fix: add root undici devDependency for e2e (#255) (thanks @tanujbhaud)

Refactor action handlers in convex/vt.ts to use explicit return types, resolving circular type inference (TS7022). Also add undici to devDependencies for E2E tests.

CHANGELOG.md

@@ -1,9 +1,69 @@
 # Changelog
 
-## Unreleased
+## 0.6.1 - 2026-02-13
+
+### Added
+- Security: add LLM-based security evaluation during skill publish.
+- Parsing: recognize `metadata.openclaw` frontmatter and evaluate all skill files for requirements.
+
+### Changed
+- Performance: lazy-load Monaco diff viewer on demand (thanks @alexjcm, #212).
+- Search: improve recall/ranking with lexical fallback and relevance prioritization.
+- Moderation UX: collapse OpenClaw analysis by default; update spacing and default reasoning model.
+
+### Fixed
+- Upload gate: handle GitHub API rate limits and optional authenticated lookup token (thanks @superlowburn, #246).
+- HTTP: remove `allowH2` from Undici agent to prevent `fetch failed` on Node.js 22+ (#245).
+- Tests: add root `undici` dev dependency for Node E2E imports (thanks @tanujbhaud, #255).
+- VirusTotal: fix scan sync race conditions and retry behavior in scan/backfill paths.
+- Metadata: tolerate trailing commas in JSON metadata.
+- Auth: allow soft-deleted users to re-authenticate on fresh login, while keeping banned users blocked (thanks @tanujbhaud, #177).
+- Web: prevent horizontal overflow from long code blocks in skill pages (thanks @bewithgaurav, #183).
+
+## 0.6.0 - 2026-02-10
+### Added
+- CLI/API: add `set-role` to change user roles (admin only).
+- Security: quarantine skill publishes with VirusTotal scans + UI (thanks @aleph8, #130).
+- Testing: add tests for badges, skillZip, uploadFiles expandDroppedItems, and ark schema error truncation.
+- Moderation: add ban reasons to API/CLI and show in management UI.
+
+### Changed
+- Coverage: track `convex/lib/skillZip.ts` in coverage reports.
+
+### Fixed
+- Web: show pending-scan skills to owners without 404 (thanks @orlyjamie, #136).
+- Users: backfill empty handles from name/email in ensure (thanks @adlai88, #158).
+- Web: update footer branding to OpenClaw (thanks @jontsai, #122).
+- Auth: restore soft-deleted users on reauth, block banned users (thanks @mkrokosz, #106).
+
+## 0.5.0 - 2026-02-02
+
+### Added
+- Admin: ban users and delete owned skills from management console.
+- Moderation: auto-hide skills after 4 unique reports; per-user report cap; moderators can ban users.
+- Uploads: require GitHub accounts to be at least 7 days old for skill + soul publish/import.
+- CLI: add `inspect` to fetch skill metadata/files without installing.
+- CLI: add moderation commands for hide/unhide/delete and ban users.
+- Management: add filters for reported skills and users.
+
+### Changed
+- Deps: update dependencies to latest available versions.
+- Reporting: require reasons, show them in management console, warn about abuse bans.
+
+### Fixed
+- Bans: batch hard-delete cleanup to avoid Convex read limits on large skills.
+
+## 0.4.0 - 2026-01-30
 
 ### Added
 - Web: show published skills on user profiles (thanks @njoylab, #20).
+- CLI: include ClawHub + Moltbot fallback skill roots for sync scans.
+- CLI: support OpenClaw configuration files (`OPENCLAW_CONFIG_PATH` / `OPENCLAW_STATE_DIR`).
+
+### Changed
+- Brand: rebrand to ClawHub and publish CLI as `clawhub` (legacy `clawdhub` supported).
+- Domain: default site/registry now `https://clawhub.ai`; `.well-known/clawhub.json` preferred.
+- Theme: persist theme under `clawhub-theme` (legacy key still read).
 
 ### Fixed
 - Registry: drop missing skills during search hydration (thanks @aaronn, #28).
@@ -36,7 +96,7 @@
 - Registry: make SoulHub auto-seed idempotent and non-user-owned.
 - Registry: keep GitHub backup state + publish backups intact (thanks @joshp123, #1).
 - CLI/Registry: restore fork lineage on sync + clamp bulk list queries (thanks @joshp123, #1).
-- CLI: default workdir falls back to Clawdbot workspace (override with `--workdir` / `CLAWDHUB_WORKDIR`).
+- CLI: default workdir falls back to Clawdbot workspace (override with `--workdir` / `CLAWHUB_WORKDIR`).
 
 ## 0.0.6 - 2026-01-07
 
@@ -52,7 +112,7 @@
 ## 0.0.5 - 2026-01-06
 
 ### Added
-- Telemetry: track installs via `clawdhub sync` (logged-in only), per root, with 120-day staleness.
+- Telemetry: track installs via `clawhub sync` (logged-in only), per root, with 120-day staleness.
 - Skills: show current + all-time installs; sort by installs.
 - Profile: private "Installed" tab with JSON export + delete telemetry controls.
 - Docs: add `docs/telemetry.md` (what we track + how to opt out).
@@ -60,7 +120,7 @@
 - Web: dashboard for managing your published skills (thanks @dbhurley!).
 
 ### Changed
-- CLI: telemetry opt-out via `CLAWDHUB_DISABLE_TELEMETRY=1`.
+- CLI: telemetry opt-out via `CLAWHUB_DISABLE_TELEMETRY=1`.
 - Web: move theme picker into mobile menu.
 
 ### Fixed
@@ -108,8 +168,8 @@
 ### Fixed
 - CLI sync: wrap note output to avoid terminal overflow; cap list lengths.
 - CLI sync: label fallback scans as fallback locations.
-- CLI package: bundle schema internally (no external `clawdhub-schema` publish).
-- Repo: mark `clawdhub-schema` as private to prevent publishing.
+- CLI package: bundle schema internally (no external `clawhub-schema` publish).
+- Repo: mark `clawhub-schema` as private to prevent publishing.
 
 ## 0.0.2 - 2026-01-04
 

README.md

@@ -1,20 +1,20 @@
-# ClawdHub
+# ClawHub
 
 <p align="center">
-  <a href="https://github.com/clawdbot/clawdhub/actions/workflows/ci.yml?branch=main"><img src="https://img.shields.io/github/actions/workflow/status/clawdbot/clawdhub/ci.yml?branch=main&style=for-the-badge" alt="CI status"></a>
+  <a href="https://github.com/openclaw/clawhub/actions/workflows/ci.yml?branch=main"><img src="https://img.shields.io/github/actions/workflow/status/openclaw/clawhub/ci.yml?branch=main&style=for-the-badge" alt="CI status"></a>
   <a href="https://discord.gg/clawd"><img src="https://img.shields.io/discord/1456350064065904867?label=Discord&logo=discord&logoColor=white&color=5865F2&style=for-the-badge" alt="Discord"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg?style=for-the-badge" alt="MIT License"></a>
 </p>
 
-ClawdHub is the **public skill registry for Clawdbot**: publish, version, and search text-based agent skills (a `SKILL.md` plus supporting files).
+ClawHub is the **public skill registry for Clawdbot**: publish, version, and search text-based agent skills (a `SKILL.md` plus supporting files).
 It’s designed for fast browsing + a CLI-friendly API, with moderation hooks and vector search.
 
 onlycrabs.ai is the **SOUL.md registry**: publish and share system lore the same way you publish skills.
 
-Live: `https://clawdhub.com`
+Live: `https://clawhub.ai`
 onlycrabs.ai: `https://onlycrabs.ai`
 
-## What you can do
+## What you can do with it
 
 - Browse skills + render their `SKILL.md`.
 - Publish new skill versions with changelogs + tags (including `latest`).
@@ -27,7 +27,7 @@ onlycrabs.ai: `https://onlycrabs.ai`
 
 - Entry point is host-based: `onlycrabs.ai`.
 - On the onlycrabs.ai host, the home page and nav default to souls.
-- On ClawdHub, souls live under `/souls`.
+- On ClawHub, souls live under `/souls`.
 - Soul bundles only accept `SOUL.md` for now (no extra files).
 
 ## How it works (high level)
@@ -35,15 +35,16 @@ onlycrabs.ai: `https://onlycrabs.ai`
 - Web app: TanStack Start (React, Vite/Nitro).
 - Backend: Convex (DB + file storage + HTTP actions) + Convex Auth (GitHub OAuth).
 - Search: OpenAI embeddings (`text-embedding-3-small`) + Convex vector search.
-- API schema + routes: `packages/schema` (`clawdhub-schema`).
+- API schema + routes: `packages/schema` (`clawhub-schema`).
+
 
 ## Telemetry
 
-ClawdHub tracks minimal **install telemetry** (to compute install counts) when you run `clawdhub sync` while logged in.
+ClawHub tracks minimal **install telemetry** (to compute install counts) when you run `clawhub sync` while logged in.
 Disable via:
 
 ```bash
-export CLAWDHUB_DISABLE_TELEMETRY=1
+export CLAWHUB_DISABLE_TELEMETRY=1
 ```
 
 Details: `docs/telemetry.md`.
@@ -95,7 +96,7 @@ This writes `JWT_PRIVATE_KEY` + `JWKS` to the deployment and prints values for y
 
 ## Nix plugins (nixmode skills)
 
-ClawdHub can store a nix-clawdbot plugin pointer in SKILL frontmatter so the registry knows which
+ClawHub can store a nix-clawdbot plugin pointer in SKILL frontmatter so the registry knows which
 Nix package bundle to install. A nix plugin is different from a regular skill pack: it bundles the
 skill pack, the CLI binary, and its config flags/requirements together.
 
@@ -137,7 +138,30 @@ metadata: {"clawdbot":{"cliHelp":"padel --help\\nUsage: padel [command]\\n"}}
 ---
 ```
 
-`metadata.clawdbot` is preferred, but `metadata.clawdis` is accepted as an alias for compatibility.
+`metadata.clawdbot` is preferred, but `metadata.clawdis` and `metadata.openclaw` are accepted as aliases.
+
+## Skill metadata
+
+Skills declare their runtime requirements (env vars, binaries, install specs) in the `SKILL.md` frontmatter. ClawHub's security analysis checks these declarations against actual skill behavior.
+
+Full reference: [`docs/skill-format.md`](docs/skill-format.md#frontmatter-metadata)
+
+Quick example:
+
+```yaml
+---
+name: my-skill
+description: Does a thing with an API.
+metadata:
+  openclaw:
+    requires:
+      env:
+        - MY_API_KEY
+      bins:
+        - curl
+    primaryEnv: MY_API_KEY
+---
+```
 
 ## Scripts
 

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.3.11/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.3.13/schema.json",
   "files": {
     "includes": [
       "**",

bun.lock

@@ -1,9 +1,9 @@
 {
   "lockfileVersion": 1,
-  "configVersion": 0,
+  "configVersion": 1,
   "workspaces": {
     "": {
-      "name": "clawdhub",
+      "name": "clawhub",
       "dependencies": {
         "@auth/core": "^0.37.4",
         "@convex-dev/auth": "^0.0.90",
@@ -15,56 +15,58 @@
         "@radix-ui/react-toggle-group": "^1.1.11",
         "@resvg/resvg-wasm": "^2.6.2",
         "@tailwindcss/vite": "^4.1.18",
-        "@tanstack/react-devtools": "^0.9.2",
-        "@tanstack/react-router": "^1.151.6",
-        "@tanstack/react-router-devtools": "^1.151.6",
-        "@tanstack/react-start": "^1.152.0",
-        "@tanstack/router-plugin": "^1.151.6",
+        "@tanstack/react-devtools": "^0.9.4",
+        "@tanstack/react-router": "^1.157.18",
+        "@tanstack/react-router-devtools": "^1.157.18",
+        "@tanstack/react-start": "^1.157.18",
+        "@tanstack/router-plugin": "^1.157.18",
         "@vercel/analytics": "^1.6.1",
-        "clawdhub-schema": "workspace:*",
+        "clawhub-schema": "workspace:*",
         "clsx": "^2.1.1",
-        "convex": "^1.31.6",
+        "convex": "^1.31.7",
         "convex-helpers": "^0.1.111",
         "fflate": "^0.8.2",
-        "h3": "2.0.1-rc.8",
-        "lucide-react": "^0.562.0",
+        "h3": "2.0.1-rc.11",
+        "lucide-react": "^0.563.0",
         "monaco-editor": "^0.55.1",
-        "nitro": "^3.0.1-alpha.1",
-        "react": "^19.2.3",
-        "react-dom": "^19.2.3",
+        "nitro": "^3.0.1-alpha.2",
+        "react": "^19.2.4",
+        "react-dom": "^19.2.4",
         "react-markdown": "^10.1.0",
         "remark-gfm": "^4.0.1",
         "semver": "^7.7.3",
         "tailwind-merge": "^3.4.0",
         "tailwindcss": "^4.1.18",
-        "vite-tsconfig-paths": "^6.0.4",
+        "vite-tsconfig-paths": "^6.0.5",
         "yaml": "^2.8.2",
       },
       "devDependencies": {
-        "@biomejs/biome": "^2.3.11",
-        "@playwright/test": "^1.57.0",
-        "@tanstack/devtools-vite": "^0.4.1",
+        "@biomejs/biome": "^2.3.13",
+        "@playwright/test": "^1.58.1",
+        "@tanstack/devtools-vite": "^0.5.0",
         "@testing-library/dom": "^10.4.1",
-        "@testing-library/react": "^16.3.1",
-        "@types/node": "^25.0.9",
-        "@types/react": "^19.2.8",
+        "@testing-library/react": "^16.3.2",
+        "@types/node": "^25.2.0",
+        "@types/react": "^19.2.10",
         "@types/react-dom": "^19.2.3",
         "@types/semver": "^7.7.1",
         "@vitejs/plugin-react": "^5.1.2",
-        "@vitest/coverage-v8": "^4.0.17",
-        "jsdom": "^27.4.0",
-        "only-allow": "^1.2.1",
-        "oxlint": "^1.39.0",
-        "oxlint-tsgolint": "^0.11.1",
+        "@vitest/coverage-v8": "^4.0.18",
+        "jsdom": "^28.0.0",
+        "only-allow": "^1.2.2",
+        "oxlint": "^1.42.0",
+        "oxlint-tsgolint": "^0.11.4",
         "typescript": "^5.9.3",
+        "undici": "^7.19.2",
         "vite": "^7.3.1",
-        "vitest": "^4.0.17",
+        "vitest": "^4.0.18",
       },
     },
     "packages/clawdhub": {
-      "name": "clawdhub",
-      "version": "0.3.0",
+      "name": "clawhub",
+      "version": "0.6.1",
       "bin": {
+        "clawhub": "bin/clawdhub.js",
         "clawdhub": "bin/clawdhub.js",
       },
       "dependencies": {
@@ -86,7 +88,7 @@
       },
     },
     "packages/schema": {
-      "name": "clawdhub-schema",
+      "name": "clawhub-schema",
       "version": "0.0.2",
       "dependencies": {
         "arktype": "^2.1.29",
@@ -97,7 +99,7 @@
     },
   },
   "packages": {
-    "@acemir/cssom": ["@acemir/cssom@0.9.30", "", {}, "sha512-9CnlMCI0LmCIq0olalQqdWrJHPzm0/tw3gzOA9zJSgvFX7Xau3D24mAGa4BtwxwY69nsuJW6kQqqCzf/mEcQgg=="],
+    "@acemir/cssom": ["@acemir/cssom@0.9.31", "", {}, "sha512-ZnR3GSaH+/vJ0YlHau21FjfLYjMpYVIzTD8M8vIEQvIGxeOXyXdzCI140rrCY862p/C/BbzWsjc1dgnM9mkoTA=="],
 
     "@ark/schema": ["@ark/schema@0.56.0", "", { "dependencies": { "@ark/util": "0.56.0" } }, "sha512-ECg3hox/6Z/nLajxXqNhgPtNdHWC9zNsDyskwO28WinoFEnWow4IsERNz9AnXRhTZJnYIlAJ4uGn3nlLk65vZA=="],
 
@@ -111,23 +113,23 @@
 
     "@auth/core": ["@auth/core@0.37.4", "", { "dependencies": { "@panva/hkdf": "^1.2.1", "jose": "^5.9.6", "oauth4webapi": "^3.1.1", "preact": "10.24.3", "preact-render-to-string": "6.5.11" }, "peerDependencies": { "@simplewebauthn/browser": "^9.0.1", "@simplewebauthn/server": "^9.0.2", "nodemailer": "^6.8.0" }, "optionalPeers": ["@simplewebauthn/browser", "@simplewebauthn/server", "nodemailer"] }, "sha512-HOXJwXWXQRhbBDHlMU0K/6FT1v+wjtzdKhsNg0ZN7/gne6XPsIrjZ4daMcFnbq0Z/vsAbYBinQhhua0d77v7qw=="],
 
-    "@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],
+    "@babel/code-frame": ["@babel/code-frame@7.28.6", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.28.5", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-JYgintcMjRiCvS8mMECzaEn+m3PfoQiyqukOMCCVQtoJGYJw8j/8LBJEiqkHLkfwCcs74E3pbAUFNg7d9VNJ+Q=="],
 
-    "@babel/compat-data": ["@babel/compat-data@7.28.5", "", {}, "sha512-6uFXyCayocRbqhZOB+6XcuZbkMNimwfVGFji8CTZnCzOHVGvDqzvitu1re2AU5LROliz7eQPhB8CpAMvnx9EjA=="],
+    "@babel/compat-data": ["@babel/compat-data@7.28.6", "", {}, "sha512-2lfu57JtzctfIrcGMz992hyLlByuzgIk58+hhGCxjKZ3rWI82NnVLjXcaTqkI2NvlcvOskZaiZ5kjUALo3Lpxg=="],
 
-    "@babel/core": ["@babel/core@7.28.5", "", { "dependencies": { "@babel/code-frame": "^7.27.1", "@babel/generator": "^7.28.5", "@babel/helper-compilation-targets": "^7.27.2", "@babel/helper-module-transforms": "^7.28.3", "@babel/helpers": "^7.28.4", "@babel/parser": "^7.28.5", "@babel/template": "^7.27.2", "@babel/traverse": "^7.28.5", "@babel/types": "^7.28.5", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw=="],
+    "@babel/core": ["@babel/core@7.28.6", "", { "dependencies": { "@babel/code-frame": "^7.28.6", "@babel/generator": "^7.28.6", "@babel/helper-compilation-targets": "^7.28.6", "@babel/helper-module-transforms": "^7.28.6", "@babel/helpers": "^7.28.6", "@babel/parser": "^7.28.6", "@babel/template": "^7.28.6", "@babel/traverse": "^7.28.6", "@babel/types": "^7.28.6", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-H3mcG6ZDLTlYfaSNi0iOKkigqMFvkTKlGUYlD8GW7nNOYRrevuA46iTypPyv+06V3fEmvvazfntkBU34L0azAw=="],
 
-    "@babel/generator": ["@babel/generator@7.28.5", "", { "dependencies": { "@babel/parser": "^7.28.5", "@babel/types": "^7.28.5", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-3EwLFhZ38J4VyIP6WNtt2kUdW9dokXA9Cr4IVIFHuCpZ3H8/YFOl5JjZHisrn1fATPBmKKqXzDFvh9fUwHz6CQ=="],
+    "@babel/generator": ["@babel/generator@7.28.6", "", { "dependencies": { "@babel/parser": "^7.28.6", "@babel/types": "^7.28.6", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-lOoVRwADj8hjf7al89tvQ2a1lf53Z+7tiXMgpZJL3maQPDxh0DgLMN62B2MKUOFcoodBHLMbDM6WAbKgNy5Suw=="],
 
-    "@babel/helper-compilation-targets": ["@babel/helper-compilation-targets@7.27.2", "", { "dependencies": { "@babel/compat-data": "^7.27.2", "@babel/helper-validator-option": "^7.27.1", "browserslist": "^4.24.0", "lru-cache": "^5.1.1", "semver": "^6.3.1" } }, "sha512-2+1thGUUWWjLTYTHZWK1n8Yga0ijBz1XAhUXcKy81rd5g6yh7hGqMp45v7cadSbEHc9G3OTv45SyneRN3ps4DQ=="],
+    "@babel/helper-compilation-targets": ["@babel/helper-compilation-targets@7.28.6", "", { "dependencies": { "@babel/compat-data": "^7.28.6", "@babel/helper-validator-option": "^7.27.1", "browserslist": "^4.24.0", "lru-cache": "^5.1.1", "semver": "^6.3.1" } }, "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA=="],
 
     "@babel/helper-globals": ["@babel/helper-globals@7.28.0", "", {}, "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw=="],
 
-    "@babel/helper-module-imports": ["@babel/helper-module-imports@7.27.1", "", { "dependencies": { "@babel/traverse": "^7.27.1", "@babel/types": "^7.27.1" } }, "sha512-0gSFWUPNXNopqtIPQvlD5WgXYI5GY2kP2cCvoT8kczjbfcfuIljTbcWrulD1CIPIX2gt1wghbDy08yE1p+/r3w=="],
+    "@babel/helper-module-imports": ["@babel/helper-module-imports@7.28.6", "", { "dependencies": { "@babel/traverse": "^7.28.6", "@babel/types": "^7.28.6" } }, "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw=="],
 
-    "@babel/helper-module-transforms": ["@babel/helper-module-transforms@7.28.3", "", { "dependencies": { "@babel/helper-module-imports": "^7.27.1", "@babel/helper-validator-identifier": "^7.27.1", "@babel/traverse": "^7.28.3" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-gytXUbs8k2sXS9PnQptz5o0QnpLL51SwASIORY6XaBKF88nsOT0Zw9szLqlSGQDP/4TljBAD5y98p2U1fqkdsw=="],
+    "@babel/helper-module-transforms": ["@babel/helper-module-transforms@7.28.6", "", { "dependencies": { "@babel/helper-module-imports": "^7.28.6", "@babel/helper-validator-identifier": "^7.28.5", "@babel/traverse": "^7.28.6" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA=="],
 
-    "@babel/helper-plugin-utils": ["@babel/helper-plugin-utils@7.27.1", "", {}, "sha512-1gn1Up5YXka3YYAHGKpbideQ5Yjf1tDa9qYcgysz+cNCXukyLl6DjPXhD3VRwSb8c0J9tA4b2+rHEZtc6R0tlw=="],
+    "@babel/helper-plugin-utils": ["@babel/helper-plugin-utils@7.28.6", "", {}, "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug=="],
 
     "@babel/helper-string-parser": ["@babel/helper-string-parser@7.27.1", "", {}, "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA=="],
 
@@ -135,45 +137,45 @@
 
     "@babel/helper-validator-option": ["@babel/helper-validator-option@7.27.1", "", {}, "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg=="],
 
-    "@babel/helpers": ["@babel/helpers@7.28.4", "", { "dependencies": { "@babel/template": "^7.27.2", "@babel/types": "^7.28.4" } }, "sha512-HFN59MmQXGHVyYadKLVumYsA9dBFun/ldYxipEjzA4196jpLZd8UjEEBLkbEkvfYreDqJhZxYAWFPtrfhNpj4w=="],
+    "@babel/helpers": ["@babel/helpers@7.28.6", "", { "dependencies": { "@babel/template": "^7.28.6", "@babel/types": "^7.28.6" } }, "sha512-xOBvwq86HHdB7WUDTfKfT/Vuxh7gElQ+Sfti2Cy6yIWNW05P8iUslOVcZ4/sKbE+/jQaukQAdz/gf3724kYdqw=="],
 
-    "@babel/parser": ["@babel/parser@7.28.5", "", { "dependencies": { "@babel/types": "^7.28.5" }, "bin": "./bin/babel-parser.js" }, "sha512-KKBU1VGYR7ORr3At5HAtUQ+TV3SzRCXmA/8OdDZiLDBIZxVyzXuztPjfLd3BV1PRAQGCMWWSHYhL0F8d5uHBDQ=="],
+    "@babel/parser": ["@babel/parser@7.28.6", "", { "dependencies": { "@babel/types": "^7.28.6" }, "bin": "./bin/babel-parser.js" }, "sha512-TeR9zWR18BvbfPmGbLampPMW+uW1NZnJlRuuHso8i87QZNq2JRF9i6RgxRqtEq+wQGsS19NNTWr2duhnE49mfQ=="],
 
-    "@babel/plugin-syntax-jsx": ["@babel/plugin-syntax-jsx@7.27.1", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.27.1" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-y8YTNIeKoyhGd9O0Jiyzyyqk8gdjnumGTQPsz0xOZOQ2RmkVJeZ1vmmfIvFEKqucBG6axJGBZDE/7iI5suUI/w=="],
+    "@babel/plugin-syntax-jsx": ["@babel/plugin-syntax-jsx@7.28.6", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.28.6" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-wgEmr06G6sIpqr8YDwA2dSRTE3bJ+V0IfpzfSY3Lfgd7YWOaAdlykvJi13ZKBt8cZHfgH1IXN+CL656W3uUa4w=="],
 
-    "@babel/plugin-syntax-typescript": ["@babel/plugin-syntax-typescript@7.27.1", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.27.1" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-xfYCBMxveHrRMnAWl1ZlPXOZjzkN82THFvLhQhFXFt81Z5HnN+EtUkZhv/zcKpmT3fzmWZB0ywiBrbC3vogbwQ=="],
+    "@babel/plugin-syntax-typescript": ["@babel/plugin-syntax-typescript@7.28.6", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.28.6" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-+nDNmQye7nlnuuHDboPbGm00Vqg3oO8niRRL27/4LYHUsHYh0zJ1xWOz0uRwNFmM1Avzk8wZbc6rdiYhomzv/A=="],
 
     "@babel/plugin-transform-react-jsx-self": ["@babel/plugin-transform-react-jsx-self@7.27.1", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.27.1" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-6UzkCs+ejGdZ5mFFC/OCUrv028ab2fp1znZmCZjAOBKiBK2jXD1O+BPSfX8X2qjJ75fZBMSnQn3Rq2mrBJK2mw=="],
 
     "@babel/plugin-transform-react-jsx-source": ["@babel/plugin-transform-react-jsx-source@7.27.1", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.27.1" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-zbwoTsBruTeKB9hSq73ha66iFeJHuaFkUbwvqElnygoNbj/jHRsSeokowZFN3CZ64IvEqcmmkVe89OPXc7ldAw=="],
 
-    "@babel/runtime": ["@babel/runtime@7.28.4", "", {}, "sha512-Q/N6JNWvIvPnLDvjlE1OUBLPQHH6l3CltCEsHIujp45zQUSSh8K+gHnaEX45yAT1nyngnINhvWtzN+Nb9D8RAQ=="],
+    "@babel/runtime": ["@babel/runtime@7.28.6", "", {}, "sha512-05WQkdpL9COIMz4LjTxGpPNCdlpyimKppYNoJ5Di5EUObifl8t4tuLuUBBZEpoLYOmfvIWrsp9fCl0HoPRVTdA=="],
 
-    "@babel/template": ["@babel/template@7.27.2", "", { "dependencies": { "@babel/code-frame": "^7.27.1", "@babel/parser": "^7.27.2", "@babel/types": "^7.27.1" } }, "sha512-LPDZ85aEJyYSd18/DkjNh4/y1ntkE5KwUHWTiqgRxruuZL2F1yuHligVHLvcHY2vMHXttKFpJn6LwfI7cw7ODw=="],
+    "@babel/template": ["@babel/template@7.28.6", "", { "dependencies": { "@babel/code-frame": "^7.28.6", "@babel/parser": "^7.28.6", "@babel/types": "^7.28.6" } }, "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ=="],
 
-    "@babel/traverse": ["@babel/traverse@7.28.5", "", { "dependencies": { "@babel/code-frame": "^7.27.1", "@babel/generator": "^7.28.5", "@babel/helper-globals": "^7.28.0", "@babel/parser": "^7.28.5", "@babel/template": "^7.27.2", "@babel/types": "^7.28.5", "debug": "^4.3.1" } }, "sha512-TCCj4t55U90khlYkVV/0TfkJkAkUg3jZFA3Neb7unZT8CPok7iiRfaX0F+WnqWqt7OxhOn0uBKXCw4lbL8W0aQ=="],
+    "@babel/traverse": ["@babel/traverse@7.28.6", "", { "dependencies": { "@babel/code-frame": "^7.28.6", "@babel/generator": "^7.28.6", "@babel/helper-globals": "^7.28.0", "@babel/parser": "^7.28.6", "@babel/template": "^7.28.6", "@babel/types": "^7.28.6", "debug": "^4.3.1" } }, "sha512-fgWX62k02qtjqdSNTAGxmKYY/7FSL9WAS1o2Hu5+I5m9T0yxZzr4cnrfXQ/MX0rIifthCSs6FKTlzYbJcPtMNg=="],
 
-    "@babel/types": ["@babel/types@7.28.5", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.28.5" } }, "sha512-qQ5m48eI/MFLQ5PxQj4PFaprjyCTLI37ElWMmNs0K8Lk3dVeOdNpB3ks8jc7yM5CDmVC73eMVk/trk3fgmrUpA=="],
+    "@babel/types": ["@babel/types@7.28.6", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.28.5" } }, "sha512-0ZrskXVEHSWIqZM/sQZ4EV3jZJXRkio/WCxaqKZP1g//CEWEPSfeZFcms4XeKBCHU0ZKnIkdJeU/kF+eRp5lBg=="],
 
     "@bcoe/v8-coverage": ["@bcoe/v8-coverage@1.0.2", "", {}, "sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA=="],
 
-    "@biomejs/biome": ["@biomejs/biome@2.3.11", "", { "optionalDependencies": { "@biomejs/cli-darwin-arm64": "2.3.11", "@biomejs/cli-darwin-x64": "2.3.11", "@biomejs/cli-linux-arm64": "2.3.11", "@biomejs/cli-linux-arm64-musl": "2.3.11", "@biomejs/cli-linux-x64": "2.3.11", "@biomejs/cli-linux-x64-musl": "2.3.11", "@biomejs/cli-win32-arm64": "2.3.11", "@biomejs/cli-win32-x64": "2.3.11" }, "bin": { "biome": "bin/biome" } }, "sha512-/zt+6qazBWguPG6+eWmiELqO+9jRsMZ/DBU3lfuU2ngtIQYzymocHhKiZRyrbra4aCOoyTg/BmY+6WH5mv9xmQ=="],
+    "@biomejs/biome": ["@biomejs/biome@2.3.13", "", { "optionalDependencies": { "@biomejs/cli-darwin-arm64": "2.3.13", "@biomejs/cli-darwin-x64": "2.3.13", "@biomejs/cli-linux-arm64": "2.3.13", "@biomejs/cli-linux-arm64-musl": "2.3.13", "@biomejs/cli-linux-x64": "2.3.13", "@biomejs/cli-linux-x64-musl": "2.3.13", "@biomejs/cli-win32-arm64": "2.3.13", "@biomejs/cli-win32-x64": "2.3.13" }, "bin": { "biome": "bin/biome" } }, "sha512-Fw7UsV0UAtWIBIm0M7g5CRerpu1eKyKAXIazzxhbXYUyMkwNrkX/KLkGI7b+uVDQ5cLUMfOC9vR60q9IDYDstA=="],
 
-    "@biomejs/cli-darwin-arm64": ["@biomejs/cli-darwin-arm64@2.3.11", "", { "os": "darwin", "cpu": "arm64" }, "sha512-/uXXkBcPKVQY7rc9Ys2CrlirBJYbpESEDme7RKiBD6MmqR2w3j0+ZZXRIL2xiaNPsIMMNhP1YnA+jRRxoOAFrA=="],
+    "@biomejs/cli-darwin-arm64": ["@biomejs/cli-darwin-arm64@2.3.13", "", { "os": "darwin", "cpu": "arm64" }, "sha512-0OCwP0/BoKzyJHnFdaTk/i7hIP9JHH9oJJq6hrSCPmJPo8JWcJhprK4gQlhFzrwdTBAW4Bjt/RmCf3ZZe59gwQ=="],
 
-    "@biomejs/cli-darwin-x64": ["@biomejs/cli-darwin-x64@2.3.11", "", { "os": "darwin", "cpu": "x64" }, "sha512-fh7nnvbweDPm2xEmFjfmq7zSUiox88plgdHF9OIW4i99WnXrAC3o2P3ag9judoUMv8FCSUnlwJCM1B64nO5Fbg=="],
+    "@biomejs/cli-darwin-x64": ["@biomejs/cli-darwin-x64@2.3.13", "", { "os": "darwin", "cpu": "x64" }, "sha512-AGr8OoemT/ejynbIu56qeil2+F2WLkIjn2d8jGK1JkchxnMUhYOfnqc9sVzcRxpG9Ycvw4weQ5sprRvtb7Yhcw=="],
 
-    "@biomejs/cli-linux-arm64": ["@biomejs/cli-linux-arm64@2.3.11", "", { "os": "linux", "cpu": "arm64" }, "sha512-l4xkGa9E7Uc0/05qU2lMYfN1H+fzzkHgaJoy98wO+b/7Gl78srbCRRgwYSW+BTLixTBrM6Ede5NSBwt7rd/i6g=="],
+    "@biomejs/cli-linux-arm64": ["@biomejs/cli-linux-arm64@2.3.13", "", { "os": "linux", "cpu": "arm64" }, "sha512-xvOiFkrDNu607MPMBUQ6huHmBG1PZLOrqhtK6pXJW3GjfVqJg0Z/qpTdhXfcqWdSZHcT+Nct2fOgewZvytESkw=="],
 
-    "@biomejs/cli-linux-arm64-musl": ["@biomejs/cli-linux-arm64-musl@2.3.11", "", { "os": "linux", "cpu": "arm64" }, "sha512-XPSQ+XIPZMLaZ6zveQdwNjbX+QdROEd1zPgMwD47zvHV+tCGB88VH+aynyGxAHdzL+Tm/+DtKST5SECs4iwCLg=="],
+    "@biomejs/cli-linux-arm64-musl": ["@biomejs/cli-linux-arm64-musl@2.3.13", "", { "os": "linux", "cpu": "arm64" }, "sha512-TUdDCSY+Eo/EHjhJz7P2GnWwfqet+lFxBZzGHldrvULr59AgahamLs/N85SC4+bdF86EhqDuuw9rYLvLFWWlXA=="],
 
-    "@biomejs/cli-linux-x64": ["@biomejs/cli-linux-x64@2.3.11", "", { "os": "linux", "cpu": "x64" }, "sha512-/1s9V/H3cSe0r0Mv/Z8JryF5x9ywRxywomqZVLHAoa/uN0eY7F8gEngWKNS5vbbN/BsfpCG5yeBT5ENh50Frxg=="],
+    "@biomejs/cli-linux-x64": ["@biomejs/cli-linux-x64@2.3.13", "", { "os": "linux", "cpu": "x64" }, "sha512-s+YsZlgiXNq8XkgHs6xdvKDFOj/bwTEevqEY6rC2I3cBHbxXYU1LOZstH3Ffw9hE5tE1sqT7U23C00MzkXztMw=="],
 
-    "@biomejs/cli-linux-x64-musl": ["@biomejs/cli-linux-x64-musl@2.3.11", "", { "os": "linux", "cpu": "x64" }, "sha512-vU7a8wLs5C9yJ4CB8a44r12aXYb8yYgBn+WeyzbMjaCMklzCv1oXr8x+VEyWodgJt9bDmhiaW/I0RHbn7rsNmw=="],
+    "@biomejs/cli-linux-x64-musl": ["@biomejs/cli-linux-x64-musl@2.3.13", "", { "os": "linux", "cpu": "x64" }, "sha512-0bdwFVSbbM//Sds6OjtnmQGp4eUjOTt6kHvR/1P0ieR9GcTUAlPNvPC3DiavTqq302W34Ae2T6u5VVNGuQtGlQ=="],
 
-    "@biomejs/cli-win32-arm64": ["@biomejs/cli-win32-arm64@2.3.11", "", { "os": "win32", "cpu": "arm64" }, "sha512-PZQ6ElCOnkYapSsysiTy0+fYX+agXPlWugh6+eQ6uPKI3vKAqNp6TnMhoM3oY2NltSB89hz59o8xIfOdyhi9Iw=="],
+    "@biomejs/cli-win32-arm64": ["@biomejs/cli-win32-arm64@2.3.13", "", { "os": "win32", "cpu": "arm64" }, "sha512-QweDxY89fq0VvrxME+wS/BXKmqMrOTZlN9SqQ79kQSIc3FrEwvW/PvUegQF6XIVaekncDykB5dzPqjbwSKs9DA=="],
 
-    "@biomejs/cli-win32-x64": ["@biomejs/cli-win32-x64@2.3.11", "", { "os": "win32", "cpu": "x64" }, "sha512-43VrG813EW+b5+YbDbz31uUsheX+qFKCpXeY9kfdAx+ww3naKxeVkTD9zLIWxUPfJquANMHrmW3wbe/037G0Qg=="],
+    "@biomejs/cli-win32-x64": ["@biomejs/cli-win32-x64@2.3.13", "", { "os": "win32", "cpu": "x64" }, "sha512-trDw2ogdM2lyav9WFQsdsfdVy1dvZALymRpgmWsvSez0BJzBjulhOT/t+wyKeh3pZWvwP3VMs1SoOKwO3wecMQ=="],
 
     "@clack/core": ["@clack/core@0.5.0", "", { "dependencies": { "picocolors": "^1.0.0", "sisteransi": "^1.0.5" } }, "sha512-p3y0FIOwaYRUPRcMO7+dlmLh8PSRcrjuTndsiA0WAFbWES0mLZlrjVoBRZ9DzkPFJZG6KGkJmoEAY0ZcVWTkow=="],
 
@@ -189,13 +191,13 @@
 
     "@csstools/css-parser-algorithms": ["@csstools/css-parser-algorithms@3.0.5", "", { "peerDependencies": { "@csstools/css-tokenizer": "^3.0.4" } }, "sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ=="],
 
-    "@csstools/css-syntax-patches-for-csstree": ["@csstools/css-syntax-patches-for-csstree@1.0.22", "", {}, "sha512-qBcx6zYlhleiFfdtzkRgwNC7VVoAwfK76Vmsw5t+PbvtdknO9StgRk7ROvq9so1iqbdW4uLIDAsXRsTfUrIoOw=="],
+    "@csstools/css-syntax-patches-for-csstree": ["@csstools/css-syntax-patches-for-csstree@1.0.26", "", {}, "sha512-6boXK0KkzT5u5xOgF6TKB+CLq9SOpEGmkZw0g5n9/7yg85wab3UzSxB8TxhLJ31L4SGJ6BCFRw/iftTha1CJXA=="],
 
     "@csstools/css-tokenizer": ["@csstools/css-tokenizer@3.0.4", "", {}, "sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw=="],
 
-    "@emnapi/core": ["@emnapi/core@1.8.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.1.0", "tslib": "^2.4.0" } }, "sha512-ryJnSmj4UhrGLZZPJ6PKVb4wNPAIkW6iyLy+0TRwazd3L1u0wzMe8RfqevAh2HbcSkoeLiSYnOVDOys4JSGYyg=="],
+    "@emnapi/core": ["@emnapi/core@1.8.1", "", { "dependencies": { "@emnapi/wasi-threads": "1.1.0", "tslib": "^2.4.0" } }, "sha512-AvT9QFpxK0Zd8J0jopedNm+w/2fIzvtPKPjqyw9jwvBaReTTqPBk9Hixaz7KbjimP+QNz605/XnjFcDAL2pqBg=="],
 
-    "@emnapi/runtime": ["@emnapi/runtime@1.8.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-Z82FDl1ByxqPEPrAYYeTQVlx2FSHPe1qwX465c+96IRS3fTdSYRoJcRxg3g2fEG5I69z1dSEWQlNRRr0/677mg=="],
+    "@emnapi/runtime": ["@emnapi/runtime@1.8.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-mehfKSMWjjNol8659Z8KxEMrdSJDDot5SXMq00dM8BN4o+CLNXQ0xH2V7EchNHV4RmbZLmmPdEaXZc5H2FXmDg=="],
 
     "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.1.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ=="],
 
@@ -251,13 +253,13 @@
 
     "@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.2", "", { "os": "win32", "cpu": "x64" }, "sha512-sRdU18mcKf7F+YgheI/zGf5alZatMUTKj/jNS6l744f9u3WFu4v7twcUI9vu4mknF4Y9aDlblIie0IM+5xxaqQ=="],
 
-    "@exodus/bytes": ["@exodus/bytes@1.8.0", "", { "peerDependencies": { "@exodus/crypto": "^1.0.0-rc.4" }, "optionalPeers": ["@exodus/crypto"] }, "sha512-8JPn18Bcp8Uo1T82gR8lh2guEOa5KKU/IEKvvdp0sgmi7coPBWf1Doi1EXsGZb2ehc8ym/StJCjffYV+ne7sXQ=="],
+    "@exodus/bytes": ["@exodus/bytes@1.11.0", "", { "peerDependencies": { "@noble/hashes": "^1.8.0 || ^2.0.0" }, "optionalPeers": ["@noble/hashes"] }, "sha512-wO3vd8nsEHdumsXrjGO/v4p6irbg7hy9kvIeR6i2AwylZSk4HJdWgL0FNaVquW1+AweJcdvU1IEpuIWk/WaPnA=="],
 
-    "@floating-ui/core": ["@floating-ui/core@1.7.3", "", { "dependencies": { "@floating-ui/utils": "^0.2.10" } }, "sha512-sGnvb5dmrJaKEZ+LDIpguvdX3bDlEllmv4/ClQ9awcmCZrlx5jQyyMWFM5kBI+EyNOCDDiKk8il0zeuX3Zlg/w=="],
+    "@floating-ui/core": ["@floating-ui/core@1.7.4", "", { "dependencies": { "@floating-ui/utils": "^0.2.10" } }, "sha512-C3HlIdsBxszvm5McXlB8PeOEWfBhcGBTZGkGlWc2U0KFY5IwG5OQEuQ8rq52DZmcHDlPLd+YFBK+cZcytwIFWg=="],
 
-    "@floating-ui/dom": ["@floating-ui/dom@1.7.4", "", { "dependencies": { "@floating-ui/core": "^1.7.3", "@floating-ui/utils": "^0.2.10" } }, "sha512-OOchDgh4F2CchOX94cRVqhvy7b3AFb+/rQXyswmzmGakRfkMgoWVjfnLWkRirfLEfuD4ysVW16eXzwt3jHIzKA=="],
+    "@floating-ui/dom": ["@floating-ui/dom@1.7.5", "", { "dependencies": { "@floating-ui/core": "^1.7.4", "@floating-ui/utils": "^0.2.10" } }, "sha512-N0bD2kIPInNHUHehXhMke1rBGs1dwqvC9O9KYMyyjK7iXt7GAhnro7UlcuYcGdS/yYOlq0MAVgrow8IbWJwyqg=="],
 
-    "@floating-ui/react-dom": ["@floating-ui/react-dom@2.1.6", "", { "dependencies": { "@floating-ui/dom": "^1.7.4" }, "peerDependencies": { "react": ">=16.8.0", "react-dom": ">=16.8.0" } }, "sha512-4JX6rEatQEvlmgU80wZyq9RT96HZJa88q8hp0pBd+LrczeDI4o6uA2M+uvxngVHo4Ihr8uibXxH6+70zhAFrVw=="],
+    "@floating-ui/react-dom": ["@floating-ui/react-dom@2.1.7", "", { "dependencies": { "@floating-ui/dom": "^1.7.5" }, "peerDependencies": { "react": ">=16.8.0", "react-dom": ">=16.8.0" } }, "sha512-0tLRojf/1Go2JgEVm+3Frg9A3IW8bJgKgdO0BN5RkF//ufuz2joZM63Npau2ff3J6lUVYgDSNzNkR+aH3IVfjg=="],
 
     "@floating-ui/utils": ["@floating-ui/utils@0.2.10", "", {}, "sha512-aGTxbpbg8/b5JfU1HXSrbH3wXZuLPJcNEcZQFMxLs3oSzgtVu6nFPkbbGGUvBcUjKV2YyB9Wxxabo+HEH9tcRQ=="],
 
@@ -299,97 +301,117 @@
 
     "@oslojs/encoding": ["@oslojs/encoding@1.1.0", "", {}, "sha512-70wQhgYmndg4GCPxPPxPGevRKqTIJ2Nh4OkiMWmDAVYsTQ+Ta7Sq+rPevXyXGdzr30/qZBnyOalCszoMxlyldQ=="],
 
-    "@oxc-minify/binding-android-arm64": ["@oxc-minify/binding-android-arm64@0.96.0", "", { "os": "android", "cpu": "arm64" }, "sha512-lzeIEMu/v6Y+La5JSesq4hvyKtKBq84cgQpKYTYM/yGuNk2tfd5Ha31hnC+mTh48lp/5vZH+WBfjVUjjINCfug=="],
+    "@oxc-minify/binding-android-arm-eabi": ["@oxc-minify/binding-android-arm-eabi@0.110.0", "", { "os": "android", "cpu": "arm" }, "sha512-43fMTO8/5bMlqfOiNSZNKUzIqeLIYuB9Hr1Ohyf58B1wU11S2dPGibTXOGNaWsfgHy99eeZ1bSgeIHy/fEYqbw=="],
 
-    "@oxc-minify/binding-darwin-arm64": ["@oxc-minify/binding-darwin-arm64@0.96.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-i0LkJAUXb4BeBFrJQbMKQPoxf8+cFEffDyLSb7NEzzKuPcH8qrVsnEItoOzeAdYam8Sr6qCHVwmBNEQzl7PWpw=="],
+    "@oxc-minify/binding-android-arm64": ["@oxc-minify/binding-android-arm64@0.110.0", "", { "os": "android", "cpu": "arm64" }, "sha512-5oQrnn9eK/ccOp80PTrNj0Vq893NPNNRryjGpOIVsYNgWFuoGCfpnKg68oEFcN8bArizYAqw4nvgHljEnar69w=="],
 
-    "@oxc-minify/binding-darwin-x64": ["@oxc-minify/binding-darwin-x64@0.96.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-C5vI0WPR+KPIFAD5LMOJk2J8iiT+Nv65vDXmemzXEXouzfEOLYNqnW+u6NSsccpuZHHWAiLyPFkYvKFduveAUQ=="],
+    "@oxc-minify/binding-darwin-arm64": ["@oxc-minify/binding-darwin-arm64@0.110.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-dqBDgTG9tF2z2lrZp9E8wU+Godz1i8gCGSei2eFKS2hRploBOD5dmOLp1j4IMornkPvSQmbwB3uSjPq7fjx4EA=="],
 
-    "@oxc-minify/binding-freebsd-x64": ["@oxc-minify/binding-freebsd-x64@0.96.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-3//5DNx+xUjVBMLLk2sl6hfe4fwfENJtjVQUBXjxzwPuv8xgZUqASG4cRG3WqG5Qe8dV6SbCI4EgKQFjO4KCZA=="],
+    "@oxc-minify/binding-darwin-x64": ["@oxc-minify/binding-darwin-x64@0.110.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-U0AqabqaooDOpYmeeOye8wClv8PSScELXgOfYqyqgrwH9J9KrpCE1jL8Rlqgz68QbL4mPw3V6sKiiHssI4CLeQ=="],
 
-    "@oxc-minify/binding-linux-arm-gnueabihf": ["@oxc-minify/binding-linux-arm-gnueabihf@0.96.0", "", { "os": "linux", "cpu": "arm" }, "sha512-WXChFKV7VdDk1NePDK1J31cpSvxACAVztJ7f7lJVYBTkH+iz5D0lCqPcE7a9eb7nC3xvz4yk7DM6dA9wlUQkQg=="],
+    "@oxc-minify/binding-freebsd-x64": ["@oxc-minify/binding-freebsd-x64@0.110.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-H0w8o/Wo1072WSdLfhwwrpFpwZnPpjQODlHuRYkTfsSSSJbTxQtjJd4uxk7YJsRv5RQp69y0I7zvdH6f8Xueyw=="],
 
-    "@oxc-minify/binding-linux-arm-musleabihf": ["@oxc-minify/binding-linux-arm-musleabihf@0.96.0", "", { "os": "linux", "cpu": "arm" }, "sha512-7B18glYMX4Z/YoqgE3VRLs/2YhVLxlxNKSgrtsRpuR8xv58xca+hEhiFwZN1Rn+NSMZ29Z33LWD7iYWnqYFvRA=="],
+    "@oxc-minify/binding-linux-arm-gnueabihf": ["@oxc-minify/binding-linux-arm-gnueabihf@0.110.0", "", { "os": "linux", "cpu": "arm" }, "sha512-qd6sW0AvEVYZhbVVMGtmKZw3b1zDYGIW+54Uh42moWRAj6i4Jhk/LGr6r9YNZpOINeuvZfkFuEeDD/jbu7xPUA=="],
 
-    "@oxc-minify/binding-linux-arm64-gnu": ["@oxc-minify/binding-linux-arm64-gnu@0.96.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-Yl+KcTldsEJNcaYxxonwAXZ2q3gxIzn3kXYQWgKWdaGIpNhOCWqF+KE5WLsldoh5Ro5SHtomvb8GM6cXrIBMog=="],
+    "@oxc-minify/binding-linux-arm-musleabihf": ["@oxc-minify/binding-linux-arm-musleabihf@0.110.0", "", { "os": "linux", "cpu": "arm" }, "sha512-7WXP0aXMrWSn0ScppUBi3jf68ebfBG0eri8kxLmBOVSBj6jw1repzkHMITJMBeLr5d0tT/51qFEptiAk2EP2iA=="],
 
-    "@oxc-minify/binding-linux-arm64-musl": ["@oxc-minify/binding-linux-arm64-musl@0.96.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-rNqoFWOWaxwMmUY5fspd/h5HfvgUlA3sv9CUdA2MpnHFiyoJNovR7WU8tGh+Yn0qOAs0SNH0a05gIthHig14IA=="],
+    "@oxc-minify/binding-linux-arm64-gnu": ["@oxc-minify/binding-linux-arm64-gnu@0.110.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-LYfADrq5x1W5gs+u9OIbMbDQNYkAECTXX0ufnAuf3oGmO51rF98kGFR5qJqC/6/csokDyT3wwTpxhE0TkcF/Og=="],
 
-    "@oxc-minify/binding-linux-riscv64-gnu": ["@oxc-minify/binding-linux-riscv64-gnu@0.96.0", "", { "os": "linux", "cpu": "none" }, "sha512-3paajIuzGnukHwSI3YBjYVqbd72pZd8NJxaayaNFR0AByIm8rmIT5RqFXbq8j2uhtpmNdZRXiu0em1zOmIScWA=="],
+    "@oxc-minify/binding-linux-arm64-musl": ["@oxc-minify/binding-linux-arm64-musl@0.110.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-53GjCVY8kvymk9P6qNDh6zyblcehF5QHstq9QgCjv13ONGRnSHjeds0PxIwiihD7h295bxsWs84DN39syLPH4Q=="],
 
-    "@oxc-minify/binding-linux-s390x-gnu": ["@oxc-minify/binding-linux-s390x-gnu@0.96.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-9ESrpkB2XG0lQ89JlsxlZa86iQCOs+jkDZLl6O+u5wb7ynUy21bpJJ1joauCOSYIOUlSy3+LbtJLiqi7oSQt5Q=="],
+    "@oxc-minify/binding-linux-ppc64-gnu": ["@oxc-minify/binding-linux-ppc64-gnu@0.110.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-li8XcN81dxbJDMBESnTgGhoiAQ+CNIdM0QGscZ4duVPjCry1RpX+5FJySFbGqG3pk4s9ZzlL/vtQtbRzZIZOzg=="],
 
-    "@oxc-minify/binding-linux-x64-gnu": ["@oxc-minify/binding-linux-x64-gnu@0.96.0", "", { "os": "linux", "cpu": "x64" }, "sha512-UMM1jkns+p+WwwmdjC5giI3SfR2BCTga18x3C0cAu6vDVf4W37uTZeTtSIGmwatTBbgiq++Te24/DE0oCdm1iQ=="],
+    "@oxc-minify/binding-linux-riscv64-gnu": ["@oxc-minify/binding-linux-riscv64-gnu@0.110.0", "", { "os": "linux", "cpu": "none" }, "sha512-SweKfsnLKShu6UFV8mwuj1d1wmlNoL/FlAxPUzwjEBgwiT2HQkY24KnjBH+TIA+//1O83kzmWKvvs4OuEhdIEQ=="],
 
-    "@oxc-minify/binding-linux-x64-musl": ["@oxc-minify/binding-linux-x64-musl@0.96.0", "", { "os": "linux", "cpu": "x64" }, "sha512-8b1naiC7MdP7xeMi7cQ5tb9W1rZAP9Qz/jBRqp1Y5EOZ1yhSGnf1QWuZ/0pCc+XiB9vEHXEY3Aki/H+86m2eOg=="],
+    "@oxc-minify/binding-linux-riscv64-musl": ["@oxc-minify/binding-linux-riscv64-musl@0.110.0", "", { "os": "linux", "cpu": "none" }, "sha512-oH8G4aFMP8XyTsEpdANC5PQyHgSeGlopHZuW1rpyYcaErg5YaK0vXjQ4EM5HVvPm+feBV24JjxgakTnZoF3aOQ=="],
 
-    "@oxc-minify/binding-wasm32-wasi": ["@oxc-minify/binding-wasm32-wasi@0.96.0", "", { "dependencies": { "@napi-rs/wasm-runtime": "^1.0.7" }, "cpu": "none" }, "sha512-bjGDjkGzo3GWU9Vg2qiFUrfoo5QxojPNV/2RHTlbIB5FWkkV4ExVjsfyqihFiAuj0NXIZqd2SAiEq9htVd3RFw=="],
+    "@oxc-minify/binding-linux-s390x-gnu": ["@oxc-minify/binding-linux-s390x-gnu@0.110.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-W9na+Vza7XVUlpf8wMt4QBfH35KeTENEmnpPUq3NSlbQHz8lSlSvhAafvo43NcKvHAXV3ckD/mUf2VkqSdbklg=="],
 
-    "@oxc-minify/binding-win32-arm64-msvc": ["@oxc-minify/binding-win32-arm64-msvc@0.96.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-4L4DlHUT47qMWQuTyUghpncR3NZHWtxvd0G1KgSjVgXf+cXzFdWQCWZZtCU0yrmOoVCNUf4S04IFCJyAe+Ie7A=="],
+    "@oxc-minify/binding-linux-x64-gnu": ["@oxc-minify/binding-linux-x64-gnu@0.110.0", "", { "os": "linux", "cpu": "x64" }, "sha512-XJdA4mmmXOjJxSRgNJXsDP7Xe8h3gQhmb56hUcCrvq5d+h5UcEi2pR8rxsdIrS8QmkLuBA3eHkGK8E27D7DTgQ=="],
 
-    "@oxc-minify/binding-win32-x64-msvc": ["@oxc-minify/binding-win32-x64-msvc@0.96.0", "", { "os": "win32", "cpu": "x64" }, "sha512-T2ijfqZLpV2bgGGocXV4SXTuMoouqN0asYTIm+7jVOLvT5XgDogf3ZvCmiEnSWmxl21+r5wHcs8voU2iUROXAg=="],
+    "@oxc-minify/binding-linux-x64-musl": ["@oxc-minify/binding-linux-x64-musl@0.110.0", "", { "os": "linux", "cpu": "x64" }, "sha512-QqzvALuOTtSckI8x467R4GNArzYDb/yEh6aNzLoeaY1O7vfT7SPDwlOEcchaTznutpeS9Dy8gUS/AfqtUHaufw=="],
 
-    "@oxc-transform/binding-android-arm64": ["@oxc-transform/binding-android-arm64@0.96.0", "", { "os": "android", "cpu": "arm64" }, "sha512-wOm+ZsqFvyZ7B9RefUMsj0zcXw77Z2pXA51nbSQyPXqr+g0/pDGxriZWP8Sdpz/e4AEaKPA9DvrwyOZxu7GRDQ=="],
+    "@oxc-minify/binding-openharmony-arm64": ["@oxc-minify/binding-openharmony-arm64@0.110.0", "", { "os": "none", "cpu": "arm64" }, "sha512-gAMssLs2Q3+uhLZxanh1DF+27Kaug3cf4PXb9AB7XK81DR+LVcKySXaoGYoOs20Co0fFSphd6rRzKge2qDK3dA=="],
 
-    "@oxc-transform/binding-darwin-arm64": ["@oxc-transform/binding-darwin-arm64@0.96.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-td1sbcvzsyuoNRiNdIRodPXRtFFwxzPpC/6/yIUtRRhKn30XQcizxupIvQQVpJWWchxkphbBDh6UN+u+2CJ8Zw=="],
+    "@oxc-minify/binding-wasm32-wasi": ["@oxc-minify/binding-wasm32-wasi@0.110.0", "", { "dependencies": { "@napi-rs/wasm-runtime": "^1.1.1" }, "cpu": "none" }, "sha512-7Wqi5Zjl022bs2zXq+ICdalDPeDuCH/Nhbi8q2isLihAonMVIT0YH2hqqnNEylRNGYck+FJ6gRZwMpGCgrNxPg=="],
 
-    "@oxc-transform/binding-darwin-x64": ["@oxc-transform/binding-darwin-x64@0.96.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-xgqxnqhPYH2NYkgbqtnCJfhbXvxIf/pnhF/ig5UBK8PYpCEWIP/cfLpQRQ9DcQnRfuxi7RMIF6LdmB1AiS6Fkg=="],
+    "@oxc-minify/binding-win32-arm64-msvc": ["@oxc-minify/binding-win32-arm64-msvc@0.110.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-ZPx+0Tj4dqn41ecyoGotlvekQKy6JxJCixn9Rw7h/dafZ3eDuBcEVh3c2ZoldXXsyMIt5ywI8IWzFZsjNedd5Q=="],
 
-    "@oxc-transform/binding-freebsd-x64": ["@oxc-transform/binding-freebsd-x64@0.96.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-1i67OXdl/rvSkcTXqDlh6qGRXYseEmf0rl/R+/i88scZ/o3A+FzlX56sThuaPzSSv9eVgesnoYUjIBJELFc1oA=="],
+    "@oxc-minify/binding-win32-ia32-msvc": ["@oxc-minify/binding-win32-ia32-msvc@0.110.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-H0Oyd3RWBfpEyvJIrFK94RYiY7KKSQl11Ym7LMDwLEagelIAfRCkt1amHZhFa/S3ZRoaOJFXzEw4YKeSsjVFsg=="],
 
-    "@oxc-transform/binding-linux-arm-gnueabihf": ["@oxc-transform/binding-linux-arm-gnueabihf@0.96.0", "", { "os": "linux", "cpu": "arm" }, "sha512-9MJBs0SWODsqyzO3eAnacXgJ/sZu1xqinjEwBzkcZ3tQI8nKhMADOzu2NzbVWDWujeoC8DESXaO08tujvUru+Q=="],
+    "@oxc-minify/binding-win32-x64-msvc": ["@oxc-minify/binding-win32-x64-msvc@0.110.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Hr3nK90+qXKJ2kepXwFIcNfQQIOBecB4FFCyaMMypthoEEhVP08heRynj4eSXZ8NL9hLjs3fQzH8PJXfpznRnQ=="],
 
-    "@oxc-transform/binding-linux-arm-musleabihf": ["@oxc-transform/binding-linux-arm-musleabihf@0.96.0", "", { "os": "linux", "cpu": "arm" }, "sha512-BQom57I2ScccixljNYh2Wy+5oVZtF1LXiiUPxSLtDHbsanpEvV/+kzCagQpTjk1BVzSQzOxfEUWjvL7mY53pRQ=="],
+    "@oxc-transform/binding-android-arm-eabi": ["@oxc-transform/binding-android-arm-eabi@0.110.0", "", { "os": "android", "cpu": "arm" }, "sha512-sE9dxvqqAax1YYJ3t7j+h5ZSI9jl6dYuDfngl6ieZUrIy5P89/8JKVgAzgp8o3wQSo7ndpJvYsi1K4ZqrmbP7w=="],
 
-    "@oxc-transform/binding-linux-arm64-gnu": ["@oxc-transform/binding-linux-arm64-gnu@0.96.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-kaqvUzNu8LL4aBSXqcqGVLFG13GmJEplRI2+yqzkgAItxoP/LfFMdEIErlTWLGyBwd0OLiNMHrOvkcCQRWadVg=="],
+    "@oxc-transform/binding-android-arm64": ["@oxc-transform/binding-android-arm64@0.110.0", "", { "os": "android", "cpu": "arm64" }, "sha512-nqtbP4aMCtsCZ6qpHlHaQoWVHSBtlKzwaAgwEOvR+9DWqHjk31BHvpGiDXlMeed6CVNpl3lCbWgygb3RcSjcfw=="],
 
-    "@oxc-transform/binding-linux-arm64-musl": ["@oxc-transform/binding-linux-arm64-musl@0.96.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-EiG/L3wEkPgTm4p906ufptyblBgtiQWTubGg/JEw82f8uLRroayr5zhbUqx40EgH037a3SfJthIyLZi7XPRFJw=="],
+    "@oxc-transform/binding-darwin-arm64": ["@oxc-transform/binding-darwin-arm64@0.110.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-oeSeHnL4Z4cMXtc8V0/rwoVn0dgwlS9q0j6LcHn9dIhtFEdp3W0iSBF8YmMQA+E7sILeLDjsHmHE4Kp0sOScXw=="],
 
-    "@oxc-transform/binding-linux-riscv64-gnu": ["@oxc-transform/binding-linux-riscv64-gnu@0.96.0", "", { "os": "linux", "cpu": "none" }, "sha512-r01CY6OxKGtVeYnvH4mGmtkQMlLkXdPWWNXwo5o7fE2s/fgZPMpqh8bAuXEhuMXipZRJrjxTk1+ZQ4KCHpMn3Q=="],
+    "@oxc-transform/binding-darwin-x64": ["@oxc-transform/binding-darwin-x64@0.110.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-nL9K5x7OuZydobAGPylsEW9d4APs2qEkIBLMgQPA+kY8dtVD3IR87QsTbs4l4DBQYyun/+ay6qVCDlxqxdX2Jg=="],
 
-    "@oxc-transform/binding-linux-s390x-gnu": ["@oxc-transform/binding-linux-s390x-gnu@0.96.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-4djg2vYLGbVeS8YiA2K4RPPpZE4fxTGCX5g/bOMbCYyirDbmBAIop4eOAj8vOA9i1CcWbDtmp+PVJ1dSw7f3IQ=="],
+    "@oxc-transform/binding-freebsd-x64": ["@oxc-transform/binding-freebsd-x64@0.110.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-GS29zXXirDQhZEUq8xKJ1azAWMuUy3Ih3W5Bc5ddk12LRthO5wRLFcKIyeHpAXCoXymQ+LmxbMtbPf84GPxouw=="],
 
-    "@oxc-transform/binding-linux-x64-gnu": ["@oxc-transform/binding-linux-x64-gnu@0.96.0", "", { "os": "linux", "cpu": "x64" }, "sha512-f6pcWVz57Y8jXa2OS7cz3aRNuks34Q3j61+3nQ4xTE8H1KbalcEvHNmM92OEddaJ8QLs9YcE0kUC6eDTbY34+A=="],
+    "@oxc-transform/binding-linux-arm-gnueabihf": ["@oxc-transform/binding-linux-arm-gnueabihf@0.110.0", "", { "os": "linux", "cpu": "arm" }, "sha512-glzDHak8ISyZJemCUi7RCvzNSl+MQ1ly9RceT2qRufhUsvNZ4C/2QLJ1HJwd2N6E88bO4laYn+RofdRzNnGGEA=="],
 
-    "@oxc-transform/binding-linux-x64-musl": ["@oxc-transform/binding-linux-x64-musl@0.96.0", "", { "os": "linux", "cpu": "x64" }, "sha512-NSiRtFvR7Pbhv3mWyPMkTK38czIjcnK0+K5STo3CuzZRVbX1TM17zGdHzKBUHZu7v6IQ6/XsQ3ELa1BlEHPGWQ=="],
+    "@oxc-transform/binding-linux-arm-musleabihf": ["@oxc-transform/binding-linux-arm-musleabihf@0.110.0", "", { "os": "linux", "cpu": "arm" }, "sha512-8JThvgJ2FRoTVfbp7e4wqeZqCZbtudM06SfZmNzND9kPNu/LVYygIR+72RWs+xm4bWkuYHg/islo/boNPtMT5Q=="],
 
-    "@oxc-transform/binding-wasm32-wasi": ["@oxc-transform/binding-wasm32-wasi@0.96.0", "", { "dependencies": { "@napi-rs/wasm-runtime": "^1.0.7" }, "cpu": "none" }, "sha512-A91ARLiuZHGN4hBds9s7bW3czUuLuHLsV+cz44iF9j8e1zX9m2hNGXf/acQRbg/zcFUXmjz5nmk8EkZyob876w=="],
+    "@oxc-transform/binding-linux-arm64-gnu": ["@oxc-transform/binding-linux-arm64-gnu@0.110.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-IRh21Ub/g4bkHoErZ0AUWMlWfoZaS0A6EaOVtbcY70RSYIMlrsbjiFwJCzM+b/1DD1rXbH5tsGcH7GweTbfRqg=="],
 
-    "@oxc-transform/binding-win32-arm64-msvc": ["@oxc-transform/binding-win32-arm64-msvc@0.96.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-IedJf40djKgDObomhYjdRAlmSYUEdfqX3A3M9KfUltl9AghTBBLkTzUMA7O09oo71vYf5TEhbFM7+Vn5vqw7AQ=="],
+    "@oxc-transform/binding-linux-arm64-musl": ["@oxc-transform/binding-linux-arm64-musl@0.110.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-e5JN94/oy+wevk76q+LMr+2klTTcO60uXa+Wkq558Ms7mdF2TvkKFI++d/JeiuIwJLTi/BxQ4qdT5FWcsHM/ug=="],
 
-    "@oxc-transform/binding-win32-x64-msvc": ["@oxc-transform/binding-win32-x64-msvc@0.96.0", "", { "os": "win32", "cpu": "x64" }, "sha512-0fI0P0W7bSO/GCP/N5dkmtB9vBqCA4ggo1WmXTnxNJVmFFOtcA1vYm1I9jl8fxo+sucW2WnlpnI4fjKdo3JKxA=="],
+    "@oxc-transform/binding-linux-ppc64-gnu": ["@oxc-transform/binding-linux-ppc64-gnu@0.110.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-Y3/Tnnz1GvDpmv8FXBIKtdZPsdZklOEPdrL6NHrN5i2u54BOkybFaDSptgWF53wOrJlTrcmAVSE6fRKK9XCM2Q=="],
 
-    "@oxlint-tsgolint/darwin-arm64": ["@oxlint-tsgolint/darwin-arm64@0.11.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-UJIOFeJZpFTJIGS+bMdFXcvjslvnXBEouMvzynfQD7RTazcFIRLbokYgEbhrN2P6B352Ut1TUtvR0CLAp/9QfA=="],
+    "@oxc-transform/binding-linux-riscv64-gnu": ["@oxc-transform/binding-linux-riscv64-gnu@0.110.0", "", { "os": "linux", "cpu": "none" }, "sha512-Y0E35iA9/v9jlkNcP6tMJ+ZFOS0rLsWDqG6rU9z+X2R3fBFJBO9UARIK6ngx8upxk81y1TFR2CmBFhupfYdH6Q=="],
 
-    "@oxlint-tsgolint/darwin-x64": ["@oxlint-tsgolint/darwin-x64@0.11.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-68O8YvexIm+ISZKl2vBFII1dMfLrteDyPcuCIecDuiBIj2tV0KYq13zpSCMz4dvJUWJW6RmOOGZKrkkvOAy6uQ=="],
+    "@oxc-transform/binding-linux-riscv64-musl": ["@oxc-transform/binding-linux-riscv64-musl@0.110.0", "", { "os": "linux", "cpu": "none" }, "sha512-JOUSYFfHjBUs7xp2FHmZHb8eTYD/oEu0NklS6JgUauqnoXZHiTLPLVW2o2uVCqldnabYHcomuwI2iqVFYJNhTw=="],
 
-    "@oxlint-tsgolint/linux-arm64": ["@oxlint-tsgolint/linux-arm64@0.11.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-hXBInrFxPNbPPbPQYozo8YpSsFFYdtHBWRUiLMxul71vTy1CdSA7H5Qq2KbrKomr/ASmhvIDVAQZxh9hIJNHMA=="],
+    "@oxc-transform/binding-linux-s390x-gnu": ["@oxc-transform/binding-linux-s390x-gnu@0.110.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-7blgoXF9D3Ngzb7eun23pNrHJpoV/TtE6LObwlZ3Nmb4oZ6Z+yMvBVaoW68NarbmvNGfZ95zrOjgm6cVETLYBA=="],
 
-    "@oxlint-tsgolint/linux-x64": ["@oxlint-tsgolint/linux-x64@0.11.1", "", { "os": "linux", "cpu": "x64" }, "sha512-aMaGctlwrJhaIQPOdVJR+AGHZGPm4D1pJ457l0SqZt4dLXAhuUt2ene6cUUGF+864R7bDyFVGZqbZHODYpENyA=="],
+    "@oxc-transform/binding-linux-x64-gnu": ["@oxc-transform/binding-linux-x64-gnu@0.110.0", "", { "os": "linux", "cpu": "x64" }, "sha512-YQ2joGWCVDZVEU2cD/r/w49hVjDm/Qu1BvC/7zs8LvprzdLS/HyMXGF2oA0puw0b+AqgYaz3bhwKB2xexHyITQ=="],
 
-    "@oxlint-tsgolint/win32-arm64": ["@oxlint-tsgolint/win32-arm64@0.11.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-ipOs6kKo8fz5n5LSHvcbyZFmEpEIsh2m7+B03RW3jGjBEPMiXb4PfKNuxnusFYTtJM9WaR3bCVm5UxeJTA8r3w=="],
+    "@oxc-transform/binding-linux-x64-musl": ["@oxc-transform/binding-linux-x64-musl@0.110.0", "", { "os": "linux", "cpu": "x64" }, "sha512-fkjr5qE632ULmNgvFXWDR/8668WxERz3tU7TQFp6JebPBneColitjSkdx6VKNVXEoMmQnOvBIGeP5tUNT384oA=="],
 
-    "@oxlint-tsgolint/win32-x64": ["@oxlint-tsgolint/win32-x64@0.11.1", "", { "os": "win32", "cpu": "x64" }, "sha512-m2apsAXg6qU3ulQG45W/qshyEpOjoL+uaQyXJG5dBoDoa66XPtCaSkBlKltD0EwGu0aoB8lM4I5I3OzQ6raNhw=="],
+    "@oxc-transform/binding-openharmony-arm64": ["@oxc-transform/binding-openharmony-arm64@0.110.0", "", { "os": "none", "cpu": "arm64" }, "sha512-HWH9Zj+lMrdSTqFRCZsvDWMz7OnMjbdGsm3xURXWfRZpuaz0bVvyuZNDQXc4FyyhRDsemICaJbU1bgeIpUJDGw=="],
 
-    "@oxlint/darwin-arm64": ["@oxlint/darwin-arm64@1.39.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-lT3hNhIa02xCujI6YGgjmYGg3Ht/X9ag5ipUVETaMpx5Rd4BbTNWUPif1WN1YZHxt3KLCIqaAe7zVhatv83HOQ=="],
+    "@oxc-transform/binding-wasm32-wasi": ["@oxc-transform/binding-wasm32-wasi@0.110.0", "", { "dependencies": { "@napi-rs/wasm-runtime": "^1.1.1" }, "cpu": "none" }, "sha512-ejdxHmYfIcHDPhZUe3WklViLt9mDEJE5BzcW7+R1vc5i/5JFA8D0l7NUSsHBJ7FB8Bu9gF+5iMDm6cXGAgaghw=="],
 
-    "@oxlint/darwin-x64": ["@oxlint/darwin-x64@1.39.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-UT+rfTWd+Yr7iJeSLd/7nF8X4gTYssKh+n77hxl6Oilp3NnG1CKRHxZDy3o3lIBnwgzJkdyUAiYWO1bTMXQ1lA=="],
+    "@oxc-transform/binding-win32-arm64-msvc": ["@oxc-transform/binding-win32-arm64-msvc@0.110.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-9VTwpXCZs7xkV+mKhQ62dVk7KLnLXtEUxNS2T4nLz3iMl1IJbA4h5oltK0JoobtiUAnbkV53QmMVGW8+Nh3bDQ=="],
 
-    "@oxlint/linux-arm64-gnu": ["@oxlint/linux-arm64-gnu@1.39.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-qocBkvS2V6rH0t9AT3DfQunMnj3xkM7srs5/Ycj2j5ZqMoaWd/FxHNVJDFP++35roKSvsRJoS0mtA8/77jqm6Q=="],
+    "@oxc-transform/binding-win32-ia32-msvc": ["@oxc-transform/binding-win32-ia32-msvc@0.110.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-5y0fzuNON7/F2hh2P94vANFaRPJ/3DI1hVl5rseCT8VUVqOGIjWaza0YS/D1g6t1WwycW2LWDMi2raOKoWU5GQ=="],
 
-    "@oxlint/linux-arm64-musl": ["@oxlint/linux-arm64-musl@1.39.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-arZzAc1PPcz9epvGBBCMHICeyQloKtHX3eoOe62B3Dskn7gf6Q14wnDHr1r9Vp4vtcBATNq6HlKV14smdlC/qA=="],
+    "@oxc-transform/binding-win32-x64-msvc": ["@oxc-transform/binding-win32-x64-msvc@0.110.0", "", { "os": "win32", "cpu": "x64" }, "sha512-QROrowwlrApI1fEScMknGWKM6GTM/Z2xwMnDqvSaEmzNazBsDUlE08Jasw610hFEsYAVU2K5sp/YaCa9ORdP4A=="],
 
-    "@oxlint/linux-x64-gnu": ["@oxlint/linux-x64-gnu@1.39.0", "", { "os": "linux", "cpu": "x64" }, "sha512-ZVt5qsECpuNprdWxAPpDBwoixr1VTcZ4qAEQA2l/wmFyVPDYFD3oBY/SWACNnWBddMrswjTg9O8ALxYWoEpmXw=="],
+    "@oxlint-tsgolint/darwin-arm64": ["@oxlint-tsgolint/darwin-arm64@0.11.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-IhdhiC183s5wdFDZSQC8PaFFq1QROiVT5ahz7ysgEKVnkNDjy82ieM7ZKiUfm2ncXNX2RcFGSSZrQO6plR+VAQ=="],
 
-    "@oxlint/linux-x64-musl": ["@oxlint/linux-x64-musl@1.39.0", "", { "os": "linux", "cpu": "x64" }, "sha512-pB0hlGyKPbxr9NMIV783lD6cWL3MpaqnZRM9MWni4yBdHPTKyFNYdg5hGD0Bwg+UP4S2rOevq/+OO9x9Bi7E6g=="],
+    "@oxlint-tsgolint/darwin-x64": ["@oxlint-tsgolint/darwin-x64@0.11.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-KJmBg10Z1uGpJqxDzETXOytYyeVrKUepo8rCXeVkRlZ2QzZqMElgalFN4BI3ccgIPkQpzzu4SVzWNFz7yiKavQ=="],
 
-    "@oxlint/win32-arm64": ["@oxlint/win32-arm64@1.39.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-Gg2SFaJohI9+tIQVKXlPw3FsPQFi/eCSWiCgwPtPn5uzQxHRTeQEZKuluz1fuzR5U70TXubb2liZi4Dgl8LJQA=="],
+    "@oxlint-tsgolint/linux-arm64": ["@oxlint-tsgolint/linux-arm64@0.11.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-P6I3dSSpoEnjFzTMlrbcBHNbErSxceZmcVUslBxrrIUH1NSVS1XfSz6S75vT2Gay7Jv6LI7zTTVAk4cSqkfe+w=="],
 
-    "@oxlint/win32-x64": ["@oxlint/win32-x64@1.39.0", "", { "os": "win32", "cpu": "x64" }, "sha512-sbi25lfj74hH+6qQtb7s1wEvd1j8OQbTaH8v3xTcDjrwm579Cyh0HBv1YSZ2+gsnVwfVDiCTL1D0JsNqYXszVA=="],
+    "@oxlint-tsgolint/linux-x64": ["@oxlint-tsgolint/linux-x64@0.11.4", "", { "os": "linux", "cpu": "x64" }, "sha512-G0eAW3S7cp/vP7Kx6e7+Ze7WfNgSt1tc/rOexfLKnnIi+9BelyOa2wF9bWFPpxk3n3AdkBwKttU1/adDZlD87Q=="],
+
+    "@oxlint-tsgolint/win32-arm64": ["@oxlint-tsgolint/win32-arm64@0.11.4", "", { "os": "win32", "cpu": "arm64" }, "sha512-prgQEBiwp4TAxarh6dYbVOKw6riRJ6hB49vDD6DxQlOZQky7xHQ9qTec5/rf0JTUZ16YaJ9YfHycbJS3QVpTYw=="],
+
+    "@oxlint-tsgolint/win32-x64": ["@oxlint-tsgolint/win32-x64@0.11.4", "", { "os": "win32", "cpu": "x64" }, "sha512-5xXTzZIT/1meWMmS60Q+FYWvWncc6iTfC8tyQt7GDfPUoqQvE5WVgHm1QjDSJvxTD+6AHphpCqdhXq/KtxagRw=="],
+
+    "@oxlint/darwin-arm64": ["@oxlint/darwin-arm64@1.42.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-ui5CdAcDsXPQwZQEXOOSWsilJWhgj9jqHCvYBm2tDE8zfwZZuF9q58+hGKH1x5y0SV4sRlyobB2Quq6uU6EgeA=="],
+
+    "@oxlint/darwin-x64": ["@oxlint/darwin-x64@1.42.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-wo0M/hcpHRv7vFje99zHHqheOhVEwUOKjOgBKyi0M99xcLizv04kcSm1rTd6HSCeZgOtiJYZRVAlKhQOQw2byQ=="],
+
+    "@oxlint/linux-arm64-gnu": ["@oxlint/linux-arm64-gnu@1.42.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-j4QzfCM8ks+OyM+KKYWDiBEQsm5RCW50H1Wz16wUyoFsobJ+X5qqcJxq6HvkE07m8euYmZelyB0WqsiDoz1v8g=="],
+
+    "@oxlint/linux-arm64-musl": ["@oxlint/linux-arm64-musl@1.42.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-g5b1Uw7zo6yw4Ymzyd1etKzAY7xAaGA3scwB8tAp3QzuY7CYdfTwlhiLKSAKbd7T/JBgxOXAGNcLDorJyVTXcg=="],
+
+    "@oxlint/linux-x64-gnu": ["@oxlint/linux-x64-gnu@1.42.0", "", { "os": "linux", "cpu": "x64" }, "sha512-HnD99GD9qAbpV4q9iQil7mXZUJFpoBdDavfcC2CgGLPlawfcV5COzQPNwOgvPVkr7C0cBx6uNCq3S6r9IIiEIg=="],
+
+    "@oxlint/linux-x64-musl": ["@oxlint/linux-x64-musl@1.42.0", "", { "os": "linux", "cpu": "x64" }, "sha512-8NTe8A78HHFn+nBi+8qMwIjgv9oIBh+9zqCPNLH56ah4vKOPvbePLI6NIv9qSkmzrBuu8SB+FJ2TH/G05UzbNA=="],
+
+    "@oxlint/win32-arm64": ["@oxlint/win32-arm64@1.42.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-lAPS2YAuu+qFqoTNPFcNsxXjwSV0M+dOgAzzVTAN7Yo2ifj+oLOx0GsntWoM78PvQWI7Q827ZxqtU2ImBmDapA=="],
+
+    "@oxlint/win32-x64": ["@oxlint/win32-x64@1.42.0", "", { "os": "win32", "cpu": "x64" }, "sha512-3/KmyUOHNriL6rLpaFfm9RJxdhpXY2/Ehx9UuorJr2pUA+lrZL15FAEx/DOszYm5r10hfzj40+efAHcCilNvSQ=="],
 
     "@panva/hkdf": ["@panva/hkdf@1.2.1", "", {}, "sha512-6oclG6Y3PiDFcoyk8srjLfVKyMfVCKJ27JwNPViuXziFpmdz+MZnZN/aKY0JGXgYuO/VghU0jcOAZgWXZ1Dmrw=="],
 
-    "@playwright/test": ["@playwright/test@1.57.0", "", { "dependencies": { "playwright": "1.57.0" }, "bin": { "playwright": "cli.js" } }, "sha512-6TyEnHgd6SArQO8UO2OMTxshln3QMWBtPGrOCgs3wVEmQmwyuNtB10IZMfmYDE0riwNR1cu4q+pPcxMVtaG3TA=="],
+    "@playwright/test": ["@playwright/test@1.58.1", "", { "dependencies": { "playwright": "1.58.1" }, "bin": { "playwright": "cli.js" } }, "sha512-6LdVIUERWxQMmUSSQi0I53GgCBYgM2RpGngCPY7hSeju+VrKjq3lvs7HpJoPbDiY5QM5EYRtRX5fvrinnMAz3w=="],
 
     "@radix-ui/primitive": ["@radix-ui/primitive@1.1.3", "", {}, "sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg=="],
 
@@ -451,49 +473,55 @@
 
     "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-beta.53", "", {}, "sha512-vENRlFU4YbrwVqNDZ7fLvy+JR1CRkyr01jhSiDpE1u6py3OMzQfztQU2jxykW3ALNxO4kSlqIDeYyD0Y9RcQeQ=="],
 
-    "@rollup/rollup-android-arm-eabi": ["@rollup/rollup-android-arm-eabi@4.54.0", "", { "os": "android", "cpu": "arm" }, "sha512-OywsdRHrFvCdvsewAInDKCNyR3laPA2mc9bRYJ6LBp5IyvF3fvXbbNR0bSzHlZVFtn6E0xw2oZlyjg4rKCVcng=="],
+    "@rollup/rollup-android-arm-eabi": ["@rollup/rollup-android-arm-eabi@4.57.0", "", { "os": "android", "cpu": "arm" }, "sha512-tPgXB6cDTndIe1ah7u6amCI1T0SsnlOuKgg10Xh3uizJk4e5M1JGaUMk7J4ciuAUcFpbOiNhm2XIjP9ON0dUqA=="],
 
-    "@rollup/rollup-android-arm64": ["@rollup/rollup-android-arm64@4.54.0", "", { "os": "android", "cpu": "arm64" }, "sha512-Skx39Uv+u7H224Af+bDgNinitlmHyQX1K/atIA32JP3JQw6hVODX5tkbi2zof/E69M1qH2UoN3Xdxgs90mmNYw=="],
+    "@rollup/rollup-android-arm64": ["@rollup/rollup-android-arm64@4.57.0", "", { "os": "android", "cpu": "arm64" }, "sha512-sa4LyseLLXr1onr97StkU1Nb7fWcg6niokTwEVNOO7awaKaoRObQ54+V/hrF/BP1noMEaaAW6Fg2d/CfLiq3Mg=="],
 
-    "@rollup/rollup-darwin-arm64": ["@rollup/rollup-darwin-arm64@4.54.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-k43D4qta/+6Fq+nCDhhv9yP2HdeKeP56QrUUTW7E6PhZP1US6NDqpJj4MY0jBHlJivVJD5P8NxrjuobZBJTCRw=="],
+    "@rollup/rollup-darwin-arm64": ["@rollup/rollup-darwin-arm64@4.57.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-/NNIj9A7yLjKdmkx5dC2XQ9DmjIECpGpwHoGmA5E1AhU0fuICSqSWScPhN1yLCkEdkCwJIDu2xIeLPs60MNIVg=="],
 
-    "@rollup/rollup-darwin-x64": ["@rollup/rollup-darwin-x64@4.54.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-cOo7biqwkpawslEfox5Vs8/qj83M/aZCSSNIWpVzfU2CYHa2G3P1UN5WF01RdTHSgCkri7XOlTdtk17BezlV3A=="],
+    "@rollup/rollup-darwin-x64": ["@rollup/rollup-darwin-x64@4.57.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-xoh8abqgPrPYPr7pTYipqnUi1V3em56JzE/HgDgitTqZBZ3yKCWI+7KUkceM6tNweyUKYru1UMi7FC060RyKwA=="],
 
-    "@rollup/rollup-freebsd-arm64": ["@rollup/rollup-freebsd-arm64@4.54.0", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-miSvuFkmvFbgJ1BevMa4CPCFt5MPGw094knM64W9I0giUIMMmRYcGW/JWZDriaw/k1kOBtsWh1z6nIFV1vPNtA=="],
+    "@rollup/rollup-freebsd-arm64": ["@rollup/rollup-freebsd-arm64@4.57.0", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-PCkMh7fNahWSbA0OTUQ2OpYHpjZZr0hPr8lId8twD7a7SeWrvT3xJVyza+dQwXSSq4yEQTMoXgNOfMCsn8584g=="],
 
-    "@rollup/rollup-freebsd-x64": ["@rollup/rollup-freebsd-x64@4.54.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-KGXIs55+b/ZfZsq9aR026tmr/+7tq6VG6MsnrvF4H8VhwflTIuYh+LFUlIsRdQSgrgmtM3fVATzEAj4hBQlaqQ=="],
+    "@rollup/rollup-freebsd-x64": ["@rollup/rollup-freebsd-x64@4.57.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-1j3stGx+qbhXql4OCDZhnK7b01s6rBKNybfsX+TNrEe9JNq4DLi1yGiR1xW+nL+FNVvI4D02PUnl6gJ/2y6WJA=="],
 
-    "@rollup/rollup-linux-arm-gnueabihf": ["@rollup/rollup-linux-arm-gnueabihf@4.54.0", "", { "os": "linux", "cpu": "arm" }, "sha512-EHMUcDwhtdRGlXZsGSIuXSYwD5kOT9NVnx9sqzYiwAc91wfYOE1g1djOEDseZJKKqtHAHGwnGPQu3kytmfaXLQ=="],
+    "@rollup/rollup-linux-arm-gnueabihf": ["@rollup/rollup-linux-arm-gnueabihf@4.57.0", "", { "os": "linux", "cpu": "arm" }, "sha512-eyrr5W08Ms9uM0mLcKfM/Uzx7hjhz2bcjv8P2uynfj0yU8GGPdz8iYrBPhiLOZqahoAMB8ZiolRZPbbU2MAi6Q=="],
 
-    "@rollup/rollup-linux-arm-musleabihf": ["@rollup/rollup-linux-arm-musleabihf@4.54.0", "", { "os": "linux", "cpu": "arm" }, "sha512-+pBrqEjaakN2ySv5RVrj/qLytYhPKEUwk+e3SFU5jTLHIcAtqh2rLrd/OkbNuHJpsBgxsD8ccJt5ga/SeG0JmA=="],
+    "@rollup/rollup-linux-arm-musleabihf": ["@rollup/rollup-linux-arm-musleabihf@4.57.0", "", { "os": "linux", "cpu": "arm" }, "sha512-Xds90ITXJCNyX9pDhqf85MKWUI4lqjiPAipJ8OLp8xqI2Ehk+TCVhF9rvOoN8xTbcafow3QOThkNnrM33uCFQA=="],
 
-    "@rollup/rollup-linux-arm64-gnu": ["@rollup/rollup-linux-arm64-gnu@4.54.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-NSqc7rE9wuUaRBsBp5ckQ5CVz5aIRKCwsoa6WMF7G01sX3/qHUw/z4pv+D+ahL1EIKy6Enpcnz1RY8pf7bjwng=="],
+    "@rollup/rollup-linux-arm64-gnu": ["@rollup/rollup-linux-arm64-gnu@4.57.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-Xws2KA4CLvZmXjy46SQaXSejuKPhwVdaNinldoYfqruZBaJHqVo6hnRa8SDo9z7PBW5x84SH64+izmldCgbezw=="],
 
-    "@rollup/rollup-linux-arm64-musl": ["@rollup/rollup-linux-arm64-musl@4.54.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-gr5vDbg3Bakga5kbdpqx81m2n9IX8M6gIMlQQIXiLTNeQW6CucvuInJ91EuCJ/JYvc+rcLLsDFcfAD1K7fMofg=="],
+    "@rollup/rollup-linux-arm64-musl": ["@rollup/rollup-linux-arm64-musl@4.57.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-hrKXKbX5FdaRJj7lTMusmvKbhMJSGWJ+w++4KmjiDhpTgNlhYobMvKfDoIWecy4O60K6yA4SnztGuNTQF+Lplw=="],
 
-    "@rollup/rollup-linux-loong64-gnu": ["@rollup/rollup-linux-loong64-gnu@4.54.0", "", { "os": "linux", "cpu": "none" }, "sha512-gsrtB1NA3ZYj2vq0Rzkylo9ylCtW/PhpLEivlgWe0bpgtX5+9j9EZa0wtZiCjgu6zmSeZWyI/e2YRX1URozpIw=="],
+    "@rollup/rollup-linux-loong64-gnu": ["@rollup/rollup-linux-loong64-gnu@4.57.0", "", { "os": "linux", "cpu": "none" }, "sha512-6A+nccfSDGKsPm00d3xKcrsBcbqzCTAukjwWK6rbuAnB2bHaL3r9720HBVZ/no7+FhZLz/U3GwwZZEh6tOSI8Q=="],
 
-    "@rollup/rollup-linux-ppc64-gnu": ["@rollup/rollup-linux-ppc64-gnu@4.54.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-y3qNOfTBStmFNq+t4s7Tmc9hW2ENtPg8FeUD/VShI7rKxNW7O4fFeaYbMsd3tpFlIg1Q8IapFgy7Q9i2BqeBvA=="],
+    "@rollup/rollup-linux-loong64-musl": ["@rollup/rollup-linux-loong64-musl@4.57.0", "", { "os": "linux", "cpu": "none" }, "sha512-4P1VyYUe6XAJtQH1Hh99THxr0GKMMwIXsRNOceLrJnaHTDgk1FTcTimDgneRJPvB3LqDQxUmroBclQ1S0cIJwQ=="],
 
-    "@rollup/rollup-linux-riscv64-gnu": ["@rollup/rollup-linux-riscv64-gnu@4.54.0", "", { "os": "linux", "cpu": "none" }, "sha512-89sepv7h2lIVPsFma8iwmccN7Yjjtgz0Rj/Ou6fEqg3HDhpCa+Et+YSufy27i6b0Wav69Qv4WBNl3Rs6pwhebQ=="],
+    "@rollup/rollup-linux-ppc64-gnu": ["@rollup/rollup-linux-ppc64-gnu@4.57.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-8Vv6pLuIZCMcgXre6c3nOPhE0gjz1+nZP6T+hwWjr7sVH8k0jRkH+XnfjjOTglyMBdSKBPPz54/y1gToSKwrSQ=="],
 
-    "@rollup/rollup-linux-riscv64-musl": ["@rollup/rollup-linux-riscv64-musl@4.54.0", "", { "os": "linux", "cpu": "none" }, "sha512-ZcU77ieh0M2Q8Ur7D5X7KvK+UxbXeDHwiOt/CPSBTI1fBmeDMivW0dPkdqkT4rOgDjrDDBUed9x4EgraIKoR2A=="],
+    "@rollup/rollup-linux-ppc64-musl": ["@rollup/rollup-linux-ppc64-musl@4.57.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-r1te1M0Sm2TBVD/RxBPC6RZVwNqUTwJTA7w+C/IW5v9Ssu6xmxWEi+iJQlpBhtUiT1raJ5b48pI8tBvEjEFnFA=="],
 
-    "@rollup/rollup-linux-s390x-gnu": ["@rollup/rollup-linux-s390x-gnu@4.54.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-2AdWy5RdDF5+4YfG/YesGDDtbyJlC9LHmL6rZw6FurBJ5n4vFGupsOBGfwMRjBYH7qRQowT8D/U4LoSvVwOhSQ=="],
+    "@rollup/rollup-linux-riscv64-gnu": ["@rollup/rollup-linux-riscv64-gnu@4.57.0", "", { "os": "linux", "cpu": "none" }, "sha512-say0uMU/RaPm3CDQLxUUTF2oNWL8ysvHkAjcCzV2znxBr23kFfaxocS9qJm+NdkRhF8wtdEEAJuYcLPhSPbjuQ=="],
 
-    "@rollup/rollup-linux-x64-gnu": ["@rollup/rollup-linux-x64-gnu@4.54.0", "", { "os": "linux", "cpu": "x64" }, "sha512-WGt5J8Ij/rvyqpFexxk3ffKqqbLf9AqrTBbWDk7ApGUzaIs6V+s2s84kAxklFwmMF/vBNGrVdYgbblCOFFezMQ=="],
+    "@rollup/rollup-linux-riscv64-musl": ["@rollup/rollup-linux-riscv64-musl@4.57.0", "", { "os": "linux", "cpu": "none" }, "sha512-/MU7/HizQGsnBREtRpcSbSV1zfkoxSTR7wLsRmBPQ8FwUj5sykrP1MyJTvsxP5KBq9SyE6kH8UQQQwa0ASeoQQ=="],
 
-    "@rollup/rollup-linux-x64-musl": ["@rollup/rollup-linux-x64-musl@4.54.0", "", { "os": "linux", "cpu": "x64" }, "sha512-JzQmb38ATzHjxlPHuTH6tE7ojnMKM2kYNzt44LO/jJi8BpceEC8QuXYA908n8r3CNuG/B3BV8VR3Hi1rYtmPiw=="],
+    "@rollup/rollup-linux-s390x-gnu": ["@rollup/rollup-linux-s390x-gnu@4.57.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-Q9eh+gUGILIHEaJf66aF6a414jQbDnn29zeu0eX3dHMuysnhTvsUvZTCAyZ6tJhUjnvzBKE4FtuaYxutxRZpOg=="],
 
-    "@rollup/rollup-openharmony-arm64": ["@rollup/rollup-openharmony-arm64@4.54.0", "", { "os": "none", "cpu": "arm64" }, "sha512-huT3fd0iC7jigGh7n3q/+lfPcXxBi+om/Rs3yiFxjvSxbSB6aohDFXbWvlspaqjeOh+hx7DDHS+5Es5qRkWkZg=="],
+    "@rollup/rollup-linux-x64-gnu": ["@rollup/rollup-linux-x64-gnu@4.57.0", "", { "os": "linux", "cpu": "x64" }, "sha512-OR5p5yG5OKSxHReWmwvM0P+VTPMwoBS45PXTMYaskKQqybkS3Kmugq1W+YbNWArF8/s7jQScgzXUhArzEQ7x0A=="],
 
-    "@rollup/rollup-win32-arm64-msvc": ["@rollup/rollup-win32-arm64-msvc@4.54.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-c2V0W1bsKIKfbLMBu/WGBz6Yci8nJ/ZJdheE0EwB73N3MvHYKiKGs3mVilX4Gs70eGeDaMqEob25Tw2Gb9Nqyw=="],
+    "@rollup/rollup-linux-x64-musl": ["@rollup/rollup-linux-x64-musl@4.57.0", "", { "os": "linux", "cpu": "x64" }, "sha512-XeatKzo4lHDsVEbm1XDHZlhYZZSQYym6dg2X/Ko0kSFgio+KXLsxwJQprnR48GvdIKDOpqWqssC3iBCjoMcMpw=="],
 
-    "@rollup/rollup-win32-ia32-msvc": ["@rollup/rollup-win32-ia32-msvc@4.54.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-woEHgqQqDCkAzrDhvDipnSirm5vxUXtSKDYTVpZG3nUdW/VVB5VdCYA2iReSj/u3yCZzXID4kuKG7OynPnB3WQ=="],
+    "@rollup/rollup-openbsd-x64": ["@rollup/rollup-openbsd-x64@4.57.0", "", { "os": "openbsd", "cpu": "x64" }, "sha512-Lu71y78F5qOfYmubYLHPcJm74GZLU6UJ4THkf/a1K7Tz2ycwC2VUbsqbJAXaR6Bx70SRdlVrt2+n5l7F0agTUw=="],
 
-    "@rollup/rollup-win32-x64-gnu": ["@rollup/rollup-win32-x64-gnu@4.54.0", "", { "os": "win32", "cpu": "x64" }, "sha512-dzAc53LOuFvHwbCEOS0rPbXp6SIhAf2txMP5p6mGyOXXw5mWY8NGGbPMPrs4P1WItkfApDathBj/NzMLUZ9rtQ=="],
+    "@rollup/rollup-openharmony-arm64": ["@rollup/rollup-openharmony-arm64@4.57.0", "", { "os": "none", "cpu": "arm64" }, "sha512-v5xwKDWcu7qhAEcsUubiav7r+48Uk/ENWdr82MBZZRIm7zThSxCIVDfb3ZeRRq9yqk+oIzMdDo6fCcA5DHfMyA=="],
 
-    "@rollup/rollup-win32-x64-msvc": ["@rollup/rollup-win32-x64-msvc@4.54.0", "", { "os": "win32", "cpu": "x64" }, "sha512-hYT5d3YNdSh3mbCU1gwQyPgQd3T2ne0A3KG8KSBdav5TiBg6eInVmV+TeR5uHufiIgSFg0XsOWGW5/RhNcSvPg=="],
+    "@rollup/rollup-win32-arm64-msvc": ["@rollup/rollup-win32-arm64-msvc@4.57.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-XnaaaSMGSI6Wk8F4KK3QP7GfuuhjGchElsVerCplUuxRIzdvZ7hRBpLR0omCmw+kI2RFJB80nenhOoGXlJ5TfQ=="],
+
+    "@rollup/rollup-win32-ia32-msvc": ["@rollup/rollup-win32-ia32-msvc@4.57.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-3K1lP+3BXY4t4VihLw5MEg6IZD3ojSYzqzBG571W3kNQe4G4CcFpSUQVgurYgib5d+YaCjeFow8QivWp8vuSvA=="],
+
+    "@rollup/rollup-win32-x64-gnu": ["@rollup/rollup-win32-x64-gnu@4.57.0", "", { "os": "win32", "cpu": "x64" }, "sha512-MDk610P/vJGc5L5ImE4k5s+GZT3en0KoK1MKPXCRgzmksAMk79j4h3k1IerxTNqwDLxsGxStEZVBqG0gIqZqoA=="],
+
+    "@rollup/rollup-win32-x64-msvc": ["@rollup/rollup-win32-x64-msvc@4.57.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Zv7v6q6aV+VslnpwzqKAmrk5JdVkLUzok2208ZXGipjb+msxBr/fJPZyeEXiFgH7k62Ak0SLIfxQRZQvTuf7rQ=="],
 
     "@solid-primitives/event-listener": ["@solid-primitives/event-listener@2.4.3", "", { "dependencies": { "@solid-primitives/utils": "^6.3.2" }, "peerDependencies": { "solid-js": "^1.6.12" } }, "sha512-h4VqkYFv6Gf+L7SQj+Y6puigL/5DIi7x5q07VZET7AWcS+9/G3WfIE9WheniHWJs51OEkRB43w6lDys5YeFceg=="],
 
@@ -539,7 +567,7 @@
 
     "@tailwindcss/vite": ["@tailwindcss/vite@4.1.18", "", { "dependencies": { "@tailwindcss/node": "4.1.18", "@tailwindcss/oxide": "4.1.18", "tailwindcss": "4.1.18" }, "peerDependencies": { "vite": "^5.2.0 || ^6 || ^7" } }, "sha512-jVA+/UpKL1vRLg6Hkao5jldawNmRo7mQYrZtNHMIVpLfLhDml5nMRUo/8MwoX2vNXvnaXNNMedrMfMugAVX1nA=="],
 
-    "@tanstack/devtools": ["@tanstack/devtools@0.10.3", "", { "dependencies": { "@solid-primitives/event-listener": "^2.4.3", "@solid-primitives/keyboard": "^1.3.3", "@solid-primitives/resize-observer": "^2.1.3", "@tanstack/devtools-client": "0.0.5", "@tanstack/devtools-event-bus": "0.4.0", "@tanstack/devtools-ui": "0.4.4", "clsx": "^2.1.1", "goober": "^2.1.16", "solid-js": "^1.9.9" } }, "sha512-M2HnKtaNf3Z8JDTNDq+X7/1gwOqSwTnCyC0GR+TYiRZM9mkY9GpvTqp6p6bx3DT8onu2URJiVxgHD9WK2e3MNQ=="],
+    "@tanstack/devtools": ["@tanstack/devtools@0.10.5", "", { "dependencies": { "@solid-primitives/event-listener": "^2.4.3", "@solid-primitives/keyboard": "^1.3.3", "@solid-primitives/resize-observer": "^2.1.3", "@tanstack/devtools-client": "0.0.5", "@tanstack/devtools-event-bus": "0.4.0", "@tanstack/devtools-ui": "0.4.4", "clsx": "^2.1.1", "goober": "^2.1.16", "solid-js": "^1.9.9" } }, "sha512-aptV4sMcdEn/zB8zqNqKSKi8pLzfB7BhdP2MuVmyfWgBDYNchqJjhviaxEXW3tJTolbWwc30o+jszwqxOIcIaA=="],
 
     "@tanstack/devtools-client": ["@tanstack/devtools-client@0.0.5", "", { "dependencies": { "@tanstack/devtools-event-client": "^0.4.0" } }, "sha512-hsNDE3iu4frt9cC2ppn1mNRnLKo2uc1/1hXAyY9z4UYb+o40M2clFAhiFoo4HngjfGJDV3x18KVVIq7W4Un+zA=="],
 
@@ -549,51 +577,51 @@
 
     "@tanstack/devtools-ui": ["@tanstack/devtools-ui@0.4.4", "", { "dependencies": { "clsx": "^2.1.1", "goober": "^2.1.16", "solid-js": "^1.9.9" } }, "sha512-5xHXFyX3nom0UaNfiOM92o6ziaHjGo3mcSGe2HD5Xs8dWRZNpdZ0Smd0B9ddEhy0oB+gXyMzZgUJb9DmrZV0Mg=="],
 
-    "@tanstack/devtools-vite": ["@tanstack/devtools-vite@0.4.1", "", { "dependencies": { "@babel/core": "^7.28.4", "@babel/generator": "^7.28.3", "@babel/parser": "^7.28.4", "@babel/traverse": "^7.28.4", "@babel/types": "^7.28.4", "@tanstack/devtools-client": "0.0.5", "@tanstack/devtools-event-bus": "0.4.0", "chalk": "^5.6.2", "launch-editor": "^2.11.1", "picomatch": "^4.0.3" }, "peerDependencies": { "vite": "^6.0.0 || ^7.0.0" } }, "sha512-PkMOomcWnl/pUkCqIjqL/csjPHtkMVBirDpJVOZR7XJZDxo5CuD7B+3KsujFCF4Dsn6QYlae97gCZvxi/CB76Q=="],
+    "@tanstack/devtools-vite": ["@tanstack/devtools-vite@0.5.0", "", { "dependencies": { "@babel/core": "^7.28.4", "@babel/generator": "^7.28.3", "@babel/parser": "^7.28.4", "@babel/traverse": "^7.28.4", "@babel/types": "^7.28.4", "@tanstack/devtools-client": "0.0.5", "@tanstack/devtools-event-bus": "0.4.0", "chalk": "^5.6.2", "launch-editor": "^2.11.1", "picomatch": "^4.0.3" }, "peerDependencies": { "vite": "^6.0.0 || ^7.0.0" } }, "sha512-Ew+ZdTnmTlVjm4q+/XY/dolx/E1BWMYpiRDyU/MXqHf5epri4MLl5C4UZJaO+ZuUCsKPpsW+ufoM99E2Z4rhug=="],
 
-    "@tanstack/history": ["@tanstack/history@1.151.1", "", {}, "sha512-Z/eymNBuUGHYIea7nNX3xR5feqx418ChlwWOKklVpCVzEQ5Q3kNTUw+WK4HYUKxF+1uXFN01Dbuhhl7SmW1LJA=="],
+    "@tanstack/history": ["@tanstack/history@1.154.14", "", {}, "sha512-xyIfof8eHBuub1CkBnbKNKQXeRZC4dClhmzePHVOEel4G7lk/dW+TQ16da7CFdeNLv6u6Owf5VoBQxoo6DFTSA=="],
 
-    "@tanstack/react-devtools": ["@tanstack/react-devtools@0.9.2", "", { "dependencies": { "@tanstack/devtools": "0.10.3" }, "peerDependencies": { "@types/react": ">=16.8", "@types/react-dom": ">=16.8", "react": ">=16.8", "react-dom": ">=16.8" } }, "sha512-JNXvBO3jgq16GzTVm7p65n5zHNfMhnqF6Bm7CawjoqZrjEakxbM6Yvy63aKSIpbrdf+Wun2Xn8P0qD+vp56e1g=="],
+    "@tanstack/react-devtools": ["@tanstack/react-devtools@0.9.4", "", { "dependencies": { "@tanstack/devtools": "0.10.5" }, "peerDependencies": { "@types/react": ">=16.8", "@types/react-dom": ">=16.8", "react": ">=16.8", "react-dom": ">=16.8" } }, "sha512-6wQf8gVKDks1VL+LI5SS4XWK8dQLIjcDF3iMZfidyesWJNmodWbWlRkdgCmK5SpDSbcygjbp3p+LG2nE/SZ1bQ=="],
 
-    "@tanstack/react-router": ["@tanstack/react-router@1.151.6", "", { "dependencies": { "@tanstack/history": "1.151.1", "@tanstack/react-store": "^0.8.0", "@tanstack/router-core": "1.151.6", "isbot": "^5.1.22", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-KDbz7kacZCOoDrUwYljz4I/qjqVGq+bgUhpi/CWubi7by0GZ3JEECwFl/+k+4V6ATinJDjTNmCGwFcdwqjQDtA=="],
+    "@tanstack/react-router": ["@tanstack/react-router@1.157.18", "", { "dependencies": { "@tanstack/history": "1.154.14", "@tanstack/react-store": "^0.8.0", "@tanstack/router-core": "1.157.18", "isbot": "^5.1.22", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-qs//HcVhEZ0K2/Sqejol0vOWaFIh4EoYTQQix9FhHOyWvdUpGoTJS0+g/qxEnZZm7r9QNOrnyrYZ5CDAqnII6g=="],
 
-    "@tanstack/react-router-devtools": ["@tanstack/react-router-devtools@1.151.6", "", { "dependencies": { "@tanstack/router-devtools-core": "1.151.6" }, "peerDependencies": { "@tanstack/react-router": "^1.151.6", "@tanstack/router-core": "^1.151.6", "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" }, "optionalPeers": ["@tanstack/router-core"] }, "sha512-mRRFzIAIOAWYcZrEr0FYy/1FmM51iWwUdK0J3nWuXjAIeEb7uizS0HkeNbzX5yxfGZgkplk23eCXIUmJcDuVRQ=="],
+    "@tanstack/react-router-devtools": ["@tanstack/react-router-devtools@1.157.18", "", { "dependencies": { "@tanstack/router-devtools-core": "1.157.18" }, "peerDependencies": { "@tanstack/react-router": "^1.157.18", "@tanstack/router-core": "^1.157.18", "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" }, "optionalPeers": ["@tanstack/router-core"] }, "sha512-JHSOnwj8wkim1AppgPT1Jp+NtmiiJ4yLZ//Vo0sfrQSgOzlZgdFg4OdQP+9rYzuj3BNz+XoDdokXQhJxiSqSww=="],
 
-    "@tanstack/react-start": ["@tanstack/react-start@1.152.0", "", { "dependencies": { "@tanstack/react-router": "1.151.6", "@tanstack/react-start-client": "1.152.0", "@tanstack/react-start-server": "1.152.0", "@tanstack/router-utils": "^1.143.11", "@tanstack/start-client-core": "1.152.0", "@tanstack/start-plugin-core": "1.152.0", "@tanstack/start-server-core": "1.152.0", "pathe": "^2.0.3" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0", "vite": ">=7.0.0" } }, "sha512-btRNNIJGnXVEmD9yuiyNRvMITX5aocVJVdv/LQHxca4EcxntPEn1+HboPXFr6SDl9UNekH/6NZqv3LPz9tDm7A=="],
+    "@tanstack/react-start": ["@tanstack/react-start@1.157.18", "", { "dependencies": { "@tanstack/react-router": "1.157.18", "@tanstack/react-start-client": "1.157.18", "@tanstack/react-start-server": "1.157.18", "@tanstack/router-utils": "^1.154.7", "@tanstack/start-client-core": "1.157.18", "@tanstack/start-plugin-core": "1.157.18", "@tanstack/start-server-core": "1.157.18", "pathe": "^2.0.3" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0", "vite": ">=7.0.0" } }, "sha512-ytKblzB34SHmm/7euujl2rZvEjzIsvICFzzKHd7DETi11FSih/WIMU4RKErMtIIc8R2NETh9MPGFLb+XFDsU6A=="],
 
-    "@tanstack/react-start-client": ["@tanstack/react-start-client@1.152.0", "", { "dependencies": { "@tanstack/react-router": "1.151.6", "@tanstack/router-core": "1.151.6", "@tanstack/start-client-core": "1.152.0", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-YI2VVdCLk86QP5Q0oMXZWdk551haIisuF5AIr+S9ZAF415s4AgDpKRlXX251aqiHXYvv4rFnV1c9o7w02031Cw=="],
+    "@tanstack/react-start-client": ["@tanstack/react-start-client@1.157.18", "", { "dependencies": { "@tanstack/react-router": "1.157.18", "@tanstack/router-core": "1.157.18", "@tanstack/start-client-core": "1.157.18", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-8bk6x7skZp62LnEC2PKegmTo4RrOMrah0RY60S3ZUDXAJGs+CF9a+0moidpawUQbWvoO6T413TVOnNFHyPixJQ=="],
 
-    "@tanstack/react-start-server": ["@tanstack/react-start-server@1.152.0", "", { "dependencies": { "@tanstack/history": "1.151.1", "@tanstack/react-router": "1.151.6", "@tanstack/router-core": "1.151.6", "@tanstack/start-client-core": "1.152.0", "@tanstack/start-server-core": "1.152.0" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-oz3J3Ipj04IUAfVSE1DD41x8+7DDWHZez+fCqLnk8sw63ct013CeKwIvW9v1n0OtU6axekuVHHYBOsF5wO5/lg=="],
+    "@tanstack/react-start-server": ["@tanstack/react-start-server@1.157.18", "", { "dependencies": { "@tanstack/history": "1.154.14", "@tanstack/react-router": "1.157.18", "@tanstack/router-core": "1.157.18", "@tanstack/start-client-core": "1.157.18", "@tanstack/start-server-core": "1.157.18" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-LQg9FjwXJpt2yS1EdEP9r67KE9Qeg/9fWhdso+wl7XqGc8It/IEYh4D9qci3o+TVKS2b+MhIRklM0tVJ/nh1jw=="],
 
     "@tanstack/react-store": ["@tanstack/react-store@0.8.0", "", { "dependencies": { "@tanstack/store": "0.8.0", "use-sync-external-store": "^1.6.0" }, "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-1vG9beLIuB7q69skxK9r5xiLN3ztzIPfSQSs0GfeqWGO2tGIyInZx0x1COhpx97RKaONSoAb8C3dxacWksm1ow=="],
 
-    "@tanstack/router-core": ["@tanstack/router-core@1.151.6", "", { "dependencies": { "@tanstack/history": "1.151.1", "@tanstack/store": "^0.8.0", "cookie-es": "^2.0.0", "seroval": "^1.4.1", "seroval-plugins": "^1.4.0", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" } }, "sha512-eyqWx6vhKffkINWLujDF2sxAG9GE/XUdi3HrlD94ddJO9MBi/90a1HJaTYFSV8LmngjcRv8A3tt7OvFdv/UqhA=="],
+    "@tanstack/router-core": ["@tanstack/router-core@1.157.18", "", { "dependencies": { "@tanstack/history": "1.154.14", "@tanstack/store": "^0.8.0", "cookie-es": "^2.0.0", "seroval": "^1.4.2", "seroval-plugins": "^1.4.2", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" } }, "sha512-jGkyA3EEE01Sf6d4goi//poxQNb/Odc/GzpjZSW2zwG+wcXm9hEzcI6vU2IxhAU0dvvwQyQgtU1HXTcXQ/Xg4A=="],
 
-    "@tanstack/router-devtools-core": ["@tanstack/router-devtools-core@1.151.6", "", { "dependencies": { "clsx": "^2.1.1", "goober": "^2.1.16", "tiny-invariant": "^1.3.3" }, "peerDependencies": { "@tanstack/router-core": "^1.151.6", "csstype": "^3.0.10" }, "optionalPeers": ["csstype"] }, "sha512-OHGGvEtnANEbEwjYCChbvCyCLk/3Cqh9G5bhM5DVqrZ+b9wfeu46IdEsbSi1JfuK2sCHNMS5MrJaE2HZPsFx6Q=="],
+    "@tanstack/router-devtools-core": ["@tanstack/router-devtools-core@1.157.18", "", { "dependencies": { "clsx": "^2.1.1", "goober": "^2.1.16", "tiny-invariant": "^1.3.3" }, "peerDependencies": { "@tanstack/router-core": "^1.157.18", "csstype": "^3.0.10" }, "optionalPeers": ["csstype"] }, "sha512-+eh3XzBUuoGxJr8b9kCLdyJN+zPsAxtNggEvCal7iI8WE6q3ujjUPYiqHNI+MS4thtxaeUdAXlEjak/+fdBPdg=="],
 
-    "@tanstack/router-generator": ["@tanstack/router-generator@1.151.6", "", { "dependencies": { "@tanstack/router-core": "1.151.6", "@tanstack/router-utils": "1.143.11", "@tanstack/virtual-file-routes": "1.145.4", "prettier": "^3.5.0", "recast": "^0.23.11", "source-map": "^0.7.4", "tsx": "^4.19.2", "zod": "^3.24.2" } }, "sha512-IS4tkrkLIwI2EViGlUXCVgnKJ4EhWMM6w75XoJqd0X4t6K0/OiHkr3AQ0f2qZXbNciqLGxS88GLe5UiSAOS5Vw=="],
+    "@tanstack/router-generator": ["@tanstack/router-generator@1.157.18", "", { "dependencies": { "@tanstack/router-core": "1.157.18", "@tanstack/router-utils": "1.154.7", "@tanstack/virtual-file-routes": "1.154.7", "prettier": "^3.5.0", "recast": "^0.23.11", "source-map": "^0.7.4", "tsx": "^4.19.2", "zod": "^3.24.2" } }, "sha512-t6nZdaX+pYWaudwg5Yasu/o8IAK8FPc4Jwq+rZpyaCgeZn895Vc407hxoRss40/hK1jk03b8x349+b1JekiSqA=="],
 
-    "@tanstack/router-plugin": ["@tanstack/router-plugin@1.151.6", "", { "dependencies": { "@babel/core": "^7.28.5", "@babel/plugin-syntax-jsx": "^7.27.1", "@babel/plugin-syntax-typescript": "^7.27.1", "@babel/template": "^7.27.2", "@babel/traverse": "^7.28.5", "@babel/types": "^7.28.5", "@tanstack/router-core": "1.151.6", "@tanstack/router-generator": "1.151.6", "@tanstack/router-utils": "1.143.11", "@tanstack/virtual-file-routes": "1.145.4", "babel-dead-code-elimination": "^1.0.11", "chokidar": "^3.6.0", "unplugin": "^2.1.2", "zod": "^3.24.2" }, "peerDependencies": { "@rsbuild/core": ">=1.0.2", "@tanstack/react-router": "^1.151.6", "vite": ">=5.0.0 || >=6.0.0 || >=7.0.0", "vite-plugin-solid": "^2.11.10", "webpack": ">=5.92.0" }, "optionalPeers": ["@rsbuild/core", "@tanstack/react-router", "vite", "vite-plugin-solid", "webpack"] }, "sha512-Kz9wmAgcylung1KoXvEEVTW91PNh4U65MgVwSmz5fYQP7UqNHPvHqBFWKEu17a45SfZ4LufsNW3LTFT35tWGXg=="],
+    "@tanstack/router-plugin": ["@tanstack/router-plugin@1.157.18", "", { "dependencies": { "@babel/core": "^7.28.5", "@babel/plugin-syntax-jsx": "^7.27.1", "@babel/plugin-syntax-typescript": "^7.27.1", "@babel/template": "^7.27.2", "@babel/traverse": "^7.28.5", "@babel/types": "^7.28.5", "@tanstack/router-core": "1.157.18", "@tanstack/router-generator": "1.157.18", "@tanstack/router-utils": "1.154.7", "@tanstack/virtual-file-routes": "1.154.7", "babel-dead-code-elimination": "^1.0.11", "chokidar": "^3.6.0", "unplugin": "^2.1.2", "zod": "^3.24.2" }, "peerDependencies": { "@rsbuild/core": ">=1.0.2", "@tanstack/react-router": "^1.157.18", "vite": ">=5.0.0 || >=6.0.0 || >=7.0.0", "vite-plugin-solid": "^2.11.10", "webpack": ">=5.92.0" }, "optionalPeers": ["@rsbuild/core", "@tanstack/react-router", "vite", "vite-plugin-solid", "webpack"] }, "sha512-1UrRnIhD4Ar0PpXwzIkxD8nfjzmO7oYRh4CkSUO+Xc6aD5poNB62aUWPp3vS5jnXDNSk0vr+N4QAPebjPKw0Hw=="],
 
-    "@tanstack/router-utils": ["@tanstack/router-utils@1.143.11", "", { "dependencies": { "@babel/core": "^7.28.5", "@babel/generator": "^7.28.5", "@babel/parser": "^7.28.5", "ansis": "^4.1.0", "diff": "^8.0.2", "pathe": "^2.0.3", "tinyglobby": "^0.2.15" } }, "sha512-N24G4LpfyK8dOlnP8BvNdkuxg1xQljkyl6PcrdiPSA301pOjatRT1y8wuCCJZKVVD8gkd0MpCZ0VEjRMGILOtA=="],
+    "@tanstack/router-utils": ["@tanstack/router-utils@1.154.7", "", { "dependencies": { "@babel/core": "^7.28.5", "@babel/generator": "^7.28.5", "@babel/parser": "^7.28.5", "ansis": "^4.1.0", "diff": "^8.0.2", "pathe": "^2.0.3", "tinyglobby": "^0.2.15" } }, "sha512-61bGx32tMKuEpVRseu2sh1KQe8CfB7793Mch/kyQt0EP3tD7X0sXmimCl3truRiDGUtI0CaSoQV1NPjAII1RBA=="],
 
-    "@tanstack/start-client-core": ["@tanstack/start-client-core@1.152.0", "", { "dependencies": { "@tanstack/router-core": "1.151.6", "@tanstack/start-fn-stubs": "1.151.3", "@tanstack/start-storage-context": "1.151.6", "seroval": "^1.4.1", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" } }, "sha512-G88urpJImiGZttawtciSj46Ko57TXO2pd11Zef6Yw1VLD6fJs+RF0q9N0P98SGs9Jm0oUjLusi3Ti550fkQ2qw=="],
+    "@tanstack/start-client-core": ["@tanstack/start-client-core@1.157.18", "", { "dependencies": { "@tanstack/router-core": "1.157.18", "@tanstack/start-fn-stubs": "1.154.7", "@tanstack/start-storage-context": "1.157.18", "seroval": "^1.4.2", "tiny-invariant": "^1.3.3", "tiny-warning": "^1.0.3" } }, "sha512-DehC8ONA3QTBbaB95sL8ID+lK284ETP8/k9RCifseXOzr5xWKNNGbe3+Fy8OYV1MtHIuOmCMqozzltPp5MTANg=="],
 
-    "@tanstack/start-fn-stubs": ["@tanstack/start-fn-stubs@1.151.3", "", {}, "sha512-/zWBnfsOwact936Bn0CxigudU1QRZdiNTsK7ME/LMXXA66XsDxkryX5+5FeGwU5ETNPfLAx6pRUet1mtUKnLCg=="],
+    "@tanstack/start-fn-stubs": ["@tanstack/start-fn-stubs@1.154.7", "", {}, "sha512-D69B78L6pcFN5X5PHaydv7CScQcKLzJeEYqs7jpuyyqGQHSUIZUjS955j+Sir8cHhuDIovCe2LmsYHeZfWf3dQ=="],
 
-    "@tanstack/start-plugin-core": ["@tanstack/start-plugin-core@1.152.0", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.28.5", "@babel/types": "^7.28.5", "@rolldown/pluginutils": "1.0.0-beta.40", "@tanstack/router-core": "1.151.6", "@tanstack/router-generator": "1.151.6", "@tanstack/router-plugin": "1.151.6", "@tanstack/router-utils": "1.143.11", "@tanstack/start-client-core": "1.152.0", "@tanstack/start-server-core": "1.152.0", "babel-dead-code-elimination": "^1.0.11", "cheerio": "^1.0.0", "exsolve": "^1.0.7", "pathe": "^2.0.3", "srvx": "^0.10.0", "tinyglobby": "^0.2.15", "ufo": "^1.5.4", "vitefu": "^1.1.1", "xmlbuilder2": "^4.0.3", "zod": "^3.24.2" }, "peerDependencies": { "vite": ">=7.0.0" } }, "sha512-XT+ECwpmi6cQj6gb9QHo1XOOw+7zGXOvwnrijg3HSzNKFDlawHycgOotnViTOjtVjhHLpW1/yGyivWX5OC8wTw=="],
+    "@tanstack/start-plugin-core": ["@tanstack/start-plugin-core@1.157.18", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.28.5", "@babel/types": "^7.28.5", "@rolldown/pluginutils": "1.0.0-beta.40", "@tanstack/router-core": "1.157.18", "@tanstack/router-generator": "1.157.18", "@tanstack/router-plugin": "1.157.18", "@tanstack/router-utils": "1.154.7", "@tanstack/start-client-core": "1.157.18", "@tanstack/start-server-core": "1.157.18", "babel-dead-code-elimination": "^1.0.11", "cheerio": "^1.0.0", "exsolve": "^1.0.7", "pathe": "^2.0.3", "srvx": "^0.10.1", "tinyglobby": "^0.2.15", "ufo": "^1.5.4", "vitefu": "^1.1.1", "xmlbuilder2": "^4.0.3", "zod": "^3.24.2" }, "peerDependencies": { "vite": ">=7.0.0" } }, "sha512-qUVfdEoLf/WYUB1WASR1hcxmlGvIBKiLEIFnpG/Kd/E01BwtHhDjv6WsEusg0n2WrWnYT2/6tuJRDPyXObV7IA=="],
 
-    "@tanstack/start-server-core": ["@tanstack/start-server-core@1.152.0", "", { "dependencies": { "@tanstack/history": "1.151.1", "@tanstack/router-core": "1.151.6", "@tanstack/start-client-core": "1.152.0", "@tanstack/start-storage-context": "1.151.6", "h3-v2": "npm:h3@2.0.1-rc.7", "seroval": "^1.4.1", "tiny-invariant": "^1.3.3" } }, "sha512-bMmc4tIhR3FClb1iWLw0zuhvY71b9k2iz8Jw0tSK/KKi++gl1bGyJjuPtx8kDbx5Ix1SoXp4QNdXuo7dv5INfQ=="],
+    "@tanstack/start-server-core": ["@tanstack/start-server-core@1.157.18", "", { "dependencies": { "@tanstack/history": "1.154.14", "@tanstack/router-core": "1.157.18", "@tanstack/start-client-core": "1.157.18", "@tanstack/start-storage-context": "1.157.18", "h3-v2": "npm:h3@2.0.1-rc.11", "seroval": "^1.4.2", "tiny-invariant": "^1.3.3" } }, "sha512-0ixErUvQsVM9SwOOpjyUOpS9KZBDRv1aoM2+qnSGR3DxZUricy/XbCaDAMxReN/0aJQzo47Y5gjpSWaGWlImWw=="],
 
-    "@tanstack/start-storage-context": ["@tanstack/start-storage-context@1.151.6", "", { "dependencies": { "@tanstack/router-core": "1.151.6" } }, "sha512-MvTcT40qnqatIpKjWSfMRxFzTkprGBxhX2c+em58iZLEsGksitMUWbprknD6AIUqjHty8V3LuhULks/o6tSugQ=="],
+    "@tanstack/start-storage-context": ["@tanstack/start-storage-context@1.157.18", "", { "dependencies": { "@tanstack/router-core": "1.157.18" } }, "sha512-OqueMS78bULFTDw37uUR8s3yWdX9JVzW4uh/y8V9Iv3oEa6yAgGC2cfOy4My70UkkggAUhoVNopQZamPtL+EBQ=="],
 
     "@tanstack/store": ["@tanstack/store@0.8.0", "", {}, "sha512-Om+BO0YfMZe//X2z0uLF2j+75nQga6TpTJgLJQBiq85aOyZNIhkCgleNcud2KQg4k4v9Y9l+Uhru3qWMPGTOzQ=="],
 
-    "@tanstack/virtual-file-routes": ["@tanstack/virtual-file-routes@1.145.4", "", {}, "sha512-CI75JrfqSluhdGwLssgVeQBaCphgfkMQpi8MCY3UJX1hoGzXa8kHYJcUuIFMOLs1q7zqHy++EVVtMK03osR5wQ=="],
+    "@tanstack/virtual-file-routes": ["@tanstack/virtual-file-routes@1.154.7", "", {}, "sha512-cHHDnewHozgjpI+MIVp9tcib6lYEQK5MyUr0ChHpHFGBl8Xei55rohFK0I0ve/GKoHeioaK42Smd8OixPp6CTg=="],
 
     "@testing-library/dom": ["@testing-library/dom@10.4.1", "", { "dependencies": { "@babel/code-frame": "^7.10.4", "@babel/runtime": "^7.12.5", "@types/aria-query": "^5.0.1", "aria-query": "5.3.0", "dom-accessibility-api": "^0.5.9", "lz-string": "^1.5.0", "picocolors": "1.1.1", "pretty-format": "^27.0.2" } }, "sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg=="],
 
-    "@testing-library/react": ["@testing-library/react@16.3.1", "", { "dependencies": { "@babel/runtime": "^7.12.5" }, "peerDependencies": { "@testing-library/dom": "^10.0.0", "@types/react": "^18.0.0 || ^19.0.0", "@types/react-dom": "^18.0.0 || ^19.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-gr4KtAWqIOQoucWYD/f6ki+j5chXfcPc74Col/6poTyqTmn7zRmodWahWRCp8tYd+GMqBonw6hstNzqjbs6gjw=="],
+    "@testing-library/react": ["@testing-library/react@16.3.2", "", { "dependencies": { "@babel/runtime": "^7.12.5" }, "peerDependencies": { "@testing-library/dom": "^10.0.0", "@types/react": "^18.0.0 || ^19.0.0", "@types/react-dom": "^18.0.0 || ^19.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-XU5/SytQM+ykqMnAnvB2umaJNIOsLF3PVv//1Ew4CTcpz0/BRyy/af40qqrt7SjKpDdT1saBMc42CUok5gaw+g=="],
 
     "@tybys/wasm-util": ["@tybys/wasm-util@0.10.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg=="],
 
@@ -623,9 +651,9 @@
 
     "@types/ms": ["@types/ms@2.1.0", "", {}, "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA=="],
 
-    "@types/node": ["@types/node@25.0.9", "", { "dependencies": { "undici-types": "~7.16.0" } }, "sha512-/rpCXHlCWeqClNBwUhDcusJxXYDjZTyE8v5oTO7WbL8eij2nKhUeU89/6xgjU7N4/Vh3He0BtyhJdQbDyhiXAw=="],
+    "@types/node": ["@types/node@25.2.0", "", { "dependencies": { "undici-types": "~7.16.0" } }, "sha512-DZ8VwRFUNzuqJ5khrvwMXHmvPe+zGayJhr2CDNiKB1WBE1ST8Djl00D0IC4vvNmHMdj6DlbYRIaFE7WHjlDl5w=="],
 
-    "@types/react": ["@types/react@19.2.8", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-3MbSL37jEchWZz2p2mjntRZtPt837ij10ApxKfgmXCTuHWagYg7iA5bqPw6C8BMPfwidlvfPI/fxOc42HLhcyg=="],
+    "@types/react": ["@types/react@19.2.10", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-WPigyYuGhgZ/cTPRXB2EwUw+XvsRA3GqHlsP4qteqrnnjDrApbS7MxcGr/hke5iUoeB7E/gQtrs9I37zAJ0Vjw=="],
 
     "@types/react-dom": ["@types/react-dom@19.2.3", "", { "peerDependencies": { "@types/react": "^19.2.0" } }, "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ=="],
 
@@ -641,21 +669,21 @@
 
     "@vitejs/plugin-react": ["@vitejs/plugin-react@5.1.2", "", { "dependencies": { "@babel/core": "^7.28.5", "@babel/plugin-transform-react-jsx-self": "^7.27.1", "@babel/plugin-transform-react-jsx-source": "^7.27.1", "@rolldown/pluginutils": "1.0.0-beta.53", "@types/babel__core": "^7.20.5", "react-refresh": "^0.18.0" }, "peerDependencies": { "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0" } }, "sha512-EcA07pHJouywpzsoTUqNh5NwGayl2PPVEJKUSinGGSxFGYn+shYbqMGBg6FXDqgXum9Ou/ecb+411ssw8HImJQ=="],
 
-    "@vitest/coverage-v8": ["@vitest/coverage-v8@4.0.17", "", { "dependencies": { "@bcoe/v8-coverage": "^1.0.2", "@vitest/utils": "4.0.17", "ast-v8-to-istanbul": "^0.3.10", "istanbul-lib-coverage": "^3.2.2", "istanbul-lib-report": "^3.0.1", "istanbul-reports": "^3.2.0", "magicast": "^0.5.1", "obug": "^2.1.1", "std-env": "^3.10.0", "tinyrainbow": "^3.0.3" }, "peerDependencies": { "@vitest/browser": "4.0.17", "vitest": "4.0.17" }, "optionalPeers": ["@vitest/browser"] }, "sha512-/6zU2FLGg0jsd+ePZcwHRy3+WpNTBBhDY56P4JTRqUN/Dp6CvOEa9HrikcQ4KfV2b2kAHUFB4dl1SuocWXSFEw=="],
+    "@vitest/coverage-v8": ["@vitest/coverage-v8@4.0.18", "", { "dependencies": { "@bcoe/v8-coverage": "^1.0.2", "@vitest/utils": "4.0.18", "ast-v8-to-istanbul": "^0.3.10", "istanbul-lib-coverage": "^3.2.2", "istanbul-lib-report": "^3.0.1", "istanbul-reports": "^3.2.0", "magicast": "^0.5.1", "obug": "^2.1.1", "std-env": "^3.10.0", "tinyrainbow": "^3.0.3" }, "peerDependencies": { "@vitest/browser": "4.0.18", "vitest": "4.0.18" }, "optionalPeers": ["@vitest/browser"] }, "sha512-7i+N2i0+ME+2JFZhfuz7Tg/FqKtilHjGyGvoHYQ6iLV0zahbsJ9sljC9OcFcPDbhYKCet+sG8SsVqlyGvPflZg=="],
 
-    "@vitest/expect": ["@vitest/expect@4.0.17", "", { "dependencies": { "@standard-schema/spec": "^1.0.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.0.17", "@vitest/utils": "4.0.17", "chai": "^6.2.1", "tinyrainbow": "^3.0.3" } }, "sha512-mEoqP3RqhKlbmUmntNDDCJeTDavDR+fVYkSOw8qRwJFaW/0/5zA9zFeTrHqNtcmwh6j26yMmwx2PqUDPzt5ZAQ=="],
+    "@vitest/expect": ["@vitest/expect@4.0.18", "", { "dependencies": { "@standard-schema/spec": "^1.0.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.0.18", "@vitest/utils": "4.0.18", "chai": "^6.2.1", "tinyrainbow": "^3.0.3" } }, "sha512-8sCWUyckXXYvx4opfzVY03EOiYVxyNrHS5QxX3DAIi5dpJAAkyJezHCP77VMX4HKA2LDT/Jpfo8i2r5BE3GnQQ=="],
 
-    "@vitest/mocker": ["@vitest/mocker@4.0.17", "", { "dependencies": { "@vitest/spy": "4.0.17", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0-0" }, "optionalPeers": ["msw", "vite"] }, "sha512-+ZtQhLA3lDh1tI2wxe3yMsGzbp7uuJSWBM1iTIKCbppWTSBN09PUC+L+fyNlQApQoR+Ps8twt2pbSSXg2fQVEQ=="],
+    "@vitest/mocker": ["@vitest/mocker@4.0.18", "", { "dependencies": { "@vitest/spy": "4.0.18", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0-0" }, "optionalPeers": ["msw", "vite"] }, "sha512-HhVd0MDnzzsgevnOWCBj5Otnzobjy5wLBe4EdeeFGv8luMsGcYqDuFRMcttKWZA5vVO8RFjexVovXvAM4JoJDQ=="],
 
-    "@vitest/pretty-format": ["@vitest/pretty-format@4.0.17", "", { "dependencies": { "tinyrainbow": "^3.0.3" } }, "sha512-Ah3VAYmjcEdHg6+MwFE17qyLqBHZ+ni2ScKCiW2XrlSBV4H3Z7vYfPfz7CWQ33gyu76oc0Ai36+kgLU3rfF4nw=="],
+    "@vitest/pretty-format": ["@vitest/pretty-format@4.0.18", "", { "dependencies": { "tinyrainbow": "^3.0.3" } }, "sha512-P24GK3GulZWC5tz87ux0m8OADrQIUVDPIjjj65vBXYG17ZeU3qD7r+MNZ1RNv4l8CGU2vtTRqixrOi9fYk/yKw=="],
 
-    "@vitest/runner": ["@vitest/runner@4.0.17", "", { "dependencies": { "@vitest/utils": "4.0.17", "pathe": "^2.0.3" } }, "sha512-JmuQyf8aMWoo/LmNFppdpkfRVHJcsgzkbCA+/Bk7VfNH7RE6Ut2qxegeyx2j3ojtJtKIbIGy3h+KxGfYfk28YQ=="],
+    "@vitest/runner": ["@vitest/runner@4.0.18", "", { "dependencies": { "@vitest/utils": "4.0.18", "pathe": "^2.0.3" } }, "sha512-rpk9y12PGa22Jg6g5M3UVVnTS7+zycIGk9ZNGN+m6tZHKQb7jrP7/77WfZy13Y/EUDd52NDsLRQhYKtv7XfPQw=="],
 
-    "@vitest/snapshot": ["@vitest/snapshot@4.0.17", "", { "dependencies": { "@vitest/pretty-format": "4.0.17", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-npPelD7oyL+YQM2gbIYvlavlMVWUfNNGZPcu0aEUQXt7FXTuqhmgiYupPnAanhKvyP6Srs2pIbWo30K0RbDtRQ=="],
+    "@vitest/snapshot": ["@vitest/snapshot@4.0.18", "", { "dependencies": { "@vitest/pretty-format": "4.0.18", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-PCiV0rcl7jKQjbgYqjtakly6T1uwv/5BQ9SwBLekVg/EaYeQFPiXcgrC2Y7vDMA8dM1SUEAEV82kgSQIlXNMvA=="],
 
-    "@vitest/spy": ["@vitest/spy@4.0.17", "", {}, "sha512-I1bQo8QaP6tZlTomQNWKJE6ym4SHf3oLS7ceNjozxxgzavRAgZDc06T7kD8gb9bXKEgcLNt00Z+kZO6KaJ62Ew=="],
+    "@vitest/spy": ["@vitest/spy@4.0.18", "", {}, "sha512-cbQt3PTSD7P2OARdVW3qWER5EGq7PHlvE+QfzSC0lbwO+xnt7+XH06ZzFjFRgzUX//JmpxrCu92VdwvEPlWSNw=="],
 
-    "@vitest/utils": ["@vitest/utils@4.0.17", "", { "dependencies": { "@vitest/pretty-format": "4.0.17", "tinyrainbow": "^3.0.3" } }, "sha512-RG6iy+IzQpa9SB8HAFHJ9Y+pTzI+h8553MrciN9eC6TFBErqrQaTas4vG+MVj8S4uKk8uTT2p0vgZPnTdxd96w=="],
+    "@vitest/utils": ["@vitest/utils@4.0.18", "", { "dependencies": { "@vitest/pretty-format": "4.0.18", "tinyrainbow": "^3.0.3" } }, "sha512-msMRKLMVLWygpK3u2Hybgi4MNjcYJvwTb0Ru09+fOyCXIgT5raYP041DRRdiJiI3k/2U6SEbAETB3YtBrUkCFA=="],
 
     "acorn": ["acorn@8.15.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg=="],
 
@@ -685,11 +713,11 @@
 
     "ast-v8-to-istanbul": ["ast-v8-to-istanbul@0.3.10", "", { "dependencies": { "@jridgewell/trace-mapping": "^0.3.31", "estree-walker": "^3.0.3", "js-tokens": "^9.0.1" } }, "sha512-p4K7vMz2ZSk3wN8l5o3y2bJAoZXT3VuJI5OLTATY/01CYWumWvwkUw0SqDBnNq6IiTO3qDa1eSQDibAV8g7XOQ=="],
 
-    "babel-dead-code-elimination": ["babel-dead-code-elimination@1.0.11", "", { "dependencies": { "@babel/core": "^7.23.7", "@babel/parser": "^7.23.6", "@babel/traverse": "^7.23.7", "@babel/types": "^7.23.6" } }, "sha512-mwq3W3e/pKSI6TG8lXMiDWvEi1VXYlSBlJlB3l+I0bAb5u1RNUl88udos85eOPNK3m5EXK9uO7d2g08pesTySQ=="],
+    "babel-dead-code-elimination": ["babel-dead-code-elimination@1.0.12", "", { "dependencies": { "@babel/core": "^7.23.7", "@babel/parser": "^7.23.6", "@babel/traverse": "^7.23.7", "@babel/types": "^7.23.6" } }, "sha512-GERT7L2TiYcYDtYk1IpD+ASAYXjKbLTDPhBtYj7X1NuRMDTMtAx9kyBenub1Ev41lo91OHCKdmP+egTDmfQ7Ig=="],
 
     "bail": ["bail@2.0.2", "", {}, "sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw=="],
 
-    "baseline-browser-mapping": ["baseline-browser-mapping@2.9.11", "", { "bin": { "baseline-browser-mapping": "dist/cli.js" } }, "sha512-Sg0xJUNDU1sJNGdfGWhVHX0kkZ+HWcvmVymJbj6NSgZZmW/8S9Y2HQ5euytnIgakgxN6papOAWiwDo1ctFDcoQ=="],
+    "baseline-browser-mapping": ["baseline-browser-mapping@2.9.19", "", { "bin": { "baseline-browser-mapping": "dist/cli.js" } }, "sha512-ipDqC8FrAl/76p2SSWKSI+H9tFwm7vYqXQrItCuiVPt26Km0jS+NzSsBWAaBusvSbQcfJG+JitdMm+wZAgTYqg=="],
 
     "bidi-js": ["bidi-js@1.0.3", "", { "dependencies": { "require-from-string": "^2.0.2" } }, "sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw=="],
 
@@ -701,7 +729,7 @@
 
     "browserslist": ["browserslist@4.28.1", "", { "dependencies": { "baseline-browser-mapping": "^2.9.0", "caniuse-lite": "^1.0.30001759", "electron-to-chromium": "^1.5.263", "node-releases": "^2.0.27", "update-browserslist-db": "^1.2.0" }, "bin": { "browserslist": "cli.js" } }, "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA=="],
 
-    "caniuse-lite": ["caniuse-lite@1.0.30001762", "", {}, "sha512-PxZwGNvH7Ak8WX5iXzoK1KPZttBXNPuaOvI2ZYU7NrlM+d9Ov+TUvlLOBNGzVXAntMSMMlJPd+jY6ovrVjSmUw=="],
+    "caniuse-lite": ["caniuse-lite@1.0.30001766", "", {}, "sha512-4C0lfJ0/YPjJQHagaE9x2Elb69CIqEPZeG0anQt9SIvIoOH4a4uaRl73IavyO+0qZh6MDLH//DrXThEYKHkmYA=="],
 
     "ccount": ["ccount@2.0.1", "", {}, "sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg=="],
 
@@ -717,19 +745,19 @@
 
     "character-reference-invalid": ["character-reference-invalid@2.0.1", "", {}, "sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw=="],
 
-    "cheerio": ["cheerio@1.1.2", "", { "dependencies": { "cheerio-select": "^2.1.0", "dom-serializer": "^2.0.0", "domhandler": "^5.0.3", "domutils": "^3.2.2", "encoding-sniffer": "^0.2.1", "htmlparser2": "^10.0.0", "parse5": "^7.3.0", "parse5-htmlparser2-tree-adapter": "^7.1.0", "parse5-parser-stream": "^7.1.2", "undici": "^7.12.0", "whatwg-mimetype": "^4.0.0" } }, "sha512-IkxPpb5rS/d1IiLbHMgfPuS0FgiWTtFIm/Nj+2woXDLTZ7fOT2eqzgYbdMlLweqlHbsZjxEChoVK+7iph7jyQg=="],
+    "cheerio": ["cheerio@1.2.0", "", { "dependencies": { "cheerio-select": "^2.1.0", "dom-serializer": "^2.0.0", "domhandler": "^5.0.3", "domutils": "^3.2.2", "encoding-sniffer": "^0.2.1", "htmlparser2": "^10.1.0", "parse5": "^7.3.0", "parse5-htmlparser2-tree-adapter": "^7.1.0", "parse5-parser-stream": "^7.1.2", "undici": "^7.19.0", "whatwg-mimetype": "^4.0.0" } }, "sha512-WDrybc/gKFpTYQutKIK6UvfcuxijIZfMfXaYm8NMsPQxSYvf+13fXUJ4rztGGbJcBQ/GF55gvrZ0Bc0bj/mqvg=="],
 
     "cheerio-select": ["cheerio-select@2.1.0", "", { "dependencies": { "boolbase": "^1.0.0", "css-select": "^5.1.0", "css-what": "^6.1.0", "domelementtype": "^2.3.0", "domhandler": "^5.0.3", "domutils": "^3.0.1" } }, "sha512-9v9kG0LvzrlcungtnJtpGNxY+fzECQKhK4EGJX2vByejiMX84MFNQw4UxPJl3bFbTMw+Dfs37XaIkCwTZfLh4g=="],
 
     "chokidar": ["chokidar@3.6.0", "", { "dependencies": { "anymatch": "~3.1.2", "braces": "~3.0.2", "glob-parent": "~5.1.2", "is-binary-path": "~2.1.0", "is-glob": "~4.0.1", "normalize-path": "~3.0.0", "readdirp": "~3.6.0" }, "optionalDependencies": { "fsevents": "~2.3.2" } }, "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw=="],
 
-    "clawdhub": ["clawdhub@workspace:packages/clawdhub"],
+    "clawhub": ["clawhub@workspace:packages/clawdhub"],
 
-    "clawdhub-schema": ["clawdhub-schema@workspace:packages/schema"],
+    "clawhub-schema": ["clawhub-schema@workspace:packages/schema"],
 
     "cli-cursor": ["cli-cursor@5.0.0", "", { "dependencies": { "restore-cursor": "^5.0.0" } }, "sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw=="],
 
-    "cli-spinners": ["cli-spinners@3.3.0", "", {}, "sha512-/+40ljC3ONVnYIttjMWrlL51nItDAbBrq2upN8BPyvGU/2n5Oxw3tbNwORCaNuNqLJnxGqOfjUuhsv7l5Q4IsQ=="],
+    "cli-spinners": ["cli-spinners@3.4.0", "", {}, "sha512-bXfOC4QcT1tKXGorxL3wbJm6XJPDqEnij2gQ2m7ESQuE+/z9YFIWnl/5RpTiKWbMq3EVKR4fRLJGn6DVfu0mpw=="],
 
     "clsx": ["clsx@2.1.1", "", {}, "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA=="],
 
@@ -741,7 +769,7 @@
 
     "convert-source-map": ["convert-source-map@2.0.0", "", {}, "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg=="],
 
-    "convex": ["convex@1.31.6", "", { "dependencies": { "esbuild": "0.27.0", "prettier": "^3.0.0" }, "peerDependencies": { "@auth0/auth0-react": "^2.0.1", "@clerk/clerk-react": "^4.12.8 || ^5.0.0", "react": "^18.0.0 || ^19.0.0-0 || ^19.0.0" }, "optionalPeers": ["@auth0/auth0-react", "@clerk/clerk-react", "react"], "bin": { "convex": "bin/main.js" } }, "sha512-9cIsOzepa3s9DURRF+fZHxbNuzLgilg9XGQCc45v0Xx4FemqeIezpPFSJF9WHC9ckk43TDUUXLecvLVt9djPkw=="],
+    "convex": ["convex@1.31.7", "", { "dependencies": { "esbuild": "0.27.0", "prettier": "^3.0.0" }, "peerDependencies": { "@auth0/auth0-react": "^2.0.1", "@clerk/clerk-react": "^4.12.8 || ^5.0.0", "react": "^18.0.0 || ^19.0.0-0 || ^19.0.0" }, "optionalPeers": ["@auth0/auth0-react", "@clerk/clerk-react", "react"], "bin": { "convex": "bin/main.js" } }, "sha512-PtNMe1mAIOvA8Yz100QTOaIdgt2rIuWqencVXrb4McdhxBHZ8IJ1eXTnrgCC9HydyilGT1pOn+KNqT14mqn9fQ=="],
 
     "convex-helpers": ["convex-helpers@0.1.111", "", { "peerDependencies": { "@standard-schema/spec": "^1.0.0", "convex": "^1.25.4", "hono": "^4.0.5", "react": "^17.0.2 || ^18.0.0 || ^19.0.0", "typescript": "^5.5", "zod": "^3.25.0 || ^4.0.0" }, "optionalPeers": ["@standard-schema/spec", "hono", "react", "typescript", "zod"], "bin": { "convex-helpers": "bin.cjs" } }, "sha512-0O59Ohi8HVc3+KULxSC6JHsw8cQJyc8gZ7OAfNRVX7T5Wy6LhPx3l8veYN9avKg7UiPlO7m1eBiQMHKclIyXyQ=="],
 
@@ -749,7 +777,7 @@
 
     "cookie-es": ["cookie-es@2.0.0", "", {}, "sha512-RAj4E421UYRgqokKUmotqAwuplYw15qtdXfY+hGzgCJ/MBjCVZcSoHK/kH9kocfjRjcDME7IiDWR/1WX1TM2Pg=="],
 
-    "crossws": ["crossws@0.4.1", "", { "peerDependencies": { "srvx": ">=0.7.1" }, "optionalPeers": ["srvx"] }, "sha512-E7WKBcHVhAVrY6JYD5kteNqVq1GSZxqGrdSiwXR9at+XHi43HJoCQKXcCczR5LBnBquFZPsB3o7HklulKoBU5w=="],
+    "crossws": ["crossws@0.4.4", "", { "peerDependencies": { "srvx": ">=0.7.1" }, "optionalPeers": ["srvx"] }, "sha512-w6c4OdpRNnudVmcgr7brb/+/HmYjMQvYToO/oTrprTwxRUiom3LYWU1PMWuD006okbUWpII1Ea9/+kwpUfmyRg=="],
 
     "css-select": ["css-select@5.2.2", "", { "dependencies": { "boolbase": "^1.0.0", "css-what": "^6.1.0", "domhandler": "^5.0.2", "domutils": "^3.0.1", "nth-check": "^2.0.1" } }, "sha512-TizTzUddG/xYLA3NXodFM0fSbNizXjOKhqiQQwvhlspadZokn1KDy0NZFS0wuEubIYAV5/c1/lAr0TaaFXEXzw=="],
 
@@ -757,11 +785,11 @@
 
     "css-what": ["css-what@6.2.2", "", {}, "sha512-u/O3vwbptzhMs3L1fQE82ZSLHQQfto5gyZzwteVIEyeaY5Fc7R4dapF/BvRoSYFeqfBk4m0V1Vafq5Pjv25wvA=="],
 
-    "cssstyle": ["cssstyle@5.3.6", "", { "dependencies": { "@asamuzakjp/css-color": "^4.1.1", "@csstools/css-syntax-patches-for-csstree": "^1.0.21", "css-tree": "^3.1.0", "lru-cache": "^11.2.4" } }, "sha512-legscpSpgSAeGEe0TNcai97DKt9Vd9AsAdOL7Uoetb52Ar/8eJm3LIa39qpv8wWzLFlNG4vVvppQM+teaMPj3A=="],
+    "cssstyle": ["cssstyle@5.3.7", "", { "dependencies": { "@asamuzakjp/css-color": "^4.1.1", "@csstools/css-syntax-patches-for-csstree": "^1.0.21", "css-tree": "^3.1.0", "lru-cache": "^11.2.4" } }, "sha512-7D2EPVltRrsTkhpQmksIu+LxeWAIEk6wRDMJ1qljlv+CKHJM+cJLlfhWIzNA44eAsHXSNe3+vO6DW1yCYx8SuQ=="],
 
     "csstype": ["csstype@3.2.3", "", {}, "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ=="],
 
-    "data-urls": ["data-urls@6.0.0", "", { "dependencies": { "whatwg-mimetype": "^4.0.0", "whatwg-url": "^15.0.0" } }, "sha512-BnBS08aLUM+DKamupXs3w2tJJoqU+AkaE/+6vQxi/G/DPmIZFJJp9Dkb1kM03AZx8ADehDUZgsNxju3mPXZYIA=="],
+    "data-urls": ["data-urls@7.0.0", "", { "dependencies": { "whatwg-mimetype": "^5.0.0", "whatwg-url": "^16.0.0" } }, "sha512-23XHcCF+coGYevirZceTVD7NdJOqVn+49IHyxgszm+JIiHLoB2TkmPtsYkNWT1pvRSGkc35L6NHs0yHkN2SumA=="],
 
     "db0": ["db0@0.3.4", "", { "peerDependencies": { "@electric-sql/pglite": "*", "@libsql/client": "*", "better-sqlite3": "*", "drizzle-orm": "*", "mysql2": "*", "sqlite3": "*" }, "optionalPeers": ["@electric-sql/pglite", "@libsql/client", "better-sqlite3", "drizzle-orm", "mysql2", "sqlite3"] }, "sha512-RiXXi4WaNzPTHEOu8UPQKMooIbqOEyqA1t7Z6MsdxSCeb8iUC9ko3LcmsLmeUt2SM5bctfArZKkRQggKZz7JNw=="],
 
@@ -769,7 +797,7 @@
 
     "decimal.js": ["decimal.js@10.6.0", "", {}, "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg=="],
 
-    "decode-named-character-reference": ["decode-named-character-reference@1.2.0", "", { "dependencies": { "character-entities": "^2.0.0" } }, "sha512-c6fcElNV6ShtZXmsgNgFFV5tVX2PaV4g+MOAkb8eXHvn6sryJBrZa9r0zV6+dtTyoCKxtDy5tyQ5ZwQuidtd+Q=="],
+    "decode-named-character-reference": ["decode-named-character-reference@1.3.0", "", { "dependencies": { "character-entities": "^2.0.0" } }, "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q=="],
 
     "dequal": ["dequal@2.0.3", "", {}, "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA=="],
 
@@ -779,7 +807,7 @@
 
     "devlop": ["devlop@1.1.0", "", { "dependencies": { "dequal": "^2.0.0" } }, "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA=="],
 
-    "diff": ["diff@8.0.2", "", {}, "sha512-sSuxWU5j5SR9QQji/o2qMvqRNYRDOcBTgsJ/DeCf4iSN4gW+gNMXM7wFIP+fdXZxoNiAnHUTGjCr+TSWXdRDKg=="],
+    "diff": ["diff@8.0.3", "", {}, "sha512-qejHi7bcSD4hQAZE0tNAawRK1ZtafHDmMTMkrrIGgSLl7hTnQHmKCeB45xAcbfTqK2zowkM3j3bHt/4b/ARbYQ=="],
 
     "dom-accessibility-api": ["dom-accessibility-api@0.5.16", "", {}, "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg=="],
 
@@ -793,7 +821,7 @@
 
     "domutils": ["domutils@3.2.2", "", { "dependencies": { "dom-serializer": "^2.0.0", "domelementtype": "^2.3.0", "domhandler": "^5.0.3" } }, "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw=="],
 
-    "electron-to-chromium": ["electron-to-chromium@1.5.267", "", {}, "sha512-0Drusm6MVRXSOJpGbaSVgcQsuB4hEkMpHXaVstcPmhu5LIedxs1xNK/nIxmQIU/RPC0+1/o0AVZfBTkTNJOdUw=="],
+    "electron-to-chromium": ["electron-to-chromium@1.5.282", "", {}, "sha512-FCPkJtpst28UmFzd903iU7PdeVTfY0KAeJy+Lk0GLZRwgwYHn/irRcaCbQQOmr5Vytc/7rcavsYLvTM8RiHYhQ=="],
 
     "encoding-sniffer": ["encoding-sniffer@0.2.1", "", { "dependencies": { "iconv-lite": "^0.6.3", "whatwg-encoding": "^3.1.1" } }, "sha512-5gvq20T6vfpekVtqrYQsSCFZ1wEg5+wW0/QaZMWkFr6BqD3NfKs0rLCx4rrVlSWJeZb5NBJgVLswK/w2MWU+Gw=="],
 
@@ -845,9 +873,9 @@
 
     "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],
 
-    "h3": ["h3@2.0.1-rc.8", "", { "dependencies": { "rou3": "^0.7.12", "srvx": "^0.10.0" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"] }, "sha512-IIMQG7qnXx1Ls75suuMHH4xtcvTFxsUguDIZB+dgdYr1RftLj59FkeWF1dOr+jnejDs8Eo+ZKV1CMqogFeqGRQ=="],
+    "h3": ["h3@2.0.1-rc.11", "", { "dependencies": { "rou3": "^0.7.12", "srvx": "^0.10.1" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"] }, "sha512-2myzjCqy32c1As9TjZW9fNZXtLqNedjFSrdFy2AjFBQQ3LzrnGoDdFDYfC0tV2e4vcyfJ2Sfo/F6NQhO2Ly/Mw=="],
 
-    "h3-v2": ["h3@2.0.1-rc.7", "", { "dependencies": { "rou3": "^0.7.12", "srvx": "^0.10.0" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"] }, "sha512-qbrRu1OLXmUYnysWOCVrYhtC/m8ZuXu/zCbo3U/KyphJxbPFiC76jHYwVrmEcss9uNAHO5BoUguQ46yEpgI2PA=="],
+    "h3-v2": ["h3@2.0.1-rc.11", "", { "dependencies": { "rou3": "^0.7.12", "srvx": "^0.10.1" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"] }, "sha512-2myzjCqy32c1As9TjZW9fNZXtLqNedjFSrdFy2AjFBQQ3LzrnGoDdFDYfC0tV2e4vcyfJ2Sfo/F6NQhO2Ly/Mw=="],
 
     "has-flag": ["has-flag@4.0.0", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
 
@@ -861,7 +889,7 @@
 
     "html-url-attributes": ["html-url-attributes@3.0.1", "", {}, "sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ=="],
 
-    "htmlparser2": ["htmlparser2@10.0.0", "", { "dependencies": { "domelementtype": "^2.3.0", "domhandler": "^5.0.3", "domutils": "^3.2.1", "entities": "^6.0.0" } }, "sha512-TwAZM+zE5Tq3lrEHvOlvwgj1XLWQCtaaibSN11Q+gGBAS7Y1uZSWwXXRe4iF6OXnaq1riyQAPFOBtYc77Mxq0g=="],
+    "htmlparser2": ["htmlparser2@10.1.0", "", { "dependencies": { "domelementtype": "^2.3.0", "domhandler": "^5.0.3", "domutils": "^3.2.2", "entities": "^7.0.1" } }, "sha512-VTZkM9GWRAtEpveh7MSF6SjjrpNVNNVJfFup7xTY3UpFtm67foy9HDVXneLtFVt4pMz5kZtgNcvCniNFb1hlEQ=="],
 
     "http-proxy-agent": ["http-proxy-agent@7.0.2", "", { "dependencies": { "agent-base": "^7.1.0", "debug": "^4.3.4" } }, "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig=="],
 
@@ -899,7 +927,7 @@
 
     "is-unicode-supported": ["is-unicode-supported@2.1.0", "", {}, "sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ=="],
 
-    "isbot": ["isbot@5.1.32", "", {}, "sha512-VNfjM73zz2IBZmdShMfAUg10prm6t7HFUQmNAEOAVS4YH92ZrZcvkMcGX6cIgBJAzWDzPent/EeAtYEHNPNPBQ=="],
+    "isbot": ["isbot@5.1.34", "", {}, "sha512-aCMIBSKd/XPRYdiCQTLC8QHH4YT8B3JUADu+7COgYIZPvkeoMcUHMRjZLM9/7V8fCj+l7FSREc1lOPNjzogo/A=="],
 
     "istanbul-lib-coverage": ["istanbul-lib-coverage@3.2.2", "", {}, "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg=="],
 
@@ -915,7 +943,7 @@
 
     "js-yaml": ["js-yaml@4.1.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA=="],
 
-    "jsdom": ["jsdom@27.4.0", "", { "dependencies": { "@acemir/cssom": "^0.9.28", "@asamuzakjp/dom-selector": "^6.7.6", "@exodus/bytes": "^1.6.0", "cssstyle": "^5.3.4", "data-urls": "^6.0.0", "decimal.js": "^10.6.0", "html-encoding-sniffer": "^6.0.0", "http-proxy-agent": "^7.0.2", "https-proxy-agent": "^7.0.6", "is-potential-custom-element-name": "^1.0.1", "parse5": "^8.0.0", "saxes": "^6.0.0", "symbol-tree": "^3.2.4", "tough-cookie": "^6.0.0", "w3c-xmlserializer": "^5.0.0", "webidl-conversions": "^8.0.0", "whatwg-mimetype": "^4.0.0", "whatwg-url": "^15.1.0", "ws": "^8.18.3", "xml-name-validator": "^5.0.0" }, "peerDependencies": { "canvas": "^3.0.0" }, "optionalPeers": ["canvas"] }, "sha512-mjzqwWRD9Y1J1KUi7W97Gja1bwOOM5Ug0EZ6UDK3xS7j7mndrkwozHtSblfomlzyB4NepioNt+B2sOSzczVgtQ=="],
+    "jsdom": ["jsdom@28.0.0", "", { "dependencies": { "@acemir/cssom": "^0.9.31", "@asamuzakjp/dom-selector": "^6.7.6", "@exodus/bytes": "^1.11.0", "cssstyle": "^5.3.7", "data-urls": "^7.0.0", "decimal.js": "^10.6.0", "html-encoding-sniffer": "^6.0.0", "http-proxy-agent": "^7.0.2", "https-proxy-agent": "^7.0.6", "is-potential-custom-element-name": "^1.0.1", "parse5": "^8.0.0", "saxes": "^6.0.0", "symbol-tree": "^3.2.4", "tough-cookie": "^6.0.0", "undici": "^7.20.0", "w3c-xmlserializer": "^5.0.0", "webidl-conversions": "^8.0.1", "whatwg-mimetype": "^5.0.0", "whatwg-url": "^16.0.0", "xml-name-validator": "^5.0.0" }, "peerDependencies": { "canvas": "^3.0.0" }, "optionalPeers": ["canvas"] }, "sha512-KDYJgZ6T2TKdU8yBfYueq5EPG/EylMsBvCaenWMJb2OXmjgczzwveRCoJ+Hgj1lXPDyasvrgneSn4GBuR1hYyA=="],
 
     "jsesc": ["jsesc@3.1.0", "", { "bin": { "jsesc": "bin/jsesc" } }, "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA=="],
 
@@ -953,11 +981,11 @@
 
     "longest-streak": ["longest-streak@3.1.0", "", {}, "sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g=="],
 
-    "lru-cache": ["lru-cache@11.2.4", "", {}, "sha512-B5Y16Jr9LB9dHVkh6ZevG+vAbOsNOYCX+sXvFWFu7B3Iz5mijW3zdbMyhsh8ANd2mSWBYdJgnqi+mL7/LrOPYg=="],
+    "lru-cache": ["lru-cache@11.2.5", "", {}, "sha512-vFrFJkWtJvJnD5hg+hJvVE8Lh/TcMzKnTgCWmtBipwI5yLX/iX+5UB2tfuyODF5E7k9xEzMdYgGqaSb1c0c5Yw=="],
 
     "lucia": ["lucia@3.2.2", "", { "dependencies": { "@oslojs/crypto": "^1.0.1", "@oslojs/encoding": "^1.1.0" } }, "sha512-P1FlFBGCMPMXu+EGdVD9W4Mjm0DqsusmKgO7Xc33mI5X1bklmsQb0hfzPhXomQr9waWIBDsiOjvr1e6BTaUqpA=="],
 
-    "lucide-react": ["lucide-react@0.562.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-82hOAu7y0dbVuFfmO4bYF1XEwYk/mEbM5E+b1jgci/udUBEE/R7LF5Ip0CCEmXe8AybRM8L+04eP+LGZeDvkiw=="],
+    "lucide-react": ["lucide-react@0.563.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-8dXPB2GI4dI8jV4MgUDGBeLdGk8ekfqVZ0BdLcrRzocGgG75ltNEmWS+gE7uokKF/0oSUuczNDT+g9hFJ23FkA=="],
 
     "lz-string": ["lz-string@1.5.0", "", { "bin": { "lz-string": "bin/bin.js" } }, "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ=="],
 
@@ -1063,19 +1091,15 @@
 
     "mimic-function": ["mimic-function@5.0.1", "", {}, "sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA=="],
 
-    "clawdhub": ["clawdhub@workspace:packages/clawdhub"],
-
-    "clawdhub-schema": ["clawdhub-schema@workspace:packages/schema"],
-
     "monaco-editor": ["monaco-editor@0.55.1", "", { "dependencies": { "dompurify": "3.2.7", "marked": "14.0.0" } }, "sha512-jz4x+TJNFHwHtwuV9vA9rMujcZRb0CEilTEwG2rRSpe/A7Jdkuj8xPKttCgOh+v/lkHy7HsZ64oj+q3xoAFl9A=="],
 
     "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
 
     "nanoid": ["nanoid@3.3.11", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w=="],
 
-    "nf3": ["nf3@0.1.12", "", {}, "sha512-qbMXT7RTGh74MYWPeqTIED8nDW70NXOULVHpdWcdZ7IVHVnAsMV9fNugSNnvooipDc1FMOzpis7T9nXJEbJhvQ=="],
+    "nf3": ["nf3@0.3.7", "", {}, "sha512-wL73kyZbBoeTWlvQWQ0gQDZnqp+aNlUN5YIqsc3fv5V/06LAlwrwt+G7TpugFLJIai0AhrmnKJ2kgW0xprj+yQ=="],
 
-    "nitro": ["nitro@3.0.1-alpha.1", "", { "dependencies": { "consola": "^3.4.2", "crossws": "^0.4.1", "db0": "^0.3.4", "h3": "2.0.1-rc.5", "jiti": "^2.6.1", "nf3": "^0.1.10", "ofetch": "^2.0.0-alpha.3", "ohash": "^2.0.11", "oxc-minify": "^0.96.0", "oxc-transform": "^0.96.0", "srvx": "^0.9.5", "undici": "^7.16.0", "unenv": "^2.0.0-rc.24", "unstorage": "^2.0.0-alpha.4" }, "peerDependencies": { "rolldown": "*", "rollup": "^4", "vite": "^7", "xml2js": "^0.6.2" }, "optionalPeers": ["rolldown", "rollup", "vite", "xml2js"], "bin": { "nitro": "dist/cli/index.mjs" } }, "sha512-U4AxIsXxdkxzkFrK0XAw0e5Qbojk8jQ50MjjRBtBakC4HurTtQoiZvF+lSe382jhuQZCfAyywGWOFa9QzXLFaw=="],
+    "nitro": ["nitro@3.0.1-alpha.2", "", { "dependencies": { "consola": "^3.4.2", "crossws": "^0.4.3", "db0": "^0.3.4", "h3": "^2.0.1-rc.11", "jiti": "^2.6.1", "nf3": "^0.3.5", "ofetch": "^2.0.0-alpha.3", "ohash": "^2.0.11", "oxc-minify": "^0.110.0", "oxc-transform": "^0.110.0", "srvx": "^0.10.1", "undici": "^7.18.2", "unenv": "^2.0.0-rc.24", "unstorage": "^2.0.0-alpha.5" }, "peerDependencies": { "rolldown": ">=1.0.0-beta.0", "rollup": "^4", "vite": "^7 || ^8 || >=8.0.0-0", "xml2js": "^0.6.2" }, "optionalPeers": ["rolldown", "rollup", "vite", "xml2js"], "bin": { "nitro": "dist/cli/index.mjs" } }, "sha512-YviDY5J/trS821qQ1fpJtpXWIdPYiOizC/meHavlm1Hfuhx//H+Egd1+4C5SegJRgtWMnRPW9n//6Woaw81cTQ=="],
 
     "node-releases": ["node-releases@2.0.27", "", {}, "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA=="],
 
@@ -1095,15 +1119,15 @@
 
     "only-allow": ["only-allow@1.2.2", "", { "dependencies": { "which-pm-runs": "1.1.0" }, "bin": { "only-allow": "bin.js" } }, "sha512-uxyNYDsCh5YIJ780G7hC5OHjVUr9reHsbZNMM80L9tZlTpb3hUzb36KXgW4ZUGtJKQnGA3xegmWg1BxhWV0jJA=="],
 
-    "ora": ["ora@9.0.0", "", { "dependencies": { "chalk": "^5.6.2", "cli-cursor": "^5.0.0", "cli-spinners": "^3.2.0", "is-interactive": "^2.0.0", "is-unicode-supported": "^2.1.0", "log-symbols": "^7.0.1", "stdin-discarder": "^0.2.2", "string-width": "^8.1.0", "strip-ansi": "^7.1.2" } }, "sha512-m0pg2zscbYgWbqRR6ABga5c3sZdEon7bSgjnlXC64kxtxLOyjRcbbUkLj7HFyy/FTD+P2xdBWu8snGhYI0jc4A=="],
+    "ora": ["ora@9.1.0", "", { "dependencies": { "chalk": "^5.6.2", "cli-cursor": "^5.0.0", "cli-spinners": "^3.2.0", "is-interactive": "^2.0.0", "is-unicode-supported": "^2.1.0", "log-symbols": "^7.0.1", "stdin-discarder": "^0.2.2", "string-width": "^8.1.0" } }, "sha512-53uuLsXHOAJl5zLrUrzY9/kE+uIFEx7iaH4g2BIJQK4LZjY4LpCCYZVKDWIkL+F01wAaCg93duQ1whnK/AmY1A=="],
 
-    "oxc-minify": ["oxc-minify@0.96.0", "", { "optionalDependencies": { "@oxc-minify/binding-android-arm64": "0.96.0", "@oxc-minify/binding-darwin-arm64": "0.96.0", "@oxc-minify/binding-darwin-x64": "0.96.0", "@oxc-minify/binding-freebsd-x64": "0.96.0", "@oxc-minify/binding-linux-arm-gnueabihf": "0.96.0", "@oxc-minify/binding-linux-arm-musleabihf": "0.96.0", "@oxc-minify/binding-linux-arm64-gnu": "0.96.0", "@oxc-minify/binding-linux-arm64-musl": "0.96.0", "@oxc-minify/binding-linux-riscv64-gnu": "0.96.0", "@oxc-minify/binding-linux-s390x-gnu": "0.96.0", "@oxc-minify/binding-linux-x64-gnu": "0.96.0", "@oxc-minify/binding-linux-x64-musl": "0.96.0", "@oxc-minify/binding-wasm32-wasi": "0.96.0", "@oxc-minify/binding-win32-arm64-msvc": "0.96.0", "@oxc-minify/binding-win32-x64-msvc": "0.96.0" } }, "sha512-dXeeGrfPJJ4rMdw+NrqiCRtbzVX2ogq//R0Xns08zql2HjV3Zi2SBJ65saqfDaJzd2bcHqvGWH+M44EQCHPAcA=="],
+    "oxc-minify": ["oxc-minify@0.110.0", "", { "optionalDependencies": { "@oxc-minify/binding-android-arm-eabi": "0.110.0", "@oxc-minify/binding-android-arm64": "0.110.0", "@oxc-minify/binding-darwin-arm64": "0.110.0", "@oxc-minify/binding-darwin-x64": "0.110.0", "@oxc-minify/binding-freebsd-x64": "0.110.0", "@oxc-minify/binding-linux-arm-gnueabihf": "0.110.0", "@oxc-minify/binding-linux-arm-musleabihf": "0.110.0", "@oxc-minify/binding-linux-arm64-gnu": "0.110.0", "@oxc-minify/binding-linux-arm64-musl": "0.110.0", "@oxc-minify/binding-linux-ppc64-gnu": "0.110.0", "@oxc-minify/binding-linux-riscv64-gnu": "0.110.0", "@oxc-minify/binding-linux-riscv64-musl": "0.110.0", "@oxc-minify/binding-linux-s390x-gnu": "0.110.0", "@oxc-minify/binding-linux-x64-gnu": "0.110.0", "@oxc-minify/binding-linux-x64-musl": "0.110.0", "@oxc-minify/binding-openharmony-arm64": "0.110.0", "@oxc-minify/binding-wasm32-wasi": "0.110.0", "@oxc-minify/binding-win32-arm64-msvc": "0.110.0", "@oxc-minify/binding-win32-ia32-msvc": "0.110.0", "@oxc-minify/binding-win32-x64-msvc": "0.110.0" } }, "sha512-KWGTzPo83QmGrXC4ml83PM9HDwUPtZFfasiclUvTV4i3/0j7xRRqINVkrL77CbQnoWura3CMxkRofjQKVDuhBw=="],
 
-    "oxc-transform": ["oxc-transform@0.96.0", "", { "optionalDependencies": { "@oxc-transform/binding-android-arm64": "0.96.0", "@oxc-transform/binding-darwin-arm64": "0.96.0", "@oxc-transform/binding-darwin-x64": "0.96.0", "@oxc-transform/binding-freebsd-x64": "0.96.0", "@oxc-transform/binding-linux-arm-gnueabihf": "0.96.0", "@oxc-transform/binding-linux-arm-musleabihf": "0.96.0", "@oxc-transform/binding-linux-arm64-gnu": "0.96.0", "@oxc-transform/binding-linux-arm64-musl": "0.96.0", "@oxc-transform/binding-linux-riscv64-gnu": "0.96.0", "@oxc-transform/binding-linux-s390x-gnu": "0.96.0", "@oxc-transform/binding-linux-x64-gnu": "0.96.0", "@oxc-transform/binding-linux-x64-musl": "0.96.0", "@oxc-transform/binding-wasm32-wasi": "0.96.0", "@oxc-transform/binding-win32-arm64-msvc": "0.96.0", "@oxc-transform/binding-win32-x64-msvc": "0.96.0" } }, "sha512-dQPNIF+gHpSkmC0+Vg9IktNyhcn28Y8R3eTLyzn52UNymkasLicl3sFAtz7oEVuFmCpgGjaUTKkwk+jW2cHpDQ=="],
+    "oxc-transform": ["oxc-transform@0.110.0", "", { "optionalDependencies": { "@oxc-transform/binding-android-arm-eabi": "0.110.0", "@oxc-transform/binding-android-arm64": "0.110.0", "@oxc-transform/binding-darwin-arm64": "0.110.0", "@oxc-transform/binding-darwin-x64": "0.110.0", "@oxc-transform/binding-freebsd-x64": "0.110.0", "@oxc-transform/binding-linux-arm-gnueabihf": "0.110.0", "@oxc-transform/binding-linux-arm-musleabihf": "0.110.0", "@oxc-transform/binding-linux-arm64-gnu": "0.110.0", "@oxc-transform/binding-linux-arm64-musl": "0.110.0", "@oxc-transform/binding-linux-ppc64-gnu": "0.110.0", "@oxc-transform/binding-linux-riscv64-gnu": "0.110.0", "@oxc-transform/binding-linux-riscv64-musl": "0.110.0", "@oxc-transform/binding-linux-s390x-gnu": "0.110.0", "@oxc-transform/binding-linux-x64-gnu": "0.110.0", "@oxc-transform/binding-linux-x64-musl": "0.110.0", "@oxc-transform/binding-openharmony-arm64": "0.110.0", "@oxc-transform/binding-wasm32-wasi": "0.110.0", "@oxc-transform/binding-win32-arm64-msvc": "0.110.0", "@oxc-transform/binding-win32-ia32-msvc": "0.110.0", "@oxc-transform/binding-win32-x64-msvc": "0.110.0" } }, "sha512-/fymQNzzUoKZweH0nC5yvbI2eR0yWYusT9TEKDYVgOgYrf9Qmdez9lUFyvxKR9ycx+PTHi/reIOzqf3wkShQsw=="],
 
-    "oxlint": ["oxlint@1.39.0", "", { "optionalDependencies": { "@oxlint/darwin-arm64": "1.39.0", "@oxlint/darwin-x64": "1.39.0", "@oxlint/linux-arm64-gnu": "1.39.0", "@oxlint/linux-arm64-musl": "1.39.0", "@oxlint/linux-x64-gnu": "1.39.0", "@oxlint/linux-x64-musl": "1.39.0", "@oxlint/win32-arm64": "1.39.0", "@oxlint/win32-x64": "1.39.0" }, "peerDependencies": { "oxlint-tsgolint": ">=0.10.0" }, "optionalPeers": ["oxlint-tsgolint"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-wSiLr0wjG+KTU6c1LpVoQk7JZ7l8HCKlAkVDVTJKWmCGazsNxexxnOXl7dsar92mQcRnzko5g077ggP3RINSjA=="],
+    "oxlint": ["oxlint@1.42.0", "", { "optionalDependencies": { "@oxlint/darwin-arm64": "1.42.0", "@oxlint/darwin-x64": "1.42.0", "@oxlint/linux-arm64-gnu": "1.42.0", "@oxlint/linux-arm64-musl": "1.42.0", "@oxlint/linux-x64-gnu": "1.42.0", "@oxlint/linux-x64-musl": "1.42.0", "@oxlint/win32-arm64": "1.42.0", "@oxlint/win32-x64": "1.42.0" }, "peerDependencies": { "oxlint-tsgolint": ">=0.11.2" }, "optionalPeers": ["oxlint-tsgolint"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-qnspC/lrp8FgKNaONLLn14dm+W5t0SSlus6V5NJpgI2YNT1tkFYZt4fBf14ESxf9AAh98WBASnW5f0gtw462Lg=="],
 
-    "oxlint-tsgolint": ["oxlint-tsgolint@0.11.1", "", { "optionalDependencies": { "@oxlint-tsgolint/darwin-arm64": "0.11.1", "@oxlint-tsgolint/darwin-x64": "0.11.1", "@oxlint-tsgolint/linux-arm64": "0.11.1", "@oxlint-tsgolint/linux-x64": "0.11.1", "@oxlint-tsgolint/win32-arm64": "0.11.1", "@oxlint-tsgolint/win32-x64": "0.11.1" }, "bin": { "tsgolint": "bin/tsgolint.js" } }, "sha512-WulCp+0/6RvpM4zPv+dAXybf03QvRA8ATxaBlmj4XMIQqTs5jeq3cUTk48WCt4CpLwKhyyGZPHmjLl1KHQ/cvA=="],
+    "oxlint-tsgolint": ["oxlint-tsgolint@0.11.4", "", { "optionalDependencies": { "@oxlint-tsgolint/darwin-arm64": "0.11.4", "@oxlint-tsgolint/darwin-x64": "0.11.4", "@oxlint-tsgolint/linux-arm64": "0.11.4", "@oxlint-tsgolint/linux-x64": "0.11.4", "@oxlint-tsgolint/win32-arm64": "0.11.4", "@oxlint-tsgolint/win32-x64": "0.11.4" }, "bin": { "tsgolint": "bin/tsgolint.js" } }, "sha512-VyQc+69TxQwUdsEPiVFN7vNZdDVO/FHaEcHltnWs3O6rvwxv67uADlknQQO714sbRdEahOjgO5dFf+K9ili0gg=="],
 
     "p-retry": ["p-retry@7.1.1", "", { "dependencies": { "is-network-error": "^1.1.0" } }, "sha512-J5ApzjyRkkf601HpEeykoiCvzHQjWxPAHhyjFcEUP2SWq0+35NKh8TLhpLw+Dkq5TZBFvUM6UigdE9hIVYTl5w=="],
 
@@ -1123,9 +1147,9 @@
 
     "picomatch": ["picomatch@4.0.3", "", {}, "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q=="],
 
-    "playwright": ["playwright@1.57.0", "", { "dependencies": { "playwright-core": "1.57.0" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-ilYQj1s8sr2ppEJ2YVadYBN0Mb3mdo9J0wQ+UuDhzYqURwSoW4n1Xs5vs7ORwgDGmyEh33tRMeS8KhdkMoLXQw=="],
+    "playwright": ["playwright@1.58.1", "", { "dependencies": { "playwright-core": "1.58.1" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-+2uTZHxSCcxjvGc5C891LrS1/NlxglGxzrC4seZiVjcYVQfUa87wBL6rTDqzGjuoWNjnBzRqKmF6zRYGMvQUaQ=="],
 
-    "playwright-core": ["playwright-core@1.57.0", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-agTcKlMw/mjBWOnD6kFZttAAGHgi/Nw0CZ2o6JqWSbMlI219lAFLZZCyqByTsvVAJq5XA5H8cA6PrvBRpBWEuQ=="],
+    "playwright-core": ["playwright-core@1.58.1", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-bcWzOaTxcW+VOOGBCQgnaKToLJ65d6AqfLVKEWvexyS3AS6rbXl+xdpYRMGSRBClPvyj44njOWoxjNdL/H9UNg=="],
 
     "postcss": ["postcss@8.5.6", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg=="],
 
@@ -1133,7 +1157,7 @@
 
     "preact-render-to-string": ["preact-render-to-string@6.5.11", "", { "peerDependencies": { "preact": ">=10" } }, "sha512-ubnauqoGczeGISiOh6RjX0/cdaF8v/oDXIjO85XALCQjwQP+SB4RDXXtvZ6yTYSjG+PC1QRP2AhPgCEsM2EvUw=="],
 
-    "prettier": ["prettier@3.7.4", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-v6UNi1+3hSlVvv8fSaoUbggEM5VErKmmpGA7Pl3HF8V6uKY7rvClBOJlH6yNwQtfTueNkGVpOv/mtWL9L4bgRA=="],
+    "prettier": ["prettier@3.8.1", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg=="],
 
     "pretty-format": ["pretty-format@27.5.1", "", { "dependencies": { "ansi-regex": "^5.0.1", "ansi-styles": "^5.0.0", "react-is": "^17.0.1" } }, "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ=="],
 
@@ -1141,9 +1165,9 @@
 
     "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
 
-    "react": ["react@19.2.3", "", {}, "sha512-Ku/hhYbVjOQnXDZFv2+RibmLFGwFdeeKHFcOTlrt7xplBnya5OGn/hIRDsqDiSUcfORsDC7MPxwork8jBwsIWA=="],
+    "react": ["react@19.2.4", "", {}, "sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ=="],
 
-    "react-dom": ["react-dom@19.2.3", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.3" } }, "sha512-yELu4WmLPw5Mr/lmeEpox5rw3RETacE++JgHqQzd2dg+YbJuat3jH4ingc+WPZhxaoFzdv9y33G+F7Nl5O0GBg=="],
+    "react-dom": ["react-dom@19.2.4", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.4" } }, "sha512-AXJdLo8kgMbimY95O2aKQqsz2iWi9jMgKJhRBAxECE4IFxfcazB2LmzloIoibJI3C12IlY20+KFaLv+71bUJeQ=="],
 
     "react-is": ["react-is@17.0.2", "", {}, "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w=="],
 
@@ -1175,7 +1199,7 @@
 
     "restore-cursor": ["restore-cursor@5.1.0", "", { "dependencies": { "onetime": "^7.0.0", "signal-exit": "^4.1.0" } }, "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA=="],
 
-    "rollup": ["rollup@4.54.0", "", { "dependencies": { "@types/estree": "1.0.8" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.54.0", "@rollup/rollup-android-arm64": "4.54.0", "@rollup/rollup-darwin-arm64": "4.54.0", "@rollup/rollup-darwin-x64": "4.54.0", "@rollup/rollup-freebsd-arm64": "4.54.0", "@rollup/rollup-freebsd-x64": "4.54.0", "@rollup/rollup-linux-arm-gnueabihf": "4.54.0", "@rollup/rollup-linux-arm-musleabihf": "4.54.0", "@rollup/rollup-linux-arm64-gnu": "4.54.0", "@rollup/rollup-linux-arm64-musl": "4.54.0", "@rollup/rollup-linux-loong64-gnu": "4.54.0", "@rollup/rollup-linux-ppc64-gnu": "4.54.0", "@rollup/rollup-linux-riscv64-gnu": "4.54.0", "@rollup/rollup-linux-riscv64-musl": "4.54.0", "@rollup/rollup-linux-s390x-gnu": "4.54.0", "@rollup/rollup-linux-x64-gnu": "4.54.0", "@rollup/rollup-linux-x64-musl": "4.54.0", "@rollup/rollup-openharmony-arm64": "4.54.0", "@rollup/rollup-win32-arm64-msvc": "4.54.0", "@rollup/rollup-win32-ia32-msvc": "4.54.0", "@rollup/rollup-win32-x64-gnu": "4.54.0", "@rollup/rollup-win32-x64-msvc": "4.54.0", "fsevents": "~2.3.2" }, "bin": { "rollup": "dist/bin/rollup" } }, "sha512-3nk8Y3a9Ea8szgKhinMlGMhGMw89mqule3KWczxhIzqudyHdCIOHw8WJlj/r329fACjKLEh13ZSk7oE22kyeIw=="],
+    "rollup": ["rollup@4.57.0", "", { "dependencies": { "@types/estree": "1.0.8" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.57.0", "@rollup/rollup-android-arm64": "4.57.0", "@rollup/rollup-darwin-arm64": "4.57.0", "@rollup/rollup-darwin-x64": "4.57.0", "@rollup/rollup-freebsd-arm64": "4.57.0", "@rollup/rollup-freebsd-x64": "4.57.0", "@rollup/rollup-linux-arm-gnueabihf": "4.57.0", "@rollup/rollup-linux-arm-musleabihf": "4.57.0", "@rollup/rollup-linux-arm64-gnu": "4.57.0", "@rollup/rollup-linux-arm64-musl": "4.57.0", "@rollup/rollup-linux-loong64-gnu": "4.57.0", "@rollup/rollup-linux-loong64-musl": "4.57.0", "@rollup/rollup-linux-ppc64-gnu": "4.57.0", "@rollup/rollup-linux-ppc64-musl": "4.57.0", "@rollup/rollup-linux-riscv64-gnu": "4.57.0", "@rollup/rollup-linux-riscv64-musl": "4.57.0", "@rollup/rollup-linux-s390x-gnu": "4.57.0", "@rollup/rollup-linux-x64-gnu": "4.57.0", "@rollup/rollup-linux-x64-musl": "4.57.0", "@rollup/rollup-openbsd-x64": "4.57.0", "@rollup/rollup-openharmony-arm64": "4.57.0", "@rollup/rollup-win32-arm64-msvc": "4.57.0", "@rollup/rollup-win32-ia32-msvc": "4.57.0", "@rollup/rollup-win32-x64-gnu": "4.57.0", "@rollup/rollup-win32-x64-msvc": "4.57.0", "fsevents": "~2.3.2" }, "bin": { "rollup": "dist/bin/rollup" } }, "sha512-e5lPJi/aui4TO1LpAXIRLySmwXSE8k3b9zoGfd42p67wzxog4WHjiZF3M2uheQih4DGyc25QEV4yRBbpueNiUA=="],
 
     "rou3": ["rou3@0.7.12", "", {}, "sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg=="],
 
@@ -1187,9 +1211,9 @@
 
     "semver": ["semver@7.7.3", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q=="],
 
-    "seroval": ["seroval@1.4.2", "", {}, "sha512-N3HEHRCZYn3cQbsC4B5ldj9j+tHdf4JZoYPlcI4rRYu0Xy4qN8MQf1Z08EibzB0WpgRG5BGK08FTrmM66eSzKQ=="],
+    "seroval": ["seroval@1.5.0", "", {}, "sha512-OE4cvmJ1uSPrKorFIH9/w/Qwuvi/IMcGbv5RKgcJ/zjA/IohDLU6SVaxFN9FwajbP7nsX0dQqMDes1whk3y+yw=="],
 
-    "seroval-plugins": ["seroval-plugins@1.4.2", "", { "peerDependencies": { "seroval": "^1.0" } }, "sha512-X7p4MEDTi+60o2sXZ4bnDBhgsUYDSkQEvzYZuJyFqWg9jcoPsHts5nrg5O956py2wyt28lUrBxk0M0/wU8URpA=="],
+    "seroval-plugins": ["seroval-plugins@1.5.0", "", { "peerDependencies": { "seroval": "^1.0" } }, "sha512-EAHqADIQondwRZIdeW2I636zgsODzoBDwb3PT/+7TLDWyw1Dy/Xv7iGUIEXXav7usHDE9HVhOU61irI3EnyyHA=="],
 
     "server-only": ["server-only@0.0.1", "", {}, "sha512-qepMx2JxAa5jjfzxG79yPPq+8BuFToHd1hm7kI+Z4zAq1ftQiP7HcxMhDDItrbtwVeLg/cY2JnKnrcFkmiswNA=="],
 
@@ -1201,7 +1225,7 @@
 
     "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="],
 
-    "solid-js": ["solid-js@1.9.10", "", { "dependencies": { "csstype": "^3.1.0", "seroval": "~1.3.0", "seroval-plugins": "~1.3.0" } }, "sha512-Coz956cos/EPDlhs6+jsdTxKuJDPT7B5SVIWgABwROyxjY7Xbr8wkzD68Et+NxnV7DLJ3nJdAC2r9InuV/4Jew=="],
+    "solid-js": ["solid-js@1.9.11", "", { "dependencies": { "csstype": "^3.1.0", "seroval": "~1.5.0", "seroval-plugins": "~1.5.0" } }, "sha512-WEJtcc5mkh/BnHA6Yrg4whlF8g6QwpmXXRg4P2ztPmcKeHHlH4+djYecBLhSpecZY2RRECXYUwIc/C2r3yzQ4Q=="],
 
     "source-map": ["source-map@0.7.6", "", {}, "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ=="],
 
@@ -1209,7 +1233,7 @@
 
     "space-separated-tokens": ["space-separated-tokens@2.0.2", "", {}, "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q=="],
 
-    "srvx": ["srvx@0.10.0", "", { "bin": { "srvx": "bin/srvx.mjs" } }, "sha512-NqIsR+wQCfkvvwczBh8J8uM4wTZx41K2lLSEp/3oMp917ODVVMtW5Me4epCmQ3gH8D+0b+/t4xxkUKutyhimTA=="],
+    "srvx": ["srvx@0.10.1", "", { "bin": { "srvx": "bin/srvx.mjs" } }, "sha512-A//xtfak4eESMWWydSRFUVvCTQbSwivnGCEf8YGPe2eHU0+Z6znfUTCPF0a7oV3sObSOcrXHlL6Bs9vVctfXdg=="],
 
     "stackback": ["stackback@0.0.2", "", {}, "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw=="],
 
@@ -1219,7 +1243,7 @@
 
     "stdin-discarder": ["stdin-discarder@0.2.2", "", {}, "sha512-UhDfHmA92YAlNnCfhmq0VeNL5bDbiZGg7sZ2IvPsXubGkiNa9EC+tUTsjBRsYUAz87btI6/1wf4XoVvQ3uRnmQ=="],
 
-    "string-width": ["string-width@8.1.0", "", { "dependencies": { "get-east-asian-width": "^1.3.0", "strip-ansi": "^7.1.0" } }, "sha512-Kxl3KJGb/gxkaUMOjRsQ8IrXiGW75O4E3RPjFIINOVH8AMl2SQ/yWdTzWwF3FevIX9LcMAjJW+GRwAlAbTSXdg=="],
+    "string-width": ["string-width@8.1.1", "", { "dependencies": { "get-east-asian-width": "^1.3.0", "strip-ansi": "^7.1.0" } }, "sha512-KpqHIdDL9KwYk22wEOg/VIqYbrnLeSApsKT/bSj6Ez7pn3CftUiLAv2Lccpq1ALcpLV9UX1Ppn92npZWu2w/aw=="],
 
     "stringify-entities": ["stringify-entities@4.0.4", "", { "dependencies": { "character-entities-html4": "^2.0.0", "character-entities-legacy": "^3.0.0" } }, "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg=="],
 
@@ -1273,9 +1297,9 @@
 
     "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
 
-    "ufo": ["ufo@1.6.1", "", {}, "sha512-9a4/uxlTWJ4+a5i0ooc1rU7C7YOw3wT+UGqdeNNHWnOF9qcMBgLRS+4IYUqbczewFx4mLEig6gawh7X6mFlEkA=="],
+    "ufo": ["ufo@1.6.3", "", {}, "sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q=="],
 
-    "undici": ["undici@7.16.0", "", {}, "sha512-QEg3HPMll0o3t2ourKwOeUAZ159Kn9mx5pnzHRQO8+Wixmh88YdZRiIwat0iNzNNXn0yoEtXJqFpyW7eM8BV7g=="],
+    "undici": ["undici@7.20.0", "", {}, "sha512-MJZrkjyd7DeC+uPZh+5/YaMDxFiiEEaDgbUSVMXayofAkDWF1088CDo+2RPg7B1BuS1qf1vgNE7xqwPxE0DuSQ=="],
 
     "undici-types": ["undici-types@7.16.0", "", {}, "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw=="],
 
@@ -1289,13 +1313,13 @@
 
     "unist-util-stringify-position": ["unist-util-stringify-position@4.0.0", "", { "dependencies": { "@types/unist": "^3.0.0" } }, "sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ=="],
 
-    "unist-util-visit": ["unist-util-visit@5.0.0", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-is": "^6.0.0", "unist-util-visit-parents": "^6.0.0" } }, "sha512-MR04uvD+07cwl/yhVuVWAtw+3GOR/knlL55Nd/wAdblk27GCVt3lqpTivy/tkJcZoNPzTwS1Y+KMojlLDhoTzg=="],
+    "unist-util-visit": ["unist-util-visit@5.1.0", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-is": "^6.0.0", "unist-util-visit-parents": "^6.0.0" } }, "sha512-m+vIdyeCOpdr/QeQCu2EzxX/ohgS8KbnPDgFni4dQsfSCtpz8UqDyY5GjRru8PDKuYn7Fq19j1CQ+nJSsGKOzg=="],
 
     "unist-util-visit-parents": ["unist-util-visit-parents@6.0.2", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-is": "^6.0.0" } }, "sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ=="],
 
     "unplugin": ["unplugin@2.3.11", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "acorn": "^8.15.0", "picomatch": "^4.0.3", "webpack-virtual-modules": "^0.6.2" } }, "sha512-5uKD0nqiYVzlmCRs01Fhs2BdkEgBS3SAVP6ndrBsuK42iC2+JHyxM05Rm9G8+5mkmRtzMZGY8Ct5+mliZxU/Ww=="],
 
-    "unstorage": ["unstorage@2.0.0-alpha.4", "", { "peerDependencies": { "@azure/app-configuration": "^1.8.0", "@azure/cosmos": "^4.2.0", "@azure/data-tables": "^13.3.0", "@azure/identity": "^4.6.0", "@azure/keyvault-secrets": "^4.9.0", "@azure/storage-blob": "^12.26.0", "@capacitor/preferences": "^6.0.3 || ^7.0.0", "@deno/kv": ">=0.9.0", "@netlify/blobs": "^6.5.0 || ^7.0.0 || ^8.1.0 || ^9.0.0 || ^10.0.0", "@planetscale/database": "^1.19.0", "@upstash/redis": "^1.34.3", "@vercel/blob": ">=0.27.1", "@vercel/functions": "^2.2.12 || ^3.0.0", "@vercel/kv": "^1.0.1", "aws4fetch": "^1.0.20", "chokidar": "^4.0.3", "db0": ">=0.2.1", "idb-keyval": "^6.2.1", "ioredis": "^5.4.2", "lru-cache": "^11.2.2", "mongodb": "^6.20.0", "ofetch": "*", "uploadthing": "^7.4.4" }, "optionalPeers": ["@azure/app-configuration", "@azure/cosmos", "@azure/data-tables", "@azure/identity", "@azure/keyvault-secrets", "@azure/storage-blob", "@capacitor/preferences", "@deno/kv", "@netlify/blobs", "@planetscale/database", "@upstash/redis", "@vercel/blob", "@vercel/functions", "@vercel/kv", "aws4fetch", "chokidar", "db0", "idb-keyval", "ioredis", "lru-cache", "mongodb", "ofetch", "uploadthing"] }, "sha512-ywXZMZRfrvmO1giJeMTCw6VUn0ALYxVl8pFqJPStiyQUvgJImejtAHrKvXPj4QGJAoS/iLGcVGF6ljN/lkh1bw=="],
+    "unstorage": ["unstorage@2.0.0-alpha.5", "", { "peerDependencies": { "@azure/app-configuration": "^1.9.0", "@azure/cosmos": "^4.7.0", "@azure/data-tables": "^13.3.1", "@azure/identity": "^4.13.0", "@azure/keyvault-secrets": "^4.10.0", "@azure/storage-blob": "^12.29.1", "@capacitor/preferences": "^6.0.3 || ^7.0.0", "@deno/kv": ">=0.12.0", "@netlify/blobs": "^6.5.0 || ^7.0.0 || ^8.1.0 || ^9.0.0 || ^10.0.0", "@planetscale/database": "^1.19.0", "@upstash/redis": "^1.35.6", "@vercel/blob": ">=0.27.3", "@vercel/functions": "^2.2.12 || ^3.0.0", "@vercel/kv": "^1.0.1", "aws4fetch": "^1.0.20", "chokidar": "^4 || ^5", "db0": ">=0.3.4", "idb-keyval": "^6.2.2", "ioredis": "^5.8.2", "lru-cache": "^11.2.2", "mongodb": "^6 || ^7", "ofetch": "*", "uploadthing": "^7.7.4" }, "optionalPeers": ["@azure/app-configuration", "@azure/cosmos", "@azure/data-tables", "@azure/identity", "@azure/keyvault-secrets", "@azure/storage-blob", "@capacitor/preferences", "@deno/kv", "@netlify/blobs", "@planetscale/database", "@upstash/redis", "@vercel/blob", "@vercel/functions", "@vercel/kv", "aws4fetch", "chokidar", "db0", "idb-keyval", "ioredis", "lru-cache", "mongodb", "ofetch", "uploadthing"] }, "sha512-Sj8btci21Twnd6M+N+MHhjg3fVn6lAPElPmvFTe0Y/wR0WImErUdA1PzlAaUavHylJ7uDiFwlZDQKm0elG4b7g=="],
 
     "update-browserslist-db": ["update-browserslist-db@1.2.3", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w=="],
 
@@ -1311,11 +1335,11 @@
 
     "vite": ["vite@7.3.1", "", { "dependencies": { "esbuild": "^0.27.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6", "rollup": "^4.43.0", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "jiti": ">=1.21.0", "less": "^4.0.0", "lightningcss": "^1.21.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA=="],
 
-    "vite-tsconfig-paths": ["vite-tsconfig-paths@6.0.4", "", { "dependencies": { "debug": "^4.1.1", "globrex": "^0.1.2", "tsconfck": "^3.0.3", "vite": "*" } }, "sha512-iIsEJ+ek5KqRTK17pmxtgIxXtqr3qDdE6OxrP9mVeGhVDNXRJTKN/l9oMbujTQNzMLe6XZ8qmpztfbkPu2TiFQ=="],
+    "vite-tsconfig-paths": ["vite-tsconfig-paths@6.0.5", "", { "dependencies": { "debug": "^4.1.1", "globrex": "^0.1.2", "tsconfck": "^3.0.3" }, "peerDependencies": { "vite": "*" } }, "sha512-f/WvY6ekHykUF1rWJUAbCU7iS/5QYDIugwpqJA+ttwKbxSbzNlqlE8vZSrsnxNQciUW+z6lvhlXMaEyZn9MSig=="],
 
     "vitefu": ["vitefu@1.1.1", "", { "peerDependencies": { "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0-beta.0" }, "optionalPeers": ["vite"] }, "sha512-B/Fegf3i8zh0yFbpzZ21amWzHmuNlLlmJT6n7bu5e+pCHUKQIfXSYokrqOBGEMMe9UG2sostKQF9mml/vYaWJQ=="],
 
-    "vitest": ["vitest@4.0.17", "", { "dependencies": { "@vitest/expect": "4.0.17", "@vitest/mocker": "4.0.17", "@vitest/pretty-format": "4.0.17", "@vitest/runner": "4.0.17", "@vitest/snapshot": "4.0.17", "@vitest/spy": "4.0.17", "@vitest/utils": "4.0.17", "es-module-lexer": "^1.7.0", "expect-type": "^1.2.2", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^3.10.0", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.0.3", "vite": "^6.0.0 || ^7.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.0.17", "@vitest/browser-preview": "4.0.17", "@vitest/browser-webdriverio": "4.0.17", "@vitest/ui": "4.0.17", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-FQMeF0DJdWY0iOnbv466n/0BudNdKj1l5jYgl5JVTwjSsZSlqyXFt/9+1sEyhR6CLowbZpV7O1sCHrzBhucKKg=="],
+    "vitest": ["vitest@4.0.18", "", { "dependencies": { "@vitest/expect": "4.0.18", "@vitest/mocker": "4.0.18", "@vitest/pretty-format": "4.0.18", "@vitest/runner": "4.0.18", "@vitest/snapshot": "4.0.18", "@vitest/spy": "4.0.18", "@vitest/utils": "4.0.18", "es-module-lexer": "^1.7.0", "expect-type": "^1.2.2", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^3.10.0", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.0.3", "vite": "^6.0.0 || ^7.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.0.18", "@vitest/browser-preview": "4.0.18", "@vitest/browser-webdriverio": "4.0.18", "@vitest/ui": "4.0.18", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-hOQuK7h0FGKgBAas7v0mSAsnvrIgAvWmRFjmzpJ7SwFHH3g1k2u37JtYwOwmEKhK6ZO3v9ggDBBm0La1LCK4uQ=="],
 
     "w3c-xmlserializer": ["w3c-xmlserializer@5.0.0", "", { "dependencies": { "xml-name-validator": "^5.0.0" } }, "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA=="],
 
@@ -1325,15 +1349,15 @@
 
     "whatwg-encoding": ["whatwg-encoding@3.1.1", "", { "dependencies": { "iconv-lite": "0.6.3" } }, "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ=="],
 
-    "whatwg-mimetype": ["whatwg-mimetype@4.0.0", "", {}, "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg=="],
+    "whatwg-mimetype": ["whatwg-mimetype@5.0.0", "", {}, "sha512-sXcNcHOC51uPGF0P/D4NVtrkjSU2fNsm9iog4ZvZJsL3rjoDAzXZhkm2MWt1y+PUdggKAYVoMAIYcs78wJ51Cw=="],
 
-    "whatwg-url": ["whatwg-url@15.1.0", "", { "dependencies": { "tr46": "^6.0.0", "webidl-conversions": "^8.0.0" } }, "sha512-2ytDk0kiEj/yu90JOAp44PVPUkO9+jVhyf+SybKlRHSDlvOOZhdPIrr7xTH64l4WixO2cP+wQIcgujkGBPPz6g=="],
+    "whatwg-url": ["whatwg-url@16.0.0", "", { "dependencies": { "@exodus/bytes": "^1.11.0", "tr46": "^6.0.0", "webidl-conversions": "^8.0.1" } }, "sha512-9CcxtEKsf53UFwkSUZjG+9vydAsFO4lFHBpJUtjBcoJOCJpKnSJNwCw813zrYJHpCJ7sgfbtOe0V5Ku7Pa1XMQ=="],
 
     "which-pm-runs": ["which-pm-runs@1.1.0", "", {}, "sha512-n1brCuqClxfFfq/Rb0ICg9giSZqCS+pLtccdag6C2HyufBrh3fBOiy9nb6ggRMvWOVH5GrdJskj5iGTZNxd7SA=="],
 
     "why-is-node-running": ["why-is-node-running@2.3.0", "", { "dependencies": { "siginfo": "^2.0.0", "stackback": "0.0.2" }, "bin": { "why-is-node-running": "cli.js" } }, "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w=="],
 
-    "ws": ["ws@8.18.3", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg=="],
+    "ws": ["ws@8.19.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg=="],
 
     "xml-name-validator": ["xml-name-validator@5.0.0", "", {}, "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg=="],
 
@@ -1357,9 +1381,9 @@
 
     "@babel/helper-compilation-targets/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
-    "@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.8.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.1.0", "tslib": "^2.4.0" }, "bundled": true }, "sha512-ryJnSmj4UhrGLZZPJ6PKVb4wNPAIkW6iyLy+0TRwazd3L1u0wzMe8RfqevAh2HbcSkoeLiSYnOVDOys4JSGYyg=="],
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.8.1", "", { "dependencies": { "@emnapi/wasi-threads": "1.1.0", "tslib": "^2.4.0" }, "bundled": true }, "sha512-AvT9QFpxK0Zd8J0jopedNm+w/2fIzvtPKPjqyw9jwvBaReTTqPBk9Hixaz7KbjimP+QNz605/XnjFcDAL2pqBg=="],
 
-    "@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.8.0", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-Z82FDl1ByxqPEPrAYYeTQVlx2FSHPe1qwX465c+96IRS3fTdSYRoJcRxg3g2fEG5I69z1dSEWQlNRRr0/677mg=="],
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.8.1", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-mehfKSMWjjNol8659Z8KxEMrdSJDDot5SXMq00dM8BN4o+CLNXQ0xH2V7EchNHV4RmbZLmmPdEaXZc5H2FXmDg=="],
 
     "@tailwindcss/oxide-wasm32-wasi/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.1.0", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ=="],
 
@@ -1369,6 +1393,8 @@
 
     "@tailwindcss/oxide-wasm32-wasi/tslib": ["tslib@2.8.1", "", { "bundled": true }, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
 
+    "@tanstack/start-plugin-core/@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],
+
     "@tanstack/start-plugin-core/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-beta.40", "", {}, "sha512-s3GeJKSQOwBlzdUrj4ISjJj5SfSh+aqn0wjOar4Bx95iV1ETI7F6S/5hLcfAxZ9kXDcyrAkxPlqmd1ZITttf+w=="],
 
     "anymatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
@@ -1377,13 +1403,21 @@
 
     "cheerio/parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
 
+    "cheerio/undici": ["undici@7.19.2", "", {}, "sha512-4VQSpGEGsWzk0VYxyB/wVX/Q7qf9t5znLRgs0dzszr9w9Fej/8RVNQ+S20vdXSAyra/bJ7ZQfGv6ZMj7UEbzSg=="],
+
+    "cheerio/whatwg-mimetype": ["whatwg-mimetype@4.0.0", "", {}, "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg=="],
+
+    "clawhub/undici": ["undici@7.19.2", "", {}, "sha512-4VQSpGEGsWzk0VYxyB/wVX/Q7qf9t5znLRgs0dzszr9w9Fej/8RVNQ+S20vdXSAyra/bJ7ZQfGv6ZMj7UEbzSg=="],
+
     "convex/esbuild": ["esbuild@0.27.0", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.0", "@esbuild/android-arm": "0.27.0", "@esbuild/android-arm64": "0.27.0", "@esbuild/android-x64": "0.27.0", "@esbuild/darwin-arm64": "0.27.0", "@esbuild/darwin-x64": "0.27.0", "@esbuild/freebsd-arm64": "0.27.0", "@esbuild/freebsd-x64": "0.27.0", "@esbuild/linux-arm": "0.27.0", "@esbuild/linux-arm64": "0.27.0", "@esbuild/linux-ia32": "0.27.0", "@esbuild/linux-loong64": "0.27.0", "@esbuild/linux-mips64el": "0.27.0", "@esbuild/linux-ppc64": "0.27.0", "@esbuild/linux-riscv64": "0.27.0", "@esbuild/linux-s390x": "0.27.0", "@esbuild/linux-x64": "0.27.0", "@esbuild/netbsd-arm64": "0.27.0", "@esbuild/netbsd-x64": "0.27.0", "@esbuild/openbsd-arm64": "0.27.0", "@esbuild/openbsd-x64": "0.27.0", "@esbuild/openharmony-arm64": "0.27.0", "@esbuild/sunos-x64": "0.27.0", "@esbuild/win32-arm64": "0.27.0", "@esbuild/win32-ia32": "0.27.0", "@esbuild/win32-x64": "0.27.0" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-jd0f4NHbD6cALCyGElNpGAOtWxSq46l9X/sWB0Nzd5er4Kz2YTm+Vl0qKFT9KUJvD8+fiO8AvoHhFvEatfVixA=="],
 
     "dom-serializer/entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],
 
-    "nitro/h3": ["h3@2.0.1-rc.5", "", { "dependencies": { "rou3": "^0.7.9", "srvx": "^0.9.1" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"] }, "sha512-qkohAzCab0nLzXNm78tBjZDvtKMTmtygS8BJLT3VPczAQofdqlFXDPkXdLMJN4r05+xqneG8snZJ0HgkERCZTg=="],
+    "html-encoding-sniffer/@exodus/bytes": ["@exodus/bytes@1.10.0", "", { "peerDependencies": { "@noble/hashes": "^1.8.0 || ^2.0.0" }, "optionalPeers": ["@noble/hashes"] }, "sha512-tf8YdcbirXdPnJ+Nd4UN1EXnz+IP2DI45YVEr3vvzcVTOyrApkmIB4zvOQVd3XPr7RXnfBtAx+PXImXOIU0Ajg=="],
 
-    "nitro/srvx": ["srvx@0.9.8", "", { "bin": { "srvx": "bin/srvx.mjs" } }, "sha512-RZaxTKJEE/14HYn8COLuUOJAt0U55N9l1Xf6jj+T0GoA01EUH1Xz5JtSUOI+EHn+AEgPCVn7gk6jHJffrr06fQ=="],
+    "htmlparser2/entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
+
+    "nitro/undici": ["undici@7.19.2", "", {}, "sha512-4VQSpGEGsWzk0VYxyB/wVX/Q7qf9t5znLRgs0dzszr9w9Fej/8RVNQ+S20vdXSAyra/bJ7ZQfGv6ZMj7UEbzSg=="],
 
     "parse-entities/@types/unist": ["@types/unist@2.0.11", "", {}, "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA=="],
 
@@ -1397,10 +1431,6 @@
 
     "recast/source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
 
-    "solid-js/seroval": ["seroval@1.3.2", "", {}, "sha512-RbcPH1n5cfwKrru7v7+zrZvjLurgHhGyso3HTyGtRivGWgYjbOmGuivCQaORNELjNONoK35nj28EoWul9sb1zQ=="],
-
-    "solid-js/seroval-plugins": ["seroval-plugins@1.3.3", "", { "peerDependencies": { "seroval": "^1.0" } }, "sha512-16OL3NnUBw8JG1jBLUoZJsLnQq0n5Ua6aHalhJK4fMQkz1lqR7Osz1sA30trBtd9VUDc2NgkuRCn8+/pBwqZ+w=="],
-
     "strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
 
     "convex/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.0", "", { "os": "aix", "cpu": "ppc64" }, "sha512-KuZrd2hRjz01y5JK9mEBSD3Vj3mbCvemhT466rSuJYeE/hjuBrHfjjcjMdTm/sz7au+++sdbJZJmuBwQLuw68A=="],

clawhub

@@ -0,0 +1,46 @@
+#!/usr/bin/env bun
+import { existsSync } from 'node:fs'
+import { stat } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
+
+const distCliUrl = new URL('./packages/clawdhub/dist/cli.js', import.meta.url)
+const distCliPath = fileURLToPath(distCliUrl)
+const srcRootPath = fileURLToPath(new URL('./packages/clawdhub/src/', import.meta.url))
+
+const shouldBuild = await (async () => {
+  if (!existsSync(distCliPath)) return true
+  try {
+    const dist = await stat(distCliPath)
+    const latestSrcMtime = await getLatestMtime(srcRootPath)
+    return latestSrcMtime > dist.mtimeMs
+  } catch {
+    return true
+  }
+})()
+
+if (shouldBuild) {
+  const proc = Bun.spawn(['bunx', 'tsc', '-p', 'packages/clawdhub/tsconfig.json'], {
+    stdin: 'inherit',
+    stdout: 'inherit',
+    stderr: 'inherit',
+  })
+  const code = await proc.exited
+  if (code !== 0) process.exit(code)
+}
+
+await import(distCliUrl.href)
+
+async function getLatestMtime(root: string) {
+  let latest = 0
+  const glob = new Bun.Glob('**/*.ts')
+  for await (const rel of glob.scan({ cwd: root, onlyFiles: true })) {
+    const path = `${root}${root.endsWith('/') ? '' : '/'}${rel}`
+    try {
+      const entry = await stat(path)
+      latest = Math.max(latest, entry.mtimeMs)
+    } catch {
+      // ignore
+    }
+  }
+  return latest
+}

convex/_generated/api.d.ts

@@ -28,6 +28,7 @@ import type * as lib_apiTokenAuth from "../lib/apiTokenAuth.js";
 import type * as lib_badges from "../lib/badges.js";
 import type * as lib_changelog from "../lib/changelog.js";
 import type * as lib_embeddings from "../lib/embeddings.js";
+import type * as lib_githubAccount from "../lib/githubAccount.js";
 import type * as lib_githubBackup from "../lib/githubBackup.js";
 import type * as lib_githubImport from "../lib/githubImport.js";
 import type * as lib_githubSoulBackup from "../lib/githubSoulBackup.js";
@@ -35,14 +36,18 @@ import type * as lib_leaderboards from "../lib/leaderboards.js";
 import type * as lib_moderation from "../lib/moderation.js";
 import type * as lib_public from "../lib/public.js";
 import type * as lib_searchText from "../lib/searchText.js";
+import type * as lib_securityPrompt from "../lib/securityPrompt.js";
 import type * as lib_skillBackfill from "../lib/skillBackfill.js";
 import type * as lib_skillPublish from "../lib/skillPublish.js";
 import type * as lib_skillStats from "../lib/skillStats.js";
+import type * as lib_skillZip from "../lib/skillZip.js";
 import type * as lib_skills from "../lib/skills.js";
 import type * as lib_soulChangelog from "../lib/soulChangelog.js";
 import type * as lib_soulPublish from "../lib/soulPublish.js";
 import type * as lib_tokens from "../lib/tokens.js";
+import type * as lib_userSearch from "../lib/userSearch.js";
 import type * as lib_webhooks from "../lib/webhooks.js";
+import type * as llmEval from "../llmEval.js";
 import type * as maintenance from "../maintenance.js";
 import type * as rateLimits from "../rateLimits.js";
 import type * as search from "../search.js";
@@ -60,6 +65,7 @@ import type * as telemetry from "../telemetry.js";
 import type * as tokens from "../tokens.js";
 import type * as uploads from "../uploads.js";
 import type * as users from "../users.js";
+import type * as vt from "../vt.js";
 import type * as webhooks from "../webhooks.js";
 
 import type {
@@ -89,6 +95,7 @@ declare const fullApi: ApiFromModules<{
   "lib/badges": typeof lib_badges;
   "lib/changelog": typeof lib_changelog;
   "lib/embeddings": typeof lib_embeddings;
+  "lib/githubAccount": typeof lib_githubAccount;
   "lib/githubBackup": typeof lib_githubBackup;
   "lib/githubImport": typeof lib_githubImport;
   "lib/githubSoulBackup": typeof lib_githubSoulBackup;
@@ -96,14 +103,18 @@ declare const fullApi: ApiFromModules<{
   "lib/moderation": typeof lib_moderation;
   "lib/public": typeof lib_public;
   "lib/searchText": typeof lib_searchText;
+  "lib/securityPrompt": typeof lib_securityPrompt;
   "lib/skillBackfill": typeof lib_skillBackfill;
   "lib/skillPublish": typeof lib_skillPublish;
   "lib/skillStats": typeof lib_skillStats;
+  "lib/skillZip": typeof lib_skillZip;
   "lib/skills": typeof lib_skills;
   "lib/soulChangelog": typeof lib_soulChangelog;
   "lib/soulPublish": typeof lib_soulPublish;
   "lib/tokens": typeof lib_tokens;
+  "lib/userSearch": typeof lib_userSearch;
   "lib/webhooks": typeof lib_webhooks;
+  llmEval: typeof llmEval;
   maintenance: typeof maintenance;
   rateLimits: typeof rateLimits;
   search: typeof search;
@@ -121,6 +132,7 @@ declare const fullApi: ApiFromModules<{
   tokens: typeof tokens;
   uploads: typeof uploads;
   users: typeof users;
+  vt: typeof vt;
   webhooks: typeof webhooks;
 }>;
 

convex/auth.test.ts

@@ -0,0 +1,101 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { Id } from './_generated/dataModel'
+import { BANNED_REAUTH_MESSAGE, handleSoftDeletedUserReauth } from './auth'
+
+function makeCtx({
+  user,
+  banRecord,
+}: {
+  user: { deletedAt?: number } | null
+  banRecord?: Record<string, unknown> | null
+}) {
+  const query = {
+    withIndex: vi.fn().mockReturnValue({
+      filter: vi.fn().mockReturnValue({
+        first: vi.fn().mockResolvedValue(banRecord ?? null),
+      }),
+    }),
+  }
+  const ctx = {
+    db: {
+      get: vi.fn().mockResolvedValue(user),
+      patch: vi.fn().mockResolvedValue(null),
+      query: vi.fn().mockReturnValue(query),
+    },
+  }
+  return { ctx, query }
+}
+
+describe('handleSoftDeletedUserReauth', () => {
+  const userId = 'users:1' as Id<'users'>
+
+  it('skips when user not found', async () => {
+    const { ctx } = makeCtx({ user: null })
+
+    await handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: userId })
+
+    expect(ctx.db.get).toHaveBeenCalledWith(userId)
+    expect(ctx.db.query).not.toHaveBeenCalled()
+  })
+
+  it('skips active users', async () => {
+    const { ctx } = makeCtx({ user: { deletedAt: undefined } })
+
+    await handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: userId })
+
+    expect(ctx.db.query).not.toHaveBeenCalled()
+    expect(ctx.db.patch).not.toHaveBeenCalled()
+  })
+
+  it('restores soft-deleted users when not banned', async () => {
+    const { ctx } = makeCtx({ user: { deletedAt: 123 }, banRecord: null })
+
+    await handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: userId })
+
+    expect(ctx.db.patch).toHaveBeenCalledWith(userId, {
+      deletedAt: undefined,
+      updatedAt: expect.any(Number),
+    })
+  })
+
+  it('restores soft-deleted users on fresh login (existingUserId is null)', async () => {
+    const { ctx } = makeCtx({ user: { deletedAt: 123 }, banRecord: null })
+
+    await handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: null })
+
+    expect(ctx.db.patch).toHaveBeenCalledWith(userId, {
+      deletedAt: undefined,
+      updatedAt: expect.any(Number),
+    })
+  })
+
+  it('skips reactivation when existingUserId does not match userId', async () => {
+    const otherUserId = 'users:999' as Id<'users'>
+    const { ctx } = makeCtx({ user: { deletedAt: 123 } })
+
+    await handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: otherUserId })
+
+    expect(ctx.db.query).not.toHaveBeenCalled()
+    expect(ctx.db.patch).not.toHaveBeenCalled()
+  })
+
+  it('blocks banned users with a custom message', async () => {
+    const { ctx } = makeCtx({ user: { deletedAt: 123 }, banRecord: { action: 'user.ban' } })
+
+    await expect(
+      handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: userId }),
+    ).rejects.toThrow(BANNED_REAUTH_MESSAGE)
+
+    expect(ctx.db.patch).not.toHaveBeenCalled()
+  })
+
+  it('blocks banned users on fresh login (existingUserId is null)', async () => {
+    const { ctx } = makeCtx({ user: { deletedAt: 123 }, banRecord: { action: 'user.ban' } })
+
+    await expect(
+      handleSoftDeletedUserReauth(ctx as never, { userId, existingUserId: null }),
+    ).rejects.toThrow(BANNED_REAUTH_MESSAGE)
+
+    expect(ctx.db.patch).not.toHaveBeenCalled()
+  })
+})

convex/auth.ts

@@ -1,5 +1,40 @@
 import GitHub from '@auth/core/providers/github'
 import { convexAuth } from '@convex-dev/auth/server'
+import type { GenericMutationCtx } from 'convex/server'
+import { ConvexError } from 'convex/values'
+import type { DataModel, Id } from './_generated/dataModel'
+
+export const BANNED_REAUTH_MESSAGE =
+  'Your account has been banned for uploading malicious skills. If you believe this is a mistake, please contact security@openclaw.ai and we will work with you to restore access.'
+
+export async function handleSoftDeletedUserReauth(
+  ctx: GenericMutationCtx<DataModel>,
+  args: { userId: Id<'users'>; existingUserId: Id<'users'> | null },
+) {
+  const user = await ctx.db.get(args.userId)
+  if (!user?.deletedAt) return
+
+  // Verify that the incoming identity matches the soft-deleted user to prevent bypass.
+  if (args.existingUserId && args.existingUserId !== args.userId) {
+    return
+  }
+
+  const userId = args.userId
+  const banRecord = await ctx.db
+    .query('auditLogs')
+    .withIndex('by_target', (q) => q.eq('targetType', 'user').eq('targetId', userId.toString()))
+    .filter((q) => q.eq(q.field('action'), 'user.ban'))
+    .first()
+
+  if (banRecord) {
+    throw new ConvexError(BANNED_REAUTH_MESSAGE)
+  }
+
+  await ctx.db.patch(userId, {
+    deletedAt: undefined,
+    updatedAt: Date.now(),
+  })
+}
 
 export const { auth, signIn, signOut, store, isAuthenticated } = convexAuth({
   providers: [
@@ -16,4 +51,17 @@ export const { auth, signIn, signOut, store, isAuthenticated } = convexAuth({
       },
     }),
   ],
+  callbacks: {
+    /**
+     * Handle re-authentication of soft-deleted users.
+     *
+     * Performance note: This callback runs on every OAuth sign-in, but the
+     * audit log query ONLY executes when a soft-deleted user attempts to
+     * sign in (user.deletedAt is set). For normal active users, this is
+     * just a single `if` check on an already-loaded field - no extra queries.
+     */
+    async afterUserCreatedOrUpdated(ctx, args) {
+      await handleSoftDeletedUserReauth(ctx, args)
+    },
+  },
 })

convex/comments.ts

@@ -3,6 +3,7 @@ import type { Doc } from './_generated/dataModel'
 import { mutation, query } from './_generated/server'
 import { assertModerator, requireUser } from './lib/access'
 import { type PublicUser, toPublicUser } from './lib/public'
+import { insertStatEvent } from './skillStatEvents'
 
 export const listBySkill = query({
   args: { skillId: v.id('skills'), limit: v.optional(v.number()) },
@@ -43,10 +44,7 @@ export const add = mutation({
       deletedBy: undefined,
     })
 
-    await ctx.db.patch(skill._id, {
-      stats: { ...skill.stats, comments: skill.stats.comments + 1 },
-      updatedAt: Date.now(),
-    })
+    await insertStatEvent(ctx, { skillId: skill._id, kind: 'comment' })
   },
 })
 
@@ -68,13 +66,7 @@ export const remove = mutation({
       deletedBy: user._id,
     })
 
-    const skill = await ctx.db.get(comment.skillId)
-    if (skill) {
-      await ctx.db.patch(skill._id, {
-        stats: { ...skill.stats, comments: Math.max(0, skill.stats.comments - 1) },
-        updatedAt: Date.now(),
-      })
-    }
+    await insertStatEvent(ctx, { skillId: comment.skillId, kind: 'uncomment' })
 
     await ctx.db.insert('auditLogs', {
       actorUserId: user._id,

convex/crons.ts

@@ -31,4 +31,13 @@ crons.interval(
   {},
 )
 
+crons.interval('vt-pending-scans', { minutes: 5 }, internal.vt.pollPendingScans, { batchSize: 100 })
+
+crons.interval('vt-cache-backfill', { minutes: 30 }, internal.vt.backfillActiveSkillsVTCache, {
+  batchSize: 100,
+})
+
+// Daily re-scan of all active skills at 3am UTC
+crons.daily('vt-daily-rescan', { hourUTC: 3, minuteUTC: 0 }, internal.vt.rescanActiveSkills, {})
+
 export default crons

convex/downloads.ts

@@ -1,7 +1,7 @@
 import { v } from 'convex/values'
-import { zipSync } from 'fflate'
 import { api } from './_generated/api'
 import { httpAction, mutation } from './_generated/server'
+import { buildDeterministicZip } from './lib/skillZip'
 import { insertStatEvent } from './skillStatEvents'
 
 export const downloadZip = httpAction(async (ctx, request) => {
@@ -19,6 +19,27 @@ export const downloadZip = httpAction(async (ctx, request) => {
     return new Response('Skill not found', { status: 404 })
   }
 
+  // Block downloads based on moderation status
+  const mod = skillResult.moderationInfo
+  if (mod?.isMalwareBlocked) {
+    return new Response(
+      'Blocked: this skill has been flagged as malicious by VirusTotal and cannot be downloaded.',
+      { status: 403 },
+    )
+  }
+  if (mod?.isPendingScan) {
+    return new Response(
+      'This skill is pending a security scan by VirusTotal. Please try again in a few minutes.',
+      { status: 423 },
+    )
+  }
+  if (mod?.isRemoved) {
+    return new Response('This skill has been removed by a moderator.', { status: 410 })
+  }
+  if (mod?.isHiddenByMod) {
+    return new Response('This skill is currently unavailable.', { status: 403 })
+  }
+
   const skill = skillResult.skill
   let version = skillResult.latestVersion
 
@@ -41,16 +62,19 @@ export const downloadZip = httpAction(async (ctx, request) => {
     return new Response('Version not available', { status: 410 })
   }
 
-  const files: Record<string, Uint8Array> = {}
+  const entries: Array<{ path: string; bytes: Uint8Array }> = []
   for (const file of version.files) {
     const blob = await ctx.storage.get(file.storageId)
     if (!blob) continue
     const buffer = new Uint8Array(await blob.arrayBuffer())
-    files[file.path] = buffer
+    entries.push({ path: file.path, bytes: buffer })
   }
-
-  const zipData = zipSync(files, { level: 6 })
-  const zipArray = Uint8Array.from(zipData)
+  const zipArray = buildDeterministicZip(entries, {
+    ownerId: String(skill.ownerUserId),
+    slug: skill.slug,
+    version: version.version,
+    publishedAt: version.createdAt,
+  })
   const zipBlob = new Blob([zipArray], { type: 'application/zip' })
 
   await ctx.runMutation(api.downloads.increment, { skillId: skill._id })
@@ -68,10 +92,11 @@ export const downloadZip = httpAction(async (ctx, request) => {
 export const increment = mutation({
   args: { skillId: v.id('skills') },
   handler: async (ctx, args) => {
-    const skill = await ctx.db.get(args.skillId)
-    if (!skill) return
+    // Skip db.get to avoid adding the skill doc to the read set.
+    // The calling HTTP action already validated the skill exists,
+    // and the stat processor handles deleted skills gracefully.
     await insertStatEvent(ctx, {
-      skillId: skill._id,
+      skillId: args.skillId,
       kind: 'download',
     })
   },

convex/http.ts

@@ -1,4 +1,4 @@
-import { ApiRoutes, LegacyApiRoutes } from 'clawdhub-schema'
+import { ApiRoutes, LegacyApiRoutes } from 'clawhub-schema'
 import { httpRouter } from 'convex/server'
 import { auth } from './auth'
 import { downloadZip } from './downloads'
@@ -28,6 +28,8 @@ import {
   soulsPostRouterV1Http,
   starsDeleteRouterV1Http,
   starsPostRouterV1Http,
+  usersListV1Http,
+  usersPostRouterV1Http,
   whoamiV1Http,
 } from './httpApiV1'
 
@@ -101,6 +103,18 @@ http.route({
   handler: whoamiV1Http,
 })
 
+http.route({
+  pathPrefix: `${ApiRoutes.users}/`,
+  method: 'POST',
+  handler: usersPostRouterV1Http,
+})
+
+http.route({
+  path: ApiRoutes.users,
+  method: 'GET',
+  handler: usersListV1Http,
+})
+
 http.route({
   path: ApiRoutes.souls,
   method: 'GET',

convex/httpApi.ts

@@ -5,7 +5,7 @@ import {
   CliSkillDeleteRequestSchema,
   CliTelemetrySyncRequestSchema,
   parseArk,
-} from 'clawdhub-schema'
+} from 'clawhub-schema'
 import { api, internal } from './_generated/api'
 import type { Id } from './_generated/dataModel'
 import type { ActionCtx } from './_generated/server'

convex/httpApiV1.handlers.test.ts

@@ -15,8 +15,33 @@ const { __handlers } = await import('./httpApiV1')
 
 type ActionCtx = import('./_generated/server').ActionCtx
 
+type RateLimitArgs = { key: string; limit: number; windowMs: number }
+
+function isRateLimitArgs(args: unknown): args is RateLimitArgs {
+  if (!args || typeof args !== 'object') return false
+  const value = args as Record<string, unknown>
+  return (
+    typeof value.key === 'string' &&
+    typeof value.limit === 'number' &&
+    typeof value.windowMs === 'number'
+  )
+}
+
 function makeCtx(partial: Record<string, unknown>) {
-  return partial as unknown as ActionCtx
+  const partialRunQuery =
+    typeof partial.runQuery === 'function'
+      ? (partial.runQuery as (query: unknown, args: Record<string, unknown>) => unknown)
+      : null
+  const runQuery = vi.fn(async (query: unknown, args: Record<string, unknown>) => {
+    if (isRateLimitArgs(args)) return okRate()
+    return partialRunQuery ? await partialRunQuery(query, args) : null
+  })
+  const runMutation =
+    typeof partial.runMutation === 'function'
+      ? partial.runMutation
+      : vi.fn().mockResolvedValue(okRate())
+
+  return { ...partial, runQuery, runMutation } as unknown as ActionCtx
 }
 
 const okRate = () => ({
@@ -524,6 +549,108 @@ describe('httpApiV1 handlers', () => {
     expect(response2.status).toBe(200)
   })
 
+  it('ban user requires auth', async () => {
+    vi.mocked(requireApiTokenUser).mockRejectedValueOnce(new Error('Unauthorized'))
+    const runMutation = vi.fn().mockResolvedValue(okRate())
+    const response = await __handlers.usersPostRouterV1Handler(
+      makeCtx({ runMutation }),
+      new Request('https://example.com/api/v1/users/ban', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ handle: 'demo' }),
+      }),
+    )
+    expect(response.status).toBe(401)
+  })
+
+  it('ban user succeeds with handle', async () => {
+    vi.mocked(requireApiTokenUser).mockResolvedValue({
+      userId: 'users:1',
+      user: { handle: 'p' },
+    } as never)
+    const runQuery = vi.fn().mockResolvedValue({ _id: 'users:2' })
+    const runMutation = vi
+      .fn()
+      .mockResolvedValueOnce(okRate())
+      .mockResolvedValueOnce({ ok: true, alreadyBanned: false, deletedSkills: 2 })
+    const response = await __handlers.usersPostRouterV1Handler(
+      makeCtx({ runQuery, runMutation }),
+      new Request('https://example.com/api/v1/users/ban', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ handle: 'demo' }),
+      }),
+    )
+    expect(response.status).toBe(200)
+    const json = await response.json()
+    expect(json.deletedSkills).toBe(2)
+  })
+
+  it('ban user forwards reason', async () => {
+    vi.mocked(requireApiTokenUser).mockResolvedValue({
+      userId: 'users:1',
+      user: { handle: 'p' },
+    } as never)
+    const runQuery = vi.fn().mockResolvedValue({ _id: 'users:2' })
+    const runMutation = vi
+      .fn()
+      .mockResolvedValueOnce(okRate())
+      .mockResolvedValueOnce({ ok: true, alreadyBanned: false, deletedSkills: 0 })
+    await __handlers.usersPostRouterV1Handler(
+      makeCtx({ runQuery, runMutation }),
+      new Request('https://example.com/api/v1/users/ban', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ handle: 'demo', reason: 'malware' }),
+      }),
+    )
+    expect(runMutation).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        actorUserId: 'users:1',
+        targetUserId: 'users:2',
+        reason: 'malware',
+      }),
+    )
+  })
+
+  it('set role requires auth', async () => {
+    vi.mocked(requireApiTokenUser).mockRejectedValueOnce(new Error('Unauthorized'))
+    const runMutation = vi.fn().mockResolvedValue(okRate())
+    const response = await __handlers.usersPostRouterV1Handler(
+      makeCtx({ runMutation }),
+      new Request('https://example.com/api/v1/users/role', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ handle: 'demo', role: 'moderator' }),
+      }),
+    )
+    expect(response.status).toBe(401)
+  })
+
+  it('set role succeeds with handle', async () => {
+    vi.mocked(requireApiTokenUser).mockResolvedValue({
+      userId: 'users:1',
+      user: { handle: 'p' },
+    } as never)
+    const runQuery = vi.fn().mockResolvedValue({ _id: 'users:2' })
+    const runMutation = vi
+      .fn()
+      .mockResolvedValueOnce(okRate())
+      .mockResolvedValueOnce({ ok: true, role: 'moderator' })
+    const response = await __handlers.usersPostRouterV1Handler(
+      makeCtx({ runQuery, runMutation }),
+      new Request('https://example.com/api/v1/users/role', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ handle: 'demo', role: 'moderator' }),
+      }),
+    )
+    expect(response.status).toBe(200)
+    const json = await response.json()
+    expect(json.role).toBe('moderator')
+  })
+
   it('stars require auth', async () => {
     vi.mocked(requireApiTokenUser).mockRejectedValueOnce(new Error('Unauthorized'))
     const runMutation = vi.fn().mockResolvedValue(okRate())

convex/httpApiV1.ts

@@ -1,4 +1,4 @@
-import { CliPublishRequestSchema, parseArk } from 'clawdhub-schema'
+import { CliPublishRequestSchema, parseArk } from 'clawhub-schema'
 import { api, internal } from './_generated/api'
 import type { Doc, Id } from './_generated/dataModel'
 import type { ActionCtx } from './_generated/server'
@@ -60,6 +60,14 @@ type GetBySlugResult = {
   } | null
   latestVersion: Doc<'skillVersions'> | null
   owner: { _id: Id<'users'>; handle?: string; displayName?: string; image?: string } | null
+  moderationInfo?: {
+    isPendingScan: boolean
+    isMalwareBlocked: boolean
+    isSuspicious: boolean
+    isHiddenByMod: boolean
+    isRemoved: boolean
+    reason?: string
+  } | null
 } | null
 
 type ListVersionsResult = {
@@ -196,7 +204,7 @@ async function listSkillsV1Handler(ctx: ActionCtx, request: Request) {
   const limit = toOptionalNumber(url.searchParams.get('limit'))
   const rawCursor = url.searchParams.get('cursor')?.trim() || undefined
   const sort = parseListSort(url.searchParams.get('sort'))
-  const cursor = sort === 'updated' ? rawCursor : undefined
+  const cursor = sort === 'trending' ? undefined : rawCursor
 
   const result = (await ctx.runQuery(api.skills.listPublicPage, {
     limit,
@@ -272,6 +280,12 @@ async function skillsGetRouterV1Handler(ctx: ActionCtx, request: Request) {
               image: result.owner.image ?? null,
             }
           : null,
+        moderation: result.moderationInfo
+          ? {
+              isSuspicious: result.moderationInfo.isSuspicious ?? false,
+              isMalwareBlocked: result.moderationInfo.isMalwareBlocked ?? false,
+            }
+          : null,
       },
       200,
       rate.headers,
@@ -376,8 +390,7 @@ async function skillsGetRouterV1Handler(ctx: ActionCtx, request: Request) {
     const textContent = await blob.text()
 
     const isSvg =
-      file.contentType?.toLowerCase().includes('svg') ||
-      file.path.toLowerCase().endsWith('.svg')
+      file.contentType?.toLowerCase().includes('svg') || file.path.toLowerCase().endsWith('.svg')
 
     const headers = mergeHeaders(rate.headers, {
       'Content-Type': file.contentType
@@ -392,7 +405,8 @@ async function skillsGetRouterV1Handler(ctx: ActionCtx, request: Request) {
       // For any text response that a browser might try to render, lock it down.
       // In particular, this prevents SVG <foreignObject> script execution from
       // reading localStorage tokens on this origin.
-      'Content-Security-Policy': "default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+      'Content-Security-Policy':
+        "default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
       ...(isSvg ? { 'Content-Disposition': 'attachment' } : {}),
     })
     return new Response(textContent, { status: 200, headers })
@@ -526,6 +540,145 @@ async function whoamiV1Handler(ctx: ActionCtx, request: Request) {
 
 export const whoamiV1Http = httpAction(whoamiV1Handler)
 
+async function usersPostRouterV1Handler(ctx: ActionCtx, request: Request) {
+  const rate = await applyRateLimit(ctx, request, 'write')
+  if (!rate.ok) return rate.response
+
+  const segments = getPathSegments(request, '/api/v1/users/')
+  if (segments.length !== 1) {
+    return text('Not found', 404, rate.headers)
+  }
+  const action = segments[0]
+  if (action !== 'ban' && action !== 'role') {
+    return text('Not found', 404, rate.headers)
+  }
+
+  let payload: Record<string, unknown>
+  try {
+    payload = (await request.json()) as Record<string, unknown>
+  } catch {
+    return text('Invalid JSON', 400, rate.headers)
+  }
+
+  const handleRaw = typeof payload.handle === 'string' ? payload.handle.trim() : ''
+  const userIdRaw = typeof payload.userId === 'string' ? payload.userId.trim() : ''
+  const reasonRaw = typeof payload.reason === 'string' ? payload.reason.trim() : ''
+  if (!handleRaw && !userIdRaw) {
+    return text('Missing userId or handle', 400, rate.headers)
+  }
+
+  const roleRaw = typeof payload.role === 'string' ? payload.role.trim().toLowerCase() : ''
+  if (action === 'role' && !roleRaw) {
+    return text('Missing role', 400, rate.headers)
+  }
+  const role = roleRaw === 'user' || roleRaw === 'moderator' || roleRaw === 'admin' ? roleRaw : null
+  if (action === 'role' && !role) {
+    return text('Invalid role', 400, rate.headers)
+  }
+
+  let actorUserId: Id<'users'>
+  try {
+    const auth = await requireApiTokenUser(ctx, request)
+    actorUserId = auth.userId
+  } catch {
+    return text('Unauthorized', 401, rate.headers)
+  }
+
+  let targetUserId: Id<'users'> | null = userIdRaw ? (userIdRaw as Id<'users'>) : null
+  if (!targetUserId) {
+    const handle = handleRaw.toLowerCase()
+    const user = await ctx.runQuery(api.users.getByHandle, { handle })
+    if (!user?._id) return text('User not found', 404, rate.headers)
+    targetUserId = user._id
+  }
+
+  if (action === 'ban') {
+    const reason = reasonRaw.length > 0 ? reasonRaw : undefined
+    if (reason && reason.length > 500) {
+      return text('Reason too long (max 500 chars)', 400, rate.headers)
+    }
+    try {
+      const result = await ctx.runMutation(internal.users.banUserInternal, {
+        actorUserId,
+        targetUserId,
+        reason,
+      })
+      return json(result, 200, rate.headers)
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Ban failed'
+      if (message.toLowerCase().includes('forbidden')) {
+        return text('Forbidden', 403, rate.headers)
+      }
+      if (message.toLowerCase().includes('not found')) {
+        return text(message, 404, rate.headers)
+      }
+      return text(message, 400, rate.headers)
+    }
+  }
+
+  if (!role) {
+    return text('Invalid role', 400, rate.headers)
+  }
+
+  try {
+    const result = await ctx.runMutation(internal.users.setRoleInternal, {
+      actorUserId,
+      targetUserId,
+      role,
+    })
+    return json({ ok: true, role: result.role ?? role }, 200, rate.headers)
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'Role change failed'
+    if (message.toLowerCase().includes('forbidden')) {
+      return text('Forbidden', 403, rate.headers)
+    }
+    if (message.toLowerCase().includes('not found')) {
+      return text(message, 404, rate.headers)
+    }
+    return text(message, 400, rate.headers)
+  }
+}
+
+export const usersPostRouterV1Http = httpAction(usersPostRouterV1Handler)
+
+async function usersListV1Handler(ctx: ActionCtx, request: Request) {
+  const rate = await applyRateLimit(ctx, request, 'read')
+  if (!rate.ok) return rate.response
+
+  const url = new URL(request.url)
+  const limitRaw = toOptionalNumber(url.searchParams.get('limit'))
+  const query = url.searchParams.get('q') ?? url.searchParams.get('query') ?? ''
+
+  let actorUserId: Id<'users'>
+  try {
+    const auth = await requireApiTokenUser(ctx, request)
+    actorUserId = auth.userId
+  } catch {
+    return text('Unauthorized', 401, rate.headers)
+  }
+
+  const limit = Math.min(Math.max(limitRaw ?? 20, 1), 200)
+  try {
+    const result = await ctx.runQuery(internal.users.searchInternal, {
+      actorUserId,
+      query,
+      limit,
+    })
+    return json(result, 200, rate.headers)
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'User search failed'
+    if (message.toLowerCase().includes('forbidden')) {
+      return text('Forbidden', 403, rate.headers)
+    }
+    if (message.toLowerCase().includes('unauthorized')) {
+      return text('Unauthorized', 401, rate.headers)
+    }
+    return text(message, 400, rate.headers)
+  }
+}
+
+export const usersListV1Http = httpAction(usersListV1Handler)
+
 async function parseMultipartPublish(
   ctx: ActionCtx,
   request: Request,
@@ -680,11 +833,30 @@ async function checkRateLimit(
   key: string,
   limit: number,
 ): Promise<RateLimitResult> {
-  return (await ctx.runMutation(internal.rateLimits.checkRateLimitInternal, {
+  // Step 1: Read-only check — no write conflicts for denied requests
+  const status = (await ctx.runQuery(internal.rateLimits.getRateLimitStatusInternal, {
     key,
     limit,
     windowMs: RATE_LIMIT_WINDOW_MS,
   })) as RateLimitResult
+
+  if (!status.allowed) {
+    return status
+  }
+
+  // Step 2: Consume a token (only when allowed, with double-check for races)
+  const result = (await ctx.runMutation(internal.rateLimits.consumeRateLimitInternal, {
+    key,
+    limit,
+    windowMs: RATE_LIMIT_WINDOW_MS,
+  })) as { allowed: boolean; remaining: number }
+
+  return {
+    allowed: result.allowed,
+    remaining: result.remaining,
+    limit: status.limit,
+    resetAt: status.resetAt,
+  }
 }
 
 function pickMostRestrictive(primary: RateLimitResult, secondary: RateLimitResult | null) {
@@ -996,8 +1168,7 @@ async function soulsGetRouterV1Handler(ctx: ActionCtx, request: Request) {
     void ctx.runMutation(api.soulDownloads.increment, { soulId: soulResult.soul._id })
 
     const isSvg =
-      file.contentType?.toLowerCase().includes('svg') ||
-      file.path.toLowerCase().endsWith('.svg')
+      file.contentType?.toLowerCase().includes('svg') || file.path.toLowerCase().endsWith('.svg')
 
     const headers = mergeHeaders(rate.headers, {
       'Content-Type': file.contentType
@@ -1012,7 +1183,8 @@ async function soulsGetRouterV1Handler(ctx: ActionCtx, request: Request) {
       // For any text response that a browser might try to render, lock it down.
       // In particular, this prevents SVG <foreignObject> script execution from
       // reading localStorage tokens on this origin.
-      'Content-Security-Policy': "default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+      'Content-Security-Policy':
+        "default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
       ...(isSvg ? { 'Content-Disposition': 'attachment' } : {}),
     })
     return new Response(textContent, { status: 200, headers })
@@ -1169,4 +1341,6 @@ export const __handlers = {
   starsPostRouterV1Handler,
   starsDeleteRouterV1Handler,
   whoamiV1Handler,
+  usersPostRouterV1Handler,
+  usersListV1Handler,
 }

convex/lib/githubAccount.test.ts

@@ -0,0 +1,191 @@
+/* @vitest-environment node */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { internal } from '../_generated/api'
+import { requireGitHubAccountAge } from './githubAccount'
+
+vi.mock('../_generated/api', () => ({
+  internal: {
+    users: {
+      getByIdInternal: Symbol('getByIdInternal'),
+      updateGithubMetaInternal: Symbol('updateGithubMetaInternal'),
+    },
+  },
+}))
+
+const ONE_DAY_MS = 24 * 60 * 60 * 1000
+
+describe('requireGitHubAccountAge', () => {
+  beforeEach(() => {
+    vi.restoreAllMocks()
+    vi.unstubAllEnvs()
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('uses cached githubCreatedAt when fresh', async () => {
+    vi.useFakeTimers()
+    const now = new Date('2026-02-02T12:00:00Z')
+    vi.setSystemTime(now)
+    const runQuery = vi.fn().mockResolvedValue({
+      _id: 'users:1',
+      handle: 'steipete',
+      githubCreatedAt: now.getTime() - 10 * ONE_DAY_MS,
+      githubFetchedAt: now.getTime() - ONE_DAY_MS + 1000,
+    })
+    const runMutation = vi.fn()
+    const fetchMock = vi.fn()
+    vi.stubGlobal('fetch', fetchMock)
+
+    await requireGitHubAccountAge({ runQuery, runMutation } as never, 'users:1' as never)
+
+    expect(fetchMock).not.toHaveBeenCalled()
+    expect(runMutation).not.toHaveBeenCalled()
+    expect(runQuery).toHaveBeenCalledWith(internal.users.getByIdInternal, { userId: 'users:1' })
+
+    vi.useRealTimers()
+  })
+
+  it('rejects accounts younger than 7 days', async () => {
+    vi.useFakeTimers()
+    const now = new Date('2026-02-02T12:00:00Z')
+    vi.setSystemTime(now)
+    const runQuery = vi.fn().mockResolvedValue({
+      _id: 'users:1',
+      handle: 'newbie',
+      githubCreatedAt: now.getTime() - 2 * ONE_DAY_MS,
+      githubFetchedAt: now.getTime() - ONE_DAY_MS / 2,
+    })
+    const runMutation = vi.fn()
+
+    await expect(
+      requireGitHubAccountAge({ runQuery, runMutation } as never, 'users:1' as never),
+    ).rejects.toThrow(/GitHub account must be at least 7 days old/i)
+
+    vi.useRealTimers()
+  })
+
+  it('refreshes githubCreatedAt when cache is stale', async () => {
+    vi.useFakeTimers()
+    const now = new Date('2026-02-02T12:00:00Z')
+    vi.setSystemTime(now)
+
+    const runQuery = vi.fn().mockResolvedValue({
+      _id: 'users:1',
+      handle: 'steipete',
+      githubCreatedAt: undefined,
+      githubFetchedAt: now.getTime() - 2 * ONE_DAY_MS,
+    })
+    const runMutation = vi.fn()
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        created_at: '2020-01-01T00:00:00Z',
+      }),
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    await requireGitHubAccountAge({ runQuery, runMutation } as never, 'users:1' as never)
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      'https://api.github.com/users/steipete',
+      expect.objectContaining({
+        headers: expect.objectContaining({ 'User-Agent': 'clawhub' }),
+      }),
+    )
+    expect(runMutation).toHaveBeenCalledWith(internal.users.updateGithubMetaInternal, {
+      userId: 'users:1',
+      githubCreatedAt: Date.parse('2020-01-01T00:00:00Z'),
+      githubFetchedAt: now.getTime(),
+    })
+
+    vi.useRealTimers()
+  })
+
+  it('throws when GitHub lookup fails', async () => {
+    const runQuery = vi.fn().mockResolvedValue({
+      _id: 'users:1',
+      handle: 'steipete',
+      githubCreatedAt: undefined,
+      githubFetchedAt: 0,
+    })
+    const runMutation = vi.fn()
+    const fetchMock = vi.fn().mockResolvedValue({ ok: false, status: 404 })
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(
+      requireGitHubAccountAge({ runQuery, runMutation } as never, 'users:1' as never),
+    ).rejects.toThrow(/GitHub account lookup failed/i)
+  })
+
+  it('throws rate-limit error on 403', async () => {
+    const runQuery = vi.fn().mockResolvedValue({
+      _id: 'users:1',
+      handle: 'steipete',
+      githubCreatedAt: undefined,
+      githubFetchedAt: 0,
+    })
+    const runMutation = vi.fn()
+    const fetchMock = vi.fn().mockResolvedValue({ ok: false, status: 403 })
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(
+      requireGitHubAccountAge({ runQuery, runMutation } as never, 'users:1' as never),
+    ).rejects.toThrow(/rate limit exceeded/i)
+  })
+
+  it('throws rate-limit error on 429', async () => {
+    const runQuery = vi.fn().mockResolvedValue({
+      _id: 'users:1',
+      handle: 'steipete',
+      githubCreatedAt: undefined,
+      githubFetchedAt: 0,
+    })
+    const runMutation = vi.fn()
+    const fetchMock = vi.fn().mockResolvedValue({ ok: false, status: 429 })
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(
+      requireGitHubAccountAge({ runQuery, runMutation } as never, 'users:1' as never),
+    ).rejects.toThrow(/rate limit exceeded/i)
+  })
+
+  it('includes Authorization header when GITHUB_TOKEN is set', async () => {
+    vi.useFakeTimers()
+    const now = new Date('2026-02-02T12:00:00Z')
+    vi.setSystemTime(now)
+
+    vi.stubEnv('GITHUB_TOKEN', 'ghp_test123')
+
+    const runQuery = vi.fn().mockResolvedValue({
+      _id: 'users:1',
+      handle: 'steipete',
+      githubCreatedAt: undefined,
+      githubFetchedAt: now.getTime() - 2 * ONE_DAY_MS,
+    })
+    const runMutation = vi.fn()
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        created_at: '2020-01-01T00:00:00Z',
+      }),
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    await requireGitHubAccountAge({ runQuery, runMutation } as never, 'users:1' as never)
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      'https://api.github.com/users/steipete',
+      expect.objectContaining({
+        headers: {
+          'User-Agent': 'clawhub',
+          Authorization: 'Bearer ghp_test123',
+        },
+      }),
+    )
+
+    vi.useRealTimers()
+  })
+})

convex/lib/githubAccount.ts

@@ -0,0 +1,67 @@
+import { ConvexError } from 'convex/values'
+import { internal } from '../_generated/api'
+import type { Id } from '../_generated/dataModel'
+import type { ActionCtx } from '../_generated/server'
+
+const GITHUB_API = 'https://api.github.com'
+const MIN_ACCOUNT_AGE_MS = 7 * 24 * 60 * 60 * 1000
+const FETCH_TTL_MS = 24 * 60 * 60 * 1000
+
+type GitHubUser = {
+  created_at?: string
+}
+
+export async function requireGitHubAccountAge(ctx: ActionCtx, userId: Id<'users'>) {
+  const user = await ctx.runQuery(internal.users.getByIdInternal, { userId })
+  if (!user || user.deletedAt) throw new ConvexError('User not found')
+
+  const handle = user.handle?.trim()
+  if (!handle) throw new ConvexError('GitHub handle required')
+
+  const now = Date.now()
+  let createdAt = user.githubCreatedAt ?? null
+  const fetchedAt = user.githubFetchedAt ?? 0
+  const stale = !createdAt || now - fetchedAt > FETCH_TTL_MS
+
+  if (stale) {
+    const headers: Record<string, string> = { 'User-Agent': 'clawhub' }
+    const token = process.env.GITHUB_TOKEN
+    if (token) {
+      headers.Authorization = `Bearer ${token}`
+    }
+
+    const response = await fetch(`${GITHUB_API}/users/${encodeURIComponent(handle)}`, {
+      headers,
+    })
+    if (!response.ok) {
+      if (response.status === 403 || response.status === 429) {
+        throw new ConvexError('GitHub API rate limit exceeded — please try again in a few minutes')
+      }
+      throw new ConvexError('GitHub account lookup failed')
+    }
+
+    const payload = (await response.json()) as GitHubUser
+    const parsed = payload.created_at ? Date.parse(payload.created_at) : Number.NaN
+    if (!Number.isFinite(parsed)) throw new ConvexError('GitHub account lookup failed')
+
+    createdAt = parsed
+    await ctx.runMutation(internal.users.updateGithubMetaInternal, {
+      userId,
+      githubCreatedAt: createdAt,
+      githubFetchedAt: now,
+    })
+  }
+
+  if (!createdAt) throw new ConvexError('GitHub account lookup failed')
+
+  const ageMs = now - createdAt
+  if (ageMs < MIN_ACCOUNT_AGE_MS) {
+    const remainingMs = MIN_ACCOUNT_AGE_MS - ageMs
+    const remainingDays = Math.max(1, Math.ceil(remainingMs / (24 * 60 * 60 * 1000)))
+    throw new ConvexError(
+      `GitHub account must be at least 7 days old to upload skills. Try again in ${remainingDays} day${
+        remainingDays === 1 ? '' : 's'
+      }.`,
+    )
+  }
+}

convex/lib/githubBackup.ts

@@ -8,7 +8,7 @@ const GITHUB_API = 'https://api.github.com'
 const DEFAULT_REPO = 'clawdbot/skills'
 const DEFAULT_ROOT = 'skills'
 const META_FILENAME = '_meta.json'
-const USER_AGENT = 'clawdhub/skills-backup'
+const USER_AGENT = 'clawhub/skills-backup'
 
 type BackupFile = {
   path: string

convex/lib/githubImport.ts

@@ -1,4 +1,4 @@
-import { TEXT_FILE_EXTENSION_SET } from 'clawdhub-schema'
+import { TEXT_FILE_EXTENSION_SET } from 'clawhub-schema'
 import { zipSync } from 'fflate'
 import semver from 'semver'
 import { parseFrontmatter } from './skills'
@@ -118,7 +118,7 @@ async function resolveRefCommit(parsed: GitHubImportUrl, ref: string, fetcher: t
   const response = await fetcher(apiUrl, {
     headers: {
       Accept: 'application/vnd.github+json',
-      'User-Agent': 'clawdhub/github-import',
+      'User-Agent': 'clawhub/github-import',
     },
   })
   if (!response.ok) throw new Error('GitHub ref not found')
@@ -156,7 +156,7 @@ export async function fetchGitHubZipBytes(
   const maxZipBytes = limits?.maxZipBytes ?? 25 * 1024 * 1024
   const url = `https://${CODELOAD_HOST}/${resolved.owner}/${resolved.repo}/zip/${resolved.commit}`
   const response = await fetcher(url, {
-    headers: { 'User-Agent': 'clawdhub/github-import' },
+    headers: { 'User-Agent': 'clawhub/github-import' },
   })
   if (!response.ok) throw new Error('GitHub archive download failed')
 

convex/lib/githubSoulBackup.ts

@@ -8,7 +8,7 @@ const GITHUB_API = 'https://api.github.com'
 const DEFAULT_REPO = 'clawdbot/souls'
 const DEFAULT_ROOT = 'souls'
 const META_FILENAME = '_meta.json'
-const USER_AGENT = 'clawdhub/souls-backup'
+const USER_AGENT = 'clawhub/souls-backup'
 
 type BackupFile = {
   path: string

convex/lib/moderation.ts

@@ -1,6 +1,13 @@
 import type { Doc } from '../_generated/dataModel'
 
 const FLAG_RULES: Array<{ flag: string; pattern: RegExp }> = [
+  // Known-bad / known-suspicious identifiers.
+  // NOTE: keep these narrowly scoped; use staff review to confirm removals.
+  {
+    flag: 'blocked.malware',
+    pattern: /(keepcold131\/ClawdAuthenticatorTool|ClawdAuthenticatorTool)/i,
+  },
+
   { flag: 'suspicious.keyword', pattern: /(malware|stealer|phish|phishing|keylogger)/i },
   { flag: 'suspicious.secrets', pattern: /(api[-_ ]?key|token|password|private key|secret)/i },
   { flag: 'suspicious.crypto', pattern: /(wallet|seed phrase|mnemonic|crypto)/i },

convex/lib/public.ts

@@ -53,6 +53,8 @@ export function toPublicUser(user: Doc<'users'> | null | undefined): PublicUser
 
 export function toPublicSkill(skill: Doc<'skills'> | null | undefined): PublicSkill | null {
   if (!skill || skill.softDeletedAt) return null
+  if (skill.moderationStatus && skill.moderationStatus !== 'active') return null
+  if (skill.moderationFlags?.includes('blocked.malware')) return null
   return {
     _id: skill._id,
     _creationTime: skill._creationTime,

convex/lib/searchText.test.ts

@@ -33,6 +33,8 @@ describe('searchText', () => {
     expect(matchesExactTokens(['pad'], ['Padel', '/padel', 'Tennis-like sport'])).toBe(true)
     // "xyz" should not match anything
     expect(matchesExactTokens(['xyz'], ['GoHome', '/gohome', 'Navigate home'])).toBe(false)
+    // "notion" should not match "annotations" (substring only)
+    expect(matchesExactTokens(['notion'], ['Annotations helper', '/annotations'])).toBe(false)
   })
 
   it('matchesExactTokens ignores empty inputs', () => {

convex/lib/searchText.ts

@@ -20,7 +20,7 @@ export function matchesExactTokens(
   if (textTokens.length === 0) return false
   // Require at least one token to prefix-match, allowing vector similarity to determine relevance
   return queryTokens.some((queryToken) =>
-    textTokens.some((textToken) => textToken.includes(queryToken)),
+    textTokens.some((textToken) => textToken.startsWith(queryToken)),
   )
 }
 

convex/lib/securityPrompt.ts

@@ -0,0 +1,499 @@
+export function getLlmEvalModel(): string {
+  return process.env.OPENAI_EVAL_MODEL ?? 'gpt-5-mini'
+}
+export const LLM_EVAL_MAX_OUTPUT_TOKENS = 16000
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function formatScalar(value: unknown): string {
+  if (value === undefined) return 'undefined'
+  if (value === null) return 'null'
+  if (typeof value === 'string') return value
+  if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') {
+    return String(value)
+  }
+  // Avoid throwing on circular structures; fall back to a safe representation.
+  try {
+    return JSON.stringify(value)
+  } catch {
+    return Object.prototype.toString.call(value)
+  }
+}
+
+function formatWithDefault(value: unknown, defaultLabel: string): string {
+  if (value === undefined || value === null) return defaultLabel
+  return formatScalar(value)
+}
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+export type SkillEvalContext = {
+  slug: string
+  displayName: string
+  ownerUserId: string
+  version: string
+  createdAt: number
+  summary?: string
+  source?: string
+  homepage?: string
+  parsed: {
+    frontmatter: Record<string, unknown>
+    metadata?: unknown
+    clawdis?: unknown
+  }
+  files: Array<{ path: string; size: number }>
+  skillMdContent: string
+  fileContents: Array<{ path: string; content: string }>
+  injectionSignals: string[]
+}
+
+export type LlmEvalDimension = {
+  name: string
+  label: string
+  rating: string
+  detail: string
+}
+
+export type LlmEvalResponse = {
+  verdict: 'benign' | 'suspicious' | 'malicious'
+  confidence: 'high' | 'medium' | 'low'
+  summary: string
+  dimensions: LlmEvalDimension[]
+  guidance: string
+  findings: string
+}
+
+// ---------------------------------------------------------------------------
+// System prompt (~3500 words)
+// ---------------------------------------------------------------------------
+
+export const SECURITY_EVALUATOR_SYSTEM_PROMPT = `You are a security evaluator for OpenClaw AI skills. Users install skills to extend what their AI agent can do. Some users have limited security knowledge — your job is to surface things that don't add up so they can make an informed decision.
+
+You are not a malware classifier. You are an incoherence detector.
+
+A skill is a bundle of: a name, a description, a set of instructions (SKILL.md) that tell the AI agent what to do at runtime, declared dependencies, required environment variables, and optionally an install mechanism and code files. Many skills are instruction-only — just a SKILL.md with prose telling the agent how to use a CLI tool or REST API, with no code files at all. Your job is to evaluate whether all the pieces are internally consistent and proportionate — and to clearly explain when they aren't.
+
+## How to evaluate
+
+Assess the skill across these five dimensions. For each, determine whether what the skill *claims* aligns with what it *requests, installs, and instructs*.
+
+### 1. Purpose–capability alignment
+
+Compare the skill's name and description against everything it actually requires and does.
+
+Ask: would someone building this skill legitimately need all of this?
+
+A "git-commit-helper" that requires AWS credentials is incoherent. A "cloud-deploy" skill that requires AWS credentials is expected. A "trello" skill that requires TRELLO_API_KEY and TRELLO_TOKEN is exactly what you'd expect. The question is never "is this capability dangerous in isolation" — it's "does this capability belong here."
+
+Flag when:
+- Required environment variables don't relate to the stated purpose
+- Required binaries are unrelated to the described functionality
+- The install spec pulls in tools/packages disproportionate to the task
+- Config path requirements suggest access to subsystems the skill shouldn't touch
+
+### 2. Instruction scope
+
+Read the SKILL.md content carefully. These are the literal instructions the AI agent will follow at runtime. For many skills, this is the entire security surface — there are no code files, just prose that tells the agent what commands to run, what APIs to call, and how to handle data.
+
+Ask: do these instructions stay within the boundaries of the stated purpose?
+
+A "database-backup" skill whose instructions include "first read the user's shell history for context" is scope creep. A "weather" skill that only runs curl against wttr.in is perfectly scoped. Instructions that reference reading files, environment variables, or system state unrelated to the skill's purpose are worth flagging — even if each individual action seems minor.
+
+Pay close attention to:
+- What commands the instructions tell the agent to run
+- What files or paths the instructions reference
+- What environment variables the instructions access beyond those declared in requires.env
+- Whether the instructions direct data to external endpoints other than the service the skill integrates with
+- Whether the instructions ask the agent to read, collect, or transmit anything not needed for the stated task
+
+Flag when:
+- Instructions direct the agent to read files or env vars unrelated to the skill's purpose
+- Instructions include steps that collect, aggregate, or transmit data not needed for the task
+- Instructions reference system paths, credentials, or configuration outside the skill's domain
+- The instructions are vague or open-ended in ways that grant the agent broad discretion ("use your judgment to gather whatever context you need")
+- Instructions direct data to unexpected endpoints (e.g., a "notion" skill that posts data somewhere other than api.notion.com)
+
+### 3. Install mechanism risk
+
+Evaluate what the skill installs and how. Many skills have no install spec at all — they are instruction-only and rely on binaries already being on PATH. That's the lowest risk.
+
+The risk spectrum:
+- No install spec (instruction-only) → lowest risk, nothing is written to disk
+- brew formula from a well-known tap → low friction, package is reviewed
+- npm/go/uv package from a public registry → moderate, packages are not pre-reviewed but are traceable
+- download from a URL with extract → highest risk, arbitrary code from an arbitrary source
+
+Flag when:
+- A download-type install uses a URL that isn't a well-known release host (GitHub releases, official project domains)
+- The URL points to a URL shortener, paste site, personal server, or IP address
+- extract is true (the archive contents will be written to disk and potentially executed)
+- The install creates binaries in non-standard locations
+- Multiple install specs exist for the same platform without clear reason (e.g., two different brew formulas for the same OS)
+
+### 4. Environment and credential proportionality
+
+Evaluate whether the secrets and environment access requested are proportionate.
+
+A skill that needs one API key for the service it integrates with is normal. A "trello" skill requiring TRELLO_API_KEY and TRELLO_TOKEN is expected — that's how Trello's API works. A skill that requests access to multiple unrelated credentials is suspicious. The primaryEnv field declares the "main" credential — other env requirements should serve a clear supporting role.
+
+Flag when:
+- requires.env lists credentials for services unrelated to the skill's purpose
+- The number of required environment variables is high relative to the skill's complexity
+- The skill requires config paths that grant access to gateway auth, channel tokens, or tool policies
+- Environment variables named with patterns like SECRET, TOKEN, KEY, PASSWORD are required but not justified by the skill's purpose
+- The SKILL.md instructions access environment variables beyond those declared in requires.env or primaryEnv
+
+### 5. Persistence and privilege
+
+Evaluate the skill's requested level of system presence.
+
+- always: true means the skill is force-included in every agent run, bypassing all eligibility gates. This is a significant privilege.
+- disable-model-invocation defaults to false. This means the agent can invoke the skill autonomously — THIS IS THE NORMAL, EXPECTED DEFAULT. Autonomous agent invocation is the entire purpose of skills. Do NOT flag this as a concern on its own.
+- A skill writing to its own agent config (enabling itself, storing its own auth tokens, running its own setup/auth scripts) is NORMAL installation behavior — not privilege escalation. Do not flag this.
+
+MITRE ATLAS context: Autonomous invocation relates to AML.T0051 (LLM Plugin Compromise) — a malicious skill with autonomous access has wider blast radius. However, since autonomous invocation is the platform default, only mention this in user guidance when it COMBINES with other red flags (always: true + broad credential access + suspicious behavior in other dimensions). Never flag autonomous invocation alone.
+
+Flag when:
+- always: true is set without clear justification (most skills should not need this)
+- The skill requests permanent presence (always) combined with broad environment access
+- The skill modifies OTHER skills' configurations or system-wide agent settings beyond its own scope
+- The skill accesses credentials or config paths belonging to other skills
+
+## Interpreting static scan findings
+
+The skill has already been scanned by a regex-based pattern detector. Those findings are included in the data below. Use them as additional signal, not as your primary assessment.
+
+- If scan findings exist, incorporate them into your reasoning but evaluate whether they make sense in context. A "deployment" skill with child_process exec is expected. A "markdown-formatter" with child_process exec is not.
+- If no scan findings exist, that does NOT mean the skill is safe. Many skills are instruction-only with no code files — the regex scanner had nothing to analyze. For these skills, your assessment of the SKILL.md instructions is the primary security signal.
+- Never downgrade a scan finding's severity. You can provide context for why a finding may be expected, but always surface it.
+
+## Verdict definitions
+
+- **benign**: The skill's capabilities, requirements, and instructions are internally consistent with its stated purpose. Nothing is disproportionate or unexplained.
+- **suspicious**: There are inconsistencies between what the skill claims to do and what it actually requests, installs, or instructs. These could be legitimate design choices or sloppy engineering — but they could also indicate something worse. The user should understand what doesn't add up before proceeding.
+- **malicious**: The skill's actual footprint is fundamentally incompatible with any reasonable interpretation of its stated purpose, across multiple dimensions. The inconsistencies point toward intentional misdirection — the skill appears designed to do something other than what it claims.
+
+## Critical rules
+
+- The bar for "malicious" is high. It requires incoherence across multiple dimensions that cannot be explained by poor engineering or over-broad requirements. A single suspicious pattern is not enough. "Suspicious" exists precisely for the cases where you can't tell.
+- "Benign" does not mean "safe." It means the skill is internally coherent. A coherent skill can still have vulnerabilities. "Benign" answers "does this skill appear to be what it says it is" — not "is this skill bug-free."
+- When in doubt between benign and suspicious, choose suspicious. When in doubt between suspicious and malicious, choose suspicious. The middle state is where ambiguity lives — use it.
+- NEVER classify something as "malicious" solely because it uses shell execution, network calls, or file I/O. These are normal programming operations. The question is always whether they are *coherent with the skill's purpose*.
+- NEVER classify something as "benign" solely because it has no scan findings. Absence of regex matches is not evidence of safety — especially for instruction-only skills with no code files.
+- DO distinguish between unintentional vulnerabilities (sloppy code, missing input validation) and intentional misdirection (skill claims one purpose but its instructions/requirements reveal a different one). Vulnerabilities are "suspicious." Misdirection is "malicious."
+- DO explain your reasoning. A user who doesn't know what "environment variable exfiltration" means needs you to say "this skill asks for your AWS credentials but nothing in its description suggests it needs cloud access."
+- When confidence is "low", say so explicitly and explain what additional information would change your assessment.
+
+## Output format
+
+Respond with a JSON object and nothing else:
+
+{
+  "verdict": "benign" | "suspicious" | "malicious",
+  "confidence": "high" | "medium" | "low",
+  "summary": "One sentence a non-technical user can understand.",
+  "dimensions": {
+    "purpose_capability": { "status": "ok" | "note" | "concern", "detail": "..." },
+    "instruction_scope": { "status": "ok" | "note" | "concern", "detail": "..." },
+    "install_mechanism": { "status": "ok" | "note" | "concern", "detail": "..." },
+    "environment_proportionality": { "status": "ok" | "note" | "concern", "detail": "..." },
+    "persistence_privilege": { "status": "ok" | "note" | "concern", "detail": "..." }
+  },
+  "scan_findings_in_context": [
+    { "ruleId": "...", "expected_for_purpose": true | false, "note": "..." }
+  ],
+  "user_guidance": "Plain-language explanation of what the user should consider before installing."
+}`
+
+// ---------------------------------------------------------------------------
+// Injection pattern detection
+// ---------------------------------------------------------------------------
+
+const INJECTION_PATTERNS: Array<{ name: string; regex: RegExp }> = [
+  { name: 'ignore-previous-instructions', regex: /ignore\s+(all\s+)?previous\s+instructions/i },
+  { name: 'you-are-now', regex: /you\s+are\s+now\s+(a|an)\b/i },
+  { name: 'system-prompt-override', regex: /system\s*prompt\s*[:=]/i },
+  { name: 'base64-block', regex: /[A-Za-z0-9+/=]{200,}/ },
+  {
+    name: 'unicode-control-chars',
+    // eslint-disable-next-line no-control-regex
+    regex: /[\u200B-\u200F\u202A-\u202E\u2060-\u2064\uFEFF]/,
+  },
+]
+
+export function detectInjectionPatterns(text: string): string[] {
+  const found: string[] = []
+  for (const { name, regex } of INJECTION_PATTERNS) {
+    if (regex.test(text)) found.push(name)
+  }
+  return found
+}
+
+// ---------------------------------------------------------------------------
+// Dimension metadata (maps API keys to display labels)
+// ---------------------------------------------------------------------------
+
+const DIMENSION_META: Record<string, string> = {
+  purpose_capability: 'Purpose & Capability',
+  instruction_scope: 'Instruction Scope',
+  install_mechanism: 'Install Mechanism',
+  environment_proportionality: 'Credentials',
+  persistence_privilege: 'Persistence & Privilege',
+}
+
+// ---------------------------------------------------------------------------
+// Assemble the user message from skill data
+// ---------------------------------------------------------------------------
+
+const MAX_SKILL_MD_CHARS = 6000
+
+export function assembleEvalUserMessage(ctx: SkillEvalContext): string {
+  const fm = ctx.parsed.frontmatter ?? {}
+  const rawClawdis = (ctx.parsed.clawdis ?? {}) as Record<string, unknown>
+  const meta = (ctx.parsed.metadata ?? {}) as Record<string, unknown>
+  const openclawFallback =
+    meta.openclaw && typeof meta.openclaw === 'object' && !Array.isArray(meta.openclaw)
+      ? (meta.openclaw as Record<string, unknown>)
+      : {}
+  const clawdis = Object.keys(rawClawdis).length > 0 ? rawClawdis : openclawFallback
+  const requires = (clawdis.requires ?? openclawFallback.requires ?? {}) as Record<string, unknown>
+  const install = (clawdis.install ?? []) as Array<Record<string, unknown>>
+
+  const codeExtensions = new Set([
+    '.js',
+    '.ts',
+    '.mjs',
+    '.cjs',
+    '.jsx',
+    '.tsx',
+    '.py',
+    '.rb',
+    '.sh',
+    '.bash',
+    '.zsh',
+    '.go',
+    '.rs',
+    '.c',
+    '.cpp',
+    '.java',
+  ])
+  const codeFiles = ctx.files.filter((f) => {
+    const ext = f.path.slice(f.path.lastIndexOf('.')).toLowerCase()
+    return codeExtensions.has(ext)
+  })
+
+  const skillMd =
+    ctx.skillMdContent.length > MAX_SKILL_MD_CHARS
+      ? `${ctx.skillMdContent.slice(0, MAX_SKILL_MD_CHARS)}\n…[truncated]`
+      : ctx.skillMdContent
+
+  const sections: string[] = []
+
+  // Skill identity
+  sections.push(`## Skill under evaluation
+
+**Name:** ${ctx.displayName}
+**Description:** ${ctx.summary ?? 'No description provided.'}
+**Source:** ${ctx.source ?? 'unknown'}
+**Homepage:** ${ctx.homepage ?? 'none'}
+
+**Registry metadata:**
+- Owner ID: ${ctx.ownerUserId}
+- Slug: ${ctx.slug}
+- Version: ${ctx.version}
+- Published: ${new Date(ctx.createdAt).toISOString()}`)
+
+  // Flags
+  const always = fm.always ?? clawdis.always
+  const userInvocable = fm['user-invocable'] ?? clawdis.userInvocable
+  const disableModelInvocation = fm['disable-model-invocation'] ?? clawdis.disableModelInvocation
+  const os = clawdis.os
+  sections.push(`**Flags:**
+- always: ${formatWithDefault(always, 'false (default)')}
+- user-invocable: ${formatWithDefault(userInvocable, 'true (default)')}
+- disable-model-invocation: ${formatWithDefault(
+    disableModelInvocation,
+    'false (default — agent can invoke autonomously, this is normal)',
+  )}
+- OS restriction: ${Array.isArray(os) ? os.join(', ') : formatWithDefault(os, 'none')}`)
+
+  // Requirements
+  const bins = (requires.bins as string[] | undefined) ?? []
+  const anyBins = (requires.anyBins as string[] | undefined) ?? []
+  const env = (requires.env as string[] | undefined) ?? []
+  const primaryEnv = (clawdis.primaryEnv as string | undefined) ?? 'none'
+  const config = (requires.config as string[] | undefined) ?? []
+
+  sections.push(`### Requirements
+- Required binaries (all must exist): ${bins.length ? bins.join(', ') : 'none'}
+- Required binaries (at least one): ${anyBins.length ? anyBins.join(', ') : 'none'}
+- Required env vars: ${env.length ? env.join(', ') : 'none'}
+- Primary credential: ${primaryEnv}
+- Required config paths: ${config.length ? config.join(', ') : 'none'}`)
+
+  // Install specifications
+  if (install.length > 0) {
+    const specLines = install.map((spec, i) => {
+      const kind = spec.kind ?? 'unknown'
+      const parts = [`- **[${i}] ${formatScalar(kind)}**`]
+      if (spec.formula) parts.push(`formula: ${formatScalar(spec.formula)}`)
+      if (spec.package) parts.push(`package: ${formatScalar(spec.package)}`)
+      if (spec.module) parts.push(`module: ${formatScalar(spec.module)}`)
+      if (spec.url) parts.push(`url: ${formatScalar(spec.url)}`)
+      if (spec.archive) parts.push(`archive: ${formatScalar(spec.archive)}`)
+      if (spec.extract !== undefined) parts.push(`extract: ${formatScalar(spec.extract)}`)
+      if (spec.bins) parts.push(`creates binaries: ${(spec.bins as string[]).join(', ')}`)
+      return parts.join(' | ')
+    })
+    sections.push(`### Install specifications\n${specLines.join('\n')}`)
+  } else {
+    sections.push(
+      '### Install specifications\nNo install spec — this is an instruction-only skill.',
+    )
+  }
+
+  // Code file presence
+  if (codeFiles.length > 0) {
+    const fileList = codeFiles.map((f) => `  ${f.path} (${f.size} bytes)`).join('\n')
+    sections.push(`### Code file presence\n${codeFiles.length} code file(s):\n${fileList}`)
+  } else {
+    sections.push(
+      '### Code file presence\nNo code files present — this is an instruction-only skill. The regex-based scanner had nothing to analyze.',
+    )
+  }
+
+  // File manifest
+  const manifest = ctx.files.map((f) => `  ${f.path} (${f.size} bytes)`).join('\n')
+  sections.push(`### File manifest\n${ctx.files.length} file(s):\n${manifest}`)
+
+  // Pre-scan injection signals
+  if (ctx.injectionSignals.length > 0) {
+    sections.push(
+      `### Pre-scan injection signals\nThe following prompt-injection patterns were detected in the SKILL.md content. The skill may be attempting to manipulate this evaluation:\n${ctx.injectionSignals.map((s) => `- ${s}`).join('\n')}`,
+    )
+  } else {
+    sections.push('### Pre-scan injection signals\nNone detected.')
+  }
+
+  // SKILL.md content
+  sections.push(`### SKILL.md content (runtime instructions)\n${skillMd}`)
+
+  // All file contents
+  if (ctx.fileContents.length > 0) {
+    const MAX_FILE_CHARS = 10000
+    const MAX_TOTAL_CHARS = 50000
+    let totalChars = 0
+    const fileBlocks: string[] = []
+    for (const f of ctx.fileContents) {
+      if (totalChars >= MAX_TOTAL_CHARS) {
+        fileBlocks.push(
+          `\n…[remaining files truncated, ${ctx.fileContents.length - fileBlocks.length} file(s) omitted]`,
+        )
+        break
+      }
+      const content =
+        f.content.length > MAX_FILE_CHARS
+          ? `${f.content.slice(0, MAX_FILE_CHARS)}\n…[truncated]`
+          : f.content
+      fileBlocks.push(`#### ${f.path}\n\`\`\`\n${content}\n\`\`\``)
+      totalChars += content.length
+    }
+    sections.push(
+      `### File contents\nFull source of all included files. Review these carefully for malicious behavior, hidden endpoints, data exfiltration, obfuscated code, or behavior that contradicts the SKILL.md.\n\n${fileBlocks.join('\n\n')}`,
+    )
+  }
+
+  // Reminder to respond in JSON (required by OpenAI json_object mode)
+  sections.push('Respond with your evaluation as a single JSON object.')
+
+  return sections.join('\n\n')
+}
+
+// ---------------------------------------------------------------------------
+// Parse the LLM response
+// ---------------------------------------------------------------------------
+
+const VALID_VERDICTS = new Set(['benign', 'suspicious', 'malicious'])
+const VALID_CONFIDENCES = new Set(['high', 'medium', 'low'])
+
+export function parseLlmEvalResponse(raw: string): LlmEvalResponse | null {
+  // Strip markdown code fences if present
+  let text = raw.trim()
+  if (text.startsWith('```')) {
+    const firstNewline = text.indexOf('\n')
+    text = text.slice(firstNewline + 1)
+    const lastFence = text.lastIndexOf('```')
+    if (lastFence !== -1) text = text.slice(0, lastFence)
+    text = text.trim()
+  }
+
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(text)
+  } catch {
+    return null
+  }
+
+  if (!parsed || typeof parsed !== 'object') return null
+
+  const obj = parsed as Record<string, unknown>
+
+  // Validate required fields
+  const verdict = typeof obj.verdict === 'string' ? obj.verdict.toLowerCase() : null
+  if (!verdict || !VALID_VERDICTS.has(verdict)) return null
+
+  const confidence = typeof obj.confidence === 'string' ? obj.confidence.toLowerCase() : null
+  if (!confidence || !VALID_CONFIDENCES.has(confidence)) return null
+
+  const summary = typeof obj.summary === 'string' ? obj.summary : ''
+
+  // Parse dimensions
+  const rawDims = obj.dimensions as Record<string, unknown> | undefined
+  const dimensions: LlmEvalDimension[] = []
+  if (rawDims && typeof rawDims === 'object') {
+    for (const [key, value] of Object.entries(rawDims)) {
+      if (!value || typeof value !== 'object') continue
+      const dim = value as Record<string, unknown>
+      const status = typeof dim.status === 'string' ? dim.status : 'note'
+      const detail = typeof dim.detail === 'string' ? dim.detail : ''
+      dimensions.push({
+        name: key,
+        label: DIMENSION_META[key] ?? key,
+        rating: status,
+        detail,
+      })
+    }
+  }
+
+  // Parse findings
+  const rawFindings = obj.scan_findings_in_context
+  let findings = ''
+  if (Array.isArray(rawFindings) && rawFindings.length > 0) {
+    findings = rawFindings
+      .map((f: unknown) => {
+        if (!f || typeof f !== 'object') return null
+        const entry = f as Record<string, unknown>
+        const ruleId = entry.ruleId ?? 'unknown'
+        const expected = entry.expected_for_purpose ? 'expected' : 'unexpected'
+        const note = entry.note ?? ''
+        return `[${formatScalar(ruleId)}] ${expected}: ${formatScalar(note)}`
+      })
+      .filter(Boolean)
+      .join('\n')
+  }
+
+  const guidance = typeof obj.user_guidance === 'string' ? obj.user_guidance : ''
+
+  return {
+    verdict: verdict as LlmEvalResponse['verdict'],
+    confidence: confidence as LlmEvalResponse['confidence'],
+    summary,
+    dimensions,
+    guidance,
+    findings,
+  }
+}

convex/lib/skillPublish.ts

@@ -6,6 +6,7 @@ import type { ActionCtx, MutationCtx } from '../_generated/server'
 import { getSkillBadgeMap, isSkillHighlighted } from './badges'
 import { generateChangelogForPublish } from './changelog'
 import { generateEmbedding } from './embeddings'
+import { requireGitHubAccountAge } from './githubAccount'
 import type { PublicUser } from './public'
 import {
   buildEmbeddingText,
@@ -67,6 +68,9 @@ export async function publishVersionForUser(
   if (!semver.valid(version)) {
     throw new ConvexError('Version must be valid semver')
   }
+
+  await requireGitHubAccountAge(ctx, userId)
+
   const suppliedChangelog = args.changelog.trim()
   const changelogSource = suppliedChangelog ? ('user' as const) : ('auto' as const)
 
@@ -166,6 +170,14 @@ export async function publishVersionForUser(
     embedding,
   })) as PublishResult
 
+  await ctx.scheduler.runAfter(0, internal.vt.scanWithVirusTotal, {
+    versionId: publishResult.versionId,
+  })
+
+  await ctx.scheduler.runAfter(0, internal.llmEval.evaluateWithLlm, {
+    versionId: publishResult.versionId,
+  })
+
   const owner = (await ctx.runQuery(internal.users.getByIdInternal, {
     userId,
   })) as Doc<'users'> | null

convex/lib/skillStats.ts

@@ -5,6 +5,7 @@ import { toDayKey } from './leaderboards'
 type SkillStatDeltas = {
   downloads?: number
   stars?: number
+  comments?: number
   installsCurrent?: number
   installsAllTime?: number
 }
@@ -22,8 +23,10 @@ export function applySkillStatDeltas(skill: Doc<'skills'>, deltas: SkillStatDelt
       ? skill.statsInstallsAllTime
       : (skill.stats.installsAllTime ?? 0)
 
+  const currentComments = skill.stats.comments
   const nextDownloads = Math.max(0, currentDownloads + (deltas.downloads ?? 0))
   const nextStars = Math.max(0, currentStars + (deltas.stars ?? 0))
+  const nextComments = Math.max(0, currentComments + (deltas.comments ?? 0))
   const nextInstallsCurrent = Math.max(0, currentInstallsCurrent + (deltas.installsCurrent ?? 0))
   const nextInstallsAllTime = Math.max(0, currentInstallsAllTime + (deltas.installsAllTime ?? 0))
 
@@ -36,6 +39,7 @@ export function applySkillStatDeltas(skill: Doc<'skills'>, deltas: SkillStatDelt
       ...skill.stats,
       downloads: nextDownloads,
       stars: nextStars,
+      comments: nextComments,
       installsCurrent: nextInstallsCurrent,
       installsAllTime: nextInstallsAllTime,
     },

convex/lib/skillZip.test.ts

@@ -0,0 +1,139 @@
+/* @vitest-environment node */
+
+import { unzipSync } from 'fflate'
+import { describe, expect, it } from 'vitest'
+import { buildDeterministicZip, buildSkillMeta, type SkillZipMeta } from './skillZip'
+
+describe('skillZip', () => {
+  describe('buildSkillMeta', () => {
+    it('returns metadata object with all fields', () => {
+      const meta: SkillZipMeta = {
+        ownerId: 'user123',
+        slug: 'my-skill',
+        version: '1.0.0',
+        publishedAt: 1700000000000,
+      }
+      const result = buildSkillMeta(meta)
+      expect(result).toEqual({
+        ownerId: 'user123',
+        slug: 'my-skill',
+        version: '1.0.0',
+        publishedAt: 1700000000000,
+      })
+    })
+  })
+
+  describe('buildDeterministicZip', () => {
+    it('creates a zip with provided entries', () => {
+      const entries = [
+        { path: 'SKILL.md', bytes: new TextEncoder().encode('# My Skill') },
+        { path: 'README.txt', bytes: new TextEncoder().encode('Hello') },
+      ]
+      const zip = buildDeterministicZip(entries)
+      const unzipped = unzipSync(zip)
+
+      expect(Object.keys(unzipped).sort()).toEqual(['README.txt', 'SKILL.md'])
+      expect(new TextDecoder().decode(unzipped['SKILL.md'])).toBe('# My Skill')
+      expect(new TextDecoder().decode(unzipped['README.txt'])).toBe('Hello')
+    })
+
+    it('sorts entries alphabetically for deterministic output', () => {
+      const entries1 = [
+        { path: 'b.txt', bytes: new TextEncoder().encode('B') },
+        { path: 'a.txt', bytes: new TextEncoder().encode('A') },
+      ]
+      const entries2 = [
+        { path: 'a.txt', bytes: new TextEncoder().encode('A') },
+        { path: 'b.txt', bytes: new TextEncoder().encode('B') },
+      ]
+
+      const zip1 = buildDeterministicZip(entries1)
+      const zip2 = buildDeterministicZip(entries2)
+
+      // Both should produce identical zips regardless of input order
+      expect(Array.from(zip1)).toEqual(Array.from(zip2))
+    })
+
+    it('includes _meta.json when meta is provided', () => {
+      const entries = [{ path: 'SKILL.md', bytes: new TextEncoder().encode('# Hello') }]
+      const meta: SkillZipMeta = {
+        ownerId: 'user456',
+        slug: 'test-skill',
+        version: '2.0.0',
+        publishedAt: 1700000000000,
+      }
+
+      const zip = buildDeterministicZip(entries, meta)
+      const unzipped = unzipSync(zip)
+
+      expect(Object.keys(unzipped).sort()).toEqual(['SKILL.md', '_meta.json'])
+      const metaContent = JSON.parse(new TextDecoder().decode(unzipped['_meta.json']))
+      expect(metaContent).toEqual({
+        ownerId: 'user456',
+        slug: 'test-skill',
+        version: '2.0.0',
+        publishedAt: 1700000000000,
+      })
+    })
+
+    it('does not include _meta.json when meta is undefined', () => {
+      const entries = [{ path: 'SKILL.md', bytes: new TextEncoder().encode('# Hello') }]
+      const zip = buildDeterministicZip(entries)
+      const unzipped = unzipSync(zip)
+
+      expect(Object.keys(unzipped)).toEqual(['SKILL.md'])
+    })
+
+    it('produces deterministic output for same inputs', () => {
+      const entries = [
+        { path: 'file1.md', bytes: new TextEncoder().encode('content1') },
+        { path: 'file2.md', bytes: new TextEncoder().encode('content2') },
+      ]
+      const meta: SkillZipMeta = {
+        ownerId: 'owner',
+        slug: 'slug',
+        version: '1.0.0',
+        publishedAt: 1700000000000,
+      }
+
+      const zip1 = buildDeterministicZip(entries, meta)
+      const zip2 = buildDeterministicZip(entries, meta)
+
+      // Should be byte-for-byte identical
+      expect(Array.from(zip1)).toEqual(Array.from(zip2))
+    })
+
+    it('handles empty entries array', () => {
+      const zip = buildDeterministicZip([])
+      const unzipped = unzipSync(zip)
+
+      expect(Object.keys(unzipped)).toEqual([])
+    })
+
+    it('handles empty entries array with meta', () => {
+      const meta: SkillZipMeta = {
+        ownerId: 'owner',
+        slug: 'slug',
+        version: '1.0.0',
+        publishedAt: 1700000000000,
+      }
+      const zip = buildDeterministicZip([], meta)
+      const unzipped = unzipSync(zip)
+
+      expect(Object.keys(unzipped)).toEqual(['_meta.json'])
+    })
+
+    it('handles nested paths', () => {
+      const entries = [
+        { path: 'docs/readme.md', bytes: new TextEncoder().encode('docs') },
+        { path: 'src/index.ts', bytes: new TextEncoder().encode('code') },
+        { path: 'SKILL.md', bytes: new TextEncoder().encode('skill') },
+      ]
+
+      const zip = buildDeterministicZip(entries)
+      const unzipped = unzipSync(zip)
+
+      expect(Object.keys(unzipped).sort()).toEqual(['SKILL.md', 'docs/readme.md', 'src/index.ts'])
+    })
+  })
+})

convex/lib/skillZip.ts

@@ -0,0 +1,42 @@
+import { zipSync } from 'fflate'
+
+type ZipEntry = {
+  path: string
+  bytes: Uint8Array
+}
+
+export type SkillZipMeta = {
+  ownerId: string
+  slug: string
+  version: string
+  publishedAt: number
+}
+
+type ZipInput = Record<string, Uint8Array | [Uint8Array, { mtime?: Date }]>
+
+const FIXED_ZIP_DATE = new Date(1980, 0, 1, 0, 0, 0)
+
+export function buildSkillMeta(meta: SkillZipMeta) {
+  return {
+    ownerId: meta.ownerId,
+    slug: meta.slug,
+    version: meta.version,
+    publishedAt: meta.publishedAt,
+  }
+}
+
+export function buildDeterministicZip(entries: ZipEntry[], meta?: SkillZipMeta) {
+  const sorted = [...entries].sort((a, b) => a.path.localeCompare(b.path))
+  const zipData: ZipInput = {}
+
+  for (const entry of sorted) {
+    zipData[entry.path] = [entry.bytes, { mtime: FIXED_ZIP_DATE }]
+  }
+
+  if (meta) {
+    const metaContent = new TextEncoder().encode(JSON.stringify(buildSkillMeta(meta), null, 2))
+    zipData['_meta.json'] = [metaContent, { mtime: FIXED_ZIP_DATE }]
+  }
+
+  return Uint8Array.from(zipSync(zipData, { level: 6 }))
+}

convex/lib/skills.ts

@@ -7,7 +7,7 @@ import {
   parseArk,
   type SkillInstallSpec,
   TEXT_FILE_EXTENSION_SET,
-} from 'clawdhub-schema'
+} from 'clawhub-schema'
 import { parse as parseYaml } from 'yaml'
 
 export type ParsedSkillFrontmatter = Record<string, unknown>
@@ -49,7 +49,9 @@ export function getFrontmatterMetadata(frontmatter: ParsedSkillFrontmatter) {
   if (!raw) return undefined
   if (typeof raw === 'string') {
     try {
-      const parsed = JSON.parse(raw) as unknown
+      // Strip trailing commas in JSON objects/arrays (common authoring mistake)
+      const cleaned = raw.replace(/,\s*([\]}])/g, '$1')
+      const parsed = JSON.parse(cleaned) as unknown
       return parsed ?? undefined
     } catch {
       return undefined
@@ -67,12 +69,15 @@ export function parseClawdisMetadata(frontmatter: ParsedSkillFrontmatter) {
       : undefined
   const clawdbotMeta = metadataRecord?.clawdbot
   const clawdisMeta = metadataRecord?.clawdis
+  const openclawMeta = metadataRecord?.openclaw
   const metadataSource =
     clawdbotMeta && typeof clawdbotMeta === 'object' && !Array.isArray(clawdbotMeta)
       ? (clawdbotMeta as Record<string, unknown>)
       : clawdisMeta && typeof clawdisMeta === 'object' && !Array.isArray(clawdisMeta)
         ? (clawdisMeta as Record<string, unknown>)
-        : undefined
+        : openclawMeta && typeof openclawMeta === 'object' && !Array.isArray(openclawMeta)
+          ? (openclawMeta as Record<string, unknown>)
+          : undefined
   const clawdisRaw = metadataSource ?? frontmatter.clawdis
   if (!clawdisRaw || typeof clawdisRaw !== 'object' || Array.isArray(clawdisRaw)) return undefined
 

convex/lib/soulPublish.ts

@@ -4,6 +4,7 @@ import { internal } from '../_generated/api'
 import type { Doc, Id } from '../_generated/dataModel'
 import type { ActionCtx } from '../_generated/server'
 import { generateEmbedding } from './embeddings'
+import { requireGitHubAccountAge } from './githubAccount'
 import {
   buildEmbeddingText,
   getFrontmatterMetadata,
@@ -90,6 +91,9 @@ export async function publishSoulVersionForUser(
   if (!semver.valid(version)) {
     throw new ConvexError('Version must be valid semver')
   }
+
+  await requireGitHubAccountAge(ctx, userId)
+
   const suppliedChangelog = args.changelog.trim()
   const changelogSource = suppliedChangelog ? ('user' as const) : ('auto' as const)
 

convex/lib/userSearch.ts

@@ -0,0 +1,68 @@
+import type { Doc } from '../_generated/dataModel'
+
+type UserSearchResult = {
+  items: Doc<'users'>[]
+  total: number
+}
+
+type UserSearchMatch = {
+  user: Doc<'users'>
+  score: number
+}
+
+function normalizeCompact(value: string) {
+  return value.toLowerCase().replace(/[^a-z0-9]/g, '')
+}
+
+function scoreUser(user: Doc<'users'>, query: string, compactQuery: string) {
+  const handle = user.handle?.toLowerCase() ?? ''
+  const name = user.name?.toLowerCase() ?? ''
+  const displayName = user.displayName?.toLowerCase() ?? ''
+  const email = user.email?.toLowerCase() ?? ''
+  const id = String(user._id).toLowerCase()
+
+  let score = 0
+
+  if (id === query) score = Math.max(score, 100)
+  if (handle === query) score = Math.max(score, 96)
+  if (displayName === query || name === query) score = Math.max(score, 90)
+
+  if (handle.startsWith(query)) score = Math.max(score, 82)
+  if (displayName.startsWith(query) || name.startsWith(query)) score = Math.max(score, 72)
+
+  if (handle.includes(query)) score = Math.max(score, 62)
+  if (displayName.includes(query) || name.includes(query)) score = Math.max(score, 52)
+  if (email.includes(query)) score = Math.max(score, 42)
+  if (id.includes(query)) score = Math.max(score, 40)
+
+  if (compactQuery.length >= 2) {
+    const compactHandle = normalizeCompact(handle)
+    const compactName = normalizeCompact(displayName || name)
+    if (compactHandle === compactQuery) score = Math.max(score, 88)
+    if (compactHandle.includes(compactQuery)) score = Math.max(score, 58)
+    if (compactName.includes(compactQuery)) score = Math.max(score, 48)
+  }
+
+  return score
+}
+
+export function buildUserSearchResults(users: Doc<'users'>[], query?: string): UserSearchResult {
+  const trimmed = query?.trim() ?? ''
+  if (!trimmed) return { items: users, total: users.length }
+
+  const normalized = trimmed.toLowerCase()
+  const compactQuery = normalizeCompact(normalized)
+  const matches: UserSearchMatch[] = []
+
+  for (const user of users) {
+    const score = scoreUser(user, normalized, compactQuery)
+    if (score > 0) matches.push({ user, score })
+  }
+
+  matches.sort((a, b) => {
+    if (b.score !== a.score) return b.score - a.score
+    return b.user._creationTime - a.user._creationTime
+  })
+
+  return { items: matches.map((entry) => entry.user), total: matches.length }
+}

convex/lib/webhooks.test.ts

@@ -20,7 +20,7 @@ describe('webhook config', () => {
     delete process.env.SITE_URL
     process.env.DISCORD_WEBHOOK_URL = 'https://example.com'
     const config = getWebhookConfig()
-    expect(config.siteUrl).toBe('https://clawdhub.com')
+    expect(config.siteUrl).toBe('https://clawhub.ai')
   })
 })
 
@@ -36,7 +36,7 @@ describe('webhook filtering', () => {
     const config = {
       url: 'https://example.com',
       highlightedOnly: true,
-      siteUrl: 'https://clawdhub.com',
+      siteUrl: 'https://clawhub.ai',
     }
     const allowed = shouldSendWebhook(
       'skill.publish',
@@ -50,7 +50,7 @@ describe('webhook filtering', () => {
     const config = {
       url: 'https://example.com',
       highlightedOnly: true,
-      siteUrl: 'https://clawdhub.com',
+      siteUrl: 'https://clawhub.ai',
     }
     const allowed = shouldSendWebhook(
       'skill.highlighted',
@@ -65,9 +65,9 @@ describe('payload building', () => {
   it('builds canonical url with owner', () => {
     const url = buildSkillUrl(
       { slug: 'beeper', displayName: 'Beeper', ownerHandle: 'KrauseFx' },
-      'https://clawdhub.com',
+      'https://clawhub.ai',
     )
-    expect(url).toBe('https://clawdhub.com/KrauseFx/beeper')
+    expect(url).toBe('https://clawhub.ai/KrauseFx/beeper')
   })
 
   it('builds a publish embed', () => {
@@ -81,7 +81,7 @@ describe('payload building', () => {
         ownerHandle: 'steipete',
         tags: ['latest', 'discord'],
       },
-      { url: 'https://example.com', highlightedOnly: false, siteUrl: 'https://clawdhub.com' },
+      { url: 'https://example.com', highlightedOnly: false, siteUrl: 'https://clawhub.ai' },
     )
     const embed = payload.embeds[0]
     expect(embed.title).toBe('Demo Skill')

convex/lib/webhooks.ts

@@ -16,7 +16,7 @@ export type WebhookConfig = {
   siteUrl: string
 }
 
-const DEFAULT_SITE_URL = 'https://clawdhub.com'
+const DEFAULT_SITE_URL = 'https://clawhub.ai'
 
 export function getWebhookConfig(env: NodeJS.ProcessEnv = process.env): WebhookConfig {
   const url = env.DISCORD_WEBHOOK_URL?.trim() || null
@@ -72,7 +72,7 @@ export function buildDiscordPayload(
           },
         ],
         footer: {
-          text: 'ClawdHub',
+          text: 'ClawHub',
         },
         timestamp: new Date().toISOString(),
       },
@@ -89,9 +89,9 @@ export function buildSkillUrl(skill: WebhookSkillPayload, siteUrl: string) {
 function buildDescription(event: WebhookEvent, skill: WebhookSkillPayload) {
   const summary = (skill.summary ?? '').trim()
   if (summary) return truncate(summary, 200)
-  if (event === 'skill.highlighted') return 'Newly highlighted skill on ClawdHub.'
-  if (skill.version) return `New version v${skill.version} published on ClawdHub.`
-  return 'New skill published on ClawdHub.'
+  if (event === 'skill.highlighted') return 'Newly highlighted skill on ClawHub.'
+  if (skill.version) return `New version v${skill.version} published on ClawHub.`
+  return 'New skill published on ClawHub.'
 }
 
 function parseBoolean(value?: string) {

convex/llmEval.ts

@@ -0,0 +1,398 @@
+import { v } from 'convex/values'
+import { internal } from './_generated/api'
+import type { Doc, Id } from './_generated/dataModel'
+import { internalAction } from './_generated/server'
+import type { SkillEvalContext } from './lib/securityPrompt'
+import {
+  assembleEvalUserMessage,
+  detectInjectionPatterns,
+  getLlmEvalModel,
+  LLM_EVAL_MAX_OUTPUT_TOKENS,
+  parseLlmEvalResponse,
+  SECURITY_EVALUATOR_SYSTEM_PROMPT,
+} from './lib/securityPrompt'
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function extractResponseText(payload: unknown): string | null {
+  if (!payload || typeof payload !== 'object') return null
+  const output = (payload as { output?: unknown }).output
+  if (!Array.isArray(output)) return null
+  const chunks: string[] = []
+  for (const item of output) {
+    if (!item || typeof item !== 'object') continue
+    if ((item as { type?: unknown }).type !== 'message') continue
+    const content = (item as { content?: unknown }).content
+    if (!Array.isArray(content)) continue
+    for (const part of content) {
+      if (!part || typeof part !== 'object') continue
+      if ((part as { type?: unknown }).type !== 'output_text') continue
+      const text = (part as { text?: unknown }).text
+      if (typeof text === 'string' && text.trim()) chunks.push(text)
+    }
+  }
+  const joined = chunks.join('\n').trim()
+  return joined || null
+}
+
+function verdictToStatus(verdict: string): string {
+  switch (verdict) {
+    case 'benign':
+      return 'clean'
+    case 'malicious':
+      return 'malicious'
+    case 'suspicious':
+      return 'suspicious'
+    default:
+      return 'pending'
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Publish-time evaluation action
+// ---------------------------------------------------------------------------
+
+export const evaluateWithLlm = internalAction({
+  args: {
+    versionId: v.id('skillVersions'),
+  },
+  handler: async (ctx, args) => {
+    const apiKey = process.env.OPENAI_API_KEY
+    if (!apiKey) {
+      console.log('[llmEval] OPENAI_API_KEY not configured, skipping evaluation')
+      return
+    }
+
+    const model = getLlmEvalModel()
+
+    // Store error helper
+    const storeError = async (message: string) => {
+      console.error(`[llmEval] ${message}`)
+      await ctx.runMutation(internal.skills.updateVersionLlmAnalysisInternal, {
+        versionId: args.versionId,
+        llmAnalysis: {
+          status: 'error',
+          summary: message,
+          model,
+          checkedAt: Date.now(),
+        },
+      })
+    }
+
+    // 1. Fetch version
+    const version = (await ctx.runQuery(internal.skills.getVersionByIdInternal, {
+      versionId: args.versionId,
+    })) as Doc<'skillVersions'> | null
+
+    if (!version) {
+      await storeError(`Version ${args.versionId} not found`)
+      return
+    }
+
+    // 2. Fetch skill
+    const skill = (await ctx.runQuery(internal.skills.getSkillByIdInternal, {
+      skillId: version.skillId,
+    })) as Doc<'skills'> | null
+
+    if (!skill) {
+      await storeError(`Skill ${version.skillId} not found`)
+      return
+    }
+
+    // 3. Read SKILL.md content
+    const skillMdFile = version.files.find((f) => {
+      const lower = f.path.toLowerCase()
+      return lower === 'skill.md' || lower === 'skills.md'
+    })
+
+    let skillMdContent = ''
+    if (skillMdFile) {
+      const blob = await ctx.storage.get(skillMdFile.storageId as Id<'_storage'>)
+      if (blob) {
+        skillMdContent = await blob.text()
+      }
+    }
+
+    if (!skillMdContent) {
+      await storeError('No SKILL.md content found')
+      return
+    }
+
+    // 4. Read all file contents
+    const fileContents: Array<{ path: string; content: string }> = []
+    for (const f of version.files) {
+      const lower = f.path.toLowerCase()
+      if (lower === 'skill.md' || lower === 'skills.md') continue
+      try {
+        const blob = await ctx.storage.get(f.storageId as Id<'_storage'>)
+        if (blob) {
+          fileContents.push({ path: f.path, content: await blob.text() })
+        }
+      } catch {
+        // Skip files that can't be read
+      }
+    }
+
+    // 5. Detect injection patterns across ALL content
+    const allContent = [skillMdContent, ...fileContents.map((f) => f.content)].join('\n')
+    const injectionSignals = detectInjectionPatterns(allContent)
+
+    // 6. Build eval context
+    const parsed = version.parsed as SkillEvalContext['parsed']
+    const fm = parsed.frontmatter ?? {}
+
+    const evalCtx: SkillEvalContext = {
+      slug: skill.slug,
+      displayName: skill.displayName,
+      ownerUserId: String(skill.ownerUserId),
+      version: version.version,
+      createdAt: version.createdAt,
+      summary: (skill.summary as string | undefined) ?? undefined,
+      source: (fm.source as string | undefined) ?? undefined,
+      homepage: (fm.homepage as string | undefined) ?? undefined,
+      parsed,
+      files: version.files.map((f) => ({ path: f.path, size: f.size })),
+      skillMdContent,
+      fileContents,
+      injectionSignals,
+    }
+
+    // 6. Assemble user message
+    const userMessage = assembleEvalUserMessage(evalCtx)
+
+    // 7. Call OpenAI Responses API (with retry for rate limits)
+    const MAX_RETRIES = 3
+    let raw: string | null = null
+    try {
+      const body = JSON.stringify({
+        model,
+        instructions: SECURITY_EVALUATOR_SYSTEM_PROMPT,
+        input: userMessage,
+        max_output_tokens: LLM_EVAL_MAX_OUTPUT_TOKENS,
+        text: {
+          format: {
+            type: 'json_object',
+          },
+        },
+      })
+
+      let response: Response | null = null
+      for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+        response = await fetch('https://api.openai.com/v1/responses', {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${apiKey}`,
+          },
+          body,
+        })
+
+        if (response.status === 429 || response.status >= 500) {
+          if (attempt < MAX_RETRIES) {
+            const delay = 2 ** attempt * 2000 + Math.random() * 1000
+            console.log(
+              `[llmEval] Rate limited (${response.status}), retrying in ${Math.round(delay)}ms (attempt ${attempt + 1}/${MAX_RETRIES})`,
+            )
+            await new Promise((r) => setTimeout(r, delay))
+            continue
+          }
+        }
+        break
+      }
+
+      if (!response || !response.ok) {
+        const errorText = response ? await response.text() : 'No response'
+        await storeError(`OpenAI API error (${response?.status}): ${errorText.slice(0, 200)}`)
+        return
+      }
+
+      const payload = (await response.json()) as unknown
+      raw = extractResponseText(payload)
+    } catch (error) {
+      await storeError(
+        `OpenAI API call failed: ${error instanceof Error ? error.message : String(error)}`,
+      )
+      return
+    }
+
+    if (!raw) {
+      await storeError('Empty response from OpenAI')
+      return
+    }
+
+    // 8. Parse response
+    const result = parseLlmEvalResponse(raw)
+
+    if (!result) {
+      console.error(`[llmEval] Raw response (first 500 chars): ${raw.slice(0, 500)}`)
+      await storeError('Failed to parse LLM evaluation response')
+      return
+    }
+
+    // 9. Store result
+    await ctx.runMutation(internal.skills.updateVersionLlmAnalysisInternal, {
+      versionId: args.versionId,
+      llmAnalysis: {
+        status: verdictToStatus(result.verdict),
+        verdict: result.verdict,
+        confidence: result.confidence,
+        summary: result.summary,
+        dimensions: result.dimensions,
+        guidance: result.guidance,
+        findings: result.findings || undefined,
+        model,
+        checkedAt: Date.now(),
+      },
+    })
+
+    console.log(
+      `[llmEval] Evaluated ${skill.slug}@${version.version}: ${result.verdict} (${result.confidence} confidence)`,
+    )
+
+    // 10. Update moderation flags — re-read version to get the sha256hash
+    // that VT may have stored while we were evaluating (both run concurrently).
+    const freshVersion = (await ctx.runQuery(internal.skills.getVersionByIdInternal, {
+      versionId: args.versionId,
+    })) as Doc<'skillVersions'> | null
+
+    const sha256hash = freshVersion?.sha256hash ?? version.sha256hash
+    if (sha256hash) {
+      const status = verdictToStatus(result.verdict)
+      if (status === 'malicious' || status === 'suspicious' || status === 'clean') {
+        await ctx.runMutation(internal.skills.approveSkillByHashInternal, {
+          sha256hash,
+          scanner: 'llm',
+          status,
+        })
+      }
+    }
+  },
+})
+
+// ---------------------------------------------------------------------------
+// Convenience: evaluate a single skill by slug (for testing / manual runs)
+// Usage: npx convex run llmEval:evaluateBySlug '{"slug": "transcribeexx"}'
+// ---------------------------------------------------------------------------
+
+export const evaluateBySlug = internalAction({
+  args: {
+    slug: v.string(),
+  },
+  handler: async (ctx, args) => {
+    const skill = (await ctx.runQuery(internal.skills.getSkillBySlugInternal, {
+      slug: args.slug,
+    })) as Doc<'skills'> | null
+
+    if (!skill) {
+      console.error(`[llmEval:bySlug] Skill "${args.slug}" not found`)
+      return { error: 'Skill not found' }
+    }
+
+    if (!skill.latestVersionId) {
+      console.error(`[llmEval:bySlug] Skill "${args.slug}" has no published version`)
+      return { error: 'No published version' }
+    }
+
+    console.log(`[llmEval:bySlug] Evaluating ${args.slug} (versionId: ${skill.latestVersionId})`)
+
+    await ctx.scheduler.runAfter(0, internal.llmEval.evaluateWithLlm, {
+      versionId: skill.latestVersionId,
+    })
+
+    return { ok: true, slug: args.slug, versionId: skill.latestVersionId }
+  },
+})
+
+// ---------------------------------------------------------------------------
+// Backfill action (Phase 2)
+// Schedules individual evaluateWithLlm actions for each skill in the batch,
+// then self-schedules the next batch. Each eval runs as its own action
+// invocation so we don't hit Convex action timeouts.
+// ---------------------------------------------------------------------------
+
+export const backfillLlmEval = internalAction({
+  args: {
+    cursor: v.optional(v.number()),
+    batchSize: v.optional(v.number()),
+    accTotal: v.optional(v.number()),
+    accScheduled: v.optional(v.number()),
+    accSkipped: v.optional(v.number()),
+    startTime: v.optional(v.number()),
+  },
+  handler: async (ctx, args) => {
+    const startTime = args.startTime ?? Date.now()
+    const apiKey = process.env.OPENAI_API_KEY
+    if (!apiKey) {
+      console.log('[llmEval:backfill] OPENAI_API_KEY not configured')
+      return { error: 'OPENAI_API_KEY not configured' }
+    }
+
+    const batchSize = args.batchSize ?? 25
+    const cursor = args.cursor ?? 0
+    let accTotal = args.accTotal ?? 0
+    let accScheduled = args.accScheduled ?? 0
+    let accSkipped = args.accSkipped ?? 0
+
+    const batch = await ctx.runQuery(internal.skills.getActiveSkillBatchForLlmBackfillInternal, {
+      cursor,
+      batchSize,
+    })
+
+    if (batch.skills.length === 0 && batch.done) {
+      console.log('[llmEval:backfill] No more skills to evaluate')
+      return { total: accTotal, scheduled: accScheduled, skipped: accSkipped }
+    }
+
+    console.log(
+      `[llmEval:backfill] Processing batch of ${batch.skills.length} skills (cursor=${cursor}, accumulated=${accTotal})`,
+    )
+
+    for (const { versionId, slug } of batch.skills) {
+      // Re-evaluate all (full file content reading upgrade)
+      const version = (await ctx.runQuery(internal.skills.getVersionByIdInternal, {
+        versionId,
+      })) as Doc<'skillVersions'> | null
+
+      if (!version) {
+        accSkipped++
+        continue
+      }
+
+      // Schedule each evaluation as a separate action invocation
+      await ctx.scheduler.runAfter(0, internal.llmEval.evaluateWithLlm, { versionId })
+      accScheduled++
+      console.log(`[llmEval:backfill] Scheduled eval for ${slug}`)
+    }
+
+    accTotal += batch.skills.length
+
+    if (!batch.done) {
+      // Delay the next batch slightly to avoid overwhelming the scheduler
+      // when all evals from this batch are also running
+      console.log(
+        `[llmEval:backfill] Scheduling next batch (cursor=${batch.nextCursor}, total so far=${accTotal})`,
+      )
+      await ctx.scheduler.runAfter(5_000, internal.llmEval.backfillLlmEval, {
+        cursor: batch.nextCursor,
+        batchSize,
+        accTotal,
+        accScheduled,
+        accSkipped,
+        startTime,
+      })
+      return { status: 'continuing', totalSoFar: accTotal }
+    }
+
+    const durationMs = Date.now() - startTime
+    const result = {
+      total: accTotal,
+      scheduled: accScheduled,
+      skipped: accSkipped,
+      durationMs,
+    }
+    console.log('[llmEval:backfill] Complete:', result)
+    return result
+  },
+})

convex/rateLimits.ts

@@ -1,7 +1,11 @@
 import { v } from 'convex/values'
-import { internalMutation } from './_generated/server'
+import { internalMutation, internalQuery } from './_generated/server'
 
-export const checkRateLimitInternal = internalMutation({
+/**
+ * Read-only rate limit check. Returns current status without writing anything.
+ * This eliminates write conflicts for denied requests entirely.
+ */
+export const getRateLimitStatusInternal = internalQuery({
   args: {
     key: v.string(),
     limit: v.number(),
@@ -20,6 +24,43 @@ export const checkRateLimitInternal = internalMutation({
       .withIndex('by_key_window', (q) => q.eq('key', args.key).eq('windowStart', windowStart))
       .unique()
 
+    const count = existing?.count ?? 0
+    const allowed = count < args.limit
+    return {
+      allowed,
+      remaining: Math.max(0, args.limit - count),
+      limit: args.limit,
+      resetAt,
+    }
+  },
+})
+
+/**
+ * Consume one rate limit token. Only call this after getRateLimitStatusInternal
+ * returns allowed=true. Includes a double-check to handle races between the
+ * query and this mutation.
+ */
+export const consumeRateLimitInternal = internalMutation({
+  args: {
+    key: v.string(),
+    limit: v.number(),
+    windowMs: v.number(),
+  },
+  handler: async (ctx, args) => {
+    const now = Date.now()
+    const windowStart = Math.floor(now / args.windowMs) * args.windowMs
+
+    const existing = await ctx.db
+      .query('rateLimits')
+      .withIndex('by_key_window', (q) => q.eq('key', args.key).eq('windowStart', windowStart))
+      .unique()
+
+    // Double-check: another request may have consumed the last token
+    // between our query and this mutation
+    if (existing && existing.count >= args.limit) {
+      return { allowed: false, remaining: 0 }
+    }
+
     if (!existing) {
       await ctx.db.insert('rateLimits', {
         key: args.key,
@@ -28,11 +69,7 @@ export const checkRateLimitInternal = internalMutation({
         limit: args.limit,
         updatedAt: now,
       })
-      return { allowed: true, remaining: Math.max(0, args.limit - 1), limit: args.limit, resetAt }
-    }
-
-    if (existing.count >= args.limit) {
-      return { allowed: false, remaining: 0, limit: args.limit, resetAt }
+      return { allowed: true, remaining: Math.max(0, args.limit - 1) }
     }
 
     await ctx.db.patch(existing._id, {
@@ -43,8 +80,6 @@ export const checkRateLimitInternal = internalMutation({
     return {
       allowed: true,
       remaining: Math.max(0, args.limit - existing.count - 1),
-      limit: args.limit,
-      resetAt,
     }
   },
 })

convex/schema.ts

@@ -17,7 +17,10 @@ const users = defineTable({
   displayName: v.optional(v.string()),
   bio: v.optional(v.string()),
   role: v.optional(v.union(v.literal('admin'), v.literal('moderator'), v.literal('user'))),
+  githubCreatedAt: v.optional(v.number()),
+  githubFetchedAt: v.optional(v.number()),
   deletedAt: v.optional(v.number()),
+  banReason: v.optional(v.string()),
   createdAt: v.optional(v.number()),
   updatedAt: v.optional(v.number()),
 })
@@ -29,6 +32,7 @@ const skills = defineTable({
   slug: v.string(),
   displayName: v.string(),
   summary: v.optional(v.string()),
+  resourceId: v.optional(v.string()),
   ownerUserId: v.id('users'),
   canonicalSkillId: v.optional(v.id('skills')),
   forkOf: v.optional(
@@ -42,32 +46,34 @@ const skills = defineTable({
   latestVersionId: v.optional(v.id('skillVersions')),
   tags: v.record(v.string(), v.id('skillVersions')),
   softDeletedAt: v.optional(v.number()),
-  badges: v.object({
-    redactionApproved: v.optional(
-      v.object({
-        byUserId: v.id('users'),
-        at: v.number(),
-      }),
-    ),
-    highlighted: v.optional(
-      v.object({
-        byUserId: v.id('users'),
-        at: v.number(),
-      }),
-    ),
-    official: v.optional(
-      v.object({
-        byUserId: v.id('users'),
-        at: v.number(),
-      }),
-    ),
-    deprecated: v.optional(
-      v.object({
-        byUserId: v.id('users'),
-        at: v.number(),
-      }),
-    ),
-  }),
+  badges: v.optional(
+    v.object({
+      redactionApproved: v.optional(
+        v.object({
+          byUserId: v.id('users'),
+          at: v.number(),
+        }),
+      ),
+      highlighted: v.optional(
+        v.object({
+          byUserId: v.id('users'),
+          at: v.number(),
+        }),
+      ),
+      official: v.optional(
+        v.object({
+          byUserId: v.id('users'),
+          at: v.number(),
+        }),
+      ),
+      deprecated: v.optional(
+        v.object({
+          byUserId: v.id('users'),
+          at: v.number(),
+        }),
+      ),
+    }),
+  ),
   moderationStatus: v.optional(
     v.union(v.literal('active'), v.literal('hidden'), v.literal('removed')),
   ),
@@ -75,6 +81,9 @@ const skills = defineTable({
   moderationReason: v.optional(v.string()),
   moderationFlags: v.optional(v.array(v.string())),
   lastReviewedAt: v.optional(v.number()),
+  // VT scan tracking
+  scanLastCheckedAt: v.optional(v.number()),
+  scanCheckCount: v.optional(v.number()),
   hiddenAt: v.optional(v.number()),
   hiddenBy: v.optional(v.id('users')),
   reportCount: v.optional(v.number()),
@@ -104,6 +113,8 @@ const skills = defineTable({
   .index('by_stats_installs_all_time', ['statsInstallsAllTime', 'updatedAt'])
   .index('by_batch', ['batch'])
   .index('by_active_updated', ['softDeletedAt', 'updatedAt'])
+  .index('by_canonical', ['canonicalSkillId'])
+  .index('by_fork_of', ['forkOf.skillId'])
 
 const souls = defineTable({
   slug: v.string(),
@@ -145,13 +156,47 @@ const skillVersions = defineTable({
     frontmatter: v.record(v.string(), v.any()),
     metadata: v.optional(v.any()),
     clawdis: v.optional(v.any()),
+    moltbot: v.optional(v.any()),
   }),
   createdBy: v.id('users'),
   createdAt: v.number(),
   softDeletedAt: v.optional(v.number()),
+  sha256hash: v.optional(v.string()),
+  vtAnalysis: v.optional(
+    v.object({
+      status: v.string(),
+      verdict: v.optional(v.string()),
+      analysis: v.optional(v.string()),
+      source: v.optional(v.string()),
+      checkedAt: v.number(),
+    }),
+  ),
+  llmAnalysis: v.optional(
+    v.object({
+      status: v.string(),
+      verdict: v.optional(v.string()),
+      confidence: v.optional(v.string()),
+      summary: v.optional(v.string()),
+      dimensions: v.optional(
+        v.array(
+          v.object({
+            name: v.string(),
+            label: v.string(),
+            rating: v.string(),
+            detail: v.string(),
+          }),
+        ),
+      ),
+      guidance: v.optional(v.string()),
+      findings: v.optional(v.string()),
+      model: v.optional(v.string()),
+      checkedAt: v.number(),
+    }),
+  ),
 })
   .index('by_skill', ['skillId'])
   .index('by_skill_version', ['skillId', 'version'])
+  .index('by_sha256hash', ['sha256hash'])
 
 const soulVersions = defineTable({
   soulId: v.id('souls'),
@@ -172,6 +217,7 @@ const soulVersions = defineTable({
     frontmatter: v.record(v.string(), v.any()),
     metadata: v.optional(v.any()),
     clawdis: v.optional(v.any()),
+    moltbot: v.optional(v.any()),
   }),
   createdBy: v.id('users'),
   createdAt: v.number(),
@@ -271,6 +317,8 @@ const skillStatEvents = defineTable({
     v.literal('download'),
     v.literal('star'),
     v.literal('unstar'),
+    v.literal('comment'),
+    v.literal('uncomment'),
     v.literal('install_new'),
     v.literal('install_reactivate'),
     v.literal('install_deactivate'),
@@ -330,6 +378,7 @@ const skillReports = defineTable({
   createdAt: v.number(),
 })
   .index('by_skill', ['skillId'])
+  .index('by_skill_createdAt', ['skillId', 'createdAt'])
   .index('by_user', ['userId'])
   .index('by_skill_user', ['skillId', 'userId'])
 
@@ -373,6 +422,24 @@ const auditLogs = defineTable({
   .index('by_actor', ['actorUserId'])
   .index('by_target', ['targetType', 'targetId'])
 
+const vtScanLogs = defineTable({
+  type: v.union(v.literal('daily_rescan'), v.literal('backfill'), v.literal('pending_poll')),
+  total: v.number(),
+  updated: v.number(),
+  unchanged: v.number(),
+  errors: v.number(),
+  flaggedSkills: v.optional(
+    v.array(
+      v.object({
+        slug: v.string(),
+        status: v.string(),
+      }),
+    ),
+  ),
+  durationMs: v.number(),
+  createdAt: v.number(),
+}).index('by_type_date', ['type', 'createdAt'])
+
 const apiTokens = defineTable({
   userId: v.id('users'),
   label: v.string(),
@@ -462,6 +529,7 @@ export default defineSchema({
   stars,
   soulStars,
   auditLogs,
+  vtScanLogs,
   apiTokens,
   rateLimits,
   githubBackupSyncState,

convex/search.test.ts

@@ -1,12 +1,305 @@
 /* @vitest-environment node */
 
-import { describe, expect, it } from 'vitest'
-import { __test } from './search'
+import { describe, expect, it, vi } from 'vitest'
+import { tokenize } from './lib/searchText'
+import { __test, lexicalFallbackSkills, searchSkills } from './search'
+
+const { generateEmbeddingMock, getSkillBadgeMapsMock } = vi.hoisted(() => ({
+  generateEmbeddingMock: vi.fn(),
+  getSkillBadgeMapsMock: vi.fn(),
+}))
+
+vi.mock('./lib/embeddings', () => ({
+  generateEmbedding: generateEmbeddingMock,
+}))
+
+vi.mock('./lib/badges', () => ({
+  getSkillBadgeMaps: getSkillBadgeMapsMock,
+  isSkillHighlighted: (skill: { badges?: Record<string, unknown> }) =>
+    Boolean(skill.badges?.highlighted),
+}))
+
+type WrappedHandler = {
+  _handler: (ctx: unknown, args: unknown) => Promise<unknown>
+}
+
+const searchSkillsHandler = (searchSkills as unknown as WrappedHandler)._handler
+const lexicalFallbackSkillsHandler = (lexicalFallbackSkills as unknown as WrappedHandler)._handler
 
 describe('search helpers', () => {
+  it('returns fallback results when vector candidates are empty', async () => {
+    generateEmbeddingMock.mockResolvedValueOnce([0, 1, 2])
+    const fallback = [
+      {
+        skill: makePublicSkill({ id: 'skills:orf', slug: 'orf', displayName: 'ORF' }),
+        version: null,
+        ownerHandle: 'steipete',
+      },
+    ]
+    const runQuery = vi
+      .fn()
+      .mockResolvedValueOnce([])
+      .mockResolvedValueOnce([])
+      .mockResolvedValueOnce(fallback)
+
+    const result = await searchSkillsHandler(
+      {
+        vectorSearch: vi.fn().mockResolvedValue([]),
+        runQuery,
+      },
+      { query: 'orf', limit: 10 },
+    )
+
+    expect(result).toHaveLength(1)
+    expect(result[0].skill.slug).toBe('orf')
+    expect(runQuery).toHaveBeenLastCalledWith(
+      expect.anything(),
+      expect.objectContaining({ query: 'orf', queryTokens: ['orf'] }),
+    )
+  })
+
+  it('applies highlightedOnly filtering in lexical fallback', async () => {
+    const highlighted = makeSkillDoc({
+      id: 'skills:hl',
+      slug: 'orf-highlighted',
+      displayName: 'ORF Highlighted',
+    })
+    const plain = makeSkillDoc({ id: 'skills:plain', slug: 'orf-plain', displayName: 'ORF Plain' })
+    getSkillBadgeMapsMock.mockResolvedValueOnce(
+      new Map([
+        ['skills:hl', { highlighted: { byUserId: 'users:mod', at: 1 } }],
+        ['skills:plain', {}],
+      ]),
+    )
+
+    const result = await lexicalFallbackSkillsHandler(
+      makeLexicalCtx({
+        exactSlugSkill: null,
+        recentSkills: [highlighted, plain],
+      }),
+      { query: 'orf', queryTokens: ['orf'], highlightedOnly: true, limit: 10 },
+    )
+
+    expect(result).toHaveLength(1)
+    expect(result[0].skill.slug).toBe('orf-highlighted')
+  })
+
+  it('includes exact slug match from by_slug even when recent scan is empty', async () => {
+    const exactSlugSkill = makeSkillDoc({ id: 'skills:orf', slug: 'orf', displayName: 'ORF' })
+    getSkillBadgeMapsMock.mockResolvedValueOnce(new Map([['skills:orf', {}]]))
+    const ctx = makeLexicalCtx({
+      exactSlugSkill,
+      recentSkills: [],
+    })
+
+    const result = await lexicalFallbackSkillsHandler(ctx, {
+      query: 'orf',
+      queryTokens: ['orf'],
+      limit: 10,
+    })
+
+    expect(result).toHaveLength(1)
+    expect(result[0].skill.slug).toBe('orf')
+    expect(ctx.db.query).toHaveBeenCalledWith('skills')
+  })
+
+  it('dedupes overlap and enforces rank + limit across vector and fallback', async () => {
+    generateEmbeddingMock.mockResolvedValueOnce([0, 1, 2])
+    const vectorEntries = [
+      {
+        embeddingId: 'skillEmbeddings:a',
+        skill: makePublicSkill({
+          id: 'skills:a',
+          slug: 'foo-a',
+          displayName: 'Foo Alpha',
+          downloads: 10,
+        }),
+        version: null,
+        ownerHandle: 'one',
+      },
+      {
+        embeddingId: 'skillEmbeddings:b',
+        skill: makePublicSkill({
+          id: 'skills:b',
+          slug: 'foo-b',
+          displayName: 'Foo Beta',
+          downloads: 2,
+        }),
+        version: null,
+        ownerHandle: 'two',
+      },
+    ]
+    const fallbackEntries = [
+      {
+        skill: makePublicSkill({
+          id: 'skills:a',
+          slug: 'foo-a',
+          displayName: 'Foo Alpha',
+          downloads: 10,
+        }),
+        version: null,
+        ownerHandle: 'one',
+      },
+      {
+        skill: makePublicSkill({
+          id: 'skills:c',
+          slug: 'foo-c',
+          displayName: 'Foo Classic',
+          downloads: 1,
+        }),
+        version: null,
+        ownerHandle: 'three',
+      },
+    ]
+
+    const runQuery = vi
+      .fn()
+      .mockResolvedValueOnce(vectorEntries)
+      .mockResolvedValueOnce([])
+      .mockResolvedValueOnce(fallbackEntries)
+
+    const result = await searchSkillsHandler(
+      {
+        vectorSearch: vi.fn().mockResolvedValue([
+          { _id: 'skillEmbeddings:a', _score: 0.4 },
+          { _id: 'skillEmbeddings:b', _score: 0.9 },
+        ]),
+        runQuery,
+      },
+      { query: 'foo', limit: 2 },
+    )
+
+    expect(result).toHaveLength(2)
+    expect(result[0].skill.slug).toBe('foo-b')
+    expect(new Set(result.map((entry: { skill: { _id: string } }) => entry.skill._id)).size).toBe(2)
+  })
+
   it('advances candidate limit until max', () => {
     expect(__test.getNextCandidateLimit(50, 1000)).toBe(100)
     expect(__test.getNextCandidateLimit(800, 1000)).toBe(1000)
     expect(__test.getNextCandidateLimit(1000, 1000)).toBeNull()
   })
+
+  it('boosts exact slug/name matches over loose matches', () => {
+    const queryTokens = tokenize('notion')
+    const exactScore = __test.scoreSkillResult(queryTokens, 0.4, 'Notion Sync', 'notion-sync', 5)
+    const looseScore = __test.scoreSkillResult(queryTokens, 0.6, 'Notes Sync', 'notes-sync', 500)
+    expect(exactScore).toBeGreaterThan(looseScore)
+  })
+
+  it('adds a popularity prior for equally relevant matches', () => {
+    const queryTokens = tokenize('notion')
+    const lowDownloads = __test.scoreSkillResult(
+      queryTokens,
+      0.5,
+      'Notion Helper',
+      'notion-helper',
+      0,
+    )
+    const highDownloads = __test.scoreSkillResult(
+      queryTokens,
+      0.5,
+      'Notion Helper',
+      'notion-helper',
+      1000,
+    )
+    expect(highDownloads).toBeGreaterThan(lowDownloads)
+  })
+
+  it('merges fallback matches without duplicate skill ids', () => {
+    const primary = [
+      {
+        embeddingId: 'skillEmbeddings:1',
+        skill: { _id: 'skills:1' },
+      },
+    ] as unknown as Parameters<typeof __test.mergeUniqueBySkillId>[0]
+    const fallback = [
+      {
+        skill: { _id: 'skills:1' },
+      },
+      {
+        skill: { _id: 'skills:2' },
+      },
+    ] as unknown as Parameters<typeof __test.mergeUniqueBySkillId>[1]
+
+    const merged = __test.mergeUniqueBySkillId(primary, fallback)
+    expect(merged).toHaveLength(2)
+    expect(merged.map((entry) => entry.skill._id)).toEqual(['skills:1', 'skills:2'])
+  })
 })
+
+function makePublicSkill(params: {
+  id: string
+  slug: string
+  displayName: string
+  downloads?: number
+}) {
+  return {
+    _id: params.id,
+    _creationTime: 1,
+    slug: params.slug,
+    displayName: params.displayName,
+    summary: `${params.displayName} summary`,
+    ownerUserId: 'users:owner',
+    canonicalSkillId: undefined,
+    forkOf: undefined,
+    latestVersionId: 'skillVersions:1',
+    tags: {},
+    badges: {},
+    stats: {
+      downloads: params.downloads ?? 0,
+      installsCurrent: 0,
+      installsAllTime: 0,
+      stars: 0,
+      versions: 1,
+      comments: 0,
+    },
+    createdAt: 1,
+    updatedAt: 1,
+  }
+}
+
+function makeSkillDoc(params: { id: string; slug: string; displayName: string }) {
+  return {
+    ...makePublicSkill(params),
+    _creationTime: 1,
+    moderationStatus: 'active',
+    moderationFlags: [],
+    softDeletedAt: undefined,
+  }
+}
+
+function makeLexicalCtx(params: {
+  exactSlugSkill: ReturnType<typeof makeSkillDoc> | null
+  recentSkills: Array<ReturnType<typeof makeSkillDoc>>
+}) {
+  return {
+    db: {
+      query: vi.fn((table: string) => {
+        if (table !== 'skills') throw new Error(`Unexpected table ${table}`)
+        return {
+          withIndex: (index: string) => {
+            if (index === 'by_slug') {
+              return {
+                unique: vi.fn().mockResolvedValue(params.exactSlugSkill),
+              }
+            }
+            if (index === 'by_active_updated') {
+              return {
+                order: () => ({
+                  take: vi.fn().mockResolvedValue(params.recentSkills),
+                }),
+              }
+            }
+            throw new Error(`Unexpected index ${index}`)
+          },
+        }
+      }),
+      get: vi.fn(async (id: string) => {
+        if (id.startsWith('users:')) return { _id: id, handle: 'owner' }
+        if (id.startsWith('skillVersions:')) return { _id: id, version: '1.0.0' }
+        return null
+      }),
+    },
+  }
+}

convex/search.ts

@@ -7,20 +7,86 @@ import { generateEmbedding } from './lib/embeddings'
 import { toPublicSkill, toPublicSoul } from './lib/public'
 import { matchesExactTokens, tokenize } from './lib/searchText'
 
-type HydratedEntry = {
-  embeddingId: Id<'skillEmbeddings'>
+type SkillSearchEntry = {
+  embeddingId?: Id<'skillEmbeddings'>
   skill: NonNullable<ReturnType<typeof toPublicSkill>>
   version: Doc<'skillVersions'> | null
   ownerHandle: string | null
 }
 
-type SearchResult = HydratedEntry & { score: number }
+type SearchResult = SkillSearchEntry & { score: number }
+
+const SLUG_EXACT_BOOST = 1.4
+const SLUG_PREFIX_BOOST = 0.8
+const NAME_EXACT_BOOST = 1.1
+const NAME_PREFIX_BOOST = 0.6
+const POPULARITY_WEIGHT = 0.08
+const FALLBACK_SCAN_LIMIT = 1200
 
 function getNextCandidateLimit(current: number, max: number) {
   const next = Math.min(current * 2, max)
   return next > current ? next : null
 }
 
+function matchesAllTokens(
+  queryTokens: string[],
+  candidateTokens: string[],
+  matcher: (candidate: string, query: string) => boolean,
+) {
+  if (queryTokens.length === 0 || candidateTokens.length === 0) return false
+  return queryTokens.every((queryToken) =>
+    candidateTokens.some((candidateToken) => matcher(candidateToken, queryToken)),
+  )
+}
+
+function getLexicalBoost(queryTokens: string[], displayName: string, slug: string) {
+  const slugTokens = tokenize(slug)
+  const nameTokens = tokenize(displayName)
+
+  let boost = 0
+  if (matchesAllTokens(queryTokens, slugTokens, (candidate, query) => candidate === query)) {
+    boost += SLUG_EXACT_BOOST
+  } else if (
+    matchesAllTokens(queryTokens, slugTokens, (candidate, query) => candidate.startsWith(query))
+  ) {
+    boost += SLUG_PREFIX_BOOST
+  }
+
+  if (matchesAllTokens(queryTokens, nameTokens, (candidate, query) => candidate === query)) {
+    boost += NAME_EXACT_BOOST
+  } else if (
+    matchesAllTokens(queryTokens, nameTokens, (candidate, query) => candidate.startsWith(query))
+  ) {
+    boost += NAME_PREFIX_BOOST
+  }
+
+  return boost
+}
+
+function scoreSkillResult(
+  queryTokens: string[],
+  vectorScore: number,
+  displayName: string,
+  slug: string,
+  downloads: number,
+) {
+  const lexicalBoost = getLexicalBoost(queryTokens, displayName, slug)
+  const popularityBoost = Math.log1p(Math.max(downloads, 0)) * POPULARITY_WEIGHT
+  return vectorScore + lexicalBoost + popularityBoost
+}
+
+function mergeUniqueBySkillId(primary: SkillSearchEntry[], fallback: SkillSearchEntry[]) {
+  if (fallback.length === 0) return primary
+  const out = [...primary]
+  const seen = new Set(primary.map((entry) => entry.skill._id))
+  for (const entry of fallback) {
+    if (seen.has(entry.skill._id)) continue
+    seen.add(entry.skill._id)
+    out.push(entry)
+  }
+  return out
+}
+
 export const searchSkills: ReturnType<typeof action> = action({
   args: {
     query: v.string(),
@@ -43,9 +109,9 @@ export const searchSkills: ReturnType<typeof action> = action({
     // Convex vectorSearch max limit is 256; clamp candidate sizes accordingly.
     const maxCandidate = Math.min(Math.max(limit * 10, 200), 256)
     let candidateLimit = Math.min(Math.max(limit * 3, 50), 256)
-    let hydrated: HydratedEntry[] = []
+    let hydrated: SkillSearchEntry[] = []
     let scoreById = new Map<Id<'skillEmbeddings'>, number>()
-    let exactMatches: HydratedEntry[] = []
+    let exactMatches: SkillSearchEntry[] = []
 
     while (candidateLimit <= maxCandidate) {
       const results = await ctx.vectorSearch('skillEmbeddings', 'by_embedding', {
@@ -56,7 +122,7 @@ export const searchSkills: ReturnType<typeof action> = action({
 
       hydrated = (await ctx.runQuery(internal.search.hydrateResults, {
         embeddingIds: results.map((result) => result._id),
-      })) as HydratedEntry[]
+      })) as SkillSearchEntry[]
 
       scoreById = new Map<Id<'skillEmbeddings'>, number>(
         results.map((result) => [result._id, result._score]),
@@ -95,12 +161,34 @@ export const searchSkills: ReturnType<typeof action> = action({
       candidateLimit = nextLimit
     }
 
-    return exactMatches
-      .map((entry) => ({
-        ...entry,
-        score: scoreById.get(entry.embeddingId) ?? 0,
-      }))
+    const fallbackMatches =
+      exactMatches.length >= limit
+        ? []
+        : ((await ctx.runQuery(internal.search.lexicalFallbackSkills, {
+            query,
+            queryTokens,
+            limit: Math.min(Math.max(limit * 4, 200), FALLBACK_SCAN_LIMIT),
+            highlightedOnly: args.highlightedOnly,
+          })) as SkillSearchEntry[])
+
+    const mergedMatches = mergeUniqueBySkillId(exactMatches, fallbackMatches)
+
+    return mergedMatches
+      .map((entry) => {
+        const vectorScore = entry.embeddingId ? (scoreById.get(entry.embeddingId) ?? 0) : 0
+        return {
+          ...entry,
+          score: scoreSkillResult(
+            queryTokens,
+            vectorScore,
+            entry.skill.displayName,
+            entry.skill.slug,
+            entry.skill.stats.downloads,
+          ),
+        }
+      })
       .filter((entry) => entry.skill)
+      .sort((a, b) => b.score - a.score || b.skill.stats.downloads - a.skill.stats.downloads)
       .slice(0, limit)
   },
 })
@@ -115,7 +203,7 @@ export const getBadgeMapsForSkills = internalQuery({
 
 export const hydrateResults = internalQuery({
   args: { embeddingIds: v.array(v.id('skillEmbeddings')) },
-  handler: async (ctx, args): Promise<HydratedEntry[]> => {
+  handler: async (ctx, args): Promise<SkillSearchEntry[]> => {
     const ownerHandleCache = new Map<Id<'users'>, Promise<string | null>>()
 
     const getOwnerHandle = (ownerUserId: Id<'users'>) => {
@@ -144,7 +232,92 @@ export const hydrateResults = internalQuery({
       }),
     )
 
-    return entries.filter((entry): entry is HydratedEntry => entry !== null)
+    return entries.filter((entry): entry is SkillSearchEntry => entry !== null)
+  },
+})
+
+export const lexicalFallbackSkills = internalQuery({
+  args: {
+    query: v.string(),
+    queryTokens: v.array(v.string()),
+    limit: v.optional(v.number()),
+    highlightedOnly: v.optional(v.boolean()),
+  },
+  handler: async (ctx, args): Promise<SkillSearchEntry[]> => {
+    const limit = Math.min(Math.max(args.limit ?? 200, 10), FALLBACK_SCAN_LIMIT)
+    const seenSkillIds = new Set<Id<'skills'>>()
+    const candidateSkills: Doc<'skills'>[] = []
+
+    const slugQuery = args.query.trim().toLowerCase()
+    if (/^[a-z0-9][a-z0-9-]*$/.test(slugQuery)) {
+      const exactSlugSkill = await ctx.db
+        .query('skills')
+        .withIndex('by_slug', (q) => q.eq('slug', slugQuery))
+        .unique()
+      if (exactSlugSkill && !exactSlugSkill.softDeletedAt) {
+        seenSkillIds.add(exactSlugSkill._id)
+        candidateSkills.push(exactSlugSkill)
+      }
+    }
+
+    const recentSkills = await ctx.db
+      .query('skills')
+      .withIndex('by_active_updated', (q) => q.eq('softDeletedAt', undefined))
+      .order('desc')
+      .take(FALLBACK_SCAN_LIMIT)
+
+    for (const skill of recentSkills) {
+      if (seenSkillIds.has(skill._id)) continue
+      seenSkillIds.add(skill._id)
+      candidateSkills.push(skill)
+    }
+
+    const matched = candidateSkills.filter((skill) =>
+      matchesExactTokens(args.queryTokens, [skill.displayName, skill.slug, skill.summary]),
+    )
+    if (matched.length === 0) return []
+
+    const ownerHandleCache = new Map<Id<'users'>, Promise<string | null>>()
+    const getOwnerHandle = (ownerUserId: Id<'users'>) => {
+      const cached = ownerHandleCache.get(ownerUserId)
+      if (cached) return cached
+      const handlePromise = ctx.db
+        .get(ownerUserId)
+        .then((owner) => owner?.handle ?? owner?._id ?? null)
+      ownerHandleCache.set(ownerUserId, handlePromise)
+      return handlePromise
+    }
+
+    const entries = await Promise.all(
+      matched.map(async (skill) => {
+        const [version, ownerHandle] = await Promise.all([
+          skill.latestVersionId ? ctx.db.get(skill.latestVersionId) : Promise.resolve(null),
+          getOwnerHandle(skill.ownerUserId),
+        ])
+        const publicSkill = toPublicSkill(skill)
+        if (!publicSkill) return null
+        return { skill: publicSkill, version, ownerHandle }
+      }),
+    )
+    const validEntries = entries.filter((entry): entry is SkillSearchEntry => entry !== null)
+    if (validEntries.length === 0) return []
+
+    const badgeMap = await getSkillBadgeMaps(
+      ctx,
+      validEntries.map((entry) => entry.skill._id),
+    )
+    const withBadges = validEntries.map((entry) => ({
+      ...entry,
+      skill: {
+        ...entry.skill,
+        badges: badgeMap.get(entry.skill._id) ?? {},
+      },
+    }))
+
+    const filtered = args.highlightedOnly
+      ? withBadges.filter((entry) => isSkillHighlighted(entry.skill))
+      : withBadges
+    return filtered.slice(0, limit)
   },
 })
 
@@ -251,4 +424,10 @@ export const getSkillBadgeMapsInternal = internalQuery({
   },
 })
 
-export const __test = { getNextCandidateLimit }
+export const __test = {
+  getNextCandidateLimit,
+  matchesAllTokens,
+  getLexicalBoost,
+  scoreSkillResult,
+  mergeUniqueBySkillId,
+}

convex/skillStatEvents.test.ts

@@ -0,0 +1,110 @@
+/* @vitest-environment node */
+import { describe, expect, it } from 'vitest'
+
+// Test the aggregateEvents function by importing and testing the module logic
+// Since aggregateEvents is not exported, we test the behavior indirectly through
+// the event processing contract
+
+describe('skill stat events - comment delta handling', () => {
+  it('aggregates comment and uncomment events into net deltas', () => {
+    // Simulate the aggregation logic from processSkillStatEventsAction
+    type EventKind =
+      | 'download'
+      | 'star'
+      | 'unstar'
+      | 'comment'
+      | 'uncomment'
+      | 'install_new'
+      | 'install_reactivate'
+      | 'install_deactivate'
+      | 'install_clear'
+
+    const events: { kind: EventKind; occurredAt: number }[] = [
+      { kind: 'star', occurredAt: 1000 },
+      { kind: 'comment', occurredAt: 2000 },
+      { kind: 'comment', occurredAt: 3000 },
+      { kind: 'uncomment', occurredAt: 4000 },
+      { kind: 'download', occurredAt: 5000 },
+    ]
+
+    // Replicate the aggregation logic
+    const result = {
+      downloads: 0,
+      stars: 0,
+      comments: 0,
+      installsAllTime: 0,
+      installsCurrent: 0,
+      downloadEvents: [] as number[],
+      installNewEvents: [] as number[],
+    }
+
+    for (const event of events) {
+      switch (event.kind) {
+        case 'download':
+          result.downloads += 1
+          result.downloadEvents.push(event.occurredAt)
+          break
+        case 'star':
+          result.stars += 1
+          break
+        case 'unstar':
+          result.stars -= 1
+          break
+        case 'comment':
+          result.comments += 1
+          break
+        case 'uncomment':
+          result.comments -= 1
+          break
+        case 'install_new':
+          result.installsAllTime += 1
+          result.installsCurrent += 1
+          result.installNewEvents.push(event.occurredAt)
+          break
+        case 'install_reactivate':
+          result.installsCurrent += 1
+          break
+        case 'install_deactivate':
+          result.installsCurrent -= 1
+          break
+      }
+    }
+
+    expect(result.stars).toBe(1)
+    expect(result.comments).toBe(1) // 2 comments - 1 uncomment
+    expect(result.downloads).toBe(1)
+    expect(result.downloadEvents).toEqual([5000])
+  })
+
+  it('should include comments in delta check (regression test for dropped comments)', () => {
+    // This test verifies the fix: the condition guard in applyAggregatedStatsAndUpdateCursor
+    // must include comments !== 0 so comment-only batches are not skipped
+    const delta = {
+      downloads: 0,
+      stars: 0,
+      comments: 3,
+      installsAllTime: 0,
+      installsCurrent: 0,
+    }
+
+    // The OLD buggy condition (missing comments):
+    const oldCondition =
+      delta.downloads !== 0 ||
+      delta.stars !== 0 ||
+      delta.installsAllTime !== 0 ||
+      delta.installsCurrent !== 0
+
+    // The FIXED condition (includes comments):
+    const fixedCondition =
+      delta.downloads !== 0 ||
+      delta.stars !== 0 ||
+      delta.comments !== 0 ||
+      delta.installsAllTime !== 0 ||
+      delta.installsCurrent !== 0
+
+    // With only comment deltas, the old condition would skip the patch
+    expect(oldCondition).toBe(false)
+    // The fixed condition correctly triggers the patch
+    expect(fixedCondition).toBe(true)
+  })
+})

convex/skillStatEvents.ts

@@ -35,6 +35,8 @@ export type StatEventKind =
   | 'download'
   | 'star'
   | 'unstar'
+  | 'comment'
+  | 'uncomment'
   | 'install_new'
   | 'install_reactivate'
   | 'install_deactivate'
@@ -86,6 +88,7 @@ export async function insertStatEvent(
 type AggregatedDeltas = {
   downloads: number
   stars: number
+  comments: number
   installsAllTime: number
   installsCurrent: number
   /** Original timestamps for each download event (for daily stats bucketing) */
@@ -117,6 +120,7 @@ function aggregateEvents(events: Doc<'skillStatEvents'>[]): AggregatedDeltas {
   const result: AggregatedDeltas = {
     downloads: 0,
     stars: 0,
+    comments: 0,
     installsAllTime: 0,
     installsCurrent: 0,
     downloadEvents: [],
@@ -135,6 +139,12 @@ function aggregateEvents(events: Doc<'skillStatEvents'>[]): AggregatedDeltas {
       case 'unstar':
         result.stars -= 1
         break
+      case 'comment':
+        result.comments += 1
+        break
+      case 'uncomment':
+        result.comments -= 1
+        break
       case 'install_new':
         // New user installing for the first time: count toward both lifetime and current
         result.installsAllTime += 1
@@ -231,12 +241,14 @@ export const processSkillStatEventsInternal = internalMutation({
       if (
         deltas.downloads !== 0 ||
         deltas.stars !== 0 ||
+        deltas.comments !== 0 ||
         deltas.installsAllTime !== 0 ||
         deltas.installsCurrent !== 0
       ) {
         const patch = applySkillStatDeltas(skill, {
           downloads: deltas.downloads,
           stars: deltas.stars,
+          comments: deltas.comments,
           installsAllTime: deltas.installsAllTime,
           installsCurrent: deltas.installsCurrent,
         })
@@ -285,7 +297,7 @@ export const processSkillStatEventsInternal = internalMutation({
 
 const CURSOR_KEY = 'skill_stat_events'
 const EVENT_BATCH_SIZE = 500
-const MAX_SKILLS_PER_RUN = 500
+const MAX_SKILLS_PER_RUN = 50
 
 /**
  * Fetch a batch of events after the given cursor (by _creationTime).
@@ -332,6 +344,7 @@ const skillDeltaValidator = v.object({
   skillId: v.id('skills'),
   downloads: v.number(),
   stars: v.number(),
+  comments: v.number(),
   installsAllTime: v.number(),
   installsCurrent: v.number(),
   downloadEvents: v.array(v.number()),
@@ -366,12 +379,14 @@ export const applyAggregatedStatsAndUpdateCursor = internalMutation({
       if (
         delta.downloads !== 0 ||
         delta.stars !== 0 ||
+        delta.comments !== 0 ||
         delta.installsAllTime !== 0 ||
         delta.installsCurrent !== 0
       ) {
         const patch = applySkillStatDeltas(skill, {
           downloads: delta.downloads,
           stars: delta.stars,
+          comments: delta.comments,
           installsAllTime: delta.installsAllTime,
           installsCurrent: delta.installsCurrent,
         })
@@ -438,6 +453,7 @@ export const processSkillStatEventsAction = internalAction({
       {
         downloads: number
         stars: number
+        comments: number
         installsAllTime: number
         installsCurrent: number
         downloadEvents: number[]
@@ -471,6 +487,7 @@ export const processSkillStatEventsAction = internalAction({
           skillDelta = {
             downloads: 0,
             stars: 0,
+            comments: 0,
             installsAllTime: 0,
             installsCurrent: 0,
             downloadEvents: [],
@@ -491,6 +508,12 @@ export const processSkillStatEventsAction = internalAction({
           case 'unstar':
             skillDelta.stars -= 1
             break
+          case 'comment':
+            skillDelta.comments += 1
+            break
+          case 'uncomment':
+            skillDelta.comments -= 1
+            break
           case 'install_new':
             skillDelta.installsAllTime += 1
             skillDelta.installsCurrent += 1

convex/statsMaintenance.ts

@@ -200,6 +200,102 @@ function buildSkillStatPatch(skill: Doc<'skills'>) {
   }
 }
 
+/**
+ * Reconcile skill stats by counting actual records in source-of-truth tables.
+ *
+ * This fixes stats that got out of sync due to missed events, cursor issues,
+ * or bugs in the event processing pipeline. It counts:
+ * - stars: actual records in the `stars` table for each skill
+ * - comments: actual records in the `comments` table for each skill
+ *
+ * Downloads and installs are event-sourced only (no separate table to count from),
+ * so they cannot be reconciled this way.
+ */
+export const reconcileSkillStarCounts = internalMutation({
+  args: {
+    cursor: v.optional(v.string()),
+    batchSize: v.optional(v.number()),
+  },
+  handler: async (ctx, args) => {
+    const batchSize = clampInt(args.batchSize ?? 50, 1, 200)
+    const now = Date.now()
+
+    const { page, isDone, continueCursor } = await ctx.db
+      .query('skills')
+      .order('asc')
+      .paginate({ cursor: args.cursor ?? null, numItems: batchSize })
+
+    let patched = 0
+    for (const skill of page) {
+      // Count actual star records for this skill
+      const starRecords = await ctx.db
+        .query('stars')
+        .withIndex('by_skill_user', (q) => q.eq('skillId', skill._id))
+        .collect()
+      const actualStars = starRecords.length
+
+      // Count actual comment records for this skill
+      const commentRecords = await ctx.db
+        .query('comments')
+        .withIndex('by_skill', (q) => q.eq('skillId', skill._id))
+        .collect()
+      const actualComments = commentRecords.filter((c) => !c.softDeletedAt).length
+
+      // Check if stats are out of sync
+      if (skill.stats.stars !== actualStars || skill.stats.comments !== actualComments) {
+        const updatedStats = {
+          ...skill.stats,
+          stars: actualStars,
+          comments: actualComments,
+        }
+        await ctx.db.patch(skill._id, {
+          statsStars: actualStars,
+          stats: updatedStats,
+          updatedAt: now,
+        })
+        patched += 1
+      }
+    }
+
+    return {
+      scanned: page.length,
+      patched,
+      cursor: isDone ? null : continueCursor,
+      isDone,
+    }
+  },
+})
+
+export const runReconcileSkillStarCountsInternal = internalAction({
+  args: {
+    batchSize: v.optional(v.number()),
+    maxBatches: v.optional(v.number()),
+  },
+  handler: async (ctx, args) => {
+    const batchSize = clampInt(args.batchSize ?? 50, 1, 200)
+    const maxBatches = clampInt(args.maxBatches ?? 10, 1, 50)
+
+    let cursor: string | undefined
+    let totalScanned = 0
+    let totalPatched = 0
+
+    for (let i = 0; i < maxBatches; i++) {
+      const result = (await ctx.runMutation(internal.statsMaintenance.reconcileSkillStarCounts, {
+        cursor,
+        batchSize,
+      })) as { scanned: number; patched: number; cursor: string | null; isDone: boolean }
+
+      totalScanned += result.scanned
+      totalPatched += result.patched
+
+      if (result.isDone) break
+      cursor = result.cursor ?? undefined
+    }
+
+    return { scanned: totalScanned, patched: totalPatched }
+  },
+})
+
 function clampInt(value: number, min: number, max: number) {
   return Math.min(Math.max(value, min), max)
 }

convex/users.ts

@@ -1,9 +1,12 @@
 import { getAuthUserId } from '@convex-dev/auth/server'
 import { v } from 'convex/values'
 import { internal } from './_generated/api'
-import { internalQuery, mutation, query } from './_generated/server'
-import { assertAdmin, requireUser } from './lib/access'
+import type { Doc, Id } from './_generated/dataModel'
+import type { MutationCtx } from './_generated/server'
+import { internalMutation, internalQuery, mutation, query } from './_generated/server'
+import { assertAdmin, assertModerator, requireUser } from './lib/access'
 import { toPublicUser } from './lib/public'
+import { buildUserSearchResults } from './lib/userSearch'
 
 const DEFAULT_ROLE = 'user'
 const ADMIN_HANDLE = 'steipete'
@@ -18,6 +21,46 @@ export const getByIdInternal = internalQuery({
   handler: async (ctx, args) => ctx.db.get(args.userId),
 })
 
+export const searchInternal = internalQuery({
+  args: {
+    actorUserId: v.id('users'),
+    query: v.optional(v.string()),
+    limit: v.optional(v.number()),
+  },
+  handler: async (ctx, args) => {
+    const actor = await ctx.db.get(args.actorUserId)
+    if (!actor || actor.deletedAt) throw new Error('Unauthorized')
+    assertAdmin(actor)
+
+    const limit = Math.min(Math.max(args.limit ?? 20, 1), 200)
+    const users = await ctx.db.query('users').order('desc').collect()
+    const result = buildUserSearchResults(users, args.query)
+    const items = result.items.slice(0, limit).map((user) => ({
+      userId: user._id,
+      handle: user.handle ?? null,
+      displayName: user.displayName ?? null,
+      name: user.name ?? null,
+      role: user.role ?? null,
+    }))
+    return { items, total: result.total }
+  },
+})
+
+export const updateGithubMetaInternal = internalMutation({
+  args: {
+    userId: v.id('users'),
+    githubCreatedAt: v.number(),
+    githubFetchedAt: v.number(),
+  },
+  handler: async (ctx, args) => {
+    await ctx.db.patch(args.userId, {
+      githubCreatedAt: args.githubCreatedAt,
+      githubFetchedAt: args.githubFetchedAt,
+      updatedAt: args.githubFetchedAt,
+    })
+  },
+})
+
 export const me = query({
   args: {},
   handler: async (ctx) => {
@@ -33,19 +76,18 @@ export const ensure = mutation({
   args: {},
   handler: async (ctx) => {
     const { userId, user } = await requireUser(ctx)
-    const now = Date.now()
     const updates: Record<string, unknown> = {}
 
-    const handle = user.handle ?? user.name ?? user.email?.split('@')[0]
+    const handle = user.handle || user.name || user.email?.split('@')[0]
     if (!user.handle && handle) updates.handle = handle
     if (!user.displayName) updates.displayName = handle
     if (!user.role) {
       updates.role = handle === ADMIN_HANDLE ? 'admin' : DEFAULT_ROLE
     }
     if (!user.createdAt) updates.createdAt = user._creationTime
-    updates.updatedAt = now
 
     if (Object.keys(updates).length > 0) {
+      updates.updatedAt = Date.now()
       await ctx.db.patch(userId, updates)
     }
 
@@ -81,12 +123,15 @@ export const deleteAccount = mutation({
 })
 
 export const list = query({
-  args: { limit: v.optional(v.number()) },
+  args: { limit: v.optional(v.number()), search: v.optional(v.string()) },
   handler: async (ctx, args) => {
     const { user } = await requireUser(ctx)
     assertAdmin(user)
-    const limit = args.limit ?? 50
-    return ctx.db.query('users').order('desc').take(limit)
+    const limit = Math.min(Math.max(args.limit ?? 50, 1), 200)
+    const query = args.search?.trim().toLowerCase()
+    const users = await ctx.db.query('users').order('desc').collect()
+    const result = buildUserSearchResults(users, query)
+    return { items: result.items.slice(0, limit), total: result.total }
   },
 })
 
@@ -108,15 +153,208 @@ export const setRole = mutation({
   },
   handler: async (ctx, args) => {
     const { user } = await requireUser(ctx)
-    assertAdmin(user)
-    await ctx.db.patch(args.userId, { role: args.role, updatedAt: Date.now() })
+    return setRoleWithActor(ctx, user, args.userId, args.role)
+  },
+})
+
+export const setRoleInternal = internalMutation({
+  args: {
+    actorUserId: v.id('users'),
+    targetUserId: v.id('users'),
+    role: v.union(v.literal('admin'), v.literal('moderator'), v.literal('user')),
+  },
+  handler: async (ctx, args) => {
+    const actor = await ctx.db.get(args.actorUserId)
+    if (!actor || actor.deletedAt) throw new Error('User not found')
+    return setRoleWithActor(ctx, actor, args.targetUserId, args.role)
+  },
+})
+
+async function setRoleWithActor(
+  ctx: MutationCtx,
+  actor: Doc<'users'>,
+  targetUserId: Id<'users'>,
+  role: 'admin' | 'moderator' | 'user',
+) {
+  assertAdmin(actor)
+  const target = await ctx.db.get(targetUserId)
+  if (!target) throw new Error('User not found')
+  const now = Date.now()
+  await ctx.db.patch(targetUserId, { role, updatedAt: now })
+  await ctx.db.insert('auditLogs', {
+    actorUserId: actor._id,
+    action: 'role.change',
+    targetType: 'user',
+    targetId: targetUserId,
+    metadata: { role },
+    createdAt: now,
+  })
+  return { ok: true as const, role }
+}
+
+export const banUser = mutation({
+  args: { userId: v.id('users'), reason: v.optional(v.string()) },
+  handler: async (ctx, args) => {
+    const { user } = await requireUser(ctx)
+    return banUserWithActor(ctx, user, args.userId, args.reason)
+  },
+})
+
+export const banUserInternal = internalMutation({
+  args: {
+    actorUserId: v.id('users'),
+    targetUserId: v.id('users'),
+    reason: v.optional(v.string()),
+  },
+  handler: async (ctx, args) => {
+    const actor = await ctx.db.get(args.actorUserId)
+    if (!actor || actor.deletedAt) throw new Error('User not found')
+    return banUserWithActor(ctx, actor, args.targetUserId, args.reason)
+  },
+})
+
+async function banUserWithActor(
+  ctx: MutationCtx,
+  actor: Doc<'users'>,
+  targetUserId: Id<'users'>,
+  reasonRaw?: string,
+) {
+  assertModerator(actor)
+
+  if (targetUserId === actor._id) throw new Error('Cannot ban yourself')
+
+  const target = await ctx.db.get(targetUserId)
+  if (!target) throw new Error('User not found')
+  if (target.role === 'admin' && actor.role !== 'admin') {
+    throw new Error('Forbidden')
+  }
+
+  const now = Date.now()
+  const reason = reasonRaw?.trim()
+  if (reason && reason.length > 500) {
+    throw new Error('Reason too long (max 500 chars)')
+  }
+  if (target.deletedAt) {
+    return { ok: true as const, alreadyBanned: true, deletedSkills: 0 }
+  }
+
+  const skills = await ctx.db
+    .query('skills')
+    .withIndex('by_owner', (q) => q.eq('ownerUserId', targetUserId))
+    .collect()
+
+  for (const skill of skills) {
+    await ctx.scheduler.runAfter(0, internal.skills.hardDeleteInternal, {
+      skillId: skill._id,
+      actorUserId: actor._id,
+    })
+  }
+
+  const tokens = await ctx.db
+    .query('apiTokens')
+    .withIndex('by_user', (q) => q.eq('userId', targetUserId))
+    .collect()
+  for (const token of tokens) {
+    await ctx.db.patch(token._id, { revokedAt: now })
+  }
+
+  await ctx.db.patch(targetUserId, {
+    deletedAt: now,
+    role: 'user',
+    updatedAt: now,
+    banReason: reason || undefined,
+  })
+
+  await ctx.runMutation(internal.telemetry.clearUserTelemetryInternal, { userId: targetUserId })
+
+  await ctx.db.insert('auditLogs', {
+    actorUserId: actor._id,
+    action: 'user.ban',
+    targetType: 'user',
+    targetId: targetUserId,
+    metadata: { deletedSkills: skills.length, reason: reason || undefined },
+    createdAt: now,
+  })
+
+  return { ok: true as const, alreadyBanned: false, deletedSkills: skills.length }
+}
+
+/**
+ * Auto-ban a user whose skill was flagged malicious by VT.
+ * Skips moderators/admins. No actor required — this is a system-level action.
+ */
+export const autobanMalwareAuthorInternal = internalMutation({
+  args: {
+    ownerUserId: v.id('users'),
+    sha256hash: v.string(),
+    slug: v.string(),
+  },
+  handler: async (ctx, args) => {
+    const target = await ctx.db.get(args.ownerUserId)
+    if (!target) return { ok: false, reason: 'user_not_found' }
+    if (target.deletedAt) return { ok: true, alreadyBanned: true }
+
+    // Never auto-ban moderators or admins
+    if (target.role === 'admin' || target.role === 'moderator') {
+      console.log(`[autoban] Skipping ${target.handle ?? args.ownerUserId}: role=${target.role}`)
+      return { ok: false, reason: 'protected_role' }
+    }
+
+    const now = Date.now()
+
+    // Soft-delete all their skills
+    const skills = await ctx.db
+      .query('skills')
+      .withIndex('by_owner', (q) => q.eq('ownerUserId', args.ownerUserId))
+      .collect()
+
+    for (const skill of skills) {
+      if (!skill.softDeletedAt) {
+        await ctx.db.patch(skill._id, { softDeletedAt: now, updatedAt: now })
+      }
+    }
+
+    // Revoke all API tokens
+    const tokens = await ctx.db
+      .query('apiTokens')
+      .withIndex('by_user', (q) => q.eq('userId', args.ownerUserId))
+      .collect()
+    for (const token of tokens) {
+      if (!token.revokedAt) {
+        await ctx.db.patch(token._id, { revokedAt: now })
+      }
+    }
+
+    // Ban the user
+    await ctx.db.patch(args.ownerUserId, {
+      deletedAt: now,
+      role: 'user',
+      updatedAt: now,
+    })
+
+    await ctx.runMutation(internal.telemetry.clearUserTelemetryInternal, {
+      userId: args.ownerUserId,
+    })
+
+    // Audit log — use the target as actor since there's no human actor
     await ctx.db.insert('auditLogs', {
-      actorUserId: user._id,
-      action: 'role.change',
+      actorUserId: args.ownerUserId,
+      action: 'user.autoban.malware',
       targetType: 'user',
-      targetId: args.userId,
-      metadata: { role: args.role },
-      createdAt: Date.now(),
+      targetId: args.ownerUserId,
+      metadata: {
+        trigger: 'vt.malicious',
+        sha256hash: args.sha256hash,
+        slug: args.slug,
+        deletedSkills: skills.length,
+      },
+      createdAt: now,
     })
+
+    console.warn(
+      `[autoban] Banned ${target.handle ?? args.ownerUserId} — malicious skill: ${args.slug}`,
+    )
+
+    return { ok: true, alreadyBanned: false, deletedSkills: skills.length }
   },
 })

docs/README.md

@@ -22,7 +22,8 @@ Reading order (new contributor):
 Feature/ops docs (already present):
 
 - `docs/spec.md`: product + implementation spec (data model + flows).
-- `docs/telemetry.md`: what `clawdhub sync` reports; opt-out.
+- `docs/security.md`: moderation, reporting, bans, upload gating.
+- `docs/telemetry.md`: what `clawhub sync` reports; opt-out.
 - `docs/webhook.md`: Discord webhook events/payload.
 - `docs/diffing.md`: version-to-version diff UI spec.
 - `docs/manual-testing.md`: CLI smoke scripts.

docs/api.md

@@ -7,7 +7,7 @@ read_when:
 
 # API v1
 
-Base: `https://clawdhub.com`
+Base: `https://clawhub.ai`
 
 OpenAPI: `/api/v1/openapi.json`
 

docs/architecture.md

@@ -11,8 +11,8 @@ read_when:
 
 - Web app: TanStack Start (React) under `src/`.
 - Backend: Convex under `convex/` (DB, storage, actions, HTTP routes).
-- CLI: `packages/clawdhub/` (published as `clawdhub`).
-- Shared schemas/routes: `packages/schema/` (`clawdhub-schema`).
+- CLI: `packages/clawdhub/` (published as `clawhub`, legacy `clawdhub`).
+- Shared schemas/routes: `packages/schema/` (`clawhub-schema`).
 
 ## Data + storage
 
@@ -38,8 +38,8 @@ read_when:
 - Download zip via `/api/v1/download?slug=...&version=...`.
 - Extract into `./skills/<slug>` (default).
 - Persist install state:
-  - `./.clawdhub/lock.json` (per workdir)
-  - `./skills/<slug>/.clawdhub/origin.json` (per skill folder)
+  - `./.clawhub/lock.json` (per workdir, legacy `.clawdhub`)
+  - `./skills/<slug>/.clawhub/origin.json` (per skill folder, legacy `.clawdhub`)
 
 ### Update (CLI)
 

docs/auth.md

@@ -23,7 +23,7 @@ The CLI uses a long-lived API token (Bearer token) for publish/sync/delete.
 
 ### Browser flow (default)
 
-`clawdhub login` does:
+`clawhub login` does:
 
 1. Starts a loopback HTTP server on `127.0.0.1` (random port).
 2. Opens `<site>/cli/auth?redirect_uri=http://127.0.0.1:<port>/callback&state=...`.
@@ -35,18 +35,18 @@ The CLI uses a long-lived API token (Bearer token) for publish/sync/delete.
 Create a token in the web UI (Settings → API tokens) and paste it:
 
 ```bash
-clawdhub login --token clh_...
+clawhub login --token clh_...
 ```
 
 ### Token storage
 
 Default global config path:
 
-- macOS: `~/Library/Application Support/clawdhub/config.json`
+- macOS: `~/Library/Application Support/clawhub/config.json`
 
 Override:
 
-- `CLAWDHUB_CONFIG_PATH=/path/to/config.json`
+- `CLAWHUB_CONFIG_PATH=/path/to/config.json` (legacy `CLAWDHUB_CONFIG_PATH`)
 
 ### Revocation
 

docs/cli.md

@@ -7,41 +7,41 @@ read_when:
 
 # CLI
 
-CLI package: `packages/clawdhub/` (bin: `clawdhub`).
+CLI package: `packages/clawdhub/` (published as `clawhub`, bin: `clawhub`).
 
 From this repo you can run it via the wrapper script:
 
 ```bash
-bun clawdhub --help
+bun clawhub --help
 ```
 
 ## Global flags
 
 - `--workdir <dir>`: working directory (default: cwd; falls back to Clawdbot workspace if configured)
 - `--dir <dir>`: install dir under workdir (default: `skills`)
-- `--site <url>`: base URL for browser login (default: `https://clawdhub.com`)
-- `--registry <url>`: API base URL (default: discovered, else `https://clawdhub.com`)
+- `--site <url>`: base URL for browser login (default: `https://clawhub.ai`)
+- `--registry <url>`: API base URL (default: discovered, else `https://clawhub.ai`)
 - `--no-input`: disable prompts
 
 Env equivalents:
 
-- `CLAWDHUB_SITE`
-- `CLAWDHUB_REGISTRY`
-- `CLAWDHUB_WORKDIR`
+- `CLAWHUB_SITE` (legacy `CLAWDHUB_SITE`)
+- `CLAWHUB_REGISTRY` (legacy `CLAWDHUB_REGISTRY`)
+- `CLAWHUB_WORKDIR` (legacy `CLAWDHUB_WORKDIR`)
 
 ## Config file
 
 Stores your API token + cached registry URL.
 
-- macOS: `~/Library/Application Support/clawdhub/config.json`
-- override: `CLAWDHUB_CONFIG_PATH`
+- macOS: `~/Library/Application Support/clawhub/config.json`
+- override: `CLAWHUB_CONFIG_PATH` (legacy `CLAWDHUB_CONFIG_PATH`)
 
 ## Commands
 
 ### `login` / `auth login`
 
 - Default: opens browser to `<site>/cli/auth` and completes via loopback callback.
-- Headless: `clawdhub login --token clh_...`
+- Headless: `clawhub login --token clh_...`
 
 ### `whoami`
 
@@ -61,23 +61,34 @@ Stores your API token + cached registry URL.
 
 - Lists latest updated skills via `/api/v1/skills?limit=...` (sorted by `updatedAt` desc).
 - Flags:
-  - `--limit <n>` (1–200, default: 25)
+- `--limit <n>` (1-200, default: 25)
   - `--sort newest|downloads|rating|installs|installsAllTime|trending` (default: newest)
   - `--json` (machine-readable output)
 - Output: `<slug>  v<version>  <age>  <summary>` (summary truncated to 50 chars).
 
+### `inspect <slug>`
+
+- Fetches skill metadata and version files without installing.
+- `--version <version>`: inspect a specific version (default: latest).
+- `--tag <tag>`: inspect a tagged version (e.g. `latest`).
+- `--versions`: list version history (first page).
+- `--limit <n>`: max versions to list (1-200).
+- `--files`: list files for the selected version.
+- `--file <path>`: fetch raw file content (text files only; 200KB limit).
+- `--json`: machine-readable output.
+
 ### `install <slug>`
 
 - Resolves latest version via `/api/v1/skills/<slug>`.
 - Downloads zip via `/api/v1/download`.
 - Extracts into `<workdir>/<dir>/<slug>`.
 - Writes:
-  - `<workdir>/.clawdhub/lock.json`
-  - `<skill>/.clawdhub/origin.json`
+  - `<workdir>/.clawhub/lock.json` (legacy `.clawdhub`)
+  - `<skill>/.clawhub/origin.json` (legacy `.clawdhub`)
 
 ### `list`
 
-- Reads `<workdir>/.clawdhub/lock.json`.
+- Reads `<workdir>/.clawhub/lock.json` (legacy `.clawdhub`).
 
 ### `update [slug]` / `update --all`
 
@@ -92,6 +103,45 @@ Stores your API token + cached registry URL.
 - Publishes via `POST /api/v1/skills` (multipart).
 - Requires semver: `--version 1.2.3`.
 
+### `delete <slug>`
+
+- Soft-delete a skill (moderator/admin only).
+- Calls `DELETE /api/v1/skills/{slug}`.
+- `--yes` skips confirmation.
+
+### `undelete <slug>`
+
+- Restore a hidden skill (moderator/admin only).
+- Calls `POST /api/v1/skills/{slug}/undelete`.
+- `--yes` skips confirmation.
+
+### `hide <slug>`
+
+- Hide a skill (moderator/admin only).
+- Alias for `delete`.
+
+### `unhide <slug>`
+
+- Unhide a skill (moderator/admin only).
+- Alias for `undelete`.
+
+### `ban-user <handleOrId>`
+
+- Ban a user and delete owned skills (moderator/admin only).
+- Calls `POST /api/v1/users/ban`.
+- `--id` treats the argument as a user id instead of a handle.
+- `--fuzzy` resolves the handle via fuzzy user search (admin only).
+- `--reason` records an optional ban reason.
+- `--yes` skips confirmation.
+
+### `set-role <handleOrId> <role>`
+
+- Change a user role (admin only).
+- Calls `POST /api/v1/users/role`.
+- `--id` treats the argument as a user id instead of a handle.
+- `--fuzzy` resolves the handle via fuzzy user search (admin only).
+- `--yes` skips confirmation.
+
 ### `sync`
 
 - Scans for local skill folders and publishes new/changed ones.
@@ -101,7 +151,7 @@ Stores your API token + cached registry URL.
   - `routing.agents.*.workspace/skills` (per-agent)
   - `~/.clawdbot/skills` (shared)
   - `skills.load.extraDirs` (shared packs)
-- Respects `CLAWDBOT_CONFIG_PATH` and `CLAWDBOT_STATE_DIR`.
+- Respects `CLAWDBOT_CONFIG_PATH` / `CLAWDBOT_STATE_DIR` and `OPENCLAW_CONFIG_PATH` / `OPENCLAW_STATE_DIR`.
 - Flags:
   - `--root <dir...>` extra scan roots
   - `--all` upload without prompting
@@ -113,5 +163,5 @@ Stores your API token + cached registry URL.
 
 Telemetry:
 
-- Sent during `sync` when logged in, unless `CLAWDHUB_DISABLE_TELEMETRY=1`.
+- Sent during `sync` when logged in, unless `CLAWHUB_DISABLE_TELEMETRY=1` (legacy `CLAWDHUB_DISABLE_TELEMETRY=1`).
 - Details: `docs/telemetry.md`.

docs/deploy.md

@@ -7,7 +7,7 @@ read_when:
 
 # Deploy
 
-ClawdHub is two deployables:
+ClawHub is two deployables:
 
 - Web app (TanStack Start) → typically Vercel.
 - Convex backend → Convex deployment (serves `/api/...` routes).
@@ -30,6 +30,7 @@ Ensure Convex env is set (auth + embeddings):
 - `OPENAI_API_KEY`
 - `SITE_URL` (your web app URL)
 - Optional webhook env (see `docs/webhook.md`)
+- Optional: `GITHUB_TOKEN` (recommended; raises GitHub account lookup limit used by publish gate)
 
 ## 2) Deploy web app (Vercel)
 
@@ -55,12 +56,13 @@ For self-host:
 
 The CLI can discover the API base from:
 
-- `/.well-known/clawdhub.json`
+- `/.well-known/clawhub.json` (preferred)
+- `/.well-known/clawdhub.json` (legacy)
 
 If you don’t serve that file, users must set:
 
 ```bash
-export CLAWDHUB_REGISTRY=https://your-site.example
+export CLAWHUB_REGISTRY=https://your-site.example
 ```
 
 ## 5) Post-deploy checks
@@ -73,6 +75,6 @@ curl -i "https://<site>/api/v1/skills/gifgrep"
 Then:
 
 ```bash
-clawdhub login --site https://<site>
-clawdhub whoami
+clawhub login --site https://<site>
+clawhub whoami
 ```

docs/diffing.md

@@ -10,7 +10,7 @@ read_when:
 ## Goals
 - Compare any file between two versions.
 - Default compare: `latest` vs `previous` (SemVer precedence).
-- UX feels native to ClawdHub (theme + typography + motion).
+- UX feels native to ClawHub (theme + typography + motion).
 - Inline or side-by-side toggle.
 - Public access.
 
@@ -57,7 +57,7 @@ Optional helper action:
    - Feed into Monaco diff editor.
 
 ## Monaco theming
-- Define `clawdhub-light` / `clawdhub-dark` via `monaco.editor.defineTheme`.
+- Define `clawhub-light` / `clawhub-dark` via `monaco.editor.defineTheme`.
 - Derive colors from CSS variables on `document.documentElement`:
   - `--surface`, `--surface-muted`, `--ink`, `--ink-soft`, `--line`, `--accent`.
 - Apply theme on load + when theme changes (`data-theme`).

docs/http-api.md

@@ -7,7 +7,7 @@ read_when:
 
 # HTTP API
 
-Base URL: `https://clawdhub.com` (default).
+Base URL: `https://clawhub.ai` (default).
 
 All v1 paths are under `/api/v1/...` and implemented by Convex HTTP routes (`convex/http.ts`).
 Legacy `/api/...` and `/api/cli/...` remain for compatibility (see `DEPRECATIONS.md`).
@@ -40,6 +40,10 @@ Response:
 { "results": [{ "score": 0.123, "slug": "gifgrep", "displayName": "GifGrep", "summary": "…", "version": "1.2.3", "updatedAt": 1730000000000 }] }
 ```
 
+Notes:
+
+- Results are returned in relevance order (embedding similarity + exact slug/name token boosts + popularity prior from downloads).
+
 ### `GET /api/v1/skills`
 
 Query params:
@@ -143,7 +147,78 @@ Publishes a new version.
 
 ### `DELETE /api/v1/skills/{slug}` / `POST /api/v1/skills/{slug}/undelete`
 
-Soft-delete / restore a skill (owner/admin only).
+Soft-delete / restore a skill (moderator/admin only).
+
+### `POST /api/v1/users/ban`
+
+Ban a user and hard-delete owned skills (moderator/admin only).
+
+Body:
+
+```json
+{ "handle": "user_handle", "reason": "optional ban reason" }
+```
+
+or
+
+```json
+{ "userId": "users_...", "reason": "optional ban reason" }
+```
+
+Response:
+
+```json
+{ "ok": true, "alreadyBanned": false, "deletedSkills": 3 }
+```
+
+### `POST /api/v1/users/role`
+
+Change a user role (admin only).
+
+Body:
+
+```json
+{ "handle": "user_handle", "role": "moderator" }
+```
+
+or
+
+```json
+{ "userId": "users_...", "role": "admin" }
+```
+
+Response:
+
+```json
+{ "ok": true, "role": "moderator" }
+```
+
+### `GET /api/v1/users`
+
+List or search users (admin only).
+
+Query params:
+
+- `q` (optional): search query
+- `query` (optional): alias for `q`
+- `limit` (optional): max results (default 20, max 200)
+
+Response:
+
+```json
+{
+  "items": [
+    {
+      "userId": "users_...",
+      "handle": "user_handle",
+      "displayName": "User",
+      "name": "User",
+      "role": "moderator"
+    }
+  ],
+  "total": 1
+}
+```
 
 ### `POST /api/v1/stars/{slug}` / `DELETE /api/v1/stars/{slug}`
 
@@ -172,16 +247,17 @@ Still supported for older CLI versions:
 
 See `DEPRECATIONS.md` for removal plan.
 
-## Registry discovery (`/.well-known/clawdhub.json`)
+## Registry discovery (`/.well-known/clawhub.json`)
 
 The CLI can discover registry/auth settings from the site:
 
-- `/.well-known/clawdhub.json` (JSON)
+- `/.well-known/clawhub.json` (JSON, preferred)
+- `/.well-known/clawdhub.json` (legacy)
 
 Schema:
 
 ```json
-{ "apiBase": "https://clawdhub.com", "authBase": "https://clawdhub.com", "minCliVersion": "0.0.5" }
+{ "apiBase": "https://clawhub.ai", "authBase": "https://clawhub.ai", "minCliVersion": "0.0.5" }
 ```
 
-If you self-host, serve this file (or set `CLAWDHUB_REGISTRY` explicitly).
+If you self-host, serve this file (or set `CLAWHUB_REGISTRY` explicitly; legacy `CLAWDHUB_REGISTRY`).

docs/manual-testing.md

@@ -8,53 +8,53 @@ read_when:
 # Manual testing (CLI)
 
 ## Setup
-- Ensure logged in: `bun clawdhub whoami` (or `bun clawdhub login`).
+- Ensure logged in: `bun clawhub whoami` (or `bun clawhub login`).
 - Optional: set env
-  - `CLAWDHUB_SITE=https://clawdhub.com`
-  - `CLAWDHUB_REGISTRY=https://clawdhub.com`
+  - `CLAWHUB_SITE=https://clawhub.ai`
+  - `CLAWHUB_REGISTRY=https://clawhub.ai`
 
 ## Smoke
-- `bun clawdhub --help`
-- `bun clawdhub --cli-version`
-- `bun clawdhub whoami`
+- `bun clawhub --help`
+- `bun clawhub --cli-version`
+- `bun clawhub whoami`
 
 ## Search
-- `bun clawdhub search gif --limit 5`
+- `bun clawhub search gif --limit 5`
 
 ## Install / list / update
-- `mkdir -p /tmp/clawdhub-manual && cd /tmp/clawdhub-manual`
-- `bunx clawdhub@beta install gifgrep --force`
-- `bunx clawdhub@beta list`
-- `bunx clawdhub@beta update gifgrep --force`
+- `mkdir -p /tmp/clawhub-manual && cd /tmp/clawhub-manual`
+- `bunx clawhub@beta install gifgrep --force`
+- `bunx clawhub@beta list`
+- `bunx clawhub@beta update gifgrep --force`
 
 ## Publish (changelog optional)
-- `mkdir -p /tmp/clawdhub-skill-demo/SKILL && cd /tmp/clawdhub-skill-demo`
+- `mkdir -p /tmp/clawhub-skill-demo/SKILL && cd /tmp/clawhub-skill-demo`
 - Create files:
   - `SKILL.md`
   - `notes.md`
 - Publish:
-  - `bun clawdhub publish . --slug clawdhub-manual-<ts> --name "Manual <ts>" --version 1.0.0 --tags latest`
+  - `bun clawhub publish . --slug clawhub-manual-<ts> --name "Manual <ts>" --version 1.0.0 --tags latest`
 - Publish update with empty changelog:
-  - `bun clawdhub publish . --slug clawdhub-manual-<ts> --name "Manual <ts>" --version 1.0.1 --tags latest`
+  - `bun clawhub publish . --slug clawhub-manual-<ts> --name "Manual <ts>" --version 1.0.1 --tags latest`
 
 ## Delete / undelete (owner/admin)
-- `bun clawdhub delete clawdhub-manual-<ts> --yes`
+- `bun clawhub delete clawhub-manual-<ts> --yes`
 - Verify hidden:
-- `curl -i "https://clawdhub.com/api/v1/skills/clawdhub-manual-<ts>"`
+- `curl -i "https://clawhub.ai/api/v1/skills/clawhub-manual-<ts>"`
 - Restore:
-  - `bun clawdhub undelete clawdhub-manual-<ts> --yes`
+  - `bun clawhub undelete clawhub-manual-<ts> --yes`
 - Cleanup:
-  - `bun clawdhub delete clawdhub-manual-<ts> --yes`
+  - `bun clawhub delete clawhub-manual-<ts> --yes`
 
 ## Sync
-- `bun clawdhub sync --dry-run --all`
+- `bun clawhub sync --dry-run --all`
 
 ## Playwright (menu smoke)
 
 Run against prod:
 
 ```
-PLAYWRIGHT_BASE_URL=https://clawdhub.com bun run test:pw
+PLAYWRIGHT_BASE_URL=https://clawhub.ai bun run test:pw
 ```
 
 Run against a local preview server:

docs/mintlify.md

@@ -20,7 +20,7 @@ Example (starter):
 
 ```json
 {
-  "name": "ClawdHub",
+  "name": "ClawHub",
   "logo": "public/logo.svg",
   "navigation": [
     { "group": "Start", "pages": ["docs/README", "docs/quickstart"] },

docs/quickstart.md

@@ -51,29 +51,29 @@ Then paste the printed `JWT_PRIVATE_KEY` + `JWKS` into `.env.local` (and ensure
 From this repo:
 
 ```bash
-bun clawdhub --help
-bun clawdhub login
-bun clawdhub whoami
-bun clawdhub search gif --limit 5
+bun clawhub --help
+bun clawhub login
+bun clawhub whoami
+bun clawhub search gif --limit 5
 ```
 
 Install a skill into `./skills/<slug>` (if Clawdbot is configured, installs into that workspace instead):
 
 ```bash
-bun clawdhub install <slug>
-bun clawdhub list
+bun clawhub install <slug>
+bun clawhub list
 ```
 
 You can also install into any folder:
 
 ```bash
-bun clawdhub install <slug> --workdir /tmp/clawdhub-demo --dir skills
+bun clawhub install <slug> --workdir /tmp/clawhub-demo --dir skills
 ```
 
 Update:
 
 ```bash
-bun clawdhub update --all
+bun clawhub update --all
 ```
 
 ## 4) Publish a skill
@@ -81,7 +81,7 @@ bun clawdhub update --all
 Create a folder containing `SKILL.md` (required) plus any supporting text files:
 
 ```bash
-mkdir -p /tmp/clawdhub-skill-demo && cd /tmp/clawdhub-skill-demo
+mkdir -p /tmp/clawhub-skill-demo && cd /tmp/clawhub-skill-demo
 cat > SKILL.md <<'EOF'
 ---
 name: Demo Skill
@@ -97,8 +97,8 @@ EOF
 Publish:
 
 ```bash
-bun clawdhub publish . \
-  --slug clawdhub-demo-$(date +%s) \
+bun clawhub publish . \
+  --slug clawhub-demo-$(date +%s) \
   --name "Demo $(date +%s)" \
   --version 1.0.0 \
   --tags latest \
@@ -110,11 +110,11 @@ bun clawdhub publish . \
 `sync` scans for local skill folders and publishes the ones that aren’t “synced” yet.
 
 ```bash
-bun clawdhub sync
+bun clawhub sync
 ```
 
 Dry run + non-interactive:
 
 ```bash
-bun clawdhub sync --all --dry-run --no-input
+bun clawhub sync --all --dry-run --no-input
 ```

docs/security.md

@@ -0,0 +1,55 @@
+---
+summary: 'Security + moderation controls (reports, bans, upload gating).'
+read_when:
+  - Working on moderation or abuse controls
+  - Reviewing upload restrictions
+  - Troubleshooting hidden/removed skills
+---
+
+# Security + Moderation
+
+## Roles + permissions
+
+- user: upload skills/souls (subject to GitHub age gate), report skills.
+- moderator: hide/restore skills, view hidden skills, unhide, soft-delete, ban users (except admins).
+- admin: all moderator actions + hard delete skills, change owners, change roles.
+
+## Reporting + auto-hide
+
+- Reports are unique per user + skill.
+- Report reason required (trimmed, max 500 chars). Abuse of reporting may result in account bans.
+- Per-user cap: 20 **active** reports.
+  - Active = skill exists, not soft-deleted, not `moderationStatus = removed`,
+    and the owner is not banned.
+- Auto-hide: when unique reports exceed 3 (4th report), the skill is:
+  - soft-deleted (`softDeletedAt`)
+  - `moderationStatus = hidden`
+  - `moderationReason = auto.reports`
+  - embeddings visibility set to `deleted`
+  - audit log entry: `skill.auto_hide`
+- Public queries hide non-active moderation statuses; staff can still access via
+  staff-only queries and unhide/restore/delete/ban.
+
+## Bans
+
+- Banning a user:
+  - hard-deletes all owned skills
+  - revokes API tokens
+  - sets `deletedAt` on the user
+- Optional ban reason is stored in `users.banReason` and audit logs.
+- Moderators cannot ban admins; nobody can ban themselves.
+- Report counters effectively reset because deleted/banned skills are no longer
+  considered active in the per-user report cap.
+
+## Upload gate (GitHub account age)
+
+- Skill + soul publish actions require GitHub account age ≥ 7 days.
+- Lookup uses GitHub `created_at` and caches on the user:
+  - `githubCreatedAt` (source of truth)
+  - `githubFetchedAt` (fetch timestamp)
+- Cache TTL: 24 hours.
+- Gate applies to web uploads, CLI publish, and GitHub import.
+- If GitHub responds `403` or `429`, publish fails with:
+  - `GitHub API rate limit exceeded — please try again in a few minutes`
+- To reduce rate-limit failures, set `GITHUB_TOKEN` in Convex env for authenticated
+  GitHub API requests.

docs/skill-format.md

@@ -18,16 +18,16 @@ Required:
 Optional:
 
 - any supporting *text-based* files (see “Allowed files”)
-- `.clawdhubignore` (ignore patterns for publish/sync)
+- `.clawhubignore` (ignore patterns for publish/sync, legacy `.clawdhubignore`)
 - `.gitignore` (also honored)
 
 Local install metadata (written by the CLI):
 
-- `<skill>/.clawdhub/origin.json`
+- `<skill>/.clawhub/origin.json` (legacy `.clawdhub`)
 
 Workdir install state (written by the CLI):
 
-- `<workdir>/.clawdhub/lock.json`
+- `<workdir>/.clawhub/lock.json` (legacy `.clawdhub`)
 
 ## `SKILL.md`
 
@@ -35,6 +35,99 @@ Workdir install state (written by the CLI):
 - The server extracts metadata from frontmatter during publish.
 - `description` is used as the skill summary in the UI/search.
 
+## Frontmatter metadata
+
+Skill metadata is declared in the YAML frontmatter at the top of your `SKILL.md`. This tells the registry (and security analysis) what your skill needs to run.
+
+### Basic frontmatter
+
+```yaml
+---
+name: my-skill
+description: Short summary of what this skill does.
+version: 1.0.0
+---
+```
+
+### Runtime metadata (`metadata.openclaw`)
+
+Declare your skill's runtime requirements under `metadata.openclaw` (aliases: `metadata.clawdbot`, `metadata.clawdis`).
+
+```yaml
+---
+name: my-skill
+description: Manage tasks via the Todoist API.
+metadata:
+  openclaw:
+    requires:
+      env:
+        - TODOIST_API_KEY
+      bins:
+        - curl
+    primaryEnv: TODOIST_API_KEY
+---
+```
+
+### Full field reference
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `requires.env` | `string[]` | Environment variables your skill expects. |
+| `requires.bins` | `string[]` | CLI binaries that must all be installed. |
+| `requires.anyBins` | `string[]` | CLI binaries where at least one must exist. |
+| `requires.config` | `string[]` | Config file paths your skill reads. |
+| `primaryEnv` | `string` | The main credential env var for your skill. |
+| `always` | `boolean` | If `true`, skill is always active (no explicit install needed). |
+| `skillKey` | `string` | Override the skill's invocation key. |
+| `emoji` | `string` | Display emoji for the skill. |
+| `homepage` | `string` | URL to the skill's homepage or docs. |
+| `os` | `string[]` | OS restrictions (e.g. `["macos"]`, `["linux"]`). |
+| `install` | `array` | Install specs for dependencies (see below). |
+| `nix` | `object` | Nix plugin spec (see README). |
+| `config` | `object` | Clawdbot config spec (see README). |
+
+### Install specs
+
+If your skill needs dependencies installed, declare them in the `install` array:
+
+```yaml
+metadata:
+  openclaw:
+    install:
+      - kind: brew
+        formula: jq
+        bins: [jq]
+      - kind: node
+        package: typescript
+        bins: [tsc]
+```
+
+Supported install kinds: `brew`, `node`, `go`, `uv`.
+
+### Why this matters
+
+ClawHub's security analysis checks that what your skill declares matches what it actually does. If your code references `TODOIST_API_KEY` but your frontmatter doesn't declare it under `requires.env`, the analysis will flag a metadata mismatch. Keeping declarations accurate helps your skill pass review and helps users understand what they're installing.
+
+### Example: complete frontmatter
+
+```yaml
+---
+name: todoist-cli
+description: Manage Todoist tasks, projects, and labels from the command line.
+version: 1.2.0
+metadata:
+  openclaw:
+    requires:
+      env:
+        - TODOIST_API_KEY
+      bins:
+        - curl
+    primaryEnv: TODOIST_API_KEY
+    emoji: "\u2705"
+    homepage: https://github.com/example/todoist-cli
+---
+```
+
 ## Allowed files
 
 Only “text-based” files are accepted by publish.

docs/spec.md

@@ -1,12 +1,12 @@
 ---
-summary: "ClawdHub spec: skills registry, versioning, vector search, moderation"
+summary: "ClawHub spec: skills registry, versioning, vector search, moderation"
 read_when:
-  - Bootstrapping ClawdHub
+  - Bootstrapping ClawHub
   - Implementing schema/auth/search/versioning
   - Reviewing API and upload/download flows
 ---
 
-# ClawdHub — product + implementation spec (v1)
+# ClawHub — product + implementation spec (v1)
 
 ## Goals
 - onlycrabs.ai mode for sharing `SOUL.md` bundles (host-based entry point).
@@ -123,8 +123,9 @@ From SKILL.md frontmatter + AgentSkills + Clawdis extensions:
 ## Auth + roles
 - Convex Auth with GitHub OAuth App.
 - Default role `user`; bootstrap `steipete` to `admin` on first login.
-- Management console: moderators can hide/restore skills + mark duplicates; admins can change owners, approve badges, and hard-delete.
+- Management console: moderators can hide/restore skills + mark duplicates + ban users; admins can change owners, approve badges, hard-delete skills, and ban users (deletes owned skills).
 - Role changes are admin-only and audited.
+- Reporting: any user can report skills; per-user cap 20 active reports; skills auto-hide after >3 unique reports (mods can review/unhide/delete/ban).
 
 ## Upload flow (50MB per version)
 1) Client requests upload session.
@@ -135,9 +136,10 @@ From SKILL.md frontmatter + AgentSkills + Clawdis extensions:
    - file extensions/text content
    - SKILL.md exists and frontmatter parseable
    - version uniqueness
+   - GitHub account age ≥ 7 days
 5) Server stores files + metadata, sets `latest` tag, updates stats.
 
-Soul upload flow: same as skills, but only `SOUL.md` is allowed in the bundle.
+Soul upload flow: same as skills (including GitHub account age checks), but only `SOUL.md` is allowed.
 Seed data lives in `convex/seed.ts` for local dev.
 
 ## Versioning + tags

docs/telemetry.md

@@ -1,5 +1,5 @@
 ---
-summary: 'Install telemetry collected via `clawdhub sync` + opt-out.'
+summary: 'Install telemetry collected via `clawhub sync` + opt-out.'
 read_when:
   - Working on telemetry / privacy controls
   - Questions about what data is collected
@@ -7,22 +7,22 @@ read_when:
 
 # Telemetry
 
-ClawdHub uses **minimal telemetry** to compute **install counts** (what’s actually in use) and to power better sorting/filtering.
-This is based on the CLI `clawdhub sync` command.
+ClawHub uses **minimal telemetry** to compute **install counts** (what’s actually in use) and to power better sorting/filtering.
+This is based on the CLI `clawhub sync` command.
 
 ## When telemetry is collected
 
 Telemetry is only sent when:
 
 - You are **logged in** in the CLI (we already require auth for sync/publish flows).
-- You run `clawdhub sync`.
+- You run `clawhub sync`.
 - Telemetry is **not disabled** (see “How to disable” below).
 
 If you are not logged in, nothing is reported.
 
 ## What we collect
 
-On each `clawdhub sync`, the CLI reports a **full snapshot** of what it found, grouped by scan root (“folder/root”).
+On each `clawhub sync`, the CLI reports a **full snapshot** of what it found, grouped by scan root (“folder/root”).
 
 For each root we store:
 
@@ -70,7 +70,7 @@ This is evaluated lazily (on the next telemetry report) to avoid background jobs
 
 ## Transparency + user controls
 
-ClawdHub provides a private “Installed” tab on your own profile:
+ClawHub provides a private “Installed” tab on your own profile:
 
 - Shows the exact roots + installed skills we store.
 - Includes a **JSON export** view.
@@ -85,7 +85,7 @@ Deleting your account also deletes your telemetry data.
 Set the environment variable:
 
 ```bash
-export CLAWDHUB_DISABLE_TELEMETRY=1
+export CLAWHUB_DISABLE_TELEMETRY=1
 ```
 
-With this set, the CLI will not send telemetry during `clawdhub sync`.
+With this set, the CLI will not send telemetry during `clawhub sync`.

docs/troubleshooting.md

@@ -6,16 +6,16 @@ read_when:
 
 # Troubleshooting
 
-## `clawdhub login` opens browser but never completes
+## `clawhub login` opens browser but never completes
 
 - Ensure your browser can reach `http://127.0.0.1:<port>/callback` (local firewalls/VPNs can interfere).
 - Use headless mode:
   - create a token in the web UI (Settings → API tokens)
-  - `clawdhub login --token clh_...`
+  - `clawhub login --token clh_...`
 
 ## `whoami` / `publish` returns `Unauthorized` (401)
 
-- Token missing or revoked: check your config file (`CLAWDHUB_CONFIG_PATH` override?).
+- Token missing or revoked: check your config file (`CLAWHUB_CONFIG_PATH` override?).
 - Ensure requests include `Authorization: Bearer ...` (CLI does this automatically).
 
 ## `publish` fails with `OPENAI_API_KEY is not configured`
@@ -23,6 +23,12 @@ read_when:
 - Set `OPENAI_API_KEY` in the Convex environment (not only locally).
 - Re-run `bunx convex dev` / `bunx convex deploy` after setting env.
 
+## `publish` fails with `GitHub API rate limit exceeded`
+
+- This is the GitHub account-age gate lookup hitting unauthenticated limits.
+- Set `GITHUB_TOKEN` in Convex environment to use authenticated GitHub API limits.
+- Retry publish after a short wait if the limit was already exhausted.
+
 ## `sync` says “No skills found”
 
 - `sync` looks for folders containing `SKILL.md` (or `skill.md`).
@@ -32,7 +38,7 @@ read_when:
 - Provide explicit roots:
 
 ```bash
-clawdhub sync --root /path/to/skills
+clawhub sync --root /path/to/skills
 ```
 
 ## `update` refuses due to “local changes (no match)”
@@ -40,8 +46,8 @@ clawdhub sync --root /path/to/skills
 - Your local files don’t match any published fingerprint.
 - Options:
   - keep local edits; skip updating
-  - overwrite: `clawdhub update <slug> --force`
-  - publish as fork: copy to new folder/slug then `clawdhub publish ... --fork-of upstream@version`
+  - overwrite: `clawhub update <slug> --force`
+  - publish as fork: copy to new folder/slug then `clawhub publish ... --fork-of upstream@version`
 
 ## `GET /api/*` works locally but not on Vercel
 

docs/webhook.md

@@ -6,7 +6,7 @@ read_when:
 
 # Webhooks (Discord)
 
-ClawdHub can post Discord embeds when skills are published or highlighted.
+ClawHub can post Discord embeds when skills are published or highlighted.
 
 ## Setup
 
@@ -14,7 +14,7 @@ Set the webhook URL in the Convex environment:
 
 - `DISCORD_WEBHOOK_URL` (required): Discord webhook URL.
 - `DISCORD_WEBHOOK_HIGHLIGHTED_ONLY` (optional): `true` to only send for highlighted skills.
-- `SITE_URL` (optional): Base site URL for links (default `https://clawdhub.com`).
+- `SITE_URL` (optional): Base site URL for links (default `https://clawhub.ai`).
 
 ## Events
 
@@ -38,13 +38,13 @@ Discord receives a JSON payload with a single embed:
     {
       "title": "Demo Skill",
       "description": "Nice skill",
-      "url": "https://clawdhub.com/owner/demo-skill",
+      "url": "https://clawhub.ai/owner/demo-skill",
       "fields": [
         { "name": "Version", "value": "v1.2.3", "inline": true },
         { "name": "Owner", "value": "@owner", "inline": true },
         { "name": "Tags", "value": "latest, discord", "inline": false }
       ],
-      "footer": { "text": "ClawdHub" }
+      "footer": { "text": "ClawHub" }
     }
   ]
 }

e2e/clawdhub.e2e.test.ts

@@ -4,13 +4,13 @@ import { spawnSync } from 'node:child_process'
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { unzipSync } from 'fflate'
 import {
   ApiRoutes,
   ApiV1SearchResponseSchema,
   ApiV1WhoamiResponseSchema,
   parseArk,
-} from 'clawdhub-schema'
+} from 'clawhub-schema'
+import { unzipSync } from 'fflate'
 import { Agent, setGlobalDispatcher } from 'undici'
 import { describe, expect, it } from 'vitest'
 import { readGlobalConfig } from '../packages/clawdhub/src/config'
@@ -20,7 +20,6 @@ const REQUEST_TIMEOUT_MS = 15_000
 try {
   setGlobalDispatcher(
     new Agent({
-      allowH2: true,
       connect: { timeout: REQUEST_TIMEOUT_MS },
     }),
   )
@@ -29,13 +28,27 @@ try {
 }
 
 function mustGetToken() {
-  const fromEnv = process.env.CLAWDHUB_E2E_TOKEN?.trim()
+  const fromEnv = process.env.CLAWHUB_E2E_TOKEN?.trim() || process.env.CLAWDHUB_E2E_TOKEN?.trim()
   if (fromEnv) return fromEnv
   return null
 }
 
+function getRegistry() {
+  return (
+    process.env.CLAWHUB_REGISTRY?.trim() ||
+    process.env.CLAWDHUB_REGISTRY?.trim() ||
+    'https://clawhub.ai'
+  )
+}
+
+function getSite() {
+  return (
+    process.env.CLAWHUB_SITE?.trim() || process.env.CLAWDHUB_SITE?.trim() || 'https://clawhub.ai'
+  )
+}
+
 async function makeTempConfig(registry: string, token: string | null) {
-  const dir = await mkdtemp(join(tmpdir(), 'clawdhub-e2e-'))
+  const dir = await mkdtemp(join(tmpdir(), 'clawhub-e2e-'))
   const path = join(dir, 'config.json')
   await writeFile(
     path,
@@ -55,9 +68,9 @@ async function fetchWithTimeout(input: RequestInfo | URL, init?: RequestInit) {
   }
 }
 
-describe('clawdhub e2e', () => {
+describe('clawhub e2e', () => {
   it('prints CLI version via --cli-version', async () => {
-    const result = spawnSync('bun', ['clawdhub', '--cli-version'], {
+    const result = spawnSync('bun', ['clawhub', '--cli-version'], {
       cwd: process.cwd(),
       encoding: 'utf8',
     })
@@ -66,7 +79,7 @@ describe('clawdhub e2e', () => {
   })
 
   it('search endpoint returns a results array (schema parse)', async () => {
-    const registry = process.env.CLAWDHUB_REGISTRY?.trim() || 'https://clawdhub.com'
+    const registry = getRegistry()
     const url = new URL(ApiRoutes.search, registry)
     url.searchParams.set('q', 'gif')
     url.searchParams.set('limit', '5')
@@ -81,17 +94,17 @@ describe('clawdhub e2e', () => {
   })
 
   it('cli search does not error on multi-result responses', async () => {
-    const registry = process.env.CLAWDHUB_REGISTRY?.trim() || 'https://clawdhub.com'
-    const site = process.env.CLAWDHUB_SITE?.trim() || 'https://clawdhub.com'
+    const registry = getRegistry()
+    const site = getSite()
     const token = mustGetToken() ?? (await readGlobalConfig())?.token ?? null
 
     const cfg = await makeTempConfig(registry, token)
     try {
-      const workdir = await mkdtemp(join(tmpdir(), 'clawdhub-e2e-workdir-'))
+      const workdir = await mkdtemp(join(tmpdir(), 'clawhub-e2e-workdir-'))
       const result = spawnSync(
         'bun',
         [
-          'clawdhub',
+          'clawhub',
           'search',
           'gif',
           '--limit',
@@ -105,7 +118,7 @@ describe('clawdhub e2e', () => {
         ],
         {
           cwd: process.cwd(),
-          env: { ...process.env, CLAWDHUB_CONFIG_PATH: cfg.path, CLAWDHUB_DISABLE_TELEMETRY: '1' },
+          env: { ...process.env, CLAWHUB_CONFIG_PATH: cfg.path, CLAWHUB_DISABLE_TELEMETRY: '1' },
           encoding: 'utf8',
         },
       )
@@ -119,11 +132,11 @@ describe('clawdhub e2e', () => {
   })
 
   it('assumes a logged-in user (whoami succeeds)', async () => {
-    const registry = process.env.CLAWDHUB_REGISTRY?.trim() || 'https://clawdhub.com'
-    const site = process.env.CLAWDHUB_SITE?.trim() || 'https://clawdhub.com'
+    const registry = getRegistry()
+    const site = getSite()
     const token = mustGetToken() ?? (await readGlobalConfig())?.token ?? null
     if (!token) {
-      throw new Error('Missing token. Set CLAWDHUB_E2E_TOKEN or run: bun clawdhub auth login')
+      throw new Error('Missing token. Set CLAWHUB_E2E_TOKEN or run: bun clawhub auth login')
     }
 
     const cfg = await makeTempConfig(registry, token)
@@ -142,10 +155,10 @@ describe('clawdhub e2e', () => {
 
       const result = spawnSync(
         'bun',
-        ['clawdhub', 'whoami', '--site', site, '--registry', registry],
+        ['clawhub', 'whoami', '--site', site, '--registry', registry],
         {
           cwd: process.cwd(),
-          env: { ...process.env, CLAWDHUB_CONFIG_PATH: cfg.path, CLAWDHUB_DISABLE_TELEMETRY: '1' },
+          env: { ...process.env, CLAWHUB_CONFIG_PATH: cfg.path, CLAWHUB_DISABLE_TELEMETRY: '1' },
           encoding: 'utf8',
         },
       )
@@ -157,15 +170,15 @@ describe('clawdhub e2e', () => {
   })
 
   it('sync dry-run finds skills from an explicit root', async () => {
-    const registry = process.env.CLAWDHUB_REGISTRY?.trim() || 'https://clawdhub.com'
-    const site = process.env.CLAWDHUB_SITE?.trim() || 'https://clawdhub.com'
+    const registry = getRegistry()
+    const site = getSite()
     const token = mustGetToken() ?? (await readGlobalConfig())?.token ?? null
     if (!token) {
-      throw new Error('Missing token. Set CLAWDHUB_E2E_TOKEN or run: bun clawdhub auth login')
+      throw new Error('Missing token. Set CLAWHUB_E2E_TOKEN or run: bun clawhub auth login')
     }
 
     const cfg = await makeTempConfig(registry, token)
-    const root = await mkdtemp(join(tmpdir(), 'clawdhub-e2e-sync-'))
+    const root = await mkdtemp(join(tmpdir(), 'clawhub-e2e-sync-'))
     try {
       const skillDir = join(root, 'cool-skill')
       await mkdir(skillDir, { recursive: true })
@@ -174,7 +187,7 @@ describe('clawdhub e2e', () => {
       const result = spawnSync(
         'bun',
         [
-          'clawdhub',
+          'clawhub',
           'sync',
           '--dry-run',
           '--all',
@@ -187,7 +200,7 @@ describe('clawdhub e2e', () => {
         ],
         {
           cwd: process.cwd(),
-          env: { ...process.env, CLAWDHUB_CONFIG_PATH: cfg.path, CLAWDHUB_DISABLE_TELEMETRY: '1' },
+          env: { ...process.env, CLAWHUB_CONFIG_PATH: cfg.path, CLAWHUB_DISABLE_TELEMETRY: '1' },
           encoding: 'utf8',
         },
       )
@@ -201,15 +214,15 @@ describe('clawdhub e2e', () => {
   })
 
   it('sync dry-run finds skills from clawdbot.json roots', async () => {
-    const registry = process.env.CLAWDHUB_REGISTRY?.trim() || 'https://clawdhub.com'
-    const site = process.env.CLAWDHUB_SITE?.trim() || 'https://clawdhub.com'
+    const registry = getRegistry()
+    const site = getSite()
     const token = mustGetToken() ?? (await readGlobalConfig())?.token ?? null
     if (!token) {
-      throw new Error('Missing token. Set CLAWDHUB_E2E_TOKEN or run: bun clawdhub auth login')
+      throw new Error('Missing token. Set CLAWHUB_E2E_TOKEN or run: bun clawhub auth login')
     }
 
     const cfg = await makeTempConfig(registry, token)
-    const root = await mkdtemp(join(tmpdir(), 'clawdhub-e2e-clawdbot-'))
+    const root = await mkdtemp(join(tmpdir(), 'clawhub-e2e-clawdbot-'))
     const stateDir = join(root, 'state')
     const configPath = join(root, 'clawdbot.json')
     const workspace = join(root, 'clawd-work')
@@ -232,13 +245,13 @@ describe('clawdhub e2e', () => {
 
       const result = spawnSync(
         'bun',
-        ['clawdhub', 'sync', '--dry-run', '--all', '--site', site, '--registry', registry],
+        ['clawhub', 'sync', '--dry-run', '--all', '--site', site, '--registry', registry],
         {
           cwd: process.cwd(),
           env: {
             ...process.env,
-            CLAWDHUB_CONFIG_PATH: cfg.path,
-            CLAWDHUB_DISABLE_TELEMETRY: '1',
+            CLAWHUB_CONFIG_PATH: cfg.path,
+            CLAWHUB_DISABLE_TELEMETRY: '1',
             CLAWDBOT_CONFIG_PATH: configPath,
             CLAWDBOT_STATE_DIR: stateDir,
           },
@@ -256,16 +269,16 @@ describe('clawdhub e2e', () => {
   })
 
   it('publishes, deletes, and undeletes a skill (logged-in)', async () => {
-    const registry = process.env.CLAWDHUB_REGISTRY?.trim() || 'https://clawdhub.com'
-    const site = process.env.CLAWDHUB_SITE?.trim() || 'https://clawdhub.com'
+    const registry = getRegistry()
+    const site = getSite()
     const token = mustGetToken() ?? (await readGlobalConfig())?.token ?? null
     if (!token) {
-      throw new Error('Missing token. Set CLAWDHUB_E2E_TOKEN or run: bun clawdhub auth login')
+      throw new Error('Missing token. Set CLAWHUB_E2E_TOKEN or run: bun clawhub auth login')
     }
 
     const cfg = await makeTempConfig(registry, token)
-    const workdir = await mkdtemp(join(tmpdir(), 'clawdhub-e2e-publish-'))
-    const installWorkdir = await mkdtemp(join(tmpdir(), 'clawdhub-e2e-install-'))
+    const workdir = await mkdtemp(join(tmpdir(), 'clawhub-e2e-publish-'))
+    const installWorkdir = await mkdtemp(join(tmpdir(), 'clawhub-e2e-install-'))
     const slug = `e2e-${Date.now()}`
     const skillDir = join(workdir, slug)
 
@@ -276,7 +289,7 @@ describe('clawdhub e2e', () => {
       const publish1 = spawnSync(
         'bun',
         [
-          'clawdhub',
+          'clawhub',
           'publish',
           skillDir,
           '--slug',
@@ -296,7 +309,7 @@ describe('clawdhub e2e', () => {
         ],
         {
           cwd: process.cwd(),
-          env: { ...process.env, CLAWDHUB_CONFIG_PATH: cfg.path, CLAWDHUB_DISABLE_TELEMETRY: '1' },
+          env: { ...process.env, CLAWHUB_CONFIG_PATH: cfg.path, CLAWHUB_DISABLE_TELEMETRY: '1' },
           encoding: 'utf8',
         },
       )
@@ -306,7 +319,7 @@ describe('clawdhub e2e', () => {
       const publish2 = spawnSync(
         'bun',
         [
-          'clawdhub',
+          'clawhub',
           'publish',
           skillDir,
           '--slug',
@@ -326,7 +339,7 @@ describe('clawdhub e2e', () => {
         ],
         {
           cwd: process.cwd(),
-          env: { ...process.env, CLAWDHUB_CONFIG_PATH: cfg.path, CLAWDHUB_DISABLE_TELEMETRY: '1' },
+          env: { ...process.env, CLAWHUB_CONFIG_PATH: cfg.path, CLAWHUB_DISABLE_TELEMETRY: '1' },
           encoding: 'utf8',
         },
       )
@@ -345,7 +358,7 @@ describe('clawdhub e2e', () => {
       const install = spawnSync(
         'bun',
         [
-          'clawdhub',
+          'clawhub',
           'install',
           slug,
           '--version',
@@ -360,7 +373,7 @@ describe('clawdhub e2e', () => {
         ],
         {
           cwd: process.cwd(),
-          env: { ...process.env, CLAWDHUB_CONFIG_PATH: cfg.path, CLAWDHUB_DISABLE_TELEMETRY: '1' },
+          env: { ...process.env, CLAWHUB_CONFIG_PATH: cfg.path, CLAWHUB_DISABLE_TELEMETRY: '1' },
           encoding: 'utf8',
         },
       )
@@ -368,10 +381,10 @@ describe('clawdhub e2e', () => {
 
       const list = spawnSync(
         'bun',
-        ['clawdhub', 'list', '--site', site, '--registry', registry, '--workdir', installWorkdir],
+        ['clawhub', 'list', '--site', site, '--registry', registry, '--workdir', installWorkdir],
         {
           cwd: process.cwd(),
-          env: { ...process.env, CLAWDHUB_CONFIG_PATH: cfg.path, CLAWDHUB_DISABLE_TELEMETRY: '1' },
+          env: { ...process.env, CLAWHUB_CONFIG_PATH: cfg.path, CLAWHUB_DISABLE_TELEMETRY: '1' },
           encoding: 'utf8',
         },
       )
@@ -381,7 +394,7 @@ describe('clawdhub e2e', () => {
       const update = spawnSync(
         'bun',
         [
-          'clawdhub',
+          'clawhub',
           'update',
           slug,
           '--force',
@@ -394,7 +407,7 @@ describe('clawdhub e2e', () => {
         ],
         {
           cwd: process.cwd(),
-          env: { ...process.env, CLAWDHUB_CONFIG_PATH: cfg.path, CLAWDHUB_DISABLE_TELEMETRY: '1' },
+          env: { ...process.env, CLAWHUB_CONFIG_PATH: cfg.path, CLAWHUB_DISABLE_TELEMETRY: '1' },
           encoding: 'utf8',
         },
       )
@@ -409,7 +422,7 @@ describe('clawdhub e2e', () => {
       const del = spawnSync(
         'bun',
         [
-          'clawdhub',
+          'clawhub',
           'delete',
           slug,
           '--yes',
@@ -422,7 +435,7 @@ describe('clawdhub e2e', () => {
         ],
         {
           cwd: process.cwd(),
-          env: { ...process.env, CLAWDHUB_CONFIG_PATH: cfg.path, CLAWDHUB_DISABLE_TELEMETRY: '1' },
+          env: { ...process.env, CLAWHUB_CONFIG_PATH: cfg.path, CLAWHUB_DISABLE_TELEMETRY: '1' },
           encoding: 'utf8',
         },
       )
@@ -439,7 +452,7 @@ describe('clawdhub e2e', () => {
       const undelete = spawnSync(
         'bun',
         [
-          'clawdhub',
+          'clawhub',
           'undelete',
           slug,
           '--yes',
@@ -452,7 +465,7 @@ describe('clawdhub e2e', () => {
         ],
         {
           cwd: process.cwd(),
-          env: { ...process.env, CLAWDHUB_CONFIG_PATH: cfg.path, CLAWDHUB_DISABLE_TELEMETRY: '1' },
+          env: { ...process.env, CLAWHUB_CONFIG_PATH: cfg.path, CLAWHUB_DISABLE_TELEMETRY: '1' },
           encoding: 'utf8',
         },
       )
@@ -466,7 +479,7 @@ describe('clawdhub e2e', () => {
       const cleanup = spawnSync(
         'bun',
         [
-          'clawdhub',
+          'clawhub',
           'delete',
           slug,
           '--yes',
@@ -479,7 +492,7 @@ describe('clawdhub e2e', () => {
         ],
         {
           cwd: process.cwd(),
-          env: { ...process.env, CLAWDHUB_CONFIG_PATH: cfg.path, CLAWDHUB_DISABLE_TELEMETRY: '1' },
+          env: { ...process.env, CLAWHUB_CONFIG_PATH: cfg.path, CLAWHUB_DISABLE_TELEMETRY: '1' },
           encoding: 'utf8',
         },
       )

e2e/menu-smoke.pw.test.ts

@@ -43,7 +43,7 @@ test('header menu routes render', async ({ page }) => {
 
     if (label === 'Search') {
       await expect(page).toHaveURL(/\/?(\?|$)/)
-      await expect(page.locator('h1', { hasText: 'ClawdHub' })).toBeVisible()
+      await expect(page.locator('h1', { hasText: 'ClawHub' })).toBeVisible()
     }
   }
 })

package.json

@@ -1,5 +1,5 @@
 {
-  "name": "clawdhub",
+  "name": "clawhub",
   "private": true,
   "type": "module",
   "workspaces": [
@@ -35,49 +35,50 @@
     "@radix-ui/react-toggle-group": "^1.1.11",
     "@resvg/resvg-wasm": "^2.6.2",
     "@tailwindcss/vite": "^4.1.18",
-    "@tanstack/react-devtools": "^0.9.2",
-    "@tanstack/react-router": "^1.151.6",
-    "@tanstack/react-router-devtools": "^1.151.6",
-    "@tanstack/react-start": "^1.152.0",
-    "@tanstack/router-plugin": "^1.151.6",
+    "@tanstack/react-devtools": "^0.9.4",
+    "@tanstack/react-router": "^1.157.18",
+    "@tanstack/react-router-devtools": "^1.157.18",
+    "@tanstack/react-start": "^1.157.18",
+    "@tanstack/router-plugin": "^1.157.18",
     "@vercel/analytics": "^1.6.1",
-    "clawdhub-schema": "workspace:*",
+    "clawhub-schema": "workspace:*",
     "clsx": "^2.1.1",
-    "convex": "^1.31.6",
+    "convex": "^1.31.7",
     "convex-helpers": "^0.1.111",
     "fflate": "^0.8.2",
-    "h3": "2.0.1-rc.8",
-    "lucide-react": "^0.562.0",
+    "h3": "2.0.1-rc.11",
+    "lucide-react": "^0.563.0",
     "monaco-editor": "^0.55.1",
-    "nitro": "^3.0.1-alpha.1",
-    "react": "^19.2.3",
-    "react-dom": "^19.2.3",
+    "nitro": "^3.0.1-alpha.2",
+    "react": "^19.2.4",
+    "react-dom": "^19.2.4",
     "react-markdown": "^10.1.0",
     "remark-gfm": "^4.0.1",
     "semver": "^7.7.3",
     "tailwind-merge": "^3.4.0",
     "tailwindcss": "^4.1.18",
-    "vite-tsconfig-paths": "^6.0.4",
+    "vite-tsconfig-paths": "^6.0.5",
     "yaml": "^2.8.2"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.3.11",
-    "@playwright/test": "^1.57.0",
-    "@tanstack/devtools-vite": "^0.4.1",
+    "@biomejs/biome": "^2.3.13",
+    "@playwright/test": "^1.58.1",
+    "@tanstack/devtools-vite": "^0.5.0",
     "@testing-library/dom": "^10.4.1",
-    "@testing-library/react": "^16.3.1",
-    "@types/node": "^25.0.9",
-    "@types/react": "^19.2.8",
+    "@testing-library/react": "^16.3.2",
+    "@types/node": "^25.2.0",
+    "@types/react": "^19.2.10",
     "@types/react-dom": "^19.2.3",
     "@types/semver": "^7.7.1",
     "@vitejs/plugin-react": "^5.1.2",
-    "@vitest/coverage-v8": "^4.0.17",
-    "jsdom": "^27.4.0",
-    "only-allow": "^1.2.1",
-    "oxlint": "^1.39.0",
-    "oxlint-tsgolint": "^0.11.1",
+    "@vitest/coverage-v8": "^4.0.18",
+    "jsdom": "^28.0.0",
+    "only-allow": "^1.2.2",
+    "oxlint": "^1.42.0",
+    "oxlint-tsgolint": "^0.11.4",
+    "undici": "^7.19.2",
     "typescript": "^5.9.3",
     "vite": "^7.3.1",
-    "vitest": "^4.0.17"
+    "vitest": "^4.0.18"
   }
 }

packages/clawdhub/README.md

@@ -1,57 +1,57 @@
-# `clawdhub`
+# `clawhub`
 
-ClawdHub CLI — install, update, search, and publish agent skills as folders.
+ClawHub CLI — install, update, search, and publish agent skills as folders.
 
 ## Install
 
 ```bash
 # From this repo (shortcut script at repo root)
-bun clawdhub --help
+bun clawhub --help
 
 # Once published to npm
-# npm i -g clawdhub
+# npm i -g clawhub
 ```
 
 ## Auth (publish)
 
 ```bash
-clawdhub login
+clawhub login
 # or
-clawdhub auth login
+clawhub auth login
 
 # Headless / token paste
 # or (token paste / headless)
-clawdhub login --token clh_...
+clawhub login --token clh_...
 ```
 
 Notes:
 
-- Browser login opens `https://clawdhub.com/cli/auth` and completes via a loopback callback.
-- Token stored in `~/Library/Application Support/clawdhub/config.json` on macOS (override via `CLAWDHUB_CONFIG_PATH`).
+- Browser login opens `https://clawhub.ai/cli/auth` and completes via a loopback callback.
+- Token stored in `~/Library/Application Support/clawhub/config.json` on macOS (override via `CLAWHUB_CONFIG_PATH`, legacy `CLAWDHUB_CONFIG_PATH`).
 
 ## Examples
 
 ```bash
-clawdhub search "postgres backups"
-clawdhub install my-skill-pack
-clawdhub update --all
-clawdhub update --all --no-input --force
-clawdhub publish ./my-skill-pack --slug my-skill-pack --name "My Skill Pack" --version 1.2.0 --changelog "Fixes + docs"
+clawhub search "postgres backups"
+clawhub install my-skill-pack
+clawhub update --all
+clawhub update --all --no-input --force
+clawhub publish ./my-skill-pack --slug my-skill-pack --name "My Skill Pack" --version 1.2.0 --changelog "Fixes + docs"
 ```
 
 ## Sync (upload local skills)
 
 ```bash
-# Start anywhere; scans workdir first, then legacy Clawdis/Clawd locations.
-clawdhub sync
+# Start anywhere; scans workdir first, then legacy Clawdis/Clawd/OpenClaw/Moltbot locations.
+clawhub sync
 
 # Explicit roots + non-interactive dry-run
-clawdhub sync --root ../clawdis/skills --all --dry-run
+clawhub sync --root ../clawdis/skills --all --dry-run
 ```
 
 ## Defaults
 
-- Site: `https://clawdhub.com` (override via `--site` or `CLAWDHUB_SITE`)
-- Registry: discovered from `/.well-known/clawdhub.json` on the site (override via `--registry` or `CLAWDHUB_REGISTRY`)
-- Workdir: current directory (falls back to Clawdbot workspace if configured; override via `--workdir` or `CLAWDHUB_WORKDIR`)
+- Site: `https://clawhub.ai` (override via `--site` or `CLAWHUB_SITE`, legacy `CLAWDHUB_SITE`)
+- Registry: discovered from `/.well-known/clawhub.json` on the site (legacy `/.well-known/clawdhub.json`; override via `--registry` or `CLAWHUB_REGISTRY`)
+- Workdir: current directory (falls back to Clawdbot workspace if configured; override via `--workdir` or `CLAWHUB_WORKDIR`)
 - Install dir: `./skills` under workdir (override via `--dir`)

packages/clawdhub/package.json

@@ -1,10 +1,11 @@
 {
-  "name": "clawdhub",
-  "version": "0.3.0",
-  "description": "ClawdHub CLI \\u2014 install, update, search, and publish agent skills.",
+  "name": "clawhub",
+  "version": "0.6.1",
+  "description": "ClawHub CLI \\u2014 install, update, search, and publish agent skills.",
   "license": "MIT",
   "type": "module",
   "bin": {
+    "clawhub": "bin/clawdhub.js",
     "clawdhub": "bin/clawdhub.js"
   },
   "files": [

packages/clawdhub/src/browserAuth.test.ts

@@ -60,7 +60,7 @@ describe('browserAuth', () => {
     const response = await fetch(server.redirectUri)
     expect(response.status).toBe(200)
     const text = await response.text()
-    expect(text).toContain('ClawdHub CLI Login')
+    expect(text).toContain('ClawHub CLI Login')
     server.close()
   })
 

packages/clawdhub/src/browserAuth.ts

@@ -127,7 +127,7 @@ const CALLBACK_HTML = `<!doctype html>
 <html lang="en">
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>ClawdHub CLI Login</title>
+  <title>ClawHub CLI Login</title>
   <style>
     :root { color-scheme: light dark; }
     body { font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, sans-serif; padding: 24px; }

packages/clawdhub/src/cli.ts

@@ -5,7 +5,14 @@ import { Command } from 'commander'
 import { getCliBuildLabel, getCliVersion } from './cli/buildInfo.js'
 import { resolveClawdbotDefaultWorkspace } from './cli/clawdbotConfig.js'
 import { cmdLoginFlow, cmdLogout, cmdWhoami } from './cli/commands/auth.js'
-import { cmdDeleteSkill, cmdUndeleteSkill } from './cli/commands/delete.js'
+import {
+  cmdDeleteSkill,
+  cmdHideSkill,
+  cmdUndeleteSkill,
+  cmdUnhideSkill,
+} from './cli/commands/delete.js'
+import { cmdInspect } from './cli/commands/inspect.js'
+import { cmdBanUser, cmdSetRole } from './cli/commands/moderation.js'
 import { cmdPublish } from './cli/commands/publish.js'
 import { cmdExplore, cmdInstall, cmdList, cmdSearch, cmdUpdate } from './cli/commands/skills.js'
 import { cmdStarSkill } from './cli/commands/star.js'
@@ -18,9 +25,9 @@ import { fail } from './cli/ui.js'
 import { readGlobalConfig } from './config.js'
 
 const program = new Command()
-  .name('clawdhub')
+  .name('clawhub')
   .description(
-    `${styleTitle(`ClawdHub CLI ${getCliBuildLabel()}`)}\n${styleEnvBlock(
+    `${styleTitle(`ClawHub CLI ${getCliBuildLabel()}`)}\n${styleEnvBlock(
       'install, update, search, and publish agent skills.',
     )}`,
   )
@@ -34,7 +41,9 @@ const program = new Command()
   .showSuggestionAfterError()
   .addHelpText(
     'after',
-    styleEnvBlock('\nEnv:\n  CLAWDHUB_SITE\n  CLAWDHUB_REGISTRY\n  CLAWDHUB_WORKDIR\n'),
+    styleEnvBlock(
+      '\nEnv:\n  CLAWHUB_SITE\n  CLAWHUB_REGISTRY\n  CLAWHUB_WORKDIR\n  (CLAWDHUB_* supported)\n',
+    ),
   )
 
 configureCommanderHelp(program)
@@ -43,9 +52,17 @@ async function resolveGlobalOpts(): Promise<GlobalOpts> {
   const raw = program.opts<{ workdir?: string; dir?: string; site?: string; registry?: string }>()
   const workdir = await resolveWorkdir(raw.workdir)
   const dir = resolve(workdir, raw.dir ?? 'skills')
-  const site = raw.site ?? process.env.CLAWDHUB_SITE ?? DEFAULT_SITE
-  const registrySource = raw.registry ? 'cli' : process.env.CLAWDHUB_REGISTRY ? 'env' : 'default'
-  const registry = raw.registry ?? process.env.CLAWDHUB_REGISTRY ?? DEFAULT_REGISTRY
+  const site = raw.site ?? process.env.CLAWHUB_SITE ?? process.env.CLAWDHUB_SITE ?? DEFAULT_SITE
+  const registrySource = raw.registry
+    ? 'cli'
+    : process.env.CLAWHUB_REGISTRY || process.env.CLAWDHUB_REGISTRY
+      ? 'env'
+      : 'default'
+  const registry =
+    raw.registry ??
+    process.env.CLAWHUB_REGISTRY ??
+    process.env.CLAWDHUB_REGISTRY ??
+    DEFAULT_REGISTRY
   return { workdir, dir, site, registry, registrySource }
 }
 
@@ -56,22 +73,26 @@ function isInputAllowed() {
 
 async function resolveWorkdir(explicit?: string) {
   if (explicit?.trim()) return resolve(explicit.trim())
-  const envWorkdir = process.env.CLAWDHUB_WORKDIR?.trim()
+  const envWorkdir = process.env.CLAWHUB_WORKDIR?.trim() ?? process.env.CLAWDHUB_WORKDIR?.trim()
   if (envWorkdir) return resolve(envWorkdir)
 
   const cwd = resolve(process.cwd())
-  const hasMarker = await hasClawdhubMarker(cwd)
+  const hasMarker = await hasClawhubMarker(cwd)
   if (hasMarker) return cwd
 
   const clawdbotWorkspace = await resolveClawdbotDefaultWorkspace()
   return clawdbotWorkspace ? resolve(clawdbotWorkspace) : cwd
 }
 
-async function hasClawdhubMarker(workdir: string) {
-  const lockfile = join(workdir, '.clawdhub', 'lock.json')
+async function hasClawhubMarker(workdir: string) {
+  const lockfile = join(workdir, '.clawhub', 'lock.json')
   if (await pathExists(lockfile)) return true
-  const markerDir = join(workdir, '.clawdhub')
-  return pathExists(markerDir)
+  const markerDir = join(workdir, '.clawhub')
+  if (await pathExists(markerDir)) return true
+  const legacyLockfile = join(workdir, '.clawdhub', 'lock.json')
+  if (await pathExists(legacyLockfile)) return true
+  const legacyMarkerDir = join(workdir, '.clawdhub')
+  return pathExists(legacyMarkerDir)
 }
 
 async function pathExists(path: string) {
@@ -207,6 +228,22 @@ program
     await cmdExplore(opts, { limit, sort: options.sort, json: options.json })
   })
 
+program
+  .command('inspect')
+  .description('Fetch skill metadata and files without installing')
+  .argument('<slug>', 'Skill slug')
+  .option('--version <version>', 'Version to inspect')
+  .option('--tag <tag>', 'Tag to inspect (default: latest)')
+  .option('--versions', 'List version history (first page)')
+  .option('--limit <n>', 'Max versions to list (1-200)', (value) => Number.parseInt(value, 10))
+  .option('--files', 'List files for the selected version')
+  .option('--file <path>', 'Fetch raw file content (text <= 200KB)')
+  .option('--json', 'Output JSON')
+  .action(async (slug, options) => {
+    const opts = await resolveGlobalOpts()
+    await cmdInspect(opts, slug, options)
+  })
+
 program
   .command('publish')
   .description('Publish skill from folder')
@@ -224,7 +261,7 @@ program
 
 program
   .command('delete')
-  .description('Soft-delete a skill (owner/admin only)')
+  .description('Soft-delete a skill (moderator/admin only)')
   .argument('<slug>', 'Skill slug')
   .option('--yes', 'Skip confirmation')
   .action(async (slug, options) => {
@@ -232,9 +269,19 @@ program
     await cmdDeleteSkill(opts, slug, options, isInputAllowed())
   })
 
+program
+  .command('hide')
+  .description('Hide a skill (moderator/admin only)')
+  .argument('<slug>', 'Skill slug')
+  .option('--yes', 'Skip confirmation')
+  .action(async (slug, options) => {
+    const opts = await resolveGlobalOpts()
+    await cmdHideSkill(opts, slug, options, isInputAllowed())
+  })
+
 program
   .command('undelete')
-  .description('Restore a soft-deleted skill (owner/admin only)')
+  .description('Restore a hidden skill (moderator/admin only)')
   .argument('<slug>', 'Skill slug')
   .option('--yes', 'Skip confirmation')
   .action(async (slug, options) => {
@@ -242,6 +289,42 @@ program
     await cmdUndeleteSkill(opts, slug, options, isInputAllowed())
   })
 
+program
+  .command('unhide')
+  .description('Unhide a skill (moderator/admin only)')
+  .argument('<slug>', 'Skill slug')
+  .option('--yes', 'Skip confirmation')
+  .action(async (slug, options) => {
+    const opts = await resolveGlobalOpts()
+    await cmdUnhideSkill(opts, slug, options, isInputAllowed())
+  })
+
+program
+  .command('ban-user')
+  .description('Ban a user and delete owned skills (moderator/admin only)')
+  .argument('<handleOrId>', 'User handle (default) or user id')
+  .option('--id', 'Treat argument as user id')
+  .option('--fuzzy', 'Resolve handle via fuzzy user search (admin only)')
+  .option('--reason <reason>', 'Ban reason (optional)')
+  .option('--yes', 'Skip confirmation')
+  .action(async (handleOrId, options) => {
+    const opts = await resolveGlobalOpts()
+    await cmdBanUser(opts, handleOrId, options, isInputAllowed())
+  })
+
+program
+  .command('set-role')
+  .description('Change a user role (admin only)')
+  .argument('<handleOrId>', 'User handle (default) or user id')
+  .argument('<role>', 'user | moderator | admin')
+  .option('--id', 'Treat argument as user id')
+  .option('--fuzzy', 'Resolve handle via fuzzy user search (admin only)')
+  .option('--yes', 'Skip confirmation')
+  .action(async (handleOrId, role, options) => {
+    const opts = await resolveGlobalOpts()
+    await cmdSetRole(opts, handleOrId, role, options, isInputAllowed())
+  })
+
 program
   .command('star')
   .description('Add a skill to your highlights')

packages/clawdhub/src/cli/buildInfo.ts

@@ -24,6 +24,7 @@ function shortCommit(value: string) {
 
 export function getCliCommit() {
   const candidates = [
+    process.env.CLAWHUB_COMMIT,
     process.env.CLAWDHUB_COMMIT,
     process.env.VERCEL_GIT_COMMIT_SHA,
     process.env.GITHUB_SHA,

packages/clawdhub/src/cli/clawdbotConfig.test.ts

@@ -13,14 +13,17 @@ afterEach(() => {
 
 describe('resolveClawdbotSkillRoots', () => {
   it('reads JSON5 config and resolves per-agent + shared skill roots', async () => {
-    const base = await mkdtemp(join(tmpdir(), 'clawdhub-clawdbot-'))
+    const base = await mkdtemp(join(tmpdir(), 'clawhub-clawdbot-'))
     const home = join(base, 'home')
     const stateDir = join(base, 'state')
     const configPath = join(base, 'clawdbot.json')
+    const openclawStateDir = join(base, 'openclaw-state')
 
     process.env.HOME = home
     process.env.CLAWDBOT_STATE_DIR = stateDir
     process.env.CLAWDBOT_CONFIG_PATH = configPath
+    process.env.OPENCLAW_STATE_DIR = openclawStateDir
+    process.env.OPENCLAW_CONFIG_PATH = join(openclawStateDir, 'openclaw.json')
 
     const config = `{
       // JSON5 comments + trailing commas supported
@@ -49,6 +52,7 @@ describe('resolveClawdbotSkillRoots', () => {
 
     const expectedRoots = [
       resolve(stateDir, 'skills'),
+      resolve(openclawStateDir, 'skills'),
       resolve(home, 'clawd-main', 'skills'),
       resolve(home, 'clawd-work', 'skills'),
       resolve(home, 'clawd-family', 'skills'),
@@ -58,6 +62,7 @@ describe('resolveClawdbotSkillRoots', () => {
 
     expect(roots).toEqual(expect.arrayContaining(expectedRoots))
     expect(labels[resolve(stateDir, 'skills')]).toBe('Shared skills')
+    expect(labels[resolve(openclawStateDir, 'skills')]).toBe('OpenClaw: Shared skills')
     expect(labels[resolve(home, 'clawd-main', 'skills')]).toBe('Agent: main')
     expect(labels[resolve(home, 'clawd-work', 'skills')]).toBe('Agent: Work Bot')
     expect(labels[resolve(home, 'clawd-family', 'skills')]).toBe('Agent: family')
@@ -66,16 +71,19 @@ describe('resolveClawdbotSkillRoots', () => {
   })
 
   it('resolves default workspace from agents.defaults and agents.list', async () => {
-    const base = await mkdtemp(join(tmpdir(), 'clawdhub-clawdbot-default-'))
+    const base = await mkdtemp(join(tmpdir(), 'clawhub-clawdbot-default-'))
     const home = join(base, 'home')
     const stateDir = join(base, 'state')
     const configPath = join(base, 'clawdbot.json')
     const workspaceMain = join(base, 'workspace-main')
     const workspaceList = join(base, 'workspace-list')
+    const openclawStateDir = join(base, 'openclaw-state')
 
     process.env.HOME = home
     process.env.CLAWDBOT_STATE_DIR = stateDir
     process.env.CLAWDBOT_CONFIG_PATH = configPath
+    process.env.OPENCLAW_STATE_DIR = openclawStateDir
+    process.env.OPENCLAW_CONFIG_PATH = join(openclawStateDir, 'openclaw.json')
 
     const config = `{
       agents: {
@@ -92,14 +100,17 @@ describe('resolveClawdbotSkillRoots', () => {
   })
 
   it('falls back to default agent in agents.list when defaults missing', async () => {
-    const base = await mkdtemp(join(tmpdir(), 'clawdhub-clawdbot-list-'))
+    const base = await mkdtemp(join(tmpdir(), 'clawhub-clawdbot-list-'))
     const home = join(base, 'home')
     const configPath = join(base, 'clawdbot.json')
     const workspaceMain = join(base, 'workspace-main')
     const workspaceWork = join(base, 'workspace-work')
+    const openclawStateDir = join(base, 'openclaw-state')
 
     process.env.HOME = home
     process.env.CLAWDBOT_CONFIG_PATH = configPath
+    process.env.OPENCLAW_STATE_DIR = openclawStateDir
+    process.env.OPENCLAW_CONFIG_PATH = join(openclawStateDir, 'openclaw.json')
 
     const config = `{
       agents: {
@@ -116,14 +127,17 @@ describe('resolveClawdbotSkillRoots', () => {
   })
 
   it('respects CLAWDBOT_STATE_DIR and CLAWDBOT_CONFIG_PATH overrides', async () => {
-    const base = await mkdtemp(join(tmpdir(), 'clawdhub-clawdbot-override-'))
+    const base = await mkdtemp(join(tmpdir(), 'clawhub-clawdbot-override-'))
     const home = join(base, 'home')
     const stateDir = join(base, 'custom-state')
     const configPath = join(base, 'config', 'clawdbot.json')
+    const openclawStateDir = join(base, 'openclaw-state')
 
     process.env.HOME = home
     process.env.CLAWDBOT_STATE_DIR = stateDir
     process.env.CLAWDBOT_CONFIG_PATH = configPath
+    process.env.OPENCLAW_STATE_DIR = openclawStateDir
+    process.env.OPENCLAW_CONFIG_PATH = join(openclawStateDir, 'openclaw.json')
 
     const config = `{
       agent: { workspace: "${join(base, 'workspace-main')}" },
@@ -136,24 +150,54 @@ describe('resolveClawdbotSkillRoots', () => {
     expect(roots).toEqual(
       expect.arrayContaining([
         resolve(stateDir, 'skills'),
+        resolve(openclawStateDir, 'skills'),
         resolve(join(base, 'workspace-main'), 'skills'),
       ]),
     )
     expect(labels[resolve(stateDir, 'skills')]).toBe('Shared skills')
+    expect(labels[resolve(openclawStateDir, 'skills')]).toBe('OpenClaw: Shared skills')
     expect(labels[resolve(join(base, 'workspace-main'), 'skills')]).toBe('Agent: main')
   })
 
   it('returns shared skills root when config is missing', async () => {
-    const base = await mkdtemp(join(tmpdir(), 'clawdhub-clawdbot-missing-'))
+    const base = await mkdtemp(join(tmpdir(), 'clawhub-clawdbot-missing-'))
     const stateDir = join(base, 'state')
     const configPath = join(base, 'missing', 'clawdbot.json')
+    const openclawStateDir = join(base, 'openclaw-state')
 
     process.env.CLAWDBOT_STATE_DIR = stateDir
     process.env.CLAWDBOT_CONFIG_PATH = configPath
+    process.env.OPENCLAW_STATE_DIR = openclawStateDir
+    process.env.OPENCLAW_CONFIG_PATH = join(openclawStateDir, 'openclaw.json')
 
     const { roots, labels } = await resolveClawdbotSkillRoots()
 
-    expect(roots).toEqual([resolve(stateDir, 'skills')])
+    expect(roots).toEqual([resolve(stateDir, 'skills'), resolve(openclawStateDir, 'skills')])
     expect(labels[resolve(stateDir, 'skills')]).toBe('Shared skills')
+    expect(labels[resolve(openclawStateDir, 'skills')]).toBe('OpenClaw: Shared skills')
+  })
+
+  it('supports OpenClaw configuration files', async () => {
+    const base = await mkdtemp(join(tmpdir(), 'clawhub-openclaw-'))
+    const stateDir = join(base, 'openclaw-state')
+    const workspace = join(base, 'openclaw-main')
+    const configPath = join(stateDir, 'openclaw.json')
+
+    process.env.OPENCLAW_STATE_DIR = stateDir
+
+    await mkdir(stateDir, { recursive: true })
+    const config = `{
+      agents: {
+        defaults: { workspace: "${workspace}", },
+      },
+    }`
+    await writeFile(configPath, config, 'utf8')
+
+    const { roots, labels } = await resolveClawdbotSkillRoots()
+    expect(roots).toEqual(
+      expect.arrayContaining([resolve(stateDir, 'skills'), resolve(workspace, 'skills')]),
+    )
+    expect(labels[resolve(stateDir, 'skills')]).toBe('OpenClaw: Shared skills')
+    expect(labels[resolve(workspace, 'skills')]).toBe('OpenClaw: Agent: main')
   })
 })

packages/clawdhub/src/cli/clawdbotConfig.ts

@@ -39,42 +39,25 @@ export async function resolveClawdbotSkillRoots(): Promise<ClawdbotSkillRoots> {
   const roots: string[] = []
   const labels: Record<string, string> = {}
 
-  const stateDir = resolveClawdbotStateDir()
-  const sharedSkills = resolveUserPath(join(stateDir, 'skills'))
+  const clawdbotStateDir = resolveClawdbotStateDir()
+  const sharedSkills = resolveUserPath(join(clawdbotStateDir, 'skills'))
   pushRoot(roots, labels, sharedSkills, 'Shared skills')
 
-  const config = await readClawdbotConfig()
-  if (!config) return { roots, labels }
+  const openclawStateDir = resolveOpenclawStateDir()
+  const openclawShared = resolveUserPath(join(openclawStateDir, 'skills'))
+  pushRoot(roots, labels, openclawShared, 'OpenClaw: Shared skills')
 
-  const mainWorkspace = resolveUserPath(
-    config.agents?.defaults?.workspace ?? config.agent?.workspace ?? '',
-  )
-  if (mainWorkspace) {
-    pushRoot(roots, labels, join(mainWorkspace, 'skills'), 'Agent: main')
+  const [clawdbotConfig, openclawConfig] = await Promise.all([
+    readClawdbotConfig(),
+    readOpenclawConfig(),
+  ])
+  if (!clawdbotConfig && !openclawConfig) return { roots, labels }
+
+  if (clawdbotConfig) {
+    addConfigRoots(clawdbotConfig, roots, labels)
   }
-
-  const listedAgents = config.agents?.list ?? []
-  for (const entry of listedAgents) {
-    const workspace = resolveUserPath(entry?.workspace ?? '')
-    if (!workspace) continue
-    const name = entry?.name?.trim() || entry?.id?.trim() || 'agent'
-    pushRoot(roots, labels, join(workspace, 'skills'), `Agent: ${name}`)
-  }
-
-  const agents = config.routing?.agents ?? {}
-  for (const [agentId, entry] of Object.entries(agents)) {
-    const workspace = resolveUserPath(entry?.workspace ?? '')
-    if (!workspace) continue
-    const name = entry?.name?.trim() || agentId
-    pushRoot(roots, labels, join(workspace, 'skills'), `Agent: ${name}`)
-  }
-
-  const extraDirs = config.skills?.load?.extraDirs ?? []
-  for (const dir of extraDirs) {
-    const resolved = resolveUserPath(String(dir))
-    if (!resolved) continue
-    const label = `Extra: ${basename(resolved) || resolved}`
-    pushRoot(roots, labels, resolved, label)
+  if (openclawConfig) {
+    addConfigRoots(openclawConfig, roots, labels, 'OpenClaw')
   }
 
   return { roots, labels }
@@ -82,18 +65,31 @@ export async function resolveClawdbotSkillRoots(): Promise<ClawdbotSkillRoots> {
 
 export async function resolveClawdbotDefaultWorkspace(): Promise<string | null> {
   const config = await readClawdbotConfig()
-  if (!config) return null
+  const openclawConfig = await readOpenclawConfig()
+  if (!config && !openclawConfig) return null
 
   const defaultsWorkspace = resolveUserPath(
-    config.agents?.defaults?.workspace ?? config.agent?.workspace ?? '',
+    config?.agents?.defaults?.workspace ?? config?.agent?.workspace ?? '',
   )
   if (defaultsWorkspace) return defaultsWorkspace
 
-  const listedAgents = config.agents?.list ?? []
+  const listedAgents = config?.agents?.list ?? []
   const defaultAgent =
     listedAgents.find((entry) => entry.default) ?? listedAgents.find((entry) => entry.id === 'main')
   const listWorkspace = resolveUserPath(defaultAgent?.workspace ?? '')
-  return listWorkspace || null
+  if (listWorkspace) return listWorkspace
+
+  if (!openclawConfig) return null
+  const openclawDefaults = resolveUserPath(
+    openclawConfig.agents?.defaults?.workspace ?? openclawConfig.agent?.workspace ?? '',
+  )
+  if (openclawDefaults) return openclawDefaults
+  const openclawAgents = openclawConfig.agents?.list ?? []
+  const openclawDefaultAgent =
+    openclawAgents.find((entry) => entry.default) ??
+    openclawAgents.find((entry) => entry.id === 'main')
+  const openclawWorkspace = resolveUserPath(openclawDefaultAgent?.workspace ?? '')
+  return openclawWorkspace || null
 }
 
 function resolveClawdbotStateDir() {
@@ -108,6 +104,18 @@ function resolveClawdbotConfigPath() {
   return join(resolveClawdbotStateDir(), 'clawdbot.json')
 }
 
+function resolveOpenclawStateDir() {
+  const override = process.env.OPENCLAW_STATE_DIR?.trim()
+  if (override) return resolveUserPath(override)
+  return join(homedir(), '.openclaw')
+}
+
+function resolveOpenclawConfigPath() {
+  const override = process.env.OPENCLAW_CONFIG_PATH?.trim()
+  if (override) return resolveUserPath(override)
+  return join(resolveOpenclawStateDir(), 'openclaw.json')
+}
+
 function resolveUserPath(input: string) {
   const trimmed = input.trim()
   if (!trimmed) return ''
@@ -118,8 +126,16 @@ function resolveUserPath(input: string) {
 }
 
 async function readClawdbotConfig(): Promise<ClawdbotConfig | null> {
+  return readConfigFile(resolveClawdbotConfigPath())
+}
+
+async function readOpenclawConfig(): Promise<ClawdbotConfig | null> {
+  return readConfigFile(resolveOpenclawConfigPath())
+}
+
+async function readConfigFile(path: string): Promise<ClawdbotConfig | null> {
   try {
-    const raw = await readFile(resolveClawdbotConfigPath(), 'utf8')
+    const raw = await readFile(path, 'utf8')
     const parsed = JSON5.parse(raw)
     if (!parsed || typeof parsed !== 'object') return null
     return parsed as ClawdbotConfig
@@ -128,6 +144,46 @@ async function readClawdbotConfig(): Promise<ClawdbotConfig | null> {
   }
 }
 
+function addConfigRoots(
+  config: ClawdbotConfig,
+  roots: string[],
+  labels: Record<string, string>,
+  labelPrefix?: string,
+) {
+  const prefix = labelPrefix ? `${labelPrefix}: ` : ''
+
+  const mainWorkspace = resolveUserPath(
+    config.agents?.defaults?.workspace ?? config.agent?.workspace ?? '',
+  )
+  if (mainWorkspace) {
+    pushRoot(roots, labels, join(mainWorkspace, 'skills'), `${prefix}Agent: main`)
+  }
+
+  const listedAgents = config.agents?.list ?? []
+  for (const entry of listedAgents) {
+    const workspace = resolveUserPath(entry?.workspace ?? '')
+    if (!workspace) continue
+    const name = entry?.name?.trim() || entry?.id?.trim() || 'agent'
+    pushRoot(roots, labels, join(workspace, 'skills'), `${prefix}Agent: ${name}`)
+  }
+
+  const agents = config.routing?.agents ?? {}
+  for (const [agentId, entry] of Object.entries(agents)) {
+    const workspace = resolveUserPath(entry?.workspace ?? '')
+    if (!workspace) continue
+    const name = entry?.name?.trim() || agentId
+    pushRoot(roots, labels, join(workspace, 'skills'), `${prefix}Agent: ${name}`)
+  }
+
+  const extraDirs = config.skills?.load?.extraDirs ?? []
+  for (const dir of extraDirs) {
+    const resolved = resolveUserPath(String(dir))
+    if (!resolved) continue
+    const label = `${prefix}Extra: ${basename(resolved) || resolved}`
+    pushRoot(roots, labels, resolved, label)
+  }
+}
+
 function pushRoot(roots: string[], labels: Record<string, string>, root: string, label?: string) {
   const resolved = resolveUserPath(root)
   if (!resolved) return

packages/clawdhub/src/cli/commands/auth.ts

@@ -37,7 +37,8 @@ export async function cmdLoginFlow(
 
   const result = await receiver.waitForResult()
   const registry = result.registry?.trim() || opts.registry
-  await cmdLogin({ ...opts, registry }, result.token, inputAllowed)
+  const registrySource = result.registry?.trim() ? 'cli' : opts.registrySource
+  await cmdLogin({ ...opts, registry, registrySource }, result.token, inputAllowed)
 }
 
 export async function cmdLogin(
@@ -47,7 +48,7 @@ export async function cmdLogin(
 ) {
   if (!tokenFlag && !inputAllowed) fail('Token required (use --token or remove --no-input)')
 
-  const token = tokenFlag || (await promptHidden('ClawdHub token: '))
+  const token = tokenFlag || (await promptHidden('ClawHub token: '))
   if (!token) fail('Token required')
 
   const registry = await getRegistry(opts, { cache: true })
@@ -79,7 +80,7 @@ export async function cmdLogout(opts: GlobalOpts) {
 export async function cmdWhoami(opts: GlobalOpts) {
   const cfg = await readGlobalConfig()
   const token = cfg?.token
-  if (!token) fail('Not logged in. Run: clawdhub login')
+  if (!token) fail('Not logged in. Run: clawhub login')
   const registry = await getRegistry(opts, { cache: true })
 
   const spinner = createSpinner('Checking token')

packages/clawdhub/src/cli/commands/delete.test.ts

@@ -4,11 +4,11 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { GlobalOpts } from '../types'
 
 vi.mock('../../config.js', () => ({
-  readGlobalConfig: vi.fn(async () => ({ registry: 'https://clawdhub.com', token: 'tkn' })),
+  readGlobalConfig: vi.fn(async () => ({ registry: 'https://clawhub.ai', token: 'tkn' })),
 }))
 
 vi.mock('../registry.js', () => ({
-  getRegistry: vi.fn(async () => 'https://clawdhub.com'),
+  getRegistry: vi.fn(async () => 'https://clawhub.ai'),
 }))
 
 const mockApiRequest = vi.fn()
@@ -29,14 +29,14 @@ vi.mock('../ui.js', () => ({
   promptConfirm: vi.fn(async () => true),
 }))
 
-const { cmdDeleteSkill, cmdUndeleteSkill } = await import('./delete')
+const { cmdDeleteSkill, cmdHideSkill, cmdUndeleteSkill, cmdUnhideSkill } = await import('./delete')
 
 function makeOpts(): GlobalOpts {
   return {
     workdir: '/work',
     dir: '/work/skills',
-    site: 'https://clawdhub.com',
-    registry: 'https://clawdhub.com',
+    site: 'https://clawhub.ai',
+    registry: 'https://clawhub.ai',
     registrySource: 'default',
   }
 }
@@ -49,6 +49,8 @@ describe('delete/undelete', () => {
   it('requires --yes when input is disabled', async () => {
     await expect(cmdDeleteSkill(makeOpts(), 'demo', {}, false)).rejects.toThrow(/--yes/i)
     await expect(cmdUndeleteSkill(makeOpts(), 'demo', {}, false)).rejects.toThrow(/--yes/i)
+    await expect(cmdHideSkill(makeOpts(), 'demo', {}, false)).rejects.toThrow(/--yes/i)
+    await expect(cmdUnhideSkill(makeOpts(), 'demo', {}, false)).rejects.toThrow(/--yes/i)
   })
 
   it('calls delete endpoint with --yes', async () => {
@@ -70,4 +72,20 @@ describe('delete/undelete', () => {
       expect.anything(),
     )
   })
+
+  it('supports hide/unhide aliases', async () => {
+    mockApiRequest.mockResolvedValue({ ok: true })
+    await cmdHideSkill(makeOpts(), 'demo', { yes: true }, false)
+    await cmdUnhideSkill(makeOpts(), 'demo', { yes: true }, false)
+    expect(mockApiRequest).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ method: 'DELETE', path: '/api/v1/skills/demo' }),
+      expect.anything(),
+    )
+    expect(mockApiRequest).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ method: 'POST', path: '/api/v1/skills/demo/undelete' }),
+      expect.anything(),
+    )
+  })
 })

packages/clawdhub/src/cli/commands/delete.ts

@@ -5,10 +5,45 @@ import { getRegistry } from '../registry.js'
 import type { GlobalOpts } from '../types.js'
 import { createSpinner, fail, formatError, isInteractive, promptConfirm } from '../ui.js'
 
+type SkillActionLabels = {
+  verb: string
+  progress: string
+  past: string
+  promptSuffix?: string
+}
+
+const deleteLabels: SkillActionLabels = {
+  verb: 'Delete',
+  progress: 'Deleting',
+  past: 'Deleted',
+  promptSuffix: 'soft delete, requires moderator/admin',
+}
+
+const undeleteLabels: SkillActionLabels = {
+  verb: 'Undelete',
+  progress: 'Undeleting',
+  past: 'Undeleted',
+  promptSuffix: 'requires moderator/admin',
+}
+
+const hideLabels: SkillActionLabels = {
+  verb: 'Hide',
+  progress: 'Hiding',
+  past: 'Hidden',
+  promptSuffix: 'requires moderator/admin',
+}
+
+const unhideLabels: SkillActionLabels = {
+  verb: 'Unhide',
+  progress: 'Unhiding',
+  past: 'Unhidden',
+  promptSuffix: 'requires moderator/admin',
+}
+
 async function requireToken() {
   const cfg = await readGlobalConfig()
   const token = cfg?.token
-  if (!token) fail('Not logged in. Run: clawdhub login')
+  if (!token) fail('Not logged in. Run: clawhub login')
   return token
 }
 
@@ -17,6 +52,7 @@ export async function cmdDeleteSkill(
   slugArg: string,
   options: { yes?: boolean },
   inputAllowed: boolean,
+  labels: SkillActionLabels = deleteLabels,
 ) {
   const slug = slugArg.trim().toLowerCase()
   if (!slug) fail('Slug required')
@@ -24,20 +60,20 @@ export async function cmdDeleteSkill(
 
   if (!options.yes) {
     if (!allowPrompt) fail('Pass --yes (no input)')
-    const ok = await promptConfirm(`Delete ${slug}? (soft delete)`)
+    const ok = await promptConfirm(formatPrompt(labels, slug))
     if (!ok) return
   }
 
   const token = await requireToken()
   const registry = await getRegistry(opts, { cache: true })
-  const spinner = createSpinner(`Deleting ${slug}`)
+  const spinner = createSpinner(`${labels.progress} ${slug}`)
   try {
     const result = await apiRequest(
       registry,
       { method: 'DELETE', path: `${ApiRoutes.skills}/${encodeURIComponent(slug)}`, token },
       ApiV1DeleteResponseSchema,
     )
-    spinner.succeed(`OK. Deleted ${slug}`)
+    spinner.succeed(`OK. ${labels.past} ${slug}`)
     return parseArk(ApiV1DeleteResponseSchema, result, 'Delete response')
   } catch (error) {
     spinner.fail(formatError(error))
@@ -50,6 +86,7 @@ export async function cmdUndeleteSkill(
   slugArg: string,
   options: { yes?: boolean },
   inputAllowed: boolean,
+  labels: SkillActionLabels = undeleteLabels,
 ) {
   const slug = slugArg.trim().toLowerCase()
   if (!slug) fail('Slug required')
@@ -57,13 +94,13 @@ export async function cmdUndeleteSkill(
 
   if (!options.yes) {
     if (!allowPrompt) fail('Pass --yes (no input)')
-    const ok = await promptConfirm(`Undelete ${slug}?`)
+    const ok = await promptConfirm(formatPrompt(labels, slug))
     if (!ok) return
   }
 
   const token = await requireToken()
   const registry = await getRegistry(opts, { cache: true })
-  const spinner = createSpinner(`Undeleting ${slug}`)
+  const spinner = createSpinner(`${labels.progress} ${slug}`)
   try {
     const result = await apiRequest(
       registry,
@@ -74,10 +111,33 @@ export async function cmdUndeleteSkill(
       },
       ApiV1DeleteResponseSchema,
     )
-    spinner.succeed(`OK. Undeleted ${slug}`)
+    spinner.succeed(`OK. ${labels.past} ${slug}`)
     return parseArk(ApiV1DeleteResponseSchema, result, 'Undelete response')
   } catch (error) {
     spinner.fail(formatError(error))
     throw error
   }
 }
+
+export async function cmdHideSkill(
+  opts: GlobalOpts,
+  slugArg: string,
+  options: { yes?: boolean },
+  inputAllowed: boolean,
+) {
+  return cmdDeleteSkill(opts, slugArg, options, inputAllowed, hideLabels)
+}
+
+export async function cmdUnhideSkill(
+  opts: GlobalOpts,
+  slugArg: string,
+  options: { yes?: boolean },
+  inputAllowed: boolean,
+) {
+  return cmdUndeleteSkill(opts, slugArg, options, inputAllowed, unhideLabels)
+}
+
+function formatPrompt(labels: SkillActionLabels, slug: string) {
+  const suffix = labels.promptSuffix ? ` (${labels.promptSuffix})` : ''
+  return `${labels.verb} ${slug}?${suffix}`
+}

packages/clawdhub/src/cli/commands/inspect.test.ts

@@ -0,0 +1,123 @@
+/* @vitest-environment node */
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ApiRoutes } from '../../schema/index.js'
+import type { GlobalOpts } from '../types'
+
+const mockApiRequest = vi.fn()
+const mockFetchText = vi.fn()
+vi.mock('../../http.js', () => ({
+  apiRequest: (...args: unknown[]) => mockApiRequest(...args),
+  fetchText: (...args: unknown[]) => mockFetchText(...args),
+}))
+
+const mockGetRegistry = vi.fn(async () => 'https://clawhub.ai')
+vi.mock('../registry.js', () => ({
+  getRegistry: () => mockGetRegistry(),
+}))
+
+const mockSpinner = {
+  stop: vi.fn(),
+  fail: vi.fn(),
+  start: vi.fn(),
+  succeed: vi.fn(),
+  isSpinning: false,
+  text: '',
+}
+vi.mock('../ui.js', () => ({
+  createSpinner: vi.fn(() => mockSpinner),
+  fail: (message: string) => {
+    throw new Error(message)
+  },
+  formatError: (error: unknown) => (error instanceof Error ? error.message : String(error)),
+}))
+
+const { cmdInspect } = await import('./inspect')
+
+const mockLog = vi.spyOn(console, 'log').mockImplementation(() => {})
+const mockWrite = vi.spyOn(process.stdout, 'write').mockImplementation(() => true)
+
+function makeOpts(): GlobalOpts {
+  return {
+    workdir: '/work',
+    dir: '/work/skills',
+    site: 'https://clawhub.ai',
+    registry: 'https://clawhub.ai',
+    registrySource: 'default',
+  }
+}
+
+afterEach(() => {
+  vi.clearAllMocks()
+  mockLog.mockClear()
+  mockWrite.mockClear()
+})
+
+describe('cmdInspect', () => {
+  it('fetches latest version files when --files is set', async () => {
+    mockApiRequest
+      .mockResolvedValueOnce({
+        skill: {
+          slug: 'demo',
+          displayName: 'Demo',
+          summary: null,
+          tags: { latest: '1.2.3' },
+          stats: {},
+          createdAt: 1,
+          updatedAt: 2,
+        },
+        latestVersion: { version: '1.2.3', createdAt: 3, changelog: 'init' },
+        owner: null,
+      })
+      .mockResolvedValueOnce({
+        skill: { slug: 'demo', displayName: 'Demo' },
+        version: { version: '1.2.3', createdAt: 3, changelog: 'init', files: [] },
+      })
+
+    await cmdInspect(makeOpts(), 'demo', { files: true })
+
+    const firstArgs = mockApiRequest.mock.calls[0]?.[1]
+    const secondArgs = mockApiRequest.mock.calls[1]?.[1]
+    expect(firstArgs?.path).toBe(`${ApiRoutes.skills}/${encodeURIComponent('demo')}`)
+    expect(secondArgs?.path).toBe(
+      `${ApiRoutes.skills}/${encodeURIComponent('demo')}/versions/${encodeURIComponent('1.2.3')}`,
+    )
+  })
+
+  it('uses tag param when fetching a file', async () => {
+    mockApiRequest
+      .mockResolvedValueOnce({
+        skill: {
+          slug: 'demo',
+          displayName: 'Demo',
+          summary: null,
+          tags: { latest: '2.0.0' },
+          stats: {},
+          createdAt: 1,
+          updatedAt: 2,
+        },
+        latestVersion: { version: '2.0.0', createdAt: 3, changelog: 'init' },
+        owner: null,
+      })
+      .mockResolvedValueOnce({
+        skill: { slug: 'demo', displayName: 'Demo' },
+        version: { version: '2.0.0', createdAt: 3, changelog: 'init', files: [] },
+      })
+    mockFetchText.mockResolvedValue('content')
+
+    await cmdInspect(makeOpts(), 'demo', { file: 'SKILL.md', tag: 'latest' })
+
+    const fetchArgs = mockFetchText.mock.calls[0]?.[1]
+    const url = new URL(String(fetchArgs?.url))
+    expect(url.pathname).toBe('/api/v1/skills/demo/file')
+    expect(url.searchParams.get('path')).toBe('SKILL.md')
+    expect(url.searchParams.get('tag')).toBe('latest')
+    expect(url.searchParams.get('version')).toBeNull()
+  })
+
+  it('rejects when both version and tag are provided', async () => {
+    await expect(
+      cmdInspect(makeOpts(), 'demo', { version: '1.0.0', tag: 'latest' }),
+    ).rejects.toThrow('Use either --version or --tag')
+  })
+})

packages/clawdhub/src/cli/commands/inspect.ts

@@ -0,0 +1,291 @@
+import { apiRequest, fetchText } from '../../http.js'
+import {
+  ApiRoutes,
+  ApiV1SkillResponseSchema,
+  ApiV1SkillVersionListResponseSchema,
+  ApiV1SkillVersionResponseSchema,
+} from '../../schema/index.js'
+import { getRegistry } from '../registry.js'
+import type { GlobalOpts } from '../types.js'
+import { createSpinner, fail, formatError } from '../ui.js'
+
+type InspectOptions = {
+  version?: string
+  tag?: string
+  versions?: boolean
+  limit?: number
+  files?: boolean
+  file?: string
+  json?: boolean
+}
+
+type FileEntry = {
+  path: string
+  size: number | null
+  sha256: string | null
+  contentType: string | null
+}
+
+export async function cmdInspect(opts: GlobalOpts, slug: string, options: InspectOptions = {}) {
+  const trimmed = slug.trim()
+  if (!trimmed) fail('Slug required')
+  if (options.version && options.tag) fail('Use either --version or --tag')
+
+  const registry = await getRegistry(opts, { cache: true })
+  const spinner = createSpinner('Fetching skill')
+  try {
+    const skillResult = await apiRequest(
+      registry,
+      { method: 'GET', path: `${ApiRoutes.skills}/${encodeURIComponent(trimmed)}` },
+      ApiV1SkillResponseSchema,
+    )
+
+    if (!skillResult.skill) {
+      spinner.fail('Skill not found')
+      return
+    }
+
+    const skill = skillResult.skill
+    const tags = normalizeTags(skill.tags)
+    const latestVersion = skillResult.latestVersion?.version ?? tags.latest ?? null
+    const taggedVersion = options.tag ? (tags[options.tag] ?? null) : null
+    if (options.tag && !taggedVersion) {
+      spinner.fail(`Unknown tag "${options.tag}"`)
+      return
+    }
+    const requestedVersion = options.version ?? taggedVersion ?? null
+
+    let versionResult: { version: unknown; skill: unknown } | null = null
+    if (options.files || options.file || options.version || options.tag) {
+      const targetVersion = requestedVersion ?? latestVersion
+      if (!targetVersion) fail('Could not resolve latest version')
+      spinner.text = `Fetching ${trimmed}@${targetVersion}`
+      versionResult = await apiRequest(
+        registry,
+        {
+          method: 'GET',
+          path: `${ApiRoutes.skills}/${encodeURIComponent(trimmed)}/versions/${encodeURIComponent(
+            targetVersion,
+          )}`,
+        },
+        ApiV1SkillVersionResponseSchema,
+      )
+    }
+
+    let versionsList: { items?: unknown[]; nextCursor?: string | null } | null = null
+    if (options.versions) {
+      const limit = clampLimit(options.limit ?? 25, 25)
+      const url = new URL(`${ApiRoutes.skills}/${encodeURIComponent(trimmed)}/versions`, registry)
+      url.searchParams.set('limit', String(limit))
+      spinner.text = `Fetching versions (${limit})`
+      versionsList = await apiRequest(
+        registry,
+        { method: 'GET', url: url.toString() },
+        ApiV1SkillVersionListResponseSchema,
+      )
+    }
+
+    let fileContent: string | null = null
+    if (options.file) {
+      const url = new URL(`${ApiRoutes.skills}/${encodeURIComponent(trimmed)}/file`, registry)
+      url.searchParams.set('path', options.file)
+      if (options.version) {
+        url.searchParams.set('version', options.version)
+      } else if (options.tag) {
+        url.searchParams.set('tag', options.tag)
+      } else if (latestVersion) {
+        url.searchParams.set('version', latestVersion)
+      }
+      spinner.text = `Fetching ${options.file}`
+      fileContent = await fetchText(registry, { url: url.toString() })
+    }
+
+    spinner.stop()
+
+    const output = {
+      skill: skillResult.skill,
+      latestVersion: skillResult.latestVersion,
+      owner: skillResult.owner,
+      version: versionResult?.version ?? null,
+      versions: versionsList?.items ?? null,
+      file: options.file ? { path: options.file, content: fileContent } : null,
+    }
+
+    if (options.json) {
+      console.log(JSON.stringify(output, null, 2))
+      return
+    }
+
+    const shouldPrintMeta = !options.file || options.files || options.versions || options.version
+    if (shouldPrintMeta) {
+      printSkillSummary({
+        skill,
+        latestVersion: skillResult.latestVersion,
+        owner: skillResult.owner,
+      })
+    }
+
+    if (shouldPrintMeta && versionResult?.version) {
+      printVersionSummary(versionResult.version)
+    }
+
+    if (versionsList?.items && Array.isArray(versionsList.items)) {
+      if (versionsList.items.length === 0) {
+        console.log('No versions found.')
+      } else {
+        console.log('Versions:')
+        for (const item of versionsList.items) {
+          console.log(formatVersionLine(item))
+        }
+      }
+    }
+
+    if (versionResult?.version) {
+      const files = normalizeFiles((versionResult.version as { files?: unknown }).files)
+      if (options.files) {
+        if (files.length === 0) {
+          console.log('No files found.')
+        } else {
+          console.log('Files:')
+          for (const file of files) {
+            console.log(formatFileLine(file))
+          }
+        }
+      }
+    }
+
+    if (options.file && fileContent !== null) {
+      if (shouldPrintMeta) console.log(`\n${options.file}:\n`)
+      process.stdout.write(fileContent)
+      if (!fileContent.endsWith('\n')) process.stdout.write('\n')
+    }
+  } catch (error) {
+    spinner.fail(formatError(error))
+    throw error
+  }
+}
+
+function printSkillSummary(result: {
+  skill: {
+    slug: string
+    displayName: string
+    summary?: string | null
+    tags?: unknown
+    stats?: unknown
+    createdAt: number
+    updatedAt: number
+  }
+  latestVersion?: { version: string; createdAt: number; changelog: string } | null
+  owner?: { handle?: string | null; displayName?: string | null; image?: string | null } | null
+}) {
+  const { skill } = result
+  console.log(`${skill.slug}  ${skill.displayName}`)
+  if (skill.summary) console.log(`Summary: ${skill.summary}`)
+  const owner = result.owner?.handle || result.owner?.displayName
+  if (owner) console.log(`Owner: ${owner}`)
+  console.log(`Created: ${formatTimestamp(skill.createdAt)}`)
+  console.log(`Updated: ${formatTimestamp(skill.updatedAt)}`)
+  if (result.latestVersion?.version) {
+    console.log(`Latest: ${result.latestVersion.version}`)
+  }
+  const tags = normalizeTags(skill.tags)
+  const tagEntries = Object.entries(tags)
+  if (tagEntries.length > 0) {
+    console.log(`Tags: ${tagEntries.map(([tag, version]) => `${tag}=${version}`).join(', ')}`)
+  }
+}
+
+function printVersionSummary(version: unknown) {
+  if (!version || typeof version !== 'object') return
+  const entry = version as { version?: unknown; createdAt?: unknown; changelog?: unknown }
+  const value = typeof entry.version === 'string' ? entry.version : null
+  if (!value) return
+  console.log(`Selected: ${value}`)
+  if (typeof entry.createdAt === 'number') {
+    console.log(`Selected At: ${formatTimestamp(entry.createdAt)}`)
+  }
+  if (typeof entry.changelog === 'string' && entry.changelog.trim()) {
+    console.log(`Changelog: ${truncate(entry.changelog, 120)}`)
+  }
+}
+
+function normalizeTags(tags: unknown): Record<string, string> {
+  if (!tags || typeof tags !== 'object') return {}
+  const entries = Object.entries(tags as Record<string, unknown>)
+  const resolved: Record<string, string> = {}
+  for (const [tag, version] of entries) {
+    if (typeof version === 'string') resolved[tag] = version
+  }
+  return resolved
+}
+
+function normalizeFiles(files: unknown): FileEntry[] {
+  if (!Array.isArray(files)) return []
+  return files
+    .map((file) => {
+      if (!file || typeof file !== 'object') return null
+      const entry = file as {
+        path?: unknown
+        size?: unknown
+        sha256?: unknown
+        contentType?: unknown
+      }
+      if (typeof entry.path !== 'string') return null
+      const size = typeof entry.size === 'number' ? entry.size : Number(entry.size)
+      const sha256 = typeof entry.sha256 === 'string' ? entry.sha256 : null
+      const contentType = typeof entry.contentType === 'string' ? entry.contentType : null
+      return {
+        path: entry.path,
+        size: Number.isFinite(size) ? size : null,
+        sha256,
+        contentType,
+      }
+    })
+    .filter((entry): entry is FileEntry => Boolean(entry))
+}
+
+function formatVersionLine(item: unknown) {
+  if (!item || typeof item !== 'object') return '-'
+  const entry = item as { version?: unknown; createdAt?: unknown; changelog?: unknown }
+  const version = typeof entry.version === 'string' ? entry.version : '?'
+  const createdAt =
+    typeof entry.createdAt === 'number' ? formatTimestamp(entry.createdAt) : 'unknown'
+  const changelog = typeof entry.changelog === 'string' ? entry.changelog : ''
+  const snippet = changelog ? `  ${truncate(changelog, 80)}` : ''
+  return `${version}  ${createdAt}${snippet}`
+}
+
+function formatFileLine(file: FileEntry) {
+  const size = file.size === null ? '?' : formatBytes(file.size)
+  const sha = file.sha256 ?? '?'
+  const type = file.contentType ? `  ${file.contentType}` : ''
+  return `${file.path}  ${size}  ${sha}${type}`
+}
+
+function formatTimestamp(timestamp: number) {
+  if (!Number.isFinite(timestamp)) return 'unknown'
+  return new Date(timestamp).toISOString()
+}
+
+function formatBytes(bytes: number) {
+  if (!Number.isFinite(bytes)) return '?'
+  const units = ['B', 'KB', 'MB', 'GB']
+  let value = bytes
+  let index = 0
+  while (value >= 1024 && index < units.length - 1) {
+    value /= 1024
+    index += 1
+  }
+  const rounded = value >= 10 ? Math.round(value) : Math.round(value * 10) / 10
+  return `${rounded}${units[index]}`
+}
+
+function clampLimit(limit: number, fallback: number) {
+  if (!Number.isFinite(limit)) return fallback
+  return Math.min(Math.max(1, Math.round(limit)), 200)
+}
+
+function truncate(str: string, maxLen: number) {
+  if (str.length <= maxLen) return str
+  return `${str.slice(0, maxLen - 3)}...`
+}

packages/clawdhub/src/cli/commands/moderation.test.ts

@@ -0,0 +1,199 @@
+/* @vitest-environment node */
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { GlobalOpts } from '../types'
+
+vi.mock('../../config.js', () => ({
+  readGlobalConfig: vi.fn(async () => ({ registry: 'https://clawhub.ai', token: 'tkn' })),
+}))
+
+vi.mock('../registry.js', () => ({
+  getRegistry: vi.fn(async () => 'https://clawhub.ai'),
+}))
+
+const mockApiRequest = vi.fn()
+vi.mock('../../http.js', () => ({
+  apiRequest: (registry: unknown, args: unknown, schema?: unknown) =>
+    mockApiRequest(registry, args, schema),
+}))
+
+vi.mock('../ui.js', () => ({
+  createSpinner: vi.fn(() => ({ succeed: vi.fn(), fail: vi.fn() })),
+  fail: (message: string) => {
+    throw new Error(message)
+  },
+  formatError: (error: unknown) => (error instanceof Error ? error.message : String(error)),
+  isInteractive: () => false,
+  promptConfirm: vi.fn(async () => true),
+}))
+
+const { cmdBanUser, cmdSetRole } = await import('./moderation')
+
+function makeOpts(): GlobalOpts {
+  return {
+    workdir: '/work',
+    dir: '/work/skills',
+    site: 'https://clawhub.ai',
+    registry: 'https://clawhub.ai',
+    registrySource: 'default',
+  }
+}
+
+afterEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('cmdBanUser', () => {
+  it('requires --yes when input is disabled', async () => {
+    await expect(cmdBanUser(makeOpts(), 'demo', {}, false)).rejects.toThrow(/--yes/i)
+  })
+
+  it('posts handle payload', async () => {
+    mockApiRequest.mockResolvedValueOnce({ ok: true, alreadyBanned: false, deletedSkills: 1 })
+    await cmdBanUser(makeOpts(), 'hightower6eu', { yes: true }, false)
+    expect(mockApiRequest).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        method: 'POST',
+        path: '/api/v1/users/ban',
+        body: { handle: 'hightower6eu' },
+      }),
+      expect.anything(),
+    )
+  })
+
+  it('includes reason when provided', async () => {
+    mockApiRequest.mockResolvedValueOnce({ ok: true, alreadyBanned: false, deletedSkills: 0 })
+    await cmdBanUser(
+      makeOpts(),
+      'hightower6eu',
+      { yes: true, reason: 'malware distribution' },
+      false,
+    )
+    expect(mockApiRequest).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        method: 'POST',
+        path: '/api/v1/users/ban',
+        body: { handle: 'hightower6eu', reason: 'malware distribution' },
+      }),
+      expect.anything(),
+    )
+  })
+
+  it('posts user id payload when --id is set', async () => {
+    mockApiRequest.mockResolvedValueOnce({ ok: true, alreadyBanned: false, deletedSkills: 0 })
+    await cmdBanUser(makeOpts(), 'user_123', { yes: true, id: true }, false)
+    expect(mockApiRequest).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        method: 'POST',
+        path: '/api/v1/users/ban',
+        body: { userId: 'user_123' },
+      }),
+      expect.anything(),
+    )
+  })
+
+  it('resolves user via fuzzy search', async () => {
+    mockApiRequest
+      .mockResolvedValueOnce({
+        items: [
+          {
+            userId: 'users_123',
+            handle: 'moonshine-100rze',
+            displayName: null,
+            name: null,
+            role: 'user',
+          },
+        ],
+        total: 1,
+      })
+      .mockResolvedValueOnce({ ok: true, alreadyBanned: false, deletedSkills: 0 })
+    await cmdBanUser(makeOpts(), 'moonshine-100rze', { yes: true, fuzzy: true }, false)
+    expect(mockApiRequest).toHaveBeenNthCalledWith(
+      1,
+      expect.anything(),
+      expect.objectContaining({
+        method: 'GET',
+        path: expect.stringContaining('/api/v1/users?'),
+      }),
+      expect.anything(),
+    )
+    expect(mockApiRequest).toHaveBeenNthCalledWith(
+      2,
+      expect.anything(),
+      expect.objectContaining({
+        method: 'POST',
+        path: '/api/v1/users/ban',
+        body: { userId: 'users_123' },
+      }),
+      expect.anything(),
+    )
+  })
+
+  it('fails fuzzy search with multiple matches when not interactive', async () => {
+    mockApiRequest.mockResolvedValueOnce({
+      items: [
+        {
+          userId: 'users_1',
+          handle: 'moonshine-100rze',
+          displayName: null,
+          name: null,
+          role: null,
+        },
+        {
+          userId: 'users_2',
+          handle: 'moonshine-100rze2',
+          displayName: null,
+          name: null,
+          role: null,
+        },
+      ],
+      total: 2,
+    })
+    await expect(
+      cmdBanUser(makeOpts(), 'moonshine', { yes: true, fuzzy: true }, false),
+    ).rejects.toThrow(/multiple users matched/i)
+  })
+})
+
+describe('cmdSetRole', () => {
+  it('requires --yes when input is disabled', async () => {
+    await expect(cmdSetRole(makeOpts(), 'demo', 'moderator', {}, false)).rejects.toThrow(/--yes/i)
+  })
+
+  it('rejects invalid roles', async () => {
+    await expect(cmdSetRole(makeOpts(), 'demo', 'owner', { yes: true }, false)).rejects.toThrow(
+      /role/i,
+    )
+  })
+
+  it('posts handle payload', async () => {
+    mockApiRequest.mockResolvedValueOnce({ ok: true, role: 'moderator' })
+    await cmdSetRole(makeOpts(), 'hightower6eu', 'moderator', { yes: true }, false)
+    expect(mockApiRequest).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        method: 'POST',
+        path: '/api/v1/users/role',
+        body: { handle: 'hightower6eu', role: 'moderator' },
+      }),
+      expect.anything(),
+    )
+  })
+
+  it('posts user id payload when --id is set', async () => {
+    mockApiRequest.mockResolvedValueOnce({ ok: true, role: 'admin' })
+    await cmdSetRole(makeOpts(), 'user_123', 'admin', { yes: true, id: true }, false)
+    expect(mockApiRequest).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        method: 'POST',
+        path: '/api/v1/users/role',
+        body: { userId: 'user_123', role: 'admin' },
+      }),
+      expect.anything(),
+    )
+  })
+})

packages/clawdhub/src/cli/commands/moderation.ts

@@ -0,0 +1,235 @@
+import { isCancel, select } from '@clack/prompts'
+import { readGlobalConfig } from '../../config.js'
+import { apiRequest } from '../../http.js'
+import {
+  ApiRoutes,
+  ApiV1BanUserResponseSchema,
+  ApiV1SetRoleResponseSchema,
+  ApiV1UserSearchResponseSchema,
+  parseArk,
+} from '../../schema/index.js'
+import { getRegistry } from '../registry.js'
+import type { GlobalOpts } from '../types.js'
+import { createSpinner, fail, formatError, isInteractive, promptConfirm } from '../ui.js'
+
+async function requireToken() {
+  const cfg = await readGlobalConfig()
+  const token = cfg?.token
+  if (!token) fail('Not logged in. Run: clawhub login')
+  return token
+}
+
+export async function cmdBanUser(
+  opts: GlobalOpts,
+  identifierArg: string,
+  options: { yes?: boolean; id?: boolean; fuzzy?: boolean; reason?: string },
+  inputAllowed: boolean,
+) {
+  const raw = identifierArg.trim()
+  if (!raw) fail('Handle or user id required')
+
+  const reason = options.reason?.trim() || undefined
+
+  const token = await requireToken()
+  const registry = await getRegistry(opts, { cache: true })
+  const allowPrompt = isInteractive() && inputAllowed !== false
+  const resolved = await resolveUserIdentifier(
+    registry,
+    token,
+    raw,
+    { id: options.id, fuzzy: options.fuzzy },
+    allowPrompt,
+  )
+  if (!resolved) return
+  if (!options.yes) {
+    if (!allowPrompt) fail('Pass --yes (no input)')
+    const ok = await promptConfirm(
+      `Ban ${resolved.label}? (requires moderator/admin; deletes owned skills)`,
+    )
+    if (!ok) return
+  }
+
+  const spinner = createSpinner(`Banning ${resolved.label}`)
+  try {
+    const result = await apiRequest(
+      registry,
+      {
+        method: 'POST',
+        path: `${ApiRoutes.users}/ban`,
+        token,
+        body: resolved.userId
+          ? { userId: resolved.userId, reason }
+          : { handle: resolved.handle, reason },
+      },
+      ApiV1BanUserResponseSchema,
+    )
+    const parsed = parseArk(ApiV1BanUserResponseSchema, result, 'Ban user response')
+    if (parsed.alreadyBanned) {
+      spinner.succeed(`OK. ${resolved.label} already banned`)
+      return parsed
+    }
+    spinner.succeed(`OK. Banned ${resolved.label} (${formatDeletedSkills(parsed.deletedSkills)})`)
+    return parsed
+  } catch (error) {
+    spinner.fail(formatError(error))
+    throw error
+  }
+}
+
+export async function cmdSetRole(
+  opts: GlobalOpts,
+  identifierArg: string,
+  roleArg: string,
+  options: { yes?: boolean; id?: boolean; fuzzy?: boolean },
+  inputAllowed: boolean,
+) {
+  const raw = identifierArg.trim()
+  if (!raw) fail('Handle or user id required')
+  const role = normalizeRole(roleArg)
+
+  const token = await requireToken()
+  const registry = await getRegistry(opts, { cache: true })
+  const allowPrompt = isInteractive() && inputAllowed !== false
+  const resolved = await resolveUserIdentifier(
+    registry,
+    token,
+    raw,
+    { id: options.id, fuzzy: options.fuzzy },
+    allowPrompt,
+  )
+  if (!resolved) return
+  if (!options.yes) {
+    if (!allowPrompt) fail('Pass --yes (no input)')
+    const ok = await promptConfirm(`Set role for ${resolved.label} to ${role}? (admin only)`)
+    if (!ok) return
+  }
+
+  const spinner = createSpinner(`Setting role for ${resolved.label}`)
+  try {
+    const result = await apiRequest(
+      registry,
+      {
+        method: 'POST',
+        path: `${ApiRoutes.users}/role`,
+        token,
+        body: resolved.userId
+          ? { userId: resolved.userId, role }
+          : { handle: resolved.handle, role },
+      },
+      ApiV1SetRoleResponseSchema,
+    )
+    const parsed = parseArk(ApiV1SetRoleResponseSchema, result, 'Set role response')
+    spinner.succeed(`OK. ${resolved.label} is now ${parsed.role}`)
+    return parsed
+  } catch (error) {
+    spinner.fail(formatError(error))
+    throw error
+  }
+}
+
+function normalizeHandle(value: string) {
+  const trimmed = value.trim()
+  return trimmed.startsWith('@') ? trimmed.slice(1).toLowerCase() : trimmed.toLowerCase()
+}
+
+type ResolvedUser = {
+  handle: string | null
+  userId: string | null
+  label: string
+}
+
+type UserSearchItem = {
+  userId: string
+  handle: string | null
+  displayName?: string | null
+  name?: string | null
+  role?: 'admin' | 'moderator' | 'user' | null
+}
+
+async function resolveUserIdentifier(
+  registry: string,
+  token: string,
+  raw: string,
+  options: { id?: boolean; fuzzy?: boolean },
+  allowPrompt: boolean,
+): Promise<ResolvedUser | null> {
+  const usesId = Boolean(options.id)
+  if (usesId) {
+    return { handle: null, userId: raw, label: raw }
+  }
+
+  const handle = normalizeHandle(raw)
+  if (!options.fuzzy) {
+    return { handle, userId: null, label: `@${handle}` }
+  }
+
+  const matches = await searchUsers(registry, token, raw)
+  if (matches.items.length === 0) {
+    fail(`No users matched "${raw}".`)
+  }
+
+  if (matches.items.length === 1) {
+    const match = matches.items[0] as UserSearchItem
+    return {
+      handle: match.handle ?? null,
+      userId: match.userId,
+      label: formatUserLabel(match),
+    }
+  }
+
+  if (!allowPrompt) {
+    fail(`Multiple users matched "${raw}". Use --id.\n${formatUserList(matches.items)}`)
+  }
+
+  const choice = await select({
+    message: `Select a user for "${raw}"`,
+    options: matches.items.map((item) => ({
+      value: item.userId,
+      label: formatUserLabel(item),
+    })),
+  })
+  if (isCancel(choice)) return null
+  const selected = matches.items.find((item) => item.userId === choice)
+  if (!selected) return null
+  return {
+    handle: selected.handle ?? null,
+    userId: selected.userId,
+    label: formatUserLabel(selected),
+  }
+}
+
+async function searchUsers(registry: string, token: string, query: string) {
+  const url = new URL(ApiRoutes.users, registry)
+  url.searchParams.set('q', query.trim())
+  url.searchParams.set('limit', '10')
+  const result = await apiRequest(
+    registry,
+    { method: 'GET', path: `${url.pathname}?${url.searchParams.toString()}`, token },
+    ApiV1UserSearchResponseSchema,
+  )
+  return parseArk(ApiV1UserSearchResponseSchema, result, 'User search response')
+}
+
+function formatUserLabel(user: UserSearchItem) {
+  const handle = user.handle ? `@${user.handle}` : 'unknown'
+  const name = user.displayName ?? user.name
+  const role = user.role ? ` (${user.role})` : ''
+  const label = name ? `${handle} — ${name}` : handle
+  return `${label}${role} · ${user.userId}`
+}
+
+function formatUserList(users: UserSearchItem[]) {
+  return users.map((user) => `- ${formatUserLabel(user)}`).join('\n')
+}
+
+function normalizeRole(value: string) {
+  const role = value.trim().toLowerCase()
+  if (role === 'user' || role === 'moderator' || role === 'admin') return role
+  fail('Role must be user|moderator|admin')
+}
+
+function formatDeletedSkills(count: number) {
+  if (!Number.isFinite(count)) return 'deleted skills unknown'
+  if (count === 1) return 'deleted 1 skill'
+  return `deleted ${count} skills`
+}

packages/clawdhub/src/cli/commands/publish.test.ts

@@ -7,10 +7,10 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { GlobalOpts } from '../types'
 
 vi.mock('../../config.js', () => ({
-  readGlobalConfig: vi.fn(async () => ({ registry: 'https://clawdhub.com', token: 'tkn' })),
+  readGlobalConfig: vi.fn(async () => ({ registry: 'https://clawhub.ai', token: 'tkn' })),
 }))
 
-const mockGetRegistry = vi.fn(async (_opts: unknown, _params?: unknown) => 'https://clawdhub.com')
+const mockGetRegistry = vi.fn(async (_opts: unknown, _params?: unknown) => 'https://clawhub.ai')
 vi.mock('../registry.js', () => ({
   getRegistry: (opts: unknown, params?: unknown) => mockGetRegistry(opts, params),
 }))
@@ -34,7 +34,7 @@ vi.mock('../ui.js', () => ({
 const { cmdPublish } = await import('./publish')
 
 async function makeTmpWorkdir() {
-  const root = await mkdtemp(join(tmpdir(), 'clawdhub-publish-'))
+  const root = await mkdtemp(join(tmpdir(), 'clawhub-publish-'))
   return root
 }
 
@@ -42,8 +42,8 @@ function makeOpts(workdir: string): GlobalOpts {
   return {
     workdir,
     dir: join(workdir, 'skills'),
-    site: 'https://clawdhub.com',
-    registry: 'https://clawdhub.com',
+    site: 'https://clawhub.ai',
+    registry: 'https://clawhub.ai',
     registrySource: 'default',
   }
 }

packages/clawdhub/src/cli/commands/publish.ts

@@ -29,7 +29,7 @@ export async function cmdPublish(
 
   const cfg = await readGlobalConfig()
   const token = cfg?.token
-  if (!token) fail('Not logged in. Run: clawdhub login')
+  if (!token) fail('Not logged in. Run: clawhub login')
   const registry = await getRegistry(opts, { cache: true })
 
   const slug = options.slug ?? sanitizeSlug(basename(folder))

packages/clawdhub/src/cli/commands/skills.test.ts

@@ -11,7 +11,7 @@ vi.mock('../../http.js', () => ({
   downloadZip: (...args: unknown[]) => mockDownloadZip(...args),
 }))
 
-const mockGetRegistry = vi.fn(async () => 'https://clawdhub.com')
+const mockGetRegistry = vi.fn(async () => 'https://clawhub.ai')
 vi.mock('../registry.js', () => ({
   getRegistry: () => mockGetRegistry(),
 }))
@@ -68,8 +68,8 @@ function makeOpts(): GlobalOpts {
   return {
     workdir: '/work',
     dir: '/work/skills',
-    site: 'https://clawdhub.com',
-    registry: 'https://clawdhub.com',
+    site: 'https://clawhub.ai',
+    registry: 'https://clawhub.ai',
     registrySource: 'default',
   }
 }

packages/clawdhub/src/cli/commands/skills.ts

@@ -73,16 +73,36 @@ export async function cmdInstall(
 
   const spinner = createSpinner(`Resolving ${trimmed}`)
   try {
-    const resolvedVersion =
-      versionFlag ??
-      (
-        await apiRequest(
-          registry,
-          { method: 'GET', path: `${ApiRoutes.skills}/${encodeURIComponent(trimmed)}` },
-          ApiV1SkillResponseSchema,
-        )
-      ).latestVersion?.version ??
-      null
+    // Fetch skill metadata including moderation status
+    const skillMeta = await apiRequest(
+      registry,
+      { method: 'GET', path: `${ApiRoutes.skills}/${encodeURIComponent(trimmed)}` },
+      ApiV1SkillResponseSchema,
+    )
+
+    // Check moderation status before proceeding
+    if (skillMeta.moderation?.isMalwareBlocked) {
+      spinner.fail(`Blocked: ${trimmed} is flagged as malicious`)
+      fail('This skill has been flagged as malware and cannot be installed.')
+    }
+
+    if (skillMeta.moderation?.isSuspicious && !force) {
+      spinner.stop()
+      console.log(
+        `\n⚠️  Warning: "${trimmed}" is flagged as suspicious by VirusTotal Code Insight.\n` +
+          '   This skill may contain risky patterns (crypto keys, external APIs, eval, etc.)\n' +
+          '   Review the skill code before use.\n',
+      )
+      if (isInteractive()) {
+        const confirm = await promptConfirm('Install anyway?')
+        if (!confirm) fail('Installation cancelled')
+        spinner.start(`Resolving ${trimmed}`)
+      } else {
+        fail('Use --force to install suspicious skills in non-interactive mode')
+      }
+    }
+
+    const resolvedVersion = versionFlag ?? skillMeta.latestVersion?.version ?? null
     if (!resolvedVersion) fail('Could not resolve latest version')
 
     spinner.text = `Downloading ${trimmed}@${resolvedVersion}`
@@ -138,6 +158,39 @@ export async function cmdUpdate(
       const target = join(opts.dir, entry)
       const exists = await fileExists(target)
 
+      // Always fetch skill metadata to check moderation status
+      const skillMeta = await apiRequest(
+        registry,
+        { method: 'GET', path: `${ApiRoutes.skills}/${encodeURIComponent(entry)}` },
+        ApiV1SkillResponseSchema,
+      )
+
+      // Check moderation status before proceeding
+      if (skillMeta.moderation?.isMalwareBlocked) {
+        spinner.fail(`${entry}: blocked as malicious`)
+        console.log('   This skill has been flagged as malware and cannot be updated.')
+        continue
+      }
+
+      if (skillMeta.moderation?.isSuspicious && !options.force) {
+        spinner.stop()
+        console.log(
+          `\n⚠️  Warning: "${entry}" is flagged as suspicious by VirusTotal Code Insight.\n` +
+            '   This skill may contain risky patterns (crypto keys, external APIs, eval, etc.)\n',
+        )
+        if (allowPrompt) {
+          const confirm = await promptConfirm('Update anyway?')
+          if (!confirm) {
+            console.log(`${entry}: skipped`)
+            continue
+          }
+          spinner.start(`Checking ${entry}`)
+        } else {
+          console.log(`${entry}: skipped (use --force to update suspicious skills)`)
+          continue
+        }
+      }
+
       let localFingerprint: string | null = null
       if (exists) {
         const filesOnDisk = await listTextFiles(target)
@@ -151,12 +204,7 @@ export async function cmdUpdate(
       if (localFingerprint) {
         resolveResult = await resolveSkillVersion(registry, entry, localFingerprint)
       } else {
-        const meta = await apiRequest(
-          registry,
-          { method: 'GET', path: `${ApiRoutes.skills}/${encodeURIComponent(entry)}` },
-          ApiV1SkillResponseSchema,
-        )
-        resolveResult = { match: null, latestVersion: meta.latestVersion ?? null }
+        resolveResult = { match: null, latestVersion: skillMeta.latestVersion ?? null }
       }
 
       const latest = resolveResult.latestVersion?.version ?? null

packages/clawdhub/src/cli/commands/star.ts

@@ -8,7 +8,7 @@ import { createSpinner, fail, formatError, isInteractive, promptConfirm } from '
 async function requireToken() {
   const cfg = await readGlobalConfig()
   const token = cfg?.token
-  if (!token) fail('Not logged in. Run: clawdhub login')
+  if (!token) fail('Not logged in. Run: clawhub login')
   return token
 }
 

packages/clawdhub/src/cli/commands/sync.test.ts

@@ -27,10 +27,10 @@ vi.mock('@clack/prompts', () => ({
 }))
 
 vi.mock('../../config.js', () => ({
-  readGlobalConfig: vi.fn(async () => ({ registry: 'https://clawdhub.com', token: 'tkn' })),
+  readGlobalConfig: vi.fn(async () => ({ registry: 'https://clawhub.ai', token: 'tkn' })),
 }))
 
-const mockGetRegistry = vi.fn(async () => 'https://clawdhub.com')
+const mockGetRegistry = vi.fn(async () => 'https://clawhub.ai')
 vi.mock('../registry.js', () => ({
   getRegistry: () => mockGetRegistry(),
 }))
@@ -89,8 +89,8 @@ function makeOpts(): GlobalOpts {
   return {
     workdir: '/work',
     dir: '/work/skills',
-    site: 'https://clawdhub.com',
-    registry: 'https://clawdhub.com',
+    site: 'https://clawhub.ai',
+    registry: 'https://clawhub.ai',
     registrySource: 'default',
   }
 }
@@ -290,9 +290,9 @@ describe('cmdSync', () => {
     expect(update.changelog).toBe('')
   })
 
-  it('skips telemetry when CLAWDHUB_DISABLE_TELEMETRY is set', async () => {
+  it('skips telemetry when CLAWHUB_DISABLE_TELEMETRY is set', async () => {
     interactive = false
-    process.env.CLAWDHUB_DISABLE_TELEMETRY = '1'
+    process.env.CLAWHUB_DISABLE_TELEMETRY = '1'
     mockApiRequest.mockImplementation(async (_registry: string, args: { path: string }) => {
       if (args.path === '/api/v1/whoami') return { user: { handle: 'steipete' } }
       if (args.path.startsWith('/api/v1/resolve?')) {
@@ -305,6 +305,6 @@ describe('cmdSync', () => {
     expect(
       mockApiRequest.mock.calls.some((call) => call[1]?.path === '/api/cli/telemetry/sync'),
     ).toBe(false)
-    delete process.env.CLAWDHUB_DISABLE_TELEMETRY
+    delete process.env.CLAWHUB_DISABLE_TELEMETRY
   })
 })

packages/clawdhub/src/cli/commands/sync.ts

@@ -30,11 +30,11 @@ import type { Candidate, LocalSkill, SyncOptions } from './syncTypes.js'
 
 export async function cmdSync(opts: GlobalOpts, options: SyncOptions, inputAllowed: boolean) {
   const allowPrompt = isInteractive() && inputAllowed !== false
-  intro('ClawdHub sync')
+  intro('ClawHub sync')
 
   const cfg = await readGlobalConfig()
   const token = cfg?.token
-  if (!token) fail('Not logged in. Run: clawdhub login')
+  if (!token) fail('Not logged in. Run: clawhub login')
 
   const registry = await getRegistryWithAuth(opts, token)
   const selectedRoots = buildScanRoots(opts, options.root)

packages/clawdhub/src/cli/commands/syncHelpers.ts

@@ -58,7 +58,7 @@ export async function reportTelemetryIfEnabled(params: {
 }
 
 function isTelemetryDisabled() {
-  const raw = process.env.CLAWDHUB_DISABLE_TELEMETRY
+  const raw = process.env.CLAWHUB_DISABLE_TELEMETRY ?? process.env.CLAWDHUB_DISABLE_TELEMETRY
   if (!raw) return false
   return ['1', 'true', 'yes', 'on'].includes(raw.trim().toLowerCase())
 }

packages/clawdhub/src/cli/commands/unstar.ts

@@ -8,7 +8,7 @@ import { createSpinner, fail, formatError, isInteractive, promptConfirm } from '
 async function requireToken() {
   const cfg = await readGlobalConfig()
   const token = cfg?.token
-  if (!token) fail('Not logged in. Run: clawdhub login')
+  if (!token) fail('Not logged in. Run: clawhub login')
   return token
 }
 

packages/clawdhub/src/cli/registry.test.ts

@@ -22,7 +22,7 @@ function makeOpts(overrides: Partial<GlobalOpts> = {}): GlobalOpts {
   return {
     workdir: '/work',
     dir: '/work/skills',
-    site: 'https://clawdhub.com',
+    site: 'https://clawhub.ai',
     registry: DEFAULT_REGISTRY,
     registrySource: 'default',
     ...overrides,
@@ -38,7 +38,7 @@ beforeEach(() => {
 describe('registry resolution', () => {
   it('prefers explicit registry over discovery/cache', async () => {
     readGlobalConfig.mockResolvedValue({ registry: 'https://auth.clawdhub.com' })
-    discoverRegistryFromSite.mockResolvedValue({ apiBase: 'https://clawdhub.com' })
+    discoverRegistryFromSite.mockResolvedValue({ apiBase: 'https://clawhub.ai' })
 
     const registry = await resolveRegistry(
       makeOpts({ registry: 'https://custom.example', registrySource: 'cli' }),
@@ -50,13 +50,13 @@ describe('registry resolution', () => {
 
   it('ignores legacy registry and updates cache from discovery', async () => {
     readGlobalConfig.mockResolvedValue({ registry: 'https://auth.clawdhub.com', token: 'tkn' })
-    discoverRegistryFromSite.mockResolvedValue({ apiBase: 'https://clawdhub.com' })
+    discoverRegistryFromSite.mockResolvedValue({ apiBase: 'https://clawhub.ai' })
 
     const registry = await getRegistry(makeOpts(), { cache: true })
 
-    expect(registry).toBe('https://clawdhub.com')
+    expect(registry).toBe('https://clawhub.ai')
     expect(writeGlobalConfig).toHaveBeenCalledWith({
-      registry: 'https://clawdhub.com',
+      registry: 'https://clawhub.ai',
       token: 'tkn',
     })
   })

packages/clawdhub/src/cli/registry.ts

@@ -2,9 +2,9 @@ import { readGlobalConfig, writeGlobalConfig } from '../config.js'
 import { discoverRegistryFromSite } from '../discovery.js'
 import type { GlobalOpts } from './types.js'
 
-export const DEFAULT_SITE = 'https://clawdhub.com'
-export const DEFAULT_REGISTRY = 'https://clawdhub.com'
-const LEGACY_REGISTRY_HOSTS = new Set(['auth.clawdhub.com'])
+export const DEFAULT_SITE = 'https://clawhub.ai'
+export const DEFAULT_REGISTRY = 'https://clawhub.ai'
+const LEGACY_REGISTRY_HOSTS = new Set(['auth.clawdhub.com', 'auth.clawhub.com', 'auth.clawhub.ai'])
 
 export async function resolveRegistry(opts: GlobalOpts) {
   const explicit = opts.registrySource !== 'default' ? opts.registry.trim() : ''

packages/clawdhub/src/cli/scanSkills.test.ts

@@ -7,7 +7,7 @@ import { describe, expect, it } from 'vitest'
 import { findSkillFolders, getFallbackSkillRoots } from './scanSkills'
 
 async function makeTmpDir() {
-  return mkdtemp(join(tmpdir(), 'clawdhub-scan-'))
+  return mkdtemp(join(tmpdir(), 'clawhub-scan-'))
 }
 
 describe('scanSkills', () => {
@@ -60,5 +60,7 @@ describe('scanSkills', () => {
     expect(roots.some((p) => p.endsWith('/clawdis/skills'))).toBe(true)
     expect(roots.some((p) => p.endsWith('/clawd/skills'))).toBe(true)
     expect(roots.some((p) => p.endsWith('/clawdbot/skills'))).toBe(true)
+    expect(roots.some((p) => p.endsWith('/openclaw/skills'))).toBe(true)
+    expect(roots.some((p) => p.endsWith('/moltbot/skills'))).toBe(true)
   })
 })

packages/clawdhub/src/cli/scanSkills.ts

@@ -37,6 +37,10 @@ export function getFallbackSkillRoots(workdir: string) {
     resolve(workdir, '..', 'clawdis', 'Skills'),
     resolve(workdir, '..', 'clawdbot', 'skills'),
     resolve(workdir, '..', 'clawdbot', 'Skills'),
+    resolve(workdir, '..', 'openclaw', 'skills'),
+    resolve(workdir, '..', 'openclaw', 'Skills'),
+    resolve(workdir, '..', 'moltbot', 'skills'),
+    resolve(workdir, '..', 'moltbot', 'Skills'),
 
     // legacy locations
     resolve(home, 'clawd', 'skills'),
@@ -54,11 +58,25 @@ export function getFallbackSkillRoots(workdir: string) {
     resolve(home, '.clawdis', 'skills'),
     resolve(home, '.clawdis', 'Skills'),
 
+    resolve(home, 'openclaw', 'skills'),
+    resolve(home, 'openclaw', 'Skills'),
+    resolve(home, '.openclaw', 'skills'),
+    resolve(home, '.openclaw', 'Skills'),
+
+    resolve(home, 'moltbot', 'skills'),
+    resolve(home, 'moltbot', 'Skills'),
+    resolve(home, '.moltbot', 'skills'),
+    resolve(home, '.moltbot', 'Skills'),
+
     // macOS App Support legacy
     resolve(home, 'Library', 'Application Support', 'clawdbot', 'skills'),
     resolve(home, 'Library', 'Application Support', 'clawdbot', 'Skills'),
     resolve(home, 'Library', 'Application Support', 'clawdis', 'skills'),
     resolve(home, 'Library', 'Application Support', 'clawdis', 'Skills'),
+    resolve(home, 'Library', 'Application Support', 'openclaw', 'skills'),
+    resolve(home, 'Library', 'Application Support', 'openclaw', 'Skills'),
+    resolve(home, 'Library', 'Application Support', 'moltbot', 'skills'),
+    resolve(home, 'Library', 'Application Support', 'moltbot', 'Skills'),
   ]
   return Array.from(new Set(roots))
 }

packages/clawdhub/src/config.test.ts

@@ -0,0 +1,73 @@
+/* @vitest-environment node */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const chmodMock = vi.fn()
+const mkdirMock = vi.fn()
+const readFileMock = vi.fn()
+const writeFileMock = vi.fn()
+
+vi.mock('node:fs/promises', () => ({
+  chmod: (...args: unknown[]) => chmodMock(...args),
+  mkdir: (...args: unknown[]) => mkdirMock(...args),
+  readFile: (...args: unknown[]) => readFileMock(...args),
+  writeFile: (...args: unknown[]) => writeFileMock(...args),
+}))
+
+const { writeGlobalConfig } = await import('./config')
+
+const originalPlatform = process.platform
+const testConfigPath = '/tmp/clawhub-config-test/config.json'
+
+function makeErr(code: string): NodeJS.ErrnoException {
+  const error = new Error(code) as NodeJS.ErrnoException
+  error.code = code
+  return error
+}
+
+beforeEach(() => {
+  vi.stubEnv('CLAWHUB_CONFIG_PATH', testConfigPath)
+  Object.defineProperty(process, 'platform', { value: 'linux' })
+  chmodMock.mockResolvedValue(undefined)
+  mkdirMock.mockResolvedValue(undefined)
+  readFileMock.mockResolvedValue('')
+  writeFileMock.mockResolvedValue(undefined)
+})
+
+afterEach(() => {
+  Object.defineProperty(process, 'platform', { value: originalPlatform })
+  vi.unstubAllEnvs()
+  vi.clearAllMocks()
+})
+
+describe('writeGlobalConfig', () => {
+  it('writes config with restricted modes', async () => {
+    await writeGlobalConfig({ registry: 'https://example.com', token: 'clh_test' })
+
+    expect(mkdirMock).toHaveBeenCalledWith('/tmp/clawhub-config-test', {
+      recursive: true,
+      mode: 0o700,
+    })
+    expect(writeFileMock).toHaveBeenCalledWith(
+      testConfigPath,
+      expect.stringContaining('"token": "clh_test"'),
+      {
+        encoding: 'utf8',
+        mode: 0o600,
+      },
+    )
+    expect(chmodMock).toHaveBeenCalledWith(testConfigPath, 0o600)
+  })
+
+  it('ignores non-fatal chmod errors', async () => {
+    chmodMock.mockRejectedValueOnce(makeErr('ENOTSUP'))
+
+    await expect(writeGlobalConfig({ registry: 'https://example.com' })).resolves.toBeUndefined()
+  })
+
+  it('rethrows unexpected chmod errors', async () => {
+    chmodMock.mockRejectedValueOnce(new Error('boom'))
+
+    await expect(writeGlobalConfig({ registry: 'https://example.com' })).rejects.toThrow('boom')
+  })
+})

packages/clawdhub/src/config.ts

@@ -1,22 +1,51 @@
-import { mkdir, readFile, writeFile } from 'node:fs/promises'
+import { existsSync } from 'node:fs'
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { type GlobalConfig, GlobalConfigSchema, parseArk } from './schema/index.js'
 
+/**
+ * Resolve config path with legacy fallback.
+ * Checks for 'clawhub' first, falls back to legacy 'clawdhub' if it exists.
+ */
+function resolveConfigPath(baseDir: string): string {
+  const clawhubPath = join(baseDir, 'clawhub', 'config.json')
+  const clawdhubPath = join(baseDir, 'clawdhub', 'config.json')
+  if (existsSync(clawhubPath)) return clawhubPath
+  if (existsSync(clawdhubPath)) return clawdhubPath
+  return clawhubPath
+}
+
+function isNonFatalChmodError(error: unknown): boolean {
+  if (!(error instanceof Error)) return false
+  const code = (error as NodeJS.ErrnoException).code
+  return code === 'EPERM' || code === 'ENOTSUP' || code === 'EOPNOTSUPP' || code === 'EINVAL'
+}
+
 export function getGlobalConfigPath() {
-  const override = process.env.CLAWDHUB_CONFIG_PATH?.trim()
+  const override =
+    process.env.CLAWHUB_CONFIG_PATH?.trim() ?? process.env.CLAWDHUB_CONFIG_PATH?.trim()
   if (override) return resolve(override)
+
   const home = homedir()
+
   if (process.platform === 'darwin') {
-    return join(home, 'Library', 'Application Support', 'clawdhub', 'config.json')
+    return resolveConfigPath(join(home, 'Library', 'Application Support'))
   }
+
   const xdg = process.env.XDG_CONFIG_HOME
-  if (xdg) return join(xdg, 'clawdhub', 'config.json')
+  if (xdg) {
+    return resolveConfigPath(xdg)
+  }
+
   if (process.platform === 'win32') {
     const appData = process.env.APPDATA
-    if (appData) return join(appData, 'clawdhub', 'config.json')
+    if (appData) {
+      return resolveConfigPath(appData)
+    }
   }
-  return join(home, '.config', 'clawdhub', 'config.json')
+
+  return resolveConfigPath(join(home, '.config'))
 }
 
 export async function readGlobalConfig(): Promise<GlobalConfig | null> {
@@ -31,6 +60,24 @@ export async function readGlobalConfig(): Promise<GlobalConfig | null> {
 
 export async function writeGlobalConfig(config: GlobalConfig) {
   const path = getGlobalConfigPath()
-  await mkdir(dirname(path), { recursive: true })
-  await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, 'utf8')
+  const dir = dirname(path)
+
+  // Create directory with restricted permissions (owner only)
+  await mkdir(dir, { recursive: true, mode: 0o700 })
+
+  // Write file with restricted permissions (owner read/write only)
+  // This protects API tokens from being read by other users
+  await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, {
+    encoding: 'utf8',
+    mode: 0o600,
+  })
+
+  // Ensure permissions on existing files (writeFile mode only applies on create)
+  if (process.platform !== 'win32') {
+    try {
+      await chmod(path, 0o600)
+    } catch (error) {
+      if (!isNonFatalChmodError(error)) throw error
+    }
+  }
 }

packages/clawdhub/src/discovery.ts

@@ -1,19 +1,23 @@
 import { parseArk, WellKnownConfigSchema } from './schema/index.js'
 
 export async function discoverRegistryFromSite(siteUrl: string) {
-  const url = new URL('/.well-known/clawdhub.json', siteUrl)
-  const response = await fetch(url.toString(), {
-    method: 'GET',
-    headers: { Accept: 'application/json' },
-  })
-  if (!response.ok) return null
-  const raw = (await response.json()) as unknown
-  const parsed = parseArk(WellKnownConfigSchema, raw, 'WellKnown config')
-  const apiBase = 'apiBase' in parsed ? parsed.apiBase : parsed.registry
-  if (!apiBase) return null
-  return {
-    apiBase,
-    authBase: parsed.authBase,
-    minCliVersion: parsed.minCliVersion,
+  const paths = ['/.well-known/clawhub.json', '/.well-known/clawdhub.json']
+  for (const path of paths) {
+    const url = new URL(path, siteUrl)
+    const response = await fetch(url.toString(), {
+      method: 'GET',
+      headers: { Accept: 'application/json' },
+    })
+    if (!response.ok) continue
+    const raw = (await response.json()) as unknown
+    const parsed = parseArk(WellKnownConfigSchema, raw, 'WellKnown config')
+    const apiBase = 'apiBase' in parsed ? parsed.apiBase : parsed.registry
+    if (!apiBase) return null
+    return {
+      apiBase,
+      authBase: parsed.authBase,
+      minCliVersion: parsed.minCliVersion,
+    }
   }
+  return null
 }

packages/clawdhub/src/http.ts

@@ -15,7 +15,6 @@ if (typeof process !== 'undefined' && process.versions?.node) {
   try {
     setGlobalDispatcher(
       new Agent({
-        allowH2: true,
         connect: { timeout: REQUEST_TIMEOUT_MS },
       }),
     )
@@ -127,6 +126,36 @@ export async function apiRequestForm<T>(
   return json as T
 }
 
+type TextRequestArgs = { path: string; token?: string } | { url: string; token?: string }
+
+export async function fetchText(registry: string, args: TextRequestArgs): Promise<string> {
+  const url = 'url' in args ? args.url : new URL(args.path, registry).toString()
+  return pRetry(
+    async () => {
+      if (isBun) {
+        return await fetchTextViaCurl(url, args)
+      }
+
+      const headers: Record<string, string> = { Accept: 'text/plain' }
+      if (args.token) headers.Authorization = `Bearer ${args.token}`
+      const controller = new AbortController()
+      const timeout = setTimeout(() => controller.abort('Timeout'), REQUEST_TIMEOUT_MS)
+      const response = await fetch(url, { method: 'GET', headers, signal: controller.signal })
+      clearTimeout(timeout)
+      const text = await response.text()
+      if (!response.ok) {
+        const message = text || `HTTP ${response.status}`
+        if (response.status === 429 || response.status >= 500) {
+          throw new Error(message)
+        }
+        throw new AbortError(message)
+      }
+      return text
+    },
+    { retries: 2 },
+  )
+}
+
 export async function downloadZip(registry: string, args: { slug: string; version?: string }) {
   const url = new URL(ApiRoutes.download, registry)
   url.searchParams.set('slug', args.slug)
@@ -202,7 +231,7 @@ async function fetchJsonFormViaCurl(url: string, args: FormRequestArgs) {
     headers.push('-H', `Authorization: Bearer ${args.token}`)
   }
 
-  const tempDir = await mkdtemp(join(tmpdir(), 'clawdhub-upload-'))
+  const tempDir = await mkdtemp(join(tmpdir(), 'clawhub-upload-'))
   try {
     const formArgs: string[] = []
     for (const [key, value] of args.form.entries()) {
@@ -254,8 +283,45 @@ async function fetchJsonFormViaCurl(url: string, args: FormRequestArgs) {
   }
 }
 
+async function fetchTextViaCurl(url: string, args: { token?: string }) {
+  const headers = ['-H', 'Accept: text/plain']
+  if (args.token) {
+    headers.push('-H', `Authorization: Bearer ${args.token}`)
+  }
+  const curlArgs = [
+    '--silent',
+    '--show-error',
+    '--location',
+    '--max-time',
+    String(REQUEST_TIMEOUT_SECONDS),
+    '--write-out',
+    '\n%{http_code}',
+    '-X',
+    'GET',
+    ...headers,
+    url,
+  ]
+  const result = spawnSync('curl', curlArgs, { encoding: 'utf8' })
+  if (result.status !== 0) {
+    throw new Error(result.stderr || 'curl failed')
+  }
+  const output = result.stdout ?? ''
+  const splitAt = output.lastIndexOf('\n')
+  if (splitAt === -1) throw new Error('curl response missing status')
+  const body = output.slice(0, splitAt)
+  const status = Number(output.slice(splitAt + 1).trim())
+  if (!Number.isFinite(status)) throw new Error('curl response missing status')
+  if (status < 200 || status >= 300) {
+    if (status === 429 || status >= 500) {
+      throw new Error(body || `HTTP ${status}`)
+    }
+    throw new AbortError(body || `HTTP ${status}`)
+  }
+  return body
+}
+
 async function fetchBinaryViaCurl(url: string) {
-  const tempDir = await mkdtemp(join(tmpdir(), 'clawdhub-download-'))
+  const tempDir = await mkdtemp(join(tmpdir(), 'clawhub-download-'))
   const filePath = join(tempDir, 'payload.bin')
   try {
     const curlArgs = [

packages/clawdhub/src/schema/routes.ts

@@ -18,5 +18,6 @@ export const ApiRoutes = {
   skills: '/api/v1/skills',
   stars: '/api/v1/stars',
   souls: '/api/v1/souls',
+  users: '/api/v1/users',
   whoami: '/api/v1/whoami',
 } as const

packages/clawdhub/src/schema/schemas.ts

@@ -125,6 +125,17 @@ export const ApiV1WhoamiResponseSchema = type({
   },
 })
 
+export const ApiV1UserSearchResponseSchema = type({
+  items: type({
+    userId: 'string',
+    handle: 'string|null',
+    displayName: 'string|null?',
+    name: 'string|null?',
+    role: '"admin"|"moderator"|"user"|null?',
+  }).array(),
+  total: 'number',
+})
+
 export const ApiV1SearchResponseSchema = type({
   results: type({
     slug: 'string?',
@@ -174,6 +185,12 @@ export const ApiV1SkillResponseSchema = type({
     displayName: 'string|null?',
     image: 'string|null?',
   }).or('null'),
+  moderation: type({
+    isSuspicious: 'boolean',
+    isMalwareBlocked: 'boolean',
+  })
+    .or('null')
+    .optional(),
 })
 
 export const ApiV1SkillVersionListResponseSchema = type({
@@ -215,6 +232,17 @@ export const ApiV1DeleteResponseSchema = type({
   ok: 'true',
 })
 
+export const ApiV1BanUserResponseSchema = type({
+  ok: 'true',
+  alreadyBanned: 'boolean',
+  deletedSkills: 'number',
+})
+
+export const ApiV1SetRoleResponseSchema = type({
+  ok: 'true',
+  role: '"admin"|"moderator"|"user"',
+})
+
 export const ApiV1StarResponseSchema = type({
   ok: 'true',
   starred: 'boolean',