAD_PATTERN =
+  /\bcurl\b[\s\S]{0,1600}(?:--data(?:-binary|-raw)?\b|-d\b|--form\b|-F\b|--upload-file\b|Authorization\s*:)/i;
+const PLAYWRIGHT_CHROMIUM_PATTERN = /\b(?:playwright\.)?chromium\.launch\s*\(/i;
+const FILE_URL_BROWSER_NAVIGATION_PATTERN = /\bpage\.goto\s*\([^)]*file:\/\//i;
+const SVG_HTML_INTERPOLATION_PATTERN =
+  /(?:<body>[\s\S]{0,240}\$\{[^}]*svg[^}]*\}|writeFile(?:Sync)?\s*\([^)]*\.html[^)]*\$\{[^}]*svg[^}]*\}|\$\{[^}]*svg[^}]*\}[\s\S]{0,240}<\/body>)/i;
+const BROWSER_JS_DISABLED_PATTERN =
+  /javaScriptEnabled\s*:\s*false|Content-Security-Policy|script-src\s+['"]?none/i;
+const AGENT_OUTPUT_DIR_ARGUMENT_PATTERN =
+  /add_argument\s*\(\s*["']--outdir["']|args\.outdir|output_path\s*=\s*Path\s*\(\s*args\.outdir\s*\)/i;
+const FFMPEG_FORCE_OUTPUT_PATTERN =
+  /subprocess\.run\s*\(\s*\[[\s\S]{0,1000}["']ffmpeg["'][\s\S]{0,1000}["']-y["'][\s\S]{0,1000}str\s*\(\s*output_path\s*\)/i;
+const OUTPUT_PATH_GUARD_PATTERN =
+  /TemporaryDirectory|mkdtemp|tempfile\.|resolve\s*\(\s*\).*relative_to|is_relative_to\s*\(/i;
+const INSECURE_TLS_VERIFICATION_PATTERN =
+  /ssl\._create_unverified_context\s*\(|ssl\.CERT_NONE\b|check_hostname\s*=\s*False\b|verify\s*=\s*False\b|rejectUnauthorized\s*:\s*false\b|NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*["']?0["']?/i;
+const PYTHON_AGENT_FILENAME_PATTERN =
+  /\b(?:filename\s*:\s*str|req\.filename|filename\s*=|["']filename["'])\b/i;
+const PYTHON_RCLONE_FILENAME_SINK_PATTERN =
+  /(?:rclone_dir\s*\/\s*filename|f["']\.\/\{filename\}|open\s*\(\s*temp_file_path\s*,|subprocess\.run\s*\([\s\S]{0,1000}["']\.\/rclone["'])/i;
+const PYTHON_FILENAME_GUARD_PATTERN =
+  /\b(?:secure_filename|basename\s*\(|Path\s*\(\s*filename\s*\)\.name|filename\s*=\s*Path\s*\(\s*filename\s*\)\.name|resolve\s*\(\s*\).*relative_to|is_relative_to\s*\(|["']\.\.["']\s+in\s+filename|["']\/["']\s+in\s+filename)/i;
+const PYTHON_CREDENTIAL_ENV_PATTERN =
+  /\b(?:os\.environ(?:\.get)?|os\.getenv|getenv)\s*(?:\[\s*|\(\s*)["'][A-Za-z_][A-Za-z0-9_]*(?:PASS|PASSWORD|SECRET|TOKEN|KEY)[A-Za-z0-9_]*["']/i;
+const PYTHON_URL_ENV_PATTERN =
+  /\b(?:os\.environ(?:\.get)?|os\.getenv|getenv)\s*(?:\[\s*|\(\s*)["'][A-Za-z_][A-Za-z0-9_]*(?:BASE_URL|URL|HOST|ENDPOINT)[A-Za-z0-9_]*["']/i;
+const PYTHON_HTTP_POST_PATTERN =
+  /\b(?:requests|session|self\.session|client)\.post\s*\(|\.post\s*\(/i;
+const PASSWORD_PAYLOAD_PATTERN = /["']password["']\s*:|password\s*=/i;
+const AUTONOMOUS_AGENT_SCHEDULE_PATTERN =
+  /\bAUTO_ANSWER\s*=\s*(?:true|os\.getenv\s*\(\s*["']AUTO_ANSWER["']\s*,\s*["']true["'])|while\s+True\s*:|time\.sleep\s*\(\s*(?:[3-9]\d{2,}|[1-9]\d{3,})\s*\)|\binterval\s*=\s*(?:[3-9]\d{2,}|[1-9]\d{3,})|"kind"\s*:\s*"cron"|"expr"\s*:\s*["'][^"']*\*\/(?:[1-5]?\d)\b/is;
+const CREDENTIAL_BEARING_AGENT_PATTERN =
+  /\b(?:X-API-Key|api_key|API_KEY|VDOOB_API_KEY|AGENT_ID|agent_config\.json)\b/i;
+const AUTONOMOUS_ANSWER_EGRESS_PATTERN =
+  /\b(?:requests|session|client)\.post\s*\([\s\S]{0,1000}(?:submit-answer|agent-withdrawals|agents\/register|messages\/agent)|\b(?:submit_answer|answer_question|act_cron_check)\b/i;
+const HARDCODED_OPERATOR_BASE_URL_PATTERN =
+  /\bBASE_URL\s*=\s*["']https:\/\/(?!your-|example\.|localhost\b|127\.0\.0\.1\b)[A-Za-z0-9.-]+\.[A-Za-z]{2,}(?::\d+)?(?:\/[^"']*)?["']/i;
+const OAUTH_CLIENT_SECRET_FLOW_PATTERN =
+  /\b(?:oauth\/register|oauth\/token|client_secret|Authorization:\s*Bearer|ACCESS_TOKEN)\b/i;
+const LIGHTNING_BILLING_FLOW_PATTERN =
+  /\b(?:billing\/agent\/(?:create|check)-invoice|amount_sats|LNURL|Lightning|PAYG)\b/i;
+const OUTBOUND_POST_PATTERN = /\b(?:curl\s+-X\s+POST|requests\.post\s*\(|fetch\s*\()/i;
+const REMOTE_RECIPE_FETCH_PATTERN =
+  /\b(?:curl|requests\.get|fetch)\b[\s\S]{0,600}(?:error-codes\.json|recipes?\.json|patterns\.json|docs\.openclaw\.ai)|ERROR_CODES_URL\s*=/i;
+const MUTABLE_RECIPE_STORE_PATTERN =
+  /\b(?:error-patterns\.json|recipes?\.json|safe_auto|fix_recipe_id|["']command["'])\b/i;
+const TEMPLATED_SUBPROCESS_EXECUTION_PATTERN =
+  /\bsubstitute_params\s*\([\s\S]{0,500}\b(?:shlex\.split|subprocess\.run)\b|\b(?:shlex\.split|subprocess\.run)\b[\s\S]{0,500}\bsubstitute_params\s*\(/i;
 
 function hasMaliciousInstallPrompt(content: string) {
   const hasTerminalInstruction =
@@ -132,6 +215,173 @@ function findHardcodedSecret(content: string) {
   return null;
 }
 
+function findCredentialExposureInstruction(content: string) {
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i] ?? "";
+    if (
+      GIT_REMOTE_CREDENTIAL_URL_PATTERN.test(line) ||
+      (MEMORY_CREDENTIAL_STORAGE_PATTERN.test(line) &&
+        SHELL_CREDENTIAL_VARIABLE_PATTERN.test(content))
+    ) {
+      return { line: i + 1, text: line };
+    }
+  }
+  return null;
+}
+
+function findBrowserCredentialAutomation(content: string) {
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i] ?? "";
+    if (BROWSER_USE_PASSWORD_ARGV_PATTERN.test(line)) {
+      return { line: i + 1, text: line };
+    }
+  }
+
+  if (
+    BROWSER_USE_AUTH_EVAL_PATTERN.test(content) &&
+    AUTHENTICATED_MAIL_CONTEXT_PATTERN.test(content) &&
+    PERSISTENCE_SCHEDULER_PATTERN.test(content)
+  ) {
+    for (let i = 0; i < lines.length; i += 1) {
+      const line = lines[i] ?? "";
+      if (BROWSER_USE_AUTH_EVAL_PATTERN.test(line) || PERSISTENCE_SCHEDULER_PATTERN.test(line)) {
+        return { line: i + 1, text: line };
+      }
+    }
+  }
+
+  return null;
+}
+
+function redactSecretArgvEvidence(line: string) {
+  return line.replace(SECRET_ARGV_REDACTION_PATTERN, "$1$2[REDACTED]$2");
+}
+
+function findSecretArgvExposure(content: string) {
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i] ?? "";
+    if (SECRET_ARGV_WARNING_PATTERN.test(line)) continue;
+    if (FROM_MNEMONIC_ARGV_PATTERN.test(line) || SECRET_FLAG_ARGV_PATTERN.test(line)) {
+      return { line: i + 1, text: redactSecretArgvEvidence(line) };
+    }
+  }
+  return null;
+}
+
+function findHostPlatformSourcePatch(content: string) {
+  if (!HOST_PLATFORM_SOURCE_CONTEXT_PATTERN.test(content)) return null;
+  if (!HOST_PLATFORM_REBUILD_PATTERN.test(content)) return null;
+
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i] ?? "";
+    if (!HOST_PLATFORM_PATCH_COMMAND_PATTERN.test(line)) continue;
+    if (hasNearbyConfirmationGate(lines, i)) continue;
+    return { line: i + 1, text: line };
+  }
+  return null;
+}
+
+function scanSecretLiteralFile(path: string, content: string, findings: ModerationFinding[]) {
+  const secretMatch = findHardcodedSecret(content);
+  if (!secretMatch) return;
+
+  addFinding(findings, {
+    code: REASON_CODES.EXPOSED_SECRET_LITERAL,
+    severity: "critical",
+    file: path,
+    line: secretMatch.line,
+    message: "File appears to expose a hardcoded API secret or token.",
+    evidence: secretMatch.text,
+  });
+}
+
+function scanPlaintextCgnatEndpointFile(
+  path: string,
+  content: string,
+  findings: ModerationFinding[],
+) {
+  if (!CGNAT_HTTP_URL_PATTERN.test(content)) return;
+  const match = findFirstLine(content, CGNAT_HTTP_URL_PATTERN);
+  addFinding(findings, {
+    code: REASON_CODES.EXPOSED_RESOURCE_IDENTIFIER,
+    severity: "critical",
+    file: path,
+    line: match.line,
+    message: "Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.",
+    evidence: match.text,
+  });
+}
+
+function hasNearbyConfirmationGate(lines: string[], commandIndex: number) {
+  const start = Math.max(0, commandIndex - 8);
+  const context = lines.slice(start, commandIndex + 1).join("\n");
+  return [
+    /\bask\s+(?:the\s+)?user\b.{0,120}\b(?:confirm|confirmation|approve|approval|continue|yes)\b/is,
+    /\b(?:prompt\s+for|require|request|obtain)\s+(?:explicit\s+)?(?:user\s+)?(?:confirmation|approval)\b/is,
+    /\buser\s+(?:confirmation|approval)\b/is,
+    /\bcontinue\?\s*\(?(?:yes\/no|y\/n)\)?/is,
+    /\breply\s+["']?yes["']?\b/is,
+    /\bonly\s+(?:continue\s+)?after\s+(?:the\s+)?user\b.{0,80}\b(?:confirms?|approves?|answers?\s+yes)\b/is,
+  ].some((pattern) => pattern.test(context));
+}
+
+function findUnguardedDestructiveDelete(content: string) {
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i += 1) {
+    if (!DESTRUCTIVE_DELETE_PATTERN.test(lines[i])) continue;
+    if (hasNearbyConfirmationGate(lines, i)) continue;
+    return { line: i + 1, text: lines[i] };
+  }
+  return null;
+}
+
+function hasShellVariableValidation(content: string, variable: string, useIndex: number) {
+  const escaped = variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const beforeUse = content.slice(0, useIndex);
+  const variableReference = String.raw`(?:\$\{${escaped}\}|\$${escaped})`;
+  const lengthCheck = new RegExp(
+    String.raw`\$\{#${escaped}\}\s*(?:-[a-z]\s+)?(?:[<>!=]=?|-[gl][te])`,
+    "m",
+  );
+  const controlCharStrip = new RegExp(
+    String.raw`(?:tr\s+-d\s+["']?\\(?:000|x00).{0,80}\\(?:037|x1[fF]|177|x7[fF])|${escaped}\s*=.*tr\s+-d)`,
+    "s",
+  );
+  const explicitValidation = new RegExp(
+    String.raw`(?:validate|sanitize|strip|clean)[A-Za-z0-9_ -]{0,60}${variableReference}|${variableReference}.{0,60}(?:validate|sanitize|strip|clean)`,
+    "is",
+  );
+
+  return (
+    lengthCheck.test(beforeUse) ||
+    controlCharStrip.test(beforeUse) ||
+    explicitValidation.test(beforeUse)
+  );
+}
+
+function findUnsafeBrowserTextInput(content: string) {
+  for (const assignment of content.matchAll(SHELL_POSITIONAL_ASSIGNMENT_PATTERN)) {
+    const variable = assignment[1];
+    if (!variable) continue;
+
+    const escaped = variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const browserTextPattern = new RegExp(
+      String.raw`\bbrowser\s+action=act\b[^\n]*\bkind=["']?type["']?[^\n]*\btext=(?:"\$${escaped}"|'\$${escaped}'|\$${escaped})(?![A-Za-z0-9_])`,
+      "i",
+    );
+    const match = content.match(browserTextPattern);
+    if (!match || match.index === undefined) continue;
+    if (hasShellVariableValidation(content, variable, match.index)) continue;
+
+    return findLineAtIndex(content, match.index);
+  }
+  return null;
+}
+
 function addFinding(
   findings: ModerationFinding[],
   finding: Omit<ModerationFinding, "evidence"> & { evidence: string },
@@ -157,6 +407,158 @@ function findLineAtIndex(content: string, index: number) {
   return { line, text: content.slice(lineStart, lineEnd) };
 }
 
+function findCallEnd(content: string, openParenIndex: number) {
+  let depth = 0;
+  let quote: '"' | "'" | "`" | undefined;
+  let escaped = false;
+
+  for (let i = openParenIndex; i < content.length; i += 1) {
+    const char = content[i];
+    if (quote) {
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (char === "\\") {
+        escaped = true;
+        continue;
+      }
+      if (char === quote) quote = undefined;
+      continue;
+    }
+
+    if (char === '"' || char === "'" || char === "`") {
+      quote = char;
+      continue;
+    }
+    if (char === "(") depth += 1;
+    if (char === ")") {
+      depth -= 1;
+      if (depth === 0) return i + 1;
+    }
+  }
+
+  return content.length;
+}
+
+function isSafeLiteralExecFileCall(callText: string) {
+  const match = callText.match(/\b(execFile|execFileSync)\s*\(\s*(["'])([^"']+)\2\s*,\s*\[/);
+  if (!match) return false;
+  if (/\bshell\s*:\s*true\b/.test(callText)) return false;
+
+  const executable = match[3]?.trim().toLowerCase();
+  if (!executable) return false;
+  const basename = executable.split(/[\\/]/).at(-1) ?? executable;
+  return !/^(?:sh|bash|zsh|fish|cmd|powershell|pwsh)$/.test(basename);
+}
+
+function findDangerousChildProcessCall(content: string) {
+  if (!/child_process/.test(content)) return null;
+
+  const execPattern = /\b(exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(/g;
+  for (const match of content.matchAll(execPattern)) {
+    const callName = match[1];
+    const callIndex = match.index;
+    if (callIndex === undefined || !callName) continue;
+
+    if (callName === "execFile" || callName === "execFileSync") {
+      const openParenIndex = content.indexOf("(", callIndex);
+      const callEnd = findCallEnd(content, openParenIndex);
+      const callText = content.slice(callIndex, callEnd);
+      if (isSafeLiteralExecFileCall(callText)) continue;
+    }
+
+    return findLineAtIndex(content, callIndex);
+  }
+
+  return null;
+}
+
+function findShellBase64FileUpload(content: string) {
+  if (!/\bcurl\b/i.test(content) || !/\bbase64\b/i.test(content)) return null;
+  if (!SHELL_NETWORK_UPLOAD_PATTERN.test(content)) return null;
+  return findFirstLine(content, SHELL_BASE64_FILE_READ_PATTERN);
+}
+
+function findUnsafeBrowserFileRender(content: string) {
+  if (!PLAYWRIGHT_CHROMIUM_PATTERN.test(content)) return null;
+  if (!FILE_URL_BROWSER_NAVIGATION_PATTERN.test(content)) return null;
+  if (!SVG_HTML_INTERPOLATION_PATTERN.test(content)) return null;
+  if (BROWSER_JS_DISABLED_PATTERN.test(content)) return null;
+  return findFirstLine(content, FILE_URL_BROWSER_NAVIGATION_PATTERN);
+}
+
+function findUnsafeAgentControlledFileWrite(content: string) {
+  if (!AGENT_OUTPUT_DIR_ARGUMENT_PATTERN.test(content)) return null;
+  if (!FFMPEG_FORCE_OUTPUT_PATTERN.test(content)) return null;
+  if (OUTPUT_PATH_GUARD_PATTERN.test(content)) return null;
+  return findFirstLine(content, /subprocess\.run\s*\(|["']-y["']|output_path\s*=/);
+}
+
+function findUnsafePythonRcloneFilename(content: string) {
+  if (!PYTHON_AGENT_FILENAME_PATTERN.test(content)) return null;
+  if (!/\brclone\b/.test(content) || !/subprocess\.run\s*\(/.test(content)) return null;
+  if (!PYTHON_RCLONE_FILENAME_SINK_PATTERN.test(content)) return null;
+  if (PYTHON_FILENAME_GUARD_PATTERN.test(content)) return null;
+  return findFirstLine(
+    content,
+    /rclone_dir\s*\/\s*filename|f["']\.\/\{filename\}|subprocess\.run\s*\(/,
+  );
+}
+
+function findPythonCredentialPostToEnvUrl(content: string) {
+  if (!PYTHON_CREDENTIAL_ENV_PATTERN.test(content)) return null;
+  if (!PYTHON_URL_ENV_PATTERN.test(content)) return null;
+  if (!PYTHON_HTTP_POST_PATTERN.test(content)) return null;
+  if (!PASSWORD_PAYLOAD_PATTERN.test(content)) return null;
+  return findFirstLine(content, PYTHON_HTTP_POST_PATTERN);
+}
+
+function findAutonomousCredentialEgress(files: TextFile[]) {
+  const packageText = files.map((file) => file.content).join("\n");
+  if (!AUTONOMOUS_AGENT_SCHEDULE_PATTERN.test(packageText)) return null;
+  if (!CREDENTIAL_BEARING_AGENT_PATTERN.test(packageText)) return null;
+  if (!AUTONOMOUS_ANSWER_EGRESS_PATTERN.test(packageText)) return null;
+
+  for (const file of files) {
+    if (!AUTONOMOUS_ANSWER_EGRESS_PATTERN.test(file.content)) continue;
+    const match = findFirstLine(file.content, AUTONOMOUS_ANSWER_EGRESS_PATTERN);
+    return { file: file.path, line: match.line, text: match.text };
+  }
+
+  const fallback = files[0];
+  if (!fallback) return null;
+  return { file: fallback.path, line: 1, text: fallback.content.split("\n")[0] ?? "" };
+}
+
+function findRemoteRecipeExecution(files: TextFile[]) {
+  const packageText = files.map((file) => file.content).join("\n");
+  if (!REMOTE_RECIPE_FETCH_PATTERN.test(packageText)) return null;
+  if (!MUTABLE_RECIPE_STORE_PATTERN.test(packageText)) return null;
+  if (!TEMPLATED_SUBPROCESS_EXECUTION_PATTERN.test(packageText)) return null;
+
+  for (const file of files) {
+    if (!TEMPLATED_SUBPROCESS_EXECUTION_PATTERN.test(file.content)) continue;
+    const match = findFirstLine(
+      file.content,
+      /substitute_params\s*\(|shlex\.split|subprocess\.run/,
+    );
+    return { file: file.path, line: match.line, text: match.text };
+  }
+
+  const fallback = files[0];
+  if (!fallback) return null;
+  return { file: fallback.path, line: 1, text: fallback.content.split("\n")[0] ?? "" };
+}
+
+function findHardcodedOperatorBillingEndpoint(content: string) {
+  if (!HARDCODED_OPERATOR_BASE_URL_PATTERN.test(content)) return null;
+  if (!OAUTH_CLIENT_SECRET_FLOW_PATTERN.test(content)) return null;
+  if (!LIGHTNING_BILLING_FLOW_PATTERN.test(content)) return null;
+  if (!OUTBOUND_POST_PATTERN.test(content)) return null;
+  return findFirstLine(content, HARDCODED_OPERATOR_BASE_URL_PATTERN);
+}
+
 function normalizeEnvName(value: unknown) {
   if (typeof value !== "string") return undefined;
   const trimmed = value.trim();
@@ -181,22 +583,45 @@ function addDeclaredEnvNamesFromList(names: Set<string>, value: unknown) {
   }
 }
 
-function collectDeclaredEnvNames(input: { frontmatter: Record<string, unknown>; metadata?: unknown }) {
+function addDeclaredEnvNamesFromRecord(names: Set<string>, record: Record<string, unknown>) {
+  const requires =
+    record.requires && typeof record.requires === "object" && !Array.isArray(record.requires)
+      ? (record.requires as Record<string, unknown>)
+      : undefined;
+
+  addDeclaredEnvName(names, record.primaryEnv);
+  addDeclaredEnvNamesFromList(names, record.envVars);
+  addDeclaredEnvNamesFromList(names, record.env);
+  addDeclaredEnvNamesFromList(names, requires?.env);
+}
+
+function addDeclaredEnvNamesFromManifestBlock(names: Set<string>, value: unknown) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return;
+  addDeclaredEnvNamesFromRecord(names, value as Record<string, unknown>);
+}
+
+function collectDeclaredEnvNames(input: {
+  frontmatter: Record<string, unknown>;
+  metadata?: unknown;
+}) {
   const names = new Set<string>();
   const sources: unknown[] = [input.frontmatter, input.metadata];
 
   for (const source of sources) {
     if (!source || typeof source !== "object" || Array.isArray(source)) continue;
     const record = source as Record<string, unknown>;
-    const requires =
-      record.requires && typeof record.requires === "object" && !Array.isArray(record.requires)
-        ? (record.requires as Record<string, unknown>)
-        : undefined;
 
-    addDeclaredEnvName(names, record.primaryEnv);
-    addDeclaredEnvNamesFromList(names, record.envVars);
-    addDeclaredEnvNamesFromList(names, record.env);
-    addDeclaredEnvNamesFromList(names, requires?.env);
+    addDeclaredEnvNamesFromRecord(names, record);
+    addDeclaredEnvNamesFromManifestBlock(names, record.openclaw);
+    addDeclaredEnvNamesFromManifestBlock(names, record.clawdis);
+    addDeclaredEnvNamesFromManifestBlock(names, record.clawdbot);
+
+    if (record.metadata && typeof record.metadata === "object" && !Array.isArray(record.metadata)) {
+      const metadata = record.metadata as Record<string, unknown>;
+      addDeclaredEnvNamesFromManifestBlock(names, metadata.openclaw);
+      addDeclaredEnvNamesFromManifestBlock(names, metadata.clawdis);
+      addDeclaredEnvNamesFromManifestBlock(names, metadata.clawdbot);
+    }
   }
 
   return names;
@@ -234,22 +659,20 @@ function scanCodeFile(
 ) {
   if (!CODE_EXTENSION.test(path)) return;
 
-  const hasChildProcess = /child_process/.test(content);
-  const execPattern = /\b(exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(/;
-  if (hasChildProcess && execPattern.test(content)) {
-    const match = findFirstLine(content, execPattern);
+  const dangerousChildProcessCall = findDangerousChildProcessCall(content);
+  if (dangerousChildProcessCall) {
     addFinding(findings, {
       code: REASON_CODES.DANGEROUS_EXEC,
       severity: "critical",
       file: path,
-      line: match.line,
+      line: dangerousChildProcessCall.line,
       message: "Shell command execution detected (child_process).",
-      evidence: match.text,
+      evidence: dangerousChildProcessCall.text,
     });
   }
 
-  if (/\beval\s*\(|new\s+Function\s*\(/.test(content)) {
-    const match = findFirstLine(content, /\beval\s*\(|new\s+Function\s*\(/);
+  if (DYNAMIC_CODE_EXECUTION_PATTERN.test(content)) {
+    const match = findFirstLine(content, DYNAMIC_CODE_EXECUTION_PATTERN);
     addFinding(findings, {
       code: REASON_CODES.DYNAMIC_CODE,
       severity: "critical",
@@ -260,6 +683,79 @@ function scanCodeFile(
     });
   }
 
+  const unsafeBrowserTextInput = findUnsafeBrowserTextInput(content);
+  if (unsafeBrowserTextInput) {
+    addFinding(findings, {
+      code: REASON_CODES.UNSAFE_BROWSER_TEXT_INPUT,
+      severity: "warn",
+      file: path,
+      line: unsafeBrowserTextInput.line,
+      message: "Shell positional input is typed into browser automation without validation.",
+      evidence: unsafeBrowserTextInput.text,
+    });
+  }
+
+  const hostPlatformSourcePatch = findHostPlatformSourcePatch(content);
+  if (hostPlatformSourcePatch) {
+    addFinding(findings, {
+      code: REASON_CODES.HOST_PLATFORM_SOURCE_PATCH,
+      severity: "critical",
+      file: path,
+      line: hostPlatformSourcePatch.line,
+      message: "Install code patches host platform source and rebuilds without confirmation.",
+      evidence: hostPlatformSourcePatch.text,
+    });
+  }
+
+  const unsafeBrowserFileRender = findUnsafeBrowserFileRender(content);
+  if (unsafeBrowserFileRender) {
+    addFinding(findings, {
+      code: REASON_CODES.BROWSER_FILE_RENDER,
+      severity: "critical",
+      file: path,
+      line: unsafeBrowserFileRender.line,
+      message:
+        "Browser automation renders interpolated SVG/HTML from a file URL with JavaScript enabled.",
+      evidence: unsafeBrowserFileRender.text,
+    });
+  }
+
+  const unsafeAgentControlledFileWrite = findUnsafeAgentControlledFileWrite(content);
+  if (unsafeAgentControlledFileWrite) {
+    addFinding(findings, {
+      code: REASON_CODES.UNSAFE_FILE_WRITE,
+      severity: "critical",
+      file: path,
+      line: unsafeAgentControlledFileWrite.line,
+      message: "Agent-controlled output path is passed to an overwrite-capable subprocess.",
+      evidence: unsafeAgentControlledFileWrite.text,
+    });
+  }
+
+  if (INSECURE_TLS_VERIFICATION_PATTERN.test(content)) {
+    const match = findFirstLine(content, INSECURE_TLS_VERIFICATION_PATTERN);
+    addFinding(findings, {
+      code: REASON_CODES.INSECURE_TLS_VERIFICATION,
+      severity: "warn",
+      file: path,
+      line: match.line,
+      message: "HTTPS certificate verification is disabled.",
+      evidence: match.text,
+    });
+  }
+
+  const unsafePythonRcloneFilename = findUnsafePythonRcloneFilename(content);
+  if (unsafePythonRcloneFilename) {
+    addFinding(findings, {
+      code: REASON_CODES.UNSAFE_FILE_WRITE,
+      severity: "critical",
+      file: path,
+      line: unsafePythonRcloneFilename.line,
+      message: "Agent-controlled filename is written and passed to rclone without path validation.",
+      evidence: unsafePythonRcloneFilename.text,
+    });
+  }
+
   if (/stratum\+tcp|stratum\+ssl|coinhive|cryptonight|xmrig/i.test(content)) {
     const match = findFirstLine(content, /stratum\+tcp|stratum\+ssl|coinhive|cryptonight|xmrig/i);
     addFinding(findings, {
@@ -302,6 +798,44 @@ function scanCodeFile(
     });
   }
 
+  const shellBase64FileUpload = findShellBase64FileUpload(content);
+  if (shellBase64FileUpload) {
+    addFinding(findings, {
+      code: REASON_CODES.EXFILTRATION,
+      severity: "critical",
+      file: path,
+      line: shellBase64FileUpload.line,
+      message: "Shell script base64-encodes a local file and sends it over the network.",
+      evidence: shellBase64FileUpload.text,
+    });
+  }
+
+  const pythonCredentialPost = findPythonCredentialPostToEnvUrl(content);
+  if (pythonCredentialPost) {
+    addFinding(findings, {
+      code: REASON_CODES.CREDENTIAL_HARVEST,
+      severity: "critical",
+      file: path,
+      line: pythonCredentialPost.line,
+      message:
+        "Python code POSTs credential environment variables to an environment-controlled URL.",
+      evidence: pythonCredentialPost.text,
+    });
+  }
+
+  const hardcodedOperatorBilling = findHardcodedOperatorBillingEndpoint(content);
+  if (hardcodedOperatorBilling) {
+    addFinding(findings, {
+      code: REASON_CODES.HARDCODED_OPERATOR_BILLING,
+      severity: "critical",
+      file: path,
+      line: hardcodedOperatorBilling.line,
+      message:
+        "Hardcoded operator endpoint combines OAuth credentials with Lightning billing calls.",
+      evidence: hardcodedOperatorBilling.text,
+    });
+  }
+
   const hasProcessEnv = /process\.env/.test(content);
   if (hasProcessEnv && hasNetworkSend) {
     const referencedEnvNames = collectReferencedEnvNames(content);
@@ -342,15 +876,52 @@ function scanCodeFile(
 function scanMarkdownFile(path: string, content: string, findings: ModerationFinding[]) {
   if (!MARKDOWN_EXTENSION.test(path)) return;
 
-  const secretMatch = findHardcodedSecret(content);
-  if (secretMatch) {
+  const credentialExposure = findCredentialExposureInstruction(content);
+  if (credentialExposure) {
     addFinding(findings, {
-      code: REASON_CODES.EXPOSED_SECRET_LITERAL,
+      code: REASON_CODES.CREDENTIAL_EXPOSURE_INSTRUCTIONS,
       severity: "critical",
       file: path,
-      line: secretMatch.line,
-      message: "Documentation appears to expose a hardcoded API secret or token.",
-      evidence: secretMatch.text,
+      line: credentialExposure.line,
+      message: "Instructions expose credentials through shell, git config, or agent memory.",
+      evidence: credentialExposure.text,
+    });
+  }
+
+  const browserCredentialAutomation = findBrowserCredentialAutomation(content);
+  if (browserCredentialAutomation) {
+    addFinding(findings, {
+      code: REASON_CODES.BROWSER_CREDENTIAL_AUTOMATION,
+      severity: "critical",
+      file: path,
+      line: browserCredentialAutomation.line,
+      message: "Browser automation instructions expose credentials or persist authenticated eval.",
+      evidence: browserCredentialAutomation.text,
+    });
+  }
+
+  const secretArgvExposure = findSecretArgvExposure(content);
+  if (secretArgvExposure) {
+    addFinding(findings, {
+      code: REASON_CODES.SECRET_ARGV_EXPOSURE,
+      severity: "critical",
+      file: path,
+      line: secretArgvExposure.line,
+      message: "Instructions pass high-value credentials through process argv.",
+      evidence: secretArgvExposure.text,
+    });
+  }
+
+  const hardcodedOperatorBilling = findHardcodedOperatorBillingEndpoint(content);
+  if (hardcodedOperatorBilling) {
+    addFinding(findings, {
+      code: REASON_CODES.HARDCODED_OPERATOR_BILLING,
+      severity: "critical",
+      file: path,
+      line: hardcodedOperatorBilling.line,
+      message:
+        "Hardcoded operator endpoint combines OAuth credentials with Lightning billing calls.",
+      evidence: hardcodedOperatorBilling.text,
     });
   }
 
@@ -369,6 +940,31 @@ function scanMarkdownFile(path: string, content: string, findings: ModerationFin
     });
   }
 
+  const destructiveDelete = findUnguardedDestructiveDelete(content);
+  if (destructiveDelete) {
+    addFinding(findings, {
+      code: REASON_CODES.DESTRUCTIVE_DELETE_COMMAND,
+      severity: "warn",
+      file: path,
+      line: destructiveDelete.line,
+      message:
+        "Documentation contains a destructive delete command without an explicit confirmation gate.",
+      evidence: destructiveDelete.text,
+    });
+  }
+
+  const unsafeBrowserTextInput = findUnsafeBrowserTextInput(content);
+  if (unsafeBrowserTextInput) {
+    addFinding(findings, {
+      code: REASON_CODES.UNSAFE_BROWSER_TEXT_INPUT,
+      severity: "warn",
+      file: path,
+      line: unsafeBrowserTextInput.line,
+      message: "Shell positional input is typed into browser automation without validation.",
+      evidence: unsafeBrowserTextInput.text,
+    });
+  }
+
   if (
     /ignore\s+(all\s+)?previous\s+instructions/i.test(content) ||
     /system\s*prompt\s*[:=]/i.test(content)
@@ -428,7 +1024,8 @@ function scanMarkdownFile(path: string, content: string, findings: ModerationFin
       severity: "critical",
       file: path,
       line: match.line,
-      message: "Example code exposes a concrete Google Sheets spreadsheet ID instead of a placeholder.",
+      message:
+        "Example code exposes a concrete Google Sheets spreadsheet ID instead of a placeholder.",
       evidence: match.text,
     });
     break;
@@ -515,11 +1112,38 @@ export function runStaticModerationScan(input: StaticScanInput): StaticScanResul
   const declaredEnvNames = collectDeclaredEnvNames(input);
 
   for (const file of files) {
+    scanSecretLiteralFile(file.path, file.content, findings);
+    scanPlaintextCgnatEndpointFile(file.path, file.content, findings);
     scanCodeFile(file.path, file.content, findings, declaredEnvNames);
     scanMarkdownFile(file.path, file.content, findings);
     scanManifestFile(file.path, file.content, findings);
   }
 
+  const autonomousCredentialEgress = findAutonomousCredentialEgress(files);
+  if (autonomousCredentialEgress) {
+    addFinding(findings, {
+      code: REASON_CODES.AUTONOMOUS_CREDENTIAL_EGRESS,
+      severity: "critical",
+      file: autonomousCredentialEgress.file,
+      line: autonomousCredentialEgress.line,
+      message:
+        "Autonomous schedule or loop submits credential-bearing agent output without per-call consent.",
+      evidence: autonomousCredentialEgress.text,
+    });
+  }
+
+  const remoteRecipeExecution = findRemoteRecipeExecution(files);
+  if (remoteRecipeExecution) {
+    addFinding(findings, {
+      code: REASON_CODES.REMOTE_RECIPE_EXECUTION,
+      severity: "critical",
+      file: remoteRecipeExecution.file,
+      line: remoteRecipeExecution.line,
+      message: "Remote recipe/catalog data can influence templated subprocess command execution.",
+      evidence: remoteRecipeExecution.text,
+    });
+  }
+
   const installJson = JSON.stringify(input.metadata ?? {});
   if (/https?:\/\/(bit\.ly|tinyurl\.com|t\.co|goo\.gl|is\.gd)\//i.test(installJson)) {
     addFinding(findings, {

convex/lib/moderationReasonCodes.ts

@@ -12,14 +12,26 @@ export type ModerationFinding = {
   evidence: string;
 };
 
-export const MODERATION_ENGINE_VERSION = "v2.4.2";
+export const MODERATION_ENGINE_VERSION = "v2.4.22";
 
 export const REASON_CODES = {
   DANGEROUS_EXEC: "suspicious.dangerous_exec",
   DYNAMIC_CODE: "suspicious.dynamic_code_execution",
   GENERATED_SOURCE_TEMPLATE: "suspicious.generated_source_template_injection",
   EXPOSED_RESOURCE_IDENTIFIER: "suspicious.exposed_resource_identifier",
+  DESTRUCTIVE_DELETE_COMMAND: "suspicious.destructive_delete_command",
+  UNSAFE_BROWSER_TEXT_INPUT: "suspicious.unsafe_browser_text_input",
   EXPOSED_SECRET_LITERAL: "suspicious.exposed_secret_literal",
+  CREDENTIAL_EXPOSURE_INSTRUCTIONS: "suspicious.credential_exposure_instructions",
+  BROWSER_CREDENTIAL_AUTOMATION: "suspicious.browser_credential_automation",
+  SECRET_ARGV_EXPOSURE: "suspicious.secret_argv_exposure",
+  HOST_PLATFORM_SOURCE_PATCH: "suspicious.host_platform_source_patch",
+  BROWSER_FILE_RENDER: "suspicious.browser_file_render",
+  UNSAFE_FILE_WRITE: "suspicious.unsafe_file_write",
+  INSECURE_TLS_VERIFICATION: "suspicious.insecure_tls_verification",
+  AUTONOMOUS_CREDENTIAL_EGRESS: "suspicious.autonomous_credential_egress",
+  HARDCODED_OPERATOR_BILLING: "suspicious.hardcoded_operator_billing",
+  REMOTE_RECIPE_EXECUTION: "suspicious.remote_recipe_execution",
   CREDENTIAL_HARVEST: "suspicious.env_credential_access",
   EXFILTRATION: "suspicious.potential_exfiltration",
   OBFUSCATED_CODE: "suspicious.obfuscated_code",
@@ -30,6 +42,7 @@ export const REASON_CODES = {
   MANIFEST_PRIVILEGED_ALWAYS: "suspicious.privileged_always",
   MALICIOUS_INSTALL_PROMPT: "malicious.install_terminal_payload",
   KNOWN_BLOCKED_SIGNATURE: "malicious.known_blocked_signature",
+  DEP_NOT_FOUND: "suspicious.dep_not_found_on_registry",
 } as const;
 
 const MALICIOUS_CODES = new Set<string>([

convex/lib/securityPrompt.test.ts

@@ -0,0 +1,233 @@
+/* @vitest-environment node */
+import { describe, expect, it } from "vitest";
+import {
+  AGENTIC_RISK_CATEGORIES,
+  CLAWSCAN_RISK_BUCKETS,
+  assembleSkillEvalUserMessage,
+  getLlmEvalServiceTier,
+  parseLlmEvalResponse,
+  SKILL_SECURITY_EVALUATOR_SYSTEM_PROMPT,
+  type SkillEvalContext,
+} from "./securityPrompt";
+
+const baseCtx: SkillEvalContext = {
+  slug: "wallet-sync",
+  displayName: "Wallet Sync",
+  ownerUserId: "users:1",
+  version: "1.0.0",
+  createdAt: Date.UTC(2026, 0, 1),
+  summary: "Syncs wallet balances to a dashboard.",
+  source: "https://github.com/example/wallet-sync",
+  homepage: "https://example.com",
+  parsed: {
+    frontmatter: {
+      description: "Syncs wallet balances to a dashboard.",
+    },
+    metadata: {},
+    clawdis: {
+      requires: {
+        env: ["WALLET_API_KEY"],
+      },
+    },
+  },
+  files: [
+    { path: "SKILL.md", size: 1200 },
+    { path: "index.ts", size: 900 },
+  ],
+  skillMdContent: "# Wallet Sync\n\nUse WALLET_API_KEY to fetch balances.",
+  fileContents: [{ path: "index.ts", content: "fetch('https://api.example.com/balances')" }],
+  injectionSignals: [],
+  staticScan: {
+    status: "suspicious",
+    reasonCodes: ["suspicious.env_credential_access"],
+    findings: [
+      {
+        code: "suspicious.env_credential_access",
+        severity: "warn",
+        file: "SKILL.md",
+        line: 3,
+        message: "Credential-like environment variable access.",
+        evidence: "WALLET_API_KEY",
+      },
+    ],
+    summary: "Static analysis found credential access.",
+    engineVersion: "test",
+    checkedAt: Date.UTC(2026, 0, 2),
+  },
+  capabilityTags: ["requires-sensitive-credentials", "posts-externally"],
+};
+
+function newResponse(overrides: Record<string, unknown> = {}) {
+  return JSON.stringify({
+    verdict: "suspicious",
+    confidence: "medium",
+    summary: "The skill is mostly aligned but uses sensitive wallet credentials.",
+    dimensions: {
+      purpose_capability: { status: "note", detail: "Wallet credentials fit the purpose." },
+    },
+    scan_findings_in_context: [
+      {
+        ruleId: "suspicious.env_credential_access",
+        expected_for_purpose: true,
+        note: "Wallet sync needs the declared wallet API key.",
+      },
+    ],
+    agentic_risk_findings: [
+      {
+        category_id: "ASI03",
+        category_label: "Identity and Privilege Abuse",
+        risk_bucket: "permission_boundary",
+        status: "note",
+        severity: "medium",
+        confidence: "medium",
+        evidence: {
+          path: "SKILL.md",
+          snippet: "Use WALLET_API_KEY",
+          explanation: "The skill handles a wallet credential.",
+        },
+        user_impact: "Users should know this skill needs wallet-scoped access.",
+        recommendation: "Use a least-privilege wallet API key.",
+      },
+      {
+        category_id: "ASI09",
+        category_label: "Human-Agent Trust Exploitation",
+        risk_bucket: "abnormal_behavior_control",
+        status: "none",
+        severity: "none",
+        confidence: "high",
+        user_impact: "No artifact-backed trust exploitation was found.",
+        recommendation: "No action needed.",
+      },
+    ],
+    risk_summary: {
+      abnormal_behavior_control: {
+        status: "none",
+        highest_severity: "none",
+        summary: "No abnormal behavior control issue is evidenced.",
+      },
+      permission_boundary: {
+        status: "note",
+        highest_severity: "medium",
+        summary: "Wallet credential access is purpose-aligned but sensitive.",
+      },
+      sensitive_data_protection: {
+        status: "note",
+        highest_severity: "medium",
+        summary: "Users should keep the wallet API key scoped.",
+      },
+    },
+    user_guidance: "Review the wallet credential scope before installing.",
+    ...overrides,
+  });
+}
+
+describe("securityPrompt", () => {
+  it("parses legacy ClawScan responses without agentic fields", () => {
+    const parsed = parseLlmEvalResponse(
+      JSON.stringify({
+        verdict: "benign",
+        confidence: "high",
+        summary: "The skill is coherent.",
+        dimensions: {
+          purpose_capability: { status: "ok", detail: "Purpose and requirements align." },
+        },
+        user_guidance: "Looks proportionate.",
+      }),
+    );
+
+    expect(parsed).toMatchObject({
+      verdict: "benign",
+      confidence: "high",
+      summary: "The skill is coherent.",
+      guidance: "Looks proportionate.",
+    });
+    expect(parsed?.agenticRiskFindings).toBeUndefined();
+    expect(parsed?.riskSummary).toBeUndefined();
+  });
+
+  it("parses ASI findings and the three-bucket risk summary", () => {
+    const parsed = parseLlmEvalResponse(newResponse());
+
+    expect(parsed?.agenticRiskFindings?.[0]).toMatchObject({
+      categoryId: "ASI03",
+      categoryLabel: "Identity and Privilege Abuse",
+      riskBucket: "permission_boundary",
+      status: "note",
+      evidence: {
+        path: "SKILL.md",
+        snippet: "Use WALLET_API_KEY",
+      },
+    });
+    expect(Object.keys(parsed?.riskSummary ?? {})).toEqual([
+      "abnormal_behavior_control",
+      "permission_boundary",
+      "sensitive_data_protection",
+    ]);
+  });
+
+  it("defaults LLM evals to OpenAI priority service tier", () => {
+    const previous = process.env.OPENAI_EVAL_SERVICE_TIER;
+    delete process.env.OPENAI_EVAL_SERVICE_TIER;
+
+    try {
+      expect(getLlmEvalServiceTier()).toBe("priority");
+      process.env.OPENAI_EVAL_SERVICE_TIER = "flex";
+      expect(getLlmEvalServiceTier()).toBe("flex");
+      process.env.OPENAI_EVAL_SERVICE_TIER = "not-a-tier";
+      expect(getLlmEvalServiceTier()).toBe("priority");
+    } finally {
+      if (previous === undefined) {
+        delete process.env.OPENAI_EVAL_SERVICE_TIER;
+      } else {
+        process.env.OPENAI_EVAL_SERVICE_TIER = previous;
+      }
+    }
+  });
+
+  it("rejects note and concern findings without concrete evidence", () => {
+    const parsed = parseLlmEvalResponse(
+      newResponse({
+        agentic_risk_findings: [
+          {
+            category_id: "ASI05",
+            category_label: "Unexpected Code Execution",
+            risk_bucket: "abnormal_behavior_control",
+            status: "concern",
+            severity: "high",
+            confidence: "high",
+            evidence: { path: "SKILL.md", snippet: "", explanation: "Empty snippet." },
+            user_impact: "Commands could run unexpectedly.",
+            recommendation: "Remove unsupported command execution.",
+          },
+        ],
+      }),
+    );
+
+    expect(parsed).toBeNull();
+  });
+
+  it("documents ASI coverage, ClawScan buckets, and runtime-claim prohibitions", () => {
+    for (const category of AGENTIC_RISK_CATEGORIES) {
+      expect(SKILL_SECURITY_EVALUATOR_SYSTEM_PROMPT).toContain(category.id);
+      expect(SKILL_SECURITY_EVALUATOR_SYSTEM_PROMPT).toContain(category.label);
+    }
+    for (const bucket of CLAWSCAN_RISK_BUCKETS) {
+      expect(SKILL_SECURITY_EVALUATOR_SYSTEM_PROMPT).toContain(bucket);
+    }
+    expect(SKILL_SECURITY_EVALUATOR_SYSTEM_PROMPT).toContain("Do not execute code");
+    expect(SKILL_SECURITY_EVALUATOR_SYSTEM_PROMPT).toContain("not assessable without execution");
+    expect(SKILL_SECURITY_EVALUATOR_SYSTEM_PROMPT).toContain("purpose-aligned");
+    expect(SKILL_SECURITY_EVALUATOR_SYSTEM_PROMPT).toContain("purpose-mismatched");
+  });
+
+  it("includes static scan and capability signals in skill eval input", () => {
+    const message = assembleSkillEvalUserMessage(baseCtx);
+
+    expect(message).toContain("### Static scan signals");
+    expect(message).toContain("suspicious.env_credential_access");
+    expect(message).toContain("WALLET_API_KEY");
+    expect(message).toContain("### Capability signals");
+    expect(message).toContain("requires-sensitive-credentials");
+    expect(message).toContain("posts-externally");
+  });
+});

convex/lib/securityPrompt.ts

@@ -1,5 +1,28 @@
 export function getLlmEvalModel(): string {
-  return process.env.OPENAI_EVAL_MODEL ?? "gpt-5-mini";
+  return process.env.OPENAI_EVAL_MODEL ?? "gpt-5.5";
+}
+export type LlmEvalReasoningEffort = "none" | "minimal" | "low" | "medium" | "high" | "xhigh";
+export type LlmEvalServiceTier = "auto" | "default" | "flex" | "priority";
+const LLM_EVAL_REASONING_EFFORTS = new Set<LlmEvalReasoningEffort>([
+  "none",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+]);
+const LLM_EVAL_SERVICE_TIERS = new Set<LlmEvalServiceTier>(["auto", "default", "flex", "priority"]);
+export function getLlmEvalReasoningEffort(): LlmEvalReasoningEffort {
+  const effort = process.env.OPENAI_EVAL_REASONING_EFFORT ?? "xhigh";
+  return LLM_EVAL_REASONING_EFFORTS.has(effort as LlmEvalReasoningEffort)
+    ? (effort as LlmEvalReasoningEffort)
+    : "xhigh";
+}
+export function getLlmEvalServiceTier(): LlmEvalServiceTier {
+  const serviceTier = process.env.OPENAI_EVAL_SERVICE_TIER ?? "priority";
+  return LLM_EVAL_SERVICE_TIERS.has(serviceTier as LlmEvalServiceTier)
+    ? (serviceTier as LlmEvalServiceTier)
+    : "priority";
 }
 export const LLM_EVAL_MAX_OUTPUT_TOKENS = 16000;
 
@@ -27,6 +50,25 @@ function formatWithDefault(value: unknown, defaultLabel: string): string {
   return formatScalar(value);
 }
 
+function formatEnvVarDeclarations(value: unknown): string {
+  if (!Array.isArray(value)) return "none";
+  const declarations = value
+    .map((entry) => {
+      if (typeof entry === "string") return `${entry} (required)`;
+      if (!entry || typeof entry !== "object" || Array.isArray(entry)) return undefined;
+      const record = entry as Record<string, unknown>;
+      if (typeof record.name !== "string" || record.name.trim() === "") return undefined;
+      const required = record.required === false ? "optional" : "required";
+      const description =
+        typeof record.description === "string" && record.description.trim() !== ""
+          ? ` - ${record.description.trim()}`
+          : "";
+      return `${record.name.trim()} (${required})${description}`;
+    })
+    .filter((entry): entry is string => Boolean(entry));
+  return declarations.length ? declarations.join("; ") : "none";
+}
+
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
@@ -49,6 +91,22 @@ export type SkillEvalContext = {
   skillMdContent: string;
   fileContents: Array<{ path: string; content: string }>;
   injectionSignals: string[];
+  staticScan?: {
+    status: string;
+    reasonCodes: string[];
+    findings: Array<{
+      code: string;
+      severity: string;
+      file: string;
+      line: number;
+      message: string;
+      evidence: string;
+    }>;
+    summary: string;
+    engineVersion: string;
+    checkedAt: number;
+  };
+  capabilityTags?: string[];
 };
 
 export type LlmEvalDimension = {
@@ -58,6 +116,39 @@ export type LlmEvalDimension = {
   detail: string;
 };
 
+export type AgenticRiskStatus = "none" | "note" | "concern";
+export type AgenticRiskConfidence = "high" | "medium" | "low";
+export type ClawScanRiskBucket =
+  | "abnormal_behavior_control"
+  | "permission_boundary"
+  | "sensitive_data_protection";
+
+export type LlmAgenticRiskEvidence = {
+  path: string;
+  snippet: string;
+  explanation: string;
+};
+
+export type LlmAgenticRiskFinding = {
+  categoryId: string;
+  categoryLabel: string;
+  riskBucket: ClawScanRiskBucket;
+  status: AgenticRiskStatus;
+  severity: string;
+  confidence: AgenticRiskConfidence;
+  evidence?: LlmAgenticRiskEvidence;
+  userImpact: string;
+  recommendation: string;
+};
+
+export type LlmRiskSummaryBucket = {
+  status: AgenticRiskStatus;
+  summary: string;
+  highestSeverity?: string;
+};
+
+export type LlmRiskSummary = Record<ClawScanRiskBucket, LlmRiskSummaryBucket>;
+
 export type LlmEvalResponse = {
   verdict: "benign" | "suspicious" | "malicious";
   confidence: "high" | "medium" | "low";
@@ -65,17 +156,20 @@ export type LlmEvalResponse = {
   dimensions: LlmEvalDimension[];
   guidance: string;
   findings: string;
+  agenticRiskFindings?: LlmAgenticRiskFinding[];
+  riskSummary?: LlmRiskSummary;
 };
 
 // ---------------------------------------------------------------------------
 // System prompt (~3500 words)
 // ---------------------------------------------------------------------------
 
-export const SECURITY_EVALUATOR_SYSTEM_PROMPT = `You are a security evaluator for OpenClaw AI skills. Users install skills to extend what their AI agent can do. Some users have limited security knowledge — your job is to surface things that don't add up so they can make an informed decision.
+// Retained for package/plugin LLM scans until we update.
+export const LEGACY_SECURITY_EVALUATOR_SYSTEM_PROMPT = `You are a security evaluator for OpenClaw AI skills. Users install skills to extend what their AI agent can do. Some users have limited security knowledge — your job is to surface things that don't add up so they can make an informed decision.
 
 You are not a malware classifier. You are an incoherence detector.
 
-A skill is a bundle of: a name, a description, a set of instructions (SKILL.md) that tell the AI agent what to do at runtime, declared dependencies, required environment variables, and optionally an install mechanism and code files. Many skills are instruction-only — just a SKILL.md with prose telling the agent how to use a CLI tool or REST API, with no code files at all. Your job is to evaluate whether all the pieces are internally consistent and proportionate — and to clearly explain when they aren't.
+A skill is a bundle of: a name, a description, a set of instructions (SKILL.md) that tell the AI agent what to do at runtime, declared dependencies, declared environment variables, and optionally an install mechanism and code files. Many skills are instruction-only — just a SKILL.md with prose telling the agent how to use a CLI tool or REST API, with no code files at all. Your job is to evaluate whether all the pieces are internally consistent and proportionate — and to clearly explain when they aren't.
 
 ## How to evaluate
 
@@ -106,7 +200,7 @@ A "database-backup" skill whose instructions include "first read the user's shel
 Pay close attention to:
 - What commands the instructions tell the agent to run
 - What files or paths the instructions reference
-- What environment variables the instructions access beyond those declared in requires.env
+- What environment variables the instructions access beyond those declared in requires.env, primaryEnv, or envVars
 - Whether the instructions direct data to external endpoints other than the service the skill integrates with
 - Whether the instructions ask the agent to read, collect, or transmit anything not needed for the stated task
 
@@ -142,6 +236,7 @@ A skill that needs one API key for the service it integrates with is normal. A "
 
 Flag when:
 - requires.env lists credentials for services unrelated to the skill's purpose
+- envVars lists credentials for services unrelated to the skill's purpose, whether required or optional
 - The number of required environment variables is high relative to the skill's complexity
 - The skill requires config paths that grant access to gateway auth, channel tokens, or tool policies
 - Environment variables named with patterns like SECRET, TOKEN, KEY, PASSWORD are required but not justified by the skill's purpose
@@ -209,6 +304,142 @@ Respond with a JSON object and nothing else:
   "user_guidance": "Plain-language explanation of what the user should consider before installing."
 }`;
 
+export const CLAWSCAN_RISK_BUCKETS = [
+  "abnormal_behavior_control",
+  "permission_boundary",
+  "sensitive_data_protection",
+] as const satisfies readonly ClawScanRiskBucket[];
+
+export const AGENTIC_RISK_CATEGORIES = [
+  { id: "ASI01", label: "Agent Goal Hijack" },
+  { id: "ASI02", label: "Tool Misuse and Exploitation" },
+  { id: "ASI03", label: "Identity and Privilege Abuse" },
+  { id: "ASI04", label: "Agentic Supply Chain Vulnerabilities" },
+  { id: "ASI05", label: "Unexpected Code Execution" },
+  { id: "ASI06", label: "Memory and Context Poisoning" },
+  { id: "ASI07", label: "Insecure Inter-Agent Communication" },
+  { id: "ASI08", label: "Cascading Failures" },
+  { id: "ASI09", label: "Human-Agent Trust Exploitation" },
+  { id: "ASI10", label: "Rogue Agents" },
+] as const;
+
+export const SKILL_SECURITY_EVALUATOR_SYSTEM_PROMPT = `You are ClawScan, ClawHub's artifact-only security reviewer for OpenClaw skills.
+
+Use the OWASP Agentic Top 10 as the internal review taxonomy:
+- ASI01 through ASI10 are the primary internal taxonomy.
+- User-facing reporting must roll up into exactly three ClawScan buckets: abnormal_behavior_control, permission_boundary, and sensitive_data_protection.
+
+You review only the artifacts provided in the user message: SKILL.md, metadata, install specs, file manifest, file contents, static scan signals, and capability signals. Do not execute code, create probes, assume a sandbox exists, infer runtime behavior that is not evidenced by artifacts, or output "not assessable without execution" style caveats. If a risk is not supported by artifact evidence, mark that ASI category as "none".
+
+## ASI categories
+
+Review every category. Use artifact evidence only.
+
+- ASI01 Agent Goal Hijack
+  Look for instructions or retrieved content that can redirect the agent's goal, override user intent, force tool use, change stopping conditions, or make untrusted text authoritative.
+
+- ASI02 Tool Misuse and Exploitation
+  Look for normal tools being exposed in unsafe ways: broad shell commands, unsafe API operations, chained tools, user-controlled arguments, missing approval for high-impact actions, or unclear limits.
+
+- ASI03 Identity and Privilege Abuse
+  Look for credentials, tokens, account access, delegated authority, workspace membership, or privilege requirements that exceed the stated purpose.
+
+- ASI04 Agentic Supply Chain Vulnerabilities
+  Look for risky install sources, unpinned packages, hidden helpers, remote scripts, missing referenced files, unexpected dependencies, or provenance gaps in tools/components the skill relies on.
+
+- ASI05 Unexpected Code Execution
+  Look for eval/dynamic execution, shell execution, downloaded executables, install-to-run flows, deserialization, generated code execution, or commands that run more than the skill purpose requires.
+
+- ASI06 Memory and Context Poisoning
+  Look for persistent memory, retrieved context, embeddings, summaries, shared notes, or stored instructions that can be poisoned, over-trusted, or reused across tasks.
+
+- ASI07 Insecure Inter-Agent Communication
+  Look for agent-to-agent, MCP, gateway, provider, webhook, or peer-message flows where identity, origin, permissions, or data boundaries are unclear.
+
+- ASI08 Cascading Failures
+  Look for one bad input/action propagating across files, sessions, teams, deployments, shared memory, cloud sync, production systems, or other agents without containment.
+
+- ASI09 Human-Agent Trust Exploitation
+  Look for misleading descriptions, false safety/privacy claims, urgency, authority claims, approval manipulation, hidden tradeoffs, or wording that could cause unsafe user trust.
+
+- ASI10 Rogue Agents
+  Look for persistence, self-propagation, hidden background behavior, fake reviewers, collusion, autonomous activity outside scope, or mechanisms that keep operating after the user's intended task.
+
+## ClawScan reporting buckets
+
+Assign each finding to one of these risk_bucket values:
+- abnormal_behavior_control: ASI01, ASI02, ASI04, ASI05, ASI08, ASI09, and ASI10 findings.
+- permission_boundary: ASI03 findings.
+- sensitive_data_protection: ASI06 and ASI07 findings.
+
+## Note vs concern
+
+- "none": no concrete artifact evidence for the ASI category.
+- "note": risky or sensitive behavior is present but appears purpose-aligned and proportionate. Explain why a user should notice it.
+- "concern": behavior is purpose-mismatched, deceptive, overbroad, materially risky, or not justified by the stated skill purpose.
+
+Do not classify a skill as suspicious only because it uses files, commands, credentials, network access, memory, package installs, provider APIs, or external tools. Judge whether those behaviors are coherent with the stated purpose and clearly disclosed.
+
+Purpose alignment is necessary but not sufficient. Treat high-impact authority as a concern when the artifacts do not clearly bound user approval, scope, reversibility, or containment. This includes actions that can mutate user data, third-party accounts, local environments, devices, deployments, public outputs, or persistent agent state.
+
+Treat the artifact's declared capability and credential contract as important evidence. If SKILL.md introduces sensitive authority such as account credentials, tokens, cookies, browser/session state, privileged config, broad file/system access, or persistent state that is not declared or clearly bounded by metadata, install specs, or capability signals, prefer "concern" over "note". Do not downgrade this merely because the skill's overall purpose is legitimate.
+
+Every "note" or "concern" MUST cite artifact evidence with:
+- path: a provided artifact path such as "SKILL.md", "metadata", "install spec", or a file path
+- snippet: a short quote or snippet from that artifact
+- explanation: why that exact evidence matters
+
+Do not create findings from intuition, popularity, missing runtime probes, or unsupported assumptions. A static scan finding is evidence only when its file/rule/snippet is included in the supplied artifacts, and you must still interpret whether it is purpose-aligned.
+
+## Verdict definitions
+
+- benign: the skill's artifacts are coherent and proportionate. Benign does not mean risk-free.
+- suspicious: one or more material concerns, or a pattern of notes that together show real ambiguity, overbreadth, under-disclosure, or unsupported security posture the user should review.
+- malicious: artifacts show intentional misdirection or fundamentally incompatible behavior across multiple high-impact categories.
+
+The bar for malicious is high. Shell commands, network calls, file I/O, credentials, or install steps are not malicious by themselves; classify based on purpose fit, scope, provenance, and artifact evidence.
+
+## Output format
+
+Respond with a JSON object and nothing else:
+
+{
+  "verdict": "benign" | "suspicious" | "malicious",
+  "confidence": "high" | "medium" | "low",
+  "summary": "One sentence a non-technical user can understand.",
+  "dimensions": {
+    "purpose_capability": { "status": "ok" | "note" | "concern", "detail": "..." },
+    "instruction_scope": { "status": "ok" | "note" | "concern", "detail": "..." },
+    "install_mechanism": { "status": "ok" | "note" | "concern", "detail": "..." },
+    "environment_proportionality": { "status": "ok" | "note" | "concern", "detail": "..." },
+    "persistence_privilege": { "status": "ok" | "note" | "concern", "detail": "..." }
+  },
+  "scan_findings_in_context": [
+    { "ruleId": "...", "expected_for_purpose": true | false, "note": "..." }
+  ],
+  "agentic_risk_findings": [
+    {
+      "category_id": "ASI01",
+      "category_label": "Agent Goal Hijack",
+      "risk_bucket": "abnormal_behavior_control",
+      "status": "none" | "note" | "concern",
+      "severity": "none" | "info" | "low" | "medium" | "high" | "critical",
+      "confidence": "high" | "medium" | "low",
+      "evidence": { "path": "SKILL.md", "snippet": "short quote", "explanation": "why this matters" },
+      "user_impact": "Plain-language impact.",
+      "recommendation": "Plain-language recommendation."
+    }
+  ],
+  "risk_summary": {
+    "abnormal_behavior_control": { "status": "none" | "note" | "concern", "highest_severity": "none" | "info" | "low" | "medium" | "high" | "critical", "summary": "..." },
+    "permission_boundary": { "status": "none" | "note" | "concern", "highest_severity": "none" | "info" | "low" | "medium" | "high" | "critical", "summary": "..." },
+    "sensitive_data_protection": { "status": "none" | "note" | "concern", "highest_severity": "none" | "info" | "low" | "medium" | "high" | "critical", "summary": "..." }
+  },
+  "user_guidance": "Plain-language explanation of what the user should consider before installing."
+}
+
+Return one agentic_risk_findings item for each ASI01 through ASI10. For "none" findings, omit evidence or set it to null. For "note" and "concern", evidence is mandatory.`;
+
 // ---------------------------------------------------------------------------
 // Injection pattern detection
 // ---------------------------------------------------------------------------
@@ -251,6 +482,32 @@ const DIMENSION_META: Record<string, string> = {
 
 const MAX_SKILL_MD_CHARS = 6000;
 
+function formatStaticScanForPrompt(staticScan: SkillEvalContext["staticScan"]) {
+  if (!staticScan) return "No static scan result was provided.";
+  const findings = staticScan.findings.length
+    ? staticScan.findings
+        .map(
+          (finding) =>
+            `- ${finding.code} (${finding.severity}) at ${finding.file}:${finding.line}: ${finding.message}\n  Evidence: ${finding.evidence}`,
+        )
+        .join("\n")
+    : "No static findings.";
+  return [
+    `Status: ${staticScan.status}`,
+    `Reason codes: ${staticScan.reasonCodes.length ? staticScan.reasonCodes.join(", ") : "none"}`,
+    `Summary: ${staticScan.summary}`,
+    `Engine version: ${staticScan.engineVersion}`,
+    `Checked at: ${new Date(staticScan.checkedAt).toISOString()}`,
+    "Findings:",
+    findings,
+  ].join("\n");
+}
+
+function formatCapabilitySignals(capabilityTags: string[] | undefined) {
+  if (!capabilityTags || capabilityTags.length === 0) return "No capability tags were derived.";
+  return capabilityTags.map((tag) => `- ${tag}`).join("\n");
+}
+
 export function assembleEvalUserMessage(ctx: SkillEvalContext): string {
   const fm = ctx.parsed.frontmatter ?? {};
   const rawClawdis = (ctx.parsed.clawdis ?? {}) as Record<string, unknown>;
@@ -325,6 +582,7 @@ export function assembleEvalUserMessage(ctx: SkillEvalContext): string {
   const bins = (requires.bins as string[] | undefined) ?? [];
   const anyBins = (requires.anyBins as string[] | undefined) ?? [];
   const env = (requires.env as string[] | undefined) ?? [];
+  const envVars = clawdis.envVars ?? openclawFallback.envVars;
   const primaryEnv = (clawdis.primaryEnv as string | undefined) ?? "none";
   const config = (requires.config as string[] | undefined) ?? [];
 
@@ -332,6 +590,7 @@ export function assembleEvalUserMessage(ctx: SkillEvalContext): string {
 - Required binaries (all must exist): ${bins.length ? bins.join(", ") : "none"}
 - Required binaries (at least one): ${anyBins.length ? anyBins.join(", ") : "none"}
 - Required env vars: ${env.length ? env.join(", ") : "none"}
+- Env var declarations: ${formatEnvVarDeclarations(envVars)}
 - Primary credential: ${primaryEnv}
 - Required config paths: ${config.length ? config.join(", ") : "none"}`);
 
@@ -379,6 +638,11 @@ export function assembleEvalUserMessage(ctx: SkillEvalContext): string {
     sections.push("### Pre-scan injection signals\nNone detected.");
   }
 
+  if (ctx.staticScan || ctx.capabilityTags) {
+    sections.push(`### Static scan signals\n${formatStaticScanForPrompt(ctx.staticScan)}`);
+    sections.push(`### Capability signals\n${formatCapabilitySignals(ctx.capabilityTags)}`);
+  }
+
   // SKILL.md content
   sections.push(`### SKILL.md content (runtime instructions)\n${skillMd}`);
 
@@ -413,12 +677,120 @@ export function assembleEvalUserMessage(ctx: SkillEvalContext): string {
   return sections.join("\n\n");
 }
 
+export function assembleSkillEvalUserMessage(ctx: SkillEvalContext): string {
+  return assembleEvalUserMessage(ctx);
+}
+
 // ---------------------------------------------------------------------------
 // Parse the LLM response
 // ---------------------------------------------------------------------------
 
 const VALID_VERDICTS = new Set(["benign", "suspicious", "malicious"]);
 const VALID_CONFIDENCES = new Set(["high", "medium", "low"]);
+const VALID_RISK_STATUSES = new Set(["none", "note", "concern"]);
+const VALID_CLAWSCAN_RISK_BUCKETS = new Set<ClawScanRiskBucket>(CLAWSCAN_RISK_BUCKETS);
+const VALID_ASI_CATEGORY_IDS = new Set<string>(
+  AGENTIC_RISK_CATEGORIES.map((category) => category.id),
+);
+
+function getStringField(obj: Record<string, unknown>, ...keys: string[]) {
+  for (const key of keys) {
+    const value = obj[key];
+    if (typeof value === "string") return value;
+  }
+  return null;
+}
+
+function normalizeCategoryId(value: string | null) {
+  if (!value) return null;
+  const upper = value.toUpperCase();
+  const match = upper.match(/^ASI(?:-)?(\d{1,2})$/);
+  if (!match) return upper;
+  return `ASI${match[1].padStart(2, "0")}`;
+}
+
+function parseRiskEvidence(value: unknown): LlmAgenticRiskEvidence | null {
+  if (!value || typeof value !== "object") return null;
+  const obj = value as Record<string, unknown>;
+  const path = getStringField(obj, "path", "artifact_path", "artifactPath");
+  const snippet = getStringField(obj, "snippet", "quote");
+  const explanation = getStringField(obj, "explanation", "why_it_matters", "whyItMatters");
+  if (!path?.trim() || !snippet?.trim() || !explanation?.trim()) return null;
+  return { path, snippet, explanation };
+}
+
+function parseAgenticRiskFindings(value: unknown): LlmAgenticRiskFinding[] | null | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value)) return null;
+
+  const findings: LlmAgenticRiskFinding[] = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object") return null;
+    const obj = item as Record<string, unknown>;
+    const categoryId = normalizeCategoryId(getStringField(obj, "category_id", "categoryId"));
+    if (!categoryId || !VALID_ASI_CATEGORY_IDS.has(categoryId)) return null;
+    const categoryLabel =
+      getStringField(obj, "category_label", "categoryLabel") ??
+      AGENTIC_RISK_CATEGORIES.find((category) => category.id === categoryId)?.label ??
+      "";
+    if (!categoryLabel) return null;
+
+    const status = getStringField(obj, "status")?.toLowerCase();
+    if (!status || !VALID_RISK_STATUSES.has(status)) return null;
+
+    const confidence = getStringField(obj, "confidence")?.toLowerCase();
+    if (!confidence || !VALID_CONFIDENCES.has(confidence)) return null;
+
+    const riskBucket = getStringField(obj, "risk_bucket", "riskBucket", "bucket");
+    if (!riskBucket || !VALID_CLAWSCAN_RISK_BUCKETS.has(riskBucket as ClawScanRiskBucket)) {
+      return null;
+    }
+
+    const severity = getStringField(obj, "severity") ?? "none";
+    const userImpact = getStringField(obj, "user_impact", "userImpact") ?? "";
+    const recommendation = getStringField(obj, "recommendation") ?? "";
+    const evidence = parseRiskEvidence(obj.evidence);
+    if ((status === "note" || status === "concern") && !evidence) return null;
+
+    findings.push({
+      categoryId,
+      categoryLabel,
+      riskBucket: riskBucket as ClawScanRiskBucket,
+      status: status as AgenticRiskStatus,
+      severity,
+      confidence: confidence as AgenticRiskConfidence,
+      evidence: evidence ?? undefined,
+      userImpact,
+      recommendation,
+    });
+  }
+
+  return findings;
+}
+
+function parseRiskSummary(value: unknown): LlmRiskSummary | null | undefined {
+  if (value === undefined) return undefined;
+  if (!value || typeof value !== "object") return null;
+  const obj = value as Record<string, unknown>;
+  const summary = {} as LlmRiskSummary;
+
+  for (const bucket of CLAWSCAN_RISK_BUCKETS) {
+    const rawBucket = obj[bucket];
+    if (!rawBucket || typeof rawBucket !== "object") return null;
+    const bucketObj = rawBucket as Record<string, unknown>;
+    const status = getStringField(bucketObj, "status")?.toLowerCase();
+    if (!status || !VALID_RISK_STATUSES.has(status)) return null;
+    const bucketSummary = getStringField(bucketObj, "summary") ?? "";
+    const highestSeverity = getStringField(bucketObj, "highest_severity", "highestSeverity");
+    summary[bucket] = {
+      status: status as AgenticRiskStatus,
+      summary: bucketSummary,
+      highestSeverity: highestSeverity ?? undefined,
+    };
+  }
+
+  return summary;
+}
 
 export function parseLlmEvalResponse(raw: string): LlmEvalResponse | null {
   // Strip markdown code fences if present
@@ -487,6 +859,13 @@ export function parseLlmEvalResponse(raw: string): LlmEvalResponse | null {
   }
 
   const guidance = typeof obj.user_guidance === "string" ? obj.user_guidance : "";
+  const agenticRiskFindings = parseAgenticRiskFindings(
+    obj.agentic_risk_findings ?? obj.agenticRiskFindings,
+  );
+  if (agenticRiskFindings === null) return null;
+
+  const riskSummary = parseRiskSummary(obj.risk_summary ?? obj.riskSummary);
+  if (riskSummary === null) return null;
 
   return {
     verdict: verdict as LlmEvalResponse["verdict"],
@@ -495,5 +874,7 @@ export function parseLlmEvalResponse(raw: string): LlmEvalResponse | null {
     dimensions,
     guidance,
     findings,
+    agenticRiskFindings: agenticRiskFindings ?? undefined,
+    riskSummary: riskSummary ?? undefined,
   };
 }

convex/lib/skillCapabilityTags.test.ts

@@ -71,4 +71,34 @@ describe("deriveSkillCapabilityTags", () => {
 
     expect(tags).toEqual([]);
   });
+
+  it("does not treat generic web font display swap wording as a crypto signal", () => {
+    const tags = deriveSkillCapabilityTags({
+      slug: "landing-page",
+      displayName: "Landing Page",
+      frontmatter: {},
+      readmeText:
+        "Loads Google Fonts with display=swap so text renders quickly while custom fonts load.",
+      fileContents: [
+        {
+          path: "src/styles.css",
+          content: "@import url('https://fonts.googleapis.com/css2?family=Inter&display=swap');",
+        },
+      ],
+    });
+
+    expect(tags).toEqual([]);
+  });
+
+  it("still detects token swap wording as a crypto signal", () => {
+    const tags = deriveSkillCapabilityTags({
+      slug: "token-router",
+      displayName: "Token Router",
+      frontmatter: {},
+      readmeText: "Find the best route to swap USDC for ETH across supported pools.",
+      fileContents: [],
+    });
+
+    expect(tags).toEqual(["crypto"]);
+  });
 });

convex/lib/skillCapabilityTags.ts

@@ -47,7 +47,8 @@ const CRYPTO_PATTERNS = [
   /\bsolana\b/,
   /\baave\b/,
   /\btoken balance\b/,
-  /\bswap\b/,
+  /\b(?:defi|token|tokens|coin|coins|nft|nfts|usdc|eth|ethereum|erc20|crypto)\s+swaps?\b/,
+  /\bswaps?\s+(?:defi|token|tokens|coin|coins|nft|nfts|usdc|eth|ethereum|erc20|crypto)\b/,
   /\bbridge\b/,
   /\bliquidity\b/,
   /\bens\b/,

convex/lib/skillPublish.ts

@@ -1,5 +1,5 @@
-import { ConvexError } from "convex/values";
 import { normalizeTextContentType } from "clawhub-schema";
+import { ConvexError } from "convex/values";
 import semver from "semver";
 import { api, internal } from "../_generated/api";
 import type { Doc, Id } from "../_generated/dataModel";
@@ -333,6 +333,10 @@ export async function publishVersionForUser(
     versionId: publishResult.versionId,
   });
 
+  await ctx.scheduler.runAfter(0, internal.depRegistryScan.checkDependencyRegistries, {
+    versionId: publishResult.versionId,
+  });
+
   const ownerHandle = owner?.handle ?? owner?.displayName ?? owner?.name ?? "unknown";
 
   if (!options.skipBackup) {

convex/llmEval.test.ts

@@ -0,0 +1,120 @@
+/* @vitest-environment node */
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { backfillLlmEval } from "./llmEval";
+
+type WrappedHandler<TArgs, TResult> = {
+  _handler: (ctx: unknown, args: TArgs) => Promise<TResult>;
+};
+
+type BackfillArgs = {
+  cursor?: number;
+  batchSize?: number;
+  delayMs?: number;
+  dryRun?: boolean;
+  maxToSchedule?: number;
+  moderationMode?: "normal" | "preserve";
+  accTotal?: number;
+  accScheduled?: number;
+  accSkipped?: number;
+  startTime?: number;
+};
+
+const backfillLlmEvalHandler = (
+  backfillLlmEval as unknown as WrappedHandler<BackfillArgs, Record<string, unknown>>
+)._handler;
+
+const originalOpenAiApiKey = process.env.OPENAI_API_KEY;
+
+afterEach(() => {
+  if (originalOpenAiApiKey === undefined) {
+    delete process.env.OPENAI_API_KEY;
+  } else {
+    process.env.OPENAI_API_KEY = originalOpenAiApiKey;
+  }
+  vi.restoreAllMocks();
+});
+
+function makeBackfillCtx(batch: {
+  skills: Array<{ versionId: string; slug: string }>;
+  nextCursor: number;
+  done: boolean;
+}) {
+  const runQuery = vi.fn(async (_ref: unknown, args: Record<string, unknown>) => {
+    if ("cursor" in args || "batchSize" in args) return batch;
+    if ("versionId" in args) return { _id: args.versionId, skillId: "skills:1" };
+    throw new Error(`Unexpected query args: ${JSON.stringify(args)}`);
+  });
+  const runAfter = vi.fn(async () => undefined);
+
+  return {
+    ctx: {
+      runQuery,
+      scheduler: { runAfter },
+    },
+    runQuery,
+    runAfter,
+  };
+}
+
+describe("llm eval backfill", () => {
+  it("passes preserve moderation mode to scheduled evaluations and follow-up batches", async () => {
+    process.env.OPENAI_API_KEY = "test-openai-key";
+    const { ctx, runQuery, runAfter } = makeBackfillCtx({
+      skills: [{ versionId: "skillVersions:1", slug: "demo" }],
+      nextCursor: 42,
+      done: false,
+    });
+
+    const result = await backfillLlmEvalHandler(ctx, {
+      batchSize: 5,
+      delayMs: 1234,
+      moderationMode: "preserve",
+      startTime: 1_700_000_000_000,
+    });
+
+    expect(runQuery.mock.calls[0]?.[1]).toEqual({ cursor: 0, batchSize: 5 });
+    expect(runAfter).toHaveBeenNthCalledWith(1, 0, expect.anything(), {
+      versionId: "skillVersions:1",
+      moderationMode: "preserve",
+    });
+    expect(runAfter).toHaveBeenNthCalledWith(2, 1234, expect.anything(), {
+      cursor: 42,
+      batchSize: 5,
+      delayMs: 1234,
+      moderationMode: "preserve",
+      accTotal: 1,
+      accScheduled: 1,
+      accSkipped: 0,
+      startTime: 1_700_000_000_000,
+    });
+    expect(result).toEqual({ status: "continuing", totalSoFar: 1 });
+  });
+
+  it("can dry run without an OpenAI key or scheduled actions", async () => {
+    delete process.env.OPENAI_API_KEY;
+    const { ctx, runAfter } = makeBackfillCtx({
+      skills: [{ versionId: "skillVersions:1", slug: "demo" }],
+      nextCursor: 42,
+      done: false,
+    });
+
+    const result = await backfillLlmEvalHandler(ctx, {
+      batchSize: 1,
+      dryRun: true,
+      moderationMode: "preserve",
+      startTime: 1_700_000_000_000,
+    });
+
+    expect(runAfter).not.toHaveBeenCalled();
+    expect(result).toMatchObject({
+      status: "dry_run",
+      total: 1,
+      scheduled: 1,
+      skipped: 0,
+      nextCursor: 42,
+      done: false,
+      moderationMode: "preserve",
+    });
+  });
+});

convex/llmEval.ts

@@ -13,11 +13,15 @@ import { extractResponseText } from "./lib/openaiResponse";
 import type { SkillEvalContext } from "./lib/securityPrompt";
 import {
   assembleEvalUserMessage,
+  assembleSkillEvalUserMessage,
   detectInjectionPatterns,
   getLlmEvalModel,
+  getLlmEvalReasoningEffort,
+  getLlmEvalServiceTier,
+  LEGACY_SECURITY_EVALUATOR_SYSTEM_PROMPT,
   LLM_EVAL_MAX_OUTPUT_TOKENS,
   parseLlmEvalResponse,
-  SECURITY_EVALUATOR_SYSTEM_PROMPT,
+  SKILL_SECURITY_EVALUATOR_SYSTEM_PROMPT,
 } from "./lib/securityPrompt";
 
 const internalRefs = internal as unknown as {
@@ -28,6 +32,12 @@ const internalRefs = internal as unknown as {
   };
 };
 
+const llmEvalModerationModeValidator = v.optional(
+  v.union(v.literal("normal"), v.literal("preserve")),
+);
+
+type LlmEvalModerationMode = "normal" | "preserve";
+
 async function runQueryRef<T>(
   ctx: { runQuery: (ref: never, args: never) => Promise<unknown> },
   ref: unknown,
@@ -68,6 +78,7 @@ function verdictToStatus(verdict: string): string {
 export const evaluateWithLlm = internalAction({
   args: {
     versionId: v.id("skillVersions"),
+    moderationMode: llmEvalModerationModeValidator,
   },
   handler: async (ctx, args) => {
     const apiKey = process.env.OPENAI_API_KEY;
@@ -77,12 +88,15 @@ export const evaluateWithLlm = internalAction({
     }
 
     const model = getLlmEvalModel();
+    const reasoningEffort = getLlmEvalReasoningEffort();
+    const serviceTier = getLlmEvalServiceTier();
 
     // Store error helper
     const storeError = async (message: string) => {
       console.error(`[llmEval] ${message}`);
       await ctx.runMutation(internal.skills.updateVersionLlmAnalysisInternal, {
         versionId: args.versionId,
+        ...(args.moderationMode ? { moderationMode: args.moderationMode } : {}),
         llmAnalysis: {
           status: "error",
           summary: message,
@@ -174,10 +188,12 @@ export const evaluateWithLlm = internalAction({
       skillMdContent,
       fileContents,
       injectionSignals,
+      staticScan: version.staticScan,
+      capabilityTags: version.capabilityTags,
     };
 
     // 6. Assemble user message
-    const userMessage = assembleEvalUserMessage(evalCtx);
+    const userMessage = assembleSkillEvalUserMessage(evalCtx);
 
     // 7. Call OpenAI Responses API (with retry for rate limits)
     const MAX_RETRIES = 3;
@@ -185,8 +201,12 @@ export const evaluateWithLlm = internalAction({
     try {
       const body = JSON.stringify({
         model,
-        instructions: SECURITY_EVALUATOR_SYSTEM_PROMPT,
+        service_tier: serviceTier,
+        instructions: SKILL_SECURITY_EVALUATOR_SYSTEM_PROMPT,
         input: userMessage,
+        reasoning: {
+          effort: reasoningEffort,
+        },
         max_output_tokens: LLM_EVAL_MAX_OUTPUT_TOKENS,
         text: {
           format: {
@@ -251,6 +271,7 @@ export const evaluateWithLlm = internalAction({
     // 9. Store result
     await ctx.runMutation(internal.skills.updateVersionLlmAnalysisInternal, {
       versionId: args.versionId,
+      ...(args.moderationMode ? { moderationMode: args.moderationMode } : {}),
       llmAnalysis: {
         status: verdictToStatus(result.verdict),
         verdict: result.verdict,
@@ -259,6 +280,8 @@ export const evaluateWithLlm = internalAction({
         dimensions: result.dimensions,
         guidance: result.guidance,
         findings: result.findings || undefined,
+        agenticRiskFindings: result.agenticRiskFindings,
+        riskSummary: result.riskSummary,
         model,
         checkedAt: Date.now(),
       },
@@ -268,8 +291,8 @@ export const evaluateWithLlm = internalAction({
       `[llmEval] Evaluated ${skill.slug}@${version.version}: ${result.verdict} (${result.confidence} confidence)`,
     );
 
-    // Moderation visibility is finalized by VT results.
-    // LLM eval only stores analysis payload on the version.
+    // Normal writes recompute moderation in updateVersionLlmAnalysisInternal.
+    // Preserve mode stores analysis only for one-time backfills.
   },
 });
 
@@ -285,6 +308,8 @@ export const evaluatePackageReleaseWithLlm = internalAction({
     }
 
     const model = getLlmEvalModel();
+    const reasoningEffort = getLlmEvalReasoningEffort();
+    const serviceTier = getLlmEvalServiceTier();
     const storeError = async (message: string) => {
       console.error(`[llmEval:package] ${message}`);
       await runMutationRef(ctx, internalRefs.packages.updateReleaseLlmAnalysisInternal, {
@@ -375,8 +400,12 @@ export const evaluatePackageReleaseWithLlm = internalAction({
     try {
       const body = JSON.stringify({
         model,
-        instructions: SECURITY_EVALUATOR_SYSTEM_PROMPT,
+        service_tier: serviceTier,
+        instructions: LEGACY_SECURITY_EVALUATOR_SYSTEM_PROMPT,
         input: userMessage,
+        reasoning: {
+          effort: reasoningEffort,
+        },
         max_output_tokens: LLM_EVAL_MAX_OUTPUT_TOKENS,
         text: {
           format: {
@@ -490,10 +519,23 @@ export const evaluateBySlug = internalAction({
 // invocation so we don't hit Convex action timeouts.
 // ---------------------------------------------------------------------------
 
-export const backfillLlmEval = internalAction({
+type LlmBackfillBatch = {
+  skills: Array<{
+    versionId: Id<"skillVersions">;
+    slug: string;
+  }>;
+  nextCursor: number;
+  done: boolean;
+};
+
+export const backfillLlmEval: ReturnType<typeof internalAction> = internalAction({
   args: {
     cursor: v.optional(v.number()),
     batchSize: v.optional(v.number()),
+    delayMs: v.optional(v.number()),
+    dryRun: v.optional(v.boolean()),
+    maxToSchedule: v.optional(v.number()),
+    moderationMode: llmEvalModerationModeValidator,
     accTotal: v.optional(v.number()),
     accScheduled: v.optional(v.number()),
     accSkipped: v.optional(v.number()),
@@ -502,29 +544,54 @@ export const backfillLlmEval = internalAction({
   handler: async (ctx, args) => {
     const startTime = args.startTime ?? Date.now();
     const apiKey = process.env.OPENAI_API_KEY;
-    if (!apiKey) {
+    const dryRun = args.dryRun ?? false;
+    if (!dryRun && !apiKey) {
       console.log("[llmEval:backfill] OPENAI_API_KEY not configured");
       return { error: "OPENAI_API_KEY not configured" };
     }
 
-    const batchSize = args.batchSize ?? 25;
+    const requestedBatchSize = Math.max(1, Math.floor(args.batchSize ?? 25));
+    const maxToSchedule =
+      args.maxToSchedule === undefined ? undefined : Math.max(0, Math.floor(args.maxToSchedule));
     const cursor = args.cursor ?? 0;
+    const delayMs = Math.max(0, Math.floor(args.delayMs ?? 5_000));
+    const moderationMode: LlmEvalModerationMode = args.moderationMode ?? "normal";
     let accTotal = args.accTotal ?? 0;
     let accScheduled = args.accScheduled ?? 0;
     let accSkipped = args.accSkipped ?? 0;
+    const remaining =
+      maxToSchedule === undefined ? undefined : Math.max(0, maxToSchedule - accScheduled);
 
-    const batch = await ctx.runQuery(internal.skills.getActiveSkillBatchForLlmBackfillInternal, {
-      cursor,
-      batchSize,
-    });
+    if (remaining === 0) {
+      console.log("[llmEval:backfill] Schedule limit reached before fetching next batch");
+      return {
+        status: "limit_reached",
+        total: accTotal,
+        scheduled: accScheduled,
+        skipped: accSkipped,
+        cursor,
+        moderationMode,
+      };
+    }
+
+    const batchSize =
+      remaining === undefined ? requestedBatchSize : Math.min(requestedBatchSize, remaining);
+
+    const batch: LlmBackfillBatch = await ctx.runQuery(
+      internal.skills.getActiveSkillBatchForLlmBackfillInternal,
+      {
+        cursor,
+        batchSize,
+      },
+    );
 
     if (batch.skills.length === 0 && batch.done) {
       console.log("[llmEval:backfill] No more skills to evaluate");
-      return { total: accTotal, scheduled: accScheduled, skipped: accSkipped };
+      return { total: accTotal, scheduled: accScheduled, skipped: accSkipped, moderationMode };
     }
 
     console.log(
-      `[llmEval:backfill] Processing batch of ${batch.skills.length} skills (cursor=${cursor}, accumulated=${accTotal})`,
+      `[llmEval:backfill] Processing batch of ${batch.skills.length} skills (cursor=${cursor}, accumulated=${accTotal}, moderationMode=${moderationMode}, dryRun=${dryRun})`,
     );
 
     for (const { versionId, slug } of batch.skills) {
@@ -538,13 +605,35 @@ export const backfillLlmEval = internalAction({
         continue;
       }
 
-      // Schedule each evaluation as a separate action invocation
-      await ctx.scheduler.runAfter(0, internal.llmEval.evaluateWithLlm, { versionId });
+      // Schedule each evaluation as a separate action invocation.
+      if (!dryRun) {
+        await ctx.scheduler.runAfter(0, internal.llmEval.evaluateWithLlm, {
+          versionId,
+          moderationMode,
+        });
+      }
       accScheduled++;
-      console.log(`[llmEval:backfill] Scheduled eval for ${slug}`);
+      console.log(`[llmEval:backfill] ${dryRun ? "Would schedule" : "Scheduled"} eval for ${slug}`);
     }
 
     accTotal += batch.skills.length;
+    const hitLimit = maxToSchedule !== undefined && accScheduled >= maxToSchedule;
+
+    if (dryRun || hitLimit) {
+      const durationMs = Date.now() - startTime;
+      const result = {
+        status: dryRun ? "dry_run" : "limit_reached",
+        total: accTotal,
+        scheduled: accScheduled,
+        skipped: accSkipped,
+        nextCursor: batch.nextCursor,
+        done: batch.done,
+        durationMs,
+        moderationMode,
+      };
+      console.log("[llmEval:backfill] Paused:", result);
+      return result;
+    }
 
     if (!batch.done) {
       // Delay the next batch slightly to avoid overwhelming the scheduler
@@ -552,9 +641,12 @@ export const backfillLlmEval = internalAction({
       console.log(
         `[llmEval:backfill] Scheduling next batch (cursor=${batch.nextCursor}, total so far=${accTotal})`,
       );
-      await ctx.scheduler.runAfter(5_000, internal.llmEval.backfillLlmEval, {
+      await ctx.scheduler.runAfter(delayMs, internal.llmEval.backfillLlmEval, {
         cursor: batch.nextCursor,
-        batchSize,
+        batchSize: requestedBatchSize,
+        delayMs,
+        ...(maxToSchedule !== undefined ? { maxToSchedule } : {}),
+        moderationMode,
         accTotal,
         accScheduled,
         accSkipped,
@@ -569,6 +661,7 @@ export const backfillLlmEval = internalAction({
       scheduled: accScheduled,
       skipped: accSkipped,
       durationMs,
+      moderationMode,
     };
     console.log("[llmEval:backfill] Complete:", result);
     return result;

convex/maintenance.ts

@@ -541,6 +541,70 @@ export const applySkillCapabilityTagsInternal = internalMutation({
   },
 });
 
+export const softDeleteSkillVersionsInternal = internalMutation({
+  args: {
+    actorUserId: v.id("users"),
+    slug: v.string(),
+    versionIds: v.array(v.id("skillVersions")),
+    reason: v.string(),
+  },
+  handler: async (ctx, args) => {
+    const actor = await ctx.db.get(args.actorUserId);
+    if (!actor || actor.deletedAt || actor.deactivatedAt) {
+      throw new ConvexError("Actor not found");
+    }
+    assertRole(actor, ["admin", "moderator"]);
+
+    const slug = args.slug.trim().toLowerCase();
+    if (!slug) throw new ConvexError("Slug required");
+    if (args.versionIds.length === 0) throw new ConvexError("versionIds required");
+
+    const skill = await ctx.db
+      .query("skills")
+      .withIndex("by_slug", (q) => q.eq("slug", slug))
+      .unique();
+    if (!skill) throw new ConvexError("Skill not found");
+
+    const latestId = skill.latestVersionId ?? skill.tags.latest;
+    const now = Date.now();
+    const deleted: string[] = [];
+    const skipped: Array<{ versionId: string; reason: string }> = [];
+
+    for (const versionId of [...new Set(args.versionIds)]) {
+      const version = await ctx.db.get(versionId);
+      if (!version || version.skillId !== skill._id) {
+        skipped.push({ versionId, reason: "missing_or_wrong_skill" });
+        continue;
+      }
+      if (version._id === latestId) {
+        throw new ConvexError("Refusing to soft-delete latest skill version");
+      }
+      if (version.softDeletedAt) {
+        skipped.push({ versionId, reason: "already_deleted" });
+        continue;
+      }
+      await ctx.db.patch(version._id, { softDeletedAt: now });
+      deleted.push(version.version);
+    }
+
+    await ctx.db.insert("auditLogs", {
+      actorUserId: actor._id,
+      action: "skill_versions.soft_delete",
+      targetType: "skill",
+      targetId: skill._id,
+      metadata: {
+        slug,
+        deleted,
+        skipped,
+        reason: args.reason,
+      },
+      createdAt: now,
+    });
+
+    return { ok: true as const, slug, deleted, skipped };
+  },
+});
+
 export async function backfillSkillCapabilityTagsInternalHandler(
   ctx: ActionCtx,
   args: {

convex/packages.public.test.ts

@@ -123,6 +123,7 @@ const insertReleaseInternalHandler = (
       capabilities?: unknown;
       verification?: unknown;
       staticScan?: unknown;
+      allowExistingRelease?: boolean;
       extractedPackageJson?: unknown;
       extractedPluginManifest?: unknown;
       normalizedBundleManifest?: unknown;
@@ -577,16 +578,40 @@ function makeInsertReleaseCtx(
         }
         if (table === "packageReleases") {
           return {
-            withIndex: vi.fn((indexName: string) => {
+            withIndex: vi.fn(
+              (
+                indexName: string,
+                buildQuery?: (q: { eq: (field: string, value: unknown) => unknown }) => unknown,
+              ) => {
               if (indexName === "by_package") {
                 return {
                   collect: vi.fn().mockResolvedValue(priorReleases),
                 };
               }
+              if (indexName === "by_package_version") {
+                const filters = new Map<string, unknown>();
+                const query = {
+                  eq(field: string, value: unknown) {
+                    filters.set(field, value);
+                    return query;
+                  },
+                };
+                buildQuery?.(query);
+                return {
+                  unique: vi.fn().mockResolvedValue(
+                    priorReleases.find(
+                      (release) =>
+                        release.packageId === filters.get("packageId") &&
+                        release.version === filters.get("version"),
+                    ) ?? null,
+                  ),
+                };
+              }
               return {
                 unique: vi.fn().mockResolvedValue(null),
               };
-            }),
+              },
+            ),
           };
         }
         throw new Error(`Unexpected table ${table}`);
@@ -2011,6 +2036,66 @@ describe("packages public queries", () => {
     });
   });
 
+  it("rejects duplicate package versions by default", async () => {
+    const ctx = makeInsertReleaseCtx(makePackageDoc(), [
+      makeReleaseDoc({
+        _id: "packageReleases:existing",
+        version: "1.0.0",
+        integritySha256: "abc123",
+      }),
+    ]);
+
+    await expect(
+      insertReleaseInternalHandler(ctx, {
+        actorUserId: "users:owner",
+        ownerUserId: "users:owner",
+        name: "demo-plugin",
+        displayName: "Demo Plugin",
+        family: "code-plugin",
+        version: "1.0.0",
+        changelog: "retry",
+        tags: ["latest"],
+        summary: "demo",
+        files: [],
+        integritySha256: "abc123",
+      }),
+    ).rejects.toThrow("Version 1.0.0 already exists");
+  });
+
+  it("treats matching workflow duplicate package releases as idempotent", async () => {
+    const ctx = makeInsertReleaseCtx(makePackageDoc(), [
+      makeReleaseDoc({
+        _id: "packageReleases:existing",
+        version: "1.0.0",
+        integritySha256: "abc123",
+      }),
+    ]);
+
+    await expect(
+      insertReleaseInternalHandler(ctx, {
+        actorUserId: "users:owner",
+        ownerUserId: "users:owner",
+        name: "demo-plugin",
+        displayName: "Demo Plugin",
+        family: "code-plugin",
+        version: "1.0.0",
+        changelog: "retry",
+        tags: ["latest"],
+        summary: "demo",
+        files: [],
+        integritySha256: "abc123",
+        allowExistingRelease: true,
+      }),
+    ).resolves.toMatchObject({
+      ok: true,
+      packageId: "packages:demo",
+      releaseId: "packageReleases:existing",
+    });
+
+    expect(ctx.insert).not.toHaveBeenCalled();
+    expect(ctx.patch).not.toHaveBeenCalled();
+  });
+
   it("adds a latest tag when an untagged promoted release becomes the package latest", async () => {
     const ctx = makeInsertReleaseCtx(
       makePackageDoc({

convex/packages.ts

@@ -167,6 +167,8 @@ type PublicPackageListItem = {
   executesCode: boolean;
   verificationTier: PackageVerificationTier | null;
 };
+
+type PackageBadgeKind = Doc<"packageBadges">["kind"];
 type PackageDigestLike = Pick<
   Doc<"packageSearchDigest">,
   | "packageId"
@@ -409,6 +411,36 @@ function digestMatchesSearchFilters(
   return digestMatchesFilters(digest, args);
 }
 
+async function upsertPackageBadge(
+  ctx: MutationCtx,
+  packageId: Id<"packages">,
+  kind: PackageBadgeKind,
+  userId: Id<"users">,
+  at: number,
+) {
+  const existing = await ctx.db
+    .query("packageBadges")
+    .withIndex("by_package_kind", (q) => q.eq("packageId", packageId).eq("kind", kind))
+    .unique();
+  if (existing) {
+    await ctx.db.patch(existing._id, { byUserId: userId, at });
+    return;
+  }
+  await ctx.db.insert("packageBadges", { packageId, kind, byUserId: userId, at });
+}
+
+async function removePackageBadge(
+  ctx: MutationCtx,
+  packageId: Id<"packages">,
+  kind: PackageBadgeKind,
+) {
+  const existing = await ctx.db
+    .query("packageBadges")
+    .withIndex("by_package_kind", (q) => q.eq("packageId", packageId).eq("kind", kind))
+    .unique();
+  if (existing) await ctx.db.delete(existing._id);
+}
+
 function toPublicPackageListItem(digest: PackageDigestLike): PublicPackageListItem {
   return {
     name: digest.name,
@@ -935,6 +967,62 @@ function buildPackageCapabilityDigestQuery(
     );
 }
 
+async function fetchHighlightedPackageDigests(
+  ctx: DbReaderCtx,
+  args: {
+    family?: PackageFamily;
+    channel?: PackageChannel;
+    isOfficial?: boolean;
+    executesCode?: boolean;
+    capabilityTag?: string;
+    viewerUserId?: Id<"users">;
+  },
+) {
+  const viewerUserId = args.viewerUserId;
+  const membershipCache = new Map<string, Promise<boolean>>();
+  const badges = await ctx.db
+    .query("packageBadges")
+    .withIndex("by_kind_at", (q) => q.eq("kind", "highlighted"))
+    .order("desc")
+    .take(MAX_PUBLIC_LIST_PAGE_SIZE);
+  const digests: PackageDigestLike[] = [];
+  for (const badge of badges) {
+    const digest = await ctx.db
+      .query("packageSearchDigest")
+      .withIndex("by_package", (q) => q.eq("packageId", badge.packageId))
+      .unique();
+    if (!digest || digest.softDeletedAt) continue;
+    if (!(await canViewerReadPackage(ctx, digest, viewerUserId, membershipCache))) continue;
+    if (!digestMatchesSearchFilters(digest, args)) continue;
+    digests.push(digest);
+  }
+  return digests;
+}
+
+async function fetchHighlightedPackagePage(
+  ctx: DbReaderCtx,
+  args: {
+    family?: PackageFamily;
+    channel?: PackageChannel;
+    isOfficial?: boolean;
+    executesCode?: boolean;
+    capabilityTag?: string;
+    viewerUserId?: Id<"users">;
+    numItems: number;
+  },
+) {
+  const digests = await fetchHighlightedPackageDigests(ctx, args);
+  return digests
+    .sort(
+      (a, b) =>
+        Number(b.isOfficial) - Number(a.isOfficial) ||
+        b.updatedAt - a.updatedAt ||
+        a.name.localeCompare(b.name),
+    )
+    .slice(0, args.numItems)
+    .map(toPublicPackageListItem);
+}
+
 async function getPackageByNormalizedName(ctx: DbReaderCtx, normalizedName: string) {
   return (await ctx.db
     .query("packages")
@@ -1011,6 +1099,41 @@ export const getByName = query({
   },
 });
 
+export const getByNameForStaff = query({
+  args: { name: v.string() },
+  handler: async (ctx, args) => {
+    const { user } = await requireUser(ctx);
+    assertModerator(user);
+
+    const pkg = await getPackageByNormalizedName(ctx, normalizePackageName(args.name));
+    if (!pkg || pkg.softDeletedAt || pkg.family === "skill") return null;
+
+    const highlighted = await ctx.db
+      .query("packageBadges")
+      .withIndex("by_package_kind", (q) => q.eq("packageId", pkg._id).eq("kind", "highlighted"))
+      .unique();
+    const latestRelease = pkg.latestReleaseId ? await ctx.db.get(pkg.latestReleaseId) : null;
+    const owner = toPublicPublisher(
+      await getOwnerPublisher(ctx, {
+        ownerPublisherId: pkg.ownerPublisherId,
+        ownerUserId: pkg.ownerUserId,
+      }),
+    );
+
+    return {
+      package: pkg,
+      latestRelease: latestRelease && !latestRelease.softDeletedAt ? latestRelease : null,
+      owner,
+      highlighted: highlighted
+        ? {
+            byUserId: highlighted.byUserId,
+            at: highlighted.at,
+          }
+        : null,
+    };
+  },
+});
+
 export const getByNameForViewerInternal = internalQuery({
   args: {
     name: v.string(),
@@ -1158,6 +1281,7 @@ export const listPublicPage = query({
       v.union(v.literal("official"), v.literal("community"), v.literal("private")),
     ),
     isOfficial: v.optional(v.boolean()),
+    highlightedOnly: v.optional(v.boolean()),
     executesCode: v.optional(v.boolean()),
     capabilityTag: v.optional(v.string()),
     paginationOpts: paginationOptsValidator,
@@ -1176,6 +1300,7 @@ export const listPageForViewerInternal = internalQuery({
       v.union(v.literal("official"), v.literal("community"), v.literal("private")),
     ),
     isOfficial: v.optional(v.boolean()),
+    highlightedOnly: v.optional(v.boolean()),
     executesCode: v.optional(v.boolean()),
     capabilityTag: v.optional(v.string()),
     viewerUserId: v.optional(v.id("users")),
@@ -1192,6 +1317,7 @@ async function listPackagePageImpl(
     family?: PackageFamily;
     channel?: PackageChannel;
     isOfficial?: boolean;
+    highlightedOnly?: boolean;
     executesCode?: boolean;
     capabilityTag?: string;
     viewerUserId?: Id<"users">;
@@ -1206,6 +1332,15 @@ async function listPackagePageImpl(
   const canViewPackage = async (digest: PackageDigestLike) =>
     await canViewerReadPackage(ctx, digest, viewerUserId, membershipCache);
   const targetCount = args.paginationOpts.numItems;
+
+  if (args.highlightedOnly) {
+    const page = await fetchHighlightedPackagePage(ctx, {
+      ...args,
+      numItems: targetCount,
+    });
+    return { page, isDone: true, continueCursor: "" };
+  }
+
   const collected: PublicPackageListItem[] = [];
   const decodedCursor = decodePublicPageCursor(args.paginationOpts.cursor);
   if (decodedCursor.done && decodedCursor.offset === 0) {
@@ -1300,6 +1435,7 @@ export const searchPublic = query({
       v.union(v.literal("official"), v.literal("community"), v.literal("private")),
     ),
     isOfficial: v.optional(v.boolean()),
+    highlightedOnly: v.optional(v.boolean()),
     executesCode: v.optional(v.boolean()),
     capabilityTag: v.optional(v.string()),
   },
@@ -1319,6 +1455,7 @@ export const searchForViewerInternal = internalQuery({
       v.union(v.literal("official"), v.literal("community"), v.literal("private")),
     ),
     isOfficial: v.optional(v.boolean()),
+    highlightedOnly: v.optional(v.boolean()),
     executesCode: v.optional(v.boolean()),
     capabilityTag: v.optional(v.string()),
     viewerUserId: v.optional(v.id("users")),
@@ -1336,6 +1473,7 @@ async function searchPackagesImpl(
     family?: PackageFamily;
     channel?: PackageChannel;
     isOfficial?: boolean;
+    highlightedOnly?: boolean;
     executesCode?: boolean;
     capabilityTag?: string;
     viewerUserId?: Id<"users">;
@@ -1349,6 +1487,21 @@ async function searchPackagesImpl(
   const membershipCache = new Map<string, Promise<boolean>>();
   const canViewPackage = async (digest: PackageDigestLike) =>
     await canViewerReadPackage(ctx, digest, viewerUserId, membershipCache);
+  if (args.highlightedOnly) {
+    const digests = await fetchHighlightedPackageDigests(ctx, args);
+    return digests
+      .map((digest) => ({ score: packageSearchScore(digest, queryText), package: digest }))
+      .filter((entry) => entry.score > 0)
+      .sort(
+        (a, b) =>
+          b.score - a.score ||
+          Number(b.package.isOfficial) - Number(a.package.isOfficial) ||
+          b.package.updatedAt - a.package.updatedAt,
+      )
+      .slice(0, targetCount)
+      .map((entry) => ({ score: entry.score, package: toPublicPackageListItem(entry.package) }));
+  }
+
   const builder = args.capabilityTag
     ? buildPackageCapabilityDigestQuery(ctx, {
         capabilityTag: args.capabilityTag,
@@ -1436,6 +1589,22 @@ export const getPackageByNameInternal = internalQuery({
   },
 });
 
+export const recordPackageDownloadInternal = internalMutation({
+  args: { packageId: v.id("packages") },
+  handler: async (ctx, args) => {
+    const pkg = await ctx.db.get(args.packageId);
+    if (!pkg) return;
+    await ctx.db.patch(pkg._id, {
+      stats: {
+        downloads: (pkg.stats?.downloads ?? 0) + 1,
+        installs: pkg.stats?.installs ?? 0,
+        stars: pkg.stats?.stars ?? 0,
+        versions: pkg.stats?.versions ?? 0,
+      },
+    });
+  },
+});
+
 export const getTrustedPublisherByPackageIdInternal = internalQuery({
   args: { packageId: v.id("packages") },
   handler: async (ctx, args) => {
@@ -2005,6 +2174,9 @@ async function publishPackageImpl(
     staticScan,
     files,
     integritySha256,
+    allowExistingRelease:
+      auth.kind === "github-actions" ||
+      (auth.kind === "user" && manualOverrideReason?.startsWith("GitHub Actions ")),
     extractedPackageJson: packageJson,
     extractedPluginManifest:
       family === "code-plugin" ? maybeParseJson(pluginManifestEntry?.text) : undefined,
@@ -2164,6 +2336,7 @@ export const insertReleaseInternal = internalMutation({
     capabilities: v.optional(v.any()),
     verification: v.optional(v.any()),
     staticScan: v.optional(v.any()),
+    allowExistingRelease: v.optional(v.boolean()),
     files: v.array(
       v.object({
         path: v.string(),
@@ -2285,7 +2458,20 @@ export const insertReleaseInternal = internalMutation({
           q.eq("packageId", existing._id).eq("version", args.version),
         )
         .unique();
-      if (releaseExists) throw new ConvexError(`Version ${nextVersionLabel} already exists`);
+      if (releaseExists) {
+        if (
+          args.allowExistingRelease &&
+          !releaseExists.softDeletedAt &&
+          releaseExists.integritySha256 === args.integritySha256
+        ) {
+          return {
+            ok: true as const,
+            packageId: existing._id,
+            releaseId: releaseExists._id,
+          };
+        }
+        throw new ConvexError(`Version ${nextVersionLabel} already exists`);
+      }
     }
     const priorReleases = existing
       ? await ctx.db
@@ -2780,6 +2966,36 @@ export const requestRescan = mutation({
   },
 });
 
+export const setBatch = mutation({
+  args: { packageId: v.id("packages"), batch: v.optional(v.string()) },
+  handler: async (ctx, args) => {
+    const { user } = await requireUser(ctx);
+    assertModerator(user);
+    const pkg = await ctx.db.get(args.packageId);
+    if (!pkg || pkg.softDeletedAt || pkg.family === "skill") {
+      throw new ConvexError("Plugin not found");
+    }
+    const nextBatch = args.batch?.trim() || undefined;
+    const nextHighlighted = nextBatch === "highlighted";
+    const now = Date.now();
+
+    if (nextHighlighted) {
+      await upsertPackageBadge(ctx, pkg._id, "highlighted", user._id, now);
+    } else {
+      await removePackageBadge(ctx, pkg._id, "highlighted");
+    }
+
+    await ctx.db.insert("auditLogs", {
+      actorUserId: user._id,
+      action: "package.badge.highlighted",
+      targetType: "package",
+      targetId: pkg._id,
+      metadata: { highlighted: nextHighlighted },
+      createdAt: now,
+    });
+  },
+});
+
 export const requestRescanForApiTokenInternal = internalMutation({
   args: {
     actorUserId: v.id("users"),

convex/schema.ts

@@ -29,6 +29,59 @@ const vtAnalysisValidator = v.object({
   checkedAt: v.number(),
 });
 
+const depRegistryStatusValidator = v.union(
+  v.literal("clean"),
+  v.literal("suspicious"),
+  v.literal("error"),
+);
+
+const depRegistryValidator = v.union(v.literal("pypi"), v.literal("npm"), v.literal("cargo"));
+
+const depRegistryAnalysisValidator = v.object({
+  status: depRegistryStatusValidator,
+  results: v.array(
+    v.object({
+      name: v.string(),
+      registry: depRegistryValidator,
+      source: v.string(),
+      exists: v.boolean(),
+      httpStatus: v.optional(v.number()),
+    }),
+  ),
+  notFoundPackages: v.array(v.string()),
+  unresolvedPackages: v.array(v.string()),
+  summary: v.string(),
+  checkedAt: v.number(),
+});
+
+const llmAgenticRiskEvidenceValidator = v.object({
+  path: v.string(),
+  snippet: v.string(),
+  explanation: v.string(),
+});
+
+const llmAgenticRiskFindingValidator = v.object({
+  categoryId: v.string(),
+  categoryLabel: v.string(),
+  riskBucket: v.union(
+    v.literal("abnormal_behavior_control"),
+    v.literal("permission_boundary"),
+    v.literal("sensitive_data_protection"),
+  ),
+  status: v.union(v.literal("none"), v.literal("note"), v.literal("concern")),
+  severity: v.string(),
+  confidence: v.union(v.literal("high"), v.literal("medium"), v.literal("low")),
+  evidence: v.optional(llmAgenticRiskEvidenceValidator),
+  userImpact: v.string(),
+  recommendation: v.string(),
+});
+
+const llmRiskSummaryBucketValidator = v.object({
+  status: v.union(v.literal("none"), v.literal("note"), v.literal("concern")),
+  summary: v.string(),
+  highestSeverity: v.optional(v.string()),
+});
+
 const users = defineTable({
   name: v.optional(v.string()),
   image: v.optional(v.string()),
@@ -465,11 +518,21 @@ const skillVersions = defineTable({
       ),
       guidance: v.optional(v.string()),
       findings: v.optional(v.string()),
+      agenticRiskFindings: v.optional(v.array(llmAgenticRiskFindingValidator)),
+      riskSummary: v.optional(
+        v.object({
+          abnormal_behavior_control: llmRiskSummaryBucketValidator,
+          permission_boundary: llmRiskSummaryBucketValidator,
+          sensitive_data_protection: llmRiskSummaryBucketValidator,
+        }),
+      ),
       model: v.optional(v.string()),
       checkedAt: v.number(),
     }),
   ),
   capabilityTags: v.optional(v.array(v.string())),
+  depRegistryAnalysis: v.optional(depRegistryAnalysisValidator),
+  depRegistryScanStatus: v.optional(depRegistryStatusValidator),
   staticScan: v.optional(
     v.object({
       status: v.union(v.literal("clean"), v.literal("suspicious"), v.literal("malicious")),
@@ -492,7 +555,17 @@ const skillVersions = defineTable({
 })
   .index("by_skill", ["skillId"])
   .index("by_skill_version", ["skillId", "version"])
-  .index("by_sha256hash", ["sha256hash"]);
+  .index("by_active_created", ["softDeletedAt", "createdAt"])
+  .index("by_sha256hash", ["sha256hash"])
+  .index("by_dep_registry_scan_status_and_created", ["depRegistryScanStatus", "createdAt"]);
+
+const depRegistryCache = defineTable({
+  registry: depRegistryValidator,
+  name: v.string(),
+  exists: v.boolean(),
+  httpStatus: v.number(),
+  checkedAt: v.number(),
+}).index("by_registry_name", ["registry", "name"]);
 
 const soulVersions = defineTable({
   soulId: v.id("souls"),
@@ -547,6 +620,16 @@ const skillBadges = defineTable({
   .index("by_skill_kind", ["skillId", "kind"])
   .index("by_kind_at", ["kind", "at"]);
 
+const packageBadges = defineTable({
+  packageId: v.id("packages"),
+  kind: v.union(v.literal("highlighted")),
+  byUserId: v.id("users"),
+  at: v.number(),
+})
+  .index("by_package", ["packageId"])
+  .index("by_package_kind", ["packageId", "kind"])
+  .index("by_kind_at", ["kind", "at"]);
+
 const soulVersionFingerprints = defineTable({
   soulId: v.id("souls"),
   versionId: v.id("soulVersions"),
@@ -763,6 +846,7 @@ const packageReleases = defineTable({
 })
   .index("by_package", ["packageId"])
   .index("by_package_active_created", ["packageId", "softDeletedAt", "createdAt"])
+  .index("by_active_created", ["softDeletedAt", "createdAt"])
   .index("by_package_version", ["packageId", "version"])
   .index("by_sha256hash", ["sha256hash"]);
 
@@ -1219,12 +1303,7 @@ const rescanRequests = defineTable({
   .index("by_skill_version", ["targetKind", "skillVersionId", "createdAt"])
   .index("by_skill_version_status", ["targetKind", "skillVersionId", "status", "createdAt"])
   .index("by_package_release", ["targetKind", "packageReleaseId", "createdAt"])
-  .index("by_package_release_status", [
-    "targetKind",
-    "packageReleaseId",
-    "status",
-    "createdAt",
-  ])
+  .index("by_package_release_status", ["targetKind", "packageReleaseId", "status", "createdAt"])
   .index("by_requester", ["requestedByUserId", "createdAt"]);
 
 const apiTokens = defineTable({
@@ -1362,10 +1441,12 @@ export default defineSchema({
   packageReleases,
   packageTrustedPublishers,
   packagePublishTokens,
+  packageBadges,
   packageSearchDigest,
   packageCapabilitySearchDigest,
   souls,
   skillVersions,
+  depRegistryCache,
   soulVersions,
   skillVersionFingerprints,
   skillBadges,

convex/search.test.ts

@@ -2,7 +2,14 @@
 
 import { describe, expect, it, vi } from "vitest";
 import { tokenize } from "./lib/searchText";
-import { __test, hydrateResults, lexicalFallbackSkills, searchSkills } from "./search";
+import {
+  __test,
+  hydrateResults,
+  lexicalFallbackSouls,
+  lexicalFallbackSkills,
+  searchSkills,
+  searchSouls,
+} from "./search";
 
 const { generateEmbeddingMock } = vi.hoisted(() => ({
   generateEmbeddingMock: vi.fn(),
@@ -27,7 +34,16 @@ const searchSkillsHandler = (
     score: number;
   }>
 )._handler;
+const searchSoulsHandler = (
+  searchSouls as unknown as WrappedHandler<{
+    soul: { slug: string; _id: string };
+    score: number;
+  }>
+)._handler;
 const lexicalFallbackSkillsHandler = (lexicalFallbackSkills as unknown as WrappedHandler)._handler;
+const lexicalFallbackSoulsHandler = (
+  lexicalFallbackSouls as unknown as WrappedHandler<{ soul: { slug: string; _id: string } }>
+)._handler;
 const hydrateResultsHandler = (
   hydrateResults as unknown as {
     _handler: (
@@ -132,16 +148,48 @@ describe("search helpers", () => {
     });
     const clean = makeSkillDoc({ id: "skills:clean", slug: "orf-clean", displayName: "ORF Clean" });
 
-    const result = await lexicalFallbackSkillsHandler(
-      makeLexicalCtx({
-        exactSlugSkill: null,
-        recentSkills: [suspicious, clean],
-      }),
-      { query: "orf", queryTokens: ["orf"], nonSuspiciousOnly: true, limit: 10 },
-    );
+    const ctx = makeLexicalCtx({
+      exactSlugSkill: null,
+      recentSkills: [suspicious, clean],
+    });
+
+    const result = await lexicalFallbackSkillsHandler(ctx, {
+      query: "orf",
+      queryTokens: ["orf"],
+      nonSuspiciousOnly: true,
+      limit: 10,
+    });
 
     expect(result).toHaveLength(1);
     expect(result[0].skill.slug).toBe("orf-clean");
+    expect(ctx.usedIndexes).toEqual(
+      expect.arrayContaining(["by_nonsuspicious_updated", "by_nonsuspicious_created"]),
+    );
+  });
+
+  it("preserves suspicious lexical fallback results when nonSuspiciousOnly is unset", async () => {
+    const clean = makeSkillDoc({ id: "skills:clean", slug: "orf-clean", displayName: "ORF Clean" });
+    const suspicious = makeSkillDoc({
+      id: "skills:suspicious",
+      slug: "orf-suspicious",
+      displayName: "ORF Suspicious",
+      moderationFlags: ["flagged.suspicious"],
+    });
+    const ctx = makeLexicalCtx({
+      exactSlugSkill: null,
+      recentSkills: [clean, suspicious],
+    });
+
+    const result = await lexicalFallbackSkillsHandler(ctx, {
+      query: "orf",
+      queryTokens: ["orf"],
+      limit: 10,
+    });
+
+    expect(result.map((entry) => entry.skill.slug)).toEqual(["orf-clean", "orf-suspicious"]);
+    expect(ctx.usedIndexes).toEqual(
+      expect.arrayContaining(["by_active_updated", "by_active_created"]),
+    );
   });
 
   it("includes exact slug match from by_slug even when recent scan is empty", async () => {
@@ -240,6 +288,63 @@ describe("search helpers", () => {
     );
   });
 
+  it("uses a stable recall pool before slicing first-page search results (#1756)", async () => {
+    generateEmbeddingMock.mockResolvedValueOnce([0, 1, 2]);
+
+    const vectorEntries = Array.from({ length: 25 }, (_, index) => ({
+      embeddingId: `skillEmbeddings:${index}`,
+      skill: makePublicSkill({
+        id: `skills:${index}`,
+        slug: `image-vector-${index}`,
+        displayName: `Image Vector ${index}`,
+        downloads: 10,
+      }),
+      version: null,
+      ownerHandle: "owner",
+      owner: null,
+    }));
+    const fallbackEntries = [
+      {
+        skill: makePublicSkill({
+          id: "skills:fallback",
+          slug: "antigravity-image-generator",
+          displayName: "Antigravity Image Generator",
+          downloads: 1_000_000_000,
+        }),
+        version: null,
+        ownerHandle: "owner",
+        owner: null,
+      },
+    ];
+
+    const runQuery = vi
+      .fn()
+      .mockResolvedValueOnce(null) // getExactSkillSlugMatch
+      .mockResolvedValueOnce(vectorEntries) // hydrateResults
+      .mockResolvedValueOnce(fallbackEntries); // lexicalFallbackSkills
+
+    const result = await searchSkillsHandler(
+      {
+        vectorSearch: vi.fn().mockResolvedValue(
+          vectorEntries.map((entry, index) => ({
+            _id: entry.embeddingId,
+            _score: 0.5 - index * 0.001,
+          })),
+        ),
+        runQuery,
+      },
+      { query: "image", limit: 25 },
+    );
+
+    expect(runQuery).toHaveBeenCalledTimes(3);
+    expect(runQuery).toHaveBeenLastCalledWith(
+      expect.anything(),
+      expect.objectContaining({ query: "image", limit: 400 }),
+    );
+    expect(result).toHaveLength(25);
+    expect(result.some((entry) => entry.skill.slug === "antigravity-image-generator")).toBe(true);
+  });
+
   it("always includes an exact slug match even when vector exact matches already fill the limit", async () => {
     generateEmbeddingMock.mockResolvedValueOnce([0, 1, 2]);
 
@@ -271,7 +376,8 @@ describe("search helpers", () => {
     const runQuery = vi
       .fn()
       .mockResolvedValueOnce(exactSlugEntry)
-      .mockResolvedValueOnce(vectorEntries);
+      .mockResolvedValueOnce(vectorEntries)
+      .mockResolvedValueOnce([]);
 
     const result = await searchSkillsHandler(
       {
@@ -288,7 +394,7 @@ describe("search helpers", () => {
 
     expect(result).toHaveLength(10);
     expect(result[0].skill.slug).toBe("skill-downloader");
-    expect(runQuery).toHaveBeenCalledTimes(2);
+    expect(runQuery).toHaveBeenCalledTimes(3);
   });
 
   it("omits exact slug injection when nonSuspiciousOnly excludes it", async () => {
@@ -879,29 +985,17 @@ describe("search helpers", () => {
     expect(result[0].skill.slug).toBe("fallback-skill");
   });
 
-  it("only hydrates new embedding IDs on subsequent iterations (incremental)", async () => {
+  it("hydrates the stable max vector window for ordinary load-more searches", async () => {
     generateEmbeddingMock.mockResolvedValueOnce([0, 1, 2]);
 
-    // limit=50 -> candidateLimit starts at 200, maxCandidate=256.
-    // First iteration must return exactly candidateLimit (200) to trigger expansion.
-    const firstBatch = Array.from({ length: 200 }, (_, i) => ({
+    // Ordinary first-page and load-more searches use a stable recall floor, so
+    // candidateLimit starts at the Convex vector maximum.
+    const batch = Array.from({ length: 256 }, (_, i) => ({
       _id: `skillEmbeddings:e${i}`,
       _score: 0.5 - i * 0.001,
     }));
-    // Second iteration returns 210 results (200 old + 10 new).
-    // 210 < next candidateLimit (256), so the loop breaks.
-    const secondBatch = [
-      ...firstBatch,
-      ...Array.from({ length: 10 }, (_, i) => ({
-        _id: `skillEmbeddings:n${i}`,
-        _score: 0.3 - i * 0.001,
-      })),
-    ];
 
-    const vectorSearchMock = vi
-      .fn()
-      .mockResolvedValueOnce(firstBatch)
-      .mockResolvedValueOnce(secondBatch);
+    const vectorSearchMock = vi.fn().mockResolvedValueOnce(batch);
 
     const hydrateCalls: string[][] = [];
     const runQuery = vi.fn(
@@ -932,14 +1026,9 @@ describe("search helpers", () => {
       { query: "test", limit: 50 },
     );
 
-    // Should have been called twice, but second call should only have new IDs
-    expect(hydrateCalls).toHaveLength(2);
-    expect(hydrateCalls[0]).toHaveLength(200);
-    expect(hydrateCalls[1]).toHaveLength(10);
-    // Verify no overlap between the two hydrate calls
-    const firstSet = new Set(hydrateCalls[0]);
-    const overlap = hydrateCalls[1].filter((id) => firstSet.has(id));
-    expect(overlap).toHaveLength(0);
+    expect(vectorSearchMock).toHaveBeenCalledTimes(1);
+    expect(hydrateCalls).toHaveLength(1);
+    expect(hydrateCalls[0]).toHaveLength(256);
   });
 
   it("merges fallback matches without duplicate skill ids", () => {
@@ -963,20 +1052,7 @@ describe("search helpers", () => {
     expect(merged.map((entry) => entry.skill._id)).toEqual(["skills:1", "skills:2"]);
   });
 
-  it("preserves vector scores across candidate expansion iterations", async () => {
-    // Regression test for scoreById overwrite bug.
-    //
-    // Setup:
-    //   limit=50  ->  candidateLimit starts at 200, maxCandidate=256
-    //   Iteration 1: vectorSearch returns exactly 200 results (= candidateLimit)
-    //                → results.length < candidateLimit is false → loop continues
-    //   Iteration 2: vectorSearch returns 2 results (< 256) → loop exits
-    //
-    // skillA appears ONLY in iteration 1 (score 0.95).
-    // skillB appears ONLY in iteration 2 (score 0.5).
-    //
-    // With the BUG:  scoreById = new Map(iter2_results) → skillA missing → vectorScore=0
-    // With the FIX:  scoreById.set() merges → skillA retains 0.95
+  it("preserves vector scores for hydrated candidates", async () => {
     generateEmbeddingMock.mockResolvedValueOnce([0, 1, 2]);
 
     const skillA = makePublicSkill({
@@ -992,23 +1068,13 @@ describe("search helpers", () => {
       downloads: 50,
     });
 
-    // Iteration 1: exactly 200 entries so the loop does NOT exit early.
-    // skillA is entry 0; entries 1-199 are fillers filtered out by hydrateResults.
-    const iter1Results = Array.from({ length: 200 }, (_, i) => ({
-      _id: i === 0 ? "skillEmbeddings:a" : `skillEmbeddings:filler${i}`,
-      _score: i === 0 ? 0.95 : 0.1,
-    }));
-
-    // Iteration 2: 2 entries, both new IDs (skillA is absent from this batch).
-    // results.length (2) < candidateLimit (256) → loop exits.
-    const iter2Results = [
+    const vectorResults = [
+      { _id: "skillEmbeddings:a", _score: 0.95 },
       { _id: "skillEmbeddings:b", _score: 0.5 },
-      { _id: "skillEmbeddings:filler50", _score: 0.08 },
     ];
 
     const runQuery = vi
       .fn()
-      // hydrateResults iteration 1: 50 new IDs → only skillA survives hydration
       .mockResolvedValueOnce([
         {
           embeddingId: "skillEmbeddings:a",
@@ -1017,9 +1083,6 @@ describe("search helpers", () => {
           ownerHandle: "owner",
           owner: null,
         },
-      ])
-      // hydrateResults iteration 2: 2 new IDs → only skillB survives hydration
-      .mockResolvedValueOnce([
         {
           embeddingId: "skillEmbeddings:b",
           skill: skillB,
@@ -1033,10 +1096,7 @@ describe("search helpers", () => {
 
     const result = await searchSkillsHandler(
       {
-        vectorSearch: vi
-          .fn()
-          .mockResolvedValueOnce(iter1Results) // iteration 1: 50 results, loop continues
-          .mockResolvedValueOnce(iter2Results), // iteration 2: 2 results, loop exits
+        vectorSearch: vi.fn().mockResolvedValueOnce(vectorResults),
         runQuery,
       },
       { query: "baidu yijian", limit: 50 },
@@ -1046,14 +1106,102 @@ describe("search helpers", () => {
       (r: { skill: { slug: string } }) => r.skill.slug === "baidu-yijian-vision",
     );
     expect(resultA).toBeDefined();
-    // With scoreById correctly merged: skillA retains vectorScore=0.95.
-    // With the bug (overwrite): skillA.embeddingId absent from iter2 map → vectorScore=0.
-    // Lexical boost for "baidu-yijian-vision" slug matching "baidu yijian" ≈ 0.8 (prefix).
-    // Fix: score ≈ 0.95 + 0.8 + popularity > 1.5; Bug: score ≈ 0 + 0.8 + popularity < 0.9.
     expect(resultA!.score).toBeGreaterThan(1.0);
   });
 });
 
+describe("soul search", () => {
+  it("falls back to lexical soul search when embedding generation fails", async () => {
+    generateEmbeddingMock.mockRejectedValueOnce(new Error("API unavailable"));
+    const fallback = [
+      {
+        soul: makePublicSoul({ id: "souls:orf", slug: "orf", displayName: "ORF" }),
+        version: null,
+      },
+    ];
+    const vectorSearch = vi.fn().mockRejectedValue(new Error("should not be called"));
+    const runQuery = vi.fn().mockResolvedValueOnce(fallback);
+
+    const result = await searchSoulsHandler(
+      {
+        vectorSearch,
+        runQuery,
+      },
+      { query: "orf", limit: 10 },
+    );
+
+    expect(vectorSearch).not.toHaveBeenCalled();
+    expect(result).toHaveLength(1);
+    expect(result[0].soul.slug).toBe("orf");
+    expect(runQuery).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ query: "orf", queryTokens: ["orf"] }),
+    );
+  });
+
+  it("uses the active souls index for lexical fallback", async () => {
+    const activeSoul = makeSoulDoc({
+      id: "souls:active",
+      slug: "orf-active",
+      displayName: "ORF Active",
+    });
+    const ctx = makeSoulLexicalCtx({
+      exactSlugSoul: null,
+      recentSouls: [activeSoul],
+    });
+
+    const result = await lexicalFallbackSoulsHandler(ctx, {
+      query: "orf",
+      queryTokens: ["orf"],
+      limit: 10,
+    });
+
+    expect(result).toHaveLength(1);
+    expect(result[0].soul.slug).toBe("orf-active");
+    expect(ctx.usedIndexes).toContain("by_active_updated");
+  });
+
+  it("hydrates only new soul embedding ids across vector iterations", async () => {
+    generateEmbeddingMock.mockResolvedValueOnce([0, 1, 2]);
+    const firstBatch = Array.from({ length: 200 }, (_, i) => ({
+      _id: i === 0 ? "soulEmbeddings:a" : `soulEmbeddings:filler${i}`,
+      _score: i === 0 ? 0.9 : 0.1,
+    }));
+    const secondBatch = [...firstBatch, { _id: "soulEmbeddings:b", _score: 0.4 }];
+    const hydrateCalls: string[][] = [];
+    const runQuery = vi.fn(
+      async (_ref: unknown, args: { embeddingIds?: string[]; query?: string }) => {
+        if (args.embeddingIds) {
+          hydrateCalls.push(args.embeddingIds);
+          return args.embeddingIds
+            .filter((id) => id === "soulEmbeddings:a" || id === "soulEmbeddings:b")
+            .map((embeddingId) => ({
+              embeddingId,
+              soul: makePublicSoul({
+                id: `souls:${embeddingId.split(":").at(-1)}`,
+                slug: `soul-${embeddingId.split(":").at(-1)}`,
+                displayName: `Soul ${embeddingId.split(":").at(-1)}`,
+              }),
+              version: null,
+            }));
+        }
+        return [];
+      },
+    );
+
+    await searchSoulsHandler(
+      {
+        vectorSearch: vi.fn().mockResolvedValueOnce(firstBatch).mockResolvedValueOnce(secondBatch),
+        runQuery,
+      },
+      { query: "soul", limit: 50 },
+    );
+
+    expect(hydrateCalls).toHaveLength(2);
+    expect(hydrateCalls[1]).toEqual(["soulEmbeddings:b"]);
+  });
+});
+
 function makePublicSkill(params: {
   id: string;
   slug: string;
@@ -1105,6 +1253,45 @@ function makeSkillDoc(params: {
   };
 }
 
+function makePublicSoul(params: {
+  id: string;
+  slug: string;
+  displayName: string;
+  downloads?: number;
+}) {
+  return {
+    _id: params.id,
+    _creationTime: 1,
+    slug: params.slug,
+    displayName: params.displayName,
+    summary: `${params.displayName} summary`,
+    ownerUserId: "users:owner",
+    ownerPublisherId: undefined,
+    latestVersionId: "soulVersions:1",
+    tags: {},
+    stats: {
+      downloads: params.downloads ?? 0,
+      stars: 0,
+      versions: 1,
+      comments: 0,
+    },
+    createdAt: 1,
+    updatedAt: 1,
+  };
+}
+
+function makeSoulDoc(params: {
+  id: string;
+  slug: string;
+  displayName: string;
+  softDeletedAt?: number;
+}) {
+  return {
+    ...makePublicSoul(params),
+    softDeletedAt: params.softDeletedAt as number | undefined,
+  };
+}
+
 function makeLexicalCtx(params: {
   exactSlugSkill: ReturnType<typeof makeSkillDoc> | null;
   recentSkills: Array<ReturnType<typeof makeSkillDoc>>;
@@ -1122,12 +1309,15 @@ function makeLexicalCtx(params: {
     }));
   const digestByUpdated = toDigestRows(params.recentSkills);
   const digestByCreated = toDigestRows(params.recentByCreated ?? []);
+  const usedIndexes: string[] = [];
   return {
+    usedIndexes,
     db: {
       query: vi.fn((table: string) => {
         if (table === "skills") {
           return {
             withIndex: (index: string) => {
+              usedIndexes.push(index);
               if (index === "by_slug") {
                 return {
                   unique: vi.fn().mockResolvedValue(params.exactSlugSkill),
@@ -1140,14 +1330,15 @@ function makeLexicalCtx(params: {
         if (table === "skillSearchDigest") {
           return {
             withIndex: (index: string) => {
-              if (index === "by_active_updated") {
+              usedIndexes.push(index);
+              if (index === "by_active_updated" || index === "by_nonsuspicious_updated") {
                 return {
                   order: () => ({
                     take: vi.fn().mockResolvedValue(digestByUpdated),
                   }),
                 };
               }
-              if (index === "by_active_created") {
+              if (index === "by_active_created" || index === "by_nonsuspicious_created") {
                 return {
                   order: () => ({
                     take: vi.fn().mockResolvedValue(digestByCreated),
@@ -1168,3 +1359,36 @@ function makeLexicalCtx(params: {
     },
   };
 }
+
+function makeSoulLexicalCtx(params: {
+  exactSlugSoul: ReturnType<typeof makeSoulDoc> | null;
+  recentSouls: Array<ReturnType<typeof makeSoulDoc>>;
+}) {
+  const usedIndexes: string[] = [];
+  return {
+    usedIndexes,
+    db: {
+      query: vi.fn((table: string) => {
+        if (table !== "souls") throw new Error(`Unexpected table ${table}`);
+        return {
+          withIndex: (index: string) => {
+            usedIndexes.push(index);
+            if (index === "by_slug") {
+              return {
+                unique: vi.fn().mockResolvedValue(params.exactSlugSoul),
+              };
+            }
+            if (index === "by_active_updated") {
+              return {
+                order: () => ({
+                  take: vi.fn().mockResolvedValue(params.recentSouls),
+                }),
+              };
+            }
+            throw new Error(`Unexpected souls index ${index}`);
+          },
+        };
+      }),
+    },
+  };
+}

convex/search.ts

@@ -53,6 +53,7 @@ const NAME_EXACT_BOOST = 1.1;
 const NAME_PREFIX_BOOST = 0.6;
 const POPULARITY_WEIGHT = 0.08;
 const FALLBACK_SCAN_LIMIT = 2000;
+const MIN_STABLE_SEARCH_RECALL_LIMIT = 100;
 const SKILL_CAPABILITY_TAG_SET = new Set<string>(SKILL_CAPABILITY_TAGS);
 
 function getNextCandidateLimit(current: number, max: number) {
@@ -168,11 +169,14 @@ export const searchSkills: ReturnType<typeof action> = action({
       vector = null;
     }
     const limit = args.limit ?? 10;
+    // Keep ordinary first-page and load-more requests ranking the same recall pool
+    // before slicing, so expanding the display limit does not reshuffle the prefix.
+    const recallLimit = Math.max(limit, MIN_STABLE_SEARCH_RECALL_LIMIT);
     // Convex vectorSearch max limit is 256; clamp candidate sizes accordingly.
     // Keep the initial pool large enough to catch moderate-vector matches
     // that win after lexical and popularity scoring, even for small limits.
-    const maxCandidate = Math.min(Math.max(limit * 10, 200), 256);
-    let candidateLimit = Math.min(Math.max(limit * 3, 200), 256);
+    const maxCandidate = Math.min(Math.max(recallLimit * 10, 200), 256);
+    let candidateLimit = Math.min(Math.max(recallLimit * 3, 200), 256);
     let hydrated: SkillSearchEntry[] = [];
     const seenEmbeddingIds = new Set<Id<"skillEmbeddings">>();
     let scoreById = new Map<Id<"skillEmbeddings">, number>();
@@ -183,8 +187,7 @@ export const searchSkills: ReturnType<typeof action> = action({
         const results = await ctx.vectorSearch("skillEmbeddings", "by_embedding", {
           vector,
           limit: candidateLimit,
-          filter: (q) =>
-            q.or(q.eq("visibility", "latest"), q.eq("visibility", "latest-approved")),
+          filter: (q) => q.or(q.eq("visibility", "latest"), q.eq("visibility", "latest-approved")),
         });
 
         // Only hydrate embedding IDs we haven't seen yet (incremental).
@@ -221,7 +224,7 @@ export const searchSkills: ReturnType<typeof action> = action({
           ]),
         );
 
-        if (exactMatches.length >= limit || results.length < candidateLimit) {
+        if (exactMatches.length >= recallLimit || results.length < candidateLimit) {
           break;
         }
 
@@ -236,12 +239,12 @@ export const searchSkills: ReturnType<typeof action> = action({
       : exactMatches;
 
     const fallbackMatches =
-      primaryMatches.length >= limit
+      primaryMatches.length >= recallLimit
         ? []
         : ((await ctx.runQuery(internal.search.lexicalFallbackSkills, {
             query,
             queryTokens,
-            limit: Math.min(Math.max(limit * 4, 200), FALLBACK_SCAN_LIMIT),
+            limit: Math.min(Math.max(recallLimit * 4, 200), FALLBACK_SCAN_LIMIT),
             highlightedOnly: args.highlightedOnly,
             nonSuspiciousOnly: args.nonSuspiciousOnly,
             capabilityTag: args.capabilityTag,
@@ -391,17 +394,28 @@ export const lexicalFallbackSkills = internalQuery({
     // Scan recent active digests (~800 bytes each) instead of full skill docs (~3-5KB).
     // Use updatedAt and createdAt windows so newly published skills are visible even
     // when they are not in the most recently updated slice.
+    const recentByUpdatedQuery = args.nonSuspiciousOnly
+      ? ctx.db
+          .query("skillSearchDigest")
+          .withIndex("by_nonsuspicious_updated", (q) =>
+            q.eq("softDeletedAt", undefined).eq("isSuspicious", false),
+          )
+      : ctx.db
+          .query("skillSearchDigest")
+          .withIndex("by_active_updated", (q) => q.eq("softDeletedAt", undefined));
+    const recentByCreatedQuery = args.nonSuspiciousOnly
+      ? ctx.db
+          .query("skillSearchDigest")
+          .withIndex("by_nonsuspicious_created", (q) =>
+            q.eq("softDeletedAt", undefined).eq("isSuspicious", false),
+          )
+      : ctx.db
+          .query("skillSearchDigest")
+          .withIndex("by_active_created", (q) => q.eq("softDeletedAt", undefined));
+
     const [recentByUpdated, recentByCreated] = await Promise.all([
-      ctx.db
-        .query("skillSearchDigest")
-        .withIndex("by_active_updated", (q) => q.eq("softDeletedAt", undefined))
-        .order("desc")
-        .take(FALLBACK_SCAN_LIMIT),
-      ctx.db
-        .query("skillSearchDigest")
-        .withIndex("by_active_created", (q) => q.eq("softDeletedAt", undefined))
-        .order("desc")
-        .take(FALLBACK_SCAN_LIMIT),
+      recentByUpdatedQuery.order("desc").take(FALLBACK_SCAN_LIMIT),
+      recentByCreatedQuery.order("desc").take(FALLBACK_SCAN_LIMIT),
     ]);
 
     const addDigestCandidates = (digests: typeof recentByUpdated) => {
@@ -455,13 +469,25 @@ export const lexicalFallbackSkills = internalQuery({
 });
 
 type HydratedSoulEntry = {
-  embeddingId: Id<"soulEmbeddings">;
+  embeddingId?: Id<"soulEmbeddings">;
   soul: NonNullable<ReturnType<typeof toPublicSoul>>;
   version: Doc<"soulVersions"> | null;
 };
 
 type SoulSearchResult = HydratedSoulEntry & { score: number };
 
+function mergeUniqueBySoulId(primary: HydratedSoulEntry[], fallback: HydratedSoulEntry[]) {
+  if (fallback.length === 0) return primary;
+  const out = [...primary];
+  const seen = new Set(primary.map((entry) => entry.soul._id));
+  for (const entry of fallback) {
+    if (seen.has(entry.soul._id)) continue;
+    seen.add(entry.soul._id);
+    out.push(entry);
+  }
+  return out;
+}
+
 export const searchSouls: ReturnType<typeof action> = action({
   args: {
     query: v.string(),
@@ -472,12 +498,12 @@ export const searchSouls: ReturnType<typeof action> = action({
     if (!query) return [];
     const queryTokens = tokenize(query);
     if (queryTokens.length === 0) return [];
-    let vector: number[];
+    let vector: number[] | null;
     try {
       vector = await generateEmbedding(query);
     } catch (error) {
-      console.warn("Search embedding generation failed", error);
-      return [];
+      console.warn("Search embedding generation failed, falling back to lexical search", error);
+      vector = null;
     }
     const limit = args.limit ?? 10;
     // Convex vectorSearch max limit is 256; clamp candidate sizes accordingly.
@@ -485,47 +511,76 @@ export const searchSouls: ReturnType<typeof action> = action({
     const maxCandidate = Math.min(Math.max(limit * 10, 200), 256);
     let candidateLimit = Math.min(Math.max(limit * 3, 200), 256);
     let hydrated: HydratedSoulEntry[] = [];
+    const seenEmbeddingIds = new Set<Id<"soulEmbeddings">>();
     let scoreById = new Map<Id<"soulEmbeddings">, number>();
     let exactMatches: HydratedSoulEntry[] = [];
 
-    while (candidateLimit <= maxCandidate) {
-      const results = await ctx.vectorSearch("soulEmbeddings", "by_embedding", {
-        vector,
-        limit: candidateLimit,
-        filter: (q) => q.or(q.eq("visibility", "latest"), q.eq("visibility", "latest-approved")),
-      });
+    if (vector) {
+      while (candidateLimit <= maxCandidate) {
+        const results = await ctx.vectorSearch("soulEmbeddings", "by_embedding", {
+          vector,
+          limit: candidateLimit,
+          filter: (q) => q.or(q.eq("visibility", "latest"), q.eq("visibility", "latest-approved")),
+        });
 
-      hydrated = (await ctx.runQuery(internal.search.hydrateSoulResults, {
-        embeddingIds: results.map((result) => result._id),
-      })) as HydratedSoulEntry[];
+        const newEmbeddingIds = results.map((r) => r._id).filter((id) => !seenEmbeddingIds.has(id));
+        for (const id of newEmbeddingIds) seenEmbeddingIds.add(id);
 
-      for (const result of results) {
-        scoreById.set(result._id, result._score);
+        if (newEmbeddingIds.length > 0) {
+          const newEntries = (await ctx.runQuery(internal.search.hydrateSoulResults, {
+            embeddingIds: newEmbeddingIds,
+          })) as HydratedSoulEntry[];
+          hydrated = [...hydrated, ...newEntries];
+        }
+
+        for (const result of results) {
+          scoreById.set(result._id, result._score);
+        }
+
+        exactMatches = hydrated.filter((entry) =>
+          matchesExactTokens(queryTokens, [
+            entry.soul.displayName,
+            entry.soul.slug,
+            entry.soul.summary,
+          ]),
+        );
+
+        if (exactMatches.length >= limit || results.length < candidateLimit) {
+          break;
+        }
+
+        const nextLimit = getNextCandidateLimit(candidateLimit, maxCandidate);
+        if (!nextLimit) break;
+        candidateLimit = nextLimit;
       }
-
-      exactMatches = hydrated.filter((entry) =>
-        matchesExactTokens(queryTokens, [
-          entry.soul.displayName,
-          entry.soul.slug,
-          entry.soul.summary,
-        ]),
-      );
-
-      if (exactMatches.length >= limit || results.length < candidateLimit) {
-        break;
-      }
-
-      const nextLimit = getNextCandidateLimit(candidateLimit, maxCandidate);
-      if (!nextLimit) break;
-      candidateLimit = nextLimit;
     }
 
-    return exactMatches
-      .map((entry) => ({
-        ...entry,
-        score: scoreById.get(entry.embeddingId) ?? 0,
-      }))
+    const fallbackMatches =
+      exactMatches.length >= limit
+        ? []
+        : ((await ctx.runQuery(internal.search.lexicalFallbackSouls, {
+            query,
+            queryTokens,
+            limit: Math.min(Math.max(limit * 4, 200), FALLBACK_SCAN_LIMIT),
+          })) as HydratedSoulEntry[]);
+    const mergedMatches = mergeUniqueBySoulId(exactMatches, fallbackMatches);
+
+    return mergedMatches
+      .map((entry) => {
+        const vectorScore = entry.embeddingId ? (scoreById.get(entry.embeddingId) ?? 0) : 0;
+        return {
+          ...entry,
+          score: scoreSkillResult(
+            queryTokens,
+            vectorScore,
+            entry.soul.displayName,
+            entry.soul.slug,
+            entry.soul.stats.downloads,
+          ),
+        };
+      })
       .filter((entry) => entry.soul)
+      .sort((a, b) => b.score - a.score || b.soul.stats.downloads - a.soul.stats.downloads)
       .slice(0, limit);
   },
 });
@@ -550,10 +605,64 @@ export const hydrateSoulResults = internalQuery({
   },
 });
 
+export const lexicalFallbackSouls = internalQuery({
+  args: {
+    query: v.string(),
+    queryTokens: v.array(v.string()),
+    limit: v.optional(v.number()),
+  },
+  handler: async (ctx, args): Promise<HydratedSoulEntry[]> => {
+    const limit = Math.min(Math.max(args.limit ?? 200, 10), FALLBACK_SCAN_LIMIT);
+    const seenSoulIds = new Set<Id<"souls">>();
+    const candidates: Doc<"souls">[] = [];
+
+    const slugQuery = args.query.trim().toLowerCase();
+    if (isSlugLikeQuery(slugQuery)) {
+      const exactSlugSoul = await ctx.db
+        .query("souls")
+        .withIndex("by_slug", (q) => q.eq("slug", slugQuery))
+        .unique();
+      if (exactSlugSoul && !exactSlugSoul.softDeletedAt) {
+        seenSoulIds.add(exactSlugSoul._id);
+        candidates.push(exactSlugSoul);
+      }
+    }
+
+    const recentSouls = await ctx.db
+      .query("souls")
+      .withIndex("by_active_updated", (q) => q.eq("softDeletedAt", undefined))
+      .order("desc")
+      .take(FALLBACK_SCAN_LIMIT);
+
+    for (const soul of recentSouls) {
+      if (seenSoulIds.has(soul._id)) continue;
+      seenSoulIds.add(soul._id);
+      candidates.push(soul);
+    }
+
+    const matched = candidates.filter((soul) =>
+      matchesExactTokens(args.queryTokens, [soul.displayName, soul.slug, soul.summary]),
+    );
+    if (matched.length === 0) return [];
+
+    const entries = matched.map((soul) => {
+      const publicSoul = toPublicSoul(soul);
+      if (!publicSoul) return null;
+      return {
+        soul: publicSoul,
+        version: null as Doc<"soulVersions"> | null,
+      };
+    });
+
+    return entries.filter((entry): entry is HydratedSoulEntry => entry !== null).slice(0, limit);
+  },
+});
+
 export const __test = {
   getNextCandidateLimit,
   matchesAllTokens,
   getLexicalBoost,
   scoreSkillResult,
   mergeUniqueBySkillId,
+  mergeUniqueBySoulId,
 };

convex/securityDataset.ts

@@ -0,0 +1,308 @@
+import { paginationOptsValidator } from "convex/server";
+import { v } from "convex/values";
+import { internal } from "./_generated/api";
+import type { Doc } from "./_generated/dataModel";
+import type { QueryCtx } from "./_generated/server";
+import { internalAction, internalQuery } from "./functions";
+
+const MAX_EXPORT_PAGE_SIZE = 50;
+const MAX_EXPORT_BATCH_PAGES = 20;
+const REDACTION_POLICY_VERSION = "public-signals-v1";
+const SOURCE_TABLES = ["skillVersions", "packageReleases"] as const;
+const SCANNER_SOURCES = ["static", "virustotal", "llm", "moderation_consensus"] as const;
+type StoredVtAnalysis = Doc<"skillVersions">["vtAnalysis"];
+type StoredLlmAnalysis = Doc<"skillVersions">["llmAnalysis"];
+type ArtifactExportRow =
+	| Awaited<ReturnType<typeof skillVersionPageToExportRows>>[number]
+	| Awaited<ReturnType<typeof packageReleasePageToExportRows>>[number];
+type ArtifactExportPage = {
+	page: ArtifactExportRow[];
+	isDone: boolean;
+	continueCursor: string;
+	exportMode: "public";
+};
+
+export const listArtifactExportPageInternal = internalQuery({
+	args: {
+		sourceKind: v.union(v.literal("skill"), v.literal("package")),
+		mode: v.optional(v.literal("public")),
+		createdAtGte: v.optional(v.number()),
+		createdAtLt: v.optional(v.number()),
+		paginationOpts: paginationOptsValidator,
+	},
+	handler: async (ctx, args) => {
+		const paginationOpts = {
+			cursor: args.paginationOpts.cursor,
+			numItems: Math.min(args.paginationOpts.numItems, MAX_EXPORT_PAGE_SIZE),
+		};
+		if (args.sourceKind === "skill") {
+			const page = await ctx.db
+				.query("skillVersions")
+				.withIndex("by_active_created", (q) => {
+					const range = q.eq("softDeletedAt", undefined);
+					if (args.createdAtGte !== undefined && args.createdAtLt !== undefined) {
+						return range.gte("createdAt", args.createdAtGte).lt("createdAt", args.createdAtLt);
+					}
+					if (args.createdAtGte !== undefined) return range.gte("createdAt", args.createdAtGte);
+					if (args.createdAtLt !== undefined) return range.lt("createdAt", args.createdAtLt);
+					return range;
+				})
+				.order("asc")
+				.paginate(paginationOpts);
+			return {
+				page: await skillVersionPageToExportRows(ctx, page.page),
+				isDone: page.isDone,
+				continueCursor: page.continueCursor,
+				exportMode: args.mode ?? "public",
+			};
+		}
+
+		const page = await ctx.db
+			.query("packageReleases")
+			.withIndex("by_active_created", (q) => {
+				const range = q.eq("softDeletedAt", undefined);
+				if (args.createdAtGte !== undefined && args.createdAtLt !== undefined) {
+					return range.gte("createdAt", args.createdAtGte).lt("createdAt", args.createdAtLt);
+				}
+				if (args.createdAtGte !== undefined) return range.gte("createdAt", args.createdAtGte);
+				if (args.createdAtLt !== undefined) return range.lt("createdAt", args.createdAtLt);
+				return range;
+			})
+			.order("asc")
+			.paginate(paginationOpts);
+		return {
+			page: await packageReleasePageToExportRows(ctx, page.page),
+			isDone: page.isDone,
+			continueCursor: page.continueCursor,
+			exportMode: args.mode ?? "public",
+		};
+	},
+});
+
+export const getArtifactExportBoundsInternal = internalQuery({
+	args: {
+		sourceKind: v.union(v.literal("skill"), v.literal("package")),
+	},
+	handler: async (ctx, args) => {
+		return await getActiveCreatedBounds(ctx, args.sourceKind);
+	},
+});
+
+export const listArtifactExportBatchInternal = internalAction({
+	args: {
+		sourceKind: v.union(v.literal("skill"), v.literal("package")),
+		mode: v.optional(v.literal("public")),
+		createdAtGte: v.optional(v.number()),
+		createdAtLt: v.optional(v.number()),
+		paginationOpts: paginationOptsValidator,
+		pageCount: v.number(),
+	},
+	handler: async (ctx, args) => {
+		const pageCount = Math.min(Math.max(1, Math.floor(args.pageCount)), MAX_EXPORT_BATCH_PAGES);
+		let cursor = args.paginationOpts.cursor;
+		const page: ArtifactExportPage["page"] = [];
+		let isDone = false;
+		for (let pageIndex = 0; pageIndex < pageCount; pageIndex += 1) {
+			const result: ArtifactExportPage = await ctx.runQuery(
+				internal.securityDataset.listArtifactExportPageInternal,
+				{
+					sourceKind: args.sourceKind,
+					mode: args.mode,
+					createdAtGte: args.createdAtGte,
+					createdAtLt: args.createdAtLt,
+					paginationOpts: {
+						cursor,
+						numItems: args.paginationOpts.numItems,
+					},
+				},
+			);
+			page.push(...result.page);
+			cursor = result.continueCursor;
+			isDone = result.isDone;
+			if (isDone) break;
+		}
+		return {
+			page,
+			isDone,
+			continueCursor: cursor,
+			exportMode: args.mode ?? "public",
+		};
+	},
+});
+
+export const getDatasetLineageInternal = internalQuery({
+	args: {
+		mode: v.optional(v.literal("public")),
+	},
+	handler: async (ctx, args) => {
+		const sourceBounds = [
+			await getActiveCreatedBounds(ctx, "skill"),
+			await getActiveCreatedBounds(ctx, "package"),
+		];
+		return {
+			exportMode: args.mode ?? "public",
+			generatedAt: Date.now(),
+			maxExportPageSize: MAX_EXPORT_PAGE_SIZE,
+			maxExportBatchPages: MAX_EXPORT_BATCH_PAGES,
+			redactionPolicyVersion: REDACTION_POLICY_VERSION,
+			sourceTables: SOURCE_TABLES,
+			scannerSources: SCANNER_SOURCES,
+			sourceBounds,
+		};
+	},
+});
+
+async function getActiveCreatedBounds(ctx: QueryCtx, sourceKind: "skill" | "package") {
+	if (sourceKind === "skill") {
+		const first = await ctx.db
+			.query("skillVersions")
+			.withIndex("by_active_created", (q) => q.eq("softDeletedAt", undefined))
+			.order("asc")
+			.first();
+		const last = await ctx.db
+			.query("skillVersions")
+			.withIndex("by_active_created", (q) => q.eq("softDeletedAt", undefined))
+			.order("desc")
+			.first();
+		return {
+			sourceKind,
+			minCreatedAt: first?.createdAt ?? null,
+			maxCreatedAt: last?.createdAt ?? null,
+		};
+	}
+
+	const first = await ctx.db
+		.query("packageReleases")
+		.withIndex("by_active_created", (q) => q.eq("softDeletedAt", undefined))
+		.order("asc")
+		.first();
+	const last = await ctx.db
+		.query("packageReleases")
+		.withIndex("by_active_created", (q) => q.eq("softDeletedAt", undefined))
+		.order("desc")
+		.first();
+	return {
+		sourceKind,
+		minCreatedAt: first?.createdAt ?? null,
+		maxCreatedAt: last?.createdAt ?? null,
+	};
+}
+
+async function skillVersionPageToExportRows(ctx: QueryCtx, versions: Array<Doc<"skillVersions">>) {
+	const rows = [];
+	for (const version of versions) {
+		const skill = await ctx.db.get(version.skillId);
+		if (!skill || skill.softDeletedAt) continue;
+		rows.push({
+			sourceKind: "skill" as const,
+			sourceDocId: version._id,
+			parentDocId: skill._id,
+			publicName: skill.displayName,
+			publicSlug: skill.slug,
+			version: version.version,
+			artifactSha256: version.sha256hash ?? null,
+			createdAt: version.createdAt,
+			softDeletedAt: version.softDeletedAt ?? null,
+			files: sanitizeFiles(version.files),
+			capabilityTags: version.capabilityTags ?? skill.capabilityTags ?? [],
+			packageFamily: null,
+			packageChannel: null,
+			packageExecutesCode: null,
+			sourceRepoHost: null,
+			vtAnalysis: normalizeVtAnalysis(version.vtAnalysis),
+			staticScan: version.staticScan ?? null,
+			llmAnalysis: normalizeLlmAnalysis(version.llmAnalysis),
+			moderationConsensus:
+				skill.moderationSourceVersionId === version._id
+					? {
+							verdict: skill.moderationVerdict ?? null,
+							reasonCodes: skill.moderationReasonCodes ?? [],
+							summary: skill.moderationSummary ?? null,
+							engineVersion: skill.moderationEngineVersion ?? null,
+							evaluatedAt: skill.moderationEvaluatedAt ?? null,
+						}
+					: null,
+		});
+	}
+	return rows;
+}
+
+async function packageReleasePageToExportRows(
+	ctx: QueryCtx,
+	releases: Array<Doc<"packageReleases">>,
+) {
+	const rows = [];
+	for (const release of releases) {
+		const pkg = await ctx.db.get(release.packageId);
+		if (!pkg || pkg.softDeletedAt || pkg.channel === "private") continue;
+		rows.push({
+			sourceKind: "package" as const,
+			sourceDocId: release._id,
+			parentDocId: pkg._id,
+			publicName: pkg.displayName,
+			publicSlug: pkg.name,
+			version: release.version,
+			artifactSha256: release.sha256hash ?? release.integritySha256,
+			createdAt: release.createdAt,
+			softDeletedAt: release.softDeletedAt ?? null,
+			files: sanitizeFiles(release.files),
+			capabilityTags: pkg.capabilityTags ?? [],
+			packageFamily: pkg.family,
+			packageChannel: pkg.channel,
+			packageExecutesCode: pkg.executesCode ?? null,
+			sourceRepoHost: sourceRepoHost(pkg.sourceRepo),
+			vtAnalysis: normalizeVtAnalysis(release.vtAnalysis),
+			staticScan: release.staticScan ?? null,
+			llmAnalysis: normalizeLlmAnalysis(release.llmAnalysis),
+			moderationConsensus: null,
+		});
+	}
+	return rows;
+}
+
+function sanitizeFiles(files: Array<Doc<"skillVersions">["files"][number]>) {
+	return files.map((file) => ({
+		path: file.path,
+		size: file.size,
+		sha256: file.sha256,
+		contentType: file.contentType ?? null,
+	}));
+}
+
+function normalizeVtAnalysis(analysis: StoredVtAnalysis) {
+	if (!analysis) return null;
+	return {
+		status: analysis.status,
+		verdict: analysis.verdict ?? null,
+		analysis: analysis.analysis ?? null,
+		source: analysis.source ?? null,
+		scanner: analysis.scanner ?? null,
+		engineStats: analysis.engineStats ?? null,
+		checkedAt: analysis.checkedAt,
+	};
+}
+
+function normalizeLlmAnalysis(analysis: StoredLlmAnalysis) {
+	if (!analysis) return null;
+	return {
+		status: analysis.status,
+		verdict: analysis.verdict ?? null,
+		confidence: analysis.confidence ?? null,
+		summary: analysis.summary ?? null,
+		dimensions: analysis.dimensions ?? null,
+		guidance: analysis.guidance ?? null,
+		findings: analysis.findings ?? null,
+		model: analysis.model ?? null,
+		checkedAt: analysis.checkedAt,
+	};
+}
+
+function sourceRepoHost(sourceRepo: string | undefined) {
+	if (!sourceRepo) return null;
+	try {
+		return new URL(sourceRepo).host.toLowerCase();
+	} catch {
+		const match = sourceRepo.match(/^[^/:]+[:/](?<owner>[^/]+)\/(?<repo>[^/]+)$/);
+		return match?.groups?.owner && match.groups.repo ? "github.com" : null;
+	}
+}

convex/securityDatasetNode.ts

@@ -0,0 +1,62 @@
+"use node";
+
+import { gzipSync } from "node:zlib";
+import { paginationOptsValidator } from "convex/server";
+import { v } from "convex/values";
+import { internal } from "./_generated/api";
+import { internalAction } from "./functions";
+
+const MAX_EXPORT_BATCH_PAGES = 20;
+
+type ArtifactExportPage = {
+	page: unknown[];
+	isDone: boolean;
+	continueCursor: string;
+	exportMode: "public";
+};
+
+export const listArtifactExportBatchCompressedInternal = internalAction({
+	args: {
+		sourceKind: v.union(v.literal("skill"), v.literal("package")),
+		mode: v.optional(v.literal("public")),
+		createdAtGte: v.optional(v.number()),
+		createdAtLt: v.optional(v.number()),
+		paginationOpts: paginationOptsValidator,
+		pageCount: v.number(),
+	},
+	handler: async (ctx, args) => {
+		const pageCount = Math.min(Math.max(1, Math.floor(args.pageCount)), MAX_EXPORT_BATCH_PAGES);
+		let cursor = args.paginationOpts.cursor;
+		const page: ArtifactExportPage["page"] = [];
+		let isDone = false;
+		for (let pageIndex = 0; pageIndex < pageCount; pageIndex += 1) {
+			const result: ArtifactExportPage = await ctx.runQuery(
+				internal.securityDataset.listArtifactExportPageInternal,
+				{
+					sourceKind: args.sourceKind,
+					mode: args.mode,
+					createdAtGte: args.createdAtGte,
+					createdAtLt: args.createdAtLt,
+					paginationOpts: {
+						cursor,
+						numItems: args.paginationOpts.numItems,
+					},
+				},
+			);
+			page.push(...result.page);
+			cursor = result.continueCursor;
+			isDone = result.isDone;
+			if (isDone) break;
+		}
+		const json = JSON.stringify({
+			page,
+			isDone,
+			continueCursor: cursor,
+			exportMode: args.mode ?? "public",
+		});
+		return {
+			encoding: "gzip-base64-json" as const,
+			payload: gzipSync(json).toString("base64"),
+		};
+	},
+});

convex/skills.countPublicSkills.test.ts

@@ -15,19 +15,6 @@ const countPublicSkillsHandler = (
   countPublicSkills as unknown as WrappedHandler<Record<string, never>, number>
 )._handler;
 
-function makeSkillsQuery(
-  skills: Array<{ softDeletedAt?: number; moderationStatus?: string | null }>,
-) {
-  return {
-    withIndex: (name: string) => {
-      if (name !== "by_active_updated") throw new Error(`unexpected skills index ${name}`);
-      return {
-        collect: async () => skills,
-      };
-    },
-  };
-}
-
 describe("skills.countPublicSkills", () => {
   it("returns precomputed global stats count when available", async () => {
     const ctx = {
@@ -40,9 +27,6 @@ describe("skills.countPublicSkills", () => {
               }),
             };
           }
-          if (table === "skillSearchDigest") {
-            return makeSkillsQuery([]);
-          }
           throw new Error(`unexpected table ${table}`);
         }),
       },
@@ -52,7 +36,7 @@ describe("skills.countPublicSkills", () => {
     expect(result).toBe(123);
   });
 
-  it("falls back to live count when global stats row is missing", async () => {
+  it("returns zero when the global stats row is missing", async () => {
     const ctx = {
       db: {
         query: vi.fn((table: string) => {
@@ -63,41 +47,28 @@ describe("skills.countPublicSkills", () => {
               }),
             };
           }
-          if (table === "skillSearchDigest") {
-            return makeSkillsQuery([
-              { softDeletedAt: undefined, moderationStatus: "active" },
-              { softDeletedAt: undefined, moderationStatus: "hidden" },
-              { softDeletedAt: undefined, moderationStatus: "active" },
-            ]);
-          }
           throw new Error(`unexpected table ${table}`);
         }),
       },
     };
 
     const result = await countPublicSkillsHandler(ctx, {});
-    expect(result).toBe(2);
+    expect(result).toBe(0);
   });
 
-  it("falls back to live count when globalStats table is unavailable", async () => {
+  it("returns zero when globalStats table is unavailable", async () => {
     const ctx = {
       db: {
         query: vi.fn((table: string) => {
           if (table === "globalStats") {
             throw new Error("unexpected table globalStats");
           }
-          if (table === "skillSearchDigest") {
-            return makeSkillsQuery([
-              { softDeletedAt: undefined, moderationStatus: "active" },
-              { softDeletedAt: undefined, moderationStatus: "active" },
-            ]);
-          }
           throw new Error(`unexpected table ${table}`);
         }),
       },
     };
 
     const result = await countPublicSkillsHandler(ctx, {});
-    expect(result).toBe(2);
+    expect(result).toBe(0);
   });
 });

convex/skills.manualOverrides.test.ts

@@ -33,6 +33,7 @@ const clearSkillManualOverrideHandler = (
 const updateVersionLlmAnalysisInternalHandler = (
   updateVersionLlmAnalysisInternal as unknown as WrappedHandler<{
     versionId: string;
+    moderationMode?: "normal" | "preserve";
     llmAnalysis: Record<string, unknown>;
   }>
 )._handler;
@@ -396,6 +397,54 @@ describe("skills manual overrides", () => {
     });
   });
 
+  it("can store llm backfill results without syncing moderation", async () => {
+    const now = 1_700_000_250_000;
+    vi.spyOn(Date, "now").mockReturnValue(now);
+
+    const skill = {
+      _id: "skills:1",
+      ownerUserId: "users:owner",
+      latestVersionId: "skillVersions:7",
+      softDeletedAt: undefined,
+      moderationStatus: "active",
+      moderationReason: undefined,
+      moderationVerdict: undefined,
+      moderationFlags: undefined,
+    };
+    const version = {
+      _id: "skillVersions:7",
+      skillId: "skills:1",
+      staticScan: undefined,
+      vtAnalysis: undefined,
+      llmAnalysis: undefined,
+    };
+
+    const { ctx, patch, get, query } = makeCtx({ skill, version });
+
+    await updateVersionLlmAnalysisInternalHandler(ctx, {
+      versionId: "skillVersions:7",
+      moderationMode: "preserve",
+      llmAnalysis: {
+        status: "malicious",
+        verdict: "malicious",
+        checkedAt: now,
+      },
+    });
+
+    expect(patch).toHaveBeenCalledTimes(1);
+    expect(patch).toHaveBeenCalledWith("skillVersions:7", {
+      llmAnalysis: {
+        status: "malicious",
+        verdict: "malicious",
+        checkedAt: now,
+      },
+    });
+    expect(get).toHaveBeenCalledTimes(1);
+    expect(get).toHaveBeenCalledWith("skillVersions:7");
+    expect(get).not.toHaveBeenCalledWith("skills:1");
+    expect(query).not.toHaveBeenCalled();
+  });
+
   it("updates global public count when llm scan sync restores a skill to active", async () => {
     const now = 1_700_000_300_000;
     vi.spyOn(Date, "now").mockReturnValue(now);

convex/skills.public.test.ts

@@ -26,6 +26,10 @@ const getBySlugHandler = (
       slug: string;
     },
     {
+      skill?: {
+        canonicalSkillId?: string;
+        forkOf?: unknown;
+      };
       owner?: {
         _id: string;
         _creationTime: number;
@@ -41,6 +45,26 @@ const getBySlugHandler = (
           contentType?: string;
         }>;
       } | null;
+      forkOf?: {
+        skill: {
+          slug: string;
+          displayName: string;
+        };
+        owner: {
+          handle: string | null;
+          userId: string | null;
+        };
+      } | null;
+      canonical?: {
+        skill: {
+          slug: string;
+          displayName: string;
+        };
+        owner: {
+          handle: string | null;
+          userId: string | null;
+        };
+      } | null;
     } | null
   >
 )._handler;
@@ -49,6 +73,8 @@ function makeCtx(args: {
   skill: Record<string, unknown> | null;
   owner: Record<string, unknown> | null;
   latestVersion?: Record<string, unknown> | null;
+  skillsById?: Record<string, Record<string, unknown>>;
+  ownersById?: Record<string, Record<string, unknown>>;
 }) {
   const unique = vi.fn().mockResolvedValue(args.skill);
   const withIndex = vi.fn(() => ({ unique }));
@@ -58,6 +84,9 @@ function makeCtx(args: {
   });
   const get = vi.fn(async (id: string) => {
     if (!args.skill) return null;
+    if (id === args.skill._id) return args.skill;
+    if (args.skillsById?.[id]) return args.skillsById[id];
+    if (args.ownersById?.[id]) return args.ownersById[id];
     if (id === args.skill.ownerUserId) return args.owner;
     if (id === args.skill.latestVersionId) return args.latestVersion ?? null;
     return null;
@@ -65,6 +94,47 @@ function makeCtx(args: {
   return { db: { query, get } } as never;
 }
 
+function makeOwner(id: string, handle: string, overrides: Record<string, unknown> = {}) {
+  return {
+    _id: id,
+    _creationTime: 1,
+    handle,
+    name: handle,
+    displayName: handle,
+    image: null,
+    ...overrides,
+  };
+}
+
+function makeSkill(overrides: Record<string, unknown> = {}) {
+  return {
+    _id: "skills:1",
+    _creationTime: 1,
+    slug: "demo",
+    displayName: "Demo",
+    summary: "Public demo skill",
+    ownerUserId: "users:1",
+    canonicalSkillId: undefined,
+    forkOf: undefined,
+    latestVersionId: null,
+    tags: {},
+    stats: {
+      downloads: 10,
+      installsCurrent: 2,
+      installsAllTime: 5,
+      stars: 3,
+      versions: 1,
+      comments: 0,
+    },
+    createdAt: 1,
+    updatedAt: 2,
+    moderationStatus: "active",
+    moderationFlags: undefined,
+    softDeletedAt: undefined,
+    ...overrides,
+  };
+}
+
 describe("skills.getBySlug", () => {
   beforeEach(() => {
     vi.mocked(getAuthUserId).mockReset();
@@ -178,6 +248,116 @@ describe("skills.getBySlug", () => {
     expect(result).toBeNull();
   });
 
+  it("omits duplicate references to nonpublic skills", async () => {
+    const ctx = makeCtx({
+      skill: makeSkill({
+        canonicalSkillId: "skills:hidden-canonical",
+        forkOf: {
+          skillId: "skills:deleted-fork",
+          kind: "duplicate",
+          version: "1.0.0",
+        },
+      }),
+      owner: makeOwner("users:1", "demo-owner", { displayName: "Demo Owner" }),
+      skillsById: {
+        "skills:deleted-fork": makeSkill({
+          _id: "skills:deleted-fork",
+          _creationTime: 2,
+          slug: "deleted-fork",
+          displayName: "Deleted Fork",
+          summary: "Deleted duplicate source",
+          ownerUserId: "users:fork-owner",
+          softDeletedAt: 123,
+        }),
+        "skills:hidden-canonical": makeSkill({
+          _id: "skills:hidden-canonical",
+          _creationTime: 3,
+          slug: "hidden-canonical",
+          displayName: "Hidden Canonical",
+          summary: "Hidden canonical source",
+          ownerUserId: "users:canonical-owner",
+          moderationStatus: "hidden",
+        }),
+      },
+    });
+
+    const result = await getBySlugHandler(ctx, { slug: "demo" } as never);
+
+    expect(result?.forkOf).toBeNull();
+    expect(result?.canonical).toBeNull();
+    expect(result?.skill?.forkOf).toBeUndefined();
+    expect(result?.skill?.canonicalSkillId).toBeUndefined();
+  });
+
+  it("keeps duplicate references to public skills", async () => {
+    const ctx = makeCtx({
+      skill: makeSkill({
+        canonicalSkillId: "skills:canonical",
+        forkOf: {
+          skillId: "skills:fork",
+          kind: "duplicate",
+          version: "1.0.0",
+        },
+      }),
+      owner: makeOwner("users:1", "demo-owner", { displayName: "Demo Owner" }),
+      skillsById: {
+        "skills:fork": makeSkill({
+          _id: "skills:fork",
+          _creationTime: 2,
+          slug: "fork-source",
+          displayName: "Fork Source",
+          summary: "Public duplicate source",
+          ownerUserId: "users:fork-owner",
+        }),
+        "skills:canonical": makeSkill({
+          _id: "skills:canonical",
+          _creationTime: 3,
+          slug: "canonical-source",
+          displayName: "Canonical Source",
+          summary: "Public canonical source",
+          ownerUserId: "users:canonical-owner",
+        }),
+      },
+      ownersById: {
+        "users:fork-owner": makeOwner("users:fork-owner", "fork-owner", {
+          _creationTime: 2,
+          displayName: "Fork Owner",
+        }),
+        "users:canonical-owner": makeOwner("users:canonical-owner", "canonical-owner", {
+          _creationTime: 3,
+          displayName: "Canonical Owner",
+        }),
+      },
+    });
+
+    const result = await getBySlugHandler(ctx, { slug: "demo" } as never);
+
+    expect(result?.forkOf).toMatchObject({
+      kind: "duplicate",
+      version: "1.0.0",
+      skill: {
+        slug: "fork-source",
+        displayName: "Fork Source",
+      },
+      owner: {
+        handle: "fork-owner",
+        userId: "users:fork-owner",
+      },
+    });
+    expect(result?.canonical).toMatchObject({
+      skill: {
+        slug: "canonical-source",
+        displayName: "Canonical Source",
+      },
+      owner: {
+        handle: "canonical-owner",
+        userId: "users:canonical-owner",
+      },
+    });
+    expect(result?.skill?.forkOf).toBeDefined();
+    expect(result?.skill?.canonicalSkillId).toBe("skills:canonical");
+  });
+
   it("normalizes misleading file MIME types in public version metadata", async () => {
     const ctx = makeCtx({
       skill: {

convex/skills.ts

@@ -26,6 +26,7 @@ import {
 import { getSkillBadgeMap, getSkillBadgeMaps, isSkillHighlighted } from "./lib/badges";
 import { scheduleNextBatchIfNeeded } from "./lib/batching";
 import { generateChangelogPreview as buildChangelogPreview } from "./lib/changelog";
+import { mergeDepRegistryFinding } from "./lib/depRegistryScan";
 import { embeddingVisibilityFor } from "./lib/embeddingVisibility";
 import {
   canHealSkillOwnershipByGitHubProviderAccountId,
@@ -33,7 +34,6 @@ import {
 } from "./lib/githubIdentity";
 import {
   adjustGlobalPublicSkillsCount,
-  countPublicSkillsForGlobalStats,
   getPublicSkillVisibilityDelta,
   isPublicSkillDoc,
   readGlobalPublicSkillsCount,
@@ -161,6 +161,31 @@ const vtAnalysisValidator = v.object({
   checkedAt: v.number(),
 });
 
+const depRegistryStatusValidator = v.union(
+  v.literal("clean"),
+  v.literal("suspicious"),
+  v.literal("error"),
+);
+
+const depRegistryValidator = v.union(v.literal("pypi"), v.literal("npm"), v.literal("cargo"));
+
+const depRegistryAnalysisValidator = v.object({
+  status: depRegistryStatusValidator,
+  results: v.array(
+    v.object({
+      name: v.string(),
+      registry: depRegistryValidator,
+      source: v.string(),
+      exists: v.boolean(),
+      httpStatus: v.optional(v.number()),
+    }),
+  ),
+  notFoundPackages: v.array(v.string()),
+  unresolvedPackages: v.array(v.string()),
+  summary: v.string(),
+  checkedAt: v.number(),
+});
+
 function buildStructuredModerationPatch(params: {
   staticScan?: Doc<"skillVersions">["staticScan"];
   vtAnalysis?: Doc<"skillVersions">["vtAnalysis"];
@@ -1082,6 +1107,22 @@ type StaffSkillAuditLogEntry = Doc<"auditLogs"> & {
   actor: ReturnType<typeof toPublicUser> | null;
 };
 
+async function loadPublicSkillReference(ctx: QueryCtx, skillId: Id<"skills"> | null | undefined) {
+  if (!skillId) return null;
+  const skill = await ctx.db.get(skillId);
+  if (!isPublicSkillDoc(skill)) return null;
+
+  const owner = toPublicPublisher(
+    await getOwnerPublisher(ctx, {
+      ownerPublisherId: skill.ownerPublisherId,
+      ownerUserId: skill.ownerUserId,
+    }),
+  );
+  if (!owner) return null;
+
+  return { skill, owner };
+}
+
 type PublicSkillListVersion = Pick<
   Doc<"skillVersions">,
   "_id" | "_creationTime" | "version" | "createdAt" | "changelog" | "changelogSource"
@@ -1566,21 +1607,8 @@ export const getBySlug = query({
     if (!owner) return null;
     const badges = await getSkillBadgeMap(ctx, skill._id);
 
-    const forkOfSkill = skill.forkOf?.skillId ? await ctx.db.get(skill.forkOf.skillId) : null;
-    const forkOfOwner = forkOfSkill
-      ? await getOwnerPublisher(ctx, {
-          ownerPublisherId: forkOfSkill.ownerPublisherId,
-          ownerUserId: forkOfSkill.ownerUserId,
-        })
-      : null;
-
-    const canonicalSkill = skill.canonicalSkillId ? await ctx.db.get(skill.canonicalSkillId) : null;
-    const canonicalOwner = canonicalSkill
-      ? await getOwnerPublisher(ctx, {
-          ownerPublisherId: canonicalSkill.ownerPublisherId,
-          ownerUserId: canonicalSkill.ownerUserId,
-        })
-      : null;
+    const forkOf = await loadPublicSkillReference(ctx, skill.forkOf?.skillId);
+    const canonical = await loadPublicSkillReference(ctx, skill.canonicalSkillId);
 
     const publicSkill = toPublicSkill({ ...skill, badges });
 
@@ -1615,6 +1643,11 @@ export const getBySlug = query({
       createdAt: skill.createdAt,
       updatedAt: skill.updatedAt,
     };
+    const responseSkillData = {
+      ...skillData,
+      canonicalSkillId: canonical ? skillData.canonicalSkillId : undefined,
+      forkOf: forkOf ? skillData.forkOf : undefined,
+    };
 
     // Moderation info - visible to owners for all states, or anyone for flagged skills (transparency)
     const showModerationInfo = isOwner || isMalwareBlocked || isSuspicious || overrideActive;
@@ -1642,34 +1675,34 @@ export const getBySlug = query({
     return {
       requestedSlug: resolved.requestedSlug,
       resolvedSlug: resolved.resolvedSlug,
-      skill: skillData,
+      skill: responseSkillData,
       latestVersion,
       owner,
       pendingReview: isOwner && isPendingScan,
       moderationInfo,
-      forkOf: forkOfSkill
+      forkOf: forkOf
         ? {
             kind: skill.forkOf?.kind ?? "fork",
             version: skill.forkOf?.version ?? null,
             skill: {
-              slug: forkOfSkill.slug,
-              displayName: forkOfSkill.displayName,
+              slug: forkOf.skill.slug,
+              displayName: forkOf.skill.displayName,
             },
             owner: {
-              handle: forkOfOwner?.handle ?? null,
-              userId: forkOfOwner?.linkedUserId ?? null,
+              handle: forkOf.owner.handle ?? null,
+              userId: forkOf.owner.linkedUserId ?? null,
             },
           }
         : null,
-      canonical: canonicalSkill
+      canonical: canonical
         ? {
             skill: {
-              slug: canonicalSkill.slug,
-              displayName: canonicalSkill.displayName,
+              slug: canonical.skill.slug,
+              displayName: canonical.skill.displayName,
             },
             owner: {
-              handle: canonicalOwner?.handle ?? null,
-              userId: canonicalOwner?.linkedUserId ?? null,
+              handle: canonical.owner.handle ?? null,
+              userId: canonical.owner.linkedUserId ?? null,
             },
           }
         : null,
@@ -3055,6 +3088,7 @@ function skillCatalogMatchesFilters(
   args: {
     channel?: "official" | "community" | "private";
     isOfficial?: boolean;
+    highlightedOnly?: boolean;
     executesCode?: boolean;
     capabilityTag?: string;
   },
@@ -3065,6 +3099,7 @@ function skillCatalogMatchesFilters(
   const isOfficial = isSkillCatalogOfficial(digest);
   const channel = getSkillCatalogChannel(digest);
   if (typeof args.isOfficial === "boolean" && isOfficial !== args.isOfficial) return false;
+  if (args.highlightedOnly && !isSkillHighlighted(digest)) return false;
   if (args.channel && channel !== args.channel) return false;
   if (args.capabilityTag && !(digest.capabilityTags ?? []).includes(args.capabilityTag))
     return false;
@@ -3120,6 +3155,7 @@ export const listPackageCatalogPage = query({
       v.union(v.literal("official"), v.literal("community"), v.literal("private")),
     ),
     isOfficial: v.optional(v.boolean()),
+    highlightedOnly: v.optional(v.boolean()),
     executesCode: v.optional(v.boolean()),
     capabilityTag: v.optional(v.string()),
     paginationOpts: paginationOptsValidator,
@@ -3211,6 +3247,7 @@ export const searchPackageCatalogPublic = query({
       v.union(v.literal("official"), v.literal("community"), v.literal("private")),
     ),
     isOfficial: v.optional(v.boolean()),
+    highlightedOnly: v.optional(v.boolean()),
     executesCode: v.optional(v.boolean()),
     capabilityTag: v.optional(v.string()),
   },
@@ -3393,9 +3430,7 @@ export const countPublicSkills = query({
   args: {},
   handler: async (ctx) => {
     const statsCount = await readGlobalPublicSkillsCount(ctx);
-    if (typeof statsCount === "number") return statsCount;
-    // Fallback for uninitialized/missing globalStats storage.
-    return countPublicSkillsForGlobalStats(ctx);
+    return statsCount ?? 0;
   },
 });
 
@@ -4055,6 +4090,41 @@ export const updateSkillVersionStaticScanInternal = internalMutation({
   },
 });
 
+export const updateVersionDepRegistryAnalysisInternal = internalMutation({
+  args: {
+    versionId: v.id("skillVersions"),
+    depRegistryAnalysis: depRegistryAnalysisValidator,
+  },
+  handler: async (ctx, args) => {
+    const version = await ctx.db.get(args.versionId);
+    if (!version) return { ok: true as const, skipped: "missing" as const };
+
+    const staticScan = mergeDepRegistryFinding({
+      staticScan: version.staticScan,
+      analysis: args.depRegistryAnalysis,
+      statusFromCodes: verdictFromCodes,
+      summarizeCodes: summarizeReasonCodes,
+    });
+    const versionPatch = {
+      depRegistryAnalysis: args.depRegistryAnalysis,
+      depRegistryScanStatus: args.depRegistryAnalysis.status,
+      staticScan,
+    };
+
+    await ctx.db.patch(version._id, versionPatch);
+    const updatedVersion = { ...version, ...versionPatch };
+
+    const skill = await ctx.db.get(version.skillId);
+    if (!skill) return { ok: true as const, skipped: "missing_skill" as const };
+    if (skill.latestVersionId !== version._id) {
+      return { ok: true as const, skipped: "not_latest" as const };
+    }
+
+    await patchStructuredModerationFromVersion(ctx, skill, updatedVersion);
+    return { ok: true as const, status: args.depRegistryAnalysis.status };
+  },
+});
+
 export const scanSkillVersionStaticallyInternal: ReturnType<typeof internalAction> = internalAction(
   {
     args: {
@@ -4833,6 +4903,7 @@ export const updateVersionScanResultsInternal = internalMutation({
 export const updateVersionLlmAnalysisInternal = internalMutation({
   args: {
     versionId: v.id("skillVersions"),
+    moderationMode: v.optional(v.union(v.literal("normal"), v.literal("preserve"))),
     llmAnalysis: v.object({
       status: v.string(),
       verdict: v.optional(v.string()),
@@ -4850,6 +4921,50 @@ export const updateVersionLlmAnalysisInternal = internalMutation({
       ),
       guidance: v.optional(v.string()),
       findings: v.optional(v.string()),
+      agenticRiskFindings: v.optional(
+        v.array(
+          v.object({
+            categoryId: v.string(),
+            categoryLabel: v.string(),
+            riskBucket: v.union(
+              v.literal("abnormal_behavior_control"),
+              v.literal("permission_boundary"),
+              v.literal("sensitive_data_protection"),
+            ),
+            status: v.union(v.literal("none"), v.literal("note"), v.literal("concern")),
+            severity: v.string(),
+            confidence: v.union(v.literal("high"), v.literal("medium"), v.literal("low")),
+            evidence: v.optional(
+              v.object({
+                path: v.string(),
+                snippet: v.string(),
+                explanation: v.string(),
+              }),
+            ),
+            userImpact: v.string(),
+            recommendation: v.string(),
+          }),
+        ),
+      ),
+      riskSummary: v.optional(
+        v.object({
+          abnormal_behavior_control: v.object({
+            status: v.union(v.literal("none"), v.literal("note"), v.literal("concern")),
+            summary: v.string(),
+            highestSeverity: v.optional(v.string()),
+          }),
+          permission_boundary: v.object({
+            status: v.union(v.literal("none"), v.literal("note"), v.literal("concern")),
+            summary: v.string(),
+            highestSeverity: v.optional(v.string()),
+          }),
+          sensitive_data_protection: v.object({
+            status: v.union(v.literal("none"), v.literal("note"), v.literal("concern")),
+            summary: v.string(),
+            highestSeverity: v.optional(v.string()),
+          }),
+        }),
+      ),
       model: v.optional(v.string()),
       checkedAt: v.number(),
     }),
@@ -4859,6 +4974,8 @@ export const updateVersionLlmAnalysisInternal = internalMutation({
     if (!version) return;
     const nextVersion = { ...version, llmAnalysis: args.llmAnalysis };
     await ctx.db.patch(args.versionId, { llmAnalysis: args.llmAnalysis });
+    if (args.moderationMode === "preserve") return;
+
     await finalizeInProgressRescanRequestsForTarget(
       ctx,
       { kind: "skill", artifactId: version._id },

convex/statsMaintenance.ts

@@ -3,11 +3,7 @@ import { internal } from "./_generated/api";
 import type { Doc } from "./_generated/dataModel";
 import type { ActionCtx } from "./_generated/server";
 import { internalAction, internalMutation, internalQuery } from "./functions";
-import {
-  countPublicSkillsForGlobalStats,
-  isPublicSkillDoc,
-  setGlobalPublicSkillsCount,
-} from "./lib/globalStats";
+import { isPublicSkillDoc, setGlobalPublicSkillsCount } from "./lib/globalStats";
 
 const DEFAULT_BATCH_SIZE = 200;
 const MAX_BATCH_SIZE = 1000;
@@ -189,8 +185,7 @@ function buildSkillStatPatch(skill: Doc<"skills">) {
   // nested `stats` object only for documents that pre-date the migration.
   const nextDownloads =
     typeof skill.statsDownloads === "number" ? skill.statsDownloads : stats.downloads;
-  const nextStars =
-    typeof skill.statsStars === "number" ? skill.statsStars : stats.stars;
+  const nextStars = typeof skill.statsStars === "number" ? skill.statsStars : stats.stars;
   const nextInstallsCurrent =
     typeof skill.statsInstallsCurrent === "number"
       ? skill.statsInstallsCurrent
@@ -279,7 +274,9 @@ export async function reconcileSkillStarCountsHandler(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       .withIndex("by_skill", (q: any) => q.eq("skillId", skill._id))
       .collect();
-    const actualComments = commentRecords.filter((c: { softDeletedAt?: unknown }) => !c.softDeletedAt).length;
+    const actualComments = commentRecords.filter(
+      (c: { softDeletedAt?: unknown }) => !c.softDeletedAt,
+    ).length;
 
     // Check if stats are out of sync (compare against the canonical value
     // used by toPublicSkill: prefer top-level field, fall back to nested).
@@ -415,15 +412,3 @@ export const updateGlobalStatsAction = internalAction({
     return { count: total };
   },
 });
-
-/**
- * @deprecated Use updateGlobalStatsAction instead.
- * Kept as a manual emergency fallback only — do not re-add to crons.
- */
-export const updateGlobalStatsInternal = internalMutation({
-  args: {},
-  handler: async (ctx) => {
-    const count = await countPublicSkillsForGlobalStats(ctx);
-    await setGlobalPublicSkillsCount(ctx, count);
-  },
-});

convex/tsconfig.json

@@ -9,6 +9,7 @@
     "strict": true,
     "moduleResolution": "Bundler",
     "jsx": "react-jsx",
+    "types": ["node"],
     "skipLibCheck": true,
     "allowSyntheticDefaultImports": true,
 

convex/users.ts

@@ -394,12 +394,11 @@ export const list = query({
 });
 
 export const listPublic = query({
-  args: { limit: v.optional(v.number()), search: v.optional(v.string()) },
+  args: { limit: v.optional(v.number()) },
   handler: async (ctx, args) => {
     const limit = clampInt(args.limit ?? 40, 1, 100);
     const result = await queryUsersForPublicList(ctx, {
       limit,
-      search: args.search,
     });
     return {
       items: result.items

convex/vt.test.ts

@@ -1,7 +1,12 @@
 /* @vitest-environment node */
 
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { __test, pollPackageReleaseScanResults, scanPackageReleaseWithVirusTotal } from "./vt";
+import {
+  __test,
+  fetchResults,
+  pollPackageReleaseScanResults,
+  scanPackageReleaseWithVirusTotal,
+} from "./vt";
 
 type WrappedHandler<TArgs, TResult> = {
   _handler: (ctx: unknown, args: TArgs) => Promise<TResult>;
@@ -21,6 +26,13 @@ const pollPackageReleaseScanResultsHandler = (
   >
 )._handler;
 
+const fetchResultsHandler = (
+  fetchResults as unknown as WrappedHandler<
+    { sha256hash?: string },
+    { status: string; message?: string; url?: string }
+  >
+)._handler;
+
 const originalVtApiKey = process.env.VT_API_KEY;
 
 afterEach(() => {
@@ -153,6 +165,48 @@ describe("vt AV engine fallback verdicts", () => {
   });
 });
 
+describe("vt result lookup", () => {
+  it("rejects non-SHA-256 lookup input before calling VirusTotal", async () => {
+    process.env.VT_API_KEY = "test-key";
+    const fetchMock = vi.fn();
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await fetchResultsHandler({} as never, { sha256hash: "../domains/google.com" });
+
+    expect(result).toEqual({ status: "error", message: "Invalid SHA-256 hash" });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("looks up only the intended VirusTotal file endpoint for valid hashes", async () => {
+    process.env.VT_API_KEY = "test-key";
+    const hash = "a".repeat(64);
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        data: {
+          attributes: {
+            last_analysis_stats: {
+              malicious: 0,
+              suspicious: 0,
+              harmless: 1,
+              undetected: 20,
+            },
+          },
+        },
+      }),
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await fetchResultsHandler({} as never, { sha256hash: hash });
+
+    expect(result.status).toBe("clean");
+    expect(fetchMock).toHaveBeenCalledWith(`https://www.virustotal.com/api/v3/files/${hash}`, {
+      method: "GET",
+      headers: { "x-apikey": "test-key" },
+    });
+  });
+});
+
 describe("package VT retries", () => {
   it("retries package scan when release files are not readable yet", async () => {
     process.env.VT_API_KEY = "test-key";

convex/vt.ts

@@ -2,9 +2,11 @@ import { v } from "convex/values";
 import { internal } from "./_generated/api";
 import type { Doc, Id } from "./_generated/dataModel";
 import type { ActionCtx } from "./_generated/server";
-import { action, internalAction, internalMutation } from "./functions";
+import { internalAction, internalMutation } from "./functions";
 import { buildDeterministicPackageZip, buildDeterministicZip } from "./lib/skillZip";
 
+const SHA256_HASH_PATTERN = /^[a-f0-9]{64}$/i;
+
 const internalRefs = internal as unknown as {
   packages: {
     getReleaseByIdInternal: unknown;
@@ -381,7 +383,7 @@ async function activateSkillWhenVtUnavailable(ctx: ActionCtx, skillId: Id<"skill
   await ctx.runMutation(internal.skills.setSkillModerationStatusActiveInternal, { skillId });
 }
 
-export const fetchResults = action({
+export const fetchResults = internalAction({
   args: {
     sha256hash: v.optional(v.string()),
   },
@@ -389,6 +391,9 @@ export const fetchResults = action({
     if (!args.sha256hash) {
       return { status: "not_found" };
     }
+    if (!SHA256_HASH_PATTERN.test(args.sha256hash)) {
+      return { status: "error", message: "Invalid SHA-256 hash" };
+    }
 
     const apiKey = process.env.VT_API_KEY;
     if (!apiKey) {

docs/api.md

@@ -75,7 +75,7 @@ Public read:
   - Optional filters: `highlightedOnly=true`, `nonSuspiciousOnly=true`
   - Legacy alias: `nonSuspicious=true`
 - `GET /api/v1/skills?limit=&cursor=&sort=`
-  - `sort`: `updated` (default), `downloads`, `stars` (`rating`), `installsCurrent` (`installs`), `installsAllTime`, `trending`
+  - `sort`: `updated` (default), `createdAt` (`newest`), `downloads`, `stars` (`rating`), `installsCurrent` (`installs`), `installsAllTime`, `trending`
   - `cursor` applies to non-`trending` sorts
   - Optional filter: `nonSuspiciousOnly=true`
   - Legacy alias: `nonSuspicious=true`

docs/cli.md

@@ -87,13 +87,16 @@ Stores your API token + cached registry URL.
 ### `search <query...>`
 
 - Calls `/api/v1/search?q=...`.
+- Search favors exact slug/name token matches before download popularity. A standalone slug token such as `map` matches `personal-map` more strongly than the substring inside `amap`.
+- Downloads are a small popularity prior, not a guarantee of top placement.
+- If a skill should appear but does not, run `clawhub inspect <slug>` while logged in to check owner-visible moderation diagnostics before renaming metadata.
 
 ### `explore`
 
-- Lists latest updated skills via `/api/v1/skills?limit=...` (sorted by `updatedAt` desc).
+- Lists newest skills via `/api/v1/skills?limit=...&sort=createdAt` (sorted by `createdAt` desc).
 - Flags:
   - `--limit <n>` (1-200, default: 25)
-  - `--sort newest|downloads|rating|installs|installsAllTime|trending` (default: newest)
+  - `--sort newest|updated|downloads|rating|installs|installsAllTime|trending` (default: newest)
   - `--json` (machine-readable output)
 - Output: `<slug>  v<version>  <age>  <summary>` (summary truncated to 50 chars).
 
@@ -205,6 +208,15 @@ Stores your API token + cached registry URL.
 - `--reason` records an optional ban reason.
 - `--yes` skips confirmation.
 
+### `unban-user <handleOrId>`
+
+- Unban a user and restore eligible skills (admin only).
+- Calls `POST /api/v1/users/unban`.
+- `--id` treats the argument as a user id instead of a handle.
+- `--fuzzy` resolves the handle via fuzzy user search (admin only).
+- `--reason` records an optional unban reason.
+- `--yes` skips confirmation.
+
 ### `set-role <handleOrId> <role>`
 
 - Change a user role (admin only).
@@ -329,7 +341,7 @@ on:
 jobs:
   dry-run:
     if: github.event_name == 'pull_request'
-    uses: openclaw/clawhub/.github/workflows/package-publish.yml@main
+    uses: openclaw/clawhub/.github/workflows/package-publish.yml@v0.12.0
     with:
       dry_run: true
 
@@ -338,7 +350,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: openclaw/clawhub/.github/workflows/package-publish.yml@main
+    uses: openclaw/clawhub/.github/workflows/package-publish.yml@v0.12.0
     with:
       dry_run: false
     secrets:
@@ -348,6 +360,7 @@ jobs:
 Notes:
 
 - The reusable workflow defaults `source` to the caller repo.
+- Pin the reusable workflow to a stable tag or full commit SHA. Do not run release publishing from `@main`.
 - `pull_request` should use `dry_run: true` so CI stays non-polluting.
 - Real publishes should be limited to trusted events such as `workflow_dispatch` or tag pushes.
 - Trusted publishing without a secret only works on `workflow_dispatch`; tag pushes still need `clawhub_token`.

docs/deploy.md

@@ -167,4 +167,5 @@ Proxy/IP caveat:
 
 - Default IP source is `cf-connecting-ip`.
 - For non-Cloudflare trusted proxy setups, set `TRUST_FORWARDED_IPS=true`.
+- If a trusted client IP is missing, anonymous downloads fall back to endpoint-scoped buckets to avoid unrelated packages sharing one `ip:unknown` download bucket.
 - If proxy headers are not forwarded/trusted correctly, multiple users may collapse into one IP and hit false-positive rate limits.

docs/http-api.md

@@ -67,6 +67,7 @@ IP source:
 
 - Uses `cf-connecting-ip` (Cloudflare) for client IP by default.
 - Set `TRUST_FORWARDED_IPS=true` to opt in to `x-forwarded-for`, `x-real-ip`, or `fly-client-ip` (non-Cloudflare deployments).
+- If no trusted client IP is available, anonymous download requests use an endpoint-scoped fallback bucket instead of one global `ip:unknown` bucket. Anonymous read/write requests still use the shared unknown bucket so missing-IP deployments remain visible and conservative.
 - If you run behind a reverse proxy/load balancer, ensure real client IP headers are preserved and trusted correctly, or rate limits may be too strict due to shared proxy IPs.
 
 ## Public endpoints (no auth)
@@ -101,6 +102,17 @@ Response:
 Notes:
 
 - Results are returned in relevance order (embedding similarity + exact slug/name token boosts + popularity prior from downloads).
+- Relevance is stronger than popularity. A precise slug or display-name token match can outrank a looser match with many more downloads.
+- ASCII text is tokenized on word and punctuation boundaries. For example, `personal-map` contains a standalone `map` token, while `amap-jsapi-skill` contains `amap`, `jsapi`, and `skill`; searching for `map` therefore gives `personal-map` a stronger lexical match than `amap-jsapi-skill`.
+- Downloads are used as a small log-scaled prior and tie-breaker, not as the primary ranking signal. High-download skills can rank lower when the query text is a weaker match.
+- Suspicious or hidden moderation state can remove a skill from public search depending on caller filters and current moderation status.
+
+Publisher discoverability guidance:
+
+- Put the terms users will literally search for in the display name, summary, and tags. Use a standalone slug token only when it is also a stable identity you want to keep.
+- Do not rename a slug just to chase one query unless the new slug is a better long-term canonical name. Old slugs become redirect aliases, but the canonical URL, displayed slug, and future search digests use the new slug.
+- Rename aliases preserve resolution for old URLs and installs that resolve through the registry, but search ranking is based on the canonical skill metadata after the rename has indexed. Existing stats stay with the skill.
+- If a skill is unexpectedly invisible, check moderation state first with `clawhub inspect <slug>` while logged in before changing ranking-related metadata.
 
 ### `GET /api/v1/skills`
 
@@ -108,13 +120,14 @@ Query params:
 
 - `limit` (optional): integer (1–200)
 - `cursor` (optional): pagination cursor for any non-`trending` sort
-- `sort` (optional): `updated` (default), `downloads`, `stars` (alias: `rating`), `installsCurrent` (alias: `installs`), `installsAllTime`, `trending`
+- `sort` (optional): `updated` (default), `createdAt` (alias: `newest`), `downloads`, `stars` (alias: `rating`), `installsCurrent` (alias: `installs`), `installsAllTime`, `trending`
 - `nonSuspiciousOnly` (optional): `true` to hide suspicious (`flagged.suspicious`) skills
 - `nonSuspicious` (optional): legacy alias for `nonSuspiciousOnly`
 
 Notes:
 
 - `trending` ranks by installs in the last 7 days (telemetry-based).
+- `createdAt` is stable for new-skill crawls; `updated` changes when existing skills are republished.
 - When `nonSuspiciousOnly=true`, cursor-based sorts may return fewer than `limit` items on a page because suspicious skills are filtered after page retrieval.
 - Use `nextCursor` to continue pagination when present. A short page does not by itself mean end-of-results.
 
@@ -515,6 +528,28 @@ Response:
 { "ok": true, "alreadyBanned": false, "deletedSkills": 3 }
 ```
 
+### `POST /api/v1/users/unban`
+
+Unban a user and restore eligible skills (admin only).
+
+Body:
+
+```json
+{ "handle": "user_handle", "reason": "optional unban reason" }
+```
+
+or
+
+```json
+{ "userId": "users_...", "reason": "optional unban reason" }
+```
+
+Response:
+
+```json
+{ "ok": true, "alreadyUnbanned": false, "restoredSkills": 3 }
+```
+
 ### `POST /api/v1/users/role`
 
 Change a user role (admin only).

docs/regression-notes/2026-04-29-hero-slot-easter-egg.md

@@ -0,0 +1,22 @@
+# Hero Slot Easter Egg Regression Note
+
+Date: 2026-04-29
+
+The homepage hero easter egg was originally added in commit `91c7e44` by Val Alexander on 2026-04-18 as `feat: slot machine Easter egg on hero label triple-click`.
+
+Follow-up behavior changes:
+
+- `cb75011` by Val Alexander on 2026-04-18 tuned odds to 1/25 for any jackpot and 1/100 for the Hack jackpot.
+- `fec5db7` by Val Alexander on 2026-04-18 added timer and interval cleanup on unmount.
+
+The easter egg was removed from `src/routes/index.tsx` in commit `6c0163f` by Patrick Erichsen on 2026-04-28 as part of `feat: add skills plugins search typeahead`.
+
+Expected behavior:
+
+- Triple-click `BUILT BY THE COMMUNITY.` within 800ms to trigger the slot-machine headline.
+- Reels stop at 1200ms, 1800ms, and 2400ms.
+- Non-jackpot spins reroll accidental triples so jackpot odds stay controlled.
+- Jackpot odds are 1/25 overall.
+- Hack jackpot odds are 1/100 overall.
+- Wins fire confetti; Hack wins use the aquatic Hack-specific effect.
+- Wins display for 10s and cool down for 18s; losses display for 2.4s and cool down for 3s.

docs/regression-notes/2026-04-29-ui-design-contract.md

@@ -0,0 +1,15 @@
+# UI Design Contract Regression Guard
+
+Date: 2026-04-29
+
+The restored ClawHub public UI has strict regression guards in `src/__tests__/ui-design-contract.test.ts`.
+
+Protected fundamentals:
+
+- Two-row header: brand, full-width desktop search, rectangular theme mode control, auth action, then content nav with `Skills`, `Plugins`, `Users`, and `About`.
+- Compact header: menu button, inline search, GitHub action, and visible content nav row.
+- Home hero: `BUILT BY THE COMMUNITY.`, `Tools built by thousands, ready in one search.`, search focus border behavior, slot-machine easter egg support, featured carousel, category grid breakpoints, and `Trending Now`.
+- Footer: restored four public sections and mobile section toggles.
+- Visual settings: no tweakcn overlay, custom-theme file, relaxed/compact density controls, or other nonfunctional visual preferences.
+
+Intentional changes to these fundamentals must update the design-contract test and this note in the same PR. A removal without a matching contract update should be treated as an accidental regression.

docs/skill-format.md

@@ -68,23 +68,26 @@ metadata:
 ---
 ```
 
+Use `requires.env` for environment variables that must be present before the skill can run. Use `envVars` when you need per-variable metadata, including optional variables with `required: false`.
+
 ### Full field reference
 
-| Field              | Type       | Description                                                     |
-| ------------------ | ---------- | --------------------------------------------------------------- |
-| `requires.env`     | `string[]` | Environment variables your skill expects.                       |
-| `requires.bins`    | `string[]` | CLI binaries that must all be installed.                        |
-| `requires.anyBins` | `string[]` | CLI binaries where at least one must exist.                     |
-| `requires.config`  | `string[]` | Config file paths your skill reads.                             |
-| `primaryEnv`       | `string`   | The main credential env var for your skill.                     |
-| `always`           | `boolean`  | If `true`, skill is always active (no explicit install needed). |
-| `skillKey`         | `string`   | Override the skill's invocation key.                            |
-| `emoji`            | `string`   | Display emoji for the skill.                                    |
-| `homepage`         | `string`   | URL to the skill's homepage or docs.                            |
-| `os`               | `string[]` | OS restrictions (e.g. `["macos"]`, `["linux"]`).                |
-| `install`          | `array`    | Install specs for dependencies (see below).                     |
-| `nix`              | `object`   | Nix plugin spec (see README).                                   |
-| `config`           | `object`   | Clawdbot config spec (see README).                              |
+| Field              | Type       | Description                                                                                                                                  |
+| ------------------ | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| `requires.env`     | `string[]` | Required environment variables your skill expects.                                                                                           |
+| `requires.bins`    | `string[]` | CLI binaries that must all be installed.                                                                                                     |
+| `requires.anyBins` | `string[]` | CLI binaries where at least one must exist.                                                                                                  |
+| `requires.config`  | `string[]` | Config file paths your skill reads.                                                                                                          |
+| `primaryEnv`       | `string`   | The main credential env var for your skill.                                                                                                  |
+| `envVars`          | `array`    | Environment variable declarations with `name`, optional `required`, and optional `description`. Set `required: false` for optional env vars. |
+| `always`           | `boolean`  | If `true`, skill is always active (no explicit install needed).                                                                              |
+| `skillKey`         | `string`   | Override the skill's invocation key.                                                                                                         |
+| `emoji`            | `string`   | Display emoji for the skill.                                                                                                                 |
+| `homepage`         | `string`   | URL to the skill's homepage or docs.                                                                                                         |
+| `os`               | `string[]` | OS restrictions (e.g. `["macos"]`, `["linux"]`).                                                                                             |
+| `install`          | `array`    | Install specs for dependencies (see below).                                                                                                  |
+| `nix`              | `object`   | Nix plugin spec (see README).                                                                                                                |
+| `config`           | `object`   | Clawdbot config spec (see README).                                                                                                           |
 
 ### Install specs
 
@@ -104,9 +107,26 @@ metadata:
 
 Supported install kinds: `brew`, `node`, `go`, `uv`.
 
+### Optional environment variables
+
+Declare optional environment variables under `metadata.openclaw.envVars` and set `required: false`. Do not add optional entries to `requires.env`, because `requires.env` means the skill cannot run without them.
+
+```yaml
+metadata:
+  openclaw:
+    primaryEnv: TODOIST_API_KEY
+    envVars:
+      - name: TODOIST_API_KEY
+        required: true
+        description: Todoist API token used for authenticated requests.
+      - name: TODOIST_PROJECT_ID
+        required: false
+        description: Optional default project ID when the user does not specify one.
+```
+
 ### Why this matters
 
-ClawHub's security analysis checks that what your skill declares matches what it actually does. If your code references `TODOIST_API_KEY` but your frontmatter doesn't declare it under `requires.env`, the analysis will flag a metadata mismatch. Keeping declarations accurate helps your skill pass review and helps users understand what they're installing.
+ClawHub's security analysis checks that what your skill declares matches what it actually does. If your code references `TODOIST_API_KEY` but your frontmatter doesn't declare it under `requires.env`, `primaryEnv`, or `envVars`, the analysis will flag a metadata mismatch. Keeping declarations accurate helps your skill pass review and helps users understand what they're installing.
 
 ### Example: complete frontmatter
 
@@ -123,6 +143,13 @@ metadata:
       bins:
         - curl
     primaryEnv: TODOIST_API_KEY
+    envVars:
+      - name: TODOIST_API_KEY
+        required: true
+        description: Todoist API token.
+      - name: TODOIST_PROJECT_ID
+        required: false
+        description: Optional default project ID.
     emoji: "\u2705"
     homepage: https://github.com/example/todoist-cli
 ---
@@ -161,4 +188,4 @@ Limits (server-side):
 
 - ClawHub does not support paid skills, per-skill pricing, paywalls, or revenue sharing.
 - Do not add pricing metadata to `SKILL.md`; it is not part of the skill format and will not make a published skill paid.
-- If your skill integrates with a paid third-party service, document the external cost and required account clearly in the skill instructions and `requires.env`.
+- If your skill integrates with a paid third-party service, document the external cost and required account clearly in the skill instructions and env declarations (`requires.env` for required variables, or `envVars` with `required: false` for optional variables).

docs/troubleshooting.md

@@ -27,6 +27,7 @@ read_when:
 - The CLI now includes retry hints in 429 errors (retry delay + remaining budget).
 - If many users share one egress IP (NAT/proxy), IP limit can be hit even with valid tokens.
 - For non-Cloudflare deploys behind trusted proxies, set `TRUST_FORWARDED_IPS=true` so forwarded client IPs can be used.
+- If no trusted client IP reaches ClawHub, anonymous downloads use endpoint-scoped fallback buckets, but search and write requests intentionally stay on the shared unknown-IP bucket until proxy headers are fixed.
 
 ## `search` / `install` fails with `fetch failed` behind a proxy
 

e2e/clawhub.e2e.test.ts

@@ -88,7 +88,7 @@ function shouldSeedRoleHelpTokens() {
 
 const itIfLiveMutations = allowLiveMutations() ? it : it.skip;
 const itIfAdminAndUserTokens =
-  getAdminToken() && getUserToken() || shouldSeedRoleHelpTokens() ? it : it.skip;
+  (getAdminToken() && getUserToken()) || shouldSeedRoleHelpTokens() ? it : it.skip;
 
 type RoleHelpTokens = {
   adminToken: string;
@@ -325,9 +325,11 @@ describe("clawhub e2e", () => {
 
       expect(adminResult.status).toBe(0);
       expect(adminResult.stdout).toContain("ban-user");
+      expect(adminResult.stdout).toContain("unban-user");
       expect(adminResult.stdout).toContain("set-role");
       expect(userResult.status).toBe(0);
       expect(userResult.stdout).not.toContain("ban-user");
+      expect(userResult.stdout).not.toContain("unban-user");
       expect(userResult.stdout).not.toContain("set-role");
     } finally {
       await rm(adminCfg.dir, { recursive: true, force: true });

e2e/prod-http-smoke.e2e.test.ts

@@ -4,6 +4,8 @@ import { Agent, setGlobalDispatcher } from "undici";
 import { describe, expect, it } from "vitest";
 
 const REQUEST_TIMEOUT_MS = 15_000;
+const MAX_RATE_LIMIT_RETRIES = 3;
+const MAX_RATE_LIMIT_WAIT_MS = 15_000;
 
 try {
   setGlobalDispatcher(
@@ -39,8 +41,40 @@ async function fetchWithTimeout(input: RequestInfo | URL, init?: RequestInit) {
   }
 }
 
+function parsePositiveNumber(value: string | null) {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+}
+
+function getRetryDelayMs(response: Response) {
+  const retryAfterSeconds = parsePositiveNumber(response.headers.get("Retry-After"));
+  if (retryAfterSeconds !== null) {
+    return Math.min(retryAfterSeconds * 1000, MAX_RATE_LIMIT_WAIT_MS);
+  }
+
+  const relativeResetSeconds = parsePositiveNumber(response.headers.get("RateLimit-Reset"));
+  if (relativeResetSeconds !== null) {
+    return Math.min(relativeResetSeconds * 1000, MAX_RATE_LIMIT_WAIT_MS);
+  }
+
+  const absoluteResetSeconds = parsePositiveNumber(response.headers.get("X-RateLimit-Reset"));
+  if (absoluteResetSeconds !== null) {
+    return Math.min(Math.max(absoluteResetSeconds * 1000 - Date.now(), 0), MAX_RATE_LIMIT_WAIT_MS);
+  }
+
+  return 1000;
+}
+
+async function fetchWithRetry(input: RequestInfo | URL, init?: RequestInit) {
+  for (let attempt = 1; ; attempt += 1) {
+    const response = await fetchWithTimeout(input, init);
+    if (response.status !== 429 || attempt >= MAX_RATE_LIMIT_RETRIES) return response;
+    await new Promise((resolve) => setTimeout(resolve, getRetryDelayMs(response)));
+  }
+}
+
 async function fetchHtml(pathname: string) {
-  const response = await fetchWithTimeout(new URL(pathname, getSiteBase()), {
+  const response = await fetchWithRetry(new URL(pathname, getSiteBase()), {
     headers: { Accept: "text/html" },
   });
   expect(response.ok).toBe(true);
@@ -48,19 +82,29 @@ async function fetchHtml(pathname: string) {
   return response.text();
 }
 
+type SkillDetailResponse = {
+  skill: { slug: string; displayName: string; summary: string | null };
+  latestVersion: { version: string | null } | null;
+  owner: { handle: string | null };
+};
+
+let skillDetailPromise: Promise<SkillDetailResponse> | null = null;
+
 async function fetchSkillDetail() {
-  const response = await fetchWithTimeout(
-    new URL(`/api/v1/skills/${getSkillSlug()}`, getSiteBase()),
-    {
-      headers: { Accept: "application/json" },
-    },
-  );
-  expect(response.ok).toBe(true);
-  return (await response.json()) as {
-    skill: { slug: string; displayName: string; summary: string | null };
-    latestVersion: { version: string | null } | null;
-    owner: { handle: string | null };
-  };
+  if (!skillDetailPromise) {
+    skillDetailPromise = (async () => {
+      const response = await fetchWithRetry(
+        new URL(`/api/v1/skills/${getSkillSlug()}`, getSiteBase()),
+        {
+          headers: { Accept: "application/json" },
+        },
+      );
+      expect(response.ok).toBe(true);
+      return (await response.json()) as SkillDetailResponse;
+    })();
+  }
+
+  return skillDetailPromise;
 }
 
 describe("prod http smoke", () => {
@@ -99,7 +143,7 @@ describe("prod http smoke", () => {
       params.set("version", detail.latestVersion.version);
     }
 
-    const response = await fetchWithTimeout(
+    const response = await fetchWithRetry(
       new URL(`/og/skill.png?${params.toString()}`, getSiteBase()),
     );
 

e2e/publish-entry-workflows.pw.test.ts

@@ -5,7 +5,8 @@ test("upload shows signed-out publish gate", async ({ page }) => {
   const errors = trackRuntimeErrors(page);
 
   await page.goto("/upload", { waitUntil: "domcontentloaded" });
-  await expect(page.getByText(/Sign in to upload a skill\./i)).toBeVisible();
+  await expect(page).toHaveURL(/\/publish-skill$/);
+  await expect(page.getByText("Sign in to publish a skill.")).toBeVisible();
   await expectHealthyPage(page, errors);
 });
 

package.json

@@ -12,9 +12,12 @@
     "check:secrets": "bun scripts/check-staged-secrets.mjs",
     "convex:deploy": "bunx convex deploy --typecheck=disable --yes",
     "coverage": "vitest run --coverage",
+    "dataset:snapshot": "bun scripts/security-dataset/export-snapshot.ts",
+    "dataset:snapshot:prod:dry-run": "bun scripts/security-dataset/export-snapshot.ts --prod --limit 10 --dry-run",
     "dev": "bun --bun vite dev --port 3000",
     "docs:list": "bun scripts/docs-list.ts",
     "format": "oxfmt --write",
+    "format:check": "oxfmt --check",
     "install:local-hooks": "bun scripts/install-git-hooks.mjs",
     "lint": "bun run lint:oxlint",
     "lint:fix": "oxlint --type-aware --tsconfig ./tsconfig.oxlint.json ./src ./convex ./packages/clawhub/src ./packages/schema/src --fix && bun run format",
@@ -27,12 +30,16 @@
     "test:e2e:local": "bash scripts/run-playwright-local.sh",
     "test:e2e:prod-http": "vitest run -c vitest.e2e.config.ts e2e/prod-http-smoke.e2e.test.ts",
     "test:pw": "playwright test",
+    "test:ui-contract": "vitest run src/__tests__/ui-design-contract.test.ts src/__tests__/header.test.tsx src/__tests__/home-route.test.tsx src/components/Footer.test.tsx src/lib/theme.test.tsx src/routes/-settings.test.tsx",
     "test:watch": "vitest",
+    "testbox:claim": "node scripts/blacksmith-testbox-runner.mjs --claim",
+    "testbox:run": "node scripts/blacksmith-testbox-runner.mjs",
+    "testbox:sanity": "node scripts/testbox-sync-sanity.mjs",
     "verify:convex-contract": "bun scripts/verify-convex-contract.ts"
   },
   "dependencies": {
     "@auth/core": "^0.37.4",
-    "@convex-dev/auth": "^0.0.91",
+    "@convex-dev/auth": "0.0.92",
     "@create-markdown/core": "^2.0.2",
     "@create-markdown/preview": "^2.0.2",
     "@fontsource/bricolage-grotesque": "^5.2.10",
@@ -58,27 +65,27 @@
     "@radix-ui/react-tooltip": "^1.2.8",
     "@resvg/resvg-wasm": "^2.6.2",
     "@shikijs/rehype": "^4.0.2",
-    "@tailwindcss/vite": "^4.2.2",
-    "@tanstack/react-devtools": "0.10.0",
-    "@tanstack/react-router": "1.168.1",
-    "@tanstack/react-router-devtools": "1.166.10",
-    "@tanstack/react-start": "1.167.2",
+    "@tailwindcss/vite": "^4.2.4",
+    "@tanstack/react-devtools": "0.10.2",
+    "@tanstack/react-router": "1.168.26",
+    "@tanstack/react-router-devtools": "1.166.13",
+    "@tanstack/react-start": "1.167.52",
     "@tanstack/react-table": "^8.21.3",
-    "@tanstack/router-plugin": "1.167.2",
+    "@tanstack/router-plugin": "1.167.29",
     "@vercel/analytics": "^2.0.1",
     "class-variance-authority": "^0.7.1",
     "clawhub-schema": "workspace:*",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
-    "convex": "^1.34.1",
-    "convex-helpers": "^0.1.114",
+    "convex": "^1.36.1",
+    "convex-helpers": "^0.1.115",
     "fflate": "^0.8.2",
-    "h3": "2.0.1-rc.18",
+    "h3": "2.0.1-rc.21",
     "ignore": "^7.0.5",
-    "lucide-react": "^0.577.0",
+    "lucide-react": "1.14.0",
     "monaco-editor": "^0.55.1",
     "next-themes": "^0.4.6",
-    "nitro": "3.0.260311-beta",
+    "nitro": "3.0.260429-beta",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "react-markdown": "^10.1.0",
@@ -89,12 +96,12 @@
     "shiki": "^4.0.2",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.5.0",
-    "tailwindcss": "^4.2.2",
+    "tailwindcss": "^4.2.4",
     "tw-animate-css": "^1.4.0",
     "unist-util-visit": "^5.1.0",
     "vite-tsconfig-paths": "^6.1.1",
     "yaml": "^2.8.3",
-    "zod": "^4.3.6"
+    "zod": "^4.4.1"
   },
   "devDependencies": {
     "@playwright/test": "^1.59.1",
@@ -106,15 +113,19 @@
     "@types/react-dom": "^19.2.3",
     "@types/semver": "^7.7.1",
     "@vitejs/plugin-react": "6.0.1",
-    "@vitest/coverage-v8": "^4.1.2",
-    "jsdom": "^29.0.1",
+    "@vitest/coverage-v8": "^4.1.5",
+    "jsdom": "^29.1.0",
     "only-allow": "^1.2.2",
-    "oxfmt": "0.41.0",
-    "oxlint": "^1.58.0",
-    "oxlint-tsgolint": "^0.17.4",
-    "typescript": "^5.9.3",
-    "undici": "^7.24.7",
-    "vite": "8.0.5",
-    "vitest": "^4.1.2"
+    "oxfmt": "0.47.0",
+    "oxlint": "^1.62.0",
+    "oxlint-tsgolint": "0.22.1",
+    "typescript": "6.0.3",
+    "undici": "7.25.0",
+    "vite": "8.0.10",
+    "vitest": "^4.1.5"
+  },
+  "overrides": {
+    "dompurify": "3.4.1",
+    "postcss": "8.5.12"
   }
 }

packages/clawhub/package.json

@@ -1,59 +1,59 @@
 {
-  "name": "clawhub",
-  "version": "0.11.0",
-  "description": "ClawHub CLI \\u2014 install, update, search, and publish skills plus OpenClaw packages.",
-  "homepage": "https://clawhub.ai",
-  "bugs": {
-    "url": "https://github.com/openclaw/clawhub/issues"
-  },
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/openclaw/clawhub.git",
-    "directory": "packages/clawhub"
-  },
-  "bin": {
-    "clawdhub": "bin/clawdhub.js",
-    "clawhub": "bin/clawdhub.js"
-  },
-  "files": [
-    "bin",
-    "dist",
-    "README.md",
-    "LICENSE"
-  ],
-  "type": "module",
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "build": "node ./scripts/build.mjs",
-    "dev": "node --enable-source-maps dist/cli.js",
-    "prepublishOnly": "npm run build",
-    "test": "bun run test:src",
-    "test:artifact": "bun run build && vitest run -c vitest.artifact.config.ts",
-    "test:src": "vitest run -c vitest.config.ts",
-    "verify": "bun run test:src && bun run verify:build && bun run test:artifact",
-    "verify:build": "tsc -p tsconfig.json --noEmit"
-  },
-  "dependencies": {
-    "@clack/prompts": "^1.1.0",
-    "arktype": "^2.2.0",
-    "commander": "^14.0.3",
-    "fflate": "^0.8.2",
-    "ignore": "^7.0.5",
-    "json5": "^2.2.3",
-    "mime": "^4.1.0",
-    "ora": "^9.3.0",
-    "p-retry": "^7.1.1",
-    "semver": "^7.7.4",
-    "undici": "^7.24.0"
-  },
-  "devDependencies": {
-    "@types/node": "^25.5.0",
-    "typescript": "^5.9.3"
-  },
-  "engines": {
-    "node": ">=20"
-  }
+	"name": "clawhub",
+	"version": "0.12.0",
+	"description": "ClawHub CLI \\u2014 install, update, search, and publish skills plus OpenClaw packages.",
+	"homepage": "https://clawhub.ai",
+	"bugs": {
+		"url": "https://github.com/openclaw/clawhub/issues"
+	},
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/openclaw/clawhub.git",
+		"directory": "packages/clawhub"
+	},
+	"bin": {
+		"clawdhub": "bin/clawdhub.js",
+		"clawhub": "bin/clawdhub.js"
+	},
+	"files": [
+		"bin",
+		"dist",
+		"README.md",
+		"LICENSE"
+	],
+	"type": "module",
+	"publishConfig": {
+		"access": "public"
+	},
+	"scripts": {
+		"build": "node ./scripts/build.mjs",
+		"dev": "node --enable-source-maps dist/cli.js",
+		"prepublishOnly": "npm run build",
+		"test": "bun run test:src",
+		"test:artifact": "bun run build && vitest run -c vitest.artifact.config.ts",
+		"test:src": "vitest run -c vitest.config.ts",
+		"verify": "bun run test:src && bun run verify:build && bun run test:artifact",
+		"verify:build": "tsc -p tsconfig.json --noEmit"
+	},
+	"dependencies": {
+		"@clack/prompts": "^1.3.0",
+		"arktype": "^2.2.0",
+		"commander": "^14.0.3",
+		"fflate": "^0.8.2",
+		"ignore": "^7.0.5",
+		"json5": "^2.2.3",
+		"mime": "^4.1.0",
+		"ora": "^9.4.0",
+		"p-retry": "8.0.0",
+		"semver": "^7.7.4",
+		"undici": "7.25.0"
+	},
+	"devDependencies": {
+		"@types/node": "^25.5.0",
+		"typescript": "6.0.3"
+	},
+	"engines": {
+		"node": ">=20"
+	}
 }

packages/clawhub/src/cli.ts

@@ -13,7 +13,7 @@ import {
   cmdUnhideSkill,
 } from "./cli/commands/delete.js";
 import { cmdInspect } from "./cli/commands/inspect.js";
-import { cmdBanUser, cmdSetRole } from "./cli/commands/moderation.js";
+import { cmdBanUser, cmdSetRole, cmdUnbanUser } from "./cli/commands/moderation.js";
 import { cmdMergeSkill, cmdRenameSkill } from "./cli/commands/ownership.js";
 import {
   cmdExplorePackages,
@@ -238,7 +238,7 @@ program
 
 program
   .command("list")
-  .description("List installed skills (from lockfile)")
+  .description("List installed skills (tracked and manually installed)")
   .action(async () => {
     const opts = await resolveGlobalOpts();
     await cmdList(opts);
@@ -513,6 +513,19 @@ program
     await cmdBanUser(opts, handleOrId, options, isInputAllowed());
   });
 
+program
+  .command("unban-user", adminCommandOptions)
+  .description("Unban a user and restore eligible skills (admin only)")
+  .argument("<handleOrId>", "User handle (default) or user id")
+  .option("--id", "Treat argument as user id")
+  .option("--fuzzy", "Resolve handle via fuzzy user search (admin only)")
+  .option("--reason <reason>", "Unban reason (optional)")
+  .option("--yes", "Skip confirmation")
+  .action(async (handleOrId, options) => {
+    const opts = await resolveGlobalOpts();
+    await cmdUnbanUser(opts, handleOrId, options, isInputAllowed());
+  });
+
 program
   .command("set-role", adminCommandOptions)
   .description("Change a user role (admin only)")

packages/clawhub/src/cli/commands/inspect.test.ts

@@ -132,6 +132,156 @@ describe("cmdInspect", () => {
     expect(mockLog).toHaveBeenCalledWith("Model: gpt-5.2");
   });
 
+  it("prints skill moderation status without requiring a version fetch", async () => {
+    httpMocks.apiRequest.mockResolvedValueOnce({
+      skill: {
+        slug: "demo",
+        displayName: "Demo",
+        summary: null,
+        tags: { latest: "2.0.0" },
+        stats: {},
+        createdAt: 1,
+        updatedAt: 2,
+      },
+      latestVersion: { version: "2.0.0", createdAt: 3, changelog: "init", license: "MIT-0" },
+      owner: null,
+      moderation: {
+        isSuspicious: true,
+        isMalwareBlocked: false,
+        verdict: "suspicious",
+        reasonCodes: ["network-send", "credential-pattern"],
+        updatedAt: 1_700_000_000_000,
+        engineVersion: "scanner-v2",
+        summary: "Found credential-like configuration and outbound network behavior.",
+      },
+    });
+
+    await cmdInspect(makeGlobalOpts(), "demo");
+
+    expect(httpMocks.apiRequest).toHaveBeenCalledTimes(1);
+    expect(mockLog).toHaveBeenCalledWith("Moderation: SUSPICIOUS");
+    expect(mockLog).toHaveBeenCalledWith("Reasons: network-send, credential-pattern");
+    expect(mockLog).toHaveBeenCalledWith("Moderation Updated: 2023-11-14T22:13:20.000Z");
+    expect(mockLog).toHaveBeenCalledWith("Moderation Engine: scanner-v2");
+    expect(mockLog).toHaveBeenCalledWith(
+      "Moderation Summary: Found credential-like configuration and outbound network behavior.",
+    );
+  });
+
+  it("fetches owner moderation diagnostics when authenticated", async () => {
+    authTokenMocks.getOptionalAuthToken.mockResolvedValueOnce("tkn");
+    httpMocks.apiRequest
+      .mockResolvedValueOnce({
+        skill: {
+          slug: "demo",
+          displayName: "Demo",
+          summary: null,
+          tags: { latest: "2.0.0" },
+          stats: {},
+          createdAt: 1,
+          updatedAt: 2,
+        },
+        latestVersion: { version: "2.0.0", createdAt: 3, changelog: "init", license: "MIT-0" },
+        owner: null,
+        moderation: null,
+      })
+      .mockResolvedValueOnce({
+        moderation: {
+          isSuspicious: true,
+          isMalwareBlocked: false,
+          verdict: "suspicious",
+          reasonCodes: ["suspicious.dynamic_code_execution"],
+          updatedAt: 1_700_000_000_000,
+          engineVersion: "scanner-v2",
+          summary: "Detected dynamic code execution.",
+          legacyReason: "quality.low",
+          evidence: [],
+        },
+      });
+
+    await cmdInspect(makeGlobalOpts(), "demo");
+
+    expect(httpMocks.apiRequest).toHaveBeenCalledTimes(2);
+    expect(httpMocks.apiRequest.mock.calls[1]?.[1]).toMatchObject({
+      method: "GET",
+      path: `${ApiRoutes.skills}/${encodeURIComponent("demo")}/moderation`,
+      token: "tkn",
+    });
+    expect(mockLog).toHaveBeenCalledWith("Moderation: SUSPICIOUS");
+    expect(mockLog).toHaveBeenCalledWith("Reasons: suspicious.dynamic_code_execution");
+    expect(mockLog).toHaveBeenCalledWith("Moderation Reason: quality.low");
+    expect(mockLog).toHaveBeenCalledWith(
+      "Visibility Guidance: publish a substantive update that passes quality assessment, then re-run inspect.",
+    );
+  });
+
+  it("prints owner moderation diagnostics when public detail is hidden", async () => {
+    authTokenMocks.getOptionalAuthToken.mockResolvedValueOnce("tkn");
+    httpMocks.apiRequest
+      .mockRejectedValueOnce(new Error("Skill is hidden by quality checks."))
+      .mockResolvedValueOnce({
+        moderation: {
+          isSuspicious: true,
+          isMalwareBlocked: false,
+          verdict: "suspicious",
+          reasonCodes: [],
+          updatedAt: null,
+          engineVersion: null,
+          summary: null,
+          legacyReason: "quality.low",
+          evidence: [],
+        },
+      });
+
+    await cmdInspect(makeGlobalOpts(), "demo");
+
+    expect(httpMocks.apiRequest).toHaveBeenCalledTimes(2);
+    expect(mockLog).toHaveBeenCalledWith("demo is not publicly visible.");
+    expect(mockLog).toHaveBeenCalledWith("Detail: Skill is hidden by quality checks.");
+    expect(mockLog).toHaveBeenCalledWith("Moderation Reason: quality.low");
+    expect(mockLog).toHaveBeenCalledWith(
+      "Visibility Guidance: publish a substantive update that passes quality assessment, then re-run inspect.",
+    );
+  });
+
+  it("includes moderation metadata in inspect JSON output", async () => {
+    httpMocks.apiRequest.mockResolvedValueOnce({
+      skill: {
+        slug: "demo",
+        displayName: "Demo",
+        summary: null,
+        tags: {},
+        stats: {},
+        createdAt: 1,
+        updatedAt: 2,
+      },
+      latestVersion: null,
+      owner: null,
+      moderation: {
+        isSuspicious: false,
+        isMalwareBlocked: false,
+        verdict: "clean",
+        reasonCodes: [],
+        updatedAt: null,
+        engineVersion: null,
+        summary: null,
+      },
+    });
+
+    await cmdInspect(makeGlobalOpts(), "demo", { json: true });
+
+    const output = JSON.parse(String(mockLog.mock.calls[0]?.[0]));
+    expect(output.moderation).toEqual({
+      isSuspicious: false,
+      isMalwareBlocked: false,
+      verdict: "clean",
+      reasonCodes: [],
+      updatedAt: null,
+      engineVersion: null,
+      summary: null,
+    });
+  });
+
   it("rejects when both version and tag are provided", async () => {
     await expect(
       cmdInspect(makeGlobalOpts(), "demo", { version: "1.0.0", tag: "latest" }),

packages/clawhub/src/cli/commands/inspect.ts

@@ -3,6 +3,7 @@ import {
   ApiRoutes,
   PLATFORM_SKILL_LICENSE,
   PLATFORM_SKILL_LICENSE_SUMMARY,
+  ApiV1SkillModerationResponseSchema,
   ApiV1SkillResponseSchema,
   ApiV1SkillVersionListResponseSchema,
   ApiV1SkillVersionResponseSchema,
@@ -36,6 +37,21 @@ type SecurityStatus = {
   model: string | null;
 };
 
+type ModerationStatus = {
+  isSuspicious: boolean;
+  isMalwareBlocked: boolean;
+  verdict?: "clean" | "suspicious" | "malicious";
+  reasonCodes?: string[];
+  updatedAt?: number | null;
+  engineVersion?: string | null;
+  summary?: string | null;
+  legacyReason?: string | null;
+};
+
+type ModerationDiagnostics = {
+  moderation: unknown;
+} | null;
+
 export async function cmdInspect(opts: GlobalOpts, slug: string, options: InspectOptions = {}) {
   const trimmed = slug.trim();
   if (!trimmed) fail("Slug required");
@@ -45,17 +61,40 @@ export async function cmdInspect(opts: GlobalOpts, slug: string, options: Inspec
   const registry = await getRegistry(opts, { cache: true });
   const spinner = createSpinner("Fetching skill");
   try {
-    const skillResult = await apiRequest(
-      registry,
-      { method: "GET", path: `${ApiRoutes.skills}/${encodeURIComponent(trimmed)}`, token },
-      ApiV1SkillResponseSchema,
-    );
+    let skillResult: Awaited<ReturnType<typeof fetchSkillDetail>> | null = null;
+    let moderationDiagnostics: ModerationDiagnostics = null;
+    try {
+      skillResult = await fetchSkillDetail(registry, trimmed, token);
+    } catch (error) {
+      moderationDiagnostics = await fetchModerationDiagnostics(registry, trimmed, token);
+      if (moderationDiagnostics?.moderation) {
+        spinner.stop();
+        const output = {
+          skill: null,
+          latestVersion: null,
+          owner: null,
+          moderation: moderationDiagnostics.moderation,
+          version: null,
+          versions: null,
+          file: null,
+        };
+        if (options.json) {
+          console.log(JSON.stringify(output, null, 2));
+          return;
+        }
+        printHiddenSkillModeration(trimmed, moderationDiagnostics.moderation, formatError(error));
+        return;
+      }
+      throw error;
+    }
 
     if (!skillResult.skill) {
       spinner.fail("Skill not found");
       return;
     }
 
+    moderationDiagnostics = await fetchModerationDiagnostics(registry, trimmed, token);
+
     const skill = skillResult.skill;
     const tags = normalizeTags(skill.tags);
     const latestVersion = skillResult.latestVersion?.version ?? tags.latest ?? null;
@@ -121,6 +160,7 @@ export async function cmdInspect(opts: GlobalOpts, slug: string, options: Inspec
       skill: skillResult.skill,
       latestVersion: skillResult.latestVersion,
       owner: skillResult.owner,
+      moderation: moderationDiagnostics?.moderation ?? skillResult.moderation ?? null,
       version: versionResult?.version ?? null,
       versions: versionsList?.items ?? null,
       file: options.file ? { path: options.file, content: fileContent } : null,
@@ -140,6 +180,7 @@ export async function cmdInspect(opts: GlobalOpts, slug: string, options: Inspec
           (versionResult?.version as { license?: string | null } | undefined)?.license ?? null,
         owner: skillResult.owner,
       });
+      printModerationSummary(moderationDiagnostics?.moderation ?? skillResult.moderation ?? null);
     }
 
     if (shouldPrintMeta && versionResult?.version) {
@@ -183,6 +224,41 @@ export async function cmdInspect(opts: GlobalOpts, slug: string, options: Inspec
   }
 }
 
+function fetchSkillDetail(registry: string, slug: string, token: string | undefined) {
+  return apiRequest(
+    registry,
+    { method: "GET", path: `${ApiRoutes.skills}/${encodeURIComponent(slug)}`, token },
+    ApiV1SkillResponseSchema,
+  );
+}
+
+async function fetchModerationDiagnostics(
+  registry: string,
+  slug: string,
+  token: string | undefined,
+): Promise<ModerationDiagnostics> {
+  if (!token) return null;
+  try {
+    return await apiRequest(
+      registry,
+      {
+        method: "GET",
+        path: `${ApiRoutes.skills}/${encodeURIComponent(slug)}/moderation`,
+        token,
+      },
+      ApiV1SkillModerationResponseSchema,
+    );
+  } catch {
+    return null;
+  }
+}
+
+function printHiddenSkillModeration(slug: string, moderation: unknown, detailError: string) {
+  console.log(`${slug} is not publicly visible.`);
+  console.log(`Detail: ${detailError}`);
+  printModerationSummary(moderation);
+}
+
 function printSkillSummary(result: {
   skill: {
     slug: string;
@@ -236,6 +312,70 @@ function printVersionSummary(version: unknown) {
   }
 }
 
+function printModerationSummary(moderation: unknown) {
+  const status = normalizeModeration(moderation);
+  if (!status) return;
+  const label = status.isMalwareBlocked
+    ? "MALICIOUS"
+    : status.isSuspicious
+      ? "SUSPICIOUS"
+      : (status.verdict ?? "clean").toUpperCase();
+  console.log(`Moderation: ${label}`);
+  if (status.reasonCodes?.length) {
+    console.log(`Reasons: ${status.reasonCodes.join(", ")}`);
+  }
+  if (status.legacyReason) {
+    console.log(`Moderation Reason: ${status.legacyReason}`);
+  }
+  if (typeof status.updatedAt === "number") {
+    console.log(`Moderation Updated: ${formatTimestamp(status.updatedAt)}`);
+  }
+  if (status.engineVersion) {
+    console.log(`Moderation Engine: ${status.engineVersion}`);
+  }
+  if (status.summary) {
+    console.log(`Moderation Summary: ${truncate(status.summary, 160)}`);
+  }
+  if (status.legacyReason === "quality.low") {
+    console.log(
+      "Visibility Guidance: publish a substantive update that passes quality assessment, then re-run inspect.",
+    );
+  }
+}
+
+function normalizeModeration(moderation: unknown): ModerationStatus | null {
+  if (!moderation || typeof moderation !== "object") return null;
+  const value = moderation as {
+    isSuspicious?: unknown;
+    isMalwareBlocked?: unknown;
+    verdict?: unknown;
+    reasonCodes?: unknown;
+    updatedAt?: unknown;
+    engineVersion?: unknown;
+    summary?: unknown;
+    legacyReason?: unknown;
+  };
+  if (typeof value.isSuspicious !== "boolean") return null;
+  if (typeof value.isMalwareBlocked !== "boolean") return null;
+  const verdict =
+    value.verdict === "clean" || value.verdict === "suspicious" || value.verdict === "malicious"
+      ? value.verdict
+      : undefined;
+  const reasonCodes = Array.isArray(value.reasonCodes)
+    ? value.reasonCodes.filter((reason): reason is string => typeof reason === "string")
+    : undefined;
+  return {
+    isSuspicious: value.isSuspicious,
+    isMalwareBlocked: value.isMalwareBlocked,
+    verdict,
+    reasonCodes,
+    updatedAt: typeof value.updatedAt === "number" ? value.updatedAt : null,
+    engineVersion: typeof value.engineVersion === "string" ? value.engineVersion : null,
+    summary: typeof value.summary === "string" && value.summary.trim() ? value.summary : null,
+    legacyReason: typeof value.legacyReason === "string" ? value.legacyReason : null,
+  };
+}
+
 function normalizeTags(tags: unknown): Record<string, string> {
   if (!tags || typeof tags !== "object") return {};
   const entries = Object.entries(tags as Record<string, unknown>);

packages/clawhub/src/cli/commands/moderation.test.ts

@@ -19,7 +19,7 @@ vi.mock("../registry.js", () => registryMocks.moduleFactory());
 vi.mock("../../http.js", () => httpMocks.moduleFactory());
 vi.mock("../ui.js", () => uiMocks.moduleFactory());
 
-const { cmdBanUser, cmdSetRole } = await import("./moderation");
+const { cmdBanUser, cmdSetRole, cmdUnbanUser } = await import("./moderation");
 
 afterEach(() => {
   vi.clearAllMocks();
@@ -193,3 +193,105 @@ describe("cmdSetRole", () => {
     );
   });
 });
+
+describe("cmdUnbanUser", () => {
+  it("requires --yes when input is disabled", async () => {
+    await expect(cmdUnbanUser(makeGlobalOpts(), "demo", {}, false)).rejects.toThrow(/--yes/i);
+  });
+
+  it("posts handle payload", async () => {
+    httpMocks.apiRequest.mockResolvedValueOnce({
+      ok: true,
+      alreadyUnbanned: false,
+      restoredSkills: 1,
+    });
+    await cmdUnbanUser(makeGlobalOpts(), "hightower6eu", { yes: true }, false);
+    expect(httpMocks.apiRequest).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        method: "POST",
+        path: "/api/v1/users/unban",
+        body: { handle: "hightower6eu" },
+      }),
+      expect.anything(),
+    );
+  });
+
+  it("includes reason when provided", async () => {
+    httpMocks.apiRequest.mockResolvedValueOnce({
+      ok: true,
+      alreadyUnbanned: false,
+      restoredSkills: 0,
+    });
+    await cmdUnbanUser(
+      makeGlobalOpts(),
+      "hightower6eu",
+      { yes: true, reason: "appeal accepted" },
+      false,
+    );
+    expect(httpMocks.apiRequest).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        method: "POST",
+        path: "/api/v1/users/unban",
+        body: { handle: "hightower6eu", reason: "appeal accepted" },
+      }),
+      expect.anything(),
+    );
+  });
+
+  it("posts user id payload when --id is set", async () => {
+    httpMocks.apiRequest.mockResolvedValueOnce({
+      ok: true,
+      alreadyUnbanned: false,
+      restoredSkills: 0,
+    });
+    await cmdUnbanUser(makeGlobalOpts(), "user_123", { yes: true, id: true }, false);
+    expect(httpMocks.apiRequest).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        method: "POST",
+        path: "/api/v1/users/unban",
+        body: { userId: "user_123" },
+      }),
+      expect.anything(),
+    );
+  });
+
+  it("resolves user via fuzzy search", async () => {
+    httpMocks.apiRequest
+      .mockResolvedValueOnce({
+        items: [
+          {
+            userId: "users_123",
+            handle: "moonshine-100rze",
+            displayName: null,
+            name: null,
+            role: "user",
+          },
+        ],
+        total: 1,
+      })
+      .mockResolvedValueOnce({ ok: true, alreadyUnbanned: false, restoredSkills: 0 });
+    await cmdUnbanUser(makeGlobalOpts(), "moonshine-100rze", { yes: true, fuzzy: true }, false);
+    expect(httpMocks.apiRequest).toHaveBeenNthCalledWith(
+      1,
+      expect.anything(),
+      expect.objectContaining({
+        method: "GET",
+        url: expect.stringContaining("/api/v1/users?"),
+      }),
+      expect.anything(),
+    );
+    expect(httpMocks.apiRequest).toHaveBeenNthCalledWith(
+      2,
+      expect.anything(),
+      expect.objectContaining({
+        method: "POST",
+        path: "/api/v1/users/unban",
+        body: { userId: "users_123" },
+      }),
+      expect.anything(),
+    );
+  });
+});

packages/clawhub/src/cli/commands/moderation.ts

@@ -4,6 +4,7 @@ import {
   ApiRoutes,
   ApiV1BanUserResponseSchema,
   ApiV1SetRoleResponseSchema,
+  ApiV1UnbanUserResponseSchema,
   ApiV1UserSearchResponseSchema,
   parseArk,
 } from "../../schema/index.js";
@@ -69,6 +70,65 @@ export async function cmdBanUser(
   }
 }
 
+export async function cmdUnbanUser(
+  opts: GlobalOpts,
+  identifierArg: string,
+  options: { yes?: boolean; id?: boolean; fuzzy?: boolean; reason?: string },
+  inputAllowed: boolean,
+) {
+  const raw = identifierArg.trim();
+  if (!raw) fail("Handle or user id required");
+
+  const reason = options.reason?.trim() || undefined;
+
+  const token = await requireAuthToken();
+  const registry = await getRegistry(opts, { cache: true });
+  const allowPrompt = isInteractive() && inputAllowed !== false;
+  const resolved = await resolveUserIdentifier(
+    registry,
+    token,
+    raw,
+    { id: options.id, fuzzy: options.fuzzy },
+    allowPrompt,
+  );
+  if (!resolved) return undefined;
+  if (!options.yes) {
+    if (!allowPrompt) fail("Pass --yes (no input)");
+    const ok = await promptConfirm(
+      `Unban ${resolved.label}? (admin only; restores eligible skills)`,
+    );
+    if (!ok) return undefined;
+  }
+
+  const spinner = createSpinner(`Unbanning ${resolved.label}`);
+  try {
+    const result = await apiRequest(
+      registry,
+      {
+        method: "POST",
+        path: `${ApiRoutes.users}/unban`,
+        token,
+        body: resolved.userId
+          ? { userId: resolved.userId, reason }
+          : { handle: resolved.handle, reason },
+      },
+      ApiV1UnbanUserResponseSchema,
+    );
+    const parsed = parseArk(ApiV1UnbanUserResponseSchema, result, "Unban user response");
+    if (parsed.alreadyUnbanned) {
+      spinner.succeed(`OK. ${resolved.label} already unbanned`);
+      return parsed;
+    }
+    spinner.succeed(
+      `OK. Unbanned ${resolved.label} (${formatRestoredSkills(parsed.restoredSkills)})`,
+    );
+    return parsed;
+  } catch (error) {
+    spinner.fail(formatError(error));
+    throw error;
+  }
+}
+
 export async function cmdSetRole(
   opts: GlobalOpts,
   identifierArg: string,
@@ -226,3 +286,9 @@ function formatDeletedSkills(count: number) {
   if (count === 1) return "deleted 1 skill";
   return `deleted ${count} skills`;
 }
+
+function formatRestoredSkills(count: number | undefined) {
+  if (!Number.isFinite(count)) return "restored skills unknown";
+  if (count === 1) return "restored 1 skill";
+  return `restored ${count} skills`;
+}

packages/clawhub/src/cli/commands/packages.test.ts

@@ -4,6 +4,7 @@ import { spawnSync } from "node:child_process";
 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { zipSync } from "fflate";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import {
   createAuthTokenModuleMocks,
@@ -1020,6 +1021,96 @@ describe("package commands", () => {
     }
   });
 
+  it("uses --source-path as the package folder for GitHub shorthand sources", async () => {
+    const workdir = await makeTmpWorkdir();
+    const originalFetch = globalThis.fetch;
+    const commit = "0123456789abcdef0123456789abcdef01234567";
+    const archiveBytes = zipSync({
+      "repo-root/plugins/demo/package.json": new TextEncoder().encode(
+        makeCodePluginPackageJson({
+          name: "@scope/demo-plugin",
+          displayName: "Demo Plugin",
+          version: "1.0.0",
+        }),
+      ),
+      "repo-root/plugins/demo/openclaw.plugin.json": new TextEncoder().encode(
+        JSON.stringify({ id: "demo.plugin" }),
+      ),
+      "repo-root/plugins/demo/dist/index.js": new TextEncoder().encode("export {};\n"),
+      "repo-root/other/package.json": new TextEncoder().encode('{"name":"wrong"}\n'),
+    });
+    const archiveBody = archiveBytes.buffer.slice(
+      archiveBytes.byteOffset,
+      archiveBytes.byteOffset + archiveBytes.byteLength,
+    ) as ArrayBuffer;
+    const fetchMock = vi.fn<typeof fetch>(async (input) => {
+      const url = input instanceof Request ? input.url : input.toString();
+      if (url.endsWith("/repos/owner/repo/commits/main")) {
+        return new Response(JSON.stringify({ sha: commit }), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        });
+      }
+      if (url.endsWith(`/repos/owner/repo/zipball/${commit}`)) {
+        return new Response(archiveBody, {
+          status: 200,
+          headers: { "content-type": "application/zip" },
+        });
+      }
+      throw new Error(`Unexpected fetch: ${url}`);
+    });
+
+    Object.defineProperty(globalThis, "fetch", {
+      value: fetchMock,
+      configurable: true,
+      writable: true,
+    });
+    const dateSpy = vi.spyOn(Date, "now").mockReturnValue(555_555_555);
+
+    try {
+      httpMocks.apiRequestForm.mockResolvedValueOnce({
+        ok: true,
+        packageId: "pkg_1",
+        releaseId: "rel_1",
+      });
+
+      await cmdPublishPackage(makeOpts(workdir), "owner/repo@main", {
+        sourcePath: "plugins/demo",
+      });
+
+      expect(getUploadedFileNames()).toEqual([
+        "dist/index.js",
+        "openclaw.plugin.json",
+        "package.json",
+      ]);
+      expect(getPublishPayload()).toEqual({
+        name: "@scope/demo-plugin",
+        displayName: "Demo Plugin",
+        family: "code-plugin",
+        version: "1.0.0",
+        changelog: "",
+        tags: ["latest"],
+        source: {
+          kind: "github",
+          url: "https://github.com/owner/repo",
+          repo: "owner/repo",
+          ref: "main",
+          commit,
+          path: "plugins/demo",
+          importedAt: 555_555_555,
+        },
+      });
+    } finally {
+      Object.defineProperty(globalThis, "fetch", {
+        value: originalFetch,
+        configurable: true,
+        writable: true,
+      });
+      dateSpy.mockRestore();
+      await rm(workdir, { recursive: true, force: true });
+    }
+  });
+
   it("supports dry-run without auth or publish and prints a summary", async () => {
     const workdir = await makeTmpWorkdir();
     const dateSpy = vi.spyOn(Date, "now").mockReturnValue(444_444_444);

packages/clawhub/src/cli/commands/packages.ts

@@ -800,22 +800,32 @@ function parseCsv(value: string | undefined) {
     .filter(Boolean);
 }
 
+function applyGitHubSourcePath(
+  source: Awaited<ReturnType<typeof resolveSourceInput>>,
+  sourcePath: string | undefined,
+) {
+  const explicitPath = sourcePath?.trim();
+  if (!explicitPath || source.kind !== "github") return source;
+  return { ...source, path: explicitPath };
+}
+
 async function preparePackagePublishPlan(
   opts: GlobalOpts,
   sourceArg: string,
   options: PackagePublishOptions,
 ): Promise<PackagePublishPlan> {
   const resolvedSource = await resolveSourceInput(sourceArg, { workdir: opts.workdir });
-  let folder = resolvedSource.kind === "local" ? resolvedSource.path : "";
+  const sourceForFetch = applyGitHubSourcePath(resolvedSource, options.sourcePath);
+  let folder = sourceForFetch.kind === "local" ? sourceForFetch.path : "";
   let cleanup: (() => Promise<void>) | undefined;
   let inferredSource: InferredPublishSource | undefined;
 
-  if (resolvedSource.kind === "github") {
+  if (sourceForFetch.kind === "github") {
     const fetchSpinner = options.json
       ? null
-      : createSpinner(`Fetching ${resolvedSource.owner}/${resolvedSource.repo}`);
+      : createSpinner(`Fetching ${sourceForFetch.owner}/${sourceForFetch.repo}`);
     try {
-      const fetched = await fetchGitHubSource(resolvedSource);
+      const fetched = await fetchGitHubSource(sourceForFetch);
       folder = fetched.dir;
       cleanup = fetched.cleanup;
       inferredSource = fetched.source;
@@ -909,7 +919,7 @@ async function preparePackagePublishPlan(
         }
       : {}),
   };
-  const sourceLabel = describePublishSource(resolvedSource, source, folder);
+  const sourceLabel = describePublishSource(sourceForFetch, source, folder);
 
   return {
     folder,

packages/clawhub/src/cli/commands/skills.test.ts

@@ -205,13 +205,16 @@ describe("cmdExplore", () => {
   it("supports all-time installs and trending sorts", async () => {
     mockApiRequest.mockResolvedValue({ items: [], nextCursor: null });
 
+    await cmdExplore(makeOpts(), { limit: 5, sort: "newest" });
     await cmdExplore(makeOpts(), { limit: 5, sort: "installsAllTime" });
     await cmdExplore(makeOpts(), { limit: 5, sort: "trending" });
 
     const first = new URL(String(mockApiRequest.mock.calls[0]?.[1]?.url));
     const second = new URL(String(mockApiRequest.mock.calls[1]?.[1]?.url));
-    expect(first.searchParams.get("sort")).toBe("installsAllTime");
-    expect(second.searchParams.get("sort")).toBe("trending");
+    const third = new URL(String(mockApiRequest.mock.calls[2]?.[1]?.url));
+    expect(first.searchParams.get("sort")).toBe("createdAt");
+    expect(second.searchParams.get("sort")).toBe("installsAllTime");
+    expect(third.searchParams.get("sort")).toBe("trending");
   });
 });
 

packages/clawhub/src/cli/commands/skills.ts

@@ -13,6 +13,7 @@ import {
 import {
   extractZipToDir,
   hashSkillFiles,
+  listManualSkills,
   listTextFiles,
   readLockfile,
   readSkillOrigin,
@@ -316,13 +317,21 @@ export async function cmdUpdate(
 export async function cmdList(opts: GlobalOpts) {
   const lock = await readLockfile(opts.workdir);
   const entries = Object.entries(lock.skills);
-  if (entries.length === 0) {
+  const manualSkills = await listManualSkills(opts.dir, new Set(Object.keys(lock.skills)));
+  if (entries.length === 0 && manualSkills.length === 0) {
     console.log("No installed skills.");
     return;
   }
   for (const [slug, entry] of entries) {
     console.log(`${slug}  ${entry.version ?? "latest"}`);
   }
+  if (manualSkills.length > 0) {
+    if (entries.length > 0) console.log();
+    console.log("Manually installed (not tracked by clawhub):");
+    for (const slug of manualSkills) {
+      console.log(`  ${slug}`);
+    }
+  }
 }
 
 export async function cmdUninstall(
@@ -366,6 +375,7 @@ export async function cmdUninstall(
 
 type ExploreSort = "newest" | "downloads" | "rating" | "installs" | "installsAllTime" | "trending";
 type ApiExploreSort =
+  | "createdAt"
   | "updated"
   | "downloads"
   | "stars"
@@ -453,7 +463,15 @@ function truncate(str: string, maxLen: number): string {
 
 function resolveExploreSort(raw?: string): { sort: ExploreSort; apiSort: ApiExploreSort } {
   const normalized = raw?.trim().toLowerCase();
-  if (!normalized || normalized === "newest" || normalized === "updated") {
+  if (
+    !normalized ||
+    normalized === "newest" ||
+    normalized === "createdat" ||
+    normalized === "created-at"
+  ) {
+    return { sort: "newest", apiSort: "createdAt" };
+  }
+  if (normalized === "updated") {
     return { sort: "newest", apiSort: "updated" };
   }
   if (normalized === "downloads" || normalized === "download") {
@@ -478,7 +496,7 @@ function resolveExploreSort(raw?: string): { sort: ExploreSort; apiSort: ApiExpl
     return { sort: "trending", apiSort: "trending" };
   }
   return fail(
-    `Invalid sort "${raw}". Use newest, downloads, rating, installs, installsAllTime, or trending.`,
+    `Invalid sort "${raw}". Use newest, updated, downloads, rating, installs, installsAllTime, or trending.`,
   );
 }
 

packages/clawhub/src/schema/schemas.test.ts

@@ -0,0 +1,26 @@
+/* @vitest-environment node */
+
+import { describe, expect, it } from "vitest";
+import { parseArk } from "./ark";
+import { ClawdisSkillMetadataSchema } from "./schemas";
+
+describe("packages/clawhub skill metadata schema", () => {
+  it("preserves optional env var declarations", () => {
+    const parsed = parseArk(
+      ClawdisSkillMetadataSchema,
+      {
+        envVars: [
+          { name: "TODOIST_API_KEY", required: true, description: "API token" },
+          { name: "TODOIST_PROJECT_ID", required: false, description: "Default project" },
+        ],
+      },
+      "Skill metadata",
+    );
+
+    expect(parsed.envVars?.[1]).toEqual({
+      name: "TODOIST_PROJECT_ID",
+      required: false,
+      description: "Default project",
+    });
+  });
+});

packages/clawhub/src/schema/schemas.ts

@@ -340,6 +340,12 @@ export const ApiV1BanUserResponseSchema = type({
   deletedSkills: "number",
 });
 
+export const ApiV1UnbanUserResponseSchema = type({
+  ok: "true",
+  alreadyUnbanned: "boolean",
+  restoredSkills: "number?",
+});
+
 export const ApiV1SetRoleResponseSchema = type({
   ok: "true",
   role: '"admin"|"moderator"|"user"',
@@ -377,6 +383,13 @@ export const ClawdisRequiresSchema = type({
 });
 export type ClawdisRequires = (typeof ClawdisRequiresSchema)[inferred];
 
+export const EnvVarDeclarationSchema = type({
+  name: "string",
+  required: "boolean?",
+  description: "string?",
+});
+export type EnvVarDeclaration = (typeof EnvVarDeclarationSchema)[inferred];
+
 export const ClawdisSkillMetadataSchema = type({
   always: "boolean?",
   skillKey: "string?",
@@ -386,5 +399,6 @@ export const ClawdisSkillMetadataSchema = type({
   os: "string[]?",
   requires: ClawdisRequiresSchema.optional(),
   install: SkillInstallSpecSchema.array().optional(),
+  envVars: EnvVarDeclarationSchema.array().optional(),
 });
 export type ClawdisSkillMetadata = (typeof ClawdisSkillMetadataSchema)[inferred];

packages/clawhub/src/schema/textFiles.test.ts

@@ -7,6 +7,7 @@ import { isTextContentType, TEXT_FILE_EXTENSION_SET } from "./textFiles";
 describe("packages/clawhub schema textFiles", () => {
   it("exports text-file extension set", () => {
     expect(TEXT_FILE_EXTENSION_SET.has("md")).toBe(true);
+    expect(TEXT_FILE_EXTENSION_SET.has("r")).toBe(true);
     expect(TEXT_FILE_EXTENSION_SET.has("exe")).toBe(false);
   });
 

packages/clawhub/src/schema/textFiles.ts

@@ -15,6 +15,7 @@ const RAW_TEXT_FILE_EXTENSIONS = [
   "jsx",
   "py",
   "sh",
+  "r",
   "rb",
   "go",
   "rs",