From 6729af202ba9e8d93756edea22987c8f29f59209 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 13:50:23 +0200
Subject: [PATCH 01/36] =?UTF-8?q?feat(plugins):=20site=20plugins=20foundat?=
 =?UTF-8?q?ions=20=E2=80=94=20reserved=20site.*=20namespace,=20source=20co?=
 =?UTF-8?q?lumn,=20plugin=20file=20type?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Reserve the site.* plugin-id namespace on the zip-install boundary
  (readPluginPackage) so uploaded packages can't hijack a site plugin's
  identity, grants, settings, or secrets. The manifest parser keeps
  accepting site.* ids — generated site-plugin packages parse through it.
- Migration 022 (both dialects): installed_plugins.source text not null
  default 'installed' — provenance for display + lifecycle routing only.
- Plumb source through the plugins repository and InstalledPlugin type.
- Add SiteFileType 'plugin' with an isolation gate pinning that plugin
  source never enters runtime scripts, user stylesheets, explorer
  sections, or any published-output pipeline.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 server/db/migrations-pg.ts                    | 11 +++
 server/db/migrations-sqlite.ts                | 11 +++
 server/handlers/cms/plugins/shared.ts         |  1 +
 server/plugins/package.ts                     | 12 +++
 server/repositories/plugins.ts                | 22 +++--
 .../site-plugin-file-isolation.test.ts        | 94 +++++++++++++++++++
 .../server/pluginPackageNamespace.test.ts     | 56 +++++++++++
 .../server/pluginSourceColumn.test.ts         | 59 ++++++++++++
 src/core/files/schemas.ts                     |  4 +
 src/core/plugin-sdk/types/installedPlugin.ts  | 10 ++
 src/core/plugins/manifest.ts                  | 13 +++
 11 files changed, 285 insertions(+), 8 deletions(-)
 create mode 100644 src/__tests__/architecture/site-plugin-file-isolation.test.ts
 create mode 100644 src/__tests__/server/pluginPackageNamespace.test.ts
 create mode 100644 src/__tests__/server/pluginSourceColumn.test.ts

diff --git a/server/db/migrations-pg.ts b/server/db/migrations-pg.ts
index 3b9799ab5..d770257cd 100644
--- a/server/db/migrations-pg.ts
+++ b/server/db/migrations-pg.ts
@@ -1359,4 +1359,15 @@ export const pgMigrations: Migration[] = [
     id: '030_iso_timestamps',
     sql: 'select 1',
   },
+  {
+    // Site plugins: provenance of an installed_plugins row. 'installed' =
+    // uploaded zip / JSON manifest; 'site-local' = generated from the site
+    // draft's plugins/<id>/ source (docs/features/site-plugins.md). Display +
+    // lifecycle routing only — the runtime never branches on it.
+    id: '031_installed_plugins_source',
+    sql: `
+      alter table installed_plugins
+        add column if not exists source text not null default 'installed';
+    `,
+  },
 ]
diff --git a/server/db/migrations-sqlite.ts b/server/db/migrations-sqlite.ts
index c88159de1..5a159a3f1 100644
--- a/server/db/migrations-sqlite.ts
+++ b/server/db/migrations-sqlite.ts
@@ -1515,4 +1515,15 @@ export const sqliteMigrations: Migration[] = [
     id: '030_iso_timestamps',
     sql: isoTimestampRewrite030(),
   },
+  {
+    // Site plugins: provenance of an installed_plugins row. 'installed' =
+    // uploaded zip / JSON manifest; 'site-local' = generated from the site
+    // draft's plugins/<id>/ source (docs/features/site-plugins.md). Display +
+    // lifecycle routing only — the runtime never branches on it.
+    id: '031_installed_plugins_source',
+    sql: `
+      alter table installed_plugins
+        add column source text not null default 'installed';
+    `,
+  },
 ]
diff --git a/server/handlers/cms/plugins/shared.ts b/server/handlers/cms/plugins/shared.ts
index 8cf45139b..bca2d8e89 100644
--- a/server/handlers/cms/plugins/shared.ts
+++ b/server/handlers/cms/plugins/shared.ts
@@ -125,6 +125,7 @@ function brokenPluginStub(
     lifecycleStatus: 'error',
     lastError: result.reason,
     grantedPermissions: [],
+    source: 'installed',
     manifest: stubManifest,
     settings: {},
     installedAt: new Date(0).toISOString(),
diff --git a/server/plugins/package.ts b/server/plugins/package.ts
index 1652617e9..e70187acb 100644
--- a/server/plugins/package.ts
+++ b/server/plugins/package.ts
@@ -1,5 +1,6 @@
 import { strFromU8, unzipSync } from 'fflate'
 import {
+  isReservedSitePluginId,
   parsePluginManifest,
 } from '@core/plugins/manifest'
 import { assertSandboxSafe } from '@core/plugins/sandboxScan'
@@ -48,6 +49,17 @@ export async function readPluginPackage(file: File): Promise<PluginPackage> {
   // parsePluginManifest is a TypeBox schema validator — it accepts unknown
   // and throws on shape mismatch. Safe boundary.
   const manifest = parsePluginManifest(JSON.parse(manifestText))
+
+  // The `site.` namespace belongs to site plugins built from the site draft.
+  // An uploaded zip claiming it could hijack a site plugin's runtime
+  // identity, grants, settings, and secrets — reject at the zip boundary.
+  if (isReservedSitePluginId(manifest.id)) {
+    throw new Error(
+      `Plugin id "${manifest.id}" uses the reserved "site." namespace. ` +
+        `That namespace belongs to site plugins built from the site draft; ` +
+        `uploaded packages must use a vendor namespace (e.g. "acme.${manifest.id.slice(5)}").`,
+    )
+  }
   const entrypoints = [
     ...Object.values(manifest.entrypoints ?? {}),
     ...manifest.adminPages.flatMap((page) =>
diff --git a/server/repositories/plugins.ts b/server/repositories/plugins.ts
index a150666df..2feda1d61 100644
--- a/server/repositories/plugins.ts
+++ b/server/repositories/plugins.ts
@@ -1,5 +1,6 @@
 import type {
   InstalledPlugin,
+  InstalledPluginSource,
   PluginLifecycleStatus,
   PluginManifest,
   PluginPermission,
@@ -44,6 +45,7 @@ interface InstalledPluginRow {
   granted_permissions_json?: unknown
   manifest_json: unknown
   settings_json?: unknown
+  source?: string | null
   installed_at: Date | string
   updated_at: Date | string
 }
@@ -94,6 +96,7 @@ function mapInstalledPlugin(row: InstalledPluginRow): InstalledPluginResult {
         grantedPermissions: Array.isArray(grantedPermissions)
           ? grantedPermissions as PluginPermission[]
           : manifest.grantedPermissions ?? [],
+        source: row.source === 'site-local' ? 'site-local' : 'installed',
         manifest,
         settings,
         installedAt: isoDate(row.installed_at),
@@ -171,7 +174,7 @@ function mapPluginRecord(row: PluginRecordRow): PluginRecord {
 export async function listInstalledPlugins(db: DbClient): Promise<InstalledPluginResult[]> {
   const { rows } = await db<InstalledPluginRow>`
     select id, name, version, enabled, lifecycle_status, last_error,
-           granted_permissions_json, manifest_json, settings_json, installed_at, updated_at
+           granted_permissions_json, manifest_json, settings_json, source, installed_at, updated_at
     from installed_plugins
     order by installed_at desc
   `
@@ -181,7 +184,7 @@ export async function listInstalledPlugins(db: DbClient): Promise<InstalledPlugi
 export async function getInstalledPlugin(db: DbClient, id: string): Promise<InstalledPluginResult | null> {
   const { rows } = await db<InstalledPluginRow>`
     select id, name, version, enabled, lifecycle_status, last_error,
-           granted_permissions_json, manifest_json, settings_json, installed_at, updated_at
+           granted_permissions_json, manifest_json, settings_json, source, installed_at, updated_at
     from installed_plugins
     where id = ${id}
   `
@@ -192,7 +195,9 @@ export async function installPlugin(
   db: DbClient,
   manifest: PluginManifest,
   grantedPermissions: PluginPermission[] = manifest.grantedPermissions ?? [],
+  opts: { source?: InstalledPluginSource } = {},
 ): Promise<InstalledPlugin> {
+  const source: InstalledPluginSource = opts.source ?? 'installed'
   const manifestToStore = { ...manifest, grantedPermissions }
   const declared = manifest.settings ?? []
   // Seed settings with the manifest's declared defaults so plugins reading
@@ -204,8 +209,8 @@ export async function installPlugin(
     Object.entries(pluginSettingsDefaults(declared)).filter(([key]) => !secretIds.has(key)),
   )
   const { rows } = await db<InstalledPluginRow>`
-    insert into installed_plugins (id, name, version, manifest_json, granted_permissions_json, settings_json, enabled, lifecycle_status, last_error)
-    values (${manifest.id}, ${manifest.name}, ${manifest.version}, ${writeJson(manifestToStore)}, ${writeJson(grantedPermissions)}, ${writeJson(initialSettings)}, true, 'installed', null)
+    insert into installed_plugins (id, name, version, manifest_json, granted_permissions_json, settings_json, enabled, lifecycle_status, last_error, source)
+    values (${manifest.id}, ${manifest.name}, ${manifest.version}, ${writeJson(manifestToStore)}, ${writeJson(grantedPermissions)}, ${writeJson(initialSettings)}, true, 'installed', null, ${source})
     on conflict (id) do update
       set name = excluded.name,
           version = excluded.version,
@@ -214,9 +219,10 @@ export async function installPlugin(
           enabled = true,
           lifecycle_status = 'installed',
           last_error = null,
+          source = excluded.source,
           updated_at = ${nowIso()}
     returning id, name, version, enabled, lifecycle_status, last_error,
-              granted_permissions_json, manifest_json, settings_json, installed_at, updated_at
+              granted_permissions_json, manifest_json, settings_json, source, installed_at, updated_at
   `
   // Secret settings with a non-empty manifest default get an encrypted row.
   // Insert-if-absent: the upgrade/rollback flows reuse this upsert and must
@@ -240,7 +246,7 @@ export async function setPluginEnabled(
     update installed_plugins set enabled = ${enabled}, updated_at = ${nowIso()}
     where id = ${id}
     returning id, name, version, enabled, lifecycle_status, last_error,
-              granted_permissions_json, manifest_json, settings_json, installed_at, updated_at
+              granted_permissions_json, manifest_json, settings_json, source, installed_at, updated_at
   `
   return rows[0] ? mapInstalledPlugin(rows[0]) : null
 }
@@ -255,7 +261,7 @@ export async function setPluginLifecycleStatus(
     update installed_plugins set lifecycle_status = ${lifecycleStatus}, last_error = ${lastError}, updated_at = ${nowIso()}
     where id = ${id}
     returning id, name, version, enabled, lifecycle_status, last_error,
-              granted_permissions_json, manifest_json, settings_json, installed_at, updated_at
+              granted_permissions_json, manifest_json, settings_json, source, installed_at, updated_at
   `
   return rows[0] ? mapInstalledPlugin(rows[0]) : null
 }
@@ -287,7 +293,7 @@ export async function setPluginSettings(
            updated_at = ${nowIso()}
      where id = ${id}
     returning id, name, version, enabled, lifecycle_status, last_error,
-              granted_permissions_json, manifest_json, settings_json, installed_at, updated_at
+              granted_permissions_json, manifest_json, settings_json, source, installed_at, updated_at
   `
   return rows[0] ? mapInstalledPlugin(rows[0]) : null
 }
diff --git a/src/__tests__/architecture/site-plugin-file-isolation.test.ts b/src/__tests__/architecture/site-plugin-file-isolation.test.ts
new file mode 100644
index 000000000..3fbc120fa
--- /dev/null
+++ b/src/__tests__/architecture/site-plugin-file-isolation.test.ts
@@ -0,0 +1,94 @@
+/**
+ * `SiteFileType: 'plugin'` isolation gate.
+ *
+ * Site plugin source files live in the site draft but must NEVER reach any
+ * visitor/module surface: published script bundles, user stylesheets,
+ * `props._siteScripts`, module-readable file lists — or the site editor's
+ * explorer (they are edited exclusively in the Plugin IDE). The pipelines
+ * select by EXACT type (`type === 'script'` / `type === 'style'`), so
+ * 'plugin' files are excluded by NOT matching; this gate pins that.
+ */
+import { describe, expect, test } from 'bun:test'
+import { collectAppliedStyles, collectRuntimeScripts, DEFAULT_SITE_RUNTIME } from '@core/site-runtime'
+import { reconcileSiteExplorerOrganization } from '@core/page-tree'
+import type { SiteFile } from '@core/files/schemas'
+
+const file = (id: string, path: string, type: SiteFile['type'], content = 'export {}'): SiteFile => ({
+  id,
+  path,
+  type,
+  content,
+  createdAt: 1,
+  updatedAt: 1,
+})
+
+const page = { id: 'page-1' }
+
+describe('site plugin file isolation', () => {
+  test("'plugin' files never become runtime scripts", () => {
+    const files = [
+      file('f1', 'plugins/newsletter/server/index.ts', 'plugin'),
+      file('f2', 'src/scripts/fx.ts', 'script'),
+    ]
+    const collected = collectRuntimeScripts({
+      files,
+      runtime: DEFAULT_SITE_RUNTIME,
+      page,
+      target: 'published',
+    })
+    expect(collected.map((entry) => entry.file.id)).toEqual(['f2'])
+  })
+
+  test("'plugin' files never become user stylesheets", () => {
+    const files = [
+      file('f1', 'plugins/newsletter/frontend/styles.css', 'plugin', 'body { color: red }'),
+      file('f2', 'src/styles/site.css', 'style', 'body { margin: 0 }'),
+    ]
+    const collected = collectAppliedStyles({
+      files,
+      runtime: DEFAULT_SITE_RUNTIME,
+      page,
+    })
+    expect(collected.map((entry) => entry.file.id)).toEqual(['f2'])
+  })
+
+  test("site explorer reconciliation drops 'plugin' files from the scripts section", () => {
+    const files = [
+      file('f1', 'plugins/demo/server/index.ts', 'plugin'),
+      file('f2', 'src/scripts/fx.ts', 'script'),
+    ]
+    // Reconciliation keeps rowOrder entries only for rows the section still
+    // derives from `files` — a 'plugin' file must never be a scripts row.
+    const organization = reconcileSiteExplorerOrganization(
+      {
+        pages: { expandedFolders: [], emptyFolders: [], rowOrder: [] },
+        styles: { expandedFolders: [], emptyFolders: [], rowOrder: [] },
+        scripts: {
+          expandedFolders: [],
+          emptyFolders: [],
+          rowOrder: [
+            { kind: 'item', id: 'f1', parentPath: 'plugins/demo/server', order: 0 },
+            { kind: 'item', id: 'f2', parentPath: 'src/scripts', order: 1 },
+          ],
+        },
+        templates: { folders: [], items: [] },
+        components: { folders: [], items: [] },
+      },
+      { pages: [], visualComponents: [], files },
+    )
+    const scriptRowIds = organization.scripts.rowOrder.map((row) => row.id)
+    expect(scriptRowIds).toContain('f2')
+    expect(scriptRowIds).not.toContain('f1')
+  })
+
+  test("no published-output pipeline matches 'plugin' by type", async () => {
+    // Static gate: the string  type === 'plugin'  must not appear in any
+    // published-output pipeline — 'plugin' files are excluded by NOT
+    // matching, never included by matching.
+    const glob = new Bun.Glob('{server/publish,src/core/publisher,src/core/site-runtime}/**/*.ts')
+    for await (const path of glob.scan('.')) {
+      const text = await Bun.file(path).text()
+      expect(text.includes("type === 'plugin'"), `${path} matches 'plugin' file type`).toBe(false)
+    }
+  })
+})
diff --git a/src/__tests__/server/pluginPackageNamespace.test.ts b/src/__tests__/server/pluginPackageNamespace.test.ts
new file mode 100644
index 000000000..da8b6abb1
--- /dev/null
+++ b/src/__tests__/server/pluginPackageNamespace.test.ts
@@ -0,0 +1,56 @@
+/**
+ * The `site.` plugin-id namespace is reserved for site plugins generated
+ * from the site draft. The zip-install boundary (`readPluginPackage`) must
+ * reject uploaded packages that claim it — otherwise a zip could hijack a
+ * site plugin's runtime identity, grants, settings, and secrets. The
+ * manifest PARSER keeps accepting `site.*` ids because generated site-plugin
+ * packages parse through it.
+ */
+import { describe, expect, it } from 'bun:test'
+import { zipSync, strToU8 } from 'fflate'
+import { isReservedSitePluginId, parsePluginManifest } from '@core/plugins/manifest'
+import { readPluginPackage } from '../../../server/plugins/package'
+
+function pluginZip(files: Record<string, string>): File {
+  const zipped = zipSync(Object.fromEntries(
+    Object.entries(files).map(([path, content]) => [path, strToU8(content)]),
+  ))
+  return new File([zipped], 'site-newsletter.zip', { type: 'application/zip' })
+}
+
+describe('site.* plugin id namespace', () => {
+  it('isReservedSitePluginId flags the reserved namespace', () => {
+    expect(isReservedSitePluginId('site.newsletter')).toBe(true)
+    expect(isReservedSitePluginId('site.a.b')).toBe(true)
+    expect(isReservedSitePluginId('acme.workflow')).toBe(false)
+    // 'sitemap.tools' must NOT be caught by a naive startsWith('site')
+    expect(isReservedSitePluginId('sitemap.tools')).toBe(false)
+  })
+
+  it('the zip boundary rejects site.* package ids', async () => {
+    const manifest = {
+      id: 'site.newsletter',
+      name: 'Newsletter',
+      version: '1.0.0',
+      apiVersion: 1,
+      permissions: [],
+      adminPages: [],
+    }
+    await expect(readPluginPackage(pluginZip({
+      'plugin.json': JSON.stringify(manifest),
+    }))).rejects.toThrow(/reserved "site\." namespace/)
+  })
+
+  it('the manifest parser still accepts site.* ids (generated packages)', () => {
+    const parsed = parsePluginManifest({
+      id: 'site.newsletter',
+      name: 'Newsletter',
+      version: '1.0.1+abcd1234',
+      apiVersion: 1,
+      permissions: [],
+      resources: [],
+      adminPages: [],
+    })
+    expect(parsed.id).toBe('site.newsletter')
+  })
+})
diff --git a/src/__tests__/server/pluginSourceColumn.test.ts b/src/__tests__/server/pluginSourceColumn.test.ts
new file mode 100644
index 000000000..1e0013d82
--- /dev/null
+++ b/src/__tests__/server/pluginSourceColumn.test.ts
@@ -0,0 +1,59 @@
+/**
+ * `installed_plugins.source` — provenance column added by migration 022.
+ * Zip/JSON installs default to 'installed'; site plugin activations pass
+ * { source: 'site-local' }. The value must round-trip reads and survive the
+ * upgrade upsert.
+ */
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
+import { parsePluginManifest } from '@core/plugins/manifest'
+import { getInstalledPlugin, installPlugin } from '../../../server/repositories/plugins'
+import { createTestDb, type TestDb } from '../helpers/createTestDb'
+
+function manifest(id: string, version = '1.0.0') {
+  return parsePluginManifest({
+    id,
+    name: id,
+    version,
+    apiVersion: 1,
+    permissions: [],
+    resources: [],
+    adminPages: [],
+  })
+}
+
+let testDb: TestDb
+
+beforeAll(async () => {
+  testDb = await createTestDb()
+})
+
+afterAll(async () => {
+  await testDb.cleanup()
+})
+
+describe('installed_plugins.source', () => {
+  test('defaults to installed and round-trips site-local', async () => {
+    const { db } = testDb
+
+    const installed = await installPlugin(db, manifest('acme.demo'), [])
+    expect(installed.source).toBe('installed')
+
+    const siteLocal = await installPlugin(db, manifest('site.demo', '1.0.1+aaaa1111'), [], {
+      source: 'site-local',
+    })
+    expect(siteLocal.source).toBe('site-local')
+
+    const read = await getInstalledPlugin(db, 'site.demo')
+    expect(read?.kind).toBe('ok')
+    if (read?.kind === 'ok') expect(read.plugin.source).toBe('site-local')
+  })
+
+  test('upgrade upsert preserves the site-local provenance', async () => {
+    const { db } = testDb
+    const upgraded = await installPlugin(db, manifest('site.demo', '1.0.2+bbbb2222'), [], {
+      source: 'site-local',
+    })
+    expect(upgraded.source).toBe('site-local')
+    expect(upgraded.version).toBe('1.0.2+bbbb2222')
+  })
+})
diff --git a/src/core/files/schemas.ts b/src/core/files/schemas.ts
index a4a13f4f8..38ecc7c6e 100644
--- a/src/core/files/schemas.ts
+++ b/src/core/files/schemas.ts
@@ -26,6 +26,10 @@ const SiteFileTypeSchema = Type.Union([
   Type.Literal('asset'),     // public/* — images, fonts, etc. (binary)
   Type.Literal('config'),    // package.json, tsconfig.json, vite.config.ts, .env, etc.
   Type.Literal('doc'),       // README.md, CHANGELOG.md — markdown docs
+  Type.Literal('plugin'),    // plugins/<local-id>/** — site plugin source; NEVER enters
+                             // published bundles, _siteScripts, or module-readable file
+                             // lists, and never appears in the site editor (edited in
+                             // the Plugin IDE). Gated by site-plugin-file-isolation.test.ts.
 ])
 
 export type SiteFileType = Static<typeof SiteFileTypeSchema>
diff --git a/src/core/plugin-sdk/types/installedPlugin.ts b/src/core/plugin-sdk/types/installedPlugin.ts
index ede4685f8..91ddedff0 100644
--- a/src/core/plugin-sdk/types/installedPlugin.ts
+++ b/src/core/plugin-sdk/types/installedPlugin.ts
@@ -7,6 +7,15 @@ import type { PluginPermission } from './permissions'
 // Installed plugin — manifest + host bookkeeping
 // ---------------------------------------------------------------------------
 
+/**
+ * Provenance of an installed plugin row. `'installed'` = uploaded zip / JSON
+ * manifest; `'site-local'` = generated from the site draft's
+ * `plugins/<local-id>/` source (docs/features/site-plugins.md). Provenance is
+ * for display labels and lifecycle-action routing only — the plugin runtime
+ * never branches on it.
+ */
+export type InstalledPluginSource = 'installed' | 'site-local'
+
 export interface InstalledPlugin {
   id: string
   name: string
@@ -15,6 +24,7 @@ export interface InstalledPlugin {
   lifecycleStatus: PluginLifecycleStatus
   lastError: string | null
   grantedPermissions: PluginPermission[]
+  source: InstalledPluginSource
   manifest: PluginManifest
   /**
    * Current user-edited settings values, keyed by setting id. Always
diff --git a/src/core/plugins/manifest.ts b/src/core/plugins/manifest.ts
index 50fe233c2..f000dcaa8 100644
--- a/src/core/plugins/manifest.ts
+++ b/src/core/plugins/manifest.ts
@@ -24,6 +24,19 @@ export { collectEnabledAdminPages, pluginAdminPageRoute }
 export { findPluginResource, validatePluginRecordData } from './resourceRecords'
 
 const PLUGIN_ID_PATTERN = /^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)+$/
+
+/**
+ * The `site.` id namespace is reserved for site plugins generated from the
+ * site draft (docs/features/site-plugins.md). Uploaded zip packages must
+ * never claim it — enforced at the zip boundary (`readPluginPackage`), NOT
+ * here in the parser, because generated site-plugin packages parse through
+ * `parsePluginManifest` with `site.*` ids.
+ */
+export const SITE_PLUGIN_ID_PREFIX = 'site.'
+
+export function isReservedSitePluginId(id: string): boolean {
+  return id.startsWith(SITE_PLUGIN_ID_PREFIX)
+}
 /**
  * Used for resource IDs and admin page IDs — these become URL path segments,
  * so they are restricted to lowercase kebab-case.

From c3140d00defc5b3cea72a8235a0f24c8ca48a38b Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 14:00:30 +0200
Subject: [PATCH 02/36] refactor(plugin-sdk): extract shared plugin-build core
 with fail-closed import containment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- New @core/plugin-build: buildPluginPackage (manifest write + per-surface
  bundling), bundleEntrypoint (one Bun.build choke point: externals
  layering, sandbox facades, post-bundle scans), facade generation, and a
  containment resolver plugin.
- The CLI build (instatic-plugin build|dev) becomes a thin frontend:
  config evaluation, dist reset, pack/icon copy, and zipping stay CLI-side;
  bundling behavior is byte-identical (verified by init+build smoke runs
  for module and server kinds).
- containmentPlugin fails resolution closed to the workspace root:
  upward-relative escapes, absolute paths, and import-attribute payloads
  throw; bare specifiers must be explicitly mapped (SDK) or external
  (import-map-resolved). Symlinked roots (macOS /var → /private/var)
  are realpath-normalized so containment can't be silently disabled.
- Barrel gate covers @core/plugin-build; sandbox-invariant gate re-pinned
  to the shared core.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 smoke-test/.gitignore                         |   4 +
 smoke-test/README.md                          |  23 +
 smoke-test/instatic-plugin.config.ts          |  14 +
 smoke-test/modules/hello.ts                   |  19 +
 .../no-core-barrel-deep-imports.test.ts       |   2 +
 .../plugin-sandbox-invariants.test.ts         |   7 +-
 .../plugins/pluginBuildContainment.test.ts    | 134 ++++++
 src/core/plugin-build/buildPackage.ts         | 216 +++++++++
 src/core/plugin-build/bundle.ts               | 220 +++++++++
 src/core/plugin-build/containment.ts          | 107 +++++
 src/core/plugin-build/facades.ts              |  82 ++++
 src/core/plugin-build/index.ts                |  17 +
 src/core/plugin-sdk/cli/build.ts              | 433 ++----------------
 13 files changed, 870 insertions(+), 408 deletions(-)
 create mode 100644 smoke-test/.gitignore
 create mode 100644 smoke-test/README.md
 create mode 100644 smoke-test/instatic-plugin.config.ts
 create mode 100644 smoke-test/modules/hello.ts
 create mode 100644 src/__tests__/plugins/pluginBuildContainment.test.ts
 create mode 100644 src/core/plugin-build/buildPackage.ts
 create mode 100644 src/core/plugin-build/bundle.ts
 create mode 100644 src/core/plugin-build/containment.ts
 create mode 100644 src/core/plugin-build/facades.ts
 create mode 100644 src/core/plugin-build/index.ts

diff --git a/smoke-test/.gitignore b/smoke-test/.gitignore
new file mode 100644
index 000000000..df45c0b07
--- /dev/null
+++ b/smoke-test/.gitignore
@@ -0,0 +1,4 @@
+node_modules
+dist
+*.plugin.zip
+.DS_Store
diff --git a/smoke-test/README.md b/smoke-test/README.md
new file mode 100644
index 000000000..434a56c71
--- /dev/null
+++ b/smoke-test/README.md
@@ -0,0 +1,23 @@
+# Smoke Test
+
+> Plugin id: `local.smoke-test`
+
+## Develop
+
+```bash
+instatic-plugin dev          # watch + sync into the running CMS
+instatic-plugin build        # produce a .plugin.zip
+```
+
+The dev command writes built files directly into the host CMS's
+`uploads/plugins/local.smoke-test/<version>/` directory. On first run it
+auto-detects the host's `uploads/` folder by walking up from the plugin
+directory; pass `--uploads <path>` (or set `INSTATIC_UPLOADS_DIR`) when running
+outside the instatic monorepo.
+
+You'll need to install the plugin once via the admin UI (`/admin/plugins` →
+Upload Plugin) so the host registers it and approves permissions. After
+that, every `instatic-plugin dev` rebuild flows in without another upload.
+
+See [docs/features/plugin-system.md](../instatic/docs/features/plugin-system.md)
+for the full plugin SDK surface.
diff --git a/smoke-test/instatic-plugin.config.ts b/smoke-test/instatic-plugin.config.ts
new file mode 100644
index 000000000..38fb3fb64
--- /dev/null
+++ b/smoke-test/instatic-plugin.config.ts
@@ -0,0 +1,14 @@
+import { definePlugin, permissions } from '@core/plugin-sdk'
+import hello from './modules/hello'
+
+export default definePlugin({
+  id: 'local.smoke-test',
+  name: 'Smoke Test',
+  version: '0.1.0',
+  description: 'A new Smoke Test plugin.',
+  permissions: [permissions.modulesRegister],
+  modules: [hello],
+  // Add settings, admin pages, hooks, frontend bundles, or a Visual Component
+  // pack here as your plugin grows. See docs/features/plugin-system.md for the
+  // full SDK surface.
+})
diff --git a/smoke-test/modules/hello.ts b/smoke-test/modules/hello.ts
new file mode 100644
index 000000000..b8b4fcb1e
--- /dev/null
+++ b/smoke-test/modules/hello.ts
@@ -0,0 +1,19 @@
+import { control, defineModule, html } from '@core/plugin-sdk'
+
+export default defineModule({
+  id: 'local.smoke-test.hello',
+  name: 'Hello',
+  description: 'Sample canvas module emitted by the scaffolded plugin.',
+  category: 'Smoke Test',
+  htmlTag: 'div',
+  defaults: {
+    message: 'Hello from your new plugin.',
+  },
+  schema: {
+    message: control.text('Message'),
+  },
+  render: ({ props }) => ({
+    html: html`<div class="hello">${props.message}</div>`,
+    css: `.hello { padding: 12px; border: 1px dashed currentColor; border-radius: 6px; }`,
+  }),
+})
diff --git a/src/__tests__/architecture/no-core-barrel-deep-imports.test.ts b/src/__tests__/architecture/no-core-barrel-deep-imports.test.ts
index 8c97aefda..1731c3b15 100644
--- a/src/__tests__/architecture/no-core-barrel-deep-imports.test.ts
+++ b/src/__tests__/architecture/no-core-barrel-deep-imports.test.ts
@@ -37,6 +37,8 @@ const BARRELLED_MODULES = [
   'framework-schema',
   'fonts',
   'collab',
+  'plugin-build',
+  'site-plugins',
 ]
 
 // Scan production + test sources in both the app and the server.
diff --git a/src/__tests__/architecture/plugin-sandbox-invariants.test.ts b/src/__tests__/architecture/plugin-sandbox-invariants.test.ts
index 796d0c799..b183d8514 100644
--- a/src/__tests__/architecture/plugin-sandbox-invariants.test.ts
+++ b/src/__tests__/architecture/plugin-sandbox-invariants.test.ts
@@ -106,8 +106,11 @@ describe('plugin sandbox invariants', () => {
     expect(scanCount).toBeGreaterThanOrEqual(2)
   })
 
-  it('the SDK build pipeline applies the same sandbox scan at build time', async () => {
-    const source = await read('src/core/plugin-sdk/cli/build.ts')
+  it('the shared build core applies the same sandbox scan at build time', async () => {
+    // The bundling pipeline lives in @core/plugin-build (shared by the CLI
+    // and the server-side site plugin build) — both surfaces ride the same
+    // scan + IIFE contract by construction.
+    const source = await read('src/core/plugin-build/bundle.ts')
     expect(source).toContain('assertSandboxSafe')
     // Sandboxed bundles must be emitted as IIFE (the format QuickJS can
     // eval). The build pipeline used to ship ESM with `export function …`
diff --git a/src/__tests__/plugins/pluginBuildContainment.test.ts b/src/__tests__/plugins/pluginBuildContainment.test.ts
new file mode 100644
index 000000000..804edabb7
--- /dev/null
+++ b/src/__tests__/plugins/pluginBuildContainment.test.ts
@@ -0,0 +1,134 @@
+/**
+ * Import containment for workspace plugin builds — the resolve plugin must
+ * fail closed: every import originating inside the workspace resolves inside
+ * it; bare specifiers are rejected unless mapped; absolute paths and
+ * upward-relative escapes throw. Without this, draft code could embed host
+ * files (env files, DB files) into a bundle and exfiltrate them through the
+ * plugin's own public routes.
+ */
+import { describe, expect, test } from 'bun:test'
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'
+import { existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { buildPluginPackage } from '@core/plugin-build'
+import { parsePluginManifest } from '@core/plugins/manifest'
+
+async function workspace(files: Record<string, string>): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'containment-'))
+  for (const [path, content] of Object.entries(files)) {
+    const absolute = join(root, path)
+    await mkdir(dirname(absolute), { recursive: true })
+    await writeFile(absolute, content, 'utf8')
+  }
+  return root
+}
+
+const MANIFEST = parsePluginManifest({
+  id: 'site.demo',
+  name: 'Demo',
+  version: '1.0.1+aaaa1111',
+  apiVersion: 1,
+  permissions: [],
+  resources: [],
+  adminPages: [],
+  entrypoints: { server: 'server/index.js' },
+})
+
+const SDK_ENTRY = resolve(import.meta.dir, '../../core/plugin-sdk/index.ts')
+
+describe('plugin build import containment', () => {
+  test('relative import inside the workspace bundles fine', async () => {
+    const root = await workspace({
+      'server/index.ts': "import { x } from '../shared/util'\nexport function activate() { return x }",
+      'shared/util.ts': 'export const x = 1',
+    })
+    try {
+      const out = join(root, '.dist')
+      const result = await buildPluginPackage({
+        sourceDir: root,
+        outputDir: out,
+        manifest: MANIFEST,
+        resolve: { workspaceRoot: root, bareSpecifiers: {} },
+      })
+      expect(result.files).toContain('server/index.js')
+      expect(existsSync(join(out, 'server/index.js'))).toBe(true)
+    } finally {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  test('upward escape outside the workspace fails the build', async () => {
+    const root = await workspace({
+      'server/index.ts': "import secret from '../../outside'\nexport function activate() { return secret }",
+    })
+    await writeFile(join(root, '..', 'outside.ts'), 'export default 42', 'utf8')
+    try {
+      await expect(
+        buildPluginPackage({
+          sourceDir: root,
+          outputDir: join(root, '.dist'),
+          manifest: MANIFEST,
+          resolve: { workspaceRoot: root, bareSpecifiers: {} },
+        }),
+      ).rejects.toThrow(/outside the plugin workspace/)
+    } finally {
+      await rm(join(root, '..', 'outside.ts'), { force: true })
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  test('absolute-path import-attribute payload fails the build', async () => {
+    const root = await workspace({
+      'server/index.ts': "import x from '/etc/hosts' with { type: 'text' }\nexport function activate() { return x }",
+    })
+    try {
+      await expect(
+        buildPluginPackage({
+          sourceDir: root,
+          outputDir: join(root, '.dist'),
+          manifest: MANIFEST,
+          resolve: { workspaceRoot: root, bareSpecifiers: {} },
+        }),
+      ).rejects.toThrow(/outside the plugin workspace/)
+    } finally {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  test('unlisted bare specifier fails; mapped one resolves to the host SDK', async () => {
+    const rejected = await workspace({
+      'server/index.ts': "import { html } from '@instatic/plugin-sdk'\nexport function activate() { return html }",
+    })
+    try {
+      await expect(
+        buildPluginPackage({
+          sourceDir: rejected,
+          outputDir: join(rejected, '.dist'),
+          manifest: MANIFEST,
+          resolve: { workspaceRoot: rejected, bareSpecifiers: {} },
+        }),
+      ).rejects.toThrow(/not an allowed dependency/)
+    } finally {
+      await rm(rejected, { recursive: true, force: true })
+    }
+
+    const mapped = await workspace({
+      'server/index.ts': "import { html } from '@instatic/plugin-sdk'\nexport function activate() { return String(html) }",
+    })
+    try {
+      const result = await buildPluginPackage({
+        sourceDir: mapped,
+        outputDir: join(mapped, '.dist'),
+        manifest: MANIFEST,
+        resolve: {
+          workspaceRoot: mapped,
+          bareSpecifiers: { '@instatic/plugin-sdk': SDK_ENTRY },
+        },
+      })
+      expect(result.files).toContain('server/index.js')
+    } finally {
+      await rm(mapped, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/src/core/plugin-build/buildPackage.ts b/src/core/plugin-build/buildPackage.ts
new file mode 100644
index 000000000..c1f72daec
--- /dev/null
+++ b/src/core/plugin-build/buildPackage.ts
@@ -0,0 +1,216 @@
+/**
+ * `buildPluginPackage` — the shared, pure plugin-package builder.
+ *
+ * Takes a fully-derived manifest plus an on-disk source workspace and emits
+ * the runtime package layout (`plugin.json` + per-surface bundles). Two
+ * frontends drive it:
+ *
+ *   - the CLI (`instatic-plugin build|dev`) — evaluates the author's
+ *     `instatic-plugin.config.ts` on the author's own machine, derives the
+ *     manifest, then calls this core;
+ *   - the server-side site plugin build — materializes draft `SiteFile[]`
+ *     source into a temp workspace, derives the manifest from the draft
+ *     `plugin.json`, and calls this core with a fail-closed
+ *     `ImportResolverPolicy` (the host must never let draft code read
+ *     outside its own folder).
+ *
+ * The core knows nothing about zips, dist directories, packs, or icons —
+ * those stay with the callers.
+ */
+import { existsSync, readdirSync } from 'node:fs'
+import { mkdir, rm, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import type { PluginManifest } from '@core/plugin-sdk'
+import { bundleEntrypoint } from './bundle'
+import { generateModulesFacade } from './facades'
+
+/**
+ * Import-containment seam. Absent = default resolution (CLI behavior).
+ * The site plugin frontend supplies a policy that fails any resolution
+ * escaping the materialized workspace. See `./containment.ts`.
+ */
+export interface ImportResolverPolicy {
+  /** Absolute dir that workspace-originating imports must stay inside. */
+  workspaceRoot: string
+  /** Exact bare-specifier → absolute-path overrides (e.g. '@instatic/plugin-sdk'). */
+  bareSpecifiers: Record<string, string>
+  /**
+   * Bare specifiers allowed to stay external (resolved by a runtime import
+   * map, never bundled). Populated automatically by `bundleEntrypoint` from
+   * the bundle's own external list when not set explicitly.
+   */
+  allowedExternals?: string[]
+}
+
+export interface BuildPackageInput {
+  /** Absolute dir containing the plugin source (server/, editor/, frontend/, modules/…). */
+  sourceDir: string
+  /** Absolute dir to write the package into (plugin.json + bundles). */
+  outputDir: string
+  /** Fully-derived, already-validated manifest to serialize as plugin.json. */
+  manifest: PluginManifest
+  resolve?: ImportResolverPolicy
+  /**
+   * Bare specifiers frontend bundles leave external (resolved by the
+   * published page's `<script type="importmap">`). The CLI derives these
+   * from module runtime dependencies; site plugin builds pass none in v1.
+   */
+  frontendExternalSpecifiers?: string[]
+}
+
+export interface BuildPackageResult {
+  /** Package-relative paths written (plugin.json first). */
+  files: string[]
+}
+
+/**
+ * Find an entrypoint source file for `basename` under `sourceDir`:
+ * `<basename>.{tsx,ts,js,mjs}` first, then `<basename>/index.{tsx,ts,js,mjs}`.
+ * Prefers `.tsx` so plugin entrypoints can use JSX directly.
+ */
+export function findEntrypoint(sourceDir: string, basename: string): string | null {
+  for (const ext of ['tsx', 'ts', 'js', 'mjs']) {
+    const candidate = join(sourceDir, `${basename}.${ext}`)
+    if (existsSync(candidate)) return candidate
+  }
+  for (const ext of ['tsx', 'ts', 'js', 'mjs']) {
+    const candidate = join(sourceDir, basename, `index.${ext}`)
+    if (existsSync(candidate)) return candidate
+  }
+  return null
+}
+
+/**
+ * Walk `<sourceDir>/frontend/` and return every `.ts`/`.tsx`/`.js`/`.mjs`
+ * file as a bundle target. Each source `frontend/<name>.<ext>` produces
+ * `frontend/<name>.js` in the package. Files in nested directories are NOT
+ * bundled automatically — only top-level files become assets, so a plugin
+ * can keep helpers / types under `frontend/utils/` without producing dead
+ * output. Authors who need multiple bundles ship multiple top-level files.
+ */
+export function listFrontendSources(
+  sourceDir: string,
+): Array<{ absolutePath: string; outputPath: string }> {
+  const frontendDir = join(sourceDir, 'frontend')
+  if (!existsSync(frontendDir)) return []
+  const out: Array<{ absolutePath: string; outputPath: string }> = []
+  for (const entry of readdirSync(frontendDir, { withFileTypes: true })) {
+    if (entry.isDirectory()) continue
+    const match = /^(?<name>[^.][^/]*)\.(?:tsx?|m?js)$/.exec(entry.name)
+    if (!match || !match.groups?.name) continue
+    out.push({
+      absolutePath: join(frontendDir, entry.name),
+      outputPath: `frontend/${match.groups.name}.js`,
+    })
+  }
+  out.sort((a, b) => (a.outputPath < b.outputPath ? -1 : a.outputPath > b.outputPath ? 1 : 0))
+  return out
+}
+
+/**
+ * Build the runtime package: write `plugin.json`, then bundle every surface
+ * the manifest declares — modules facade (inlined host runtime), editor
+ * (host externals), server (QuickJS sandbox IIFE), top-level frontend
+ * sources, and admin app entries. Missing sources for declared entrypoints
+ * fail loudly.
+ */
+export async function buildPluginPackage(input: BuildPackageInput): Promise<BuildPackageResult> {
+  const { sourceDir, outputDir, manifest } = input
+  const files: string[] = []
+
+  await mkdir(outputDir, { recursive: true })
+  await writeFile(join(outputDir, 'plugin.json'), JSON.stringify(manifest, null, 2), 'utf-8')
+  files.push('plugin.json')
+
+  const entrypoints = manifest.entrypoints ?? {}
+
+  // Modules entrypoint — bundle a generated facade that re-exports every
+  // module file's default export as one array. The facade is written next
+  // to the plugin source (not under the output dir) so its relative
+  // `./modules/<file>` imports resolve correctly.
+  if (entrypoints.modules) {
+    const modulesFacade = generateModulesFacade(sourceDir)
+    const modulesFacadePath = join(sourceDir, '__modules-facade.ts')
+    await writeFile(modulesFacadePath, modulesFacade, 'utf-8')
+    try {
+      // Module packs are loaded by BOTH the browser editor (as an ES module
+      // via dynamic import for the canvas preview) AND the server (inside
+      // the QuickJS sandbox via `modulePackVm`). We emit ESM here;
+      // `modulePackVm.ts` runtime-transforms `export default …` into a
+      // `globalThis.__module_pack = …` assignment that QuickJS can eval.
+      // `inlineHostRuntime: true` keeps the SDK helpers bundled in — the
+      // sandbox path has no import map / module resolver.
+      await bundleEntrypoint(modulesFacadePath, join(outputDir, entrypoints.modules), {
+        inlineHostRuntime: true,
+        ...(input.resolve ? { resolve: input.resolve } : {}),
+      })
+      files.push(entrypoints.modules)
+    } finally {
+      await rm(modulesFacadePath, { force: true })
+    }
+  }
+
+  // Editor entrypoint — runs in the admin window; shares host React + UI
+  // via the editor's import map (HOST_RUNTIME_EXTERNALS).
+  if (entrypoints.editor) {
+    const editorSource = findEntrypoint(sourceDir, 'editor')
+    if (!editorSource) {
+      throw new Error(`Manifest declares entrypoints.editor but no editor/index.{tsx,ts,js,mjs} source exists`)
+    }
+    await bundleEntrypoint(editorSource, join(outputDir, entrypoints.editor), {
+      ...(input.resolve ? { resolve: input.resolve } : {}),
+    })
+    files.push(entrypoints.editor)
+  }
+
+  // Server entrypoint — QuickJS sandbox IIFE, self-contained, scanned.
+  if (entrypoints.server) {
+    const serverSource = findEntrypoint(sourceDir, 'server')
+    if (!serverSource) {
+      throw new Error(`Manifest declares entrypoints.server but no server/index.{tsx,ts,js,mjs} source exists`)
+    }
+    await bundleEntrypoint(serverSource, join(outputDir, entrypoints.server), {
+      sandbox: 'server',
+      ...(input.resolve ? { resolve: input.resolve } : {}),
+    })
+    files.push(entrypoints.server)
+  }
+
+  // Frontend sources — every top-level file under frontend/ becomes a
+  // published-page bundle (no host import map there).
+  const frontendSources = listFrontendSources(sourceDir)
+  const frontendExternals = input.frontendExternalSpecifiers ?? []
+  for (const entry of frontendSources) {
+    await bundleEntrypoint(entry.absolutePath, join(outputDir, entry.outputPath), {
+      frontendBundle: true,
+      ...(frontendExternals.length > 0 ? { externalSpecifiers: frontendExternals } : {}),
+      ...(input.resolve ? { resolve: input.resolve } : {}),
+    })
+    files.push(entry.outputPath)
+  }
+
+  // Admin app pages — one bundle per declared app entry. The manifest's
+  // `entry` field points at the BUNDLED output (.js); resolve the typed
+  // source next to it.
+  for (const page of manifest.adminPages) {
+    if (page.content.kind !== 'app') continue
+    const entry = page.content.entry
+    const sourceCandidate = join(sourceDir, entry)
+    const sourceTsx = sourceCandidate.replace(/\.js$/, '.tsx')
+    const sourceTs = sourceCandidate.replace(/\.js$/, '.ts')
+    const sourcePath = existsSync(sourceTsx)
+      ? sourceTsx
+      : existsSync(sourceTs)
+        ? sourceTs
+        : sourceCandidate
+    if (!existsSync(sourcePath)) {
+      throw new Error(`Admin app entry "${entry}" not found at ${sourcePath}`)
+    }
+    await bundleEntrypoint(sourcePath, join(outputDir, entry), {
+      ...(input.resolve ? { resolve: input.resolve } : {}),
+    })
+    files.push(entry)
+  }
+
+  return { files }
+}
diff --git a/src/core/plugin-build/bundle.ts b/src/core/plugin-build/bundle.ts
new file mode 100644
index 000000000..cfb993daa
--- /dev/null
+++ b/src/core/plugin-build/bundle.ts
@@ -0,0 +1,220 @@
+/**
+ * Entrypoint bundling — the one `Bun.build` choke point every plugin build
+ * surface goes through (CLI `instatic-plugin build|dev`, the server-side
+ * site plugin build). Owns the externals layering, sandbox facades,
+ * post-bundle sandbox scans, and the optional import-containment resolver.
+ */
+import { mkdir, rm, writeFile } from 'node:fs/promises'
+import { dirname, join, resolve } from 'node:path'
+import { assertSandboxSafe } from '@core/plugins/sandboxScan'
+import type { ImportResolverPolicy } from './buildPackage'
+import { containmentPlugin } from './containment'
+import { generateSandboxFacade } from './facades'
+
+/**
+ * Externals for plugin **admin/editor** bundles (admin pages, editor
+ * entrypoints, canvas modules).
+ *
+ * Bun.build leaves these names as bare imports. At runtime, the host's
+ * import map (`index.html`) resolves them to the host's React instance,
+ * design-system primitives, plugin SDK helpers, and editor/settings
+ * hooks — so plugins share host React + host UI without bundling a
+ * copy. This is what gives plugin bundles ~kilobyte sizes and keeps
+ * the editor's design-system contract stable across plugin upgrades.
+ *
+ * Two bundle modes that DO NOT externalize:
+ *   - `sandbox` — server entrypoints load in the host's Bun worker;
+ *     no browser host runtime there.
+ *   - `frontendBundle: true` — frontend scripts run on PUBLISHED pages,
+ *     which never load the editor's import map. A bare `import 'react'`
+ *     in a frontend bundle would crash at runtime ("Failed to resolve
+ *     module specifier"). Frontend scripts must either bundle React
+ *     themselves or stick to `window.__instatic` and vanilla DOM.
+ */
+export const HOST_RUNTIME_EXTERNALS = [
+  'react',
+  'react/jsx-runtime',
+  'react/jsx-dev-runtime',
+  'react-dom',
+  '@instatic/host-ui',
+  '@instatic/host-hooks',
+  '@instatic/plugin-sdk',
+]
+
+export interface BundleOptions {
+  /**
+   * When set, the entrypoint will be wrapped in an IIFE that assigns the
+   * plugin's exports to the given globalThis slot. Used for sandboxed code
+   * — server entrypoints (`__plugin_exports`) and module packs
+   * (`__module_pack`) — which run inside a QuickJS-WASM VM that cannot
+   * resolve ES module syntax. The host's `pluginWorker.ts` /
+   * `modulePackVm.ts` read from these globals.
+   *
+   * When this is set:
+   *  - Externals are omitted (the bundle must be self-contained)
+   *  - The bundled source is scanned for forbidden literals (`node:*`,
+   *    `bun:*`, `require(`) and the build FAILS with a clear message if
+   *    any are found — saves authors the round-trip of finding out at
+   *    install time
+   *  - For 'modules' kind, only the default export is exfiltrated; for
+   *    'server' kind, the whole namespace becomes `__plugin_exports`
+   */
+  sandbox?: 'server' | 'modules'
+  /**
+   * When true, omit the host-runtime externals — use for `frontend.assets`
+   * script bundles. Published pages don't have the host import map, so
+   * frontend code can't rely on bare `react` / `@instatic/*` imports being
+   * resolved. Bundle locally (or stick to `window.__instatic`).
+   */
+  frontendBundle?: boolean
+  /**
+   * When true, omit the host-runtime externals while keeping ESM format.
+   * Use for `entrypoints.modules` (canvas module pack) bundles, which are
+   * loaded by BOTH the browser editor (via dynamic import — has the host
+   * import map) AND the server publisher / QuickJS sandbox (via
+   * `modulePackVm` — NO import map, no module resolver).
+   *
+   * The browser path could resolve bare `@instatic/plugin-sdk` imports
+   * via the import map, but the sandbox path cannot — and the SDK helpers
+   * that module packs use (`defineModule`, `control`, `html`, `raw`,
+   * `safeUrl`) are pure data builders with no React or host-state
+   * dependency, so inlining them is the simple, correct fix.
+   *
+   * Without this flag, modules bundles would ship bare
+   * `import { defineModule } from "@instatic/plugin-sdk"`, which fails
+   * at module-pack-activate time inside the sandbox, the registry never
+   * gets populated, and the publisher emits `<!-- instatic: unknown module -->`
+   * comments on published pages.
+   */
+  inlineHostRuntime?: boolean
+  /**
+   * Extra bare specifiers to externalize on top of the host-runtime defaults.
+   * Used for frontend bundles that lean on the published-page runtime
+   * importmap — e.g. a Three.js plugin imports `three` and
+   * `three/examples/jsm/...`, and both must stay as bare imports so the
+   * browser's importmap resolves them to the host's locally-installed copy.
+   * Subpath imports are matched via `<name>/*` glob so the addon files
+   * (`three/examples/jsm/controls/OrbitControls.js`) also survive bundling.
+   */
+  externalSpecifiers?: string[]
+  /**
+   * Fail-closed import containment (site plugin builds). When set, every
+   * import originating inside `resolve.workspaceRoot` must resolve inside
+   * it; bare specifiers must be mapped or external. When absent, behavior
+   * is byte-identical to the historical CLI build.
+   */
+  resolve?: ImportResolverPolicy
+}
+
+export async function bundleEntrypoint(
+  sourcePath: string,
+  outFile: string,
+  options: BundleOptions = {},
+): Promise<void> {
+  // Externals layering, from most → least restrictive:
+  //  - Sandboxed bundles (server / modules) get NO externals: they run in a
+  //    QuickJS VM with no module resolver, so every dep must be inlined.
+  //  - Frontend bundles default to NO externals (published pages have no
+  //    import map of their own), but the caller can opt into runtime-resolved
+  //    externals via `externalSpecifiers` — used when the host is going to
+  //    emit an `<script type="importmap">` for the page's locked deps.
+  //  - Admin / editor bundles share the host's React + design system via
+  //    `HOST_RUNTIME_EXTERNALS` resolved by the editor's import map.
+  const externalSet = new Set<string>()
+  if (!options.sandbox) {
+    if (!options.frontendBundle && !options.inlineHostRuntime) {
+      for (const name of HOST_RUNTIME_EXTERNALS) externalSet.add(name)
+    }
+    for (const specifier of options.externalSpecifiers ?? []) {
+      externalSet.add(specifier)
+      // Bun.build (and esbuild) treat `name/*` as a glob — required to
+      // externalize subpath imports like `three/examples/jsm/...` while
+      // letting the bare `three` resolve via the same external.
+      externalSet.add(`${specifier}/*`)
+    }
+  }
+  const external = [...externalSet]
+
+  // Sandboxed bundles go through a generated facade so the bundler can
+  // resolve the user's entrypoint normally and we just hand-write the
+  // global-slot assignment. The facade lives next to the entrypoint
+  // briefly and is removed after the build.
+  let entryToBundle = sourcePath
+  let facadeCleanup: string | null = null
+  if (options.sandbox) {
+    const facade = generateSandboxFacade(resolve(sourcePath), options.sandbox)
+    const facadePath = join(dirname(sourcePath), `__sandbox-facade-${Date.now()}.ts`)
+    await writeFile(facadePath, facade, 'utf-8')
+    entryToBundle = facadePath
+    facadeCleanup = facadePath
+  }
+
+  try {
+    // Bun surfaces plugin onResolve/onLoad throws as an AggregateError with
+    // the generic message "Bundle failed" — unwrap the sub-errors so a
+    // containment violation reads as itself, not as noise.
+    const result = await Bun.build({
+      entrypoints: [entryToBundle],
+      target: 'browser',
+      format: options.sandbox ? 'iife' : 'esm',
+      splitting: false,
+      minify: false,
+      external,
+      ...(options.resolve
+        ? {
+            plugins: [
+              containmentPlugin({
+                ...options.resolve,
+                // The bundle's own externals stay bare imports — the runtime
+                // import map resolves them; containment must not reject them.
+                allowedExternals: options.resolve.allowedExternals ?? [...externalSet],
+              }),
+            ],
+          }
+        : {}),
+      // Force production JSX. Without this, Bun's transpiler emits
+      // `import { jsxDEV } from "react/jsx-dev-runtime"` for every JSX
+      // expression — and that's fatal in a production host because React
+      // 19's `react-jsx-dev-runtime.production.js` intentionally exports
+      // `jsxDEV` as `void 0`. Plugin bundles then crash with
+      // "TypeError: jsxDEV is not a function" as soon as any of their
+      // components render. The runtime shim at
+      // `public/runtime/react-jsx-dev-runtime.js` falls back to
+      // `jsx`/`jsxs` defensively (for third-party plugins not built with
+      // this CLI), but bundles built here should import the production
+      // runtime directly. Bun's transpiler keys this off
+      // `process.env.NODE_ENV`, so inlining it as a define is enough —
+      // the `jsx` build-config field exists in the type defs but is not
+      // honored by the transpiler in Bun 1.3.
+      define: { 'process.env.NODE_ENV': '"production"' },
+    }).catch((err: unknown) => {
+      if (err instanceof AggregateError && err.errors.length > 0) {
+        const messages = err.errors
+          .map((e) => (e instanceof Error ? e.message : String(e)))
+          .join('\n')
+        throw new Error(`Failed to bundle ${sourcePath}:\n${messages}`, { cause: err })
+      }
+      throw err
+    })
+    if (!result.success) {
+      const messages = result.logs.map((l) => l.message).join('\n')
+      throw new Error(`Failed to bundle ${sourcePath}:\n${messages}`)
+    }
+    const built = result.outputs[0]
+    if (!built) throw new Error(`No output from Bun.build for ${sourcePath}`)
+    const text = await built.text()
+
+    if (options.sandbox) {
+      // Defense in depth — fail the build NOW if the bundled output (after
+      // tree-shaking and external resolution) still references Node/Bun
+      // primitives. Plugin authors get a clear error instead of a
+      // sandbox-time activation failure.
+      assertSandboxSafe(text, sourcePath)
+    }
+
+    await mkdir(dirname(outFile), { recursive: true })
+    await writeFile(outFile, text, 'utf-8')
+  } finally {
+    if (facadeCleanup) await rm(facadeCleanup, { force: true })
+  }
+}
diff --git a/src/core/plugin-build/containment.ts b/src/core/plugin-build/containment.ts
new file mode 100644
index 000000000..516bd1450
--- /dev/null
+++ b/src/core/plugin-build/containment.ts
@@ -0,0 +1,107 @@
+import { realpathSync } from 'node:fs'
+import { dirname, isAbsolute, resolve, sep } from 'node:path'
+import type { BunPlugin } from 'bun'
+import type { ImportResolverPolicy } from './buildPackage'
+
+/**
+ * Roots a workspace may legitimately appear under: as given, fully
+ * resolved, and realpath'd. The bundler reports importer paths through the
+ * OS realpath (`/var` → `/private/var` on macOS), so comparing against the
+ * un-realpath'd root alone would silently disable containment on any
+ * symlinked temp directory.
+ */
+function workspaceRoots(root: string): string[] {
+  const roots = new Set([resolve(root)])
+  try {
+    roots.add(realpathSync(root))
+  } catch {
+    // Root may not exist yet at plugin-construction time — the resolved
+    // form still guards correctly.
+  }
+  return [...roots]
+}
+
+function isInsideOne(root: string, candidate: string): boolean {
+  return candidate === root || candidate.startsWith(root + sep)
+}
+
+function isInsideAny(roots: readonly string[], candidate: string): boolean {
+  const normalized = resolve(candidate)
+  if (roots.some((root) => isInsideOne(root, normalized))) return true
+  try {
+    const real = realpathSync(normalized)
+    return roots.some((root) => isInsideOne(root, real))
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Fail-closed import containment for site plugin builds.
+ *
+ * Imports originating inside `workspaceRoot` must resolve inside it. Bare
+ * specifiers are rejected unless explicitly mapped in `bareSpecifiers`
+ * (v1 maps exactly `@instatic/plugin-sdk` to the host's SDK entry so pure
+ * data builders — `defineModule`, `control`, `html`, … — inline into
+ * sandbox bundles) or listed in `allowedExternals` (host-runtime externals
+ * on editor/admin bundles, resolved by the import map at runtime, never
+ * bundled). Absolute paths and upward-relative escapes throw — without
+ * this, draft code could embed host files (env files, DB files) into a
+ * bundle via `import x from '../../.env' with { type: 'text' }` and
+ * exfiltrate them through the plugin's own routes. The sandbox literal
+ * scan does NOT cover this class — it catches `node:`/`bun:` references,
+ * not embedded file contents.
+ *
+ * Imports whose importer lives OUTSIDE the workspace (the mapped SDK's own
+ * relative imports) fall through to default resolution: that subtree is
+ * host-owned code the draft cannot influence.
+ */
+export function containmentPlugin(policy: ImportResolverPolicy): BunPlugin {
+  const allowedExternals = new Set(policy.allowedExternals ?? [])
+  const externalPrefixes = [...allowedExternals].map((name) => `${name}/`)
+  const roots = workspaceRoots(policy.workspaceRoot)
+  return {
+    name: 'instatic-plugin-workspace-containment',
+    setup(build) {
+      build.onResolve({ filter: /.*/ }, (args) => {
+        const specifier = args.path
+
+        const mapped = policy.bareSpecifiers[specifier]
+        if (mapped) return { path: mapped }
+
+        // Host-owned dependency internals (e.g. the mapped SDK's own
+        // relative imports) — the draft cannot influence them.
+        const importer = args.importer
+        if (importer && !isInsideAny(roots, importer)) {
+          return undefined
+        }
+
+        const isRelative = specifier.startsWith('./') || specifier.startsWith('../')
+        if (!isRelative && !isAbsolute(specifier)) {
+          if (
+            allowedExternals.has(specifier) ||
+            externalPrefixes.some((prefix) => specifier.startsWith(prefix))
+          ) {
+            return undefined // stays external; the runtime import map resolves it
+          }
+          throw new Error(
+            `"${specifier}" is not an allowed dependency of a site plugin. ` +
+              `Imports must stay inside the plugin folder.`,
+          )
+        }
+
+        const importerDir = importer ? dirname(importer) : policy.workspaceRoot
+        const target = isAbsolute(specifier) ? specifier : resolve(importerDir, specifier)
+        if (!isInsideAny(roots, target)) {
+          throw new Error(
+            `Import "${specifier}" resolves outside the plugin workspace. ` +
+              `Site plugin imports are confined to the plugin folder.`,
+          )
+        }
+        // Target dir proven inside the workspace — defer extension
+        // resolution (.ts/.tsx/index) to the default resolver.
+        return undefined
+      })
+    },
+  }
+}
diff --git a/src/core/plugin-build/facades.ts b/src/core/plugin-build/facades.ts
new file mode 100644
index 000000000..a6504913a
--- /dev/null
+++ b/src/core/plugin-build/facades.ts
@@ -0,0 +1,82 @@
+/**
+ * Facade-source generation for sandboxed plugin bundles. Shared by the CLI
+ * build (`instatic-plugin build`) and the server-side site plugin build —
+ * the facade is what lets the QuickJS runner find the plugin's exports on a
+ * `globalThis` slot without touching the author's own source.
+ */
+import { existsSync, readdirSync } from 'node:fs'
+import { join } from 'node:path'
+
+/**
+ * Generate the IIFE facade source that re-exports the user's entrypoint to
+ * a `globalThis.<slot>` so the QuickJS sandbox can find it. The user's
+ * source is left untouched; this facade is bundled WITH it.
+ *
+ * For 'server' sandboxes the runner expects `__plugin_exports.activate`
+ * etc. as direct properties — but plugin authors reasonably write either:
+ *
+ *   // shape A: named exports
+ *   export function activate(api) { … }
+ *   export function deactivate(api) { … }
+ *
+ *   // shape B: single default export — much more common in TS+ESM code
+ *   const mod = { install, activate, deactivate, uninstall }
+ *   export default mod
+ *
+ * Shape A maps cleanly to `import * as __plugin` (every named export shows
+ * up as a property). Shape B does NOT — `__plugin.default` holds the
+ * module object, and `__plugin.activate` is undefined, so the runner
+ * silently no-ops the lifecycle hook. The facade therefore detects shape B
+ * at runtime and unwraps it: when the default export looks like a plugin
+ * module (at least one known lifecycle hook is a function on it), the
+ * default is promoted — falling back to the namespace so shape A still
+ * works unchanged.
+ *
+ * For 'modules' sandboxes, only the default export is exfiltrated (the
+ * SDK's `definePack` builder default-exports the array of modules).
+ */
+export function generateSandboxFacade(entrypointAbsolutePath: string, kind: 'server' | 'modules'): string {
+  // Bun's bundler accepts absolute paths in import specifiers.
+  const importPath = JSON.stringify(entrypointAbsolutePath)
+  if (kind === 'server') {
+    return [
+      `import * as __plugin from ${importPath};`,
+      `const __default = __plugin && __plugin.default;`,
+      `const __isPluginModule = (v) => v && typeof v === 'object' && (`,
+      `  typeof v.install === 'function' || typeof v.activate === 'function' ||`,
+      `  typeof v.deactivate === 'function' || typeof v.uninstall === 'function' ||`,
+      `  typeof v.migrate === 'function'`,
+      `);`,
+      `globalThis.__plugin_exports = __isPluginModule(__default) ? __default : __plugin;`,
+    ].join('\n')
+  }
+  return [
+    `import __default from ${importPath};`,
+    `globalThis.__module_pack = __default;`,
+  ].join('\n')
+}
+
+/**
+ * Generate a tiny facade module that imports each module file in
+ * `<src>/modules/`, collects the default exports, and re-exports them as a
+ * single array. The facade is what gets bundled into `dist/modules/index.js`.
+ *
+ * Convention: every `.ts` file directly under `<src>/modules/` whose default
+ * export is a `PluginModuleDefinition` becomes a registered module.
+ */
+export function generateModulesFacade(sourceDir: string): string {
+  const modulesDir = join(sourceDir, 'modules')
+  if (!existsSync(modulesDir)) {
+    throw new Error(`Plugin declares modules but ${modulesDir} does not exist`)
+  }
+  const files = readdirSync(modulesDir)
+  const moduleFiles = files.filter((f) => /\.(ts|tsx|js|mjs)$/.test(f) && !f.startsWith('index.'))
+  if (moduleFiles.length === 0) {
+    throw new Error(`No module files found under ${modulesDir}`)
+  }
+  const imports = moduleFiles
+    .map((file, idx) => `import m${idx} from './modules/${file.replace(/\.(tsx?|m?js)$/, '')}'`)
+    .join('\n')
+  const defaultExport = `export default [${moduleFiles.map((_, idx) => `m${idx}`).join(', ')}]`
+  return `${imports}\n${defaultExport}\n`
+}
diff --git a/src/core/plugin-build/index.ts b/src/core/plugin-build/index.ts
new file mode 100644
index 000000000..a54cc4306
--- /dev/null
+++ b/src/core/plugin-build/index.ts
@@ -0,0 +1,17 @@
+/**
+ * @core/plugin-build — the shared plugin-package builder.
+ *
+ * One `Bun.build`-backed pipeline behind two frontends: the CLI
+ * (`instatic-plugin build|dev`) and the server-side site plugin build.
+ * See `./buildPackage.ts` for the core entry.
+ */
+export {
+  buildPluginPackage,
+  findEntrypoint,
+  listFrontendSources,
+  type BuildPackageInput,
+  type BuildPackageResult,
+  type ImportResolverPolicy,
+} from './buildPackage'
+export { bundleEntrypoint, HOST_RUNTIME_EXTERNALS, type BundleOptions } from './bundle'
+export { generateModulesFacade, generateSandboxFacade } from './facades'
diff --git a/src/core/plugin-sdk/cli/build.ts b/src/core/plugin-sdk/cli/build.ts
index 53fbffb51..bb3e331fa 100644
--- a/src/core/plugin-sdk/cli/build.ts
+++ b/src/core/plugin-sdk/cli/build.ts
@@ -1,9 +1,12 @@
 /**
- * Plugin build pipeline.
+ * Plugin build pipeline — the CLI frontend of `@core/plugin-build`.
  *
  * Reads `<dir>/instatic-plugin.config.ts`, evaluates it via `import()` (Bun
- * transpiles TypeScript natively), and writes the runtime zip layout that
- * the host package installer expects:
+ * transpiles TypeScript natively — this runs the AUTHOR'S OWN code on the
+ * author's machine, which is why config evaluation lives here and never in
+ * the server-side site plugin build), derives the final manifest, and hands
+ * the bundling to the shared `buildPluginPackage` core. The zip layout the
+ * host package installer expects:
  *
  *   <dir>/dist/
  *     plugin.json
@@ -15,18 +18,15 @@
  *     admin/<entry>.js             (per declared admin app entry)
  *
  * Then zips `dist/` into `<dir-parent>/<plugin-dir-name>.plugin.zip`.
- *
- * Bundling: each entrypoint is bundled with `Bun.build()` as ESM. Plugin
- * authors get one self-contained bundle per entrypoint with no
- * node_modules in the zip.
  */
-import { existsSync, readdirSync } from 'node:fs'
+import { existsSync } from 'node:fs'
 import { copyFile, mkdir, rm, writeFile } from 'node:fs/promises'
 import { basename, dirname, join, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { spawn } from 'node:child_process'
 import type { PluginDefinition } from '../builders/definePlugin'
-import { assertSandboxSafe } from '@core/plugins/sandboxScan'
+import type { PluginManifest } from '../types'
+import { buildPluginPackage, findEntrypoint } from '@core/plugin-build'
 import { installPackCompileEnvironment } from './packCompileEnvironment'
 
 export interface PluginBuildResult {
@@ -50,302 +50,6 @@ export async function readPluginDefinition(sourceDir: string): Promise<PluginDef
   return mod.default
 }
 
-/**
- * Externals for plugin **admin/editor** bundles (admin pages, editor
- * entrypoints, canvas modules).
- *
- * Bun.build leaves these names as bare imports. At runtime, the host's
- * import map (`index.html`) resolves them to the host's React instance,
- * design-system primitives, plugin SDK helpers, and editor/settings
- * hooks — so plugins share host React + host UI without bundling a
- * copy. This is what gives plugin bundles ~kilobyte sizes and keeps
- * the editor's design-system contract stable across plugin upgrades.
- *
- * Two bundle modes that DO NOT externalize:
- *   - `serverSide: true` — server entrypoints load in the host's Bun
- *     worker; no browser host runtime there.
- *   - `frontendBundle: true` — frontend scripts run on PUBLISHED pages,
- *     which never load the editor's import map. A bare `import 'react'`
- *     in a frontend bundle would crash at runtime ("Failed to resolve
- *     module specifier"). Frontend scripts must either bundle React
- *     themselves or stick to `window.__instatic` and vanilla DOM.
- */
-const HOST_RUNTIME_EXTERNALS = [
-  'react',
-  'react/jsx-runtime',
-  'react/jsx-dev-runtime',
-  'react-dom',
-  '@instatic/host-ui',
-  '@instatic/host-hooks',
-  '@instatic/plugin-sdk',
-]
-
-interface BundleOptions {
-  /**
-   * When set, the entrypoint will be wrapped in an IIFE that assigns the
-   * plugin's exports to the given globalThis slot. Used for sandboxed code
-   * — server entrypoints (`__plugin_exports`) and module packs
-   * (`__module_pack`) — which run inside a QuickJS-WASM VM that cannot
-   * resolve ES module syntax. The host's `pluginWorker.ts` /
-   * `modulePackVm.ts` read from these globals.
-   *
-   * When this is set:
-   *  - Externals are omitted (the bundle must be self-contained)
-   *  - The bundled source is scanned for forbidden literals (`node:*`,
-   *    `bun:*`, `require(`) and the build FAILS with a clear message if
-   *    any are found — saves authors the round-trip of finding out at
-   *    install time
-   *  - For 'modules' kind, only the default export is exfiltrated; for
-   *    'server' kind, the whole namespace becomes `__plugin_exports`
-   */
-  sandbox?: 'server' | 'modules'
-  /**
-   * When true, omit the host-runtime externals — use for `frontend.assets`
-   * script bundles. Published pages don't have the host import map, so
-   * frontend code can't rely on bare `react` / `@instatic/*` imports being
-   * resolved. Bundle locally (or stick to `window.__instatic`).
-   */
-  frontendBundle?: boolean
-  /**
-   * When true, omit the host-runtime externals while keeping ESM format.
-   * Use for `entrypoints.modules` (canvas module pack) bundles, which are
-   * loaded by BOTH the browser editor (via dynamic import — has the host
-   * import map) AND the server publisher / QuickJS sandbox (via
-   * `modulePackVm` — NO import map, no module resolver).
-   *
-   * The browser path could resolve bare `@instatic/plugin-sdk` imports
-   * via the import map, but the sandbox path cannot — and the SDK helpers
-   * that module packs use (`defineModule`, `control`, `html`, `raw`,
-   * `safeUrl`) are pure data builders with no React or host-state
-   * dependency, so inlining them is the simple, correct fix.
-   *
-   * Without this flag, modules bundles would ship bare
-   * `import { defineModule } from "@instatic/plugin-sdk"`, which fails
-   * at module-pack-activate time inside the sandbox, the registry never
-   * gets populated, and the publisher emits `<!-- instatic: unknown module -->`
-   * comments on published pages.
-   */
-  inlineHostRuntime?: boolean
-  /**
-   * Extra bare specifiers to externalize on top of the host-runtime defaults.
-   * Used for frontend bundles that lean on the published-page runtime
-   * importmap — e.g. a Three.js plugin imports `three` and
-   * `three/examples/jsm/...`, and both must stay as bare imports so the
-   * browser's importmap resolves them to the host's locally-installed copy.
-   * Subpath imports are matched via `<name>/*` glob so the addon files
-   * (`three/examples/jsm/controls/OrbitControls.js`) also survive bundling.
-   */
-  externalSpecifiers?: string[]
-}
-
-/**
- * Generate the IIFE facade source that re-exports the user's entrypoint to
- * a `globalThis.<slot>` so the QuickJS sandbox can find it. The user's
- * source is left untouched; this facade is bundled WITH it.
- *
- * For 'server' sandboxes the runner expects `__plugin_exports.activate`
- * etc. as direct properties — but plugin authors reasonably write either:
- *
- *   // shape A: named exports
- *   export function activate(api) { … }
- *   export function deactivate(api) { … }
- *
- *   // shape B: single default export — much more common in TS+ESM code
- *   const mod = { install, activate, deactivate, uninstall }
- *   export default mod
- *
- * Shape A maps cleanly to `import * as __plugin` (every named export shows
- * up as a property). Shape B does NOT — `__plugin.default` holds the
- * module object, and `__plugin.activate` is undefined, so the runner
- * silently no-ops the lifecycle hook. That's exactly the symptom we hit
- * with the uptime-monitor demo: install reported success but no schedules
- * landed because activate was never invoked.
- *
- * The facade therefore detects shape B at runtime and unwraps it. If the
- * default export looks like a plugin module (at least one of the known
- * lifecycle hooks is a function on it), we promote the default — falling
- * back to the namespace so shape A still works unchanged.
- *
- * For 'modules' sandboxes, only the default export is exfiltrated (the
- * SDK's `definePack` builder default-exports the array of modules).
- */
-function generateSandboxFacade(entrypointAbsolutePath: string, kind: 'server' | 'modules'): string {
-  // Bun's bundler accepts absolute paths in import specifiers.
-  const importPath = JSON.stringify(entrypointAbsolutePath)
-  if (kind === 'server') {
-    return [
-      `import * as __plugin from ${importPath};`,
-      `const __default = __plugin && __plugin.default;`,
-      `const __isPluginModule = (v) => v && typeof v === 'object' && (`,
-      `  typeof v.install === 'function' || typeof v.activate === 'function' ||`,
-      `  typeof v.deactivate === 'function' || typeof v.uninstall === 'function' ||`,
-      `  typeof v.migrate === 'function'`,
-      `);`,
-      `globalThis.__plugin_exports = __isPluginModule(__default) ? __default : __plugin;`,
-    ].join('\n')
-  }
-  return [
-    `import __default from ${importPath};`,
-    `globalThis.__module_pack = __default;`,
-  ].join('\n')
-}
-
-async function bundleEntrypoint(
-  sourcePath: string,
-  outFile: string,
-  options: BundleOptions = {},
-): Promise<void> {
-  // Externals layering, from most → least restrictive:
-  //  - Sandboxed bundles (server / modules) get NO externals: they run in a
-  //    QuickJS VM with no module resolver, so every dep must be inlined.
-  //  - Frontend bundles default to NO externals (published pages have no
-  //    import map of their own), but the caller can opt into runtime-resolved
-  //    externals via `externalSpecifiers` — used when the host is going to
-  //    emit an `<script type="importmap">` for the page's locked deps.
-  //  - Admin / editor bundles share the host's React + design system via
-  //    `HOST_RUNTIME_EXTERNALS` resolved by the editor's import map.
-  const externalSet = new Set<string>()
-  if (!options.sandbox) {
-    if (!options.frontendBundle && !options.inlineHostRuntime) {
-      for (const name of HOST_RUNTIME_EXTERNALS) externalSet.add(name)
-    }
-    for (const specifier of options.externalSpecifiers ?? []) {
-      externalSet.add(specifier)
-      // Bun.build (and esbuild) treat `name/*` as a glob — required to
-      // externalize subpath imports like `three/examples/jsm/...` while
-      // letting the bare `three` resolve via the same external.
-      externalSet.add(`${specifier}/*`)
-    }
-  }
-  const external = [...externalSet]
-
-  // Sandboxed bundles go through a generated facade so the bundler can
-  // resolve the user's entrypoint normally and we just hand-write the
-  // global-slot assignment. The facade lives next to the entrypoint
-  // briefly and is removed after the build.
-  let entryToBundle = sourcePath
-  let facadeCleanup: string | null = null
-  if (options.sandbox) {
-    const facade = generateSandboxFacade(resolve(sourcePath), options.sandbox)
-    const facadePath = join(dirname(sourcePath), `__sandbox-facade-${Date.now()}.ts`)
-    await writeFile(facadePath, facade, 'utf-8')
-    entryToBundle = facadePath
-    facadeCleanup = facadePath
-  }
-
-  try {
-    const result = await Bun.build({
-      entrypoints: [entryToBundle],
-      target: 'browser',
-      format: options.sandbox ? 'iife' : 'esm',
-      splitting: false,
-      minify: false,
-      external,
-      // Force production JSX. Without this, Bun's transpiler emits
-      // `import { jsxDEV } from "react/jsx-dev-runtime"` for every JSX
-      // expression — and that's fatal in a production host because React
-      // 19's `react-jsx-dev-runtime.production.js` intentionally exports
-      // `jsxDEV` as `void 0`. Plugin bundles then crash with
-      // "TypeError: jsxDEV is not a function" as soon as any of their
-      // components render. The runtime shim at
-      // `public/runtime/react-jsx-dev-runtime.js` falls back to
-      // `jsx`/`jsxs` defensively (for third-party plugins not built with
-      // this CLI), but bundles built here should import the production
-      // runtime directly. Bun's transpiler keys this off
-      // `process.env.NODE_ENV`, so inlining it as a define is enough —
-      // the `jsx` build-config field exists in the type defs but is not
-      // honored by the transpiler in Bun 1.3.
-      define: { 'process.env.NODE_ENV': '"production"' },
-    })
-    if (!result.success) {
-      const messages = result.logs.map((l) => l.message).join('\n')
-      throw new Error(`Failed to bundle ${sourcePath}:\n${messages}`)
-    }
-    const built = result.outputs[0]
-    if (!built) throw new Error(`No output from Bun.build for ${sourcePath}`)
-    const text = await built.text()
-
-    if (options.sandbox) {
-      // Defense in depth — fail the build NOW if the bundled output (after
-      // tree-shaking and external resolution) still references Node/Bun
-      // primitives. Plugin authors get a clear error instead of a
-      // sandbox-time activation failure.
-      assertSandboxSafe(text, sourcePath)
-    }
-
-    await mkdir(dirname(outFile), { recursive: true })
-    await writeFile(outFile, text, 'utf-8')
-  } finally {
-    if (facadeCleanup) await rm(facadeCleanup, { force: true })
-  }
-}
-
-/**
- * Walk `<sourceDir>/frontend/` and return every `.ts`/`.tsx` file as a
- * bundle target. Each source `frontend/<name>.{ts,tsx}` produces
- * `dist/frontend/<name>.js`. Files in nested directories are NOT bundled
- * automatically — only top-level files become assets, so a plugin can
- * keep helpers / types under `frontend/utils/` without producing dead
- * `dist/` output. Authors who need multiple bundles ship multiple
- * top-level files.
- */
-async function listFrontendSources(sourceDir: string): Promise<Array<{ absolutePath: string; outputPath: string }>> {
-  const frontendDir = join(sourceDir, 'frontend')
-  if (!existsSync(frontendDir)) return []
-  const out: Array<{ absolutePath: string; outputPath: string }> = []
-  for (const entry of readdirSync(frontendDir, { withFileTypes: true })) {
-    if (entry.isDirectory()) continue
-    const match = /^(?<name>[^.][^/]*)\.(?:tsx?|m?js)$/.exec(entry.name)
-    if (!match || !match.groups?.name) continue
-    out.push({
-      absolutePath: join(frontendDir, entry.name),
-      outputPath: `frontend/${match.groups.name}.js`,
-    })
-  }
-  out.sort((a, b) => (a.outputPath < b.outputPath ? -1 : a.outputPath > b.outputPath ? 1 : 0))
-  return out
-}
-
-async function findEntrypoint(sourceDir: string, basename: string): Promise<string | null> {
-  // Prefer .tsx so plugin entrypoints can use JSX directly.
-  for (const ext of ['tsx', 'ts', 'js', 'mjs']) {
-    const candidate = join(sourceDir, `${basename}.${ext}`)
-    if (existsSync(candidate)) return candidate
-  }
-  for (const ext of ['tsx', 'ts', 'js', 'mjs']) {
-    const candidate = join(sourceDir, basename, `index.${ext}`)
-    if (existsSync(candidate)) return candidate
-  }
-  return null
-}
-
-async function bundleAdminApps(
-  sourceDir: string,
-  outputDir: string,
-  definition: PluginDefinition,
-): Promise<void> {
-  for (const page of definition.manifest.adminPages) {
-    if (page.content.kind !== 'app') continue
-    const entry = page.content.entry
-    const sourceCandidate = join(sourceDir, entry)
-    // Plugin source is .tsx (JSX) or .ts (no JSX). The manifest's `entry`
-    // field always points at the BUNDLED output (.js); we resolve to one
-    // of the typed sources here.
-    const sourceTsx = sourceCandidate.replace(/\.js$/, '.tsx')
-    const sourceTs = sourceCandidate.replace(/\.js$/, '.ts')
-    const sourcePath = existsSync(sourceTsx)
-      ? sourceTsx
-      : existsSync(sourceTs)
-        ? sourceTs
-        : sourceCandidate
-    if (!existsSync(sourcePath)) {
-      throw new Error(`Admin app entry "${entry}" not found at ${sourcePath}`)
-    }
-    const outFile = join(outputDir, entry)
-    await bundleEntrypoint(sourcePath, outFile)
-  }
-}
-
 async function zipDirectory(sourceDir: string, zipPath: string): Promise<void> {
   await rm(zipPath, { force: true })
   await new Promise<void>((resolveZip, rejectZip) => {
@@ -377,91 +81,33 @@ export async function buildPlugin(
   await rm(distDir, { recursive: true, force: true })
   await mkdir(distDir, { recursive: true })
 
-  // 1. Manifest — build entrypoint paths from what we'll emit.
+  // 1. Manifest — build entrypoint paths from what the core will emit.
   const entrypoints: NonNullable<typeof definition.manifest.entrypoints> = {}
   if (definition.modules.length > 0) {
     entrypoints.modules = 'modules/index.js'
   }
-  const editorSource = await findEntrypoint(absoluteSource, 'editor')
-  if (editorSource) entrypoints.editor = 'editor/index.js'
-  const serverSource = await findEntrypoint(absoluteSource, 'server')
-  if (serverSource) entrypoints.server = 'server/index.js'
+  if (findEntrypoint(absoluteSource, 'editor')) entrypoints.editor = 'editor/index.js'
+  if (findEntrypoint(absoluteSource, 'server')) entrypoints.server = 'server/index.js'
 
-  // Frontend assets are declared explicitly in the manifest's
-  // `frontend.assets[]` array. The build doesn't need to invent a single
-  // entrypoint anymore — instead it bundles every `.ts`/`.tsx` source under
-  // `<sourceDir>/frontend/` to `<distDir>/frontend/<name>.js`. Authors
-  // reference the built path from their `frontend.assets[]` declaration.
-  const frontendSources = await listFrontendSources(absoluteSource)
-
-  const finalManifest = {
+  const finalManifest: PluginManifest = {
     ...definition.manifest,
     entrypoints,
     ...(definition.pack ? { pack: { path: 'pack/site.json' } } : {}),
   }
-  await writeFile(join(distDir, 'plugin.json'), JSON.stringify(finalManifest, null, 2), 'utf-8')
 
-  // 2. Modules entrypoint — bundle a generated facade that re-exports every
-  //    defined module via a default-exported array. The facade is written
-  //    next to the plugin source (not under dist/) so its relative imports
-  //    of `./modules/<file>` resolve correctly.
-  if (definition.modules.length > 0) {
-    const modulesFacade = generateModulesFacade(absoluteSource)
-    const modulesFacadePath = join(absoluteSource, '__modules-facade.ts')
-    await writeFile(modulesFacadePath, modulesFacade, 'utf-8')
-    try {
-      // Module packs are loaded by BOTH the browser editor (as an ES
-      // module via dynamic import for the canvas preview) AND the server
-      // (inside the QuickJS sandbox via `modulePackVm`). We emit ESM here;
-      // `modulePackVm.ts` runtime-transforms `export default …` into a
-      // `globalThis.__module_pack = …` assignment that QuickJS can eval.
-      //
-      // CRITICAL: `inlineHostRuntime: true` is what keeps the SDK helpers
-      // (defineModule / control / html / raw / safeUrl) bundled in. The
-      // sandbox path has no import map / no module resolver — without this
-      // flag, bare `import { defineModule } from "@instatic/plugin-sdk"`
-      // fails at activate time, the registry never receives the pack, and
-      // the publisher emits `<!-- instatic: unknown module -->` on every page
-      // that drops one of the plugin's modules.
-      await bundleEntrypoint(modulesFacadePath, join(distDir, 'modules', 'index.js'), {
-        inlineHostRuntime: true,
-      })
-    } finally {
-      await rm(modulesFacadePath, { force: true })
-    }
-  }
-
-  // 3. Editor / server / frontend entrypoints — passthrough bundle. Only
-  //    the server entrypoint runs in the host's QuickJS sandbox; the rest
-  //    run in the browser and externalize React + the host runtime
-  //    packages so plugins share host React via the editor's import map.
-  if (editorSource) await bundleEntrypoint(editorSource, join(distDir, 'editor', 'index.js'))
-  if (serverSource) {
-    await bundleEntrypoint(serverSource, join(distDir, 'server', 'index.js'), { sandbox: 'server' })
-  }
-  if (frontendSources.length > 0) {
-    // Collect every package any module declared as a runtime dependency.
-    // Frontend bundles that import those packages should leave the bare
-    // specifier in place — the published page's `<script type="importmap">`
-    // (emitted by the publisher from the site's lock) resolves them to
-    // host-served URLs at runtime, so multiple plugins share one copy.
-    const runtimeExternals = collectRuntimeExternals(definition.modules)
-    for (const entry of frontendSources) {
-      await bundleEntrypoint(
-        entry.absolutePath,
-        join(distDir, entry.outputPath),
-        {
-          frontendBundle: true,
-          ...(runtimeExternals.length > 0 ? { externalSpecifiers: runtimeExternals } : {}),
-        },
-      )
-    }
-  }
-
-  // 4. Admin apps — one bundle per declared app entry.
-  await bundleAdminApps(absoluteSource, distDir, definition)
+  // 2. Shared core — plugin.json + every entrypoint/frontend/admin bundle.
+  //    Frontend bundles leave module runtime dependencies external; the
+  //    published page's `<script type="importmap">` (emitted by the
+  //    publisher from the site's lock) resolves them so multiple plugins
+  //    share one copy.
+  await buildPluginPackage({
+    sourceDir: absoluteSource,
+    outputDir: distDir,
+    manifest: finalManifest,
+    frontendExternalSpecifiers: collectRuntimeExternals(definition.modules),
+  })
 
-  // 5. Pack.
+  // 3. Pack.
   if (definition.pack) {
     await mkdir(join(distDir, 'pack'), { recursive: true })
     await writeFile(
@@ -471,7 +117,7 @@ export async function buildPlugin(
     )
   }
 
-  // 5b. Marketplace icon — passthrough copy. The manifest path is
+  // 3b. Marketplace icon — passthrough copy. The manifest path is
   // validated by the schema (no `..` traversal, allowed extensions only),
   // so a missing file is the only realistic failure here.
   if (definition.manifest.icon) {
@@ -482,7 +128,7 @@ export async function buildPlugin(
     await copyFile(iconSource, join(distDir, definition.manifest.icon))
   }
 
-  // 6. Zip — skipped during `dev` mode where the dist directory is synced
+  // 4. Zip — skipped during `dev` mode where the dist directory is synced
   //    directly into the host's uploads folder.
   let zipPath = ''
   if (options.zip !== false) {
@@ -514,28 +160,3 @@ function collectRuntimeExternals(modules: PluginDefinition['modules']): string[]
   }
   return [...externals].sort()
 }
-
-/**
- * Generate a tiny facade module that imports each module file in
- * `<src>/modules/`, collects the default exports, and re-exports them as a
- * single array. The facade is what gets bundled into `dist/modules/index.js`.
- *
- * Convention: every `.ts` file directly under `<src>/modules/` whose default
- * export is a `PluginModuleDefinition` becomes a registered module.
- */
-function generateModulesFacade(sourceDir: string): string {
-  const modulesDir = join(sourceDir, 'modules')
-  if (!existsSync(modulesDir)) {
-    throw new Error(`Plugin declares modules but ${modulesDir} does not exist`)
-  }
-  const files = readdirSync(modulesDir)
-  const moduleFiles = files.filter((f) => /\.(ts|tsx|js|mjs)$/.test(f) && !f.startsWith('index.'))
-  if (moduleFiles.length === 0) {
-    throw new Error(`No module files found under ${modulesDir}`)
-  }
-  const imports = moduleFiles
-    .map((file, idx) => `import m${idx} from './modules/${file.replace(/\.(tsx?|m?js)$/, '')}'`)
-    .join('\n')
-  const defaultExport = `export default [${moduleFiles.map((_, idx) => `m${idx}`).join(', ')}]`
-  return `${imports}\n${defaultExport}\n`
-}

From 46cdc808d592b56622f9040b05b1e5aa06129e12 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 14:27:52 +0200
Subject: [PATCH 03/36] =?UTF-8?q?feat(site-plugins):=20server=20engine=20?=
 =?UTF-8?q?=E2=80=94=20source=20model,=20workspace=20build,=20lifecycle=20?=
 =?UTF-8?q?endpoints,=20publish=20coupling?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- @core/site-plugins: folder-convention discovery over draft SiteFile[],
  author-manifest validation (derived fields rejected via
  additionalProperties:false against the runtime manifest's own field
  schemas), runtime-manifest derivation through the REAL parser,
  order-independent content hash, generated 1.0.<n>+<hash> versions,
  scaffold templates, and the runtime-state machine shared by server + UI.
- server/plugins/sitePlugins: temp-workspace materializer (path-safe,
  realpath'd), build orchestrator (single-flight per plugin, validate-only
  mode returning the modules bundle for canvas preview, 30s timeout,
  fail-closed containment with '@instatic/plugin-sdk' mapped to the host
  SDK), and revision retention (active + previous kept for rollback).
- Extracted activatePluginPackageFromDisk from the zip install/upgrade
  path — site plugins ride the exact same lifecycle (install→activate,
  deactivate→migrate→activate with rollback), zero runtime branches.
- /admin/api/cms/site-plugins routes: list (union of draft folders and
  site-local rows with computed states), scaffold (site.structure.edit),
  validate + preview-pack (no elevated capability), activate/rollback
  (plugins.install; step-up only on first activation and grant changes),
  delete (row + assets + draft source; step-up).
- Publish coupling: visitor-facing activations republish before revision
  GC so baked pages never reference a deleted revision.
- sitePluginRoute SDK helper for stable frontend→backend calls.
- manifest.ts split into schemas + parser modules (size ceiling); the
  siteDocument file-type validator now derives from SITE_FILE_TYPES
  (killed a parallel hardcoded list that silently dropped 'plugin' files).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 server/handlers/cms/index.ts                  |   6 +
 server/handlers/cms/plugins/install.ts        | 175 +++--
 server/handlers/cms/plugins/state.ts          |  59 +-
 server/handlers/cms/sitePlugins.ts            | 631 ++++++++++++++++++
 server/plugins/sitePlugins/build.ts           | 160 +++++
 server/plugins/sitePlugins/retention.ts       |  83 +++
 server/plugins/sitePlugins/workspace.ts       |  44 ++
 src/__tests__/server/sitePluginBuild.test.ts  | 148 ++++
 .../server/sitePluginLifecycle.test.ts        | 278 ++++++++
 .../server/sitePluginRetention.test.ts        |  69 ++
 .../sitePlugins/sitePluginRoute.test.ts       |  11 +
 src/__tests__/sitePlugins/sourceModel.test.ts | 169 +++++
 src/core/files/schemas.ts                     |  34 +-
 src/core/page-tree/siteDocument.ts            |   4 +-
 src/core/plugin-build/buildPackage.ts         |  48 +-
 src/core/plugin-build/bundle.ts               |   3 +-
 src/core/plugin-build/containment.ts          |  19 +-
 src/core/plugin-build/index.ts                |   2 +-
 src/core/plugin-sdk/index.ts                  |   1 +
 src/core/plugin-sdk/sitePluginRoute.ts        |  16 +
 src/core/plugins/manifest.ts                  | 369 +---------
 src/core/plugins/manifestSchemas.ts           | 388 +++++++++++
 src/core/site-plugins/derive.ts               | 154 +++++
 src/core/site-plugins/discover.ts             |  45 ++
 src/core/site-plugins/index.ts                |  49 ++
 src/core/site-plugins/schemas.ts              |  72 ++
 src/core/site-plugins/state.ts                | 145 ++++
 src/core/site-plugins/templates.ts            | 144 ++++
 28 files changed, 2867 insertions(+), 459 deletions(-)
 create mode 100644 server/handlers/cms/sitePlugins.ts
 create mode 100644 server/plugins/sitePlugins/build.ts
 create mode 100644 server/plugins/sitePlugins/retention.ts
 create mode 100644 server/plugins/sitePlugins/workspace.ts
 create mode 100644 src/__tests__/server/sitePluginBuild.test.ts
 create mode 100644 src/__tests__/server/sitePluginLifecycle.test.ts
 create mode 100644 src/__tests__/server/sitePluginRetention.test.ts
 create mode 100644 src/__tests__/sitePlugins/sitePluginRoute.test.ts
 create mode 100644 src/__tests__/sitePlugins/sourceModel.test.ts
 create mode 100644 src/core/plugin-sdk/sitePluginRoute.ts
 create mode 100644 src/core/plugins/manifestSchemas.ts
 create mode 100644 src/core/site-plugins/derive.ts
 create mode 100644 src/core/site-plugins/discover.ts
 create mode 100644 src/core/site-plugins/index.ts
 create mode 100644 src/core/site-plugins/schemas.ts
 create mode 100644 src/core/site-plugins/state.ts
 create mode 100644 src/core/site-plugins/templates.ts

diff --git a/server/handlers/cms/index.ts b/server/handlers/cms/index.ts
index b7ce0e53c..0e62c4da9 100644
--- a/server/handlers/cms/index.ts
+++ b/server/handlers/cms/index.ts
@@ -49,6 +49,7 @@ import { handleMediaRoutes } from './media'
 import { handleMediaFolderRoutes } from './mediaFolders'
 import { handleMediaStorageAdminRoutes } from './mediaStorageAdmin'
 import { handlePluginsRoutes } from './plugins'
+import { handleSitePluginsRoutes } from './sitePlugins'
 import { handleDataRoutes } from './data'
 import { handleDashboardRoutes } from './dashboard'
 import { handleFontsRoutes } from './fonts'
@@ -126,6 +127,11 @@ export async function handleCmsRequest(
     ?? (await handleMediaStorageAdminRoutes(req, db, options))
     ?? (await handleMediaRoutes(req, db))
     ?? (await handlePluginsRoutes(req, db, options))
+    // Site plugins — authored in the site draft, activated through the same
+    // plugin lifecycle. Paths (`/site-plugins/...`) are disjoint from
+    // `/plugins/...`; adjacency here is for reading order only. They read the
+    // main draft: putting plugin sources on a branch is its own phase.
+    ?? (await handleSitePluginsRoutes(req, db, options))
     ?? (await handleDataRoutes(req, db, scope, options))
     // Dashboard stats — read-only aggregate counts used by the admin
     // dashboard widgets. Lives after data routes so future routes
diff --git a/server/handlers/cms/plugins/install.ts b/server/handlers/cms/plugins/install.ts
index be2f2eec2..84bdcbc50 100644
--- a/server/handlers/cms/plugins/install.ts
+++ b/server/handlers/cms/plugins/install.ts
@@ -30,6 +30,7 @@ import {
 import { parsePluginManifest } from '@core/plugins/manifest'
 import type {
   InstalledPlugin,
+  InstalledPluginSource,
   PluginManifest,
   PluginPermission,
 } from '@core/plugin-sdk'
@@ -208,23 +209,62 @@ interface InstallContext {
 // Fresh install
 // ---------------------------------------------------------------------------
 
-async function installFreshFromPackage(ctx: InstallContext): Promise<Response> {
-  const { db, options, user, req, pluginPackage, grantedPermissions } = ctx
-  // `uploadsDir` was checked by the caller; assert to narrow the type.
-  if (!options.uploadsDir) throw new Error('uploadsDir required')
+// ---------------------------------------------------------------------------
+// Disk-package activation seam
+//
+// The lifecycle half of an install/upgrade, decoupled from HOW the package
+// landed on disk. Two callers: the zip route below (writes the uploaded
+// files first) and the site plugin engine (the build already wrote the
+// package under uploads/plugins/site.<id>/<version>/). One lifecycle path,
+// zero site-local branches downstream.
+// ---------------------------------------------------------------------------
 
-  const manifest = await writePluginPackageFiles(
-    options.uploadsDir,
-    pluginPackage.manifest,
-    pluginPackage.files,
-  )
-  const installed = await installPlugin(db, manifest, grantedPermissions)
+export interface ActivatePackageFromDiskInput {
+  db: DbClient
+  options: CmsHandlerOptions
+  user: AuthUser
+  req: Request
+  /** Manifest whose assetBasePath already points at files ON DISK. */
+  manifest: PluginManifest
+  grantedPermissions: PluginPermission[]
+  source: InstalledPluginSource
+}
+
+export interface ActivatePackageOutcome {
+  plugin: InstalledPlugin
+  pack: PluginPackSummary | null
+  upgrade?: { fromVersion: string; toVersion: string }
+  /** Set when an upgrade failed and rolled back — the caller reports it. */
+  upgradeError?: string
+}
+
+/**
+ * Fresh install or upgrade, decided by the existing-row lookup. Runs the
+ * full plugin lifecycle: fresh = `install` -> `activate`; upgrade = old
+ * `deactivate` -> row swap -> `migrate({ fromVersion })` -> `activate`,
+ * with rollback to the previous version on failure. Audit + event
+ * broadcast included. Callers with version-ordering rules (the zip route
+ * rejects downgrades) enforce them BEFORE calling.
+ */
+export async function activatePluginPackageFromDisk(
+  input: ActivatePackageFromDiskInput,
+): Promise<ActivatePackageOutcome> {
+  const existingResult = await getInstalledPlugin(input.db, input.manifest.id)
+  const existing = existingResult?.kind === 'ok' ? existingResult.plugin : null
+  if (existing && semverGt(input.manifest.version, existing.version)) {
+    return upgradeFromDisk(input, existing)
+  }
+  return freshInstallFromDisk(input)
+}
+
+async function freshInstallFromDisk(
+  input: ActivatePackageFromDiskInput,
+): Promise<ActivatePackageOutcome> {
+  const { db, options, user, req, manifest, grantedPermissions, source } = input
+  const installed = await installPlugin(db, manifest, grantedPermissions, { source })
   const installLifecycle = await runPluginLifecycleHook(db, installed, options, 'install', 'installed')
   if (!installLifecycle.ok) {
-    return jsonResponse(
-      { plugin: await presentPluginSecrets(db, installLifecycle.plugin), ...(await pluginsPayload(db)) },
-      { status: 201 },
-    )
+    return { plugin: installLifecycle.plugin, pack: null }
   }
 
   // Reset worker + host state so partial registrations from `install` don't
@@ -257,11 +297,33 @@ async function installFreshFromPackage(ctx: InstallContext): Promise<Response> {
     version: activateLifecycle.plugin.version,
     occurredAt: new Date().toISOString(),
   })
+  return { plugin: activateLifecycle.plugin, pack: packSummary }
+}
+
+async function installFreshFromPackage(ctx: InstallContext): Promise<Response> {
+  const { db, options, user, req, pluginPackage, grantedPermissions } = ctx
+  // `uploadsDir` was checked by the caller; assert to narrow the type.
+  if (!options.uploadsDir) throw new Error('uploadsDir required')
+
+  const manifest = await writePluginPackageFiles(
+    options.uploadsDir,
+    pluginPackage.manifest,
+    pluginPackage.files,
+  )
+  const outcome = await freshInstallFromDisk({
+    db,
+    options,
+    user,
+    req,
+    manifest,
+    grantedPermissions,
+    source: 'installed',
+  })
   return jsonResponse(
     {
-      plugin: await presentPluginSecrets(db, activateLifecycle.plugin),
+      plugin: await presentPluginSecrets(db, outcome.plugin),
       ...(await pluginsPayload(db)),
-      pack: packSummary,
+      ...(outcome.pack !== null ? { pack: outcome.pack } : {}),
     },
     { status: 201 },
   )
@@ -300,8 +362,42 @@ interface UpgradeContext extends InstallContext {
 async function installUpgradeFromPackage(ctx: UpgradeContext): Promise<Response> {
   const { db, options, user, req, existing, pluginPackage, grantedPermissions } = ctx
   if (!options.uploadsDir) throw new Error('uploadsDir required')
+
+  // Write new assets, then ride the shared disk-activation upgrade path.
+  const newManifest = await writePluginPackageFiles(
+    options.uploadsDir,
+    pluginPackage.manifest,
+    pluginPackage.files,
+  )
+  const outcome = await upgradeFromDisk(
+    { db, options, user, req, manifest: newManifest, grantedPermissions, source: 'installed' },
+    existing,
+  )
+  if (outcome.upgradeError) {
+    return jsonResponse(
+      { error: outcome.upgradeError, ...(await pluginsPayload(db)) },
+      { status: 400 },
+    )
+  }
+  return jsonResponse(
+    {
+      plugin: await presentPluginSecrets(db, outcome.plugin),
+      ...(await pluginsPayload(db)),
+      ...(outcome.pack !== null ? { pack: outcome.pack } : {}),
+      upgrade: outcome.upgrade,
+    },
+    { status: 200 },
+  )
+}
+
+async function upgradeFromDisk(
+  input: ActivatePackageFromDiskInput,
+  existing: InstalledPlugin,
+): Promise<ActivatePackageOutcome> {
+  const { db, options, user, req, manifest: newManifest, grantedPermissions, source } = input
+  if (!options.uploadsDir) throw new Error('uploadsDir required')
   const fromVersion = existing.version
-  const newVersion = pluginPackage.manifest.version
+  const newVersion = newManifest.version
   const pluginId = existing.id
 
   // 1. Deactivate the old version. Best-effort — a deactivate failure
@@ -309,16 +405,9 @@ async function installUpgradeFromPackage(ctx: UpgradeContext): Promise<Response>
   //    about to replace it anyway). We log and move on.
   await teardownPreviousVersion(db, pluginId, existing, options.uploadsDir)
 
-  // 2. Write new assets.
-  const newManifest = await writePluginPackageFiles(
-    options.uploadsDir,
-    pluginPackage.manifest,
-    pluginPackage.files,
-  )
-
-  // 3. Replace DB row. `installPlugin` upserts — settings_json + installed_at
+  // 2. Replace DB row. `installPlugin` upserts — settings_json + installed_at
   //    are preserved by the SET clause (it doesn't reference them).
-  const upgraded = await installPlugin(db, newManifest, grantedPermissions)
+  const upgraded = await installPlugin(db, newManifest, grantedPermissions, { source })
   // Refresh settings cache from the upserted row (merging decrypted secrets)
   // so the worker's `loadPluginServerEntrypoint` seeds the right values into
   // the worker's local mirror.
@@ -353,13 +442,14 @@ async function installUpgradeFromPackage(ctx: UpgradeContext): Promise<Response>
     const failureMessage = lifecycleErrorMessage(err)
     console.error(`[plugin:${pluginId}] upgrade ${fromVersion} → ${newVersion} failed:`, err)
     await rollbackUpgrade({ db, options, existing, newManifest })
-    return jsonResponse(
-      {
-        error: `Upgrade failed: ${failureMessage}. Rolled back to version ${fromVersion}.`,
-        ...(await pluginsPayload(db)),
-      },
-      { status: 400 },
-    )
+    const rolledBackResult = await getInstalledPlugin(db, pluginId)
+    const rolledBack =
+      (rolledBackResult?.kind === 'ok' ? rolledBackResult.plugin : null) ?? existing
+    return {
+      plugin: rolledBack,
+      pack: null,
+      upgradeError: `Upgrade failed: ${failureMessage}. Rolled back to version ${fromVersion}.`,
+    }
   }
 
   // 6. The old version's files STAY. Published pages link plugin frontend
@@ -394,15 +484,11 @@ async function installUpgradeFromPackage(ctx: UpgradeContext): Promise<Response>
     toVersion: newVersion,
     occurredAt: new Date().toISOString(),
   })
-  return jsonResponse(
-    {
-      plugin: await presentPluginSecrets(db, finalRow),
-      ...(await pluginsPayload(db)),
-      pack: packSummary,
-      upgrade: { fromVersion, toVersion: newVersion },
-    },
-    { status: 200 },
-  )
+  return {
+    plugin: finalRow,
+    pack: packSummary,
+    upgrade: { fromVersion, toVersion: newVersion },
+  }
 }
 
 /**
@@ -458,12 +544,13 @@ async function rollbackUpgrade(args: {
   const { db, options, existing, newManifest } = args
   const pluginId = existing.id
 
-  // Restore DB row to previous manifest + grants. The upsert preserves
-  // settings + installed_at automatically.
+  // Restore DB row to previous manifest + grants (provenance included).
+  // The upsert preserves settings + installed_at automatically.
   const restored = await installPlugin(
     db,
     pluginManifestWithGrants(existing),
     existing.grantedPermissions,
+    { source: existing.source },
   )
 
   // Drop new version assets — the upgrade didn't take. With worker
diff --git a/server/handlers/cms/plugins/state.ts b/server/handlers/cms/plugins/state.ts
index 47b19d504..a48744aff 100644
--- a/server/handlers/cms/plugins/state.ts
+++ b/server/handlers/cms/plugins/state.ts
@@ -129,31 +129,48 @@ export async function handlePluginItem(
 
   if (req.method === 'DELETE') {
     const force = new URL(req.url).searchParams.get('force') === 'true'
-    const lookup = await getInstalledPlugin(db, pluginId)
-    if (!lookup) return pluginNotFound()
+    return uninstallPluginById(req, db, options, user, pluginId, force)
+  }
 
-    // Lifecycle hooks run only on the normal path with a parseable manifest:
-    // `?force=true` is the operator's escape hatch for a throwing or
-    // unloadable hook, and a corrupt manifest has no valid plugin to run
-    // hooks on. Both skip straight to teardown.
-    if (!force && lookup.kind === 'ok') {
-      let current = lookup.plugin
-      // Uninstall contract: "(if active) deactivate → uninstall". Run
-      // deactivate first so the plugin tears down its active-state
-      // resources before the uninstall hook does its permanent cleanup.
-      if (current.lifecycleStatus === 'active') {
-        const deactivated = await runPluginLifecycleHook(db, current, options, 'deactivate', 'disabled')
-        if (!deactivated.ok) return uninstallHookFailure('deactivate', deactivated.plugin)
-        current = deactivated.plugin
-      }
-      const uninstalled = await runPluginLifecycleHook(db, current, options, 'uninstall', current.lifecycleStatus)
-      if (!uninstalled.ok) return uninstallHookFailure('uninstall', uninstalled.plugin)
-    }
+  return methodNotAllowed()
+}
 
-    return removePluginCompletely(req, db, options, user, pluginId, force)
+/**
+ * The full uninstall path — lifecycle hooks (unless forced or the manifest
+ * is corrupt) followed by complete teardown. Shared by the plugin DELETE
+ * route above and the site plugin delete route (which additionally removes
+ * the draft source folder).
+ */
+export async function uninstallPluginById(
+  req: Request,
+  db: DbClient,
+  options: CmsHandlerOptions,
+  user: AuthUser,
+  pluginId: string,
+  force: boolean,
+): Promise<Response> {
+  const lookup = await getInstalledPlugin(db, pluginId)
+  if (!lookup) return pluginNotFound()
+
+  // Lifecycle hooks run only on the normal path with a parseable manifest:
+  // `?force=true` is the operator's escape hatch for a throwing or
+  // unloadable hook, and a corrupt manifest has no valid plugin to run
+  // hooks on. Both skip straight to teardown.
+  if (!force && lookup.kind === 'ok') {
+    let current = lookup.plugin
+    // Uninstall contract: "(if active) deactivate → uninstall". Run
+    // deactivate first so the plugin tears down its active-state
+    // resources before the uninstall hook does its permanent cleanup.
+    if (current.lifecycleStatus === 'active') {
+      const deactivated = await runPluginLifecycleHook(db, current, options, 'deactivate', 'disabled')
+      if (!deactivated.ok) return uninstallHookFailure('deactivate', deactivated.plugin)
+      current = deactivated.plugin
+    }
+    const uninstalled = await runPluginLifecycleHook(db, current, options, 'uninstall', current.lifecycleStatus)
+    if (!uninstalled.ok) return uninstallHookFailure('uninstall', uninstalled.plugin)
   }
 
-  return methodNotAllowed()
+  return removePluginCompletely(req, db, options, user, pluginId, force)
 }
 
 /**
diff --git a/server/handlers/cms/sitePlugins.ts b/server/handlers/cms/sitePlugins.ts
new file mode 100644
index 000000000..f34facfb7
--- /dev/null
+++ b/server/handlers/cms/sitePlugins.ts
@@ -0,0 +1,631 @@
+/**
+ * Site plugin admin endpoints — the authoring/lifecycle surface for plugins
+ * built from the site draft (docs/features/site-plugins.md).
+ *
+ *   GET    /admin/api/cms/site-plugins                        — union of draft plugins/* folders and
+ *                                                               site-local runtime rows, with computed states
+ *   POST   /admin/api/cms/site-plugins                        — scaffold a new site plugin into the draft
+ *   POST   /admin/api/cms/site-plugins/:localId/validate      — validate-only build → diagnostics
+ *   GET    /admin/api/cms/site-plugins/:localId/preview-pack.js — draft module pack bundle (session-local canvas preview)
+ *   POST   /admin/api/cms/site-plugins/:localId/activate      — build + install/upgrade lifecycle (+ publish coupling)
+ *   POST   /admin/api/cms/site-plugins/:localId/rollback      — re-activate the retained previous revision
+ *   DELETE /admin/api/cms/site-plugins/:localId[?force=true]  — uninstall runtime row + delete draft source
+ *
+ * Authority model (design → "Activation Semantics"):
+ *   - authoring (scaffold) needs site write capability, never plugins.install;
+ *   - validation/preview need no elevated capability (site.read);
+ *   - activation needs `plugins.install`, with step-up ONLY on the consent
+ *     moments — first activation and grant-set changes. Same-grant rebuilds
+ *     skip both the review and the step-up.
+ *
+ * Deactivate/restart/settings/logs ride the EXISTING plugin routes by id
+ * (`site.<localId>` is an ordinary installed_plugins row) — no duplicates.
+ */
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { nanoid } from 'nanoid'
+import type { SiteFile } from '@core/files/schemas'
+import type { PluginManifest } from '@core/plugin-sdk'
+import { parsePluginManifest } from '@core/plugins/manifest'
+import {
+  SITE_PLUGIN_LOCAL_ID_PATTERN,
+  SITE_PLUGIN_TEMPLATE_IDS,
+  computeSitePluginContentHash,
+  computeSitePluginState,
+  contentHashOfVersion,
+  deriveSitePluginManifest,
+  discoverSitePlugins,
+  sitePluginFolder,
+  sitePluginIdFromLocalId,
+  sitePluginTemplateFiles,
+  type SitePluginSummary,
+} from '@core/site-plugins'
+import { Type } from '@core/utils/typeboxHelpers'
+import { getErrorMessage } from '@core/utils/errorMessage'
+import type { DbClient } from '../../db/client'
+import type { AuthUser } from '../../repositories/users'
+import {
+  requireAnyCapability,
+  requireCapability,
+  requireStepUp,
+} from '../../auth/authz'
+import { getDraftSite, saveDraftSite } from '../../repositories/site'
+import { getInstalledPlugin, listInstalledPlugins } from '../../repositories/plugins'
+import { runPublishFlush } from '../../publish/publishFlush'
+import { republishAllPages } from '../../publish/republish'
+import { bumpPublishVersionSerialized } from '../../publish/publishState'
+import { buildSitePlugin } from '../../plugins/sitePlugins/build'
+import {
+  previousSitePluginRevision,
+  sweepSitePluginRevisions,
+} from '../../plugins/sitePlugins/retention'
+import { badRequest, jsonResponse, methodNotAllowed, readValidatedBody } from '../../http'
+import { type CmsHandlerOptions } from './shared'
+import { activatePluginPackageFromDisk } from './plugins/install'
+import { presentPluginSecrets } from './plugins/shared'
+import { uninstallPluginById } from './plugins/state'
+
+const COLLECTION_PATH = '/admin/api/cms/site-plugins'
+const ITEM_PATTERN = /^\/admin\/api\/cms\/site-plugins\/(?<localId>[^/]+)$/
+const VALIDATE_PATTERN = /^\/admin\/api\/cms\/site-plugins\/(?<localId>[^/]+)\/validate$/
+const PREVIEW_PACK_PATTERN = /^\/admin\/api\/cms\/site-plugins\/(?<localId>[^/]+)\/preview-pack\.js$/
+const ACTIVATE_PATTERN = /^\/admin\/api\/cms\/site-plugins\/(?<localId>[^/]+)\/activate$/
+const ROLLBACK_PATTERN = /^\/admin\/api\/cms\/site-plugins\/(?<localId>[^/]+)\/rollback$/
+
+// ---------------------------------------------------------------------------
+// Draft access
+// ---------------------------------------------------------------------------
+
+/**
+ * Read the persisted draft's plugin files — flushing the collab relay first
+ * so edits still inside the persist debounce window are included ("flush
+ * the editor's pending save, then read the persisted draft").
+ */
+async function readDraftPluginFiles(db: DbClient): Promise<SiteFile[]> {
+  await runPublishFlush()
+  const shell = await getDraftSite(db)
+  return shell?.files.filter((file) => file.type === 'plugin') ?? []
+}
+
+function sameStringSet(a: readonly string[], b: readonly string[]): boolean {
+  if (a.length !== b.length) return false
+  const sortedA = [...a].sort()
+  const sortedB = [...b].sort()
+  return sortedA.every((value, index) => value === sortedB[index])
+}
+
+// ---------------------------------------------------------------------------
+// GET /site-plugins — the list
+// ---------------------------------------------------------------------------
+
+async function listSitePlugins(db: DbClient): Promise<SitePluginSummary[]> {
+  const draftFiles = await readDraftPluginFiles(db)
+  let discovered: ReturnType<typeof discoverSitePlugins>
+  try {
+    discovered = discoverSitePlugins(draftFiles)
+  } catch (err) {
+    // An invalid local id in the draft must not blank the whole list — the
+    // offending folder simply can't be discovered until renamed.
+    console.error('[site-plugins] draft discovery failed:', err)
+    discovered = []
+  }
+  const draftByLocalId = new Map(discovered.map((plugin) => [plugin.localId, plugin]))
+
+  const rows = (await listInstalledPlugins(db))
+    .flatMap((result) => (result.kind === 'ok' ? [result.plugin] : []))
+    .filter((plugin) => plugin.source === 'site-local')
+  const rowByLocalId = new Map(
+    rows.map((plugin) => [plugin.id.replace(/^site\./, ''), plugin]),
+  )
+
+  // Union — a deleted folder must never hide a still-running backend.
+  const localIds = [...new Set([...draftByLocalId.keys(), ...rowByLocalId.keys()])].sort()
+
+  return localIds.map((localId) => {
+    const draft = draftByLocalId.get(localId) ?? null
+    const row = rowByLocalId.get(localId) ?? null
+
+    let manifest: PluginManifest | null = null
+    let manifestError: string | null = null
+    let draftContentHash: string | null = null
+    if (draft) {
+      draftContentHash = computeSitePluginContentHash(draft.files)
+      if (draft.manifestFile?.content) {
+        try {
+          manifest = deriveSitePluginManifest({
+            localId,
+            draftManifestJson: draft.manifestFile.content,
+            files: draft.files,
+            previousVersion: row?.version ?? null,
+            contentHash: draftContentHash,
+          })
+        } catch (err) {
+          manifestError = getErrorMessage(err, 'Invalid site plugin manifest')
+        }
+      } else {
+        manifestError = `plugins/${localId}/plugin.json is missing`
+      }
+    }
+
+    const declared = manifest?.permissions ?? []
+    const granted = row?.grantedPermissions ?? []
+    const grantsChanged = manifest !== null && row !== null && !sameStringSet(declared, granted)
+
+    const state = computeSitePluginState({
+      hasDraftSource: draft !== null,
+      row: row
+        ? { version: row.version, lifecycleStatus: row.lifecycleStatus, enabled: row.enabled }
+        : null,
+      manifestError,
+      draftContentHash,
+      activeContentHash: contentHashOfVersion(row?.version),
+      grantsChanged,
+    })
+
+    return {
+      localId,
+      pluginId: sitePluginIdFromLocalId(localId),
+      name: manifest?.name ?? row?.name ?? localId,
+      state,
+      activeVersion: row?.version ?? null,
+      hasDraftSource: draft !== null,
+      hasModules: Boolean(manifest?.entrypoints?.modules),
+      declaredPermissions: declared,
+      grantedPermissions: granted,
+      newPermissions: declared.filter((permission) => !granted.includes(permission)),
+      removedPermissions: granted.filter((permission) => !declared.includes(permission)),
+      manifestError,
+      lastError: row?.lastError ?? null,
+    }
+  })
+}
+
+// ---------------------------------------------------------------------------
+// POST /site-plugins — scaffold
+// ---------------------------------------------------------------------------
+
+const ScaffoldBodySchema = Type.Object({
+  name: Type.String({ minLength: 1, maxLength: 80 }),
+  localId: Type.String({ pattern: SITE_PLUGIN_LOCAL_ID_PATTERN.source, maxLength: 64 }),
+  template: Type.Union(SITE_PLUGIN_TEMPLATE_IDS.map((id) => Type.Literal(id))),
+})
+
+async function handleScaffold(req: Request, db: DbClient): Promise<Response> {
+  const body = await readValidatedBody(req, ScaffoldBodySchema)
+  if (!body) {
+    return badRequest(
+      'Invalid site plugin scaffold — name, kebab-case localId, and a valid template are required',
+    )
+  }
+
+  await runPublishFlush()
+  const shell = await getDraftSite(db)
+  if (!shell) return badRequest('No draft site exists yet')
+
+  const folder = sitePluginFolder(body.localId)
+  if (shell.files.some((file) => file.path.startsWith(folder))) {
+    return jsonResponse(
+      { error: `A site plugin folder "${folder}" already exists` },
+      { status: 409 },
+    )
+  }
+  const existingRow = await getInstalledPlugin(db, sitePluginIdFromLocalId(body.localId))
+  if (existingRow) {
+    return jsonResponse(
+      { error: `A site plugin "${body.localId}" already has a runtime record — pick another id` },
+      { status: 409 },
+    )
+  }
+
+  const now = Date.now()
+  const created: SiteFile[] = sitePluginTemplateFiles(body.template, body.localId, body.name).map(
+    (file) => ({
+      id: nanoid(),
+      path: file.path,
+      type: 'plugin',
+      content: file.content,
+      createdAt: now,
+      updatedAt: now,
+    }),
+  )
+
+  // Out-of-relay shell write — saveDraftSite fires notifyShellWrite, the
+  // relay resets the site doc, and connected editors rebind with the new
+  // files. The scaffold is a rare, explicit action; the reset is the
+  // designed path for external writers.
+  await saveDraftSite(db, {
+    ...shell,
+    files: [...shell.files, ...created],
+    updatedAt: now,
+  })
+
+  return jsonResponse(
+    { ok: true, localId: body.localId, files: created.map((file) => file.path) },
+    { status: 201 },
+  )
+}
+
+// ---------------------------------------------------------------------------
+// POST /site-plugins/:localId/validate — diagnostics without activation
+// ---------------------------------------------------------------------------
+
+async function handleValidate(db: DbClient, localId: string): Promise<Response> {
+  const draftFiles = await readDraftPluginFiles(db)
+  const plugin = discoverSitePlugins(draftFiles).find((entry) => entry.localId === localId)
+  if (!plugin) {
+    return jsonResponse({ error: `No site plugin source at plugins/${localId}/` }, { status: 404 })
+  }
+  const rowResult = await getInstalledPlugin(db, sitePluginIdFromLocalId(localId))
+  const row = rowResult?.kind === 'ok' ? rowResult.plugin : null
+  const result = await buildSitePlugin({
+    localId,
+    files: plugin.files,
+    previousVersion: row?.version ?? null,
+    validateOnly: true,
+  })
+  if (!result.ok) {
+    return jsonResponse({ ok: false, diagnostics: result.diagnostics })
+  }
+  return jsonResponse({ ok: true, diagnostics: [] })
+}
+
+// ---------------------------------------------------------------------------
+// GET /site-plugins/:localId/preview-pack.js — session-local canvas preview
+// ---------------------------------------------------------------------------
+
+async function handlePreviewPack(db: DbClient, localId: string): Promise<Response> {
+  const draftFiles = await readDraftPluginFiles(db)
+  const plugin = discoverSitePlugins(draftFiles).find((entry) => entry.localId === localId)
+  if (!plugin) {
+    return jsonResponse({ error: `No site plugin source at plugins/${localId}/` }, { status: 404 })
+  }
+  const rowResult = await getInstalledPlugin(db, sitePluginIdFromLocalId(localId))
+  const row = rowResult?.kind === 'ok' ? rowResult.plugin : null
+  const result = await buildSitePlugin({
+    localId,
+    files: plugin.files,
+    previousVersion: row?.version ?? null,
+    validateOnly: true,
+  })
+  if (!result.ok) {
+    return jsonResponse(
+      { error: `Draft build failed: ${result.diagnostics.join('; ')}` },
+      { status: 404 },
+    )
+  }
+  if (result.modulesBundle === undefined) {
+    return jsonResponse(
+      { error: `Site plugin "${localId}" declares no module pack` },
+      { status: 404 },
+    )
+  }
+  // Draft bundles must never cache — every preview reflects the current draft.
+  return new Response(result.modulesBundle, {
+    headers: {
+      'content-type': 'application/javascript; charset=utf-8',
+      'cache-control': 'no-store',
+    },
+  })
+}
+
+// ---------------------------------------------------------------------------
+// POST /site-plugins/:localId/activate — Build & activate
+// ---------------------------------------------------------------------------
+
+async function handleActivate(
+  req: Request,
+  db: DbClient,
+  options: CmsHandlerOptions,
+  user: AuthUser,
+  localId: string,
+): Promise<Response> {
+  if (!options.uploadsDir) {
+    return jsonResponse({ error: 'Uploads directory is not configured' }, { status: 500 })
+  }
+  const draftFiles = await readDraftPluginFiles(db)
+  const plugin = discoverSitePlugins(draftFiles).find((entry) => entry.localId === localId)
+  if (!plugin) {
+    return jsonResponse({ error: `No site plugin source at plugins/${localId}/` }, { status: 404 })
+  }
+  if (!plugin.manifestFile?.content) {
+    return badRequest(`plugins/${localId}/plugin.json is missing`)
+  }
+
+  const rowResult = await getInstalledPlugin(db, sitePluginIdFromLocalId(localId))
+  const row = rowResult?.kind === 'ok' ? rowResult.plugin : null
+  const contentHash = computeSitePluginContentHash(plugin.files)
+
+  // Skip when the active revision already matches the draft source.
+  if (
+    row &&
+    row.lifecycleStatus === 'active' &&
+    contentHashOfVersion(row.version) === contentHash
+  ) {
+    return jsonResponse({
+      plugin: await presentPluginSecrets(db, row),
+      skipped: true,
+      sitePlugins: await listSitePlugins(db),
+    })
+  }
+
+  // Derive BEFORE building: the grant diff decides whether this request is
+  // a consent moment (step-up) — and a manifest error should fail before
+  // any bundling work.
+  let manifest: PluginManifest
+  try {
+    manifest = deriveSitePluginManifest({
+      localId,
+      draftManifestJson: plugin.manifestFile.content,
+      files: plugin.files,
+      previousVersion: row?.version ?? null,
+      contentHash,
+    })
+  } catch (err) {
+    return badRequest(getErrorMessage(err, 'Invalid site plugin manifest'))
+  }
+
+  // Step-up on the consent moments only: first activation, or a changed
+  // grant set. Same-grant rebuilds skip it — the security boundary is the
+  // grant set, not the code revision.
+  const grantsChanged = !row || !sameStringSet(row.grantedPermissions, manifest.permissions)
+  if (grantsChanged) {
+    const stepUp = await requireStepUp(req, db, user)
+    if (stepUp) return stepUp
+  }
+
+  const built = await buildSitePlugin({
+    localId,
+    files: plugin.files,
+    previousVersion: row?.version ?? null,
+    uploadsDir: options.uploadsDir,
+    validateOnly: false,
+  })
+  if (!built.ok) {
+    return jsonResponse(
+      { error: `Site plugin build failed`, diagnostics: built.diagnostics },
+      { status: 400 },
+    )
+  }
+
+  // Grants = declared, in both directions: activation grants exactly what
+  // the draft declares, and dropping a permission shrinks the grant.
+  const outcome = await activatePluginPackageFromDisk({
+    db,
+    options,
+    user,
+    req,
+    manifest: built.manifest,
+    grantedPermissions: built.manifest.permissions,
+    source: 'site-local',
+  })
+  if (outcome.upgradeError) {
+    return jsonResponse(
+      { error: outcome.upgradeError, sitePlugins: await listSitePlugins(db) },
+      { status: 400 },
+    )
+  }
+
+  await republishAndSweep(db, options.uploadsDir, built.manifest)
+
+  return jsonResponse({
+    plugin: await presentPluginSecrets(db, outcome.plugin),
+    ...(outcome.upgrade ? { upgrade: outcome.upgrade } : {}),
+    sitePlugins: await listSitePlugins(db),
+  })
+}
+
+/**
+ * Publish coupling (design → "Revision/publish coupling — defined"): baked
+ * Layer-A HTML embeds versioned asset URLs, so when the plugin has
+ * visitor-facing surfaces the host republishes BEFORE any old revision is
+ * garbage-collected — published pages must never reference a deleted
+ * revision. Backend-only plugins skip the republish and sweep immediately.
+ */
+async function republishAndSweep(
+  db: DbClient,
+  uploadsDir: string,
+  manifest: PluginManifest,
+): Promise<void> {
+  const visitorFacing =
+    (manifest.frontend?.assets.length ?? 0) > 0 || Boolean(manifest.entrypoints?.modules)
+  if (visitorFacing) {
+    try {
+      await republishAllPages(db)
+      await bumpPublishVersionSerialized()
+    } catch (err) {
+      // A failed republish must not fail the activation — but it must also
+      // not trigger the sweep (old revision stays referenced).
+      console.error(`[site-plugins] post-activation republish failed for ${manifest.id}:`, err)
+      return
+    }
+  }
+  await sweepSitePluginRevisions(uploadsDir, manifest.id, manifest.version)
+}
+
+// ---------------------------------------------------------------------------
+// POST /site-plugins/:localId/rollback — re-activate the previous revision
+// ---------------------------------------------------------------------------
+
+async function handleRollback(
+  req: Request,
+  db: DbClient,
+  options: CmsHandlerOptions,
+  user: AuthUser,
+  localId: string,
+): Promise<Response> {
+  if (!options.uploadsDir) {
+    return jsonResponse({ error: 'Uploads directory is not configured' }, { status: 500 })
+  }
+  const pluginId = sitePluginIdFromLocalId(localId)
+  const rowResult = await getInstalledPlugin(db, pluginId)
+  const row = rowResult?.kind === 'ok' ? rowResult.plugin : null
+  if (!row) {
+    return jsonResponse({ error: `Site plugin "${localId}" has no runtime record` }, { status: 404 })
+  }
+
+  const previousVersion = await previousSitePluginRevision(options.uploadsDir, pluginId, row.version)
+  if (!previousVersion) {
+    return badRequest(`No previous revision of "${localId}" is retained to roll back to`)
+  }
+
+  let manifest: PluginManifest
+  try {
+    const manifestPath = join(
+      options.uploadsDir,
+      'plugins',
+      pluginId,
+      previousVersion,
+      'plugin.json',
+    )
+    manifest = parsePluginManifest(JSON.parse(await readFile(manifestPath, 'utf8')))
+  } catch (err) {
+    return badRequest(
+      `Previous revision ${previousVersion} is unreadable: ${getErrorMessage(err, 'corrupt package')}`,
+    )
+  }
+
+  // Rolling back to a revision with a DIFFERENT grant set is a consent
+  // moment too (it may re-grant something the current draft dropped).
+  if (!sameStringSet(row.grantedPermissions, manifest.permissions)) {
+    const stepUp = await requireStepUp(req, db, user)
+    if (stepUp) return stepUp
+  }
+
+  const outcome = await activatePluginPackageFromDisk({
+    db,
+    options,
+    user,
+    req,
+    manifest,
+    grantedPermissions: manifest.permissions,
+    source: 'site-local',
+  })
+  if (outcome.upgradeError) {
+    return jsonResponse(
+      { error: outcome.upgradeError, sitePlugins: await listSitePlugins(db) },
+      { status: 400 },
+    )
+  }
+
+  await republishAndSweep(db, options.uploadsDir, manifest)
+
+  return jsonResponse({
+    plugin: await presentPluginSecrets(db, outcome.plugin),
+    rolledBackTo: previousVersion,
+    sitePlugins: await listSitePlugins(db),
+  })
+}
+
+// ---------------------------------------------------------------------------
+// DELETE /site-plugins/:localId — uninstall + delete draft source
+// ---------------------------------------------------------------------------
+
+async function handleDelete(
+  req: Request,
+  db: DbClient,
+  options: CmsHandlerOptions,
+  user: AuthUser,
+  localId: string,
+): Promise<Response> {
+  const pluginId = sitePluginIdFromLocalId(localId)
+  const force = new URL(req.url).searchParams.get('force') === 'true'
+
+  // Runtime teardown first (hooks unless forced) — a hook failure aborts
+  // with the same "fix or force" contract as installed plugins, leaving the
+  // draft source untouched. `Response.ok` = HTTP 2xx here.
+  const rowResult = await getInstalledPlugin(db, pluginId)
+  if (rowResult) {
+    const teardown = await uninstallPluginById(req, db, options, user, pluginId, force)
+    if (!teardown.ok) return teardown
+  }
+
+  // Then the draft source folder.
+  await runPublishFlush()
+  const shell = await getDraftSite(db)
+  if (shell) {
+    const folder = sitePluginFolder(localId)
+    const remaining = shell.files.filter((file) => !file.path.startsWith(folder))
+    if (remaining.length !== shell.files.length) {
+      await saveDraftSite(db, { ...shell, files: remaining, updatedAt: Date.now() })
+    }
+  }
+
+  return jsonResponse({ ok: true, sitePlugins: await listSitePlugins(db) })
+}
+
+// ---------------------------------------------------------------------------
+// Dispatcher
+// ---------------------------------------------------------------------------
+
+export async function handleSitePluginsRoutes(
+  req: Request,
+  db: DbClient,
+  options: CmsHandlerOptions,
+): Promise<Response | null> {
+  const { pathname } = new URL(req.url)
+  if (pathname !== COLLECTION_PATH && !pathname.startsWith(`${COLLECTION_PATH}/`)) return null
+
+  if (pathname === COLLECTION_PATH) {
+    if (req.method === 'GET') {
+      // The Plugins page reads with plugins.read; the IDE's status chip works
+      // for pure site developers via site.read.
+      const user = await requireAnyCapability(req, db, ['plugins.read', 'site.read'])
+      if (user instanceof Response) return user
+      return jsonResponse({ sitePlugins: await listSitePlugins(db) })
+    }
+    if (req.method === 'POST') {
+      // Scaffolding writes draft files — structural site work, NOT a plugin
+      // power grant (activation is where powers happen).
+      const user = await requireCapability(req, db, 'site.structure.edit')
+      if (user instanceof Response) return user
+      return handleScaffold(req, db)
+    }
+    return methodNotAllowed()
+  }
+
+  const validateMatch = VALIDATE_PATTERN.exec(pathname)
+  if (validateMatch?.groups) {
+    if (req.method !== 'POST') return methodNotAllowed()
+    const user = await requireAnyCapability(req, db, ['plugins.read', 'site.read'])
+    if (user instanceof Response) return user
+    return handleValidate(db, validateMatch.groups['localId']!)
+  }
+
+  const previewMatch = PREVIEW_PACK_PATTERN.exec(pathname)
+  if (previewMatch?.groups) {
+    if (req.method !== 'GET') return methodNotAllowed()
+    const user = await requireAnyCapability(req, db, ['plugins.read', 'site.read'])
+    if (user instanceof Response) return user
+    return handlePreviewPack(db, previewMatch.groups['localId']!)
+  }
+
+  const activateMatch = ACTIVATE_PATTERN.exec(pathname)
+  if (activateMatch?.groups) {
+    if (req.method !== 'POST') return methodNotAllowed()
+    const user = await requireCapability(req, db, 'plugins.install')
+    if (user instanceof Response) return user
+    return handleActivate(req, db, options, user, activateMatch.groups['localId']!)
+  }
+
+  const rollbackMatch = ROLLBACK_PATTERN.exec(pathname)
+  if (rollbackMatch?.groups) {
+    if (req.method !== 'POST') return methodNotAllowed()
+    const user = await requireCapability(req, db, 'plugins.install')
+    if (user instanceof Response) return user
+    return handleRollback(req, db, options, user, rollbackMatch.groups['localId']!)
+  }
+
+  const itemMatch = ITEM_PATTERN.exec(pathname)
+  if (itemMatch?.groups) {
+    if (req.method !== 'DELETE') return methodNotAllowed()
+    // Deleting a site plugin is the install operation's inverse — same
+    // capability + step-up as uninstalling an installed plugin.
+    const user = await requireCapability(req, db, 'plugins.install')
+    if (user instanceof Response) return user
+    const stepUp = await requireStepUp(req, db, user)
+    if (stepUp) return stepUp
+    return handleDelete(req, db, options, user, itemMatch.groups['localId']!)
+  }
+
+  return jsonResponse({ error: 'Not found' }, { status: 404 })
+}
diff --git a/server/plugins/sitePlugins/build.ts b/server/plugins/sitePlugins/build.ts
new file mode 100644
index 000000000..e152fb6fd
--- /dev/null
+++ b/server/plugins/sitePlugins/build.ts
@@ -0,0 +1,160 @@
+/**
+ * Site plugin build orchestrator — the server frontend of
+ * `@core/plugin-build`.
+ *
+ *   draft SiteFile[]  →  derive manifest  →  materialize temp workspace
+ *   →  buildPluginPackage (fail-closed import containment, bundle timeout)
+ *   →  package under uploads/plugins/site.<id>/<version>/  (or a throwaway
+ *      dir in validate-only mode)
+ *
+ * Builds are single-flight per localId: a second build queues behind the
+ * first and runs against the arguments IT was called with (the caller
+ * re-reads the then-current draft before calling).
+ */
+import { readFile } from 'node:fs/promises'
+import { join, resolve } from 'node:path'
+import type { SiteFile } from '@core/files/schemas'
+import type { PluginManifest } from '@core/plugin-sdk'
+import { buildPluginPackage } from '@core/plugin-build'
+import {
+  computeSitePluginContentHash,
+  deriveSitePluginManifest,
+  sitePluginFolder,
+} from '@core/site-plugins'
+import { getErrorMessage } from '@core/utils/errorMessage'
+import { materializeSitePluginWorkspace } from './workspace'
+
+/**
+ * '@instatic/plugin-sdk' resolves to the host's own SDK barrel so pure data
+ * builders (defineModule, control, html, …) inline into sandbox bundles —
+ * the only bare specifier a site plugin may import.
+ */
+const SDK_ENTRY = resolve(import.meta.dir, '../../../src/core/plugin-sdk/index.ts')
+
+/** Pathological inputs must fail fast instead of tying up the server. */
+const DEFAULT_BUILD_TIMEOUT_MS = 30_000
+
+export interface SitePluginBuildInput {
+  localId: string
+  /** Every 'plugin' file under plugins/<localId>/ from the persisted draft. */
+  files: readonly SiteFile[]
+  /** The currently active generated version, or null on first build. */
+  previousVersion: string | null
+  /** Uploads root — required unless `validateOnly`. */
+  uploadsDir?: string
+  /** true = diagnostics only: build into the throwaway workspace, never under uploads. */
+  validateOnly: boolean
+  /** Override the build timeout (ms). Mainly for tests. */
+  buildTimeoutMs?: number
+}
+
+export interface SitePluginBuildSuccess {
+  ok: true
+  manifest: PluginManifest
+  contentHash: string
+  /** Absolute package dir (absent in validate-only mode). */
+  packageDir?: string
+  /** Built modules bundle text (validate-only, when the draft declares one) — feeds `Preview in canvas`. */
+  modulesBundle?: string
+}
+
+export interface SitePluginBuildFailure {
+  ok: false
+  diagnostics: string[]
+}
+
+export type SitePluginBuildResult = SitePluginBuildSuccess | SitePluginBuildFailure
+
+// Single-flight per localId — later builds chain behind earlier ones.
+const inflight = new Map<string, Promise<unknown>>()
+
+export function buildSitePlugin(input: SitePluginBuildInput): Promise<SitePluginBuildResult> {
+  const previous = inflight.get(input.localId) ?? Promise.resolve()
+  const next = previous.then(
+    () => runBuild(input),
+    () => runBuild(input),
+  )
+  inflight.set(input.localId, next)
+  void next.finally(() => {
+    if (inflight.get(input.localId) === next) inflight.delete(input.localId)
+  })
+  return next
+}
+
+async function runBuild(input: SitePluginBuildInput): Promise<SitePluginBuildResult> {
+  const contentHash = computeSitePluginContentHash(input.files)
+
+  const manifestFile = input.files.find(
+    (f) => f.path === `${sitePluginFolder(input.localId)}plugin.json`,
+  )
+  if (!manifestFile || typeof manifestFile.content !== 'string') {
+    return { ok: false, diagnostics: [`plugins/${input.localId}/plugin.json is missing`] }
+  }
+
+  let manifest: PluginManifest
+  try {
+    manifest = deriveSitePluginManifest({
+      localId: input.localId,
+      draftManifestJson: manifestFile.content,
+      files: input.files,
+      previousVersion: input.previousVersion,
+      contentHash,
+    })
+  } catch (err) {
+    return { ok: false, diagnostics: [getErrorMessage(err, 'Invalid site plugin manifest')] }
+  }
+
+  if (!input.validateOnly && !input.uploadsDir) {
+    return { ok: false, diagnostics: ['Uploads directory is not configured'] }
+  }
+
+  const workspace = await materializeSitePluginWorkspace(input.localId, input.files)
+  try {
+    const outputDir = input.validateOnly
+      ? join(workspace.rootDir, '.instatic-dist')
+      : join(input.uploadsDir!, 'plugins', manifest.id, manifest.version)
+
+    const timeoutMs = input.buildTimeoutMs ?? DEFAULT_BUILD_TIMEOUT_MS
+    let timeoutHandle: ReturnType<typeof setTimeout> | undefined
+    const timeout = new Promise<never>((_resolve, reject) => {
+      timeoutHandle = setTimeout(
+        () => reject(new Error(`site plugin build timed out after ${timeoutMs}ms`)),
+        timeoutMs,
+      )
+    })
+    try {
+      await Promise.race([
+        buildPluginPackage({
+          sourceDir: workspace.rootDir,
+          outputDir,
+          manifest,
+          resolve: {
+            workspaceRoot: workspace.rootDir,
+            bareSpecifiers: { '@instatic/plugin-sdk': SDK_ENTRY },
+          },
+        }),
+        timeout,
+      ])
+    } finally {
+      clearTimeout(timeoutHandle)
+    }
+
+    let modulesBundle: string | undefined
+    if (input.validateOnly && manifest.entrypoints?.modules) {
+      // Read before cleanup — the throwaway workspace is about to vanish.
+      modulesBundle = await readFile(join(outputDir, manifest.entrypoints.modules), 'utf8')
+    }
+
+    return {
+      ok: true,
+      manifest,
+      contentHash,
+      ...(input.validateOnly ? {} : { packageDir: outputDir }),
+      ...(modulesBundle !== undefined ? { modulesBundle } : {}),
+    }
+  } catch (err) {
+    return { ok: false, diagnostics: [getErrorMessage(err, 'Site plugin build failed')] }
+  } finally {
+    await workspace.cleanup()
+  }
+}
diff --git a/server/plugins/sitePlugins/retention.ts b/server/plugins/sitePlugins/retention.ts
new file mode 100644
index 000000000..56b209011
--- /dev/null
+++ b/server/plugins/sitePlugins/retention.ts
@@ -0,0 +1,83 @@
+/**
+ * Site plugin revision retention — generated packages under
+ * `uploads/plugins/site.<id>/<version>/` accumulate one dir per build.
+ * Policy (design: docs/features/site-plugins.md → "Cleanup And Retention"):
+ *
+ *   - keep the active revision;
+ *   - keep the immediately previous revision (the `Rollback to previous
+ *     revision` target — source-level rollback is impossible once the
+ *     draft has moved on, so the artifact is the only rollback);
+ *   - delete older revisions AFTER activation and the coupled republish
+ *     (when required) succeed — callers sequence that; this module only
+ *     sweeps.
+ *
+ * Whole-plugin teardown (uninstall) rides the existing
+ * `removeAllPluginAssets` sweep, not this module.
+ */
+import { readdir, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { assertPathWithin } from '../../util/pathWithin'
+
+const VERSION_COUNTER = /^1\.0\.(\d+)\+/
+
+/** Keep the active version + the immediately previous one; delete the rest. */
+export async function sweepSitePluginRevisions(
+  uploadsDir: string,
+  pluginId: string,
+  activeVersion: string,
+): Promise<string[]> {
+  const pluginDir = join(uploadsDir, 'plugins', pluginId)
+  assertPathWithin(uploadsDir, pluginDir)
+  let entries: string[]
+  try {
+    entries = await readdir(pluginDir)
+  } catch {
+    return [] // nothing built yet
+  }
+  const counter = (version: string): number => {
+    const match = VERSION_COUNTER.exec(version)
+    return match ? Number(match[1]) : -1
+  }
+  const activeCounter = counter(activeVersion)
+  const keep = new Set([activeVersion])
+  const previous = entries
+    .filter((v) => v !== activeVersion && counter(v) >= 0 && counter(v) < activeCounter)
+    .sort((a, b) => counter(b) - counter(a))[0]
+  if (previous) keep.add(previous)
+
+  const removed: string[] = []
+  for (const entry of entries) {
+    if (keep.has(entry)) continue
+    const target = join(pluginDir, entry)
+    assertPathWithin(uploadsDir, target)
+    await rm(target, { recursive: true, force: true })
+    removed.push(entry)
+  }
+  return removed
+}
+
+/** The rollback target — the retained revision immediately below `activeVersion`. */
+export async function previousSitePluginRevision(
+  uploadsDir: string,
+  pluginId: string,
+  activeVersion: string,
+): Promise<string | null> {
+  const pluginDir = join(uploadsDir, 'plugins', pluginId)
+  assertPathWithin(uploadsDir, pluginDir)
+  let entries: string[]
+  try {
+    entries = await readdir(pluginDir)
+  } catch {
+    return null
+  }
+  const counter = (version: string): number => {
+    const match = VERSION_COUNTER.exec(version)
+    return match ? Number(match[1]) : -1
+  }
+  const activeCounter = counter(activeVersion)
+  return (
+    entries
+      .filter((v) => v !== activeVersion && counter(v) >= 0 && counter(v) < activeCounter)
+      .sort((a, b) => counter(b) - counter(a))[0] ?? null
+  )
+}
diff --git a/server/plugins/sitePlugins/workspace.ts b/server/plugins/sitePlugins/workspace.ts
new file mode 100644
index 000000000..1568070fb
--- /dev/null
+++ b/server/plugins/sitePlugins/workspace.ts
@@ -0,0 +1,44 @@
+/**
+ * Site plugin workspace materializer — writes one plugin's draft files into
+ * an isolated temp directory (prefix stripped) so the shared builder core
+ * can bundle them. Same pattern as `materializeSiteScriptWorkspace`
+ * (server/publish/runtime/virtualSiteWorkspace.ts): path-safety checks,
+ * realpath'd temp root, cleanup callback.
+ */
+import { mkdtemp, mkdir, realpath, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import type { SiteFile } from '@core/files/schemas'
+import { isSafePath, normalizePath } from '@core/files/pathValidation'
+import { sitePluginFolder } from '@core/site-plugins'
+
+export interface SitePluginWorkspace {
+  rootDir: string
+  cleanup: () => Promise<void>
+}
+
+/** Write plugins/<localId>/** files into a temp dir, prefix stripped. */
+export async function materializeSitePluginWorkspace(
+  localId: string,
+  files: readonly SiteFile[],
+): Promise<SitePluginWorkspace> {
+  const tempDir = await mkdtemp(join(tmpdir(), `instatic-site-plugin-${localId}-`))
+  const rootDir = await realpath(tempDir)
+  const prefix = sitePluginFolder(localId)
+  try {
+    for (const file of files) {
+      if (typeof file.content !== 'string') continue
+      if (!file.path.startsWith(prefix)) continue
+      const relative = normalizePath(file.path.slice(prefix.length))
+      if (!relative || !isSafePath(relative)) continue
+      const absolutePath = resolve(rootDir, relative)
+      if (!absolutePath.startsWith(rootDir + '/')) continue
+      await mkdir(dirname(absolutePath), { recursive: true })
+      await writeFile(absolutePath, file.content, 'utf8')
+    }
+  } catch (error) {
+    await rm(rootDir, { recursive: true, force: true })
+    throw error
+  }
+  return { rootDir, cleanup: () => rm(rootDir, { recursive: true, force: true }) }
+}
diff --git a/src/__tests__/server/sitePluginBuild.test.ts b/src/__tests__/server/sitePluginBuild.test.ts
new file mode 100644
index 000000000..49de44e39
--- /dev/null
+++ b/src/__tests__/server/sitePluginBuild.test.ts
@@ -0,0 +1,148 @@
+/**
+ * Server-side site plugin build — materialized workspace, shared builder
+ * core with import containment, validate-only mode, single-flight queue.
+ */
+import { describe, expect, test } from 'bun:test'
+import { mkdtemp, readdir, rm } from 'node:fs/promises'
+import { existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { buildSitePlugin } from '../../../server/plugins/sitePlugins/build'
+import type { SiteFile } from '@core/files/schemas'
+
+const file = (path: string, content: string): SiteFile => ({
+  id: path,
+  path,
+  type: 'plugin',
+  content,
+  createdAt: 1,
+  updatedAt: 1,
+})
+
+const routesManifest = JSON.stringify({ name: 'Newsletter', permissions: ['cms.routes'] })
+
+const serverEntry = [
+  `export function activate(api) {`,
+  `  api.cms.routes.get('/status', 'plugins.read', () => ({ ok: true }))`,
+  `}`,
+].join('\n')
+
+describe('buildSitePlugin', () => {
+  test('happy path writes plugin.json + server bundle under uploads', async () => {
+    const uploadsDir = await mkdtemp(join(tmpdir(), 'uploads-'))
+    try {
+      const result = await buildSitePlugin({
+        localId: 'newsletter',
+        files: [
+          file('plugins/newsletter/plugin.json', routesManifest),
+          file('plugins/newsletter/server/index.ts', serverEntry),
+        ],
+        previousVersion: null,
+        uploadsDir,
+        validateOnly: false,
+      })
+      expect(result.ok).toBe(true)
+      if (!result.ok) return
+      expect(result.manifest.id).toBe('site.newsletter')
+      expect(result.manifest.version).toBe(`1.0.1+${result.contentHash}`)
+      expect(result.packageDir).toBe(
+        join(uploadsDir, 'plugins', 'site.newsletter', result.manifest.version),
+      )
+      expect(existsSync(join(result.packageDir!, 'plugin.json'))).toBe(true)
+      expect(existsSync(join(result.packageDir!, 'server/index.js'))).toBe(true)
+      const bundle = await Bun.file(join(result.packageDir!, 'server/index.js')).text()
+      expect(bundle).toContain('__plugin_exports')
+    } finally {
+      await rm(uploadsDir, { recursive: true, force: true })
+    }
+  })
+
+  test('validate-only leaves uploads untouched and returns the modules bundle', async () => {
+    const uploadsDir = await mkdtemp(join(tmpdir(), 'uploads-'))
+    try {
+      const result = await buildSitePlugin({
+        localId: 'kit',
+        files: [
+          file('plugins/kit/plugin.json', JSON.stringify({ name: 'Kit', permissions: ['modules.register'] })),
+          file(
+            'plugins/kit/modules/card.ts',
+            [
+              `import { control, defineModule, html } from '@instatic/plugin-sdk'`,
+              `export default defineModule({`,
+              `  id: 'site.kit.card', name: 'Card', htmlTag: 'div',`,
+              `  defaults: { text: 'hi' },`,
+              `  schema: { text: control.text('Text') },`,
+              `  render: ({ props }) => ({ html: html\`<div>\${props.text}</div>\` }),`,
+              `})`,
+            ].join('\n'),
+          ),
+        ],
+        previousVersion: null,
+        uploadsDir,
+        validateOnly: true,
+      })
+      expect(result.ok).toBe(true)
+      if (!result.ok) return
+      expect(result.packageDir).toBeUndefined()
+      expect(result.modulesBundle).toContain('site.kit.card')
+      expect(await readdir(uploadsDir)).toEqual([])
+    } finally {
+      await rm(uploadsDir, { recursive: true, force: true })
+    }
+  })
+
+  test('containment violation surfaces as a diagnostic', async () => {
+    const result = await buildSitePlugin({
+      localId: 'evil',
+      files: [
+        file('plugins/evil/plugin.json', JSON.stringify({ name: 'Evil', permissions: ['cms.routes'] })),
+        file('plugins/evil/server/index.ts', "import x from '../../../.env' with { type: 'text' }\nexport function activate() { return x }"),
+      ],
+      previousVersion: null,
+      validateOnly: true,
+    })
+    expect(result.ok).toBe(false)
+    if (result.ok) return
+    expect(result.diagnostics.join('\n')).toMatch(/outside the plugin workspace/)
+  })
+
+  test('forbidden node primitives surface as a diagnostic', async () => {
+    const result = await buildSitePlugin({
+      localId: 'nodey',
+      files: [
+        file('plugins/nodey/plugin.json', JSON.stringify({ name: 'Nodey', permissions: ['cms.routes'] })),
+        file('plugins/nodey/server/index.ts', "import { readFileSync } from 'node:fs'\nexport function activate() { return readFileSync('/etc/passwd') }"),
+      ],
+      previousVersion: null,
+      validateOnly: true,
+    })
+    expect(result.ok).toBe(false)
+    if (result.ok) return
+    expect(result.diagnostics.join('\n')).toMatch(/node:|not an allowed dependency|sandbox/i)
+  })
+
+  test('missing plugin.json is a diagnostic, not a crash', async () => {
+    const result = await buildSitePlugin({
+      localId: 'ghost',
+      files: [file('plugins/ghost/server/index.ts', serverEntry)],
+      previousVersion: null,
+      validateOnly: true,
+    })
+    expect(result.ok).toBe(false)
+    if (result.ok) return
+    expect(result.diagnostics[0]).toContain('plugin.json is missing')
+  })
+
+  test('builds are single-flight per localId', async () => {
+    const files = [
+      file('plugins/serial/plugin.json', routesManifest),
+      file('plugins/serial/server/index.ts', serverEntry),
+    ]
+    const [a, b] = await Promise.all([
+      buildSitePlugin({ localId: 'serial', files, previousVersion: null, validateOnly: true }),
+      buildSitePlugin({ localId: 'serial', files, previousVersion: null, validateOnly: true }),
+    ])
+    expect(a.ok).toBe(true)
+    expect(b.ok).toBe(true)
+  })
+})
diff --git a/src/__tests__/server/sitePluginLifecycle.test.ts b/src/__tests__/server/sitePluginLifecycle.test.ts
new file mode 100644
index 000000000..fb56e3460
--- /dev/null
+++ b/src/__tests__/server/sitePluginLifecycle.test.ts
@@ -0,0 +1,278 @@
+/**
+ * Site plugin lifecycle endpoints — scaffold, validate, activation
+ * authority (plugins.install + step-up only on consent moments), rebuild
+ * skip, grant shrink/grow, and delete (runtime row + draft source).
+ */
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  createCapabilityTestHarness,
+  expectForbidden,
+  expectStepUpRequired,
+  readJson,
+  type CapabilityTestHarness,
+} from '../helpers/capabilityHarness'
+import { getDraftSite, saveDraftSite } from '../../../server/repositories/site'
+import { getInstalledPlugin } from '../../../server/repositories/plugins'
+import type { SitePluginSummary } from '@core/site-plugins'
+
+let harness: CapabilityTestHarness
+let uploadsDir: string
+let ownerCookie: string
+let ownerEmail: string
+
+beforeAll(async () => {
+  uploadsDir = await mkdtemp(join(tmpdir(), 'site-plugin-uploads-'))
+  harness = await createCapabilityTestHarness({ uploadsDir })
+  ownerCookie = await harness.setupOwner()
+  // setupOwner logs in the owner; capture a NON-stepped-up cookie too.
+  ownerEmail = ''
+})
+
+afterAll(async () => {
+  await harness.cleanup()
+  await rm(uploadsDir, { recursive: true, force: true })
+})
+
+async function updateDraftFile(path: string, content: string): Promise<void> {
+  const shell = await getDraftSite(harness.db)
+  if (!shell) throw new Error('no draft site')
+  const files = shell.files.map((file) =>
+    file.path === path ? { ...file, content, updatedAt: Date.now() } : file,
+  )
+  await saveDraftSite(harness.db, { ...shell, files, updatedAt: Date.now() })
+}
+
+describe('site plugin scaffold + validate', () => {
+  test('scaffold requires site.structure.edit', async () => {
+    const viewer = await harness.createRoleUser({
+      name: 'Viewer',
+      slug: 'viewer',
+      capabilities: ['plugins.read', 'site.read'],
+    })
+    const res = await harness.cms('/admin/api/cms/site-plugins', {
+      method: 'POST',
+      cookie: viewer.cookie,
+      json: { name: 'Newsletter', localId: 'newsletter', template: 'routes' },
+    })
+    await expectForbidden(res)
+  })
+
+  test('scaffold creates plugin-typed draft files', async () => {
+    const res = await harness.cms('/admin/api/cms/site-plugins', {
+      method: 'POST',
+      cookie: ownerCookie,
+      json: { name: 'Newsletter', localId: 'newsletter', template: 'routes' },
+    })
+    expect(res.status).toBe(201)
+    const shell = await getDraftSite(harness.db)
+    const pluginFiles = shell?.files.filter((file) => file.type === 'plugin') ?? []
+    expect(pluginFiles.map((file) => file.path).sort()).toEqual([
+      'plugins/newsletter/plugin.json',
+      'plugins/newsletter/server/index.ts',
+    ])
+  })
+
+  test('duplicate scaffold is a 409', async () => {
+    const res = await harness.cms('/admin/api/cms/site-plugins', {
+      method: 'POST',
+      cookie: ownerCookie,
+      json: { name: 'Newsletter', localId: 'newsletter', template: 'empty' },
+    })
+    expect(res.status).toBe(409)
+  })
+
+  test('the scaffolded plugin passes validation with site.read only', async () => {
+    const viewer = await harness.createRoleUser({
+      name: 'Site Reader',
+      slug: 'site-reader',
+      capabilities: ['site.read'],
+    })
+    const res = await harness.cms('/admin/api/cms/site-plugins/newsletter/validate', {
+      method: 'POST',
+      cookie: viewer.cookie,
+    })
+    expect(res.status).toBe(200)
+    const body = await readJson<{ ok: boolean; diagnostics: string[] }>(res)
+    expect(body).toEqual({ ok: true, diagnostics: [] })
+  })
+
+  test('the list computes draft-changed for a never-built plugin', async () => {
+    const res = await harness.cms('/admin/api/cms/site-plugins', { cookie: ownerCookie })
+    expect(res.status).toBe(200)
+    const body = await readJson<{ sitePlugins: SitePluginSummary[] }>(res)
+    const entry = body.sitePlugins.find((plugin) => plugin.localId === 'newsletter')
+    expect(entry?.state).toBe('draft-changed')
+    expect(entry?.pluginId).toBe('site.newsletter')
+    expect(entry?.activeVersion).toBeNull()
+  })
+})
+
+describe('site plugin activation authority', () => {
+  test('activate without plugins.install is forbidden', async () => {
+    const editor = await harness.createRoleUser({
+      name: 'Site Editor',
+      slug: 'site-editor',
+      capabilities: ['site.read', 'site.structure.edit', 'site.content.edit', 'site.style.edit'],
+    })
+    const res = await harness.cms('/admin/api/cms/site-plugins/newsletter/activate', {
+      method: 'POST',
+      cookie: editor.cookie,
+    })
+    await expectForbidden(res)
+  })
+
+  test('first activation requires step-up; with step-up it installs', async () => {
+    const installer = await harness.createRoleUser({
+      name: 'Installer',
+      slug: 'installer',
+      capabilities: ['plugins.read', 'plugins.install', 'site.read'],
+    })
+
+    const noStepUp = await harness.cms('/admin/api/cms/site-plugins/newsletter/activate', {
+      method: 'POST',
+      cookie: installer.cookie,
+    })
+    await expectStepUpRequired(noStepUp)
+
+    const stepped = await harness.stepUp(installer.cookie)
+    const res = await harness.cms('/admin/api/cms/site-plugins/newsletter/activate', {
+      method: 'POST',
+      cookie: stepped,
+    })
+    expect(res.status).toBe(200)
+    const body = await readJson<{ plugin: { id: string; version: string; source: string } }>(res)
+    expect(body.plugin.id).toBe('site.newsletter')
+    expect(body.plugin.version).toStartWith('1.0.1+')
+    expect(body.plugin.source).toBe('site-local')
+
+    // Package on disk, byte-compatible layout.
+    expect(
+      existsSync(join(uploadsDir, 'plugins', 'site.newsletter', body.plugin.version, 'plugin.json')),
+    ).toBe(true)
+    expect(
+      existsSync(join(uploadsDir, 'plugins', 'site.newsletter', body.plugin.version, 'server/index.js')),
+    ).toBe(true)
+  })
+
+  test('unchanged source activation is a skip', async () => {
+    const res = await harness.cms('/admin/api/cms/site-plugins/newsletter/activate', {
+      method: 'POST',
+      cookie: ownerCookie,
+    })
+    expect(res.status).toBe(200)
+    const body = await readJson<{ skipped?: boolean; plugin: { version: string } }>(res)
+    expect(body.skipped).toBe(true)
+    expect(body.plugin.version).toStartWith('1.0.1+')
+  })
+
+  test('source change without grant change rebuilds WITHOUT step-up (upgrade path)', async () => {
+    await updateDraftFile(
+      'plugins/newsletter/server/index.ts',
+      [
+        `import type { ServerPluginModule } from '@instatic/plugin-sdk'`,
+        `const mod: ServerPluginModule = {`,
+        `  activate(api) {`,
+        `    api.cms.routes.get('/status', 'plugins.read', () => ({ ok: true, rev: 2 }))`,
+        `  },`,
+        `}`,
+        `export default mod`,
+      ].join('\n'),
+    )
+
+    const installer = await harness.createRoleUser({
+      name: 'Installer 2',
+      slug: 'installer-2',
+      capabilities: ['plugins.read', 'plugins.install', 'site.read'],
+    })
+    // NOT stepped up — same grants, no consent moment.
+    const res = await harness.cms('/admin/api/cms/site-plugins/newsletter/activate', {
+      method: 'POST',
+      cookie: installer.cookie,
+    })
+    expect(res.status).toBe(200)
+    const body = await readJson<{
+      plugin: { version: string }
+      upgrade?: { fromVersion: string; toVersion: string }
+    }>(res)
+    expect(body.plugin.version).toStartWith('1.0.2+')
+    expect(body.upgrade?.fromVersion).toStartWith('1.0.1+')
+    expect(body.upgrade?.toVersion).toStartWith('1.0.2+')
+  })
+
+  test('adding a permission requires step-up again; grants follow declarations', async () => {
+    const shell = await getDraftSite(harness.db)
+    const manifestFile = shell?.files.find((file) => file.path === 'plugins/newsletter/plugin.json')
+    expect(manifestFile).toBeDefined()
+    await updateDraftFile(
+      'plugins/newsletter/plugin.json',
+      JSON.stringify({
+        name: 'Newsletter',
+        description: '',
+        permissions: ['cms.routes', 'cms.routes.public'],
+      }),
+    )
+
+    const installer = await harness.createRoleUser({
+      name: 'Installer 3',
+      slug: 'installer-3',
+      capabilities: ['plugins.read', 'plugins.install', 'site.read'],
+    })
+    const noStepUp = await harness.cms('/admin/api/cms/site-plugins/newsletter/activate', {
+      method: 'POST',
+      cookie: installer.cookie,
+    })
+    await expectStepUpRequired(noStepUp)
+
+    const stepped = await harness.stepUp(installer.cookie)
+    const res = await harness.cms('/admin/api/cms/site-plugins/newsletter/activate', {
+      method: 'POST',
+      cookie: stepped,
+    })
+    expect(res.status).toBe(200)
+    const row = await getInstalledPlugin(harness.db, 'site.newsletter')
+    expect(row?.kind).toBe('ok')
+    if (row?.kind === 'ok') {
+      expect(row.plugin.grantedPermissions.sort()).toEqual(['cms.routes', 'cms.routes.public'])
+    }
+  })
+
+  test('the list reports active after activation', async () => {
+    const res = await harness.cms('/admin/api/cms/site-plugins', { cookie: ownerCookie })
+    const body = await readJson<{ sitePlugins: SitePluginSummary[] }>(res)
+    const entry = body.sitePlugins.find((plugin) => plugin.localId === 'newsletter')
+    expect(entry?.state).toBe('active')
+    expect(entry?.activeVersion).toStartWith('1.0.3+')
+  })
+})
+
+describe('site plugin delete', () => {
+  test('delete requires step-up, then removes row + assets + draft source', async () => {
+    const noStepUp = await harness.cms('/admin/api/cms/site-plugins/newsletter', {
+      method: 'DELETE',
+      cookie: await harness.sessionForEmail(ownerEmail || (await ownerEmailOf())),
+    })
+    await expectStepUpRequired(noStepUp)
+
+    const res = await harness.cms('/admin/api/cms/site-plugins/newsletter', {
+      method: 'DELETE',
+      cookie: ownerCookie,
+    })
+    expect(res.status).toBe(200)
+
+    expect(await getInstalledPlugin(harness.db, 'site.newsletter')).toBeNull()
+    expect(existsSync(join(uploadsDir, 'plugins', 'site.newsletter'))).toBe(false)
+    const shell = await getDraftSite(harness.db)
+    expect(shell?.files.some((file) => file.path.startsWith('plugins/newsletter/'))).toBe(false)
+  })
+})
+
+async function ownerEmailOf(): Promise<string> {
+  const { rows } = await harness.db<{ email: string }>`
+    select email from users order by created_at asc limit 1
+  `
+  return rows[0]!.email
+}
diff --git a/src/__tests__/server/sitePluginRetention.test.ts b/src/__tests__/server/sitePluginRetention.test.ts
new file mode 100644
index 000000000..64e72f28b
--- /dev/null
+++ b/src/__tests__/server/sitePluginRetention.test.ts
@@ -0,0 +1,69 @@
+/**
+ * Site plugin revision retention — keep the active revision plus the
+ * immediately previous one (the rollback target); delete the rest.
+ */
+import { describe, expect, test } from 'bun:test'
+import { mkdtemp, mkdir, readdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  previousSitePluginRevision,
+  sweepSitePluginRevisions,
+} from '../../../server/plugins/sitePlugins/retention'
+
+async function uploadsWithRevisions(versions: string[]): Promise<string> {
+  const uploadsDir = await mkdtemp(join(tmpdir(), 'retention-'))
+  for (const version of versions) {
+    const dir = join(uploadsDir, 'plugins', 'site.demo', version)
+    await mkdir(dir, { recursive: true })
+    await writeFile(join(dir, 'plugin.json'), '{}', 'utf8')
+  }
+  return uploadsDir
+}
+
+describe('sweepSitePluginRevisions', () => {
+  test('keeps active + immediately previous, deletes older', async () => {
+    const uploadsDir = await uploadsWithRevisions(['1.0.1+a', '1.0.2+b', '1.0.3+c'])
+    try {
+      const removed = await sweepSitePluginRevisions(uploadsDir, 'site.demo', '1.0.3+c')
+      expect(removed).toEqual(['1.0.1+a'])
+      const remaining = (await readdir(join(uploadsDir, 'plugins', 'site.demo'))).sort()
+      expect(remaining).toEqual(['1.0.2+b', '1.0.3+c'])
+    } finally {
+      await rm(uploadsDir, { recursive: true, force: true })
+    }
+  })
+
+  test('after a rollback, revisions newer than the active one are swept', async () => {
+    const uploadsDir = await uploadsWithRevisions(['1.0.1+a', '1.0.2+b', '1.0.3+c'])
+    try {
+      const removed = await sweepSitePluginRevisions(uploadsDir, 'site.demo', '1.0.2+b')
+      expect(removed.sort()).toEqual(['1.0.3+c'])
+      const remaining = (await readdir(join(uploadsDir, 'plugins', 'site.demo'))).sort()
+      expect(remaining).toEqual(['1.0.1+a', '1.0.2+b'])
+    } finally {
+      await rm(uploadsDir, { recursive: true, force: true })
+    }
+  })
+
+  test('missing plugin dir is a no-op', async () => {
+    const uploadsDir = await mkdtemp(join(tmpdir(), 'retention-'))
+    try {
+      expect(await sweepSitePluginRevisions(uploadsDir, 'site.ghost', '1.0.1+a')).toEqual([])
+    } finally {
+      await rm(uploadsDir, { recursive: true, force: true })
+    }
+  })
+})
+
+describe('previousSitePluginRevision', () => {
+  test('returns the retained revision immediately below the active one', async () => {
+    const uploadsDir = await uploadsWithRevisions(['1.0.2+b', '1.0.5+e'])
+    try {
+      expect(await previousSitePluginRevision(uploadsDir, 'site.demo', '1.0.5+e')).toBe('1.0.2+b')
+      expect(await previousSitePluginRevision(uploadsDir, 'site.demo', '1.0.2+b')).toBeNull()
+    } finally {
+      await rm(uploadsDir, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/src/__tests__/sitePlugins/sitePluginRoute.test.ts b/src/__tests__/sitePlugins/sitePluginRoute.test.ts
new file mode 100644
index 000000000..4ba5b4b98
--- /dev/null
+++ b/src/__tests__/sitePlugins/sitePluginRoute.test.ts
@@ -0,0 +1,11 @@
+import { describe, expect, test } from 'bun:test'
+import { sitePluginRoute } from '@core/plugin-sdk'
+
+describe('sitePluginRoute', () => {
+  test('resolves to the reserved plugin runtime route', () => {
+    expect(sitePluginRoute('newsletter', '/subscribe'))
+      .toBe('/admin/api/cms/plugins/site.newsletter/runtime/subscribe')
+    expect(sitePluginRoute('newsletter', 'subscribe'))
+      .toBe('/admin/api/cms/plugins/site.newsletter/runtime/subscribe')
+  })
+})
diff --git a/src/__tests__/sitePlugins/sourceModel.test.ts b/src/__tests__/sitePlugins/sourceModel.test.ts
new file mode 100644
index 000000000..4ef10dd5d
--- /dev/null
+++ b/src/__tests__/sitePlugins/sourceModel.test.ts
@@ -0,0 +1,169 @@
+/**
+ * Site plugin source model — discovery by folder convention, author-manifest
+ * validation (derived fields rejected), runtime manifest derivation, and the
+ * content hash the generated version carries.
+ */
+import { describe, expect, test } from 'bun:test'
+import {
+  computeSitePluginContentHash,
+  contentHashOfVersion,
+  computeSitePluginState,
+  deriveSitePluginManifest,
+  discoverSitePlugins,
+  nextSitePluginVersion,
+} from '@core/site-plugins'
+import type { SiteFile } from '@core/files/schemas'
+
+const file = (path: string, content: string, type: SiteFile['type'] = 'plugin'): SiteFile => ({
+  id: path,
+  path,
+  type,
+  content,
+  createdAt: 1,
+  updatedAt: 1,
+})
+
+const draftManifest = JSON.stringify({
+  name: 'Newsletter',
+  description: 'Email capture',
+  permissions: ['cms.routes', 'cms.routes.public'],
+})
+
+describe('site plugin discovery', () => {
+  test('discovers plugins by folder convention, ignoring non-plugin files', () => {
+    const found = discoverSitePlugins([
+      file('plugins/newsletter/plugin.json', draftManifest),
+      file('plugins/newsletter/server/index.ts', 'export function activate() {}'),
+      file('src/scripts/fx.ts', '', 'script'),
+      file('plugins/analytics/plugin.json', draftManifest),
+    ])
+    expect(found.map((p) => p.localId)).toEqual(['analytics', 'newsletter'])
+    expect(found[1]!.files).toHaveLength(2)
+    expect(found[1]!.manifestFile?.path).toBe('plugins/newsletter/plugin.json')
+  })
+
+  test('rejects invalid local ids', () => {
+    expect(() =>
+      discoverSitePlugins([file('plugins/News.Letter/plugin.json', draftManifest)]),
+    ).toThrow(/local id/i)
+  })
+})
+
+describe('site plugin manifest derivation', () => {
+  test('derives id, version, apiVersion, entrypoints, assetBasePath', () => {
+    const derived = deriveSitePluginManifest({
+      localId: 'newsletter',
+      draftManifestJson: draftManifest,
+      files: [file('plugins/newsletter/server/index.ts', '')],
+      previousVersion: '1.0.6+aaaa1111',
+      contentHash: 'bbbb2222',
+    })
+    expect(derived.id).toBe('site.newsletter')
+    expect(derived.version).toBe('1.0.7+bbbb2222')
+    expect(derived.apiVersion).toBeGreaterThanOrEqual(1)
+    expect(derived.entrypoints?.server).toBe('server/index.js')
+    expect(derived.assetBasePath).toBe('/uploads/plugins/site.newsletter/1.0.7+bbbb2222')
+  })
+
+  test('first build starts the counter at 1', () => {
+    const derived = deriveSitePluginManifest({
+      localId: 'newsletter',
+      draftManifestJson: draftManifest,
+      files: [file('plugins/newsletter/server/index.ts', '')],
+      previousVersion: null,
+      contentHash: 'cccc3333',
+    })
+    expect(derived.version).toBe('1.0.1+cccc3333')
+  })
+
+  test('derives module entrypoints and pack from folder convention', () => {
+    const derived = deriveSitePluginManifest({
+      localId: 'kit',
+      draftManifestJson: JSON.stringify({ name: 'Kit', permissions: ['modules.register'] }),
+      files: [
+        file('plugins/kit/plugin.json', ''),
+        file('plugins/kit/modules/card.ts', ''),
+        file('plugins/kit/pack/site.json', '{}'),
+      ],
+      previousVersion: null,
+      contentHash: 'dddd4444',
+    })
+    expect(derived.entrypoints?.modules).toBe('modules/index.js')
+    expect(derived.pack?.path).toBe('pack/site.json')
+  })
+
+  test('rewrites frontend asset source paths to built paths', () => {
+    const derived = deriveSitePluginManifest({
+      localId: 'tracker',
+      draftManifestJson: JSON.stringify({
+        name: 'Tracker',
+        permissions: ['frontend.assets'],
+        frontend: { assets: [{ kind: 'script', src: 'frontend/tracker.ts' }] },
+      }),
+      files: [file('plugins/tracker/frontend/tracker.ts', '')],
+      previousVersion: null,
+      contentHash: 'eeee5555',
+    })
+    const asset = derived.frontend?.assets[0]
+    expect(asset && asset.kind === 'script' ? asset.src : null).toBe('frontend/tracker.js')
+  })
+
+  test('rejects author-set derived fields', () => {
+    const withId = JSON.stringify({ id: 'acme.evil', name: 'X', permissions: [] })
+    expect(() =>
+      deriveSitePluginManifest({
+        localId: 'newsletter',
+        draftManifestJson: withId,
+        files: [],
+        previousVersion: null,
+        contentHash: 'ffff6666',
+      }),
+    ).toThrow(/derived by the build/i)
+  })
+})
+
+describe('content hash + version', () => {
+  test('content hash is stable and order-independent', () => {
+    const a = [file('plugins/n/plugin.json', draftManifest), file('plugins/n/server/index.ts', 'x')]
+    const b = [...a].reverse()
+    expect(computeSitePluginContentHash(a)).toBe(computeSitePluginContentHash(b))
+    const changed = [file('plugins/n/plugin.json', draftManifest), file('plugins/n/server/index.ts', 'y')]
+    expect(computeSitePluginContentHash(changed)).not.toBe(computeSitePluginContentHash(a))
+  })
+
+  test('version round-trips its content hash', () => {
+    const hash = computeSitePluginContentHash([file('plugins/n/plugin.json', draftManifest)])
+    const version = nextSitePluginVersion(null, hash)
+    expect(contentHashOfVersion(version)).toBe(hash)
+    expect(nextSitePluginVersion(version, 'aaaa')).toBe(`1.0.2+aaaa`)
+  })
+})
+
+describe('runtime state machine', () => {
+  const base = {
+    hasDraftSource: true,
+    row: { version: '1.0.3+abc', lifecycleStatus: 'active' as const, enabled: true },
+    manifestError: null,
+    draftContentHash: 'abc',
+    activeContentHash: 'abc',
+    grantsChanged: false,
+  }
+
+  test('precedence: source-missing > runtime-error > disabled > build-failed > review > draft-changed > active', () => {
+    expect(computeSitePluginState(base)).toBe('active')
+    expect(computeSitePluginState({ ...base, draftContentHash: 'zzz' })).toBe('draft-changed')
+    expect(computeSitePluginState({ ...base, grantsChanged: true })).toBe('permission-review')
+    expect(computeSitePluginState({ ...base, manifestError: 'bad json' })).toBe('build-failed')
+    expect(
+      computeSitePluginState({
+        ...base,
+        row: { ...base.row, enabled: false, lifecycleStatus: 'disabled' },
+      }),
+    ).toBe('disabled')
+    expect(
+      computeSitePluginState({ ...base, row: { ...base.row, lifecycleStatus: 'error' } }),
+    ).toBe('runtime-error')
+    expect(computeSitePluginState({ ...base, hasDraftSource: false })).toBe('source-missing')
+    expect(computeSitePluginState({ ...base, row: null })).toBe('draft-changed')
+  })
+})
diff --git a/src/core/files/schemas.ts b/src/core/files/schemas.ts
index 38ecc7c6e..ce6dcbe2e 100644
--- a/src/core/files/schemas.ts
+++ b/src/core/files/schemas.ts
@@ -19,20 +19,26 @@ import { Type, type Static } from '@sinclair/typebox'
 // SiteFileType
 // ---------------------------------------------------------------------------
 
-const SiteFileTypeSchema = Type.Union([
-  Type.Literal('component'), // src/components/*.tsx — user-authored React components
-  Type.Literal('script'),    // src/scripts/*.ts, src/utils/*.ts, src/hooks/*.ts
-  Type.Literal('style'),     // src/styles/*.css — global CSS
-  Type.Literal('asset'),     // public/* — images, fonts, etc. (binary)
-  Type.Literal('config'),    // package.json, tsconfig.json, vite.config.ts, .env, etc.
-  Type.Literal('doc'),       // README.md, CHANGELOG.md — markdown docs
-  Type.Literal('plugin'),    // plugins/<local-id>/** — site plugin source; NEVER enters
-                             // published bundles, _siteScripts, or module-readable file
-                             // lists, and never appears in the site editor (edited in
-                             // the Plugin IDE). Gated by site-plugin-file-isolation.test.ts.
-])
-
-export type SiteFileType = Static<typeof SiteFileTypeSchema>
+/**
+ * THE list of site file types — the schema union and every runtime
+ * validator derive from this one array (no parallel lists).
+ */
+export const SITE_FILE_TYPES = [
+  'component', // src/components/*.tsx — user-authored React components
+  'script',    // src/scripts/*.ts, src/utils/*.ts, src/hooks/*.ts
+  'style',     // src/styles/*.css — global CSS
+  'asset',     // public/* — images, fonts, etc. (binary)
+  'config',    // package.json, tsconfig.json, vite.config.ts, .env, etc.
+  'doc',       // README.md, CHANGELOG.md — markdown docs
+  'plugin',    // plugins/<local-id>/** — site plugin source; NEVER enters
+               // published bundles, _siteScripts, or module-readable file
+               // lists, and never appears in the site editor (edited in the
+               // Plugin IDE). Gated by site-plugin-file-isolation.test.ts.
+] as const
+
+const SiteFileTypeSchema = Type.Union(SITE_FILE_TYPES.map((type) => Type.Literal(type)))
+
+export type SiteFileType = (typeof SITE_FILE_TYPES)[number]
 
 // ---------------------------------------------------------------------------
 // SiteFile
diff --git a/src/core/page-tree/siteDocument.ts b/src/core/page-tree/siteDocument.ts
index ca10bba65..fc9d88512 100644
--- a/src/core/page-tree/siteDocument.ts
+++ b/src/core/page-tree/siteDocument.ts
@@ -37,7 +37,7 @@ import {
 } from './condition'
 import { StyleRuleSchema, parseStyleRuleRegistry } from './styleRule'
 import { SiteSettingsSchema, parseSiteSettings } from './siteSettings'
-import { SiteFileSchema, type SiteFile, type SiteFileType } from '@core/files/schemas'
+import { SITE_FILE_TYPES, SiteFileSchema, type SiteFile, type SiteFileType } from '@core/files/schemas'
 import { SiteRuntimeConfigSchema, type SiteRuntimeConfig } from '@core/site-runtime/schemas'
 import { normalizeSiteRuntimeConfig } from '@core/site-runtime/runtimeConfig'
 import { SitePackageJsonSchema, type SitePackageJson } from '@core/site-dependencies/manifest'
@@ -109,7 +109,7 @@ export type SiteDocument = SiteShell & {
 // Tolerant parsing
 // ---------------------------------------------------------------------------
 
-const VALID_SITE_FILE_TYPES: SiteFileType[] = ['component', 'script', 'style', 'asset', 'config', 'doc']
+const VALID_SITE_FILE_TYPES: readonly SiteFileType[] = SITE_FILE_TYPES
 
 /**
  * Parse a SiteFile. Keeps the file with blob=undefined when the blob is
diff --git a/src/core/plugin-build/buildPackage.ts b/src/core/plugin-build/buildPackage.ts
index c1f72daec..8148b0fa2 100644
--- a/src/core/plugin-build/buildPackage.ts
+++ b/src/core/plugin-build/buildPackage.ts
@@ -18,30 +18,13 @@
  * those stay with the callers.
  */
 import { existsSync, readdirSync } from 'node:fs'
-import { mkdir, rm, writeFile } from 'node:fs/promises'
-import { join } from 'node:path'
+import { copyFile, mkdir, rm, writeFile } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
 import type { PluginManifest } from '@core/plugin-sdk'
 import { bundleEntrypoint } from './bundle'
+import type { ImportResolverPolicy } from './containment'
 import { generateModulesFacade } from './facades'
 
-/**
- * Import-containment seam. Absent = default resolution (CLI behavior).
- * The site plugin frontend supplies a policy that fails any resolution
- * escaping the materialized workspace. See `./containment.ts`.
- */
-export interface ImportResolverPolicy {
-  /** Absolute dir that workspace-originating imports must stay inside. */
-  workspaceRoot: string
-  /** Exact bare-specifier → absolute-path overrides (e.g. '@instatic/plugin-sdk'). */
-  bareSpecifiers: Record<string, string>
-  /**
-   * Bare specifiers allowed to stay external (resolved by a runtime import
-   * map, never bundled). Populated automatically by `bundleEntrypoint` from
-   * the bundle's own external list when not set explicitly.
-   */
-  allowedExternals?: string[]
-}
-
 export interface BuildPackageInput {
   /** Absolute dir containing the plugin source (server/, editor/, frontend/, modules/…). */
   sourceDir: string
@@ -189,6 +172,31 @@ export async function buildPluginPackage(input: BuildPackageInput): Promise<Buil
     files.push(entry.outputPath)
   }
 
+  // Frontend stylesheets — style assets are static files (never bundled);
+  // copy top-level frontend/*.css through so `frontend.assets[]` style
+  // declarations resolve in the package.
+  const frontendDir = join(sourceDir, 'frontend')
+  if (existsSync(frontendDir)) {
+    for (const entry of readdirSync(frontendDir, { withFileTypes: true })) {
+      if (entry.isDirectory() || !entry.name.endsWith('.css')) continue
+      const outputPath = `frontend/${entry.name}`
+      await mkdir(join(outputDir, 'frontend'), { recursive: true })
+      await copyFile(join(frontendDir, entry.name), join(outputDir, outputPath))
+      files.push(outputPath)
+    }
+  }
+
+  // Pack contents — a static JSON file in the source tree (site plugin
+  // builds materialize it from the draft). The CLI writes its pack from the
+  // evaluated config AFTER this core runs, so a missing source file is
+  // skipped, not an error.
+  if (manifest.pack && existsSync(join(sourceDir, manifest.pack.path))) {
+    const packOut = join(outputDir, manifest.pack.path)
+    await mkdir(dirname(packOut), { recursive: true })
+    await copyFile(join(sourceDir, manifest.pack.path), packOut)
+    files.push(manifest.pack.path)
+  }
+
   // Admin app pages — one bundle per declared app entry. The manifest's
   // `entry` field points at the BUNDLED output (.js); resolve the typed
   // source next to it.
diff --git a/src/core/plugin-build/bundle.ts b/src/core/plugin-build/bundle.ts
index cfb993daa..75483305c 100644
--- a/src/core/plugin-build/bundle.ts
+++ b/src/core/plugin-build/bundle.ts
@@ -7,8 +7,7 @@
 import { mkdir, rm, writeFile } from 'node:fs/promises'
 import { dirname, join, resolve } from 'node:path'
 import { assertSandboxSafe } from '@core/plugins/sandboxScan'
-import type { ImportResolverPolicy } from './buildPackage'
-import { containmentPlugin } from './containment'
+import { containmentPlugin, type ImportResolverPolicy } from './containment'
 import { generateSandboxFacade } from './facades'
 
 /**
diff --git a/src/core/plugin-build/containment.ts b/src/core/plugin-build/containment.ts
index 516bd1450..d3e21d25e 100644
--- a/src/core/plugin-build/containment.ts
+++ b/src/core/plugin-build/containment.ts
@@ -1,7 +1,24 @@
 import { realpathSync } from 'node:fs'
 import { dirname, isAbsolute, resolve, sep } from 'node:path'
 import type { BunPlugin } from 'bun'
-import type { ImportResolverPolicy } from './buildPackage'
+
+/**
+ * Import-containment seam. Absent on a bundle = default resolution (CLI
+ * behavior). The site plugin frontend supplies a policy that fails any
+ * resolution escaping the materialized workspace.
+ */
+export interface ImportResolverPolicy {
+  /** Absolute dir that workspace-originating imports must stay inside. */
+  workspaceRoot: string
+  /** Exact bare-specifier → absolute-path overrides (e.g. '@instatic/plugin-sdk'). */
+  bareSpecifiers: Record<string, string>
+  /**
+   * Bare specifiers allowed to stay external (resolved by a runtime import
+   * map, never bundled). Populated automatically by `bundleEntrypoint` from
+   * the bundle's own external list when not set explicitly.
+   */
+  allowedExternals?: string[]
+}
 
 /**
  * Roots a workspace may legitimately appear under: as given, fully
diff --git a/src/core/plugin-build/index.ts b/src/core/plugin-build/index.ts
index a54cc4306..6b4edfdac 100644
--- a/src/core/plugin-build/index.ts
+++ b/src/core/plugin-build/index.ts
@@ -11,7 +11,7 @@ export {
   listFrontendSources,
   type BuildPackageInput,
   type BuildPackageResult,
-  type ImportResolverPolicy,
 } from './buildPackage'
+export type { ImportResolverPolicy } from './containment'
 export { bundleEntrypoint, HOST_RUNTIME_EXTERNALS, type BundleOptions } from './bundle'
 export { generateModulesFacade, generateSandboxFacade } from './facades'
diff --git a/src/core/plugin-sdk/index.ts b/src/core/plugin-sdk/index.ts
index d7ad8e382..1d8e87268 100644
--- a/src/core/plugin-sdk/index.ts
+++ b/src/core/plugin-sdk/index.ts
@@ -5,3 +5,4 @@ export * from './capabilities'
 export * from './guards'
 export * from './modules'
 export * from './builders'
+export { sitePluginRoute } from './sitePluginRoute'
diff --git a/src/core/plugin-sdk/sitePluginRoute.ts b/src/core/plugin-sdk/sitePluginRoute.ts
new file mode 100644
index 000000000..b9e2826cf
--- /dev/null
+++ b/src/core/plugin-sdk/sitePluginRoute.ts
@@ -0,0 +1,16 @@
+/**
+ * Stable route construction for site plugin backends. Pure string function —
+ * frontend bundles INLINE it at build time (published pages have no host
+ * import map; site plugin builds map '@instatic/plugin-sdk' through the
+ * containment policy so this bundles in), while editor/admin bundles
+ * resolve it through the host import map like the rest of the SDK. Keeping
+ * the URL shape behind this helper preserves room to change it later.
+ *
+ *   import { sitePluginRoute } from '@instatic/plugin-sdk'
+ *   await fetch(sitePluginRoute('newsletter', '/subscribe'), { method: 'POST' })
+ *   // → /admin/api/cms/plugins/site.newsletter/runtime/subscribe
+ */
+export function sitePluginRoute(localId: string, path: string): string {
+  const suffix = path.startsWith('/') ? path.slice(1) : path
+  return `/admin/api/cms/plugins/site.${localId}/runtime/${suffix}`
+}
diff --git a/src/core/plugins/manifest.ts b/src/core/plugins/manifest.ts
index f000dcaa8..40a55142e 100644
--- a/src/core/plugins/manifest.ts
+++ b/src/core/plugins/manifest.ts
@@ -1,4 +1,4 @@
-import { Type, Value, type Static } from '@core/utils/typeboxHelpers'
+import { Value } from '@core/utils/typeboxHelpers'
 import { compiled } from '@core/utils/typeboxCompiler'
 import type {
   PluginAdminPage,
@@ -12,10 +12,23 @@ import {
   isCompatiblePluginApiVersion,
   MIN_SUPPORTED_PLUGIN_API_VERSION,
   PLUGIN_API_VERSION,
-  PLUGIN_PERMISSION_VALUES,
   permissionLabel as sdkPermissionLabel,
 } from '@core/plugin-sdk'
 import { collectEnabledAdminPages, pluginAdminPageRoute } from './manifestAdminPages'
+import {
+  MANIFEST_SLUG_PATTERN,
+  RESOURCE_FIELD_ID_PATTERN,
+  manifestSchema,
+  type ManifestRaw,
+} from './manifestSchemas'
+
+// Schema shapes live in `./manifestSchemas.ts`; re-exported so
+// `@core/plugins/manifest` stays the public surface.
+export {
+  MANIFEST_AUTHOR_FIELD_SCHEMAS,
+  SITE_PLUGIN_ID_PREFIX,
+  isReservedSitePluginId,
+} from './manifestSchemas'
 
 // Admin-page route helpers and resource-record helpers live in sibling
 // modules (responsibility split); re-exported here so
@@ -23,358 +36,6 @@ import { collectEnabledAdminPages, pluginAdminPageRoute } from './manifestAdminP
 export { collectEnabledAdminPages, pluginAdminPageRoute }
 export { findPluginResource, validatePluginRecordData } from './resourceRecords'
 
-const PLUGIN_ID_PATTERN = /^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)+$/
-
-/**
- * The `site.` id namespace is reserved for site plugins generated from the
- * site draft (docs/features/site-plugins.md). Uploaded zip packages must
- * never claim it — enforced at the zip boundary (`readPluginPackage`), NOT
- * here in the parser, because generated site-plugin packages parse through
- * `parsePluginManifest` with `site.*` ids.
- */
-export const SITE_PLUGIN_ID_PREFIX = 'site.'
-
-export function isReservedSitePluginId(id: string): boolean {
-  return id.startsWith(SITE_PLUGIN_ID_PREFIX)
-}
-/**
- * Used for resource IDs and admin page IDs — these become URL path segments,
- * so they are restricted to lowercase kebab-case.
- * Examples: `subscribers`, `seo-entries`, `my-posts`
- */
-const MANIFEST_SLUG_PATTERN = /^[a-z][a-z0-9-]*$/
-/**
- * Used for resource field IDs — these are JSON object keys only, not URL
- * segments. Allows camelCase, snake_case, and kebab-case.
- * Examples: `email`, `subscribedAt`, `page_id`, `first-name`
- */
-const RESOURCE_FIELD_ID_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_-]*$/
-const SEMVERISH_PATTERN = /^\d+\.\d+\.\d+(?:[-+][0-9a-zA-Z.-]+)?$/
-const SAFE_ASSET_PATH_PATTERN = /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[a-zA-Z0-9._/-]+$/
-// `assetBasePath` is server-controlled. The only legitimate shape is
-// `/uploads/plugins/{pluginId}/{version}` (optionally trailing `/`),
-// produced by `writePluginPackageFiles` on zip install. Any other shape
-// — including `..` traversal, empty segments, or non-uploads paths —
-// is rejected at the schema boundary so it can't reach the filesystem
-// sinks (`loadServerPluginModule`, `removePluginAssets`).
-const ASSET_BASE_PATH_PATTERN =
-  /^\/uploads\/plugins\/[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)+\/\d+\.\d+\.\d+(?:[-+][0-9a-zA-Z.-]+)?\/?$/
-// `adminPages[].content.assetPath` (app pages) — must look like an uploads
-// path with no `.`/`..` segments. The post-check in `parsePluginManifest`
-// further pins it to the declaring plugin's own asset subtree.
-const ADMIN_APP_ASSET_PATH_PATTERN =
-  /^(?!.*(?:^|\/)\.{1,2}(?:\/|$))\/uploads\/plugins\/[a-zA-Z0-9._/-]+$/
-// Outbound network allowlist: lowercase hostname, optional leading `*.`
-// wildcard. No paths, ports, query strings — just the host. This is the
-// allowlist the host's `network.fetch` bridge checks against.
-const NETWORK_HOST_PATTERN = /^(?:\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/
-
-const permissionSchema = Type.Union(
-  PLUGIN_PERMISSION_VALUES.map((v) => Type.Literal(v)),
-)
-
-const pinSchema = Type.Object({
-  label: Type.String({ minLength: 1, maxLength: 80 }),
-  detail: Type.Optional(Type.String({ maxLength: 160 })),
-  x: Type.Number({ minimum: 0, maximum: 100 }),
-  y: Type.Number({ minimum: 0, maximum: 100 }),
-})
-
-// `pins` is optional in the schema so the union default can be handled
-// explicitly in parsePluginManifest post-processing (TypeBox union defaults
-// are not reliably applied within discriminated-union variants).
-const contentSchema = Type.Union([
-  Type.Object({
-    kind: Type.Literal('markdown'),
-    heading: Type.Optional(Type.String({ minLength: 1, maxLength: 120 })),
-    body: Type.String({ maxLength: 20_000 }),
-  }),
-  Type.Object({
-    kind: Type.Literal('map'),
-    heading: Type.String({ minLength: 1, maxLength: 120 }),
-    body: Type.Optional(Type.String({ maxLength: 500 })),
-    centerLabel: Type.Optional(Type.String({ maxLength: 80 })),
-    pins: Type.Optional(Type.Array(pinSchema, { maxItems: 40 })),
-  }),
-  Type.Object({
-    kind: Type.Literal('resource'),
-    heading: Type.String({ minLength: 1, maxLength: 120 }),
-    resource: Type.String({ pattern: MANIFEST_SLUG_PATTERN.source }),
-  }),
-  Type.Object({
-    kind: Type.Literal('app'),
-    heading: Type.String({ minLength: 1, maxLength: 120 }),
-    entry: Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source }),
-    // Optional override for where the host resolves `entry` from; defaults
-    // to the plugin's `assetBasePath`. The schema pattern rejects dot
-    // segments and foreign URL shapes; parsePluginManifest additionally
-    // pins the path to THIS plugin's own `/uploads/plugins/{id}/{version}`
-    // subtree so a manifest can't point the admin shell's dynamic import()
-    // at an arbitrary location.
-    assetPath: Type.Optional(Type.String({
-      pattern: ADMIN_APP_ASSET_PATH_PATTERN.source,
-      maxLength: 500,
-    })),
-  }),
-])
-
-const resourceFieldSchema = Type.Object({
-  id: Type.String({ pattern: RESOURCE_FIELD_ID_PATTERN.source }),
-  label: Type.String({ minLength: 1, maxLength: 80 }),
-  type: Type.Union([
-    Type.Literal('text'),
-    Type.Literal('longtext'),
-    Type.Literal('number'),
-    Type.Literal('date'),
-    Type.Literal('boolean'),
-  ]),
-  required: Type.Optional(Type.Boolean()),
-})
-
-const resourceSchema = Type.Object({
-  id: Type.String({ pattern: MANIFEST_SLUG_PATTERN.source }),
-  title: Type.String({ minLength: 1, maxLength: 80 }),
-  singularLabel: Type.Optional(Type.String({ minLength: 1, maxLength: 80 })),
-  pluralLabel: Type.Optional(Type.String({ minLength: 1, maxLength: 80 })),
-  fields: Type.Array(resourceFieldSchema, { minItems: 1, maxItems: 50 }),
-})
-
-const adminPageSchema = Type.Object({
-  id: Type.String({ pattern: MANIFEST_SLUG_PATTERN.source }),
-  title: Type.String({ minLength: 1, maxLength: 80 }),
-  navLabel: Type.Optional(Type.String({ minLength: 1, maxLength: 30 })),
-  icon: Type.Optional(Type.String({ minLength: 1, maxLength: 30 })),
-  route: Type.Optional(Type.String()),
-  content: contentSchema,
-})
-
-// `settings` schema — a discriminated union over the supported types, mirroring
-// `PluginSettingDefinition` in `src/core/plugin-sdk/builders/settings.ts`.
-// The Static type of each variant is assignment-compatible with the
-// corresponding `PluginSettingDefinition` branch (Array<T> extends
-// ReadonlyArray<T>), so parsePluginManifest needs no cast for `settings`.
-const SETTING_ID_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_-]*$/
-
-// Base properties shared by every setting variant.
-const settingBaseProps = {
-  id: Type.String({ pattern: SETTING_ID_PATTERN.source }),
-  label: Type.String({ minLength: 1, maxLength: 80 }),
-  description: Type.Optional(Type.String({ maxLength: 500 })),
-  required: Type.Optional(Type.Boolean()),
-  secret: Type.Optional(Type.Boolean()),
-}
-
-const settingOptionSchema = Type.Object({
-  label: Type.String({ minLength: 1, maxLength: 80 }),
-  value: Type.String({ minLength: 1, maxLength: 80 }),
-})
-
-const settingDefinitionSchema = Type.Union([
-  Type.Object({
-    ...settingBaseProps,
-    type: Type.Literal('text'),
-    placeholder: Type.Optional(Type.String({ maxLength: 120 })),
-    default: Type.Optional(Type.String()),
-  }),
-  Type.Object({
-    ...settingBaseProps,
-    type: Type.Literal('textarea'),
-    placeholder: Type.Optional(Type.String({ maxLength: 120 })),
-    rows: Type.Optional(Type.Number({ minimum: 1 })),
-    default: Type.Optional(Type.String()),
-  }),
-  Type.Object({
-    ...settingBaseProps,
-    type: Type.Literal('number'),
-    min: Type.Optional(Type.Number()),
-    max: Type.Optional(Type.Number()),
-    step: Type.Optional(Type.Number()),
-    unit: Type.Optional(Type.String({ maxLength: 16 })),
-    default: Type.Optional(Type.Number()),
-  }),
-  Type.Object({
-    ...settingBaseProps,
-    type: Type.Literal('toggle'),
-    default: Type.Optional(Type.Boolean()),
-  }),
-  Type.Object({
-    ...settingBaseProps,
-    type: Type.Literal('select'),
-    // Required field — a select setting must declare its options.
-    options: Type.Array(settingOptionSchema, { minItems: 1 }),
-    default: Type.Optional(Type.String()),
-  }),
-  Type.Object({
-    ...settingBaseProps,
-    type: Type.Literal('color'),
-    format: Type.Optional(Type.Union([Type.Literal('hex'), Type.Literal('rgba')])),
-    default: Type.Optional(Type.String()),
-  }),
-  Type.Object({
-    ...settingBaseProps,
-    type: Type.Literal('url'),
-    default: Type.Optional(Type.String()),
-  }),
-  Type.Object({
-    ...settingBaseProps,
-    type: Type.Literal('password'),
-    placeholder: Type.Optional(Type.String({ maxLength: 120 })),
-    default: Type.Optional(Type.String()),
-  }),
-])
-
-// Marketplace metadata — author, license, URLs, keywords, visual icon.
-// Validated at the manifest boundary so a malicious zip can't inject
-// arbitrary HTML or filesystem-traversing icon paths.
-const URL_PATTERN = /^https?:\/\/[^\s<>"'`]+$/
-const EMAIL_PATTERN = /^[^\s<>"'`@]+@[^\s<>"'`@]+\.[^\s<>"'`@]+$/
-const SPDX_PATTERN = /^[A-Za-z0-9.+-]{1,40}$/
-const KEYWORD_PATTERN = /^[A-Za-z0-9_-]{1,30}$/
-const ICON_PATH_PATTERN = /^[a-zA-Z0-9._-]+\.(png|svg|webp|jpg|jpeg)$/
-
-const authorSchema = Type.Object({
-  name: Type.String({ minLength: 1, maxLength: 120 }),
-  email: Type.Optional(Type.String({ pattern: EMAIL_PATTERN.source, maxLength: 240 })),
-  url: Type.Optional(Type.String({ pattern: URL_PATTERN.source, maxLength: 500 })),
-})
-
-// ---------------------------------------------------------------------------
-// Frontend assets — shared schemas referenced by the manifest below.
-// ---------------------------------------------------------------------------
-
-const FrontendAssetPlacementSchema = Type.Union([
-  Type.Literal('head'),
-  Type.Literal('head-end'),
-  Type.Literal('body-start'),
-  Type.Literal('body-end'),
-])
-
-// HTML attribute name: lowercase letters / digits / dashes / colon / underscore.
-// Restricts what plugins can spell so a malformed declaration can't smuggle
-// in arbitrary HTML by setting an attribute named `>`. Values are
-// HTML-escaped at render time.
-const FRONTEND_ATTR_NAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9_:-]*$/
-
-const FrontendAssetAttrsSchema = Type.Record(
-  Type.String({ pattern: FRONTEND_ATTR_NAME_PATTERN.source, maxLength: 64 }),
-  Type.String({ maxLength: 4096 }),
-)
-
-const manifestSchema = Type.Object({
-  id: Type.String({ pattern: PLUGIN_ID_PATTERN.source }),
-  name: Type.String({ minLength: 1, maxLength: 80 }),
-  version: Type.String({ pattern: SEMVERISH_PATTERN.source }),
-  // Schema accepts any positive integer; the parser narrows to the
-  // host-supported range via `isCompatiblePluginApiVersion`. Rejecting at
-  // a literal would force every old plugin offline the day a host bumps
-  // PLUGIN_API_VERSION, even when the host explicitly wants to keep
-  // serving older plugins via MIN_SUPPORTED_PLUGIN_API_VERSION.
-  apiVersion: Type.Integer({ minimum: 1 }),
-  description: Type.Optional(Type.String({ maxLength: 500 })),
-  author: Type.Optional(authorSchema),
-  license: Type.Optional(Type.String({ pattern: SPDX_PATTERN.source })),
-  homepage: Type.Optional(Type.String({ pattern: URL_PATTERN.source, maxLength: 500 })),
-  repository: Type.Optional(Type.String({ pattern: URL_PATTERN.source, maxLength: 500 })),
-  keywords: Type.Optional(Type.Array(Type.String({ pattern: KEYWORD_PATTERN.source }), { maxItems: 20 })),
-  icon: Type.Optional(Type.String({ pattern: ICON_PATH_PATTERN.source, maxLength: 80 })),
-  permissions: Type.Array(permissionSchema, { default: [] }),
-  grantedPermissions: Type.Optional(Type.Array(permissionSchema)),
-  // Per-host allowlist for outbound HTTP. Plain hostnames (`api.example.com`)
-  // match exactly; the leading `*.` wildcard matches one subdomain segment.
-  // Hostnames are normalized (lowercased, trimmed) at manifest parse time.
-  networkAllowedHosts: Type.Optional(Type.Array(
-    Type.String({ pattern: NETWORK_HOST_PATTERN.source, maxLength: 253 }),
-    { maxItems: 50 },
-  )),
-  // Per-table allowlist for the `api.cms.content.*` surface. The host
-  // additionally enforces that each `mode` matches a granted permission
-  // at install time (`assertContentAccessCoherent` below).
-  contentAccess: Type.Optional(Type.Array(
-    Type.Object({
-      table: Type.String({ pattern: MANIFEST_SLUG_PATTERN.source, maxLength: 80 }),
-      modes: Type.Array(
-        Type.Union([
-          Type.Literal('read'),
-          Type.Literal('write'),
-          Type.Literal('publish'),
-          Type.Literal('delete'),
-        ]),
-        { minItems: 1 },
-      ),
-    }, { additionalProperties: false }),
-    { maxItems: 50 },
-  )),
-  entrypoints: Type.Optional(Type.Object({
-    server: Type.Optional(Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source })),
-    editor: Type.Optional(Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source })),
-    admin: Type.Optional(Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source })),
-    modules: Type.Optional(Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source })),
-  })),
-  /**
-   * Declarative frontend tag list — scripts, styles, meta, link, and shared
-   * host-runtime references the host injects into every published page on
-   * behalf of this plugin. Validated structurally here; the host's frontend
-   * injection pipeline reads the array at publish time and emits the actual
-   * tags. Requires the `frontend.assets` permission (coherence checked
-   * downstream in `assertFrontendAssetsCoherent`).
-   */
-  frontend: Type.Optional(Type.Object({
-    assets: Type.Array(
-      Type.Union([
-        Type.Object({
-          kind: Type.Literal('script'),
-          src: Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source }),
-          placement: Type.Optional(FrontendAssetPlacementSchema),
-          strategy: Type.Optional(Type.Union([
-            Type.Literal('defer'),
-            Type.Literal('async'),
-            Type.Literal('module'),
-            Type.Literal('sync'),
-          ])),
-          attrs: Type.Optional(FrontendAssetAttrsSchema),
-        }, { additionalProperties: false }),
-        Type.Object({
-          kind: Type.Literal('script-inline'),
-          content: Type.String({ minLength: 1, maxLength: 64 * 1024 }),
-          placement: Type.Optional(FrontendAssetPlacementSchema),
-          attrs: Type.Optional(FrontendAssetAttrsSchema),
-        }, { additionalProperties: false }),
-        Type.Object({
-          kind: Type.Literal('style'),
-          href: Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source }),
-          placement: Type.Optional(FrontendAssetPlacementSchema),
-          attrs: Type.Optional(FrontendAssetAttrsSchema),
-        }, { additionalProperties: false }),
-        Type.Object({
-          kind: Type.Literal('style-inline'),
-          content: Type.String({ minLength: 1, maxLength: 64 * 1024 }),
-          placement: Type.Optional(FrontendAssetPlacementSchema),
-          attrs: Type.Optional(FrontendAssetAttrsSchema),
-        }, { additionalProperties: false }),
-        Type.Object({
-          kind: Type.Literal('link'),
-          attrs: FrontendAssetAttrsSchema,
-          placement: Type.Optional(FrontendAssetPlacementSchema),
-        }, { additionalProperties: false }),
-        Type.Object({
-          kind: Type.Literal('meta'),
-          attrs: FrontendAssetAttrsSchema,
-          placement: Type.Optional(FrontendAssetPlacementSchema),
-        }, { additionalProperties: false }),
-      ]),
-      { maxItems: 50 },
-    ),
-  })),
-  assetBasePath: Type.Optional(Type.String({ pattern: ASSET_BASE_PATH_PATTERN.source })),
-  resources: Type.Array(resourceSchema, { maxItems: 20, default: [] }),
-  adminPages: Type.Array(adminPageSchema, { maxItems: 20, default: [] }),
-  pack: Type.Optional(Type.Object({
-    path: Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source }),
-  })),
-  settings: Type.Optional(Type.Array(settingDefinitionSchema, { maxItems: 50 })),
-})
-
-type ManifestRaw = Static<typeof manifestSchema>
 
 /**
  * Convert a raw TypeBox pattern-validation error into a human-readable
diff --git a/src/core/plugins/manifestSchemas.ts b/src/core/plugins/manifestSchemas.ts
new file mode 100644
index 000000000..e123cbee7
--- /dev/null
+++ b/src/core/plugins/manifestSchemas.ts
@@ -0,0 +1,388 @@
+/**
+ * Plugin manifest schemas — patterns, sub-schemas, the runtime manifest
+ * schema, and the author-owned field record shared with the site plugin
+ * draft manifest. The PARSER (validation + coherence checks) lives in
+ * `./manifest.ts`; this module owns only shapes so both stay under the
+ * module-size ceiling with one clear responsibility each.
+ */
+import { Type, type Static } from '@core/utils/typeboxHelpers'
+import { PLUGIN_PERMISSION_VALUES } from '@core/plugin-sdk'
+
+export const PLUGIN_ID_PATTERN = /^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)+$/
+
+/**
+ * The `site.` id namespace is reserved for site plugins generated from the
+ * site draft (docs/features/site-plugins.md). Uploaded zip packages must
+ * never claim it — enforced at the zip boundary (`readPluginPackage`), NOT
+ * here in the parser, because generated site-plugin packages parse through
+ * `parsePluginManifest` with `site.*` ids.
+ */
+export const SITE_PLUGIN_ID_PREFIX = 'site.'
+
+export function isReservedSitePluginId(id: string): boolean {
+  return id.startsWith(SITE_PLUGIN_ID_PREFIX)
+}
+/**
+ * Used for resource IDs and admin page IDs — these become URL path segments,
+ * so they are restricted to lowercase kebab-case.
+ * Examples: `subscribers`, `seo-entries`, `my-posts`
+ */
+export const MANIFEST_SLUG_PATTERN = /^[a-z][a-z0-9-]*$/
+/**
+ * Used for resource field IDs — these are JSON object keys only, not URL
+ * segments. Allows camelCase, snake_case, and kebab-case.
+ * Examples: `email`, `subscribedAt`, `page_id`, `first-name`
+ */
+export const RESOURCE_FIELD_ID_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_-]*$/
+export const SEMVERISH_PATTERN = /^\d+\.\d+\.\d+(?:[-+][0-9a-zA-Z.-]+)?$/
+export const SAFE_ASSET_PATH_PATTERN = /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[a-zA-Z0-9._/-]+$/
+// `assetBasePath` is server-controlled. The only legitimate shape is
+// `/uploads/plugins/{pluginId}/{version}` (optionally trailing `/`),
+// produced by `writePluginPackageFiles` on zip install. Any other shape
+// — including `..` traversal, empty segments, or non-uploads paths —
+// is rejected at the schema boundary so it can't reach the filesystem
+// sinks (`loadServerPluginModule`, `removePluginAssets`).
+export const ASSET_BASE_PATH_PATTERN =
+  /^\/uploads\/plugins\/[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)+\/\d+\.\d+\.\d+(?:[-+][0-9a-zA-Z.-]+)?\/?$/
+// `adminPages[].content.assetPath` (app pages) — must look like an uploads
+// path with no `.`/`..` segments. The post-check in `parsePluginManifest`
+// further pins it to the declaring plugin's own asset subtree.
+export const ADMIN_APP_ASSET_PATH_PATTERN =
+  /^(?!.*(?:^|\/)\.{1,2}(?:\/|$))\/uploads\/plugins\/[a-zA-Z0-9._/-]+$/
+// Outbound network allowlist: lowercase hostname, optional leading `*.`
+// wildcard. No paths, ports, query strings — just the host. This is the
+// allowlist the host's `network.fetch` bridge checks against.
+export const NETWORK_HOST_PATTERN = /^(?:\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/
+
+const permissionSchema = Type.Union(
+  PLUGIN_PERMISSION_VALUES.map((v) => Type.Literal(v)),
+)
+
+const pinSchema = Type.Object({
+  label: Type.String({ minLength: 1, maxLength: 80 }),
+  detail: Type.Optional(Type.String({ maxLength: 160 })),
+  x: Type.Number({ minimum: 0, maximum: 100 }),
+  y: Type.Number({ minimum: 0, maximum: 100 }),
+})
+
+// `pins` is optional in the schema so the union default can be handled
+// explicitly in parsePluginManifest post-processing (TypeBox union defaults
+// are not reliably applied within discriminated-union variants).
+const contentSchema = Type.Union([
+  Type.Object({
+    kind: Type.Literal('markdown'),
+    heading: Type.Optional(Type.String({ minLength: 1, maxLength: 120 })),
+    body: Type.String({ maxLength: 20_000 }),
+  }),
+  Type.Object({
+    kind: Type.Literal('map'),
+    heading: Type.String({ minLength: 1, maxLength: 120 }),
+    body: Type.Optional(Type.String({ maxLength: 500 })),
+    centerLabel: Type.Optional(Type.String({ maxLength: 80 })),
+    pins: Type.Optional(Type.Array(pinSchema, { maxItems: 40 })),
+  }),
+  Type.Object({
+    kind: Type.Literal('resource'),
+    heading: Type.String({ minLength: 1, maxLength: 120 }),
+    resource: Type.String({ pattern: MANIFEST_SLUG_PATTERN.source }),
+  }),
+  Type.Object({
+    kind: Type.Literal('app'),
+    heading: Type.String({ minLength: 1, maxLength: 120 }),
+    entry: Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source }),
+    // Optional override for where the host resolves `entry` from; defaults
+    // to the plugin's `assetBasePath`. The schema pattern rejects dot
+    // segments and foreign URL shapes; parsePluginManifest additionally
+    // pins the path to THIS plugin's own `/uploads/plugins/{id}/{version}`
+    // subtree so a manifest can't point the admin shell's dynamic import()
+    // at an arbitrary location.
+    assetPath: Type.Optional(Type.String({
+      pattern: ADMIN_APP_ASSET_PATH_PATTERN.source,
+      maxLength: 500,
+    })),
+  }),
+])
+
+const resourceFieldSchema = Type.Object({
+  id: Type.String({ pattern: RESOURCE_FIELD_ID_PATTERN.source }),
+  label: Type.String({ minLength: 1, maxLength: 80 }),
+  type: Type.Union([
+    Type.Literal('text'),
+    Type.Literal('longtext'),
+    Type.Literal('number'),
+    Type.Literal('date'),
+    Type.Literal('boolean'),
+  ]),
+  required: Type.Optional(Type.Boolean()),
+})
+
+const resourceSchema = Type.Object({
+  id: Type.String({ pattern: MANIFEST_SLUG_PATTERN.source }),
+  title: Type.String({ minLength: 1, maxLength: 80 }),
+  singularLabel: Type.Optional(Type.String({ minLength: 1, maxLength: 80 })),
+  pluralLabel: Type.Optional(Type.String({ minLength: 1, maxLength: 80 })),
+  fields: Type.Array(resourceFieldSchema, { minItems: 1, maxItems: 50 }),
+})
+
+const adminPageSchema = Type.Object({
+  id: Type.String({ pattern: MANIFEST_SLUG_PATTERN.source }),
+  title: Type.String({ minLength: 1, maxLength: 80 }),
+  navLabel: Type.Optional(Type.String({ minLength: 1, maxLength: 30 })),
+  icon: Type.Optional(Type.String({ minLength: 1, maxLength: 30 })),
+  route: Type.Optional(Type.String()),
+  content: contentSchema,
+})
+
+// `settings` schema — a discriminated union over the supported types, mirroring
+// `PluginSettingDefinition` in `src/core/plugin-sdk/builders/settings.ts`.
+// The Static type of each variant is assignment-compatible with the
+// corresponding `PluginSettingDefinition` branch (Array<T> extends
+// ReadonlyArray<T>), so parsePluginManifest needs no cast for `settings`.
+const SETTING_ID_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_-]*$/
+
+// Base properties shared by every setting variant.
+const settingBaseProps = {
+  id: Type.String({ pattern: SETTING_ID_PATTERN.source }),
+  label: Type.String({ minLength: 1, maxLength: 80 }),
+  description: Type.Optional(Type.String({ maxLength: 500 })),
+  required: Type.Optional(Type.Boolean()),
+  secret: Type.Optional(Type.Boolean()),
+}
+
+const settingOptionSchema = Type.Object({
+  label: Type.String({ minLength: 1, maxLength: 80 }),
+  value: Type.String({ minLength: 1, maxLength: 80 }),
+})
+
+const settingDefinitionSchema = Type.Union([
+  Type.Object({
+    ...settingBaseProps,
+    type: Type.Literal('text'),
+    placeholder: Type.Optional(Type.String({ maxLength: 120 })),
+    default: Type.Optional(Type.String()),
+  }),
+  Type.Object({
+    ...settingBaseProps,
+    type: Type.Literal('textarea'),
+    placeholder: Type.Optional(Type.String({ maxLength: 120 })),
+    rows: Type.Optional(Type.Number({ minimum: 1 })),
+    default: Type.Optional(Type.String()),
+  }),
+  Type.Object({
+    ...settingBaseProps,
+    type: Type.Literal('number'),
+    min: Type.Optional(Type.Number()),
+    max: Type.Optional(Type.Number()),
+    step: Type.Optional(Type.Number()),
+    unit: Type.Optional(Type.String({ maxLength: 16 })),
+    default: Type.Optional(Type.Number()),
+  }),
+  Type.Object({
+    ...settingBaseProps,
+    type: Type.Literal('toggle'),
+    default: Type.Optional(Type.Boolean()),
+  }),
+  Type.Object({
+    ...settingBaseProps,
+    type: Type.Literal('select'),
+    // Required field — a select setting must declare its options.
+    options: Type.Array(settingOptionSchema, { minItems: 1 }),
+    default: Type.Optional(Type.String()),
+  }),
+  Type.Object({
+    ...settingBaseProps,
+    type: Type.Literal('color'),
+    format: Type.Optional(Type.Union([Type.Literal('hex'), Type.Literal('rgba')])),
+    default: Type.Optional(Type.String()),
+  }),
+  Type.Object({
+    ...settingBaseProps,
+    type: Type.Literal('url'),
+    default: Type.Optional(Type.String()),
+  }),
+  Type.Object({
+    ...settingBaseProps,
+    type: Type.Literal('password'),
+    placeholder: Type.Optional(Type.String({ maxLength: 120 })),
+    default: Type.Optional(Type.String()),
+  }),
+])
+
+// Marketplace metadata — author, license, URLs, keywords, visual icon.
+// Validated at the manifest boundary so a malicious zip can't inject
+// arbitrary HTML or filesystem-traversing icon paths.
+const URL_PATTERN = /^https?:\/\/[^\s<>"'`]+$/
+const EMAIL_PATTERN = /^[^\s<>"'`@]+@[^\s<>"'`@]+\.[^\s<>"'`@]+$/
+const SPDX_PATTERN = /^[A-Za-z0-9.+-]{1,40}$/
+const KEYWORD_PATTERN = /^[A-Za-z0-9_-]{1,30}$/
+const ICON_PATH_PATTERN = /^[a-zA-Z0-9._-]+\.(png|svg|webp|jpg|jpeg)$/
+
+const authorSchema = Type.Object({
+  name: Type.String({ minLength: 1, maxLength: 120 }),
+  email: Type.Optional(Type.String({ pattern: EMAIL_PATTERN.source, maxLength: 240 })),
+  url: Type.Optional(Type.String({ pattern: URL_PATTERN.source, maxLength: 500 })),
+})
+
+// ---------------------------------------------------------------------------
+// Frontend assets — shared schemas referenced by the manifest below.
+// ---------------------------------------------------------------------------
+
+const FrontendAssetPlacementSchema = Type.Union([
+  Type.Literal('head'),
+  Type.Literal('head-end'),
+  Type.Literal('body-start'),
+  Type.Literal('body-end'),
+])
+
+// HTML attribute name: lowercase letters / digits / dashes / colon / underscore.
+// Restricts what plugins can spell so a malformed declaration can't smuggle
+// in arbitrary HTML by setting an attribute named `>`. Values are
+// HTML-escaped at render time.
+const FRONTEND_ATTR_NAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9_:-]*$/
+
+const FrontendAssetAttrsSchema = Type.Record(
+  Type.String({ pattern: FRONTEND_ATTR_NAME_PATTERN.source, maxLength: 64 }),
+  Type.String({ maxLength: 4096 }),
+)
+
+/**
+ * Manifest fields a plugin AUTHOR owns — shared verbatim with the site
+ * plugin draft-manifest schema (`@core/site-plugins`), which is exactly
+ * "author fields, nothing derived". Deliberately excludes `id`, `version`,
+ * `apiVersion`, `entrypoints`, `assetBasePath`, `grantedPermissions`
+ * (derived / host-owned) and `icon` (needs a build-side asset copy that
+ * site plugins don't support yet).
+ */
+export const MANIFEST_AUTHOR_FIELD_SCHEMAS = {
+  name: Type.String({ minLength: 1, maxLength: 80 }),
+  description: Type.Optional(Type.String({ maxLength: 500 })),
+  author: Type.Optional(authorSchema),
+  license: Type.Optional(Type.String({ pattern: SPDX_PATTERN.source })),
+  homepage: Type.Optional(Type.String({ pattern: URL_PATTERN.source, maxLength: 500 })),
+  repository: Type.Optional(Type.String({ pattern: URL_PATTERN.source, maxLength: 500 })),
+  keywords: Type.Optional(Type.Array(Type.String({ pattern: KEYWORD_PATTERN.source }), { maxItems: 20 })),
+  permissions: Type.Array(permissionSchema, { default: [] }),
+  // Per-host allowlist for outbound HTTP. Plain hostnames (`api.example.com`)
+  // match exactly; the leading `*.` wildcard matches one subdomain segment.
+  // Hostnames are normalized (lowercased, trimmed) at manifest parse time.
+  networkAllowedHosts: Type.Optional(Type.Array(
+    Type.String({ pattern: NETWORK_HOST_PATTERN.source, maxLength: 253 }),
+    { maxItems: 50 },
+  )),
+  // Per-table allowlist for the `api.cms.content.*` surface. The host
+  // additionally enforces that each `mode` matches a granted permission
+  // at install time (`assertContentAccessCoherent` below).
+  contentAccess: Type.Optional(Type.Array(
+    Type.Object({
+      table: Type.String({ pattern: MANIFEST_SLUG_PATTERN.source, maxLength: 80 }),
+      modes: Type.Array(
+        Type.Union([
+          Type.Literal('read'),
+          Type.Literal('write'),
+          Type.Literal('publish'),
+          Type.Literal('delete'),
+        ]),
+        { minItems: 1 },
+      ),
+    }, { additionalProperties: false }),
+    { maxItems: 50 },
+  )),
+  resources: Type.Array(resourceSchema, { maxItems: 20, default: [] }),
+  adminPages: Type.Array(adminPageSchema, { maxItems: 20, default: [] }),
+  settings: Type.Optional(Type.Array(settingDefinitionSchema, { maxItems: 50 })),
+  /**
+   * Declarative frontend tag list — scripts, styles, meta, link, and shared
+   * host-runtime references the host injects into every published page on
+   * behalf of this plugin. Validated structurally here; the host's frontend
+   * injection pipeline reads the array at publish time and emits the actual
+   * tags. Requires the `frontend.assets` permission (coherence checked
+   * downstream in `parsePluginManifest`).
+   */
+  frontend: Type.Optional(Type.Object({
+    assets: Type.Array(
+      Type.Union([
+        Type.Object({
+          kind: Type.Literal('script'),
+          src: Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source }),
+          placement: Type.Optional(FrontendAssetPlacementSchema),
+          strategy: Type.Optional(Type.Union([
+            Type.Literal('defer'),
+            Type.Literal('async'),
+            Type.Literal('module'),
+            Type.Literal('sync'),
+          ])),
+          attrs: Type.Optional(FrontendAssetAttrsSchema),
+        }, { additionalProperties: false }),
+        Type.Object({
+          kind: Type.Literal('script-inline'),
+          content: Type.String({ minLength: 1, maxLength: 64 * 1024 }),
+          placement: Type.Optional(FrontendAssetPlacementSchema),
+          attrs: Type.Optional(FrontendAssetAttrsSchema),
+        }, { additionalProperties: false }),
+        Type.Object({
+          kind: Type.Literal('style'),
+          href: Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source }),
+          placement: Type.Optional(FrontendAssetPlacementSchema),
+          attrs: Type.Optional(FrontendAssetAttrsSchema),
+        }, { additionalProperties: false }),
+        Type.Object({
+          kind: Type.Literal('style-inline'),
+          content: Type.String({ minLength: 1, maxLength: 64 * 1024 }),
+          placement: Type.Optional(FrontendAssetPlacementSchema),
+          attrs: Type.Optional(FrontendAssetAttrsSchema),
+        }, { additionalProperties: false }),
+        Type.Object({
+          kind: Type.Literal('link'),
+          attrs: FrontendAssetAttrsSchema,
+          placement: Type.Optional(FrontendAssetPlacementSchema),
+        }, { additionalProperties: false }),
+        Type.Object({
+          kind: Type.Literal('meta'),
+          attrs: FrontendAssetAttrsSchema,
+          placement: Type.Optional(FrontendAssetPlacementSchema),
+        }, { additionalProperties: false }),
+      ]),
+      { maxItems: 50 },
+    ),
+  })),
+} as const
+
+export const manifestSchema = Type.Object({
+  id: Type.String({ pattern: PLUGIN_ID_PATTERN.source }),
+  name: MANIFEST_AUTHOR_FIELD_SCHEMAS.name,
+  version: Type.String({ pattern: SEMVERISH_PATTERN.source }),
+  // Schema accepts any positive integer; the parser narrows to the
+  // host-supported range via `isCompatiblePluginApiVersion`. Rejecting at
+  // a literal would force every old plugin offline the day a host bumps
+  // PLUGIN_API_VERSION, even when the host explicitly wants to keep
+  // serving older plugins via MIN_SUPPORTED_PLUGIN_API_VERSION.
+  apiVersion: Type.Integer({ minimum: 1 }),
+  description: MANIFEST_AUTHOR_FIELD_SCHEMAS.description,
+  author: MANIFEST_AUTHOR_FIELD_SCHEMAS.author,
+  license: MANIFEST_AUTHOR_FIELD_SCHEMAS.license,
+  homepage: MANIFEST_AUTHOR_FIELD_SCHEMAS.homepage,
+  repository: MANIFEST_AUTHOR_FIELD_SCHEMAS.repository,
+  keywords: MANIFEST_AUTHOR_FIELD_SCHEMAS.keywords,
+  icon: Type.Optional(Type.String({ pattern: ICON_PATH_PATTERN.source, maxLength: 80 })),
+  permissions: MANIFEST_AUTHOR_FIELD_SCHEMAS.permissions,
+  grantedPermissions: Type.Optional(Type.Array(permissionSchema)),
+  networkAllowedHosts: MANIFEST_AUTHOR_FIELD_SCHEMAS.networkAllowedHosts,
+  contentAccess: MANIFEST_AUTHOR_FIELD_SCHEMAS.contentAccess,
+  entrypoints: Type.Optional(Type.Object({
+    server: Type.Optional(Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source })),
+    editor: Type.Optional(Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source })),
+    admin: Type.Optional(Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source })),
+    modules: Type.Optional(Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source })),
+  })),
+  frontend: MANIFEST_AUTHOR_FIELD_SCHEMAS.frontend,
+  assetBasePath: Type.Optional(Type.String({ pattern: ASSET_BASE_PATH_PATTERN.source })),
+  resources: MANIFEST_AUTHOR_FIELD_SCHEMAS.resources,
+  adminPages: MANIFEST_AUTHOR_FIELD_SCHEMAS.adminPages,
+  pack: Type.Optional(Type.Object({
+    path: Type.String({ pattern: SAFE_ASSET_PATH_PATTERN.source }),
+  })),
+  settings: MANIFEST_AUTHOR_FIELD_SCHEMAS.settings,
+})
+
+
+export type ManifestRaw = Static<typeof manifestSchema>
diff --git a/src/core/site-plugins/derive.ts b/src/core/site-plugins/derive.ts
new file mode 100644
index 000000000..b0c295c50
--- /dev/null
+++ b/src/core/site-plugins/derive.ts
@@ -0,0 +1,154 @@
+/**
+ * Site plugin manifest derivation — turns the author-owned draft
+ * `plugin.json` plus the folder convention into a full runtime
+ * `PluginManifest`, validated through the REAL parser
+ * (`parsePluginManifest`) — the same contract a zip package has.
+ *
+ * Field ownership (design: docs/features/site-plugins.md):
+ *   author writes  → name, description, permissions, contentAccess,
+ *                    settings, resources, adminPages, frontend assets,
+ *                    networkAllowedHosts, marketplace metadata
+ *   build derives  → id (site.<local-id>), version (1.0.<n>+<hash>),
+ *                    apiVersion (host PLUGIN_API_VERSION), entrypoints
+ *                    (folder convention), assetBasePath (pinned shape),
+ *                    pack (pack/site.json presence), built asset paths
+ */
+import type { SiteFile } from '@core/files/schemas'
+import type { PluginManifest } from '@core/plugin-sdk'
+import { PLUGIN_API_VERSION } from '@core/plugin-sdk'
+import { parsePluginManifest } from '@core/plugins/manifest'
+import { safeParseJson } from '@core/utils/jsonValidate'
+import {
+  SITE_PLUGIN_DERIVED_FIELDS,
+  SitePluginDraftManifestSchema,
+  sitePluginFolder,
+  sitePluginIdFromLocalId,
+  type SitePluginDraftManifest,
+} from './schemas'
+
+const VERSION_PATTERN = /^1\.0\.(\d+)\+[0-9a-f]+$/
+
+/**
+ * Deterministic, order-independent fingerprint over the manifest plus every
+ * file under the site plugin folder — the `+<hash>` component of the
+ * generated version, used to skip no-op rebuilds. FNV-1a (64-bit, pure JS)
+ * rather than a crypto hash so this module stays browser-safe (the IDE
+ * computes draft-changed state client-side); the hash guards a
+ * skip-own-rebuild optimization, not a trust boundary.
+ */
+export function computeSitePluginContentHash(files: readonly SiteFile[]): string {
+  let h = 0xcbf29ce484222325n
+  const prime = 0x100000001b3n
+  const mask = 0xffffffffffffffffn
+  const update = (text: string): void => {
+    for (let i = 0; i < text.length; i++) {
+      h ^= BigInt(text.charCodeAt(i) & 0xff)
+      h = (h * prime) & mask
+      h ^= BigInt(text.charCodeAt(i) >> 8)
+      h = (h * prime) & mask
+    }
+  }
+  for (const file of [...files].sort((a, b) => a.path.localeCompare(b.path))) {
+    update(file.path)
+    update('\0')
+    update(file.content ?? '')
+    update('\0')
+  }
+  return h.toString(16).padStart(16, '0')
+}
+
+/**
+ * Monotonic generated version: `1.0.<buildCounter>+<contentHash>`. Passes
+ * the manifest's SEMVERISH_PATTERN, keeps `migrate({ fromVersion })`
+ * ordered, and carries the source fingerprint for skip-rebuild.
+ */
+export function nextSitePluginVersion(previousVersion: string | null, contentHash: string): string {
+  const previous = previousVersion ? VERSION_PATTERN.exec(previousVersion) : null
+  const counter = previous ? Number(previous[1]) + 1 : 1
+  return `1.0.${counter}+${contentHash}`
+}
+
+/** The content hash a stored generated version carries, or null. */
+export function contentHashOfVersion(version: string | null | undefined): string | null {
+  if (!version) return null
+  const match = /\+([0-9a-f]+)$/.exec(version)
+  return match?.[1] ?? null
+}
+
+export interface DeriveSitePluginManifestInput {
+  localId: string
+  draftManifestJson: string
+  /** Every 'plugin' file under plugins/<localId>/ (paths intact). */
+  files: readonly SiteFile[]
+  /** The currently active generated version, or null on first build. */
+  previousVersion: string | null
+  contentHash: string
+}
+
+function parseDraftManifest(localId: string, raw: string): SitePluginDraftManifest {
+  const result = safeParseJson(raw, SitePluginDraftManifestSchema)
+  if (!result.ok) {
+    // additionalProperties:false violations usually mean an author-set
+    // derived field — name them so a copy-pasted manifest fails helpfully.
+    throw new Error(
+      `plugin.json for "${localId}" is invalid — ${result.error.message}. ` +
+        `Note: ${SITE_PLUGIN_DERIVED_FIELDS.join(', ')} are derived by the build and must not be set.`,
+      { cause: result.error },
+    )
+  }
+  return result.value
+}
+
+export function deriveSitePluginManifest(input: DeriveSitePluginManifestInput): PluginManifest {
+  const draft = parseDraftManifest(input.localId, input.draftManifestJson)
+
+  const id = sitePluginIdFromLocalId(input.localId)
+  const version = nextSitePluginVersion(input.previousVersion, input.contentHash)
+  const folder = sitePluginFolder(input.localId)
+  const relativePaths = new Set(
+    input.files
+      .filter((f) => f.path.startsWith(folder))
+      .map((f) => f.path.slice(folder.length)),
+  )
+
+  const entrypoints: Record<string, string> = {}
+  const hasEntry = (base: string): boolean =>
+    ['ts', 'tsx', 'js', 'mjs'].some(
+      (ext) => relativePaths.has(`${base}.${ext}`) || relativePaths.has(`${base}/index.${ext}`),
+    )
+  if (hasEntry('server')) entrypoints['server'] = 'server/index.js'
+  if (hasEntry('editor')) entrypoints['editor'] = 'editor/index.js'
+  if (
+    [...relativePaths].some(
+      (p) => p.startsWith('modules/') && /\.(tsx?|m?js)$/.test(p) && !p.startsWith('modules/index.'),
+    )
+  ) {
+    entrypoints['modules'] = 'modules/index.js'
+  }
+
+  // Frontend asset declarations reference SOURCE paths; the build emits
+  // `.js` bundles for `.ts`/`.tsx`/`.mjs` sources — rewrite so the stored
+  // manifest points at what actually exists in the package.
+  const frontend = draft.frontend
+    ? {
+        assets: draft.frontend.assets.map((asset) => {
+          if (asset.kind === 'script') {
+            return { ...asset, src: asset.src.replace(/\.(tsx?|mjs)$/, '.js') }
+          }
+          return asset
+        }),
+      }
+    : undefined
+
+  // Validate through the REAL parser — the same contract a zip has.
+  return parsePluginManifest({
+    ...draft,
+    ...(frontend ? { frontend } : {}),
+    id,
+    version,
+    apiVersion: PLUGIN_API_VERSION,
+    entrypoints,
+    assetBasePath: `/uploads/plugins/${id}/${version}`,
+    ...(relativePaths.has('pack/site.json') ? { pack: { path: 'pack/site.json' } } : {}),
+  })
+}
diff --git a/src/core/site-plugins/discover.ts b/src/core/site-plugins/discover.ts
new file mode 100644
index 000000000..66e6991ca
--- /dev/null
+++ b/src/core/site-plugins/discover.ts
@@ -0,0 +1,45 @@
+/**
+ * Site plugin discovery — pure function over the draft's `SiteFile[]`.
+ * Groups `type: 'plugin'` files by the `plugins/<local-id>/` folder
+ * convention and validates local ids before anything downstream runs.
+ */
+import type { SiteFile } from '@core/files/schemas'
+import { SITE_PLUGIN_LOCAL_ID_PATTERN, SITE_PLUGIN_SOURCE_ROOT } from './schemas'
+
+export interface DiscoveredSitePlugin {
+  localId: string
+  /** All 'plugin' files under plugins/<localId>/, paths intact, sorted by path. */
+  files: SiteFile[]
+  /** The plugins/<localId>/plugin.json file, or null when missing. */
+  manifestFile: SiteFile | null
+}
+
+export function discoverSitePlugins(files: readonly SiteFile[]): DiscoveredSitePlugin[] {
+  const byLocalId = new Map<string, SiteFile[]>()
+  for (const file of files) {
+    if (file.type !== 'plugin') continue
+    if (!file.path.startsWith(SITE_PLUGIN_SOURCE_ROOT)) continue
+    const [localId] = file.path.slice(SITE_PLUGIN_SOURCE_ROOT.length).split('/')
+    if (!localId) continue
+    if (!SITE_PLUGIN_LOCAL_ID_PATTERN.test(localId)) {
+      throw new Error(
+        `Invalid site plugin local id "${localId}" — must be a single lowercase ` +
+          `kebab-case segment (a-z, 0-9, hyphens; starts with a letter).`,
+      )
+    }
+    const bucket = byLocalId.get(localId) ?? []
+    bucket.push(file)
+    byLocalId.set(localId, bucket)
+  }
+  return [...byLocalId.entries()]
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([localId, pluginFiles]) => {
+      const sorted = [...pluginFiles].sort((a, b) => a.path.localeCompare(b.path))
+      return {
+        localId,
+        files: sorted,
+        manifestFile:
+          sorted.find((f) => f.path === `${SITE_PLUGIN_SOURCE_ROOT}${localId}/plugin.json`) ?? null,
+      }
+    })
+}
diff --git a/src/core/site-plugins/index.ts b/src/core/site-plugins/index.ts
new file mode 100644
index 000000000..dc29df870
--- /dev/null
+++ b/src/core/site-plugins/index.ts
@@ -0,0 +1,49 @@
+/**
+ * @core/site-plugins — source model for developer-authored site plugins.
+ *
+ * Discovery over draft `SiteFile[]`, author-manifest validation + runtime
+ * manifest derivation, content hashing, scaffold templates, and the
+ * runtime-state machine shared by the server list endpoint and the admin
+ * UI. Feature doc: docs/features/site-plugins.md.
+ */
+export {
+  SITE_PLUGIN_DERIVED_FIELDS,
+  SITE_PLUGIN_LOCAL_ID_PATTERN,
+  SITE_PLUGIN_SOURCE_ROOT,
+  SitePluginDraftManifestSchema,
+  localIdFromSitePluginId,
+  sitePluginFolder,
+  sitePluginIdFromLocalId,
+  type SitePluginDraftManifest,
+} from './schemas'
+export { discoverSitePlugins, type DiscoveredSitePlugin } from './discover'
+export {
+  computeSitePluginContentHash,
+  contentHashOfVersion,
+  deriveSitePluginManifest,
+  nextSitePluginVersion,
+  type DeriveSitePluginManifestInput,
+} from './derive'
+export {
+  SITE_PLUGIN_TEMPLATE_IDS,
+  SITE_PLUGIN_TEMPLATES,
+  sitePluginTemplateFiles,
+  type SitePluginTemplateFile,
+  type SitePluginTemplateId,
+  type SitePluginTemplateInfo,
+} from './templates'
+export {
+  SITE_PLUGIN_RUNTIME_STATES,
+  SitePluginRuntimeStateSchema,
+  SitePluginSummarySchema,
+  SitePluginsPayloadSchema,
+  computeSitePluginState,
+  sitePluginPrimaryAction,
+  sitePluginStateLabel,
+  type SitePluginPrimaryAction,
+  type SitePluginPrimaryActionKind,
+  type SitePluginRuntimeState,
+  type SitePluginStateInput,
+  type SitePluginSummary,
+  type SitePluginsPayload,
+} from './state'
diff --git a/src/core/site-plugins/schemas.ts b/src/core/site-plugins/schemas.ts
new file mode 100644
index 000000000..9e1c4b7da
--- /dev/null
+++ b/src/core/site-plugins/schemas.ts
@@ -0,0 +1,72 @@
+/**
+ * Site plugin source model — schemas and constants.
+ *
+ * Site plugins are authored in the site draft under `plugins/<local-id>/`
+ * as `SiteFile` entries with `type: 'plugin'`, and compiled server-side
+ * into packages byte-compatible with installed plugins (runtime id
+ * `site.<local-id>`). Design: docs/features/site-plugins.md.
+ */
+import { Type, type Static } from '@core/utils/typeboxHelpers'
+import { MANIFEST_AUTHOR_FIELD_SCHEMAS, SITE_PLUGIN_ID_PREFIX } from '@core/plugins/manifest'
+
+export const SITE_PLUGIN_SOURCE_ROOT = 'plugins/'
+
+/**
+ * `<local-id>` is a single lowercase kebab-case segment (no dots), so the
+ * runtime id `site.<local-id>` is always well-formed and unambiguous.
+ */
+export const SITE_PLUGIN_LOCAL_ID_PATTERN = /^[a-z][a-z0-9-]*$/
+
+export function sitePluginIdFromLocalId(localId: string): string {
+  return `${SITE_PLUGIN_ID_PREFIX}${localId}`
+}
+
+/** Strip the `site.` prefix; null when the id is not a site plugin id. */
+export function localIdFromSitePluginId(pluginId: string): string | null {
+  if (!pluginId.startsWith(SITE_PLUGIN_ID_PREFIX)) return null
+  const localId = pluginId.slice(SITE_PLUGIN_ID_PREFIX.length)
+  return SITE_PLUGIN_LOCAL_ID_PATTERN.test(localId) ? localId : null
+}
+
+export function sitePluginFolder(localId: string): string {
+  return `${SITE_PLUGIN_SOURCE_ROOT}${localId}/`
+}
+
+/**
+ * Author-owned subset of the plugin manifest (design: "plugin.json —
+ * author-owned fields only"). Everything else — `id`, `version`,
+ * `apiVersion`, `entrypoints`, `assetBasePath`, `pack` — is derived by the
+ * build from the folder convention and REJECTED here if hand-set
+ * (`additionalProperties: false`), so a manifest copy-pasted from an
+ * installed plugin fails loudly instead of drifting.
+ *
+ * Field shapes reuse the runtime manifest's own sub-schemas
+ * (`MANIFEST_AUTHOR_FIELD_SCHEMAS` in `@core/plugins/manifest`) — one
+ * source of truth, no duplicated shapes.
+ */
+export const SitePluginDraftManifestSchema = Type.Object(
+  {
+    ...MANIFEST_AUTHOR_FIELD_SCHEMAS,
+    // The runtime schema gives these `default` values and relies on the
+    // Value.Parse pipeline to apply them; the draft is validated with the
+    // compiled Check (no Default pass), so they must be genuinely optional
+    // here — `parsePluginManifest` applies the defaults downstream.
+    permissions: Type.Optional(MANIFEST_AUTHOR_FIELD_SCHEMAS.permissions),
+    resources: Type.Optional(MANIFEST_AUTHOR_FIELD_SCHEMAS.resources),
+    adminPages: Type.Optional(MANIFEST_AUTHOR_FIELD_SCHEMAS.adminPages),
+  },
+  { additionalProperties: false },
+)
+export type SitePluginDraftManifest = Static<typeof SitePluginDraftManifestSchema>
+
+/** The manifest fields the build derives — named for error messages. */
+export const SITE_PLUGIN_DERIVED_FIELDS = [
+  'id',
+  'version',
+  'apiVersion',
+  'entrypoints',
+  'assetBasePath',
+  'pack',
+  'grantedPermissions',
+  'icon',
+] as const
diff --git a/src/core/site-plugins/state.ts b/src/core/site-plugins/state.ts
new file mode 100644
index 000000000..c6f4c617a
--- /dev/null
+++ b/src/core/site-plugins/state.ts
@@ -0,0 +1,145 @@
+/**
+ * Site plugin runtime-state machine — ONE vocabulary shared by the server
+ * list endpoint (which computes states) and the admin UI (which renders the
+ * state chip + smart primary action). Design: docs/features/site-plugins.md
+ * → "Runtime states" / "One smart primary action".
+ */
+import { Type, type Static } from '@core/utils/typeboxHelpers'
+
+export const SITE_PLUGIN_RUNTIME_STATES = [
+  'active',
+  'draft-changed',
+  'build-failed',
+  'permission-review',
+  'runtime-error',
+  'disabled',
+  'source-missing',
+] as const
+
+export type SitePluginRuntimeState = (typeof SITE_PLUGIN_RUNTIME_STATES)[number]
+
+export const SitePluginRuntimeStateSchema = Type.Union(
+  SITE_PLUGIN_RUNTIME_STATES.map((state) => Type.Literal(state)),
+)
+
+/** Wire shape of one site plugin in the list payload. */
+export const SitePluginSummarySchema = Type.Object({
+  localId: Type.String(),
+  /** Runtime plugin id (site.<localId>). */
+  pluginId: Type.String(),
+  name: Type.String(),
+  state: SitePluginRuntimeStateSchema,
+  /** Active generated version (1.0.<n>+<hash>), or null before first build. */
+  activeVersion: Type.Union([Type.String(), Type.Null()]),
+  /** False when the runtime row survives a deleted plugins/<id>/ folder. */
+  hasDraftSource: Type.Boolean(),
+  /** Draft declares a module pack — enables `Preview in canvas`. */
+  hasModules: Type.Boolean(),
+  declaredPermissions: Type.Array(Type.String()),
+  grantedPermissions: Type.Array(Type.String()),
+  /** Grant diff — non-empty means activation shows the permission review. */
+  newPermissions: Type.Array(Type.String()),
+  removedPermissions: Type.Array(Type.String()),
+  /** Draft plugin.json derivation error, or null when it parses. */
+  manifestError: Type.Union([Type.String(), Type.Null()]),
+  /** Runtime lifecycle error from the active revision, or null. */
+  lastError: Type.Union([Type.String(), Type.Null()]),
+})
+export type SitePluginSummary = Static<typeof SitePluginSummarySchema>
+
+export const SitePluginsPayloadSchema = Type.Object({
+  sitePlugins: Type.Array(SitePluginSummarySchema),
+})
+export type SitePluginsPayload = Static<typeof SitePluginsPayloadSchema>
+
+export interface SitePluginStateInput {
+  hasDraftSource: boolean
+  /** Null when no installed_plugins row exists yet. */
+  row: {
+    version: string
+    lifecycleStatus: 'installed' | 'active' | 'disabled' | 'error'
+    enabled: boolean
+  } | null
+  /** Draft plugin.json failed derivation (cheap manifest-only check). */
+  manifestError: string | null
+  /** Content hash of the current draft source. */
+  draftContentHash: string | null
+  /** Hash carried by the active row's version (`+<hash>`), or null. */
+  activeContentHash: string | null
+  /** Grant diff between the derived draft manifest and the row. */
+  grantsChanged: boolean
+}
+
+/**
+ * Compute the runtime state — the exact precedence the design's states
+ * table implies: missing source beats everything (an invisible-but-running
+ * backend must surface), then runtime errors, then disabled, then draft
+ * problems, then the hash comparison.
+ */
+export function computeSitePluginState(input: SitePluginStateInput): SitePluginRuntimeState {
+  if (!input.hasDraftSource) return 'source-missing'
+  if (input.row?.lifecycleStatus === 'error') return 'runtime-error'
+  if (input.row && (!input.row.enabled || input.row.lifecycleStatus === 'disabled')) {
+    return 'disabled'
+  }
+  if (input.manifestError) return 'build-failed'
+  if (input.grantsChanged) return 'permission-review'
+  if (!input.row) return 'draft-changed' // never built — the first Build & activate
+  if (input.draftContentHash !== input.activeContentHash) return 'draft-changed'
+  return 'active'
+}
+
+export type SitePluginPrimaryActionKind =
+  | 'activate'
+  | 'review'
+  | 'diagnostics'
+  | 'logs'
+  | 'delete'
+  | 'enable'
+  | null
+
+export interface SitePluginPrimaryAction {
+  label: string
+  action: SitePluginPrimaryActionKind
+}
+
+/** One state-appropriate primary action — shared by the Plugins-page card
+ *  and the IDE header so the two surfaces can never drift. */
+export function sitePluginPrimaryAction(state: SitePluginRuntimeState): SitePluginPrimaryAction {
+  switch (state) {
+    case 'draft-changed':
+      return { label: 'Build & activate', action: 'activate' }
+    case 'permission-review':
+      return { label: 'Review permissions', action: 'review' }
+    case 'build-failed':
+      return { label: 'View diagnostics', action: 'diagnostics' }
+    case 'runtime-error':
+      return { label: 'View logs', action: 'logs' }
+    case 'source-missing':
+      return { label: 'Delete site plugin', action: 'delete' }
+    case 'disabled':
+      return { label: 'Activate', action: 'enable' }
+    case 'active':
+      return { label: '', action: null }
+  }
+}
+
+/** Human label for the state chip. */
+export function sitePluginStateLabel(state: SitePluginRuntimeState): string {
+  switch (state) {
+    case 'active':
+      return 'Active'
+    case 'draft-changed':
+      return 'Draft changed'
+    case 'build-failed':
+      return 'Build failed'
+    case 'permission-review':
+      return 'Permission review needed'
+    case 'runtime-error':
+      return 'Runtime error'
+    case 'disabled':
+      return 'Disabled'
+    case 'source-missing':
+      return 'Source missing'
+  }
+}
diff --git a/src/core/site-plugins/templates.ts b/src/core/site-plugins/templates.ts
new file mode 100644
index 000000000..a258a2fec
--- /dev/null
+++ b/src/core/site-plugins/templates.ts
@@ -0,0 +1,144 @@
+/**
+ * Scaffold templates for `New site plugin` — pure data, mirroring the CLI's
+ * `instatic-plugin init --kind` shapes. Each template generates the minimal
+ * WORKING shape for its kind and pre-declares the matching permissions
+ * (declared, not granted — consent still happens at activation). Every
+ * template must pass validate-only builds out of the box.
+ */
+import { sitePluginFolder } from './schemas'
+
+export const SITE_PLUGIN_TEMPLATE_IDS = ['module', 'routes', 'editor', 'empty'] as const
+export type SitePluginTemplateId = (typeof SITE_PLUGIN_TEMPLATE_IDS)[number]
+
+export interface SitePluginTemplateInfo {
+  id: SitePluginTemplateId
+  label: string
+  description: string
+}
+
+export const SITE_PLUGIN_TEMPLATES: readonly SitePluginTemplateInfo[] = [
+  {
+    id: 'module',
+    label: 'Canvas module',
+    description: 'A drag-and-drop canvas block with controls — preview it in the editor without activating.',
+  },
+  {
+    id: 'routes',
+    label: 'Backend routes',
+    description: 'Server code in the sandbox exposing HTTP routes under the plugin runtime path.',
+  },
+  {
+    id: 'editor',
+    label: 'Editor extension',
+    description: 'Commands and toolbar buttons inside the admin editor (runs unsandboxed — consent required).',
+  },
+  {
+    id: 'empty',
+    label: 'Empty',
+    description: 'Just a plugin.json — add folders as you go.',
+  },
+]
+
+export interface SitePluginTemplateFile {
+  path: string
+  content: string
+}
+
+function manifestJson(name: string, permissions: string[]): string {
+  return `${JSON.stringify({ name, description: '', permissions }, null, 2)}\n`
+}
+
+export function sitePluginTemplateFiles(
+  template: SitePluginTemplateId,
+  localId: string,
+  name: string,
+): SitePluginTemplateFile[] {
+  const folder = sitePluginFolder(localId)
+  switch (template) {
+    case 'module':
+      return [
+        { path: `${folder}plugin.json`, content: manifestJson(name, ['modules.register']) },
+        {
+          path: `${folder}modules/${localId}.ts`,
+          content: [
+            `import { control, defineModule, html } from '@instatic/plugin-sdk'`,
+            ``,
+            `export default defineModule({`,
+            `  id: 'site.${localId}.${localId}',`,
+            `  name: '${name}',`,
+            `  description: 'Canvas module from the ${name} site plugin.',`,
+            `  category: '${name}',`,
+            `  htmlTag: 'div',`,
+            `  defaults: {`,
+            `    message: 'Hello from ${name}.',`,
+            `  },`,
+            `  schema: {`,
+            `    message: control.text('Message'),`,
+            `  },`,
+            `  render: ({ props }) => ({`,
+            `    html: html\`<div class="${localId}">\${props.message}</div>\`,`,
+            `    css: \`.${localId} { padding: 12px; border: 1px dashed currentColor; border-radius: 6px; }\`,`,
+            `  }),`,
+            `})`,
+            ``,
+          ].join('\n'),
+        },
+      ]
+    case 'routes':
+      return [
+        { path: `${folder}plugin.json`, content: manifestJson(name, ['cms.routes']) },
+        {
+          path: `${folder}server/index.ts`,
+          content: [
+            `/**`,
+            ` * Server entrypoint for ${name} — runs inside the QuickJS sandbox.`,
+            ` * Routes register under:`,
+            ` *   /admin/api/cms/plugins/site.${localId}/runtime/<path>`,
+            ` * Call them from browser code via sitePluginRoute('${localId}', '<path>').`,
+            ` */`,
+            `import type { ServerPluginModule } from '@instatic/plugin-sdk'`,
+            ``,
+            `const mod: ServerPluginModule = {`,
+            `  activate(api) {`,
+            `    // Authenticated GET — third argument is the required capability.`,
+            `    api.cms.routes.get('/status', 'plugins.read', () => ({`,
+            `      ok: true,`,
+            `      plugin: api.plugin.id,`,
+            `      version: api.plugin.version,`,
+            `    }))`,
+            `  },`,
+            `}`,
+            ``,
+            `export default mod`,
+            ``,
+          ].join('\n'),
+        },
+      ]
+    case 'editor':
+      return [
+        {
+          path: `${folder}plugin.json`,
+          content: manifestJson(name, ['editor.code', 'editor.commands']),
+        },
+        {
+          path: `${folder}editor/index.ts`,
+          content: [
+            `/**`,
+            ` * Editor entrypoint for ${name} — runs unsandboxed in the admin`,
+            ` * window (gated by the editor.code permission at activation).`,
+            ` */`,
+            `export function activate(api: { editor: { commands: { register(command: { id: string; label: string; run(): unknown }): void } } }) {`,
+            `  api.editor.commands.register({`,
+            `    id: 'site.${localId}.hello',`,
+            `    label: 'Hello from ${name}',`,
+            `    run: () => ({ message: 'Hello from ${name}!' }),`,
+            `  })`,
+            `}`,
+            ``,
+          ].join('\n'),
+        },
+      ]
+    case 'empty':
+      return [{ path: `${folder}plugin.json`, content: manifestJson(name, []) }]
+  }
+}

From 21c97bf61e05a9468d6027ed06df964f93e0b643 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 15:05:06 +0200
Subject: [PATCH 04/36] feat(plugins): full-screen Plugin IDE with live
 multi-author co-editing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Collab core — granular shell files:
- The shell's files key becomes a per-file Y.Map (entry per file id,
  content as Y.Text): different files never collide, one file's content
  merges character-level, and deleting a file can't clobber a neighbour's
  concurrent edit. Patch translation handles membership via pre/post
  id-set diffs, skips pure index shifts by object identity, and splices
  content minimally; projection returns the ordered array (legacy LWW
  array layouts still project and upgrade on first write).

The IDE (/admin/plugins/develop/:localId):
- Renders in the shared workspace canvas shell: resizable file tree
  (Tree primitives + context menu; inline new/rename), co-edited
  CodeMirror buffer via a new CollabCodeMirrorEditor lazy sibling
  (y-codemirror.next: live splices, per-peer colored carets/selections,
  local-only per-file undo), diagnostics strip fed by debounced automatic
  validation, and the structured manifest panel (permissions checklist
  with the editor.code danger note, network hosts, derived fields
  read-only) writing plugin.json as minimal Y.Text splices.
- Its own collab session binds ONLY site:default over the site socket —
  server-seeded, no editor store, presence published in the shared
  awareness (site editors see IDE peers in their roster; IDE rows show
  who's editing which file).
- Toolbar: state chip + ONE smart primary action + Preview in canvas for
  module drafts + overflow (rollback/deactivate/restart/diagnostics/
  settings/delete); disabled-with-reason, never hidden.

Plugins page: Site plugins group (state chips, Open IDE) + New site
plugin dialog (live kebab-case id, template picker). Scripts section
relabeled 'Frontend scripts' with placement guidance; 'plugin' files stay
out of the site editor entirely.

Gates: workspace/circular/codemirror/bundle-size/token gates updated in
the same change per repo rules.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 bun.lock                                      |  65 ++--
 package.json                                  |   1 +
 .../architecture/bundle-size-budgets.test.ts  |  18 +-
 .../architecture/codemirror-lazy-only.test.ts |  33 +-
 src/__tests__/collab/filesGranular.test.ts    | 180 +++++++++
 src/admin/AuthenticatedAdmin.tsx              |   8 +
 src/admin/access.ts                           |   5 +
 .../AdminWorkspaceCanvasLayout.tsx            |   5 +-
 .../pages/plugins/PluginsPage.module.css      |   7 +
 src/admin/pages/plugins/PluginsPage.tsx       |   6 +
 .../components/NewSitePluginDialog.module.css |  59 +++
 .../components/NewSitePluginDialog.tsx        | 175 +++++++++
 .../components/SitePluginsSection.module.css  | 113 ++++++
 .../plugins/components/SitePluginsSection.tsx | 135 +++++++
 .../plugins/ide/DiagnosticsStrip.module.css   |  73 ++++
 .../pages/plugins/ide/DiagnosticsStrip.tsx    |  42 +++
 .../pages/plugins/ide/FileTreePane.module.css |  61 +++
 src/admin/pages/plugins/ide/FileTreePane.tsx  | 352 ++++++++++++++++++
 .../pages/plugins/ide/IdeActions.module.css   |  44 +++
 src/admin/pages/plugins/ide/IdeActions.tsx    | 230 ++++++++++++
 src/admin/pages/plugins/ide/IdeFileEditor.tsx |  45 +++
 src/admin/pages/plugins/ide/IdeSidebar.tsx    |  43 +++
 .../pages/plugins/ide/ManifestPane.module.css | 176 +++++++++
 src/admin/pages/plugins/ide/ManifestPane.tsx  | 288 ++++++++++++++
 .../plugins/ide/SitePluginIdePage.module.css  |  51 +++
 .../pages/plugins/ide/SitePluginIdePage.tsx   | 222 +++++++++++
 src/admin/pages/plugins/ide/ideCollab.ts      | 224 +++++++++++
 src/admin/pages/plugins/ide/ideLanguage.ts    |  15 +
 src/admin/pages/plugins/ide/idePresence.ts    | 118 ++++++
 .../pages/plugins/ide/useSitePluginIde.ts     | 307 +++++++++++++++
 .../site/code-editor/CodeMirrorEditor.tsx     |   9 +
 .../code-editor/CollabCodeMirrorEditor.tsx    | 116 ++++++
 .../code-editor/ScriptSettingsPane.module.css |  13 +
 .../site/code-editor/ScriptSettingsPane.tsx   |   5 +
 .../SiteExplorerPanelSections.tsx             |   2 +-
 .../SiteExplorerPathConfirmDialog.tsx         |   2 +-
 src/admin/router.tsx                          |   7 +
 src/admin/state/workspaceLayoutStorage.ts     |   2 +-
 src/admin/workspace.ts                        |   7 +
 src/core/collab/applyPatches.ts               | 117 +++++-
 src/core/collab/filesY.ts                     |  72 ++++
 src/core/collab/index.ts                      |   5 +
 src/core/collab/project.ts                    |   8 +
 src/core/collab/seed.ts                       |   8 +
 44 files changed, 3417 insertions(+), 57 deletions(-)
 create mode 100644 src/__tests__/collab/filesGranular.test.ts
 create mode 100644 src/admin/pages/plugins/components/NewSitePluginDialog.module.css
 create mode 100644 src/admin/pages/plugins/components/NewSitePluginDialog.tsx
 create mode 100644 src/admin/pages/plugins/components/SitePluginsSection.module.css
 create mode 100644 src/admin/pages/plugins/components/SitePluginsSection.tsx
 create mode 100644 src/admin/pages/plugins/ide/DiagnosticsStrip.module.css
 create mode 100644 src/admin/pages/plugins/ide/DiagnosticsStrip.tsx
 create mode 100644 src/admin/pages/plugins/ide/FileTreePane.module.css
 create mode 100644 src/admin/pages/plugins/ide/FileTreePane.tsx
 create mode 100644 src/admin/pages/plugins/ide/IdeActions.module.css
 create mode 100644 src/admin/pages/plugins/ide/IdeActions.tsx
 create mode 100644 src/admin/pages/plugins/ide/IdeFileEditor.tsx
 create mode 100644 src/admin/pages/plugins/ide/IdeSidebar.tsx
 create mode 100644 src/admin/pages/plugins/ide/ManifestPane.module.css
 create mode 100644 src/admin/pages/plugins/ide/ManifestPane.tsx
 create mode 100644 src/admin/pages/plugins/ide/SitePluginIdePage.module.css
 create mode 100644 src/admin/pages/plugins/ide/SitePluginIdePage.tsx
 create mode 100644 src/admin/pages/plugins/ide/ideCollab.ts
 create mode 100644 src/admin/pages/plugins/ide/ideLanguage.ts
 create mode 100644 src/admin/pages/plugins/ide/idePresence.ts
 create mode 100644 src/admin/pages/plugins/ide/useSitePluginIde.ts
 create mode 100644 src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx
 create mode 100644 src/core/collab/filesY.ts

diff --git a/bun.lock b/bun.lock
index 5be0bc1ca..9820faad5 100644
--- a/bun.lock
+++ b/bun.lock
@@ -54,6 +54,7 @@
         "semver": "^7.7.4",
         "sharp": "^0.35.0",
         "uqr": "^0.1.3",
+        "y-codemirror.next": "^0.3.5",
         "y-protocols": "^1.0.7",
         "yjs": "^13.6.31",
         "zustand": "^5.0.12",
@@ -190,7 +191,7 @@
 
     "@csstools/css-parser-algorithms": ["@csstools/css-parser-algorithms@4.0.0", "", { "peerDependencies": { "@csstools/css-tokenizer": "^4.0.0" } }, "sha512-+B87qS7fIG3L5h3qwJ/IFbjoVoOe/bpOdh9hAjXbvx0o8ImEmUsGXN0inFOnk2ChCFgqkkGFQ+TpM5rbhkKe4w=="],
 
-    "@csstools/css-syntax-patches-for-csstree": ["@csstools/css-syntax-patches-for-csstree@1.1.10", "", { "peerDependencies": { "css-tree": "^3.2.1" }, "optionalPeers": ["css-tree"] }, "sha512-xBja6gaAaH2R2c7eNyl0TY4dhnnZ2uhj+KXpLdEQ6M/wuk9bYFZM8wY0ykw3VO4TgEJ56KGlerXS/9KBKVR/Cg=="],
+    "@csstools/css-syntax-patches-for-csstree": ["@csstools/css-syntax-patches-for-csstree@1.1.12", "", { "peerDependencies": { "css-tree": "^3.2.1" }, "optionalPeers": ["css-tree"] }, "sha512-3vLQK+dXxhBMR2Wx99PTCifE+vHtW2ndZWyla8yK813ev6oGhyn8Lja8jCyGAWTJ+LEYZK7EVtJxrDj8ztevJw=="],
 
     "@csstools/css-tokenizer": ["@csstools/css-tokenizer@4.0.0", "", {}, "sha512-QxULHAm7cNu72w97JUNCBFODFaXpbDg+dP8b/oWFAZ2MTRppA3U00Y2L1HqaS4J6yBqxwa/Y3nMBaxVKbB/NsA=="],
 
@@ -302,57 +303,57 @@
 
     "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="],
 
-    "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.2" }, "os": "darwin", "cpu": "arm64" }, "sha512-RMnFX7YQsMoh7lWfcM4NEHHymBX/rLuKNPVM84XE9ONPcaSCDgE7CHIHpSgPcO2xcRthgBy1HfNO319mwhIAkg=="],
+    "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.3" }, "os": "darwin", "cpu": "arm64" }, "sha512-Uhfl4V4lhP2nbUVF9+hyH1+luj86f1gUFeo8ALYxFoULoU+G87D43BfeMP8XHsk9boxAnCY/bf2EHwhA7MuGsA=="],
 
-    "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.2" }, "os": "darwin", "cpu": "x64" }, "sha512-Xo+5uFBtLN0BKqieTxiFzFPQAUlBbbH5iBKyRX/z1JrbnYsHTfKJnUfL8+p2TPXr1pXqao4eeL4Rl144uDpK9w=="],
+    "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.3" }, "os": "darwin", "cpu": "x64" }, "sha512-hWniXY3bG5qKpkKrAwPe4y+VTPmf086YQAnkxWh7uA1YrlRouWGa0M0Mxj3ZjnXFkv7/TD1bTy9lGUK26vRvWw=="],
 
-    "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.3", "", { "dependencies": { "@img/sharp-wasm32": "0.35.3" }, "os": "freebsd" }, "sha512-lUxcqWIj2wMQ9BrwNjngcr1gWUr5xgaGThBRqPPalIC2n67Cqj1uPh8NnA/ZhAg8hUbKl+kVHKwgUIwe6ZYPrg=="],
+    "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.4", "", { "dependencies": { "@img/sharp-wasm32": "0.35.4" }, "os": "freebsd" }, "sha512-lIsKw/BU+kjB4eZjxrYrZmwOJYi3Ajrv66iAlBmUPyKc3HpnloevB1g3wxGD9P/5BbQ1brBGl65VRRrCvQDEqA=="],
 
-    "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-9J6ypZFpQBj4YnePGoq/S38w6nz+vqg5WZLrLGY4YuSemdMq47GMLBPO42MzwdGwpg/agZ7xzZcFHa48xlywfg=="],
+    "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-suTBPTDGrI9WodccaDdwZItTSaBYASlBk1NSfElSHrUfzu3szG6lvIF58+WiFvnfzuK8ZBFS5zE00PxqxnRiPg=="],
 
-    "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-m2pW1n6cns9VaubNwsZ+c3CRYjxNQWgJ5gPlnL1nbBcpkBvFm6SCFN5o0psFHI8w9n11NKhFkeEDns98tiqbEw=="],
+    "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-FVJZ5mITMobmXIz/hPDTw0EintTW5H3WfrxwLqEqjiIihlu+hVRyGrFQ60xl0Lxn7Bt3zdpevPaQi0HEzqz9fw=="],
 
-    "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.2", "", { "os": "linux", "cpu": "arm" }, "sha512-1eMLzy92I4J6rmi4mAT8yC3HxOtniyGELlzGbNMLLeqe052ahFQ0h6LFq+lh5DsDIdYViIDst08abvSbcEdLXQ=="],
+    "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.3", "", { "os": "linux", "cpu": "arm" }, "sha512-3rbU4vqXXc3hY/OiXdl52xZvT0F1yEngWfvqudtPJg/KkyiaQw2DRsFrNzpmLvfavbwOq3qXn36GP8obHRULQA=="],
 
-    "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-dqVSFynCox4C/J8kT16V7SIFAns0IjgLwkvYT7p8LQVmJ5OS5b6tI9IGflxTeuBS//zXeFIUbwt5dwxyZ17cnA=="],
+    "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A=="],
 
-    "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-3z0NHDxD6n5I9gc05U1eW1AyRm+Gznzq3naMrthPNqE6oYykcogW0l/jfpJdjYnuNl8R7yI9pNbE1XiUeyq0Aw=="],
+    "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.3", "", { "os": "linux", "cpu": "ppc64" }, "sha512-cdn1OvUBwsXhbC0zSzJnNzf5MZ/mTrobawDvNXBTxe8VtqKAm0sRuEY2Evzovb/w9JMk4TvRxqt1mekSuJz64w=="],
 
-    "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.2", "", { "os": "linux", "cpu": "none" }, "sha512-bsb4rI+NldGOsXuej2r8OdSS8+zXDVaCWxyWrcv6kneTOlgAHtZABRzBBCwdsPiD90J4myNJuHpg6kA20ImW/w=="],
+    "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.3", "", { "os": "linux", "cpu": "none" }, "sha512-HjPVx7yKz+0lqdhDlTw1tt90wamBoxhiXpvl1XZpJLiHH4RCJ5yDTqH+VlYPv2fwFs89JFw4c1IexYOcQUi4IQ=="],
 
-    "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-/ABshyj8gCpyIrNXnHn4LorDJ0HHm1VhXPBlxZ8zAtfVPAaSafXPGn+sUSIRiwaSBy0mmFjSjiXI5mkcwdChKQ=="],
+    "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.3", "", { "os": "linux", "cpu": "s390x" }, "sha512-neWLh+3yCNThxnfy3c4BbVBeGgt9aftno+XbT56iK28RgeDs3UOFWviLWlUu0bArYVYJaFDK+RRohbicUNCm8Q=="],
 
-    "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.2", "", { "os": "linux", "cpu": "x64" }, "sha512-ITPEtgffGJ0S6G9dRyw/366tJQqFRcHWPHhC+Stpg3Z8AEMrDrTr2lhdz4f/Y/HMbRh//7Z5mBzEpVdi62Oc3w=="],
+    "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA=="],
 
-    "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-zE9EdiUzUmg5mDT5a1rk5fYJ6GWPloTwWBYDS14naqHsL+EaMpDj1AWnpLgh3u0YCORv2Tt50wrcrpYqkP97Kw=="],
+    "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-Y9kQaLMuNoB0bPYOOdcZMaseNrFpPodIWWMrx+CZyydf2xn68j9WYc6sWWRrDwNkzCQjKYfc68L7jKjGlHMibw=="],
 
-    "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.2", "", { "os": "linux", "cpu": "x64" }, "sha512-m0lrLiUt+lBYnCFr8qV/65yMR4E/c7/wf78I5eKTdkEakFAlZ9QlzEM3QIhhAwVeUhLAHLcCq7a7Vszq/oFNZQ=="],
+    "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-fj8Mv0HHfD1Rr+4I68+3agJynxDWtBFgicTbSOb9Bke6pIwzGcJ+RX/yHjmiEGFMCavY/dxvem7MyNaJF+wDiw=="],
 
-    "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.2" }, "os": "linux", "cpu": "arm" }, "sha512-affVWCTLooy8TSxbDx2qkzuDeaWLNVBA+P//FNBirHsXpP2fuBhk5AuboYUnrDnzoXes8GFjpTx0SBFOCRg+FA=="],
+    "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.3" }, "os": "linux", "cpu": "arm" }, "sha512-7OAS8gI0EReKGVN2HssHlM6umJgxF5VI3xN0p9FA91p/YO+ou5hiNghLdZ5BEHztwaaK5+bLKRf8x/o2L2nk9A=="],
 
-    "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.2" }, "os": "linux", "cpu": "arm64" }, "sha512-QgKDspHPnrU+GQ55XPhGwyhC8acLVOOSyAvo1oVfFmrIXLkDNmGWzAfDZ4xK8oSA1qBQrALcHX0G5UZni/SuFQ=="],
+    "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.3" }, "os": "linux", "cpu": "arm64" }, "sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ=="],
 
-    "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.2" }, "os": "linux", "cpu": "ppc64" }, "sha512-sMd8rDxmpLOwv/7N44klFjOD5DUO7FLdjiXDI0hoxYaf7Ar262dQIEkosE98bps+5HPLtp/EvNqeqQtOycP/IA=="],
+    "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.3" }, "os": "linux", "cpu": "ppc64" }, "sha512-2oYZJeIl4kCcMGk4ouZVjnkCtFrpQFlNEtJ6GbxzhHQchwH0NH/qEb9ykmOl29dqwMq+JhFdZn+1ak2FKhI9fQ=="],
 
-    "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.2" }, "os": "linux", "cpu": "none" }, "sha512-0Eob78yjlYPfL5vMNWAW55l3R9Y6BQS/gOfe0ZcP9mEz9ohhKSt4im1hayiknXgf8AWrFqMvJcKIdmLmEe7yeQ=="],
+    "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.3" }, "os": "linux", "cpu": "none" }, "sha512-cPbNChoRURAWdebDIHSenxRpgEdy7JkPydSnUxRm9VvKD7m0/xVaR/8Fzlu81pk5nHEvHH87UZUA7cTtwnbJSA=="],
 
-    "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.2" }, "os": "linux", "cpu": "s390x" }, "sha512-KgAxQ0DxpNOq1rG2t5cgTgShJFGSuU7XO45cqC+1NVOuZnP6tlgZRuSYOfNupGkHID0o3cJOsw4DVeJpMovcGw=="],
+    "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.3" }, "os": "linux", "cpu": "s390x" }, "sha512-RY0JFY8Fd6RonCBtHz+DvadaPkXDSI1AUn6yWL9TipqkZ1vY8w8evqdgyDFnkm4/K1ve1TvZiaePP5oSd4+WVQ=="],
 
-    "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.2" }, "os": "linux", "cpu": "x64" }, "sha512-8pqvxubL2PGdhlPy6GLqzDYMUjyRmKAwKHYKixpdJYBUK7PJ0C029XdsnpFIdgRZG68fZiGdHVWcKPvtiPB4cA=="],
+    "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.3" }, "os": "linux", "cpu": "x64" }, "sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA=="],
 
-    "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.2" }, "os": "linux", "cpu": "arm64" }, "sha512-Vz0iQjzzcSX3HCbfwFfCSG/9SCIqyO0mH2sXyiHaAYfBk0cRsCWXRyQYX0ovCK/PAQBbTzQ0dsPQHh5MAFL59w=="],
+    "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.3" }, "os": "linux", "cpu": "arm64" }, "sha512-KB5jxpfWQTr0nc3xdHtWChdbifHrBGsd2SM62Eyxrl8afikm+f5qGBU75SJIZBT/S1MC8XyacdlXBMSWq6OURA=="],
 
-    "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.2" }, "os": "linux", "cpu": "x64" }, "sha512-6O1NPKcDVj9QEdg7Hx549EX8U0rp6yXQERqru6yRN7fGBn32UvIRJUlWnk+8xDCiG76hXVBbX82NZ/ZKr0euIg=="],
+    "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.3" }, "os": "linux", "cpu": "x64" }, "sha512-f+eZJZIQNEEd26RPSW+76chwOf1XtA2Y/O+5ocVyLliHkeih3e+jhLVBdNTd2rS3IbNXK8+ug93Vf5ZXtF5Lxg=="],
 
-    "@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.3", "", { "dependencies": { "@emnapi/runtime": "^1.11.1" } }, "sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w=="],
+    "@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.4", "", { "dependencies": { "@emnapi/runtime": "^1.11.3" } }, "sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA=="],
 
-    "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.3", "", { "dependencies": { "@img/sharp-wasm32": "0.35.3" }, "cpu": "none" }, "sha512-2rnq7bX3NzeR2T4YWgz8qiG4h3TSdMe+vN1iQXpJleSJ3SM5zQ8Fy2SyyXAWlbxpEZ2Y+Z4u1BePgJEYbSy80Q=="],
+    "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.4", "", { "dependencies": { "@img/sharp-wasm32": "0.35.4" }, "cpu": "none" }, "sha512-ESfNkywmCfPNyaZjxooddJQiQ+l/nTpGEOGthxiLnIHXC/CmcBixnfwUleX9mCz9ovrUUvKMap/pm8RYbzfwaA=="],
 
-    "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.3", "", { "os": "win32", "cpu": "arm64" }, "sha512-4bPwFdMbeC4JQ8L8LOyWp6nsHcboP5fxkp6iPOXz2Vg49R42TuMs2whkJ5OAP4/Ul035qOzy0AecOF9VOscn4w=="],
+    "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.4", "", { "os": "win32", "cpu": "arm64" }, "sha512-iNdlBX9gLVvqe2I3uIJSIKTq6wckP/DYxZtcqxm09x5Gi24DnFBmPAWZmr60ZyYMG0xlzo6goG3670ar+RXvRw=="],
 
-    "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.3", "", { "os": "win32", "cpu": "ia32" }, "sha512-r53mXsBN6lFUDiST764SvgwUdHAqM4rPAiDzAmf4fLoB6X/rkfyTrLCg6+g17wJJiCmB3JYgHuUldCWUIRFSXw=="],
+    "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.4", "", { "os": "win32", "cpu": "ia32" }, "sha512-kqRsbaa5CS6KHlpxnN7WhE6vAAugXyZButpRdvDWetlv6Qv4N9WTcrWzF7tXfB9T7MsoadqdI8hmwLq6UlLvtw=="],
 
-    "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.3", "", { "os": "win32", "cpu": "x64" }, "sha512-D4y1vNeZrIIJCN+uHaWVtH86B+aCrdMYYjicy9pXHvbGZeGYLLSd3wdVuC37FxVXlU1ARsk84eKWfWMXGYEqvA=="],
+    "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.4", "", { "os": "win32", "cpu": "x64" }, "sha512-XtmnYhBcrORsJ4XJngyzr/EWP0hRZLAZRFaApdKuviyqF78+ylxh2y06ZmtULAMOnObJ3ucpN0AcwSWnMowTRg=="],
 
     "@jitl/quickjs-ffi-types": ["@jitl/quickjs-ffi-types@0.32.0", "", {}, "sha512-v9T+GQpmk43VDJ7d72sf0Nexhk+ArvtUihW27dy7lqAl0zBObFKtSBBIm5RBjwIhE8VwsPPm9PNuvPvNqLWUEg=="],
 
@@ -1496,7 +1497,7 @@
 
     "semver": ["semver@7.7.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA=="],
 
-    "sharp": ["sharp@0.35.3", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.5" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.3", "@img/sharp-darwin-x64": "0.35.3", "@img/sharp-freebsd-wasm32": "0.35.3", "@img/sharp-libvips-darwin-arm64": "1.3.2", "@img/sharp-libvips-darwin-x64": "1.3.2", "@img/sharp-libvips-linux-arm": "1.3.2", "@img/sharp-libvips-linux-arm64": "1.3.2", "@img/sharp-libvips-linux-ppc64": "1.3.2", "@img/sharp-libvips-linux-riscv64": "1.3.2", "@img/sharp-libvips-linux-s390x": "1.3.2", "@img/sharp-libvips-linux-x64": "1.3.2", "@img/sharp-libvips-linuxmusl-arm64": "1.3.2", "@img/sharp-libvips-linuxmusl-x64": "1.3.2", "@img/sharp-linux-arm": "0.35.3", "@img/sharp-linux-arm64": "0.35.3", "@img/sharp-linux-ppc64": "0.35.3", "@img/sharp-linux-riscv64": "0.35.3", "@img/sharp-linux-s390x": "0.35.3", "@img/sharp-linux-x64": "0.35.3", "@img/sharp-linuxmusl-arm64": "0.35.3", "@img/sharp-linuxmusl-x64": "0.35.3", "@img/sharp-webcontainers-wasm32": "0.35.3", "@img/sharp-win32-arm64": "0.35.3", "@img/sharp-win32-ia32": "0.35.3", "@img/sharp-win32-x64": "0.35.3" } }, "sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q=="],
+    "sharp": ["sharp@0.35.4", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.5" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.4", "@img/sharp-darwin-x64": "0.35.4", "@img/sharp-freebsd-wasm32": "0.35.4", "@img/sharp-libvips-darwin-arm64": "1.3.3", "@img/sharp-libvips-darwin-x64": "1.3.3", "@img/sharp-libvips-linux-arm": "1.3.3", "@img/sharp-libvips-linux-arm64": "1.3.3", "@img/sharp-libvips-linux-ppc64": "1.3.3", "@img/sharp-libvips-linux-riscv64": "1.3.3", "@img/sharp-libvips-linux-s390x": "1.3.3", "@img/sharp-libvips-linux-x64": "1.3.3", "@img/sharp-libvips-linuxmusl-arm64": "1.3.3", "@img/sharp-libvips-linuxmusl-x64": "1.3.3", "@img/sharp-linux-arm": "0.35.4", "@img/sharp-linux-arm64": "0.35.4", "@img/sharp-linux-ppc64": "0.35.4", "@img/sharp-linux-riscv64": "0.35.4", "@img/sharp-linux-s390x": "0.35.4", "@img/sharp-linux-x64": "0.35.4", "@img/sharp-linuxmusl-arm64": "0.35.4", "@img/sharp-linuxmusl-x64": "0.35.4", "@img/sharp-webcontainers-wasm32": "0.35.4", "@img/sharp-win32-arm64": "0.35.4", "@img/sharp-win32-ia32": "0.35.4", "@img/sharp-win32-x64": "0.35.4" } }, "sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA=="],
 
     "shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="],
 
@@ -1610,9 +1611,9 @@
 
     "unbash": ["unbash@3.0.0", "", {}, "sha512-FeFPZ/WFT0mbRCuydiZzpPFlrYN8ZUpphQKoq4EeElVIYjYyGzPMxQR/simUwCOJIyVhpFk4RbtyO7RuMpMnHA=="],
 
-    "undici": ["undici@8.10.0", "", {}, "sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ=="],
+    "undici": ["undici@8.10.2", "", {}, "sha512-/y4/bH9YNU5hi9NIrpOuvGXFcxrj3CMrV+/AYpowAYTpHn8gX/XPFjNy766FPoYY0miQhdW977JFWKGNhBdwyQ=="],
 
-    "undici-types": ["undici-types@8.10.0", "", {}, "sha512-ibvdovq3nCFs8Msrd95BW+zUOq+aOVbT+wpHUoPWhztbHEoPc6oof51iFDB6Es8lTKvNvVW9jNSAB8dwrKTMGg=="],
+    "undici-types": ["undici-types@8.10.2", "", {}, "sha512-7/+aSjzkUoLc92hV22bTW4aGanXf800zbwguhcICs0OAoCF9wDOE4wkopQ+SqfhXZm8mCK8gHpdTs7pZUWzK3w=="],
 
     "unicorn-magic": ["unicorn-magic@0.4.0", "", {}, "sha512-wH590V9VNgYH9g3lH9wWjTrUoKsjLF6sGLjhR4sH1LWpLmCOH0Zf7PukhDA8BiS7KHe4oPNkcTHqYkj7SOGUOw=="],
 
@@ -1672,6 +1673,8 @@
 
     "xmlchars": ["xmlchars@2.2.0", "", {}, "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw=="],
 
+    "y-codemirror.next": ["y-codemirror.next@0.3.5", "", { "dependencies": { "lib0": "^0.2.42" }, "peerDependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.0.0", "yjs": "^13.5.6" } }, "sha512-VluNu3e5HfEXybnypnsGwKAj+fKLd4iAnR7JuX1Sfyydmn1jCBS5wwEL/uS04Ch2ib0DnMAOF6ZRR/8kK3wyGw=="],
+
     "y-protocols": ["y-protocols@1.0.7", "", { "dependencies": { "lib0": "^0.2.85" }, "peerDependencies": { "yjs": "^13.0.0" } }, "sha512-YSVsLoXxO67J6eE/nV4AtFtT3QEotZf5sK5BHxFBXso7VDUT3Tx07IfA6hsu5Q5OmBdMkQVmFZ9QOA7fikWvnw=="],
 
     "yallist": ["yallist@3.1.1", "", {}, "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="],
@@ -1704,7 +1707,7 @@
 
     "@eslint-community/eslint-utils/eslint-visitor-keys": ["eslint-visitor-keys@3.4.3", "", {}, "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag=="],
 
-    "@img/sharp-wasm32/@emnapi/runtime": ["@emnapi/runtime@1.11.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA=="],
+    "@img/sharp-wasm32/@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="],
 
     "@secretlint/config-loader/ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
 
diff --git a/package.json b/package.json
index 422a42268..3e726616b 100644
--- a/package.json
+++ b/package.json
@@ -109,6 +109,7 @@
     "semver": "^7.7.4",
     "sharp": "^0.35.0",
     "uqr": "^0.1.3",
+    "y-codemirror.next": "^0.3.5",
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.31",
     "zustand": "^5.0.12",
diff --git a/src/__tests__/architecture/bundle-size-budgets.test.ts b/src/__tests__/architecture/bundle-size-budgets.test.ts
index 8dae203c3..1ce6f51da 100644
--- a/src/__tests__/architecture/bundle-size-budgets.test.ts
+++ b/src/__tests__/architecture/bundle-size-budgets.test.ts
@@ -227,14 +227,18 @@ function findChunk(prefix: string): { path: string; size: number } | null {
     (f) => f.startsWith(prefix) && f.endsWith('.js'),
   )
   if (matches.length === 0) return null
-  if (matches.length > 1) {
-    throw new Error(
-      `[bundle-size-budgets] Found ${matches.length} files matching prefix ` +
-      `"${prefix}" in dist/assets/: ${matches.join(', ')}. Expected exactly one.`,
-    )
-  }
+  // A module reachable through BOTH a dynamic and a static import (e.g.
+  // CodeMirrorEditor: lazy from CodeEditorPanel, static from its collab
+  // sibling lazy module) makes rolldown emit a tiny re-export facade chunk
+  // alongside the real one. Budget the SUM of all matches — that stays
+  // facade-tolerant while still catching genuine duplication (two full
+  // copies would blow the budget immediately).
+  const size = matches.reduce(
+    (total, match) => total + statSync(join(DIST_ASSETS, match)).size,
+    0,
+  )
   const path = join(DIST_ASSETS, matches[0]!)
-  return { path, size: statSync(path).size }
+  return { path, size }
 }
 
 function findChunks(prefix: string): string[] {
diff --git a/src/__tests__/architecture/codemirror-lazy-only.test.ts b/src/__tests__/architecture/codemirror-lazy-only.test.ts
index 0cf515aad..7e65c9e78 100644
--- a/src/__tests__/architecture/codemirror-lazy-only.test.ts
+++ b/src/__tests__/architecture/codemirror-lazy-only.test.ts
@@ -73,9 +73,15 @@ function collectProdFiles(): string[] {
 // CodeMirror lazy-load enforcement
 // ---------------------------------------------------------------------------
 
-// The ONE file allowed to statically import the CodeMirror packages.
-// Path is relative to SRC_ROOT (i.e. relative to `src/`).
-const ALLOWED_CONSUMER = 'admin/pages/site/code-editor/CodeMirrorEditor.tsx'
+// The files allowed to statically import the CodeMirror packages — the base
+// lazy module and its collab sibling (both only reachable through
+// React.lazy() boundaries; the sibling adds the y-codemirror binding for
+// the Plugin IDE's co-edited buffers).
+// Paths are relative to SRC_ROOT (i.e. relative to `src/`).
+const ALLOWED_CONSUMERS = new Set([
+  'admin/pages/site/code-editor/CodeMirrorEditor.tsx',
+  'admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx',
+])
 
 // Matches: import ... from 'codemirror' / '@codemirror/...' / '@lezer/...'
 //          require('codemirror') / require('@codemirror/...') / require('@lezer/...')
@@ -98,13 +104,13 @@ const CODEMIRROR_IMPORT_PATTERNS: { family: string; pattern: RegExp }[] = [
 ]
 
 describe('CodeMirror lazy-load enforcement', () => {
-  it(`only ${ALLOWED_CONSUMER} may statically import codemirror / @codemirror / @lezer`, () => {
+  it('only the code-editor lazy modules may statically import codemirror / @codemirror / @lezer', () => {
     const allFiles = collectProdFiles()
     const violations: { file: string; family: string }[] = []
 
     for (const file of allFiles) {
       const rel = relative(SRC_ROOT, file)
-      if (rel === ALLOWED_CONSUMER) continue
+      if (ALLOWED_CONSUMERS.has(rel)) continue
 
       let source: string
       try {
@@ -125,8 +131,8 @@ describe('CodeMirror lazy-load enforcement', () => {
         (v) => `  src/${v.file}  →  imports ${v.family}`
       )
       throw new Error(
-        `[codemirror-lazy-only] CodeMirror must stay behind the React.lazy()\n` +
-        `boundary in CodeEditorPanel.tsx. Only src/${ALLOWED_CONSUMER} is\n` +
+        `[codemirror-lazy-only] CodeMirror must stay behind a React.lazy()\n` +
+        `boundary. Only ${[...ALLOWED_CONSUMERS].map((f) => `src/${f}`).join(' and ')} are\n` +
         `permitted to statically import CodeMirror packages. A static import\n` +
         `elsewhere pulls the ~605 kB CodeMirror bundle into the eager admin\n` +
         `chunk and undoes the code-split.\n\n` +
@@ -139,11 +145,12 @@ describe('CodeMirror lazy-load enforcement', () => {
     expect(violations).toHaveLength(0)
   })
 
-  it('the allowed consumer file actually exists at the documented path', () => {
-    // Sanity check — if CodeMirrorEditor.tsx is renamed or moved without
-    // updating ALLOWED_CONSUMER above, the gate would silently start
-    // failing for the lazy module itself. Detect that case directly.
-    const allowed = join(SRC_ROOT, ALLOWED_CONSUMER)
-    expect(existsSync(allowed)).toBe(true)
+  it('the allowed consumer files actually exist at the documented paths', () => {
+    // Sanity check — if a lazy module is renamed or moved without updating
+    // ALLOWED_CONSUMERS above, the gate would silently start failing for
+    // the lazy module itself. Detect that case directly.
+    for (const consumer of ALLOWED_CONSUMERS) {
+      expect(existsSync(join(SRC_ROOT, consumer))).toBe(true)
+    }
   })
 })
diff --git a/src/__tests__/collab/filesGranular.test.ts b/src/__tests__/collab/filesGranular.test.ts
new file mode 100644
index 000000000..b4e5bbd79
--- /dev/null
+++ b/src/__tests__/collab/filesGranular.test.ts
@@ -0,0 +1,180 @@
+/**
+ * Granular shell files — the shell's `files` key is a per-file Y.Map with
+ * `content` as Y.Text, so code files co-edit with the same guarantees as
+ * canvas text: different files never collide, one file's content merges
+ * character-level, and a delete of one file can't clobber a neighbour's
+ * concurrent edit. This is what the site editor's code panel and the
+ * Plugin IDE both ride.
+ */
+import { describe, expect, it } from 'bun:test'
+import * as Y from 'yjs'
+import { create } from 'mutative'
+import '@modules/base'
+import {
+  applySitePatchesToDocs,
+  createCollabDocSet,
+  projectSiteDoc,
+  seedSiteDoc,
+  shellMap,
+  siteFileContentText,
+  SITE_DOC_ID,
+} from '@core/collab'
+import type { SiteDocument } from '@core/page-tree'
+import type { SiteFile } from '@core/files/schemas'
+import { makeSite } from '../fixtures'
+
+const file = (id: string, path: string, content: string, createdAt = 1): SiteFile => ({
+  id,
+  path,
+  type: 'script',
+  content,
+  createdAt,
+  updatedAt: createdAt,
+})
+
+function siteWithFiles(): SiteDocument {
+  return makeSite({
+    files: [
+      file('f1', 'src/scripts/a.ts', 'const a = 1\n', 1),
+      file('f2', 'src/scripts/b.ts', 'const b = 2\n', 2),
+    ],
+  })
+}
+
+function seededPair(site: SiteDocument): [Y.Doc, Y.Doc] {
+  const a = new Y.Doc()
+  seedSiteDoc(a, site)
+  const b = new Y.Doc()
+  Y.applyUpdate(b, Y.encodeStateAsUpdate(a))
+  return [a, b]
+}
+
+function syncDocs(a: Y.Doc, b: Y.Doc): void {
+  Y.applyUpdate(b, Y.encodeStateAsUpdate(a, Y.encodeStateVector(b)))
+  Y.applyUpdate(a, Y.encodeStateAsUpdate(b, Y.encodeStateVector(a)))
+}
+
+/** Run one store-style mutation through the patch translator against `doc`. */
+function mutateThroughPatches(
+  doc: Y.Doc,
+  site: SiteDocument,
+  recipe: (draft: SiteDocument) => void,
+): SiteDocument {
+  const [next, patches] = create(site, recipe, { enablePatches: true })
+  const docs = createCollabDocSet()
+  docs.set(SITE_DOC_ID, doc)
+  applySitePatchesToDocs(patches, site, next, docs, 'test-local')
+  return next
+}
+
+function projectedFiles(doc: Y.Doc): SiteFile[] {
+  return projectSiteDoc(doc).shell['files'] as SiteFile[]
+}
+
+describe('granular shell files', () => {
+  it('seed + project round-trips the files array', () => {
+    const site = siteWithFiles()
+    const [a] = seededPair(site)
+    expect(projectedFiles(a)).toEqual(site.files)
+  })
+
+  it('content edits translate to Y.Text splices that merge character-level', () => {
+    const site = siteWithFiles()
+    const [a, b] = seededPair(site)
+
+    mutateThroughPatches(a, site, (draft) => {
+      draft.files[0]!.content = '// top\nconst a = 1\n'
+    })
+    mutateThroughPatches(b, site, (draft) => {
+      draft.files[0]!.content = 'const a = 1\n// bottom\n'
+    })
+    syncDocs(a, b)
+
+    const merged = projectedFiles(a).find((f) => f.id === 'f1')!.content
+    expect(merged).toContain('// top')
+    expect(merged).toContain('// bottom')
+    expect(merged).toContain('const a = 1')
+    expect(projectedFiles(b).find((f) => f.id === 'f1')!.content).toBe(merged)
+  })
+
+  it('deleting one file never clobbers a concurrent edit to another', () => {
+    const site = siteWithFiles()
+    const [a, b] = seededPair(site)
+
+    // Peer A deletes f1 (shifts f2 to index 0 — Mutative emits replace ops
+    // for the shifted entry); peer B concurrently edits f2's content.
+    mutateThroughPatches(a, site, (draft) => {
+      draft.files.splice(0, 1)
+    })
+    mutateThroughPatches(b, site, (draft) => {
+      draft.files[1]!.content = 'const b = 2\n// edited\n'
+    })
+    syncDocs(a, b)
+
+    for (const doc of [a, b]) {
+      const files = projectedFiles(doc)
+      expect(files.map((f) => f.id)).toEqual(['f2'])
+      expect(files[0]!.content).toContain('// edited')
+    }
+  })
+
+  it('adding files on both peers keeps both', () => {
+    const site = siteWithFiles()
+    const [a, b] = seededPair(site)
+
+    mutateThroughPatches(a, site, (draft) => {
+      draft.files.push(file('f3', 'src/scripts/c.ts', 'const c = 3\n', 3))
+    })
+    mutateThroughPatches(b, site, (draft) => {
+      draft.files.push(file('f4', 'src/scripts/d.ts', 'const d = 4\n', 4))
+    })
+    syncDocs(a, b)
+
+    for (const doc of [a, b]) {
+      expect(projectedFiles(doc).map((f) => f.id)).toEqual(['f1', 'f2', 'f3', 'f4'])
+    }
+  })
+
+  it('renames merge with concurrent content edits to the same file', () => {
+    const site = siteWithFiles()
+    const [a, b] = seededPair(site)
+
+    mutateThroughPatches(a, site, (draft) => {
+      draft.files[0]!.path = 'src/scripts/renamed.ts'
+    })
+    mutateThroughPatches(b, site, (draft) => {
+      draft.files[0]!.content = 'const a = 1\n// note\n'
+    })
+    syncDocs(a, b)
+
+    const merged = projectedFiles(a).find((f) => f.id === 'f1')!
+    expect(merged.path).toBe('src/scripts/renamed.ts')
+    expect(merged.content).toContain('// note')
+  })
+
+  it('siteFileContentText exposes the live Y.Text for editor bindings', () => {
+    const site = siteWithFiles()
+    const [a] = seededPair(site)
+    const text = siteFileContentText(shellMap(a), 'f1')
+    expect(text).toBeInstanceOf(Y.Text)
+    expect(text!.toString()).toBe('const a = 1\n')
+    expect(siteFileContentText(shellMap(a), 'nope')).toBeNull()
+  })
+
+  it('legacy LWW-array layout projects as-is and upgrades on first write', () => {
+    const site = siteWithFiles()
+    const doc = new Y.Doc()
+    seedSiteDoc(doc, { ...site, files: [] })
+    // Simulate a pre-granular doc: plain array value under 'files'.
+    doc.transact(() => {
+      shellMap(doc).set('files', site.files)
+    })
+    expect(projectedFiles(doc)).toEqual(site.files)
+
+    mutateThroughPatches(doc, site, (draft) => {
+      draft.files[0]!.content = 'upgraded\n'
+    })
+    expect(shellMap(doc).get('files')).toBeInstanceOf(Y.Map)
+    expect(projectedFiles(doc).find((f) => f.id === 'f1')!.content).toBe('upgraded\n')
+  })
+})
diff --git a/src/admin/AuthenticatedAdmin.tsx b/src/admin/AuthenticatedAdmin.tsx
index 6d539e910..35d813d92 100644
--- a/src/admin/AuthenticatedAdmin.tsx
+++ b/src/admin/AuthenticatedAdmin.tsx
@@ -106,6 +106,10 @@ const DataPage = prewarmedLazy(
   () => import('./pages/data/DataPage').then((m) => ({ default: m.DataPage })),
   { displayName: 'DataPage' },
 )
+const SitePluginIdePage = prewarmedLazy(
+  () => import('./pages/plugins/ide/SitePluginIdePage').then((m) => ({ default: m.SitePluginIdePage })),
+  { displayName: 'SitePluginIdePage' },
+)
 
 const SiteImportModal = lazy(() =>
   import('./modals/SiteImport').then((m) => ({ default: m.SiteImportModal })),
@@ -157,6 +161,7 @@ if (typeof window !== 'undefined') {
     pathname.startsWith('/admin/content') ? ContentPage :
     pathname.startsWith('/admin/data') ? DataPage :
     pathname.startsWith('/admin/media') ? MediaPage :
+    pathname.startsWith('/admin/plugins/develop/') ? SitePluginIdePage :
     pathname.startsWith('/admin/plugins/') ? PluginPage :
     pathname.startsWith('/admin/plugins') ? PluginsPage :
     pathname.startsWith('/admin/users') ? UsersPage :
@@ -191,6 +196,7 @@ const ALL_WORKSPACE_PAGES = [
   AiPage,
   AccountPage,
   PluginPage,
+  SitePluginIdePage,
 ]
 
 function pageForSection(section: AdminWorkspace) {
@@ -204,6 +210,7 @@ function pageForSection(section: AdminWorkspace) {
     section === 'ai' ? AiPage :
     section === 'branchReview' ? SitePage :
     section === 'pluginPage' ? PluginPage :
+    section === 'pluginIde' ? SitePluginIdePage :
     section === 'account' ? AccountPage :
     DashboardPage
   )
@@ -330,6 +337,7 @@ export default function AuthenticatedAdmin({ section, currentUser }: Authenticat
                 section === 'ai' ? <AiPage /> :
                 section === 'branchReview' ? <BranchReviewPage /> :
                 section === 'pluginPage' ? <PluginPage /> :
+                section === 'pluginIde' ? <SitePluginIdePage /> :
                 section === 'account' ? <AccountPage /> :
                 <DashboardPage />}
             </Suspense>
diff --git a/src/admin/access.ts b/src/admin/access.ts
index 666643390..a4f65906e 100644
--- a/src/admin/access.ts
+++ b/src/admin/access.ts
@@ -287,6 +287,10 @@ export function canAccessWorkspace(user: CmsCurrentUser | null, workspace: Admin
     case 'plugins':
     case 'pluginPage':
       return canAccessPluginsWorkspace(user)
+    case 'pluginIde':
+      // Authoring site plugin source is site-developer work — activation
+      // (the power grant) is separately gated by plugins.install.
+      return hasCapability(user, 'site.read')
     case 'users':
       return canAccessUsersWorkspace(user)
     case 'ai':
@@ -319,6 +323,7 @@ export function workspacePath(workspace: AdminWorkspace): string {
     case 'media':
       return '/admin/media'
     case 'plugins':
+    case 'pluginIde':
       return '/admin/plugins'
     case 'users':
       return '/admin/users'
diff --git a/src/admin/layouts/AdminWorkspaceCanvasLayout/AdminWorkspaceCanvasLayout.tsx b/src/admin/layouts/AdminWorkspaceCanvasLayout/AdminWorkspaceCanvasLayout.tsx
index e9c0035a1..f1a1d8b61 100644
--- a/src/admin/layouts/AdminWorkspaceCanvasLayout/AdminWorkspaceCanvasLayout.tsx
+++ b/src/admin/layouts/AdminWorkspaceCanvasLayout/AdminWorkspaceCanvasLayout.tsx
@@ -33,7 +33,7 @@ const SettingsModal = lazy(() =>
   import('@admin/modals/Settings/SettingsModal').then((m) => ({ default: m.SettingsModal })),
 )
 
-type WorkspaceCanvasSection = Extract<AdminWorkspace, 'content' | 'data' | 'media' | 'branchReview'>
+type WorkspaceCanvasSection = Extract<AdminWorkspace, 'content' | 'data' | 'media' | 'branchReview' | 'pluginIde'>
 
 interface AdminWorkspaceCanvasLayoutProps {
   workspace: WorkspaceCanvasSection
@@ -126,7 +126,8 @@ interface WorkspaceRightPanelNotchProps {
 }
 
 function WorkspaceRightPanelNotch({ workspace, onOpen }: WorkspaceRightPanelNotchProps) {
-  const label = workspace === 'content' ? 'settings' : 'inspector'
+  const label =
+    workspace === 'content' ? 'settings' : workspace === 'pluginIde' ? 'manifest' : 'inspector'
   const testId = workspace === 'content' ? 'content-settings-notch' : `${workspace}-inspector-notch`
   const stopCanvasInteraction = (event: SyntheticEvent) => {
     event.stopPropagation()
diff --git a/src/admin/pages/plugins/PluginsPage.module.css b/src/admin/pages/plugins/PluginsPage.module.css
index f1444b2db..0aa03e412 100644
--- a/src/admin/pages/plugins/PluginsPage.module.css
+++ b/src/admin/pages/plugins/PluginsPage.module.css
@@ -258,3 +258,10 @@
         grid-template-columns: 1fr;
     }
 }
+
+.groupTitle {
+  margin: var(--space-l) 0 0;
+  font-size: var(--text-l);
+  font-weight: 600;
+  color: var(--text);
+}
diff --git a/src/admin/pages/plugins/PluginsPage.tsx b/src/admin/pages/plugins/PluginsPage.tsx
index 85f38d56a..b1bda8778 100644
--- a/src/admin/pages/plugins/PluginsPage.tsx
+++ b/src/admin/pages/plugins/PluginsPage.tsx
@@ -6,11 +6,13 @@ import { PluginRemoveDialog } from './components/PluginRemoveDialog/PluginRemove
 import { PermissionReviewSection } from './components/PermissionReviewSection'
 import { PluginSettingsDialog } from './components/PluginSettingsDialog/PluginSettingsDialog'
 import { PluginSchedulesDialog } from './components/PluginSchedulesDialog/PluginSchedulesDialog'
+import { SitePluginsSection } from './components/SitePluginsSection'
 import { isSandboxRelatedError, usePluginsWorkspace } from './hooks/usePluginsWorkspace'
 import { notifyCmsPluginsChanged } from './utils/pluginEvents'
 import { useAuthenticatedAdminUser } from '@admin/sessionContext'
 import {
   canConfigurePlugins,
+  canEditStructure,
   canInstallPlugins,
   canManagePluginLifecycle,
 } from '@admin/access'
@@ -27,6 +29,7 @@ export function PluginsPage() {
   const canConfigure = canConfigurePlugins(currentUser)
   const canInstall = canInstallPlugins(currentUser)
   const canManageLifecycle = canManagePluginLifecycle(currentUser)
+  const canCreateSitePlugins = canEditStructure(currentUser)
   const vm = usePluginsWorkspace()
   const {
     fileInputRef,
@@ -130,6 +133,9 @@ export function PluginsPage() {
           />
         )}
 
+        <SitePluginsSection canCreate={canCreateSitePlugins} />
+
+        <h2 className={styles.groupTitle}>Installed</h2>
         <div
           className={styles.pluginsList}
           aria-label="Installed plugins"
diff --git a/src/admin/pages/plugins/components/NewSitePluginDialog.module.css b/src/admin/pages/plugins/components/NewSitePluginDialog.module.css
new file mode 100644
index 000000000..62234cbc9
--- /dev/null
+++ b/src/admin/pages/plugins/components/NewSitePluginDialog.module.css
@@ -0,0 +1,59 @@
+.body {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-xs);
+}
+
+.label {
+  font-size: var(--text-xs);
+  color: var(--text-subtle);
+  margin-top: var(--space-xs);
+}
+
+.fieldError {
+  margin: 0;
+  font-size: var(--text-xs);
+  color: var(--danger);
+}
+
+.templates {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: var(--space-xs);
+}
+
+.templateCard {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: var(--space-3xs);
+  height: auto;
+  padding: var(--space-s);
+  text-align: left;
+  white-space: normal;
+  border: 1px solid var(--border-muted);
+  border-radius: var(--radius);
+}
+
+.templateCard[aria-checked='true'] {
+  border-color: var(--overlay);
+  background: var(--bg-surface-3);
+}
+
+.templateLabel {
+  font-size: var(--text-s);
+  font-weight: 600;
+  color: var(--text);
+}
+
+.templateDescription {
+  font-size: var(--text-2xs);
+  line-height: 1.5;
+  color: var(--text-subtle);
+}
+
+.error {
+  margin: 0;
+  font-size: var(--text-xs);
+  color: var(--danger);
+}
diff --git a/src/admin/pages/plugins/components/NewSitePluginDialog.tsx b/src/admin/pages/plugins/components/NewSitePluginDialog.tsx
new file mode 100644
index 000000000..0946aa27c
--- /dev/null
+++ b/src/admin/pages/plugins/components/NewSitePluginDialog.tsx
@@ -0,0 +1,175 @@
+/**
+ * NewSitePluginDialog — name + template picker for `New site plugin`.
+ *
+ * The kebab-case local id derives live from the name (shown, editable);
+ * each template scaffolds a WORKING minimal shape with its permissions
+ * pre-declared (declared, not granted — consent happens at activation).
+ * On success the caller navigates straight into the Plugin IDE.
+ */
+import { useState } from 'react'
+import { apiRequest } from '@core/http'
+import { Type } from '@core/utils/typeboxHelpers'
+import { getErrorMessage } from '@core/utils/errorMessage'
+import {
+  SITE_PLUGIN_LOCAL_ID_PATTERN,
+  SITE_PLUGIN_TEMPLATES,
+  type SitePluginTemplateId,
+} from '@core/site-plugins'
+import { Button } from '@ui/components/Button'
+import { Dialog } from '@ui/components/Dialog'
+import { Input } from '@ui/components/Input'
+import styles from './NewSitePluginDialog.module.css'
+
+const ScaffoldResponseSchema = Type.Object({
+  ok: Type.Boolean(),
+  localId: Type.String(),
+  files: Type.Array(Type.String()),
+})
+
+function deriveLocalId(name: string): string {
+  return name
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .replace(/^[^a-z]+/, '')
+    .slice(0, 40)
+}
+
+interface NewSitePluginDialogProps {
+  existingLocalIds: string[]
+  onClose: () => void
+  onCreated: (localId: string) => void
+}
+
+export function NewSitePluginDialog({
+  existingLocalIds,
+  onClose,
+  onCreated,
+}: NewSitePluginDialogProps) {
+  const [name, setName] = useState('')
+  const [localIdTouched, setLocalIdTouched] = useState(false)
+  const [localId, setLocalId] = useState('')
+  const [template, setTemplate] = useState<SitePluginTemplateId>('module')
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  const effectiveLocalId = localIdTouched ? localId : deriveLocalId(name)
+  const idValid = SITE_PLUGIN_LOCAL_ID_PATTERN.test(effectiveLocalId)
+  const idTaken = existingLocalIds.includes(effectiveLocalId)
+  const canSubmit = name.trim().length > 0 && idValid && !idTaken && !busy
+
+  // Field-local validation stays inline (allowed exception); operation
+  // failures surface via the dialog-level alert below.
+  const idHint = !effectiveLocalId
+    ? null
+    : !idValid
+      ? 'Id must be lowercase kebab-case and start with a letter.'
+      : idTaken
+        ? 'A site plugin with this id already exists.'
+        : null
+
+  const submit = async (): Promise<void> => {
+    if (!canSubmit) return
+    setBusy(true)
+    setError(null)
+    try {
+      const result = await apiRequest('/admin/api/cms/site-plugins', {
+        method: 'POST',
+        body: { name: name.trim(), localId: effectiveLocalId, template },
+        schema: ScaffoldResponseSchema,
+      })
+      onCreated(result.localId)
+    } catch (err) {
+      setError(getErrorMessage(err, 'Could not create the site plugin'))
+      setBusy(false)
+    }
+  }
+
+  return (
+    <Dialog
+      open
+      onClose={busy ? () => {} : onClose}
+      eyebrow="Site plugins"
+      title="New site plugin"
+      footer={
+        <>
+          <Button variant="secondary" size="sm" type="button" onClick={onClose} disabled={busy}>
+            Cancel
+          </Button>
+          <Button
+            variant="primary"
+            size="sm"
+            type="button"
+            onClick={() => void submit()}
+            disabled={!canSubmit}
+            data-testid="create-site-plugin"
+          >
+            {busy ? 'Creating…' : 'Create & open IDE'}
+          </Button>
+        </>
+      }
+    >
+      <div className={styles.body}>
+        <label className={styles.label} htmlFor="site-plugin-name">
+          Name
+        </label>
+        <Input
+          id="site-plugin-name"
+          value={name}
+          placeholder="Newsletter"
+          autoFocus
+          onChange={(event) => setName(event.currentTarget.value)}
+          onKeyDown={(event) => {
+            if (event.key === 'Enter') void submit()
+          }}
+        />
+
+        <label className={styles.label} htmlFor="site-plugin-id">
+          Plugin id
+        </label>
+        <Input
+          id="site-plugin-id"
+          value={effectiveLocalId}
+          prefix="site."
+          monospace
+          invalid={Boolean(idHint)}
+          onChange={(event) => {
+            setLocalIdTouched(true)
+            setLocalId(event.currentTarget.value)
+          }}
+        />
+        {idHint && (
+          <p className={styles.fieldError} role="alert">
+            {idHint}
+          </p>
+        )}
+
+        <span className={styles.label}>Template</span>
+        <div className={styles.templates} role="radiogroup" aria-label="Scaffold template">
+          {SITE_PLUGIN_TEMPLATES.map((option) => (
+            <Button
+              key={option.id}
+              variant="ghost"
+              size="sm"
+              role="radio"
+              aria-checked={template === option.id}
+              pressed={template === option.id}
+              className={styles.templateCard}
+              onClick={() => setTemplate(option.id)}
+              data-testid={`template-${option.id}`}
+            >
+              <span className={styles.templateLabel}>{option.label}</span>
+              <span className={styles.templateDescription}>{option.description}</span>
+            </Button>
+          ))}
+        </div>
+
+        {error && (
+          <p className={styles.error} role="alert">
+            {error}
+          </p>
+        )}
+      </div>
+    </Dialog>
+  )
+}
diff --git a/src/admin/pages/plugins/components/SitePluginsSection.module.css b/src/admin/pages/plugins/components/SitePluginsSection.module.css
new file mode 100644
index 000000000..be565eeb9
--- /dev/null
+++ b/src/admin/pages/plugins/components/SitePluginsSection.module.css
@@ -0,0 +1,113 @@
+.section {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-m);
+}
+
+.header {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: var(--space-m);
+}
+
+.title {
+  margin: 0;
+  font-size: var(--text-l);
+  font-weight: 600;
+  color: var(--text);
+}
+
+.subtitle {
+  margin: var(--space-3xs) 0 0;
+  font-size: var(--text-s);
+  line-height: 1.5;
+  color: var(--text-subtle);
+  max-width: 52ch;
+}
+
+.empty {
+  margin: 0;
+  padding: var(--space-l);
+  border-radius: var(--radius);
+  background: var(--bg-surface-2);
+  font-size: var(--text-s);
+  color: var(--text-subtle);
+}
+
+.list {
+  margin: 0;
+  padding: 0;
+  list-style: none;
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+  gap: var(--space-s);
+}
+
+.card {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: var(--space-s);
+  padding: var(--space-m);
+  border-radius: 16px;
+  background: var(--bg-surface-2);
+}
+
+.cardBody {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-3xs);
+  min-width: 0;
+}
+
+.cardName {
+  font-size: var(--text-m);
+  font-weight: 600;
+  color: var(--text);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.cardId {
+  font-family: var(--font-mono);
+  font-size: var(--text-2xs);
+  color: var(--text-subtle);
+}
+
+.cardMeta {
+  display: flex;
+  align-items: center;
+  gap: var(--space-xs);
+}
+
+.stateChip {
+  padding: var(--space-px) var(--space-xs);
+  border-radius: var(--radius-sm);
+  font-size: var(--text-2xs);
+  font-weight: 600;
+  white-space: nowrap;
+  color: var(--text-subtle);
+  background: var(--bg-surface-3);
+}
+
+.stateChip[data-state='active'] {
+  color: var(--success-text);
+}
+
+.stateChip[data-state='build-failed'],
+.stateChip[data-state='runtime-error'],
+.stateChip[data-state='source-missing'] {
+  color: var(--danger);
+}
+
+.stateChip[data-state='permission-review'] {
+  color: var(--warning);
+}
+
+.cardVersion {
+  font-family: var(--font-mono);
+  font-size: var(--text-2xs);
+  color: var(--text-disabled);
+}
diff --git a/src/admin/pages/plugins/components/SitePluginsSection.tsx b/src/admin/pages/plugins/components/SitePluginsSection.tsx
new file mode 100644
index 000000000..6f8770ea9
--- /dev/null
+++ b/src/admin/pages/plugins/components/SitePluginsSection.tsx
@@ -0,0 +1,135 @@
+/**
+ * SitePluginsSection — the "Site plugins" group on the Plugins page.
+ *
+ * Lists plugins authored in this site's draft (union of draft folders and
+ * site-local runtime rows — a deleted folder never hides a still-running
+ * backend). Each card shows the runtime state chip and opens the full
+ * Plugin IDE; `New site plugin` scaffolds from a template.
+ */
+import { useCallback, useEffect, useState } from 'react'
+import { apiRequest } from '@core/http'
+import { getErrorMessage } from '@core/utils/errorMessage'
+import {
+  SitePluginsPayloadSchema,
+  sitePluginStateLabel,
+  type SitePluginSummary,
+} from '@core/site-plugins'
+import { Button } from '@ui/components/Button'
+import { pushToast } from '@ui/components/Toast'
+import { useNavigate } from '@admin/lib/routing'
+import { CodeIcon } from 'pixel-art-icons/icons/code'
+import { NewSitePluginDialog } from './NewSitePluginDialog'
+import styles from './SitePluginsSection.module.css'
+
+interface SitePluginsSectionProps {
+  canCreate: boolean
+}
+
+export function SitePluginsSection({ canCreate }: SitePluginsSectionProps) {
+  const navigate = useNavigate()
+  const [sitePlugins, setSitePlugins] = useState<SitePluginSummary[] | null>(null)
+  const [dialogOpen, setDialogOpen] = useState(false)
+
+  // useCallback kept: stable identity for the load-on-mount effect's dep array.
+  const load = useCallback(async (): Promise<void> => {
+    try {
+      const payload = await apiRequest('/admin/api/cms/site-plugins', {
+        schema: SitePluginsPayloadSchema,
+      })
+      setSitePlugins(payload.sitePlugins)
+    } catch (err) {
+      console.error('[SitePluginsSection] load failed:', err)
+      pushToast({
+        kind: 'error',
+        title: 'Could not load site plugins',
+        body: getErrorMessage(err, 'Unknown error'),
+      })
+      setSitePlugins([])
+    }
+  }, [])
+
+  useEffect(() => {
+    const timer = setTimeout(() => {
+      void load()
+    }, 0)
+    return () => clearTimeout(timer)
+  }, [load])
+
+  return (
+    <section className={styles.section} aria-labelledby="site-plugins-title">
+      <header className={styles.header}>
+        <div>
+          <h2 id="site-plugins-title" className={styles.title}>
+            Site plugins
+          </h2>
+          <p className={styles.subtitle}>
+            Built from this site’s draft in the Plugin IDE — same sandbox,
+            permissions, and lifecycle as installed plugins.
+          </p>
+        </div>
+        <Button
+          variant="secondary"
+          size="md"
+          disabled={!canCreate}
+          tooltip={canCreate ? undefined : 'Requires the site structure permission'}
+          onClick={() => setDialogOpen(true)}
+          data-testid="new-site-plugin"
+        >
+          <CodeIcon size={15} aria-hidden="true" />
+          <span>New site plugin</span>
+        </Button>
+      </header>
+
+      {sitePlugins === null ? (
+        <p className={styles.empty}>Loading site plugins…</p>
+      ) : sitePlugins.length === 0 ? (
+        <p className={styles.empty}>
+          No site plugins yet. Create one to add backend routes, canvas
+          modules, or editor commands from this site’s own code.
+        </p>
+      ) : (
+        <ul className={styles.list} aria-label="Site plugins">
+          {sitePlugins.map((plugin) => (
+            <li
+              key={plugin.localId}
+              className={styles.card}
+              data-testid={`site-plugin-card-${plugin.localId}`}
+            >
+              <div className={styles.cardBody}>
+                <span className={styles.cardName}>{plugin.name}</span>
+                <span className={styles.cardId}>{plugin.pluginId}</span>
+                <span className={styles.cardMeta}>
+                  <span className={styles.stateChip} data-state={plugin.state}>
+                    {sitePluginStateLabel(plugin.state)}
+                  </span>
+                  <span className={styles.cardVersion}>
+                    {plugin.activeVersion ?? 'not built yet'}
+                  </span>
+                </span>
+              </div>
+              <Button
+                variant="secondary"
+                size="sm"
+                onClick={() => navigate(`/admin/plugins/develop/${plugin.localId}`)}
+                data-testid={`open-ide-${plugin.localId}`}
+              >
+                Open IDE
+              </Button>
+            </li>
+          ))}
+        </ul>
+      )}
+
+      {dialogOpen && (
+        <NewSitePluginDialog
+          existingLocalIds={(sitePlugins ?? []).map((plugin) => plugin.localId)}
+          onClose={() => setDialogOpen(false)}
+          onCreated={(localId) => {
+            setDialogOpen(false)
+            navigate(`/admin/plugins/develop/${localId}`)
+          }}
+        />
+      )}
+    </section>
+  )
+}
diff --git a/src/admin/pages/plugins/ide/DiagnosticsStrip.module.css b/src/admin/pages/plugins/ide/DiagnosticsStrip.module.css
new file mode 100644
index 000000000..bc09ab359
--- /dev/null
+++ b/src/admin/pages/plugins/ide/DiagnosticsStrip.module.css
@@ -0,0 +1,73 @@
+.strip {
+  flex-shrink: 0;
+  max-height: 180px;
+  display: flex;
+  flex-direction: column;
+  border-top: 1px solid var(--border-muted);
+  background: var(--bg-surface-2);
+}
+
+.header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: var(--space-xs) var(--space-m);
+  border-bottom: 1px solid var(--border-muted);
+}
+
+.title {
+  font-size: var(--text-xs);
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: var(--text-subtle);
+}
+
+.status {
+  font-size: var(--text-xs);
+  color: var(--text-subtle);
+}
+
+.empty {
+  display: flex;
+  align-items: center;
+  gap: var(--space-xs);
+  margin: 0;
+  padding: var(--space-s) var(--space-m);
+  font-size: var(--text-xs);
+  color: var(--text-subtle);
+}
+
+.okIcon {
+  color: var(--success-text);
+  flex-shrink: 0;
+}
+
+.list {
+  margin: 0;
+  padding: var(--space-xs) 0;
+  list-style: none;
+  overflow-y: auto;
+}
+
+.item {
+  display: flex;
+  align-items: flex-start;
+  gap: var(--space-xs);
+  padding: var(--space-3xs) var(--space-m);
+  font-size: var(--text-xs);
+  line-height: 1.5;
+  color: var(--text);
+}
+
+.errorIcon {
+  color: var(--danger);
+  flex-shrink: 0;
+  margin-top: var(--space-px);
+}
+
+.message {
+  font-family: var(--font-mono);
+  white-space: pre-wrap;
+  word-break: break-word;
+}
diff --git a/src/admin/pages/plugins/ide/DiagnosticsStrip.tsx b/src/admin/pages/plugins/ide/DiagnosticsStrip.tsx
new file mode 100644
index 000000000..ff4710f93
--- /dev/null
+++ b/src/admin/pages/plugins/ide/DiagnosticsStrip.tsx
@@ -0,0 +1,42 @@
+/**
+ * DiagnosticsStrip — the bottom strip under the code editor. Shows the
+ * automatic validation's bundle / manifest / sandbox / containment
+ * diagnostics as they land (debounced on save-less live edits).
+ */
+import { WarningDiamondSolidIcon } from 'pixel-art-icons/icons/warning-diamond-solid'
+import { CheckIcon } from 'pixel-art-icons/icons/check'
+import styles from './DiagnosticsStrip.module.css'
+
+interface DiagnosticsStripProps {
+  diagnostics: string[]
+  validating: boolean
+  synced: boolean
+}
+
+export function DiagnosticsStrip({ diagnostics, validating, synced }: DiagnosticsStripProps) {
+  return (
+    <section className={styles.strip} aria-label="Diagnostics" data-testid="ide-diagnostics">
+      <header className={styles.header}>
+        <span className={styles.title}>Diagnostics</span>
+        <span className={styles.status} role="status">
+          {!synced ? 'connecting…' : validating ? 'validating…' : diagnostics.length === 0 ? 'clean' : `${diagnostics.length} problem${diagnostics.length === 1 ? '' : 's'}`}
+        </span>
+      </header>
+      {diagnostics.length === 0 ? (
+        <p className={styles.empty}>
+          <CheckIcon size={12} aria-hidden="true" className={styles.okIcon} />
+          No diagnostics — the draft builds cleanly.
+        </p>
+      ) : (
+        <ul className={styles.list}>
+          {diagnostics.map((diagnostic, index) => (
+            <li key={index} className={styles.item}>
+              <WarningDiamondSolidIcon size={12} aria-hidden="true" className={styles.errorIcon} />
+              <span className={styles.message}>{diagnostic}</span>
+            </li>
+          ))}
+        </ul>
+      )}
+    </section>
+  )
+}
diff --git a/src/admin/pages/plugins/ide/FileTreePane.module.css b/src/admin/pages/plugins/ide/FileTreePane.module.css
new file mode 100644
index 000000000..7299ba980
--- /dev/null
+++ b/src/admin/pages/plugins/ide/FileTreePane.module.css
@@ -0,0 +1,61 @@
+.pane {
+  display: flex;
+  flex-direction: column;
+  height: 100%;
+  min-height: 0;
+  background: var(--bg-surface-2);
+}
+
+.header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: var(--space-s) var(--space-m);
+  border-bottom: 1px solid var(--border-muted);
+}
+
+.title {
+  font-size: var(--text-xs);
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: var(--text-subtle);
+}
+
+.tree {
+  flex: 1;
+  min-height: 0;
+  overflow-y: auto;
+  padding: var(--space-xs) 0;
+}
+
+.rowPeers {
+  display: inline-flex;
+  align-items: center;
+  gap: var(--space-px);
+  margin-left: auto;
+  padding-right: var(--space-xs);
+}
+
+.inlineInput {
+  height: 22px;
+  font-size: var(--text-xs);
+}
+
+.footer {
+  border-top: 1px solid var(--border-muted);
+  padding: var(--space-s) var(--space-m);
+}
+
+.hint {
+  margin: 0;
+  font-size: var(--text-xs);
+  line-height: 1.5;
+  color: var(--text-subtle);
+}
+
+.hint code {
+  font-family: var(--font-mono);
+  font-size: var(--text-2xs);
+  color: var(--text);
+}
diff --git a/src/admin/pages/plugins/ide/FileTreePane.tsx b/src/admin/pages/plugins/ide/FileTreePane.tsx
new file mode 100644
index 000000000..c9d99d88a
--- /dev/null
+++ b/src/admin/pages/plugins/ide/FileTreePane.tsx
@@ -0,0 +1,352 @@
+/**
+ * FileTreePane — the Plugin IDE's file explorer.
+ *
+ * Rows derive from the plugin's live co-edited file list (folders inferred
+ * from paths), rendered with the shared Tree primitives. Context menu on
+ * rows offers new file, rename, and delete; new/rename edit inline. Peers
+ * editing a file show as identity-colored avatars on its row.
+ */
+import { useState, type KeyboardEvent, type MouseEvent } from 'react'
+import {
+  TreeChevron,
+  TreeContainer,
+  TreeIconSlot,
+  TreeLabel,
+  TreeLabelGroup,
+  TreeRow,
+} from '@site/ui/Tree'
+import { ContextMenu, ContextMenuItem } from '@ui/components/ContextMenu'
+import { Button } from '@ui/components/Button'
+import { Input } from '@ui/components/Input'
+import { pushToast } from '@ui/components/Toast'
+import { getErrorMessage } from '@core/utils/errorMessage'
+import { sitePluginFolder } from '@core/site-plugins'
+import { FilePlusSolidIcon } from 'pixel-art-icons/icons/file-plus-solid'
+import { FileTextSolidIcon } from 'pixel-art-icons/icons/file-text-solid'
+import { FolderGlyphIcon } from 'pixel-art-icons/icons/folder-glyph'
+import { PeerAvatar } from '@site/collab/PeerAvatar'
+import type { IdeFileMeta } from './ideCollab'
+import type { IdePeer } from './idePresence'
+import styles from './FileTreePane.module.css'
+
+interface TreeEntry {
+  key: string
+  kind: 'folder' | 'file'
+  label: string
+  depth: number
+  fileId?: string
+  /** Plugin-folder-relative path. */
+  path: string
+}
+
+interface MenuState {
+  x: number
+  y: number
+  entry: TreeEntry
+}
+
+/** Flatten paths into depth-annotated rows; folders derive from prefixes. */
+function buildRows(
+  files: IdeFileMeta[],
+  folder: string,
+  collapsed: ReadonlySet<string>,
+): TreeEntry[] {
+  const rows: TreeEntry[] = []
+  const seenFolders = new Set<string>()
+  for (const file of files) {
+    const relative = file.path.slice(folder.length)
+    const segments = relative.split('/')
+    let prefix = ''
+    let hidden = false
+    for (let depth = 0; depth < segments.length - 1; depth++) {
+      const segment = segments[depth]!
+      const folderPath = prefix ? `${prefix}/${segment}` : segment
+      if (!hidden && !seenFolders.has(folderPath)) {
+        seenFolders.add(folderPath)
+        rows.push({
+          key: `folder:${folderPath}`,
+          kind: 'folder',
+          label: segment,
+          depth,
+          path: folderPath,
+        })
+      }
+      if (collapsed.has(folderPath)) hidden = true
+      prefix = folderPath
+    }
+    if (!hidden) {
+      rows.push({
+        key: `file:${file.id}`,
+        kind: 'file',
+        label: segments[segments.length - 1] ?? relative,
+        depth: segments.length - 1,
+        fileId: file.id,
+        path: relative,
+      })
+    }
+  }
+  return rows
+}
+
+interface FileTreePaneProps {
+  localId: string
+  files: IdeFileMeta[]
+  activeFileId: string | null
+  peers: IdePeer[]
+  canEdit: boolean
+  onSelect: (fileId: string) => void
+  onCreate: (relativePath: string) => void
+  onRename: (fileId: string, relativePath: string) => void
+  onDelete: (fileId: string) => void
+}
+
+export function FileTreePane({
+  localId,
+  files,
+  activeFileId,
+  peers,
+  canEdit,
+  onSelect,
+  onCreate,
+  onRename,
+  onDelete,
+}: FileTreePaneProps) {
+  const folder = sitePluginFolder(localId)
+  const [collapsed, setCollapsed] = useState<ReadonlySet<string>>(new Set())
+  const [pendingNew, setPendingNew] = useState<string | null>(null) // parent folder ('' = root)
+  const [renamingFileId, setRenamingFileId] = useState<string | null>(null)
+  const [menu, setMenu] = useState<MenuState | null>(null)
+
+  const rows = buildRows(files, folder, collapsed)
+  const peersByFileId = new Map<string, IdePeer[]>()
+  for (const peer of peers) {
+    if (!peer.ideFile) continue
+    const bucket = peersByFileId.get(peer.ideFile.fileId) ?? []
+    bucket.push(peer)
+    peersByFileId.set(peer.ideFile.fileId, bucket)
+  }
+
+  const toggleFolder = (path: string): void => {
+    setCollapsed((current) => {
+      const next = new Set(current)
+      if (next.has(path)) next.delete(path)
+      else next.add(path)
+      return next
+    })
+  }
+
+  const openMenu = (event: MouseEvent, entry: TreeEntry): void => {
+    if (!canEdit) return
+    event.preventDefault()
+    event.stopPropagation()
+    setMenu({ x: event.clientX, y: event.clientY, entry })
+  }
+
+  const submitNew = (relativePath: string): void => {
+    setPendingNew(null)
+    const trimmed = relativePath.trim()
+    if (!trimmed) return
+    try {
+      onCreate(trimmed)
+    } catch (err) {
+      pushToast({
+        kind: 'error',
+        title: 'Could not create file',
+        body: getErrorMessage(err, 'Invalid path'),
+      })
+    }
+  }
+
+  const submitRename = (fileId: string, relativePath: string): void => {
+    setRenamingFileId(null)
+    const trimmed = relativePath.trim()
+    if (!trimmed) return
+    try {
+      onRename(fileId, trimmed)
+    } catch (err) {
+      pushToast({
+        kind: 'error',
+        title: 'Could not rename file',
+        body: getErrorMessage(err, 'Invalid path'),
+      })
+    }
+  }
+
+  return (
+    <div className={styles.pane} data-testid="ide-file-tree">
+      <header className={styles.header}>
+        <span className={styles.title}>Files</span>
+        <Button
+          variant="ghost"
+          size="micro"
+          iconOnly
+          aria-label="New file"
+          tooltip={canEdit ? 'New file' : 'Editing requires the site structure permission'}
+          disabled={!canEdit}
+          onClick={() => setPendingNew('')}
+          data-testid="ide-new-file"
+        >
+          <FilePlusSolidIcon size={14} aria-hidden="true" />
+        </Button>
+      </header>
+
+      <div className={styles.tree}>
+        <TreeContainer ariaLabel="Site plugin files">
+          {rows.map((entry) => {
+            const filePeers = entry.fileId ? (peersByFileId.get(entry.fileId) ?? []) : []
+            return (
+              <TreeRow
+                key={entry.key}
+                depth={entry.depth}
+                selected={entry.kind === 'file' && entry.fileId === activeFileId}
+                onClick={() => {
+                  if (entry.kind === 'folder') toggleFolder(entry.path)
+                  else if (entry.fileId) onSelect(entry.fileId)
+                }}
+                onContextMenu={(event) => openMenu(event, entry)}
+                data-testid={entry.kind === 'file' ? 'ide-file-row' : 'ide-folder-row'}
+                data-path={entry.path}
+              >
+                {entry.kind === 'folder' ? (
+                  <>
+                    <TreeChevron expanded={!collapsed.has(entry.path)} />
+                    <TreeIconSlot>
+                      <FolderGlyphIcon size={12} aria-hidden="true" />
+                    </TreeIconSlot>
+                  </>
+                ) : (
+                  <TreeIconSlot>
+                    <FileTextSolidIcon size={12} aria-hidden="true" />
+                  </TreeIconSlot>
+                )}
+                <TreeLabelGroup>
+                  {entry.kind === 'file' && renamingFileId === entry.fileId ? (
+                    <InlinePathInput
+                      defaultValue={entry.path}
+                      onSubmit={(value) => submitRename(entry.fileId!, value)}
+                      onCancel={() => setRenamingFileId(null)}
+                    />
+                  ) : (
+                    <TreeLabel>{entry.label}</TreeLabel>
+                  )}
+                </TreeLabelGroup>
+                {filePeers.length > 0 && (
+                  <span
+                    className={styles.rowPeers}
+                    aria-label={`${filePeers.length} peer(s) editing this file`}
+                  >
+                    {filePeers.slice(0, 3).map((peer) => (
+                      <PeerAvatar key={peer.clientId} user={peer.user} size={14} />
+                    ))}
+                  </span>
+                )}
+              </TreeRow>
+            )
+          })}
+
+          {pendingNew !== null && (
+            <TreeRow depth={pendingNew === '' ? 0 : pendingNew.split('/').length}>
+              <TreeIconSlot>
+                <FilePlusSolidIcon size={12} aria-hidden="true" />
+              </TreeIconSlot>
+              <TreeLabelGroup>
+                <InlinePathInput
+                  defaultValue={pendingNew === '' ? '' : `${pendingNew}/`}
+                  placeholder="path/to/file.ts"
+                  onSubmit={submitNew}
+                  onCancel={() => setPendingNew(null)}
+                />
+              </TreeLabelGroup>
+            </TreeRow>
+          )}
+        </TreeContainer>
+      </div>
+
+      <footer className={styles.footer}>
+        <p className={styles.hint}>
+          Files live in <code>{folder}</code> and save live — every open
+          editor co-edits the same draft.
+        </p>
+      </footer>
+
+      {menu && (
+        <ContextMenu
+          x={menu.x}
+          y={menu.y}
+          ariaLabel="File actions"
+          onClose={() => setMenu(null)}
+        >
+          {menu.entry.kind === 'folder' ? (
+            <ContextMenuItem
+              onClick={() => {
+                setPendingNew(menu.entry.path)
+                setMenu(null)
+              }}
+            >
+              New file…
+            </ContextMenuItem>
+          ) : (
+            <>
+              <ContextMenuItem
+                onClick={() => {
+                  setRenamingFileId(menu.entry.fileId ?? null)
+                  setMenu(null)
+                }}
+              >
+                Rename…
+              </ContextMenuItem>
+              <ContextMenuItem
+                danger
+                disabled={menu.entry.path === 'plugin.json'}
+                tooltip={
+                  menu.entry.path === 'plugin.json'
+                    ? 'plugin.json is required — delete the whole site plugin instead'
+                    : undefined
+                }
+                onClick={() => {
+                  if (menu.entry.fileId) onDelete(menu.entry.fileId)
+                  setMenu(null)
+                }}
+              >
+                Delete file
+              </ContextMenuItem>
+            </>
+          )}
+        </ContextMenu>
+      )}
+    </div>
+  )
+}
+
+interface InlinePathInputProps {
+  defaultValue: string
+  placeholder?: string
+  onSubmit: (value: string) => void
+  onCancel: () => void
+}
+
+function InlinePathInput({ defaultValue, placeholder, onSubmit, onCancel }: InlinePathInputProps) {
+  const [value, setValue] = useState(defaultValue)
+  const handleKeyDown = (event: KeyboardEvent<HTMLInputElement>): void => {
+    if (event.key === 'Enter') {
+      event.preventDefault()
+      onSubmit(value)
+    } else if (event.key === 'Escape') {
+      event.preventDefault()
+      onCancel()
+    }
+  }
+  return (
+    <Input
+      autoFocus
+      value={value}
+      placeholder={placeholder}
+      aria-label="File path"
+      className={styles.inlineInput}
+      onChange={(event) => setValue(event.currentTarget.value)}
+      onKeyDown={handleKeyDown}
+      onBlur={onCancel}
+      onClick={(event) => event.stopPropagation()}
+    />
+  )
+}
diff --git a/src/admin/pages/plugins/ide/IdeActions.module.css b/src/admin/pages/plugins/ide/IdeActions.module.css
new file mode 100644
index 000000000..520b14f63
--- /dev/null
+++ b/src/admin/pages/plugins/ide/IdeActions.module.css
@@ -0,0 +1,44 @@
+.actions {
+  display: flex;
+  align-items: center;
+  gap: var(--space-xs);
+}
+
+.peerStack {
+  display: inline-flex;
+  align-items: center;
+  padding-right: var(--space-3xs);
+}
+
+.peerAvatar {
+  margin-left: calc(-1 * var(--space-3xs));
+}
+
+.peerAvatar:first-child {
+  margin-left: 0;
+}
+
+.stateChip {
+  padding: var(--space-px) var(--space-s);
+  border-radius: var(--radius-sm);
+  font-size: var(--text-2xs);
+  font-weight: 600;
+  letter-spacing: 0.02em;
+  white-space: nowrap;
+  color: var(--text-subtle);
+  background: var(--bg-surface-3);
+}
+
+.stateChip[data-state='active'] {
+  color: var(--success-text);
+}
+
+.stateChip[data-state='build-failed'],
+.stateChip[data-state='runtime-error'],
+.stateChip[data-state='source-missing'] {
+  color: var(--danger);
+}
+
+.stateChip[data-state='permission-review'] {
+  color: var(--warning);
+}
diff --git a/src/admin/pages/plugins/ide/IdeActions.tsx b/src/admin/pages/plugins/ide/IdeActions.tsx
new file mode 100644
index 000000000..c2fb9e08f
--- /dev/null
+++ b/src/admin/pages/plugins/ide/IdeActions.tsx
@@ -0,0 +1,230 @@
+/**
+ * IdeActions — the IDE toolbar's right slot: peer avatar stack, runtime
+ * state chip, ONE state-appropriate smart primary action, an optional
+ * `Preview in canvas` secondary (module drafts), and the overflow menu.
+ * Unavailable actions are disabled with an inline reason, never hidden.
+ */
+import { useRef, useState } from 'react'
+import {
+  sitePluginPrimaryAction,
+  sitePluginStateLabel,
+  type SitePluginSummary,
+} from '@core/site-plugins'
+import { Button } from '@ui/components/Button'
+import { ContextMenu, ContextMenuItem, ContextMenuSeparator } from '@ui/components/ContextMenu'
+import { MoreHorizontalSolidIcon } from 'pixel-art-icons/icons/more-horizontal-solid'
+import { PeerAvatar } from '@site/collab/PeerAvatar'
+import type { IdePeer } from './idePresence'
+import styles from './IdeActions.module.css'
+
+interface IdeActionsProps {
+  summary: SitePluginSummary | null
+  peers: IdePeer[]
+  canInstall: boolean
+  activating: boolean
+  onActivate: () => void
+  onPreview: () => void
+  onRollback: () => void
+  onSetEnabled: (enabled: boolean) => void
+  onRestart: () => void
+  onRerunDiagnostics: () => void
+  onOpenSettings: () => void
+  onDelete: () => void
+  onShowDiagnostics: () => void
+}
+
+export function IdeActions({
+  summary,
+  peers,
+  canInstall,
+  activating,
+  onActivate,
+  onPreview,
+  onRollback,
+  onSetEnabled,
+  onRestart,
+  onRerunDiagnostics,
+  onOpenSettings,
+  onDelete,
+  onShowDiagnostics,
+}: IdeActionsProps) {
+  const [menuOpen, setMenuOpen] = useState(false)
+  const overflowRef = useRef<HTMLButtonElement | null>(null)
+
+  const state = summary?.state ?? null
+  const primary = state ? sitePluginPrimaryAction(state) : null
+
+  const uniquePeers = new Map(peers.map((peer) => [peer.user.id, peer]))
+
+  const runPrimary = (): void => {
+    if (!primary) return
+    switch (primary.action) {
+      case 'activate':
+        onActivate()
+        return
+      case 'review':
+        // The review moment IS activation — the server enforces step-up and
+        // the dialog shows the grant diff before anything changes.
+        onActivate()
+        return
+      case 'diagnostics':
+        onShowDiagnostics()
+        return
+      case 'logs':
+        onOpenSettings()
+        return
+      case 'delete':
+        onDelete()
+        return
+      case 'enable':
+        onSetEnabled(true)
+        return
+      case null:
+        return
+    }
+  }
+
+  const needsInstallCap = primary?.action === 'activate' || primary?.action === 'review' || primary?.action === 'enable' || primary?.action === 'delete'
+  const primaryDisabled = activating || (needsInstallCap && !canInstall)
+
+  return (
+    <div className={styles.actions}>
+      {uniquePeers.size > 0 && (
+        <span className={styles.peerStack} aria-label={`${uniquePeers.size} other editor(s) in this IDE`}>
+          {[...uniquePeers.values()].slice(0, 4).map((peer) => (
+            <PeerAvatar key={peer.user.id} user={peer.user} size={18} className={styles.peerAvatar} />
+          ))}
+        </span>
+      )}
+
+      {state && (
+        <span className={styles.stateChip} data-state={state} data-testid="ide-state-chip">
+          {sitePluginStateLabel(state)}
+        </span>
+      )}
+
+      {summary?.hasModules && summary.hasDraftSource && (
+        <Button variant="secondary" size="sm" onClick={onPreview} data-testid="ide-preview">
+          Preview in canvas
+        </Button>
+      )}
+
+      {primary && primary.action !== null && (
+        <Button
+          variant="primary"
+          size="sm"
+          disabled={primaryDisabled}
+          tooltip={
+            needsInstallCap && !canInstall
+              ? 'Requires the plugins.install permission'
+              : undefined
+          }
+          onClick={runPrimary}
+          data-testid="ide-primary-action"
+        >
+          {activating && primary.action === 'activate' ? 'Building…' : primary.label}
+        </Button>
+      )}
+
+      <Button
+        ref={overflowRef}
+        variant="ghost"
+        size="sm"
+        iconOnly
+        aria-label="More actions"
+        tooltip="More actions"
+        onClick={() => setMenuOpen((open) => !open)}
+        data-testid="ide-overflow"
+      >
+        <MoreHorizontalSolidIcon size={14} aria-hidden="true" />
+      </Button>
+
+      {menuOpen && (
+        <ContextMenu
+          anchorRef={overflowRef}
+          ariaLabel="Site plugin actions"
+          onClose={() => setMenuOpen(false)}
+          minWidth={230}
+        >
+          <ContextMenuItem
+            disabled={!summary?.hasModules || !summary.hasDraftSource}
+            tooltip={!summary?.hasModules ? 'The draft declares no module pack' : undefined}
+            onClick={() => {
+              onPreview()
+              setMenuOpen(false)
+            }}
+          >
+            Preview in canvas
+          </ContextMenuItem>
+          <ContextMenuItem
+            onClick={() => {
+              onRerunDiagnostics()
+              setMenuOpen(false)
+            }}
+          >
+            Re-run diagnostics
+          </ContextMenuItem>
+          <ContextMenuSeparator />
+          <ContextMenuItem
+            disabled={!canInstall || !summary?.activeVersion}
+            tooltip={
+              !canInstall
+                ? 'Requires the plugins.install permission'
+                : !summary?.activeVersion
+                  ? 'Nothing is activated yet'
+                  : undefined
+            }
+            onClick={() => {
+              onRollback()
+              setMenuOpen(false)
+            }}
+          >
+            Rollback to previous revision
+          </ContextMenuItem>
+          <ContextMenuItem
+            disabled={!summary?.activeVersion || summary.state === 'disabled'}
+            tooltip={!summary?.activeVersion ? 'Nothing is activated yet' : undefined}
+            onClick={() => {
+              onSetEnabled(false)
+              setMenuOpen(false)
+            }}
+          >
+            Deactivate
+          </ContextMenuItem>
+          <ContextMenuItem
+            disabled={!summary?.activeVersion}
+            tooltip={!summary?.activeVersion ? 'Nothing is activated yet' : undefined}
+            onClick={() => {
+              onRestart()
+              setMenuOpen(false)
+            }}
+          >
+            Restart
+          </ContextMenuItem>
+          <ContextMenuItem
+            disabled={!summary?.activeVersion}
+            tooltip={!summary?.activeVersion ? 'Settings exist after the first activation' : undefined}
+            onClick={() => {
+              onOpenSettings()
+              setMenuOpen(false)
+            }}
+          >
+            Open plugin settings
+          </ContextMenuItem>
+          <ContextMenuSeparator />
+          <ContextMenuItem
+            danger
+            disabled={!canInstall}
+            tooltip={!canInstall ? 'Requires the plugins.install permission' : undefined}
+            onClick={() => {
+              onDelete()
+              setMenuOpen(false)
+            }}
+          >
+            Delete site plugin
+          </ContextMenuItem>
+        </ContextMenu>
+      )}
+    </div>
+  )
+}
diff --git a/src/admin/pages/plugins/ide/IdeFileEditor.tsx b/src/admin/pages/plugins/ide/IdeFileEditor.tsx
new file mode 100644
index 000000000..a55140197
--- /dev/null
+++ b/src/admin/pages/plugins/ide/IdeFileEditor.tsx
@@ -0,0 +1,45 @@
+/**
+ * IdeFileEditor — one co-edited code buffer in the Plugin IDE.
+ *
+ * Lazy-mounts the collab CodeMirror module (CodeMirror stays out of the
+ * eager admin graph) bound to the file's Y.Text: keystrokes stream live
+ * over the site socket, peers' edits and carets render in place, undo is
+ * per-file and local-only.
+ */
+import { lazy, Suspense } from 'react'
+import type { IdeCollabSession } from './ideCollab'
+import { ideLanguageForPath } from './ideLanguage'
+import styles from './SitePluginIdePage.module.css'
+
+const CollabCodeMirrorEditor = lazy(
+  () => import('@site/code-editor/CollabCodeMirrorEditor'),
+)
+
+interface IdeFileEditorProps {
+  session: IdeCollabSession
+  fileId: string
+  path: string
+  readOnly: boolean
+}
+
+export function IdeFileEditor({ session, fileId, path, readOnly }: IdeFileEditorProps) {
+  const text = session.contentText(fileId)
+  if (!text) {
+    return <div className={styles.editorEmpty}>This file has no editable text content.</div>
+  }
+
+  return (
+    <Suspense fallback={<div className={styles.editorEmpty}>Loading editor…</div>}>
+      <div className={styles.editorMount} data-testid="ide-code-editor">
+        <CollabCodeMirrorEditor
+          docKey={fileId}
+          language={ideLanguageForPath(path)}
+          text={text}
+          awareness={session.provider.awareness}
+          undoManager={session.undoManagerFor(fileId) ?? false}
+          readOnly={readOnly}
+        />
+      </div>
+    </Suspense>
+  )
+}
diff --git a/src/admin/pages/plugins/ide/IdeSidebar.tsx b/src/admin/pages/plugins/ide/IdeSidebar.tsx
new file mode 100644
index 000000000..125611045
--- /dev/null
+++ b/src/admin/pages/plugins/ide/IdeSidebar.tsx
@@ -0,0 +1,43 @@
+/**
+ * IdeSidebar — the IDE's left sidebar shell: the shared left-sidebar chrome
+ * (width CSS vars + resize handle + persisted width) without a panel rail —
+ * the IDE has exactly one pane (Files), so a rail would be dead chrome.
+ */
+import { useRef, type CSSProperties, type ReactNode } from 'react'
+import { useWorkspaceLayout } from '@admin/state/workspaceLayout'
+import { SidebarResizeHandle } from '@admin/shared/SidebarResizeHandle'
+import leftSidebarStyles from '@site/sidebars/LeftSidebar/LeftSidebar.module.css'
+
+export function IdeSidebar({ children }: { children: ReactNode }) {
+  const sidebarRef = useRef<HTMLElement | null>(null)
+  const leftSidebarWidth = useWorkspaceLayout((s) => s.leftSidebarWidth)
+  const setLeftSidebarWidth = useWorkspaceLayout((s) => s.setLeftSidebarWidth)
+  const style = {
+    '--left-sidebar-panel-width': `${leftSidebarWidth}px`,
+    '--left-sidebar-panel-layout-width': `${leftSidebarWidth}px`,
+  } as CSSProperties
+
+  return (
+    <aside
+      ref={sidebarRef}
+      className={leftSidebarStyles.sidebar}
+      data-testid="ide-left-sidebar"
+      data-expanded="true"
+      data-active-panel="files"
+      style={style}
+    >
+      <div className={leftSidebarStyles.panelSlot}>
+        <div className={leftSidebarStyles.panelMount}>{children}</div>
+      </div>
+      <SidebarResizeHandle
+        side="left"
+        width={leftSidebarWidth}
+        targetRef={sidebarRef}
+        cssVariable="--left-sidebar-panel-width"
+        layoutCssVariable="--left-sidebar-panel-layout-width"
+        ariaLabel="Resize file tree"
+        onResize={setLeftSidebarWidth}
+      />
+    </aside>
+  )
+}
diff --git a/src/admin/pages/plugins/ide/ManifestPane.module.css b/src/admin/pages/plugins/ide/ManifestPane.module.css
new file mode 100644
index 000000000..70dd977c1
--- /dev/null
+++ b/src/admin/pages/plugins/ide/ManifestPane.module.css
@@ -0,0 +1,176 @@
+.pane {
+  display: flex;
+  flex-direction: column;
+  height: 100%;
+  min-height: 0;
+  overflow-y: auto;
+  background: var(--bg-surface-2);
+}
+
+.header {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: var(--space-s) var(--space-m);
+  border-bottom: 1px solid var(--border-muted);
+  background: var(--bg-surface-2);
+}
+
+.title {
+  margin: 0;
+  font-size: var(--text-xs);
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: var(--text-subtle);
+}
+
+.sections {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-m);
+  padding: var(--space-m);
+}
+
+.section {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-xs);
+}
+
+.sectionTitle {
+  margin: 0;
+  font-size: var(--text-xs);
+  font-weight: 600;
+  color: var(--text);
+}
+
+.sectionHint {
+  margin: 0;
+  font-size: var(--text-xs);
+  line-height: 1.5;
+  color: var(--text-subtle);
+}
+
+.fieldLabel {
+  font-size: var(--text-xs);
+  color: var(--text-subtle);
+}
+
+.permissionList {
+  margin: 0;
+  padding: 0;
+  list-style: none;
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-3xs);
+}
+
+.permissionRow {
+  display: flex;
+  align-items: center;
+  gap: var(--space-s);
+}
+
+.permissionText {
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+}
+
+.permissionId {
+  font-family: var(--font-mono);
+  font-size: var(--text-2xs);
+  color: var(--text);
+}
+
+.permissionLabel {
+  font-size: var(--text-2xs);
+  color: var(--text-subtle);
+}
+
+.dangerNote {
+  margin: 0;
+  padding: var(--space-xs) var(--space-s);
+  border-radius: var(--radius);
+  font-size: var(--text-xs);
+  line-height: 1.5;
+  color: var(--text);
+  background: var(--bg-surface-3);
+  border-left: 2px solid var(--danger);
+}
+
+.hostList {
+  margin: 0;
+  padding: 0;
+  list-style: none;
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-3xs);
+}
+
+.hostRow {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: var(--space-s);
+}
+
+.hostName {
+  font-family: var(--font-mono);
+  font-size: var(--text-xs);
+  color: var(--text);
+}
+
+.hostAdd {
+  display: flex;
+  align-items: center;
+  gap: var(--space-xs);
+}
+
+.derivedList {
+  display: grid;
+  grid-template-columns: auto 1fr;
+  gap: var(--space-3xs) var(--space-s);
+  margin: 0;
+  font-size: var(--text-xs);
+}
+
+.derivedList dt {
+  color: var(--text-subtle);
+}
+
+.derivedList dd {
+  margin: 0;
+  color: var(--text);
+  overflow-wrap: anywhere;
+}
+
+.derivedList code {
+  font-family: var(--font-mono);
+  font-size: var(--text-2xs);
+}
+
+.parseError {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-s);
+  padding: var(--space-m);
+  font-size: var(--text-xs);
+  color: var(--text);
+}
+
+.parseError p {
+  margin: 0;
+}
+
+.parseErrorDetail {
+  font-family: var(--font-mono);
+  font-size: var(--text-2xs);
+  color: var(--danger);
+  white-space: pre-wrap;
+  word-break: break-word;
+}
diff --git a/src/admin/pages/plugins/ide/ManifestPane.tsx b/src/admin/pages/plugins/ide/ManifestPane.tsx
new file mode 100644
index 000000000..742e53d8a
--- /dev/null
+++ b/src/admin/pages/plugins/ide/ManifestPane.tsx
@@ -0,0 +1,288 @@
+/**
+ * ManifestPane — the structured `plugin.json` editor (the IDE's right panel).
+ *
+ * The panel is the PRIMARY manifest surface: name/description fields,
+ * a permission checklist (with the dangerous-code warning on editor.code),
+ * network allowlist entries, and read-only derived fields (id, active
+ * version, detected entrypoints). Raw JSON stays available by opening
+ * plugin.json in the editor — the escape hatch, not the default.
+ *
+ * Writes rewrite the plugin.json file content as a minimal Y.Text splice,
+ * so a peer's concurrent manifest edit merges instead of clobbering.
+ */
+import { useSyncExternalStore, useCallback, useRef, useState } from 'react'
+import { safeParseJson } from '@core/utils/jsonValidate'
+import {
+  SitePluginDraftManifestSchema,
+  sitePluginIdFromLocalId,
+  type SitePluginDraftManifest,
+  type SitePluginSummary,
+} from '@core/site-plugins'
+import {
+  PLUGIN_PERMISSION_VALUES,
+  permissionLabel,
+  type PluginPermission,
+} from '@core/plugin-sdk'
+import { Button } from '@ui/components/Button'
+import { Input } from '@ui/components/Input'
+import { Switch } from '@ui/components/Switch'
+import { Separator } from '@ui/components/Separator'
+import type { IdeCollabSession, IdeFileMeta } from './ideCollab'
+import styles from './ManifestPane.module.css'
+
+interface ManifestPaneProps {
+  session: IdeCollabSession
+  localId: string
+  files: IdeFileMeta[]
+  summary: SitePluginSummary | null
+  canEdit: boolean
+  onOpenRawJson: () => void
+}
+
+interface ParsedManifest {
+  manifest: SitePluginDraftManifest | null
+  error: string | null
+  raw: string
+}
+
+function parseManifest(raw: string | null): ParsedManifest {
+  if (raw === null) {
+    return { manifest: null, error: 'plugin.json is missing', raw: '' }
+  }
+  const result = safeParseJson(raw, SitePluginDraftManifestSchema)
+  if (!result.ok) {
+    return { manifest: null, error: result.error.message, raw }
+  }
+  return { manifest: result.value, error: null, raw }
+}
+
+export function ManifestPane({
+  session,
+  localId,
+  files,
+  summary,
+  canEdit,
+  onOpenRawJson,
+}: ManifestPaneProps) {
+  const manifestFile = files.find((file) => file.path.endsWith('/plugin.json')) ?? null
+  const manifestFileId = manifestFile?.id ?? null
+
+  // Manifest content is CRDT state — subscribe to the file's text and parse
+  // per change (cached snapshot keeps renders referentially stable).
+  const parsedCache = useRef<ParsedManifest & { source: string | null }>({
+    manifest: null,
+    error: 'plugin.json is missing',
+    raw: '',
+    source: null,
+  })
+  const subscribe = useCallback(
+    (onStoreChange: () => void) => session.onFilesChange(onStoreChange),
+    [session],
+  )
+  const getSnapshot = useCallback((): ParsedManifest => {
+    const raw = manifestFileId ? (session.contentText(manifestFileId)?.toString() ?? null) : null
+    if (raw !== parsedCache.current.source) {
+      parsedCache.current = { ...parseManifest(raw), source: raw }
+    }
+    return parsedCache.current
+  }, [session, manifestFileId])
+  const parsed = useSyncExternalStore(subscribe, getSnapshot)
+
+  const [hostDraft, setHostDraft] = useState('')
+
+  const writeManifest = (update: (current: SitePluginDraftManifest) => SitePluginDraftManifest): void => {
+    if (!manifestFileId || !parsed.manifest) return
+    const next = update(parsed.manifest)
+    session.replaceFileContent(manifestFileId, `${JSON.stringify(next, null, 2)}\n`)
+  }
+
+  const permissions = parsed.manifest?.permissions ?? []
+  const togglePermission = (permission: PluginPermission, enabled: boolean): void => {
+    writeManifest((current) => ({
+      ...current,
+      permissions: enabled
+        ? [...(current.permissions ?? []), permission]
+        : (current.permissions ?? []).filter((p) => p !== permission),
+    }))
+  }
+
+  const hosts = parsed.manifest?.networkAllowedHosts ?? []
+  const addHost = (): void => {
+    const host = hostDraft.trim().toLowerCase()
+    if (!host || hosts.includes(host)) return
+    writeManifest((current) => ({
+      ...current,
+      networkAllowedHosts: [...(current.networkAllowedHosts ?? []), host],
+    }))
+    setHostDraft('')
+  }
+  const removeHost = (host: string): void => {
+    writeManifest((current) => {
+      const remaining = (current.networkAllowedHosts ?? []).filter((h) => h !== host)
+      const next = { ...current }
+      if (remaining.length > 0) next.networkAllowedHosts = remaining
+      else delete next.networkAllowedHosts
+      return next
+    })
+  }
+
+  const detectedEntrypoints = detectEntrypoints(files)
+
+  return (
+    <div className={styles.pane} data-testid="ide-manifest-pane">
+      <header className={styles.header}>
+        <h2 className={styles.title}>Manifest</h2>
+        <Button variant="ghost" size="xs" onClick={onOpenRawJson}>
+          Edit raw JSON
+        </Button>
+      </header>
+
+      {parsed.error ? (
+        <div className={styles.parseError} role="alert">
+          <p>plugin.json can’t be edited structurally right now:</p>
+          <p className={styles.parseErrorDetail}>{parsed.error}</p>
+          <Button variant="secondary" size="sm" onClick={onOpenRawJson}>
+            Fix in raw JSON
+          </Button>
+        </div>
+      ) : (
+        <div className={styles.sections}>
+          <section className={styles.section}>
+            <label className={styles.fieldLabel} htmlFor="ide-manifest-name">
+              Name
+            </label>
+            <Input
+              id="ide-manifest-name"
+              value={parsed.manifest?.name ?? ''}
+              disabled={!canEdit}
+              onChange={(event) => {
+                const name = event.currentTarget.value
+                writeManifest((current) => ({ ...current, name }))
+              }}
+            />
+            <label className={styles.fieldLabel} htmlFor="ide-manifest-description">
+              Description
+            </label>
+            <Input
+              id="ide-manifest-description"
+              value={parsed.manifest?.description ?? ''}
+              disabled={!canEdit}
+              onChange={(event) => {
+                const description = event.currentTarget.value
+                writeManifest((current) => ({ ...current, description }))
+              }}
+            />
+          </section>
+
+          <Separator />
+
+          <section className={styles.section}>
+            <h3 className={styles.sectionTitle}>Permissions</h3>
+            <p className={styles.sectionHint}>
+              Declared here; granted by an operator at Build &amp; activate.
+            </p>
+            <ul className={styles.permissionList}>
+              {PLUGIN_PERMISSION_VALUES.map((permission) => (
+                <li key={permission} className={styles.permissionRow}>
+                  <Switch
+                    checked={permissions.includes(permission)}
+                    disabled={!canEdit}
+                    onCheckedChange={(checked) => togglePermission(permission, checked)}
+                    aria-label={`Permission ${permission}`}
+                  />
+                  <span className={styles.permissionText}>
+                    <span className={styles.permissionId}>{permission}</span>
+                    <span className={styles.permissionLabel}>{permissionLabel(permission)}</span>
+                  </span>
+                </li>
+              ))}
+            </ul>
+            {permissions.includes('editor.code') && (
+              <p className={styles.dangerNote} role="note">
+                editor.code runs this plugin’s JavaScript unsandboxed in every
+                admin’s browser. Operators see a warning before granting it.
+              </p>
+            )}
+          </section>
+
+          <Separator />
+
+          <section className={styles.section}>
+            <h3 className={styles.sectionTitle}>Outbound network hosts</h3>
+            <p className={styles.sectionHint}>
+              Requires the network.outbound permission. One hostname per entry;
+              `*.example.com` matches one subdomain level.
+            </p>
+            <ul className={styles.hostList}>
+              {hosts.map((host) => (
+                <li key={host} className={styles.hostRow}>
+                  <code className={styles.hostName}>{host}</code>
+                  <Button
+                    variant="ghost"
+                    size="micro"
+                    disabled={!canEdit}
+                    onClick={() => removeHost(host)}
+                  >
+                    Remove
+                  </Button>
+                </li>
+              ))}
+            </ul>
+            <div className={styles.hostAdd}>
+              <Input
+                value={hostDraft}
+                placeholder="api.example.com"
+                aria-label="Add allowed host"
+                disabled={!canEdit}
+                onChange={(event) => setHostDraft(event.currentTarget.value)}
+                onKeyDown={(event) => {
+                  if (event.key === 'Enter') {
+                    event.preventDefault()
+                    addHost()
+                  }
+                }}
+              />
+              <Button variant="secondary" size="xs" disabled={!canEdit || !hostDraft.trim()} onClick={addHost}>
+                Add
+              </Button>
+            </div>
+          </section>
+
+          <Separator />
+
+          <section className={styles.section}>
+            <h3 className={styles.sectionTitle}>Derived by the build</h3>
+            <dl className={styles.derivedList}>
+              <dt>Plugin id</dt>
+              <dd>
+                <code>{sitePluginIdFromLocalId(localId)}</code>
+              </dd>
+              <dt>Active version</dt>
+              <dd>{summary?.activeVersion ?? 'not built yet'}</dd>
+              <dt>Entrypoints</dt>
+              <dd>
+                {detectedEntrypoints.length > 0 ? detectedEntrypoints.join(', ') : 'none detected'}
+              </dd>
+            </dl>
+          </section>
+        </div>
+      )}
+    </div>
+  )
+}
+
+function detectEntrypoints(files: IdeFileMeta[]): string[] {
+  const relative = files.map((file) => file.path.split('/').slice(2).join('/'))
+  const has = (base: string): boolean =>
+    ['ts', 'tsx', 'js', 'mjs'].some(
+      (ext) => relative.includes(`${base}.${ext}`) || relative.includes(`${base}/index.${ext}`),
+    )
+  const detected: string[] = []
+  if (has('server')) detected.push('server')
+  if (has('editor')) detected.push('editor')
+  if (relative.some((p) => p.startsWith('modules/') && /\.(tsx?|m?js)$/.test(p))) {
+    detected.push('modules')
+  }
+  if (relative.some((p) => p.startsWith('frontend/'))) detected.push('frontend')
+  return detected
+}
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.module.css b/src/admin/pages/plugins/ide/SitePluginIdePage.module.css
new file mode 100644
index 000000000..332eae6b9
--- /dev/null
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.module.css
@@ -0,0 +1,51 @@
+.editorColumn {
+  display: flex;
+  flex-direction: column;
+  height: 100%;
+  min-height: 0;
+  background: var(--bg-surface);
+}
+
+.editorArea {
+  flex: 1;
+  min-height: 0;
+  overflow: auto;
+  display: flex;
+  flex-direction: column;
+}
+
+.editorArea :global([data-codemirror-container]) {
+  height: 100%;
+}
+
+.editorMount {
+  height: 100%;
+  min-height: 0;
+}
+
+.editorEmpty {
+  flex: 1;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: var(--space-xl);
+  color: var(--text-subtle);
+  font-size: var(--text-s);
+  text-align: center;
+}
+
+.missing {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: var(--space-s);
+  height: 100%;
+  color: var(--text-subtle);
+}
+
+.missingTitle {
+  margin: 0;
+  font-size: var(--text-l);
+  color: var(--text);
+}
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
new file mode 100644
index 000000000..088ba6fde
--- /dev/null
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
@@ -0,0 +1,222 @@
+/**
+ * SitePluginIdePage — the full-screen Plugin IDE
+ * (`/admin/plugins/develop/:localId`).
+ *
+ * Renders in the same workspace canvas shell Content/Data/Media use:
+ * standard toolbar + section nav, a resizable left file tree, the co-edited
+ * CodeMirror buffer with the diagnostics strip beneath it, and the
+ * collapsible manifest panel on the right (edge-notch reopen, persisted
+ * layout — all owned by the layout).
+ *
+ * Everything here co-edits live: files are CRDT state on the site socket,
+ * peers' carets render inline, and there is no save button — Cmd+S re-runs
+ * diagnostics for muscle memory.
+ */
+import { useEffect, useState } from 'react'
+import { AdminWorkspaceCanvasLayout } from '@admin/layouts/AdminWorkspaceCanvasLayout/AdminWorkspaceCanvasLayout'
+import { useNavigate, useParams } from '@admin/lib/routing'
+import { useAuthenticatedAdminUser } from '@admin/sessionContext'
+import { canEditStructure, canInstallPlugins } from '@admin/access'
+import { ConfirmDeleteDialog } from '@admin/shared/dialogs/ConfirmDeleteDialog/ConfirmDeleteDialog'
+import { SITE_PLUGIN_LOCAL_ID_PATTERN, sitePluginFolder } from '@core/site-plugins'
+import { useSitePluginIde } from './useSitePluginIde'
+import { useIdePeers, usePublishIdePresence } from './idePresence'
+import { FileTreePane } from './FileTreePane'
+import { IdeFileEditor } from './IdeFileEditor'
+import { DiagnosticsStrip } from './DiagnosticsStrip'
+import { ManifestPane } from './ManifestPane'
+import { IdeActions } from './IdeActions'
+import { IdeSidebar } from './IdeSidebar'
+import styles from './SitePluginIdePage.module.css'
+
+export function SitePluginIdePage() {
+  const params = useParams<{ localId: string }>()
+  const rawLocalId = params.localId ?? ''
+  const localId = SITE_PLUGIN_LOCAL_ID_PATTERN.test(rawLocalId) ? rawLocalId : null
+
+  if (!localId) {
+    return (
+      <AdminWorkspaceCanvasLayout
+        workspace="pluginIde"
+        contentCanvas={(
+          <div className={styles.missing} role="alert">
+            <h1 className={styles.missingTitle}>Unknown site plugin</h1>
+            <p>“{rawLocalId}” is not a valid site plugin id.</p>
+          </div>
+        )}
+      />
+    )
+  }
+
+  return <SitePluginIde localId={localId} />
+}
+
+interface PendingDelete {
+  title: string
+  description: string
+  confirmLabel: string
+  commit: () => void
+}
+
+function SitePluginIde({ localId }: { localId: string }) {
+  const currentUser = useAuthenticatedAdminUser()
+  const navigate = useNavigate()
+  const canEdit = canEditStructure(currentUser)
+  const canInstall = canInstallPlugins(currentUser)
+  const [pendingDelete, setPendingDelete] = useState<PendingDelete | null>(null)
+
+  const vm = useSitePluginIde(localId)
+  const { session, files, activeFileId, selectFile, runValidation } = vm
+  const peers = useIdePeers(session, localId)
+
+  const activeFile = files.find((file) => file.id === activeFileId) ?? null
+  const folder = sitePluginFolder(localId)
+
+  usePublishIdePresence(
+    session,
+    currentUser,
+    localId,
+    activeFile ? { fileId: activeFile.id, path: activeFile.path } : null,
+  )
+
+  // Auto-select plugin.json (or the first file) once files arrive.
+  useEffect(() => {
+    if (activeFileId && files.some((file) => file.id === activeFileId)) return
+    const manifest = files.find((file) => file.path === `${folder}plugin.json`)
+    selectFile(manifest?.id ?? files[0]?.id ?? null)
+  }, [files, activeFileId, folder, selectFile])
+
+  // Cmd+S — there is nothing to save (edits persist live); honor the muscle
+  // memory by re-running diagnostics instead of the browser save dialog.
+  useEffect(() => {
+    const onKeyDown = (event: KeyboardEvent): void => {
+      if ((event.metaKey || event.ctrlKey) && event.key.toLowerCase() === 's') {
+        event.preventDefault()
+        runValidation()
+      }
+    }
+    window.addEventListener('keydown', onKeyDown)
+    return () => window.removeEventListener('keydown', onKeyDown)
+  }, [runValidation])
+
+  return (
+    <AdminWorkspaceCanvasLayout
+      workspace="pluginIde"
+      contentSidebar={(
+        <IdeSidebar>
+          <FileTreePane
+            localId={localId}
+            files={files}
+            activeFileId={activeFileId}
+            peers={peers}
+            canEdit={canEdit}
+            onSelect={selectFile}
+            onCreate={(relativePath) => {
+              if (!session) return
+              const id = session.createFile(`${folder}${relativePath}`)
+              selectFile(id)
+            }}
+            onRename={(fileId, relativePath) => {
+              session?.renameFile(fileId, `${folder}${relativePath}`)
+            }}
+            onDelete={(fileId) => {
+              const file = files.find((entry) => entry.id === fileId)
+              setPendingDelete({
+                title: `Delete ${file?.path.slice(folder.length) ?? 'this file'}?`,
+                description: 'The file is removed from the live draft for every editor.',
+                confirmLabel: 'Delete file',
+                commit: () => {
+                  session?.deleteFile(fileId)
+                  if (activeFileId === fileId) selectFile(null)
+                },
+              })
+            }}
+          />
+        </IdeSidebar>
+      )}
+      contentCanvas={(
+        <div className={styles.editorColumn} data-testid="ide-editor-column">
+          <div className={styles.editorArea}>
+            {!session || !vm.synced ? (
+              <div className={styles.editorEmpty} role="status">
+                Connecting to the live draft…
+              </div>
+            ) : activeFile ? (
+              <IdeFileEditor
+                session={session}
+                fileId={activeFile.id}
+                path={activeFile.path}
+                readOnly={!canEdit}
+              />
+            ) : (
+              <div className={styles.editorEmpty}>
+                {files.length === 0
+                  ? `No source yet — this plugin has no files under ${folder}.`
+                  : 'Select a file to start editing.'}
+              </div>
+            )}
+          </div>
+          <DiagnosticsStrip
+            diagnostics={vm.diagnostics}
+            validating={vm.validating}
+            synced={vm.synced}
+          />
+        </div>
+      )}
+      contentRightPanel={
+        session ? (
+          <ManifestPane
+            session={session}
+            localId={localId}
+            files={files}
+            summary={vm.summary}
+            canEdit={canEdit}
+            onOpenRawJson={() => {
+              const manifest = files.find((file) => file.path === `${folder}plugin.json`)
+              if (manifest) selectFile(manifest.id)
+            }}
+          />
+        ) : null
+      }
+      toolbarRightSlot={(
+        <>
+          <IdeActions
+            summary={vm.summary}
+            peers={peers}
+            canInstall={canInstall}
+            activating={vm.activating}
+            onActivate={() => void vm.activate()}
+            onPreview={vm.openPreview}
+            onRollback={() => void vm.rollback()}
+            onSetEnabled={(enabled) => void vm.setEnabled(enabled)}
+            onRestart={() => void vm.restart()}
+            onRerunDiagnostics={vm.runValidation}
+            onOpenSettings={() => navigate('/admin/plugins')}
+            onDelete={() =>
+              setPendingDelete({
+                title: `Delete site plugin “${localId}”?`,
+                description:
+                  'Removes the runtime plugin, its generated revisions, settings and secrets, AND the source folder from the draft.',
+                confirmLabel: 'Delete site plugin',
+                commit: () => void vm.deletePlugin(),
+              })
+            }
+            onShowDiagnostics={vm.runValidation}
+          />
+          {pendingDelete && (
+            <ConfirmDeleteDialog
+              title={pendingDelete.title}
+              description={pendingDelete.description}
+              confirmLabel={pendingDelete.confirmLabel}
+              onCancel={() => setPendingDelete(null)}
+              onConfirm={() => {
+                pendingDelete.commit()
+                setPendingDelete(null)
+              }}
+            />
+          )}
+        </>
+      )}
+    />
+  )
+}
diff --git a/src/admin/pages/plugins/ide/ideCollab.ts b/src/admin/pages/plugins/ide/ideCollab.ts
new file mode 100644
index 000000000..0f2591c1f
--- /dev/null
+++ b/src/admin/pages/plugins/ide/ideCollab.ts
@@ -0,0 +1,224 @@
+/**
+ * Plugin IDE collab session — the IDE's own bridge onto the site collab
+ * socket. Binds ONLY the site doc (`site:default`): plugin source files
+ * live in the shell's granular `files` Y.Map (entry per file id, `content`
+ * as Y.Text), so the IDE co-edits with the same machinery as the site
+ * editor — server-seeded docs, character-level merges, presence over the
+ * shared awareness — without loading pages, trees, or the editor store.
+ *
+ * File CRUD happens as direct Y transactions (IDE_ORIGIN); the relay
+ * persists on its debounce and the site editor's projection picks changes
+ * up live. Per-file Y.UndoManagers give each buffer its own local-only
+ * undo (the yCollab binding registers its origin on them).
+ */
+import * as Y from 'yjs'
+import {
+  applyTextDiff,
+  buildSiteFileEntry,
+  shellMap,
+  siteFileContentText,
+  MAIN_SITE_DOC_ID,
+} from '@core/collab'
+import { isSafePath, normalizePath } from '@core/files/pathValidation'
+import type { SiteFile } from '@core/files/schemas'
+import { sitePluginFolder } from '@core/site-plugins'
+import { nanoid } from 'nanoid'
+import {
+  createCollabProvider,
+  type CollabProvider,
+} from '@site/collab/collabProvider'
+
+/** Origin for IDE-local transactions — streamed by the provider (≠ remote). */
+export const IDE_ORIGIN = Symbol('plugin-ide-local')
+
+export interface IdeFileMeta {
+  id: string
+  path: string
+  updatedAt: number
+}
+
+export interface IdeCollabSession {
+  provider: CollabProvider
+  doc: Y.Doc
+  whenSynced: Promise<void>
+  synced(): boolean
+  /** Metadata of this plugin's files, path-sorted. Content stays in Y.Text. */
+  pluginFiles(): IdeFileMeta[]
+  onFilesChange(listener: () => void): () => void
+  contentText(fileId: string): Y.Text | null
+  /** Per-file undo manager (created on demand; local origins only). */
+  undoManagerFor(fileId: string): Y.UndoManager | null
+  createFile(path: string, content?: string): string
+  renameFile(fileId: string, nextPath: string): void
+  deleteFile(fileId: string): void
+  /** Whole-value content replace as a minimal Y.Text splice (manifest panel). */
+  replaceFileContent(fileId: string, content: string): void
+  destroy(): void
+}
+
+function projectFileMeta(id: string, entry: Y.Map<unknown>): IdeFileMeta {
+  const path = entry.get('path')
+  const updatedAt = entry.get('updatedAt')
+  return {
+    id,
+    path: typeof path === 'string' ? path : '',
+    updatedAt: typeof updatedAt === 'number' ? updatedAt : 0,
+  }
+}
+
+export function createIdeCollabSession(localId: string): IdeCollabSession {
+  const provider = createCollabProvider()
+  const binding = provider.bind(MAIN_SITE_DOC_ID)
+  const doc = binding.doc
+  const folder = sitePluginFolder(localId)
+  const filesListeners = new Set<() => void>()
+  const undoManagers = new Map<string, Y.UndoManager>()
+  let observedFilesMap: Y.Map<unknown> | null = null
+
+  const notifyFiles = (): void => {
+    for (const listener of filesListeners) listener()
+  }
+
+  const filesMap = (): Y.Map<unknown> | null => {
+    const value = shellMap(doc).get('files')
+    return value instanceof Y.Map ? value : null
+  }
+
+  // Observe the whole shell deeply — file metadata changes (path renames,
+  // membership) re-notify; pure content keystrokes also fire but the hook
+  // layer collapses them via a metadata signature, so React work stays
+  // proportional to structural changes.
+  const shellObserver = (): void => {
+    const current = filesMap()
+    if (current !== observedFilesMap) observedFilesMap = current
+    notifyFiles()
+  }
+  shellMap(doc).observeDeep(shellObserver)
+
+  const allFiles = (): Array<{ id: string; entry: Y.Map<unknown> }> => {
+    const map = filesMap()
+    if (!map) return []
+    const out: Array<{ id: string; entry: Y.Map<unknown> }> = []
+    for (const [id, entry] of map.entries()) {
+      if (entry instanceof Y.Map) out.push({ id, entry })
+    }
+    return out
+  }
+
+  const pathTaken = (path: string, exceptFileId?: string): boolean =>
+    allFiles().some(({ id, entry }) => id !== exceptFileId && entry.get('path') === path)
+
+  const requireSafePluginPath = (rawPath: string): string => {
+    const normalized = normalizePath(rawPath)
+    if (!normalized || !isSafePath(normalized)) {
+      throw new Error(`Invalid path: "${rawPath}"`)
+    }
+    if (!normalized.startsWith(folder)) {
+      throw new Error(`Site plugin files must stay under ${folder}`)
+    }
+    return normalized
+  }
+
+  return {
+    provider,
+    doc,
+    whenSynced: binding.whenSynced,
+    synced: () => binding.synced,
+
+    pluginFiles: () =>
+      allFiles()
+        .map(({ id, entry }) => projectFileMeta(id, entry))
+        .filter((file) => file.path.startsWith(folder))
+        .sort((a, b) => a.path.localeCompare(b.path)),
+
+    onFilesChange: (listener) => {
+      filesListeners.add(listener)
+      return () => {
+        filesListeners.delete(listener)
+      }
+    },
+
+    contentText: (fileId) => siteFileContentText(shellMap(doc), fileId),
+
+    undoManagerFor: (fileId) => {
+      const existing = undoManagers.get(fileId)
+      if (existing) return existing
+      const text = siteFileContentText(shellMap(doc), fileId)
+      if (!text) return null
+      // Tracks IDE transactions + whatever origins the yCollab binding
+      // registers on it; remote peers' edits are never undone locally.
+      const manager = new Y.UndoManager(text, {
+        trackedOrigins: new Set([IDE_ORIGIN]),
+        captureTimeout: 500,
+      })
+      undoManagers.set(fileId, manager)
+      return manager
+    },
+
+    createFile: (rawPath, content = '') => {
+      const path = requireSafePluginPath(rawPath)
+      if (pathTaken(path)) throw new Error(`A file at "${path}" already exists`)
+      const id = nanoid()
+      const now = Date.now()
+      const file: SiteFile = {
+        id,
+        path,
+        type: 'plugin',
+        content,
+        createdAt: now,
+        updatedAt: now,
+      }
+      doc.transact(() => {
+        let map = filesMap()
+        if (!map) {
+          map = new Y.Map<unknown>()
+          shellMap(doc).set('files', map)
+        }
+        map.set(id, buildSiteFileEntry(file))
+      }, IDE_ORIGIN)
+      return id
+    },
+
+    renameFile: (fileId, nextPath) => {
+      const path = requireSafePluginPath(nextPath)
+      if (pathTaken(path, fileId)) throw new Error(`A file at "${path}" already exists`)
+      const map = filesMap()
+      const entry = map?.get(fileId)
+      if (!(entry instanceof Y.Map)) return
+      doc.transact(() => {
+        entry.set('path', path)
+        entry.set('updatedAt', Date.now())
+      }, IDE_ORIGIN)
+    },
+
+    deleteFile: (fileId) => {
+      const map = filesMap()
+      if (!map?.has(fileId)) return
+      undoManagers.get(fileId)?.destroy()
+      undoManagers.delete(fileId)
+      doc.transact(() => {
+        map.delete(fileId)
+      }, IDE_ORIGIN)
+    },
+
+    replaceFileContent: (fileId, content) => {
+      const text = siteFileContentText(shellMap(doc), fileId)
+      const map = filesMap()
+      const entry = map?.get(fileId)
+      if (!text || !(entry instanceof Y.Map)) return
+      doc.transact(() => {
+        // Minimal splice (shared prefix/suffix preserved) so concurrent
+        // remote edits outside the change survive the replacement.
+        applyTextDiff(text, text.toString(), content)
+        entry.set('updatedAt', Date.now())
+      }, IDE_ORIGIN)
+    },
+
+    destroy: () => {
+      shellMap(doc).unobserveDeep(shellObserver)
+      for (const manager of undoManagers.values()) manager.destroy()
+      undoManagers.clear()
+      provider.destroy()
+    },
+  }
+}
diff --git a/src/admin/pages/plugins/ide/ideLanguage.ts b/src/admin/pages/plugins/ide/ideLanguage.ts
new file mode 100644
index 000000000..1b6a79a5d
--- /dev/null
+++ b/src/admin/pages/plugins/ide/ideLanguage.ts
@@ -0,0 +1,15 @@
+/**
+ * File-extension → CodeMirror language mapping for the Plugin IDE. Lives in
+ * its own module (not next to a component) so Fast Refresh stays intact.
+ */
+import type { CodeLanguage } from '@site/code-editor/CodeMirrorEditor'
+
+export function ideLanguageForPath(path: string): CodeLanguage {
+  if (path.endsWith('.tsx') || path.endsWith('.jsx')) return 'tsx'
+  if (path.endsWith('.ts') || path.endsWith('.js') || path.endsWith('.mjs')) return 'ts'
+  if (path.endsWith('.css')) return 'css'
+  if (path.endsWith('.json')) return 'json'
+  if (path.endsWith('.md')) return 'markdown'
+  if (path.endsWith('.html') || path.endsWith('.svg')) return 'html'
+  return 'text'
+}
diff --git a/src/admin/pages/plugins/ide/idePresence.ts b/src/admin/pages/plugins/ide/idePresence.ts
new file mode 100644
index 000000000..9f5a46890
--- /dev/null
+++ b/src/admin/pages/plugins/ide/idePresence.ts
@@ -0,0 +1,118 @@
+/**
+ * Plugin IDE presence — publishes this IDE session's identity + active file
+ * into the shared site-socket awareness, and reads peers back (validated —
+ * peer states are wire data).
+ *
+ * The published state is `EditorPresence`-compatible (identity block checked
+ * server-side against the session), so site editors count IDE users in
+ * their toolbar roster; the extra `ideFile` field is what IDE peers key on.
+ * Character-precise remote carets inside a code buffer ride y-codemirror's
+ * own `cursor` awareness field — this module never touches it.
+ */
+import { useEffect, useState } from 'react'
+import { safeParseValue, Type, type Static } from '@core/utils/typeboxHelpers'
+import { peerColor } from '@site/collab/awarenessState'
+import type { CmsCurrentUser } from '@core/persistence'
+import type { IdeCollabSession } from './ideCollab'
+
+const IdePresenceSchema = Type.Object({
+  user: Type.Object({
+    id: Type.String(),
+    name: Type.String(),
+    color: Type.String(),
+    avatarUrl: Type.Union([Type.String(), Type.Null()]),
+    gravatarHash: Type.Union([Type.String(), Type.Null()]),
+  }),
+  ideFile: Type.Union([
+    Type.Object({
+      localId: Type.String(),
+      fileId: Type.String(),
+      path: Type.String(),
+    }),
+    Type.Null(),
+  ]),
+})
+
+export type IdePresence = Static<typeof IdePresenceSchema>
+
+export interface IdePeer extends IdePresence {
+  clientId: number
+}
+
+/** Publish identity + active-file presence for this IDE session. */
+export function usePublishIdePresence(
+  session: IdeCollabSession | null,
+  user: CmsCurrentUser,
+  localId: string,
+  activeFile: { fileId: string; path: string } | null,
+): void {
+  const fileId = activeFile?.fileId ?? null
+  const path = activeFile?.path ?? null
+
+  useEffect(() => {
+    if (!session) return undefined
+    const awareness = session.provider.awareness
+    const previous = awareness.getLocalState()
+    awareness.setLocalState({
+      ...previous,
+      user: {
+        id: user.id,
+        name: user.displayName,
+        color: peerColor(user.id),
+        avatarUrl: user.avatarUrl,
+        gravatarHash: user.gravatarHash,
+      },
+      // EditorPresence-compatible fields so site-editor peers parse us.
+      docId: null,
+      selectedNodeIds: [],
+      editingNodeId: null,
+      pointer: null,
+      textCaret: null,
+      ideFile: fileId && path ? { localId, fileId, path } : null,
+    })
+    return () => {
+      awareness.setLocalState(null)
+    }
+  }, [session, user.id, user.displayName, user.avatarUrl, user.gravatarHash, localId, fileId, path])
+}
+
+function readIdePeers(session: IdeCollabSession, localId: string): IdePeer[] {
+  const awareness = session.provider.awareness
+  const peers: IdePeer[] = []
+  for (const [clientId, raw] of awareness.getStates()) {
+    if (clientId === awareness.clientID) continue
+    const result = safeParseValue(IdePresenceSchema, raw)
+    if (!result.ok) continue
+    if (!result.value.ideFile || result.value.ideFile.localId !== localId) continue
+    peers.push({ clientId, ...result.value })
+  }
+  return peers
+}
+
+function peersKey(peers: IdePeer[]): string {
+  return peers
+    .map((p) => `${p.clientId}:${p.user.id}:${p.ideFile?.fileId ?? ''}`)
+    .sort()
+    .join('|')
+}
+
+/** Peers currently inside THIS plugin's IDE (deduped per client). */
+export function useIdePeers(session: IdeCollabSession | null, localId: string): IdePeer[] {
+  const [peers, setPeers] = useState<IdePeer[]>([])
+
+  useEffect(() => {
+    if (!session) return undefined
+    const awareness = session.provider.awareness
+    const recompute = (): void => {
+      const next = readIdePeers(session, localId)
+      setPeers((current) => (peersKey(current) === peersKey(next) ? current : next))
+    }
+    awareness.on('change', recompute)
+    recompute()
+    return () => {
+      awareness.off('change', recompute)
+    }
+  }, [session, localId])
+
+  return peers
+}
diff --git a/src/admin/pages/plugins/ide/useSitePluginIde.ts b/src/admin/pages/plugins/ide/useSitePluginIde.ts
new file mode 100644
index 000000000..f0c444226
--- /dev/null
+++ b/src/admin/pages/plugins/ide/useSitePluginIde.ts
@@ -0,0 +1,307 @@
+/**
+ * useSitePluginIde — the Plugin IDE's view-model hook.
+ *
+ * Owns one `IdeCollabSession` for the page's lifetime (live co-edited files
+ * over the site socket), the plugin's summary/state from the list endpoint,
+ * debounced auto-validation after edits, and the lifecycle actions
+ * (activate / rollback / deactivate / delete / preview) with the same
+ * step-up retry pattern the Plugins page uses.
+ */
+import { useEffect, useRef, useState, useSyncExternalStore, useCallback } from 'react'
+import { apiRequest } from '@core/http'
+import { Type } from '@core/utils/typeboxHelpers'
+import { getErrorMessage } from '@core/utils/errorMessage'
+import {
+  SitePluginsPayloadSchema,
+  type SitePluginSummary,
+} from '@core/site-plugins'
+import { pushToast } from '@ui/components/Toast'
+import { StepUpCancelledMessage, useStepUp } from '@admin/shared/StepUp'
+import { useNavigate } from '@admin/lib/routing'
+import { createIdeCollabSession, type IdeCollabSession, type IdeFileMeta } from './ideCollab'
+
+const ValidateResponseSchema = Type.Object({
+  ok: Type.Boolean(),
+  diagnostics: Type.Array(Type.String()),
+})
+
+const AUTO_VALIDATE_DEBOUNCE_MS = 900
+
+export interface SitePluginIdeVm {
+  /** Null for at most one render — the mount effect creates it. */
+  session: IdeCollabSession | null
+  files: IdeFileMeta[]
+  synced: boolean
+  activeFileId: string | null
+  selectFile: (fileId: string | null) => void
+  summary: SitePluginSummary | null
+  refreshSummary: () => Promise<void>
+  diagnostics: string[]
+  validating: boolean
+  runValidation: () => void
+  activating: boolean
+  activate: () => Promise<void>
+  rollback: () => Promise<void>
+  setEnabled: (enabled: boolean) => Promise<void>
+  restart: () => Promise<void>
+  deletePlugin: () => Promise<void>
+  openPreview: () => void
+}
+
+export function useSitePluginIde(localId: string): SitePluginIdeVm {
+  const { runStepUp } = useStepUp()
+  const navigate = useNavigate()
+
+  // One session per (mounted page, localId) — StrictMode-safe via ref-count
+  // free create/destroy in the effect below.
+  const [session, setSession] = useState<IdeCollabSession | null>(null)
+  const sessionRef = useRef<IdeCollabSession | null>(null)
+  const [synced, setSynced] = useState(false)
+  const [activeFileId, setActiveFileId] = useState<string | null>(null)
+  const [summary, setSummary] = useState<SitePluginSummary | null>(null)
+  const [diagnostics, setDiagnostics] = useState<string[]>([])
+  const [validating, setValidating] = useState(false)
+  const [activating, setActivating] = useState(false)
+  const validateTimer = useRef<ReturnType<typeof setTimeout> | null>(null)
+  const validateSeq = useRef(0)
+
+  useEffect(() => {
+    const created = createIdeCollabSession(localId)
+    sessionRef.current = created
+    let alive = true
+    // Deferred so the effect body never sets state synchronously (lint rule
+    // react-hooks/set-state-in-effect) — one tick is invisible next to the
+    // socket round-trip anyway.
+    const publish = setTimeout(() => {
+      if (!alive) return
+      setSession(created)
+      setSynced(created.synced())
+      setActiveFileId(null)
+    }, 0)
+    void created.whenSynced.then(() => {
+      if (!alive) return
+      setSynced(true)
+    })
+    return () => {
+      alive = false
+      clearTimeout(publish)
+      sessionRef.current = null
+      created.destroy()
+    }
+  }, [localId])
+
+  // Files metadata via useSyncExternalStore — content keystrokes fire the
+  // underlying observer too, so the snapshot is signature-cached and only
+  // re-renders on structural/metadata changes.
+  const filesCache = useRef<{ signature: string; files: IdeFileMeta[] }>({
+    signature: '',
+    files: [],
+  })
+  const subscribeFiles = useCallback(
+    (onStoreChange: () => void) => session?.onFilesChange(onStoreChange) ?? (() => {}),
+    [session],
+  )
+  const getFilesSnapshot = useCallback((): IdeFileMeta[] => {
+    const files = session?.pluginFiles() ?? []
+    const signature = files.map((file) => `${file.id}:${file.path}`).join('|')
+    if (signature !== filesCache.current.signature) {
+      filesCache.current = { signature, files }
+    }
+    return filesCache.current.files
+  }, [session])
+  const files = useSyncExternalStore(subscribeFiles, getFilesSnapshot)
+
+  const refreshSummary = useCallback(async (): Promise<void> => {
+    try {
+      const payload = await apiRequest('/admin/api/cms/site-plugins', {
+        schema: SitePluginsPayloadSchema,
+      })
+      setSummary(payload.sitePlugins.find((entry) => entry.localId === localId) ?? null)
+    } catch (err) {
+      console.error('[SitePluginIde] summary load failed:', err)
+    }
+  }, [localId])
+
+  useEffect(() => {
+    const timer = setTimeout(() => {
+      void refreshSummary()
+    }, 0)
+    return () => clearTimeout(timer)
+  }, [refreshSummary])
+
+  const runValidation = useCallback((): void => {
+    const seq = ++validateSeq.current
+    setValidating(true)
+    void apiRequest(`/admin/api/cms/site-plugins/${localId}/validate`, {
+      method: 'POST',
+      schema: ValidateResponseSchema,
+    })
+      .then((result) => {
+        if (seq !== validateSeq.current) return
+        setDiagnostics(result.diagnostics)
+      })
+      .catch((err: unknown) => {
+        if (seq !== validateSeq.current) return
+        setDiagnostics([getErrorMessage(err, 'Validation failed')])
+      })
+      .finally(() => {
+        if (seq === validateSeq.current) setValidating(false)
+      })
+    // State chips (draft-changed vs active) key off the content hash — keep
+    // the summary fresh alongside diagnostics.
+    void refreshSummary()
+  }, [localId, refreshSummary])
+
+  // Automatic validation — debounced on every file change (metadata or
+  // content; the session notifies for both). The relay persists on ~800 ms
+  // debounce, so waiting slightly longer keeps validate reading the same
+  // draft the build would.
+  useEffect(() => {
+    if (!session || !synced) return
+    const off = session.onFilesChange(() => {
+      if (validateTimer.current) clearTimeout(validateTimer.current)
+      validateTimer.current = setTimeout(() => {
+        validateTimer.current = null
+        runValidation()
+      }, AUTO_VALIDATE_DEBOUNCE_MS)
+    })
+    return () => {
+      off()
+      if (validateTimer.current) {
+        clearTimeout(validateTimer.current)
+        validateTimer.current = null
+      }
+    }
+  }, [session, synced, runValidation])
+
+  // First-load validation once synced — diagnostics should not require a
+  // keystroke to appear.
+  useEffect(() => {
+    if (!synced) return
+    const timer = setTimeout(() => runValidation(), 0)
+    return () => clearTimeout(timer)
+  }, [synced, runValidation])
+
+  const activate = useCallback(async (): Promise<void> => {
+    setActivating(true)
+    try {
+      await runStepUp(() =>
+        apiRequest(`/admin/api/cms/site-plugins/${localId}/activate`, { method: 'POST' }),
+      )
+      pushToast({ kind: 'success', title: 'Site plugin activated' })
+      await refreshSummary()
+    } catch (err) {
+      if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
+        pushToast({
+          kind: 'error',
+          title: 'Build & activate failed',
+          body: getErrorMessage(err, 'Unknown activation error'),
+        })
+        runValidation()
+      }
+    } finally {
+      setActivating(false)
+    }
+  }, [localId, refreshSummary, runStepUp, runValidation])
+
+  const rollback = useCallback(async (): Promise<void> => {
+    try {
+      await runStepUp(() =>
+        apiRequest(`/admin/api/cms/site-plugins/${localId}/rollback`, { method: 'POST' }),
+      )
+      pushToast({ kind: 'success', title: 'Rolled back to the previous revision' })
+      await refreshSummary()
+    } catch (err) {
+      if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
+        pushToast({
+          kind: 'error',
+          title: 'Rollback failed',
+          body: getErrorMessage(err, 'Unknown rollback error'),
+        })
+      }
+    }
+  }, [localId, refreshSummary, runStepUp])
+
+  const setEnabled = useCallback(
+    async (enabled: boolean): Promise<void> => {
+      try {
+        await runStepUp(() =>
+          apiRequest(`/admin/api/cms/plugins/site.${localId}`, {
+            method: 'PATCH',
+            body: { enabled },
+          }),
+        )
+        await refreshSummary()
+      } catch (err) {
+        if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
+          pushToast({
+            kind: 'error',
+            title: enabled ? 'Could not activate' : 'Could not deactivate',
+            body: getErrorMessage(err, 'Unknown error'),
+          })
+        }
+      }
+    },
+    [localId, refreshSummary, runStepUp],
+  )
+
+  const restart = useCallback(async (): Promise<void> => {
+    try {
+      await runStepUp(() =>
+        apiRequest(`/admin/api/cms/plugins/site.${localId}/restart`, { method: 'POST' }),
+      )
+      pushToast({ kind: 'success', title: 'Plugin restarted' })
+      await refreshSummary()
+    } catch (err) {
+      if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
+        pushToast({
+          kind: 'error',
+          title: 'Restart failed',
+          body: getErrorMessage(err, 'Unknown error'),
+        })
+      }
+    }
+  }, [localId, refreshSummary, runStepUp])
+
+  const deletePlugin = useCallback(async (): Promise<void> => {
+    try {
+      await runStepUp(() =>
+        apiRequest(`/admin/api/cms/site-plugins/${localId}`, { method: 'DELETE' }),
+      )
+      pushToast({ kind: 'success', title: 'Site plugin deleted' })
+      navigate('/admin/plugins')
+    } catch (err) {
+      if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
+        pushToast({
+          kind: 'error',
+          title: 'Delete failed',
+          body: getErrorMessage(err, 'Unknown error'),
+        })
+      }
+    }
+  }, [localId, navigate, runStepUp])
+
+  const openPreview = useCallback((): void => {
+    navigate(`/admin/site?previewSitePlugin=${encodeURIComponent(localId)}`)
+  }, [localId, navigate])
+
+  return {
+    session,
+    files,
+    synced,
+    activeFileId,
+    selectFile: setActiveFileId,
+    summary,
+    refreshSummary,
+    diagnostics,
+    validating,
+    runValidation,
+    activating,
+    activate,
+    rollback,
+    setEnabled,
+    restart,
+    deletePlugin,
+    openPreview,
+  }
+}
diff --git a/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx b/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
index 28a8161d6..747a7b6bb 100644
--- a/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
+++ b/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
@@ -349,6 +349,13 @@ interface CodeMirrorEditorProps {
    * command surfaces can pass 0 so their primary action never reads stale text.
    */
   changeDelayMs?: number
+  /**
+   * Extra CM6 extensions appended to the stack — the Plugin IDE passes the
+   * yCollab binding (Y.Text sync + remote peer cursors) here. Captured at
+   * mount like `value`/`language`; changing them mid-doc requires a docKey
+   * change (which remounts the view).
+   */
+  extensions?: Extension[]
   /** Authoritative publisher-compiler diagnostics for this document. */
   diagnostics?: SiteRuntimeDiagnostic[]
   /** Site-relative path used by the TypeScript language-service project. */
@@ -504,6 +511,7 @@ export default function CodeMirrorEditor({
   filePath,
   projectFiles = EMPTY_PROJECT_FILES,
   onTypeScriptDiagnosticsChange,
+  extensions,
 }: CodeMirrorEditorProps) {
   const containerRef = useRef<HTMLDivElement | null>(null)
   const viewRef = useRef<EditorView | null>(null)
@@ -606,6 +614,7 @@ export default function CodeMirrorEditor({
             }, changeDelayMs)
           }),
           EditorView.lineWrapping,
+          ...(extensions ?? []),
         ],
       }),
       parent: container,
diff --git a/src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx b/src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx
new file mode 100644
index 000000000..67f583b2c
--- /dev/null
+++ b/src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx
@@ -0,0 +1,116 @@
+/**
+ * CollabCodeMirrorEditor — the co-editing CodeMirror mount.
+ *
+ * A sibling lazy module to CodeMirrorEditor (same React.lazy rule — this
+ * file and CodeMirrorEditor.tsx are the only static CodeMirror importers,
+ * gated by codemirror-lazy-only.test.ts). Wraps the base editor with
+ * y-codemirror.next's `yCollab` extension: local keystrokes splice the
+ * bound Y.Text, remote peers' edits apply character-precise, and their
+ * carets/selections render inline colored by each peer's awareness
+ * identity. Undo is the passed Y.UndoManager — local-only by construction.
+ */
+import { keymap } from '@codemirror/view'
+import { EditorState, type Extension } from '@codemirror/state'
+import { EditorView } from 'codemirror'
+import type * as Y from 'yjs'
+import type { Awareness } from 'y-protocols/awareness'
+import { yCollab, yUndoManagerKeymap } from 'y-codemirror.next'
+import CodeMirrorEditor, { type CodeLanguage } from './CodeMirrorEditor'
+
+/** Remote peer carets/selections — colors ride each peer's awareness
+ *  `user.color`; class names come from y-codemirror.next. */
+const remotePeerTheme = EditorView.theme({
+  '.cm-yLineSelection': {
+    padding: 0,
+    margin: '0 var(--space-3xs)',
+  },
+  '.cm-ySelectionCaret': {
+    position: 'relative',
+    borderLeft: '1px solid',
+    borderRight: '1px solid',
+    marginLeft: '-1px',
+    marginRight: '-1px',
+    boxSizing: 'border-box',
+    display: 'inline',
+  },
+  '.cm-ySelectionCaretDot': {
+    borderRadius: '50%',
+    position: 'absolute',
+    width: '.4em',
+    height: '.4em',
+    top: '-.2em',
+    left: '-.2em',
+    backgroundColor: 'inherit',
+    transition: 'transform .3s ease-in-out',
+    boxSizing: 'border-box',
+  },
+  '.cm-ySelectionCaret:hover > .cm-ySelectionCaretDot': {
+    transform: 'scale(0)',
+  },
+  '.cm-ySelectionInfo': {
+    position: 'absolute',
+    top: '-1.05em',
+    left: '-1px',
+    fontSize: 'var(--text-2xs)',
+    fontFamily: 'var(--font-sans)',
+    fontStyle: 'normal',
+    fontWeight: 'normal',
+    lineHeight: 'normal',
+    userSelect: 'none',
+    color: 'var(--bg-surface)',
+    paddingLeft: 'var(--space-px)',
+    paddingRight: 'var(--space-px)',
+    zIndex: 101,
+    transition: 'opacity .3s ease-in-out',
+    backgroundColor: 'inherit',
+    opacity: 0,
+    transitionDelay: '0s',
+    whiteSpace: 'nowrap',
+  },
+  '.cm-ySelectionCaret:hover > .cm-ySelectionInfo': {
+    opacity: 1,
+    transitionDelay: '0s',
+  },
+})
+
+interface CollabCodeMirrorEditorProps {
+  /** Stable identity — switching remounts the underlying view. */
+  docKey: string
+  language: CodeLanguage
+  /** The live CRDT text this buffer edits. */
+  text: Y.Text
+  awareness: Awareness
+  /** Local-only undo; false disables the binding's undo integration. */
+  undoManager: Y.UndoManager | false
+  readOnly: boolean
+}
+
+export default function CollabCodeMirrorEditor({
+  docKey,
+  language,
+  text,
+  awareness,
+  undoManager,
+  readOnly,
+}: CollabCodeMirrorEditorProps) {
+  // Recomputed per render is fine: CodeMirrorEditor captures `value` and
+  // `extensions` at mount and only remounts when `docKey` changes.
+  const extensions: Extension[] = [
+    keymap.of(yUndoManagerKeymap),
+    yCollab(text, awareness, { undoManager }),
+    remotePeerTheme,
+    ...(readOnly ? [EditorState.readOnly.of(true), EditorView.editable.of(false)] : []),
+  ]
+
+  return (
+    <CodeMirrorEditor
+      docKey={docKey}
+      value={text.toString()}
+      language={language}
+      // Content persistence is the Y binding's job — the store-style
+      // onChange stays a no-op so nothing double-writes.
+      onChange={() => {}}
+      extensions={extensions}
+    />
+  )
+}
diff --git a/src/admin/pages/site/code-editor/ScriptSettingsPane.module.css b/src/admin/pages/site/code-editor/ScriptSettingsPane.module.css
index 0defa1e1a..02dda48b3 100644
--- a/src/admin/pages/site/code-editor/ScriptSettingsPane.module.css
+++ b/src/admin/pages/site/code-editor/ScriptSettingsPane.module.css
@@ -110,3 +110,16 @@
     border-bottom: 1px solid var(--border);
   }
 }
+
+.placementHint {
+  margin: 0;
+  padding: var(--space-xs) 0;
+  font-size: var(--text-xs);
+  line-height: 1.5;
+  color: var(--text-muted);
+}
+
+.placementHint code {
+  font-family: var(--font-mono);
+  font-size: var(--text-2xs);
+}
diff --git a/src/admin/pages/site/code-editor/ScriptSettingsPane.tsx b/src/admin/pages/site/code-editor/ScriptSettingsPane.tsx
index e05374ccb..78844d2f6 100644
--- a/src/admin/pages/site/code-editor/ScriptSettingsPane.tsx
+++ b/src/admin/pages/site/code-editor/ScriptSettingsPane.tsx
@@ -50,6 +50,11 @@ export function ScriptSettingsPane({ file }: ScriptSettingsPaneProps) {
 
   return (
     <aside className={styles.pane} aria-label="Script runtime settings">
+      <p className={styles.placementHint}>
+        Frontend scripts are standalone page JavaScript. Browser code that
+        calls a site plugin’s backend belongs in that plugin’s{' '}
+        <code>frontend/</code> assets instead.
+      </p>
       <div className={styles.header}>
         <span className={styles.title}>Runtime</span>
         <Button
diff --git a/src/admin/pages/site/panels/SiteExplorerPanel/SiteExplorerPanelSections.tsx b/src/admin/pages/site/panels/SiteExplorerPanel/SiteExplorerPanelSections.tsx
index 9fbc718d8..87f599101 100644
--- a/src/admin/pages/site/panels/SiteExplorerPanel/SiteExplorerPanelSections.tsx
+++ b/src/admin/pages/site/panels/SiteExplorerPanel/SiteExplorerPanelSections.tsx
@@ -198,7 +198,7 @@ export function SiteExplorerPanelSections({
 
       {sectionGroup === 'code' && scriptTreeModel && (
         <SiteExplorerTreeSection
-          title="Scripts"
+          title="Frontend scripts"
           count={scriptCount}
           actionLabel="New script"
           actionIcon={CodeIcon}
diff --git a/src/admin/pages/site/panels/SiteExplorerPanel/SiteExplorerPathConfirmDialog.tsx b/src/admin/pages/site/panels/SiteExplorerPanel/SiteExplorerPathConfirmDialog.tsx
index 80d03f43b..cafd9efe9 100644
--- a/src/admin/pages/site/panels/SiteExplorerPanel/SiteExplorerPathConfirmDialog.tsx
+++ b/src/admin/pages/site/panels/SiteExplorerPanel/SiteExplorerPathConfirmDialog.tsx
@@ -119,5 +119,5 @@ function summaryForPlan(plan: ExplorerPathChangePlan): string {
 function sectionLabel(sectionId: ExplorerPathChangePlan['sectionId']): string {
   if (sectionId === 'pages') return 'Pages'
   if (sectionId === 'styles') return 'Styles'
-  return 'Scripts'
+  return 'Frontend scripts'
 }
diff --git a/src/admin/router.tsx b/src/admin/router.tsx
index dd0a40ec0..2e7ce7100 100644
--- a/src/admin/router.tsx
+++ b/src/admin/router.tsx
@@ -64,6 +64,13 @@ export function AdminRoutes() {
       <Route path="/admin/ai" element={withRouteBoundary(<AdminEntry section="ai" />)} />
       <Route path="/admin/ai/oauth/authorize" element={withRouteBoundary(<AdminEntry section="ai" />)} />
       <Route path="/admin/account" element={withRouteBoundary(<AdminEntry section="account" />)} />
+      {/* The IDE route must precede the generic plugin-page pattern —
+          <Routes> takes the first match, and /admin/plugins/develop/x would
+          otherwise resolve as pluginId="develop". */}
+      <Route
+        path="/admin/plugins/develop/:localId"
+        element={withRouteBoundary(<AdminEntry section="pluginIde" />)}
+      />
       <Route
         path="/admin/plugins/:pluginId/:pageId"
         element={withRouteBoundary(<AdminEntry section="pluginPage" />)}
diff --git a/src/admin/state/workspaceLayoutStorage.ts b/src/admin/state/workspaceLayoutStorage.ts
index 87a56dd43..6b90a0bce 100644
--- a/src/admin/state/workspaceLayoutStorage.ts
+++ b/src/admin/state/workspaceLayoutStorage.ts
@@ -60,7 +60,7 @@ export type FloatingPanelId =
  * pages (Plugins, Users, Account, …) render via `AdminPageLayout` and do not
  * participate in this persistence.
  */
-export type EditorWorkspaceId = 'site' | 'content' | 'data' | 'media'
+export type EditorWorkspaceId = 'site' | 'content' | 'data' | 'media' | 'pluginIde'
 
 export interface StoredWorkspaceLayout {
   /** Left sidebar pixel width (clamped to SIDEBAR_MIN/MAX_WIDTH on read). */
diff --git a/src/admin/workspace.ts b/src/admin/workspace.ts
index 5c6aaf5c9..af654942e 100644
--- a/src/admin/workspace.ts
+++ b/src/admin/workspace.ts
@@ -18,6 +18,12 @@
  * `'ai'` is the AI provider settings + defaults workspace. Gated by
  * `ai.providers.manage` (or `ai.audit.read` for the read-only audit tab).
  */
+/**
+ * `'pluginIde'` is the full-screen site plugin IDE
+ * (`/admin/plugins/develop/:localId`) — authoring is a site-developer
+ * surface, gated by `site.read` (activation, not authoring, needs plugin
+ * powers).
+ */
 export type AdminWorkspace =
   | 'dashboard'
   | 'site'
@@ -30,4 +36,5 @@ export type AdminWorkspace =
   | 'pluginPage'
   /** The merge review of one branch (`/admin/branches/:branchId/review`). */
   | 'branchReview'
+  | 'pluginIde'
   | 'account'
diff --git a/src/core/collab/applyPatches.ts b/src/core/collab/applyPatches.ts
index 4e2a5cc16..19e90da9b 100644
--- a/src/core/collab/applyPatches.ts
+++ b/src/core/collab/applyPatches.ts
@@ -29,6 +29,7 @@ import type { SavedLayout } from '@core/layouts'
 import { encodeCollabDocId, siteDocId } from './docIds'
 import { dataMap, inlineTextPropOf, metaMap, rostersMap, SHELL_PER_ENTRY_KEYS, shellMap, treeMap } from './schema'
 import { buildBreakpointOverridesMap, buildNodeMap, buildPropsMap } from './nodeY'
+import { buildSiteFileEntry, buildSiteFilesMap } from './filesY'
 import { populateComponentDoc, populateLayoutDoc, populatePageDoc } from './seed'
 import { applyTextDiff } from './textDiff'
 import type { CollabDocSet } from './docSet'
@@ -346,6 +347,88 @@ function applyRowTargets(
   }
 }
 
+// ---------------------------------------------------------------------------
+// Shell files (granular per-file entries; content as Y.Text)
+// ---------------------------------------------------------------------------
+
+/**
+ * Translate file-array patches onto the per-file Y.Map. Membership derives
+ * from the pre/post id-set diff (splice index churn is meaningless);
+ * whole-entry replaces at depth 2 skip pure index shifts via the same
+ * object-identity check the row translator uses; `content` edits splice the
+ * entry's Y.Text so concurrent remote edits to the SAME file survive.
+ */
+function applyFilesTargets(
+  shell: Y.Map<unknown>,
+  preSite: SiteDocument,
+  nextSite: SiteDocument,
+  wholesale: boolean,
+  fieldTargets: ReadonlyMap<number, ReadonlySet<string>>,
+): void {
+  const existing = shell.get('files')
+  if (!(existing instanceof Y.Map) || wholesale) {
+    // Legacy LWW-array layout, unseeded shell, or an unattributable
+    // whole-array op — (re)build the granular map from the final state.
+    shell.set('files', buildSiteFilesMap(nextSite.files))
+    return
+  }
+  const filesMap = existing
+
+  const preById = new Map(preSite.files.map((file) => [file.id, file]))
+  const nextById = new Map(nextSite.files.map((file) => [file.id, file]))
+
+  // Membership.
+  for (const [id, file] of nextById) {
+    if (!preById.has(id)) filesMap.set(id, buildSiteFileEntry(file))
+  }
+  for (const id of preById.keys()) {
+    if (!nextById.has(id)) filesMap.delete(id)
+  }
+
+  // Per-entry field updates.
+  for (const [index, fields] of fieldTargets) {
+    const file = nextSite.files[index]
+    if (!file || !nextById.has(file.id)) continue
+    const preFile = preById.get(file.id)
+    if (!preFile) continue // freshly created — membership already built it
+
+    const entryValue = filesMap.get(file.id)
+    if (!(entryValue instanceof Y.Map)) {
+      filesMap.set(file.id, buildSiteFileEntry(file))
+      continue
+    }
+    const entry = entryValue
+
+    if (fields.has('*')) {
+      // Whole-entry replace at depth 2. A splice shifts UNTOUCHED files to
+      // new indices and Mutative emits replace ops for them — the object
+      // identity check skips those so a delete of one file can never
+      // clobber concurrent edits to its neighbours.
+      if (preFile !== file) filesMap.set(file.id, buildSiteFileEntry(file))
+      continue
+    }
+
+    for (const field of fields) {
+      const value = (file as unknown as Record<string, unknown>)[field]
+      if (field === 'content' && typeof value === 'string') {
+        const text = entry.get('content')
+        if (text instanceof Y.Text) {
+          applyTextDiff(
+            text,
+            typeof preFile.content === 'string' ? preFile.content : text.toString(),
+            value,
+          )
+        } else {
+          entry.set('content', new Y.Text(value))
+        }
+        continue
+      }
+      if (value === undefined) entry.delete(field)
+      else entry.set(field, value)
+    }
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Entry point
 // ---------------------------------------------------------------------------
@@ -370,6 +453,11 @@ export function applySitePatchesToDocs(
   const shellHeads = new Set<string>()
   const shellEntryTargets = new Map<string, Set<string>>() // head → entry keys ('*' = whole)
   const collectionPatches = new Map<Collection, Patches[number][]>()
+  // files/<index>/<field...> targets. Membership (add/remove) is derived
+  // from a pre/post id-set diff like the rosters; '*' = whole-array op.
+  let filesTouched = false
+  let filesWholesale = false
+  const fileFieldTargets = new Map<number, Set<string>>() // index → fields ('*' = whole entry)
 
   for (const patch of patches) {
     const path = patchPath(patch)
@@ -381,6 +469,24 @@ export function applySitePatchesToDocs(
       continue
     }
     if (SHELL_SKIPPED_KEYS.has(head)) continue
+    if (head === 'files') {
+      filesTouched = true
+      const index = path[1]
+      if (index === undefined || index === 'length') {
+        // Whole-array replace or splice bookkeeping — membership diff covers it.
+        if (index === undefined) filesWholesale = true
+        continue
+      }
+      if (typeof index !== 'number') {
+        filesWholesale = true
+        continue
+      }
+      const field = path[2]
+      const fields = fileFieldTargets.get(index) ?? new Set<string>()
+      fields.add(field === undefined ? '*' : String(field))
+      fileFieldTargets.set(index, fields)
+      continue
+    }
     if (SHELL_PER_ENTRY_KEYS.has(head)) {
       shellEntryTargets.set(head, shellEntryTargets.get(head) ?? new Set())
       shellEntryTargets.get(head)!.add(path.length === 1 ? '*' : String(path[1]))
@@ -396,7 +502,12 @@ export function applySitePatchesToDocs(
     if (colPatches.some(isMembershipShapedOp)) collectionsWithMembershipOps.push(col)
   }
 
-  if (shellHeads.size > 0 || shellEntryTargets.size > 0 || collectionsWithMembershipOps.length > 0) {
+  if (
+    shellHeads.size > 0 ||
+    shellEntryTargets.size > 0 ||
+    filesTouched ||
+    collectionsWithMembershipOps.length > 0
+  ) {
     const siteDoc = docs.ensure(siteDocId(branchId))
     touch(siteDocId(branchId))
     siteDoc.transact(() => {
@@ -406,6 +517,10 @@ export function applySitePatchesToDocs(
         if (value === undefined) shell.delete(head)
         else shell.set(head, value)
       }
+
+      if (filesTouched) {
+        applyFilesTargets(shell, preSite, nextSite, filesWholesale, fileFieldTargets)
+      }
       for (const [head, targets] of shellEntryTargets) {
         const nextEntries = (nextSite as unknown as Record<string, Record<string, unknown>>)[head] ?? {}
         let entryMap = shell.get(head)
diff --git a/src/core/collab/filesY.ts b/src/core/collab/filesY.ts
new file mode 100644
index 000000000..2cb9ec280
--- /dev/null
+++ b/src/core/collab/filesY.ts
@@ -0,0 +1,72 @@
+/**
+ * Site-file Y layout — the shell's `files` key is a Y.Map keyed by file id;
+ * each entry is a Y.Map whose `content` is a Y.Text (character-level merge
+ * for co-edited code files — the site editor's code panel and the Plugin
+ * IDE both ride this) and whose other fields are plain LWW values. `id` is
+ * the map key, never stored inside the entry.
+ *
+ * Projection returns the array shape the domain uses, ordered
+ * deterministically by (createdAt, id) so every peer assembles an identical
+ * shell from converged state.
+ */
+import * as Y from 'yjs'
+import type { SiteFile } from '@core/files/schemas'
+
+export function buildSiteFileEntry(file: SiteFile): Y.Map<unknown> {
+  const entry = new Y.Map<unknown>()
+  for (const [key, value] of Object.entries(file)) {
+    if (key === 'id' || value === undefined) continue
+    if (key === 'content' && typeof value === 'string') {
+      entry.set('content', new Y.Text(value))
+    } else {
+      entry.set(key, value)
+    }
+  }
+  return entry
+}
+
+export function buildSiteFilesMap(files: readonly SiteFile[]): Y.Map<unknown> {
+  const map = new Y.Map<unknown>()
+  for (const file of files) map.set(file.id, buildSiteFileEntry(file))
+  return map
+}
+
+function projectSiteFileEntry(id: string, entry: Y.Map<unknown>): Record<string, unknown> {
+  const out: Record<string, unknown> = { id }
+  for (const [key, value] of entry.entries()) {
+    out[key] = value instanceof Y.Text ? value.toString() : value
+  }
+  return out
+}
+
+/**
+ * Project the shell's `files` value back to the domain array. Handles both
+ * layouts: the granular Y.Map (current) and a plain LWW array (docs seeded
+ * before the per-file layout existed — upgraded on the next write).
+ */
+export function projectSiteFilesValue(value: unknown): unknown {
+  if (value instanceof Y.Map) {
+    const files: Record<string, unknown>[] = []
+    for (const [id, entry] of value.entries()) {
+      if (entry instanceof Y.Map) files.push(projectSiteFileEntry(id, entry))
+    }
+    files.sort((a, b) => {
+      const createdA = typeof a['createdAt'] === 'number' ? (a['createdAt'] as number) : 0
+      const createdB = typeof b['createdAt'] === 'number' ? (b['createdAt'] as number) : 0
+      if (createdA !== createdB) return createdA - createdB
+      return String(a['id']).localeCompare(String(b['id']))
+    })
+    return files
+  }
+  return value
+}
+
+/** The live Y.Text of a file's content, or null (missing file / legacy layout / asset). */
+export function siteFileContentText(shell: Y.Map<unknown>, fileId: string): Y.Text | null {
+  const filesMap = shell.get('files')
+  if (!(filesMap instanceof Y.Map)) return null
+  const entry = filesMap.get(fileId)
+  if (!(entry instanceof Y.Map)) return null
+  const content = entry.get('content')
+  return content instanceof Y.Text ? content : null
+}
diff --git a/src/core/collab/index.ts b/src/core/collab/index.ts
index c1fb63adc..8e5af992b 100644
--- a/src/core/collab/index.ts
+++ b/src/core/collab/index.ts
@@ -29,6 +29,11 @@ export {
   treeMap,
 } from './schema'
 export { reconcileTreeIntegrity } from './integrity'
+export {
+  buildSiteFileEntry,
+  buildSiteFilesMap,
+  siteFileContentText,
+} from './filesY'
 export { applyTextDiff } from './textDiff'
 export {
   decodeCollabFrame,
diff --git a/src/core/collab/project.ts b/src/core/collab/project.ts
index ae8e6c07b..50c619784 100644
--- a/src/core/collab/project.ts
+++ b/src/core/collab/project.ts
@@ -11,6 +11,7 @@ import type { VisualComponent } from '@core/visualComponents'
 import type { SavedLayout } from '@core/layouts'
 import { dataMap, metaMap, rostersMap, shellMap, treeMap } from './schema'
 import { own, projectNodeMap } from './nodeY'
+import { projectSiteFilesValue } from './filesY'
 import { reconcileTreeIntegrity } from './integrity'
 
 function projectTree(doc: Y.Doc): { rootNodeId: string; nodes: Record<string, BaseNode> } {
@@ -81,6 +82,13 @@ export function projectSiteDoc(doc: Y.Doc): ProjectedSiteDoc {
   const shellSrc = shellMap(doc)
   const shell: Record<string, unknown> = {}
   for (const [key, value] of shellSrc.entries()) {
+    // `files` is a granular map (one entry per file, content as Y.Text) so
+    // the Plugin IDE can co-edit a file character-level; everything else in
+    // the shell projects as an owned deep copy.
+    if (key === 'files') {
+      shell[key] = projectSiteFilesValue(value)
+      continue
+    }
     if (value instanceof Y.Map) {
       const entries: Record<string, unknown> = {}
       for (const [entryKey, entryValue] of value.entries()) entries[entryKey] = own(entryValue)
diff --git a/src/core/collab/seed.ts b/src/core/collab/seed.ts
index 9fa79e19a..b7250a74b 100644
--- a/src/core/collab/seed.ts
+++ b/src/core/collab/seed.ts
@@ -14,6 +14,8 @@ import type { VisualComponent } from '@core/visualComponents'
 import type { SavedLayout } from '@core/layouts'
 import { dataMap, metaMap, rostersMap, SEED_CLIENT_ID, SEED_ORIGIN, SHELL_PER_ENTRY_KEYS, shellMap, treeMap } from './schema'
 import { buildNodeMap } from './nodeY'
+import { buildSiteFilesMap } from './filesY'
+import type { SiteFile } from '@core/files/schemas'
 
 function seeding(doc: Y.Doc, fn: () => void): void {
   const previousClientId = doc.clientID
@@ -112,6 +114,12 @@ export function seedSiteDocFromParts(
     const shell = shellMap(doc)
     for (const [key, value] of Object.entries(shellFields)) {
       if (SHELL_SKIPPED_KEYS.has(key) || value === undefined) continue
+      if (key === 'files' && Array.isArray(value)) {
+        // Per-file granular layout — entry Y.Maps with Y.Text content, so
+        // two admins can co-edit code files character-by-character.
+        shell.set('files', buildSiteFilesMap(value as SiteFile[]))
+        continue
+      }
       if (SHELL_PER_ENTRY_KEYS.has(key)) {
         const entryMap = new Y.Map<unknown>()
         for (const [entryKey, entryValue] of Object.entries(value as Record<string, unknown>)) {

From 5753540526cf145720717f84550e0194ca003afb Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 15:20:56 +0200
Subject: [PATCH 05/36] feat(site-plugins): session-local draft canvas preview,
 export guarantees, invariant gates, docs

- Preview in canvas: the site editor's ?previewSitePlugin=<localId> loads
  the draft's validate-only module bundle from the no-store preview-pack
  route, activates it through the SAME browser-side pack loader installed
  plugins use, and badges the modules 'Draft' in the inserter. Nothing
  registers server-side; leaving the page restores the active revision's
  registrations. Publishing a page that uses a site.* module with no
  active registration logs a publish warning naming the plugin.
- Export/import pinned: bundles carry plugin SOURCE ('plugin' shell files),
  never generated artifacts or runtime rows; imported drafts validate
  cleanly and require rebuild+activate on the target.
- site-plugin-invariants gate: zero 'site-local' branches outside the
  repository/engine/UI allowlist; worker/VM/host machinery never mentions
  site plugins; the zip boundary rejection, the containment policy call
  shape, and the plugins.install + conditional step-up authority are
  source-pinned.
- docs/features/site-plugins.md + cross-links from plugin-system.md,
  site-shell.md, and the CLAUDE.md stack bullet.
- Explorer tests updated for the Frontend scripts relabel.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 CLAUDE.md                                     |   2 +-
 docs/features/plugin-system.md                |   2 +-
 docs/features/site-plugins.md                 | 224 ++++++++++++++++++
 docs/features/site-shell.md                   |   3 +-
 .../site-plugin-invariants.test.ts            |  72 ++++++
 src/__tests__/server/sitePluginExport.test.ts |  96 ++++++++
 .../server/sitePluginPreviewPack.test.ts      |  62 +++++
 .../site-explorer/siteExplorerPanel.test.tsx  |   4 +-
 src/admin/pages/site/SitePage.tsx             |   6 +
 .../site/hooks/draftModulePreviewState.ts     |  29 +++
 .../site/hooks/useDraftModulePackPreview.ts   | 107 +++++++++
 .../ModuleInserterDialog.module.css           |  13 +
 .../ModuleInserterItemButton.tsx              |   7 +
 src/core/publisher/renderNode.ts              |  14 +-
 14 files changed, 635 insertions(+), 6 deletions(-)
 create mode 100644 docs/features/site-plugins.md
 create mode 100644 src/__tests__/architecture/site-plugin-invariants.test.ts
 create mode 100644 src/__tests__/server/sitePluginExport.test.ts
 create mode 100644 src/__tests__/server/sitePluginPreviewPack.test.ts
 create mode 100644 src/admin/pages/site/hooks/draftModulePreviewState.ts
 create mode 100644 src/admin/pages/site/hooks/useDraftModulePackPreview.ts

diff --git a/CLAUDE.md b/CLAUDE.md
index 558cd8789..a8b84f703 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -45,7 +45,7 @@ Read [`docs/architecture.md`](docs/architecture.md) for the system overview, [`d
 - **Real-time co-editing:** Yjs CRDT engine. One Y doc per row (`page:<id>`, `component:<id>`, `layout:<id>`) + one site-shell doc, multiplexed over `/admin/api/cms/site-socket`. The editor store stays the render source of truth: local mutations apply directly AND translate to Y ops (`@core/collab`); remote/undo changes project back. The server relay (`server/collab/`) persists continuously (blob + derived row JSON) — there is NO client-side save pipeline, no autosave, no Cmd+S. Undo is per-editor per-doc `Y.UndoManager`. Feature doc: [`docs/features/site-shell.md`](docs/features/site-shell.md) → "Real-time co-editing".
 - **Validation:** TypeBox at every untyped boundary. Schemas are source of truth (`type Foo = Static<typeof FooSchema>`, never a parallel `interface`). `zod` is banned repo-wide (the AI drivers pass TypeBox schemas through as JSON Schema, so no typebox→zod adapter is needed). Helpers + patterns: [`docs/reference/typebox-patterns.md`](docs/reference/typebox-patterns.md).
 - **Sanitization:** DOMPurify at the publisher boundary (`src/core/sanitize.ts`).
-- **Plugins:** Zip packages with a `plugin.json` manifest, lifecycle hooks. Server entrypoints and canvas module packs run inside a **QuickJS-WASM sandbox** — no Node/Bun ambient access, network gated by `network.outbound` permission + `networkAllowedHosts`. The VM bootstrap (SDK factory + `__run*` dispatchers) is authored as typed TS in `server/plugins/quickjs/bootstrap/src/` and bundled to committed string artifacts in `bootstrap/generated/` — after editing the source run `bun run bootstrap:sync` (gated by `plugin-bootstrap-fresh.test.ts`). Permission enforcement everywhere (VM, host, editor) validates against `grantedPermissions`, never the declared `permissions` array. Feature doc: [`docs/features/plugin-system.md`](docs/features/plugin-system.md).
+- **Plugins:** Zip packages with a `plugin.json` manifest, lifecycle hooks. Server entrypoints and canvas module packs run inside a **QuickJS-WASM sandbox** — no Node/Bun ambient access, network gated by `network.outbound` permission + `networkAllowedHosts`. The VM bootstrap (SDK factory + `__run*` dispatchers) is authored as typed TS in `server/plugins/quickjs/bootstrap/src/` and bundled to committed string artifacts in `bootstrap/generated/` — after editing the source run `bun run bootstrap:sync` (gated by `plugin-bootstrap-fresh.test.ts`). Permission enforcement everywhere (VM, host, editor) validates against `grantedPermissions`, never the declared `permissions` array. Feature doc: [`docs/features/plugin-system.md`](docs/features/plugin-system.md). **Site plugins** are authored in the site draft (`plugins/<local-id>/`, `SiteFileType: 'plugin'`), developed in the full-screen Plugin IDE (`/admin/plugins/develop/<local-id>`, live co-editing over the collab socket), built server-side through the shared `@core/plugin-build` core with fail-closed import containment, and activated as ordinary `installed_plugins` rows (`source: 'site-local'`) — the runtime never branches on provenance. Doc: [`docs/features/site-plugins.md`](docs/features/site-plugins.md).
 - **Routing:** In-house router at `src/admin/lib/routing/`. Replaces `react-router-dom`. Use it for all internal admin navigation, including links rendered from the site editor. `react-router-dom` is banned, raw `<a href="/admin...">` hard navigations are banned in admin UI, and `src/core/` + `src/modules/` must not import the admin router. Gated by `admin-router-usage.test.ts`.
 - **Icons:** `pixel-art-icons/icons/<name>` — deep-imported, tree-shakeable. Vendored at `vendor/pixel-art-icons/`. No `lucide-react`, no inline SVG strings — gated by `no-third-party-icons.test.ts`, `direct-icon-imports.test.ts`. Add a new icon by importing it and running `bun run icons:sync`.
 - **AI providers:** No provider SDKs. Each driver in `server/ai/drivers/` talks directly to its provider's REST API over HTTP/SSE, sharing one multi-turn tool loop (`drivers/http/toolLoop.ts`). `@anthropic-ai/sdk`, `@anthropic-ai/claude-agent-sdk`, `@openai/agents`, and `@openrouter/agent` are banned repo-wide. The official split `@modelcontextprotocol/server` / `@modelcontextprotocol/client` v2 packages are **scoped, not banned**: allowed only under `server/ai/mcp/` (Instatic's MCP *server* implements a real wire protocol), still banned in the drivers and the browser. Gated by `ai-driver-isolation.test.ts`.
diff --git a/docs/features/plugin-system.md b/docs/features/plugin-system.md
index d07fa28f4..48ce2f9d4 100644
--- a/docs/features/plugin-system.md
+++ b/docs/features/plugin-system.md
@@ -2,7 +2,7 @@
 
 End-to-end description of the plugin system: what plugins are, how they ship, how they run sandboxed, what they can do, and how to author them.
 
-A plugin is a zip package containing a `plugin.json` manifest and one or more bundled JavaScript entrypoints. The SDK CLI usually authors that zip from `instatic-plugin.config.ts`, then the CMS host loads installed plugins at boot. Each server entrypoint runs in its own Bun `Worker`, and that worker hosts a **QuickJS-WASM sandbox** — no Node, no Bun, no host file system, no environment variables, no network unless explicitly granted. Plugins reach the CMS through SDK surfaces scoped to where they run: `api.plugin.*`, `api.cms.*`, `api.editor.*`, and `api.dashboard.*`.
+A plugin is a package containing a `plugin.json` manifest and one or more bundled JavaScript entrypoints. Packages come from two sources — an uploaded **zip** (the SDK CLI usually authors it from `instatic-plugin.config.ts`) or a **site plugin** built from the site draft's `plugins/<local-id>/` source ([`site-plugins.md`](site-plugins.md)); both produce byte-compatible packages and identical runtime records, so everything below applies to both. The CMS host loads installed plugins at boot. Each server entrypoint runs in its own Bun `Worker`, and that worker hosts a **QuickJS-WASM sandbox** — no Node, no Bun, no host file system, no environment variables, no network unless explicitly granted. Plugins reach the CMS through SDK surfaces scoped to where they run: `api.plugin.*`, `api.cms.*`, `api.editor.*`, and `api.dashboard.*`.
 
 ---
 
diff --git a/docs/features/site-plugins.md b/docs/features/site-plugins.md
new file mode 100644
index 000000000..9493087e1
--- /dev/null
+++ b/docs/features/site-plugins.md
@@ -0,0 +1,224 @@
+# Site plugins
+
+**TL;DR** — Site plugins are full backend/frontend plugins authored inside the
+site draft (`plugins/<local-id>/`, `SiteFile` entries with `type: 'plugin'`),
+developed in a full-screen **Plugin IDE** with live multi-author co-editing,
+compiled server-side into packages **byte-compatible with installed plugins**
+(`uploads/plugins/site.<local-id>/<version>/`), and activated through the
+exact same install/upgrade lifecycle, sandbox, permissions, settings, and
+crash handling. The runtime never branches on provenance.
+
+Design history: `docs/plans/2026-07-02-site-local-integrations-design.md`
+(spec) and `docs/plans/2026-07-03-site-plugins-implementation.md` (plan).
+
+## The user-facing model
+
+Two concepts, deliberately:
+
+- **Frontend scripts** — the relabeled Scripts section of the site editor:
+  standalone page JavaScript with no backend counterpart.
+- **Plugins** — units of code with powers, requiring operator approval. Some
+  are **installed** (uploaded zips), some are **site plugins** (authored in
+  this site's draft). Both share the permission review, settings surface,
+  lifecycle states, logs, and crash handling.
+
+If browser code talks to a plugin's server code, it lives in that plugin's
+`frontend/` assets — the placement rule is surfaced in both UIs.
+
+## Where the code lives
+
+| Piece | Path |
+| --- | --- |
+| Source model (discovery, derivation, hash, templates, states) | `src/core/site-plugins/` |
+| Shared package builder (CLI + server) | `src/core/plugin-build/` |
+| Import containment resolver | `src/core/plugin-build/containment.ts` |
+| Server build orchestrator (workspace, single-flight, timeout) | `server/plugins/sitePlugins/build.ts` |
+| Workspace materializer | `server/plugins/sitePlugins/workspace.ts` |
+| Revision retention / rollback target | `server/plugins/sitePlugins/retention.ts` |
+| HTTP routes | `server/handlers/cms/sitePlugins.ts` |
+| Disk-package activation seam (shared with zip installs) | `server/handlers/cms/plugins/install.ts` → `activatePluginPackageFromDisk` |
+| Plugin IDE | `src/admin/pages/plugins/ide/` |
+| Plugins-page group + scaffold dialog | `src/admin/pages/plugins/components/SitePluginsSection.tsx`, `NewSitePluginDialog.tsx` |
+| Draft canvas preview (editor side) | `src/admin/pages/site/hooks/useDraftModulePackPreview.ts` |
+| Collab CodeMirror binding | `src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx` |
+| Granular collab files (Y.Map + Y.Text content) | `src/core/collab/filesY.ts` |
+| SDK route helper | `src/core/plugin-sdk/sitePluginRoute.ts` |
+
+## Source layout and field ownership
+
+Source lives under `plugins/<local-id>/` (`<local-id>` = one lowercase
+kebab-case segment; runtime id `site.<local-id>`). The draft `plugin.json`
+carries **author intent only** — the build derives the rest and REJECTS
+author-set derived fields (`additionalProperties: false` against
+`SitePluginDraftManifestSchema`, whose field shapes are the runtime
+manifest's own sub-schemas — `MANIFEST_AUTHOR_FIELD_SCHEMAS`).
+
+| Author writes | Builder derives |
+| --- | --- |
+| `name`, `description`, marketplace metadata | `id` (= `site.<local-id>`) |
+| `permissions` | `version` (= `1.0.<buildCounter>+<contentHash>`) |
+| `contentAccess[]`, `settings[]` | `apiVersion` (= host `PLUGIN_API_VERSION`) |
+| `resources[]`, `adminPages[]` | `entrypoints` (folder convention: `server/index.ts`, `editor/index.ts`, `modules/*`) |
+| `frontend.assets[]` (source paths, rewritten to built `.js`) | `assetBasePath` (pinned `/uploads/plugins/{id}/{version}`) |
+| `networkAllowedHosts[]` | `pack` (from `pack/site.json` presence) |
+
+The generated version passes the manifest `SEMVERISH_PATTERN`, is monotonic
+(ordered `migrate({ fromVersion })`), and carries the source fingerprint —
+`contentHashOfVersion` powers the skip-rebuild and the `Draft changed` state.
+
+## Build pipeline
+
+`buildSitePlugin` (server): flush the collab relay (`runPublishFlush` — the
+IDE persists continuously through the relay), read the persisted draft,
+derive the manifest, materialize a temp workspace, and run the shared
+`buildPluginPackage` with a **fail-closed `ImportResolverPolicy`**:
+
+- imports originating in the workspace must resolve inside it — upward
+  escapes, absolute paths, and import-attribute payloads
+  (`with { type: 'text' }`) fail the build (without this, draft code could
+  embed `.env`/DB files into a bundle and exfiltrate them through the
+  plugin's own routes — the sandbox literal scan does not cover this class);
+- exactly one bare specifier is mapped: `@instatic/plugin-sdk` → the host
+  SDK entry (pure data builders inline into sandbox bundles);
+- editor/admin bundles keep the host-runtime externals (import-map
+  resolved).
+
+Builds are single-flight per plugin with a 30 s timeout. Validate-only mode
+writes into the throwaway workspace (never uploads), returns diagnostics,
+and can return the built modules bundle text (the preview-pack route).
+Diagnostics are bundle/parse errors, sandbox-scan violations, containment
+violations, and manifest errors — **not** TypeScript semantic errors
+(`Bun.build` does not typecheck; the UI must not promise it).
+
+## Runtime model and lifecycle
+
+A site plugin IS an `installed_plugins` row (`source: 'site-local'`,
+migration `022_installed_plugins_source`, additive, both dialects). The
+worker, QuickJS VM, route registry, hooks, schedules, settings/secrets,
+event broadcaster, crash recovery, and frontend injection consume it with
+**zero provenance branches** (gated by `site-plugin-invariants.test.ts`).
+
+Activation rides `activatePluginPackageFromDisk` — the same seam the zip
+route uses: fresh = `install` → `activate`; version change = old
+`deactivate` → row swap → `migrate({ fromVersion })` → `activate` with
+rollback on failure. Settings and encrypted secrets survive rebuilds
+(insert-if-absent seeding) — a contract, not an accident. Declared packs
+auto-sync on activation like installed plugins.
+
+### Authority
+
+- **Authoring** (IDE editing, scaffold) — site write capability
+  (`site.structure.edit` for the scaffold; relay write-policy categories
+  gate live edits). Never `plugins.install`.
+- **Validation / preview** — no elevated capability (`site.read`).
+- **`Build & activate` / rollback / delete** — `plugins.install`; step-up
+  ONLY on the consent moments: first activation, grant-set changes, and
+  rollbacks that change the grant set. Same-grant rebuilds skip both the
+  review and the step-up — the security boundary is the grant set, not the
+  code revision.
+- Grants = declared, in both directions: activation grants exactly what the
+  draft declares; dropping a permission shrinks the grant.
+- The `site.*` id namespace is **reserved**: the zip boundary
+  (`readPluginPackage`) rejects uploaded packages claiming it.
+
+### Runtime states
+
+Computed by `computeSitePluginState` (shared server + UI vocabulary) over
+the **union** of draft folders and site-local rows — deleting the folder
+never hides a running backend (`Source missing` still lists, offering
+deactivate/delete):
+
+`active` · `draft-changed` · `build-failed` · `permission-review` ·
+`runtime-error` · `disabled` · `source-missing`
+
+Each state maps to ONE smart primary action (`sitePluginPrimaryAction`),
+used by both the Plugins-page card and the IDE header. Unavailable actions
+are disabled with an inline reason, never hidden.
+
+## The Plugin IDE
+
+`/admin/plugins/develop/<local-id>` — a full-screen workspace-canvas route
+(`AdminWorkspace: 'pluginIde'`, layout persistence like every canvas):
+file tree (left, resizable), co-edited CodeMirror buffer + diagnostics
+strip (center), structured manifest panel (right, edge-notch reopen).
+
+**Live multi-author co-editing**: the shell's `files` key is a granular
+Y.Map — one entry per file id, `content` as Y.Text (`@core/collab/filesY.ts`).
+The IDE binds ONLY `site:default` over the site socket (its own
+`CollabProvider`; server-seeded docs), so:
+
+- two admins co-type one file character-level, with per-peer colored carets
+  (y-codemirror.next);
+- file CRUD, renames, and manifest edits merge per-field;
+- the site editor's code panel rides the same granularity;
+- presence is shared: site editors see IDE users in their roster; IDE rows
+  show who's editing which file;
+- undo is per-file and local-only (Y.UndoManager).
+
+There is no save button — the relay persists continuously; Cmd+S re-runs
+diagnostics. Automatic validation runs debounced on every change.
+
+The manifest panel is the PRIMARY `plugin.json` editor (permission
+checklist with the `editor.code` danger note, network hosts, derived fields
+read-only); raw JSON = opening plugin.json in the buffer. Structured writes
+splice the file's Y.Text minimally so concurrent manifest edits merge.
+
+## Publish coupling, retention, preview
+
+- Activating a revision with visitor-facing surfaces (frontend assets or a
+  module pack) **republishes before sweeping** — baked Layer-A HTML embeds
+  versioned asset URLs and must never reference a deleted revision.
+  Backend-only plugins skip the republish.
+- Retention keeps the active revision + the immediately previous one (the
+  `Rollback to previous revision` target — source rolls forward only, so
+  the artifact is the only rollback). Uninstall sweeps the whole
+  `uploads/plugins/site.<id>/` tree via the existing teardown.
+- `Preview in canvas` (module drafts): the IDE opens
+  `/admin/site?previewSitePlugin=<local-id>`; the editor fetches the
+  validate-only bundle from `GET .../preview-pack.js` (no-store), activates
+  it browser-side into the requesting session only, and badges the modules
+  `Draft` in the inserter. Nothing registers server-side. Publishing a page
+  that uses a `site.*` module with no active registration logs a publish
+  warning naming the plugin (renderNode).
+
+## Export / import
+
+The site bundle carries plugin SOURCE (`type: 'plugin'` shell files) —
+never generated artifacts, secrets, or runtime rows. On import the source
+lands as draft; the operator rebuilds and activates on the target so
+grants, secrets, and network allowlists are reviewed in that environment.
+
+## Frontend → backend calls
+
+```ts
+import { sitePluginRoute } from '@instatic/plugin-sdk'
+await fetch(sitePluginRoute('newsletter', '/subscribe'), { method: 'POST' })
+// → /admin/api/cms/plugins/site.newsletter/runtime/subscribe
+```
+
+Pure string helper: frontend bundles inline it (published pages have no
+import map); editor/admin bundles resolve it through the host import map.
+
+## Forbidden patterns
+
+- Author-set derived fields in a draft `plugin.json` (fails the build).
+- `site.*` ids in uploaded zip packages (rejected at the zip boundary).
+- `type === 'plugin'` matches in any published-output pipeline (gated).
+- Provenance branches in runtime machinery (gated).
+- Calling `buildPluginPackage` server-side without the containment policy
+  (gated).
+
+## Gate tests
+
+- `src/__tests__/architecture/site-plugin-invariants.test.ts`
+- `src/__tests__/architecture/site-plugin-file-isolation.test.ts`
+- `src/__tests__/server/pluginPackageNamespace.test.ts`
+- `src/__tests__/server/pluginSourceColumn.test.ts`
+- `src/__tests__/plugins/pluginBuildContainment.test.ts`
+- `src/__tests__/server/sitePluginBuild.test.ts`
+- `src/__tests__/server/sitePluginLifecycle.test.ts`
+- `src/__tests__/server/sitePluginRetention.test.ts`
+- `src/__tests__/server/sitePluginPreviewPack.test.ts`
+- `src/__tests__/server/sitePluginExport.test.ts`
+- `src/__tests__/sitePlugins/*` (source model, route helper)
+- `src/__tests__/collab/filesGranular.test.ts` (co-editing granularity)
diff --git a/docs/features/site-shell.md b/docs/features/site-shell.md
index b61f10560..d4abffdf7 100644
--- a/docs/features/site-shell.md
+++ b/docs/features/site-shell.md
@@ -185,7 +185,7 @@ Arbitrary files attached to the site: CSS stylesheets, TypeScript scripts, React
 type SiteFile = {
   id:         string          // nanoid-generated; stable (path is mutable on rename)
   path:       string          // POSIX-style path relative to site root, e.g. 'src/styles/main.css'
-  type:       SiteFileType    // 'component' | 'script' | 'style' | 'asset' | 'config' | 'doc'
+  type:       SiteFileType    // 'component' | 'script' | 'style' | 'asset' | 'config' | 'doc' | 'plugin'
   content?:   string          // text content; absent for 'asset' files
   blob?:      { mimeType: string; base64: string }  // binary payload for 'asset' only
   generated?: boolean         // auto-generated by scaffold; hidden until ejected
@@ -201,6 +201,7 @@ Schema source of truth: `src/core/files/schemas.ts`.
 - `'script'` files are exposed to module render functions through `props._siteScripts`.
 - `'component'`, `'config'`, and `'doc'` files are stored but not auto-emitted; modules can read them via `ctx.siteFiles`.
 - `'asset'` files store binary content in `blob` (base64-encoded); the file's `content` field is absent.
+- `'plugin'` files are site plugin source (`plugins/<local-id>/**`). They NEVER enter published bundles, `props._siteScripts`, or module-readable lists, and never appear in the site editor — they are edited exclusively in the Plugin IDE. See [`site-plugins.md`](site-plugins.md); gated by `site-plugin-file-isolation.test.ts`.
 
 Generated files (e.g. `package.json`, `vite.config.ts`) are hidden in the Site Explorer until the user ejects them. Files are created and renamed through the Site Explorer panel and edited with the CodeMirror-backed code editor.
 
diff --git a/src/__tests__/architecture/site-plugin-invariants.test.ts b/src/__tests__/architecture/site-plugin-invariants.test.ts
new file mode 100644
index 000000000..469f1209e
--- /dev/null
+++ b/src/__tests__/architecture/site-plugin-invariants.test.ts
@@ -0,0 +1,72 @@
+/**
+ * Site plugin invariants — the contracts no unit test above owns
+ * (design: docs/plans/2026-07-02-site-local-integrations-design.md;
+ * feature: docs/features/site-plugins.md).
+ *
+ * The load-bearing simplification: a site plugin IS an installed plugin at
+ * runtime. Provenance ('site-local') exists for display + lifecycle
+ * routing only — the worker, VM, host bridges, and publish machinery must
+ * never branch on it.
+ */
+import { describe, expect, test } from 'bun:test'
+
+describe('site plugin invariants', () => {
+  test("the runtime has zero 'site-local' branches", async () => {
+    // The string 'site-local' may appear ONLY in: the repository (row
+    // plumbing), the site plugin engine/handlers, the install seam, the
+    // SDK's provenance type, and UI presentation.
+    const allowed = [
+      /server\/repositories\/plugins\.ts$/,
+      /server\/plugins\/sitePlugins\//,
+      /server\/handlers\/cms\/sitePlugins\.ts$/,
+      /server\/handlers\/cms\/plugins\/install\.ts$/,
+      /server\/db\/migrations-(pg|sqlite)\.ts$/, // the source-column migration comment/default
+      /src\/core\/plugin-sdk\/types\/installedPlugin\.ts$/,
+      /src\/core\/site-plugins\//,
+      /src\/admin\/pages\/plugins\//,
+    ]
+    const glob = new Bun.Glob('{server,src}/**/*.{ts,tsx}')
+    const offenders: string[] = []
+    for await (const path of glob.scan('.')) {
+      if (path.includes('__tests__')) continue
+      const text = await Bun.file(path).text()
+      if (!text.includes("'site-local'")) continue
+      if (allowed.some((pattern) => pattern.test(path))) continue
+      offenders.push(path)
+    }
+    expect(offenders).toEqual([])
+  })
+
+  test('worker / VM / host-bridge plugin machinery never mentions site plugins', async () => {
+    const glob = new Bun.Glob('server/plugins/{quickjs,host,protocol}/**/*.ts')
+    for await (const path of glob.scan('.')) {
+      const text = await Bun.file(path).text()
+      expect(text.includes('sitePlugin'), `${path} references sitePlugin`).toBe(false)
+      expect(text.includes("'site-local'"), `${path} branches on 'site-local'`).toBe(false)
+    }
+  })
+
+  test('the zip-install boundary rejects the reserved namespace (source pin)', async () => {
+    const text = await Bun.file('server/plugins/package.ts').text()
+    expect(text).toContain('isReservedSitePluginId')
+  })
+
+  test('site plugin builds always pass an import-containment policy', async () => {
+    // The server build orchestrator must never call buildPluginPackage
+    // without `resolve:` — dropping it would let draft imports read host
+    // files. Pin the call shape.
+    const text = await Bun.file('server/plugins/sitePlugins/build.ts').text()
+    expect(text).toContain('buildPluginPackage')
+    expect(text).toContain('workspaceRoot: workspace.rootDir')
+    expect(text).toContain("'@instatic/plugin-sdk': SDK_ENTRY")
+  })
+
+  test('activation authority stays with plugins.install + conditional step-up', async () => {
+    const text = await Bun.file('server/handlers/cms/sitePlugins.ts').text()
+    // Activate + rollback gate on plugins.install…
+    expect(text.match(/requireCapability\(req, db, 'plugins\.install'\)/g)?.length).toBeGreaterThanOrEqual(2)
+    // …and step-up runs behind the grant-diff, not unconditionally.
+    expect(text).toContain('grantsChanged')
+    expect(text).toContain('requireStepUp')
+  })
+})
diff --git a/src/__tests__/server/sitePluginExport.test.ts b/src/__tests__/server/sitePluginExport.test.ts
new file mode 100644
index 000000000..02f6cb9ee
--- /dev/null
+++ b/src/__tests__/server/sitePluginExport.test.ts
@@ -0,0 +1,96 @@
+/**
+ * Site plugin export/import — the site bundle carries plugin SOURCE
+ * (`type: 'plugin'` shell files) and never generated artifacts or runtime
+ * rows. On import the source lands as draft; the operator rebuilds and
+ * activates on the target instance so grants and secrets are reviewed there.
+ */
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
+import { unzipSync, strFromU8 } from 'fflate'
+import {
+  createCapabilityTestHarness,
+  readJson,
+  type CapabilityTestHarness,
+} from '../helpers/capabilityHarness'
+import { getDraftSite } from '../../../server/repositories/site'
+import { getInstalledPlugin } from '../../../server/repositories/plugins'
+
+let source: CapabilityTestHarness
+let target: CapabilityTestHarness
+let sourceCookie: string
+let targetCookie: string
+
+beforeAll(async () => {
+  source = await createCapabilityTestHarness()
+  target = await createCapabilityTestHarness()
+  sourceCookie = await source.setupOwner()
+  targetCookie = await target.setupOwner()
+})
+
+afterAll(async () => {
+  await source.cleanup()
+  await target.cleanup()
+})
+
+describe('site plugin export/import', () => {
+  test('export carries plugin source files, never generated artifacts', async () => {
+    const scaffold = await source.cms('/admin/api/cms/site-plugins', {
+      method: 'POST',
+      cookie: sourceCookie,
+      json: { name: 'Newsletter', localId: 'newsletter', template: 'routes' },
+    })
+    expect(scaffold.status).toBe(201)
+
+    const res = await source.cms('/admin/api/cms/export', { cookie: sourceCookie })
+    expect(res.status).toBe(200)
+    const archive = unzipSync(new Uint8Array(await res.arrayBuffer()))
+
+    const manifestEntry = archive['.instatic/site-bundle.json']
+    expect(manifestEntry).toBeDefined()
+    // The bundle manifest is this test's own fixture — parsed for assertions
+    // only, not consumed as typed data.
+    const manifest = JSON.parse(strFromU8(manifestEntry!)) as {
+      site?: { files?: Array<{ path: string; type: string }> }
+    }
+    const pluginFiles = (manifest.site?.files ?? []).filter((file) => file.type === 'plugin')
+    expect(pluginFiles.map((file) => file.path).sort()).toEqual([
+      'plugins/newsletter/plugin.json',
+      'plugins/newsletter/server/index.ts',
+    ])
+
+    // Generated packages never enter the archive.
+    const entryNames = Object.keys(archive)
+    expect(entryNames.some((name) => name.includes('uploads/plugins'))).toBe(false)
+  })
+
+  test('import lands source as draft with NO runtime record', async () => {
+    const exportRes = await source.cms('/admin/api/cms/export', { cookie: sourceCookie })
+    const archive = unzipSync(new Uint8Array(await exportRes.arrayBuffer()))
+    const bundle = JSON.parse(strFromU8(archive['.instatic/site-bundle.json']!)) as unknown
+
+    const importRes = await target.cms('/admin/api/cms/import', {
+      method: 'POST',
+      cookie: targetCookie,
+      json: bundle,
+    })
+    expect(importRes.status).toBe(200)
+    await readJson(importRes)
+
+    const shell = await getDraftSite(target.db)
+    const pluginFiles = shell?.files.filter((file) => file.type === 'plugin') ?? []
+    expect(pluginFiles.map((file) => file.path).sort()).toEqual([
+      'plugins/newsletter/plugin.json',
+      'plugins/newsletter/server/index.ts',
+    ])
+
+    // Powers never transfer — the operator rebuilds + activates on the target.
+    expect(await getInstalledPlugin(target.db, 'site.newsletter')).toBeNull()
+
+    // And the imported draft is immediately buildable.
+    const validate = await target.cms('/admin/api/cms/site-plugins/newsletter/validate', {
+      method: 'POST',
+      cookie: targetCookie,
+    })
+    expect(validate.status).toBe(200)
+    expect(await readJson(validate)).toEqual({ ok: true, diagnostics: [] })
+  })
+})
diff --git a/src/__tests__/server/sitePluginPreviewPack.test.ts b/src/__tests__/server/sitePluginPreviewPack.test.ts
new file mode 100644
index 000000000..2788c0767
--- /dev/null
+++ b/src/__tests__/server/sitePluginPreviewPack.test.ts
@@ -0,0 +1,62 @@
+/**
+ * Session-local draft canvas preview — the preview-pack route returns the
+ * validate-only modules bundle with no-store caching and registers NOTHING
+ * server-side (the plugin row stays untouched).
+ */
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
+import {
+  createCapabilityTestHarness,
+  readJson,
+  type CapabilityTestHarness,
+} from '../helpers/capabilityHarness'
+import { getInstalledPlugin } from '../../../server/repositories/plugins'
+
+let harness: CapabilityTestHarness
+let ownerCookie: string
+
+beforeAll(async () => {
+  harness = await createCapabilityTestHarness()
+  ownerCookie = await harness.setupOwner()
+  const scaffold = await harness.cms('/admin/api/cms/site-plugins', {
+    method: 'POST',
+    cookie: ownerCookie,
+    json: { name: 'Kit', localId: 'kit', template: 'module' },
+  })
+  expect(scaffold.status).toBe(201)
+})
+
+afterAll(async () => {
+  await harness.cleanup()
+})
+
+describe('site plugin preview pack', () => {
+  test('returns the draft modules bundle with no-store, registering nothing', async () => {
+    const res = await harness.cms('/admin/api/cms/site-plugins/kit/preview-pack.js', {
+      cookie: ownerCookie,
+    })
+    expect(res.status).toBe(200)
+    expect(res.headers.get('content-type')).toContain('application/javascript')
+    expect(res.headers.get('cache-control')).toBe('no-store')
+    const bundle = await res.text()
+    expect(bundle).toContain('site.kit.kit')
+
+    // Preview is session-local by construction — no runtime row appears.
+    expect(await getInstalledPlugin(harness.db, 'site.kit')).toBeNull()
+  })
+
+  test('404s with diagnostics context for a plugin without modules', async () => {
+    const scaffold = await harness.cms('/admin/api/cms/site-plugins', {
+      method: 'POST',
+      cookie: ownerCookie,
+      json: { name: 'Backend', localId: 'backend', template: 'routes' },
+    })
+    expect(scaffold.status).toBe(201)
+
+    const res = await harness.cms('/admin/api/cms/site-plugins/backend/preview-pack.js', {
+      cookie: ownerCookie,
+    })
+    expect(res.status).toBe(404)
+    const body = await readJson<{ error: string }>(res)
+    expect(body.error).toContain('no module pack')
+  })
+})
diff --git a/src/__tests__/site-explorer/siteExplorerPanel.test.tsx b/src/__tests__/site-explorer/siteExplorerPanel.test.tsx
index ac4bb1435..3c6551098 100644
--- a/src/__tests__/site-explorer/siteExplorerPanel.test.tsx
+++ b/src/__tests__/site-explorer/siteExplorerPanel.test.tsx
@@ -172,7 +172,7 @@ describe('SiteExplorerPanel', () => {
 
     const panel = screen.getByTestId('site-explorer-panel')
     expect(within(panel).getByRole('heading', { name: 'Styles' })).toBeDefined()
-    expect(within(panel).getByRole('heading', { name: 'Scripts' })).toBeDefined()
+    expect(within(panel).getByRole('heading', { name: 'Frontend scripts' })).toBeDefined()
     expect(within(panel).queryByRole('heading', { name: 'Pages' })).toBeNull()
     expect(within(panel).queryByRole('heading', { name: 'Components' })).toBeNull()
 
@@ -266,7 +266,7 @@ describe('SiteExplorerPanel', () => {
 
     render(<SiteExplorerPanel sectionGroup="code" />)
     const codePanel = screen.getByTestId('site-explorer-panel')
-    const scriptsTree = within(codePanel).getByRole('tree', { name: 'Scripts' })
+    const scriptsTree = within(codePanel).getByRole('tree', { name: 'Frontend scripts' })
     expect(within(scriptsTree).getByRole('button', { name: 'assets' })).toBeDefined()
     expect(within(scriptsTree).getByRole('button', { name: 'js' })).toBeDefined()
   })
diff --git a/src/admin/pages/site/SitePage.tsx b/src/admin/pages/site/SitePage.tsx
index 698ee74b5..20bbf789b 100644
--- a/src/admin/pages/site/SitePage.tsx
+++ b/src/admin/pages/site/SitePage.tsx
@@ -3,6 +3,7 @@ import { AdminCanvasLayout } from '@admin/layouts/AdminCanvasLayout'
 import { consumePendingAction } from '@admin/spotlight/pendingAction'
 import { useEditorStore } from '@site/store/store'
 import { useMcpWorkspaceBridge } from '@admin/ai/useMcpWorkspaceBridge'
+import { useDraftModulePackPreview } from '@site/hooks/useDraftModulePackPreview'
 import { executeAgentTool } from './agent'
 
 /**
@@ -24,6 +25,11 @@ export function SitePage() {
   // actually see an active site.
   useMcpWorkspaceBridge('site', executeAgentTool, undefined, siteHydrated)
 
+  // Session-local site plugin draft preview (`?previewSitePlugin=<localId>`,
+  // set by the Plugin IDE's "Preview in canvas") — loads the draft module
+  // pack into THIS editor session only.
+  useDraftModulePackPreview()
+
   // Consume cross-workspace pending actions queued by the spotlight. Each
   // action waits for the editor store to hydrate (site !== null) — we
   // subscribe once and tear down as soon as the action has fired so the
diff --git a/src/admin/pages/site/hooks/draftModulePreviewState.ts b/src/admin/pages/site/hooks/draftModulePreviewState.ts
new file mode 100644
index 000000000..f670fff5a
--- /dev/null
+++ b/src/admin/pages/site/hooks/draftModulePreviewState.ts
@@ -0,0 +1,29 @@
+/**
+ * Session-local draft module-pack preview state — which module ids are
+ * currently registered from a site plugin DRAFT build (not the active
+ * revision). The module inserter reads this to render the `Draft` badge;
+ * nothing here is ever persisted or server-side.
+ */
+const draftModuleIds = new Set<string>()
+const listeners = new Set<() => void>()
+
+export function markDraftPreviewModules(moduleIds: readonly string[]): void {
+  for (const id of moduleIds) draftModuleIds.add(id)
+  for (const listener of listeners) listener()
+}
+
+export function clearDraftPreviewModules(moduleIds: readonly string[]): void {
+  for (const id of moduleIds) draftModuleIds.delete(id)
+  for (const listener of listeners) listener()
+}
+
+export function isDraftPreviewModule(moduleId: string): boolean {
+  return draftModuleIds.has(moduleId)
+}
+
+export function onDraftPreviewModulesChange(listener: () => void): () => void {
+  listeners.add(listener)
+  return () => {
+    listeners.delete(listener)
+  }
+}
diff --git a/src/admin/pages/site/hooks/useDraftModulePackPreview.ts b/src/admin/pages/site/hooks/useDraftModulePackPreview.ts
new file mode 100644
index 000000000..d2277c3e0
--- /dev/null
+++ b/src/admin/pages/site/hooks/useDraftModulePackPreview.ts
@@ -0,0 +1,107 @@
+/**
+ * useDraftModulePackPreview — session-local `Preview in canvas` for site
+ * plugin module drafts.
+ *
+ * When the site editor opens with `?previewSitePlugin=<localId>` (set by
+ * the Plugin IDE), this hook fetches the draft's validate-only module
+ * bundle from the preview-pack route (no server-side registration, no
+ * plugin row change), activates it through the SAME browser-side pack
+ * loader installed plugins use, and marks the modules `Draft` in the
+ * inserter. Production and other sessions are untouched; leaving the page
+ * (or dropping the param) deactivates the draft pack and re-runs the
+ * normal plugin activation pass so the ACTIVE revision's modules return.
+ */
+import { useEffect } from 'react'
+import { parsePluginManifest } from '@core/plugins/manifest'
+import {
+  activatePluginModulePack,
+  deactivatePluginModulePack,
+  listPluginRegisteredModuleIds,
+} from '@core/plugins/modulePackLoader'
+import { PLUGIN_API_VERSION } from '@core/plugin-sdk'
+import { SITE_PLUGIN_LOCAL_ID_PATTERN, sitePluginIdFromLocalId } from '@core/site-plugins'
+import { pushToast } from '@ui/components/Toast'
+import { getErrorMessage } from '@core/utils/errorMessage'
+import { useLocation } from '@admin/lib/routing'
+import { ensurePluginRuntime } from '@admin/pluginRuntimeBootstrap'
+import { notifyCmsPluginsChanged } from '@plugins/utils/pluginEvents'
+import { editorPluginModuleComponentFactory } from '@site/canvas/pluginModuleComponentFactory'
+import {
+  clearDraftPreviewModules,
+  markDraftPreviewModules,
+} from './draftModulePreviewState'
+
+function previewParam(search: string): string | null {
+  const value = new URLSearchParams(search).get('previewSitePlugin')
+  if (!value || !SITE_PLUGIN_LOCAL_ID_PATTERN.test(value)) return null
+  return value
+}
+
+export function useDraftModulePackPreview(): void {
+  const { search } = useLocation()
+  const localId = previewParam(search)
+
+  useEffect(() => {
+    if (!localId) return undefined
+    const pluginId = sitePluginIdFromLocalId(localId)
+    let cancelled = false
+    let registered: string[] = []
+
+    async function loadDraftPack(): Promise<void> {
+      // The pack bundle inlines the SDK, but its React components render
+      // through the host runtime — make sure it exists first.
+      await ensurePluginRuntime()
+      if (cancelled) return
+      // Vite must not try to resolve this at build time — it is a live
+      // server route that rebuilds the draft on every request (no-store).
+      const url = `/admin/api/cms/site-plugins/${localId}/preview-pack.js?t=${Date.now()}`
+      const mod = (await import(/* @vite-ignore */ url)) as {
+        default: unknown
+      }
+      if (cancelled) return
+
+      // A synthetic manifest for the DRAFT pack: modules.register is
+      // "granted" browser-side only — the pack never leaves this session.
+      const manifest = parsePluginManifest({
+        id: pluginId,
+        name: `${localId} (draft preview)`,
+        version: '0.0.1-draft',
+        apiVersion: PLUGIN_API_VERSION,
+        permissions: ['modules.register'],
+        grantedPermissions: ['modules.register'],
+        resources: [],
+        adminPages: [],
+      })
+      activatePluginModulePack(
+        manifest,
+        mod as Parameters<typeof activatePluginModulePack>[1],
+        editorPluginModuleComponentFactory,
+      )
+      registered = listPluginRegisteredModuleIds(pluginId)
+      markDraftPreviewModules(registered)
+      pushToast({
+        kind: 'info',
+        title: `Previewing “${localId}” draft modules`,
+        body: 'Session-local: production and other editors are unaffected.',
+      })
+    }
+
+    void loadDraftPack().catch((err: unknown) => {
+      if (cancelled) return
+      pushToast({
+        kind: 'error',
+        title: 'Draft preview failed',
+        body: getErrorMessage(err, 'Could not build the draft module pack'),
+      })
+    })
+
+    return () => {
+      cancelled = true
+      clearDraftPreviewModules(registered)
+      deactivatePluginModulePack(pluginId)
+      // Restore the ACTIVE revision's registrations (if any) — the normal
+      // activation pass is idempotent and reads server state.
+      notifyCmsPluginsChanged()
+    }
+  }, [localId])
+}
diff --git a/src/admin/pages/site/module-picker/ModuleInserterDialog.module.css b/src/admin/pages/site/module-picker/ModuleInserterDialog.module.css
index 9cfed46cd..863a7559a 100644
--- a/src/admin/pages/site/module-picker/ModuleInserterDialog.module.css
+++ b/src/admin/pages/site/module-picker/ModuleInserterDialog.module.css
@@ -807,3 +807,16 @@
         margin-left: 0;
     }
 }
+
+/* Draft badge — session-local site plugin preview modules (never active
+   revisions). Identity via warning state color, per the two-layer model. */
+.draftBadge {
+  padding: 0 var(--space-3xs);
+  border-radius: var(--radius-sm);
+  font-size: var(--text-3xs);
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  color: var(--warning);
+  background: var(--bg-surface-3);
+}
diff --git a/src/admin/pages/site/module-picker/ModuleInserterItemButton.tsx b/src/admin/pages/site/module-picker/ModuleInserterItemButton.tsx
index 086b0e913..9cc2b9b73 100644
--- a/src/admin/pages/site/module-picker/ModuleInserterItemButton.tsx
+++ b/src/admin/pages/site/module-picker/ModuleInserterItemButton.tsx
@@ -18,6 +18,7 @@ import {
   type ModuleInserterSectionId,
 } from './moduleInserterModel'
 import { ModuleWireframe } from './ModuleWireframe'
+import { isDraftPreviewModule } from '@site/hooks/draftModulePreviewState'
 import styles from './ModuleInserterDialog.module.css'
 
 export type InserterView = 'grid' | 'list'
@@ -137,6 +138,9 @@ function ItemTile({ item }: { item: ModuleInserterItem }) {
         <span className={styles.itemTitle}>
           <ItemIcon item={item} />
           <span>{item.name}</span>
+          {item.kind === 'module' && isDraftPreviewModule(item.id) && (
+            <span className={styles.draftBadge}>Draft</span>
+          )}
         </span>
         <span className={styles.itemDescription}>{itemDescription(item)}</span>
       </span>
@@ -157,6 +161,9 @@ function ItemRow({ item }: { item: ModuleInserterItem }) {
         <span className={styles.itemTitle}>
           <ItemIcon item={item} />
           <span>{item.name}</span>
+          {item.kind === 'module' && isDraftPreviewModule(item.id) && (
+            <span className={styles.draftBadge}>Draft</span>
+          )}
         </span>
         <span className={styles.itemDescription}>{itemDescription(item)}</span>
       </span>
diff --git a/src/core/publisher/renderNode.ts b/src/core/publisher/renderNode.ts
index e54aec67e..4a388a7fc 100644
--- a/src/core/publisher/renderNode.ts
+++ b/src/core/publisher/renderNode.ts
@@ -305,7 +305,19 @@ export function renderNode(
 
   const def = config.registry.get(node.moduleId)
   if (!def) {
-    // Unknown module — emit a comment so the page doesn't silently lose content
+    // Unknown module — emit a comment so the page doesn't silently lose
+    // content. A `site.<plugin>.*` id names its site plugin explicitly:
+    // the module was previewed from a draft (or the plugin was
+    // deactivated) but never activated — the fix is Build & activate,
+    // and the publish log must say so instead of burying a silent comment.
+    if (node.moduleId.startsWith('site.')) {
+      const pluginId = node.moduleId.split('.').slice(0, 2).join('.')
+      console.warn(
+        `[publish] page uses module "${node.moduleId}" from site plugin "${pluginId}" ` +
+          `with no ACTIVE registration — Build & activate the site plugin so published ` +
+          `pages can render it.`,
+      )
+    }
     return `<!-- instatic: unknown module "${escapeHtml(node.moduleId)}" -->`
   }
 

From f7b9ea7047614489c59ddbbfc19db24f550d3cac Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 15:56:57 +0200
Subject: [PATCH 06/36] =?UTF-8?q?fix(site-plugins):=20live=20smoke-test=20?=
 =?UTF-8?q?findings=20=E2=80=94=20slim=20SDK=20inlining,=20artefact=20reba?=
 =?UTF-8?q?ke=20on=20activation,=20consent=20dialog?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Findings from the end-to-end browser smoke (scaffold → co-edit → validate
→ review → step-up → activate → preview → publish), all fixed:

- Mapping '@instatic/plugin-sdk' to the FULL SDK barrel inlined TypeBox
  (~390 kB) and tripped a bundler tree-shake edge ('Object3 is not
  defined') that broke module packs in BOTH the browser preview and the
  QuickJS publisher. New src/core/plugin-sdk/inlineRuntime.ts exposes
  exactly the pure-data surface (defineModule, control, html/raw/safeUrl,
  sitePluginRoute) + type-only re-exports; bundles drop to ~4 kB and run
  everywhere.
- republishAllPages re-rendered pages but never re-baked Layer-A static
  artefacts, so activation left published HTML referencing the OLD
  revision (the exact staleness the publish coupling exists to prevent).
  It now takes an optional uploadsDir and updates each page's artefact
  in place; the site plugin activation passes it.
- IDE lifecycle actions now fire notifyCmsPluginsChanged so open editor
  sessions reload the new revision's module pack without a page reload.
- Grant-changing activations show a permission-review dialog (new grants
  with labels, revocations, editor.code danger note) BEFORE the build —
  the consent moment the design requires, on top of server-side step-up.
- ideCollab upgrades a legacy LWW files array from its EXISTING entries
  (an empty replacement would have projected a shell that lost every
  other site file) and reads metas across both layouts.
- Build diagnostics rewrite throwaway-workspace paths to the draft's
  plugins/<id>/ paths — no server temp-dir leakage, the author's file
  is named.

Verified live: multi-author co-editing with peer carets across two
sessions, character merges, containment rejection of a used host-file
escape import, activation → auto-republish serving the new render, and
the scaffolded routes plugin answering through the QuickJS runtime.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 server/handlers/cms/sitePlugins.ts            |  2 +-
 server/plugins/sitePlugins/build.ts           | 18 +++-
 server/publish/republish.ts                   | 23 +++--
 .../pages/plugins/ide/SitePluginIdePage.tsx   | 23 ++++-
 ...itePluginPermissionReviewDialog.module.css | 59 +++++++++++
 .../ide/SitePluginPermissionReviewDialog.tsx  | 98 +++++++++++++++++++
 src/admin/pages/plugins/ide/ideCollab.ts      | 68 ++++++++-----
 .../pages/plugins/ide/useSitePluginIde.ts     |  8 ++
 src/core/plugin-sdk/inlineRuntime.ts          | 21 ++++
 9 files changed, 281 insertions(+), 39 deletions(-)
 create mode 100644 src/admin/pages/plugins/ide/SitePluginPermissionReviewDialog.module.css
 create mode 100644 src/admin/pages/plugins/ide/SitePluginPermissionReviewDialog.tsx
 create mode 100644 src/core/plugin-sdk/inlineRuntime.ts

diff --git a/server/handlers/cms/sitePlugins.ts b/server/handlers/cms/sitePlugins.ts
index f34facfb7..23494ea8d 100644
--- a/server/handlers/cms/sitePlugins.ts
+++ b/server/handlers/cms/sitePlugins.ts
@@ -430,7 +430,7 @@ async function republishAndSweep(
     (manifest.frontend?.assets.length ?? 0) > 0 || Boolean(manifest.entrypoints?.modules)
   if (visitorFacing) {
     try {
-      await republishAllPages(db)
+      await republishAllPages(db, uploadsDir)
       await bumpPublishVersionSerialized()
     } catch (err) {
       // A failed republish must not fail the activation — but it must also
diff --git a/server/plugins/sitePlugins/build.ts b/server/plugins/sitePlugins/build.ts
index e152fb6fd..d574d5889 100644
--- a/server/plugins/sitePlugins/build.ts
+++ b/server/plugins/sitePlugins/build.ts
@@ -25,11 +25,13 @@ import { getErrorMessage } from '@core/utils/errorMessage'
 import { materializeSitePluginWorkspace } from './workspace'
 
 /**
- * '@instatic/plugin-sdk' resolves to the host's own SDK barrel so pure data
- * builders (defineModule, control, html, …) inline into sandbox bundles —
- * the only bare specifier a site plugin may import.
+ * '@instatic/plugin-sdk' resolves to the SDK's inlinable runtime surface
+ * (pure data builders — defineModule, control, html, sitePluginRoute) so
+ * sandbox/module bundles stay self-contained AND small. Never the full
+ * barrel: its TypeBox-backed schema modules weigh hundreds of kB and have
+ * tripped bundler tree-shake edge cases when inlined.
  */
-const SDK_ENTRY = resolve(import.meta.dir, '../../../src/core/plugin-sdk/index.ts')
+const SDK_ENTRY = resolve(import.meta.dir, '../../../src/core/plugin-sdk/inlineRuntime.ts')
 
 /** Pathological inputs must fail fast instead of tying up the server. */
 const DEFAULT_BUILD_TIMEOUT_MS = 30_000
@@ -153,7 +155,13 @@ async function runBuild(input: SitePluginBuildInput): Promise<SitePluginBuildRes
       ...(modulesBundle !== undefined ? { modulesBundle } : {}),
     }
   } catch (err) {
-    return { ok: false, diagnostics: [getErrorMessage(err, 'Site plugin build failed')] }
+    // Diagnostics quote bundler paths inside the throwaway workspace —
+    // rewrite them to the draft's plugins/<localId>/ paths so the message
+    // names the author's file instead of leaking a server temp dir.
+    const message = getErrorMessage(err, 'Site plugin build failed')
+      .replaceAll(`${workspace.rootDir}/`, sitePluginFolder(input.localId))
+      .replaceAll(workspace.rootDir, sitePluginFolder(input.localId))
+    return { ok: false, diagnostics: [message] }
   } finally {
     await workspace.cleanup()
   }
diff --git a/server/publish/republish.ts b/server/publish/republish.ts
index 8d429b27c..b5f79d898 100644
--- a/server/publish/republish.ts
+++ b/server/publish/republish.ts
@@ -19,6 +19,7 @@ import type { DbClient } from '../db/client'
 import { getPublishedPageSnapshotById } from '../repositories/publish'
 import { renderPublishedSnapshot } from './publicRenderer'
 import { applyPublishedHtmlPipeline } from './publishedHtmlPipeline'
+import { updateArtefactInPlace } from './staticArtefact'
 
 // ---------------------------------------------------------------------------
 // Typed error — callers can distinguish "page not found / not published" from
@@ -47,7 +48,7 @@ class PageNotPublishedError extends Error {
  * Throws `PageNotPublishedError` if the page is not found or is not
  * currently published.
  */
-async function republishSinglePage(db: DbClient, pageId: string): Promise<void> {
+async function republishSinglePage(db: DbClient, pageId: string, uploadsDir?: string): Promise<void> {
   // Typed read through the publish repository — the snapshot column is parsed
   // by the DbClient (`*_json` auto-parse) and typed as `PublishedPageSnapshot`,
   // so there is no boundary cast here.
@@ -62,11 +63,19 @@ async function republishSinglePage(db: DbClient, pageId: string): Promise<void>
   const syntheticUrl = new URL('http://localhost/__republish')
 
   // Drive the full pipeline (publish.before → frontend.assets injection →
-  // publish.html filter → publish.after). The returned HTML is discarded —
-  // the side-effects are what the caller actually needs (lets plugins
-  // catch up on pages published before they were activated).
+  // publish.html filter → publish.after) — plugin hook listeners and
+  // filters catch up on pages published before the plugin was activated.
   const rendered = await renderPublishedSnapshot(snapshot, { db, url: syntheticUrl })
-  await applyPublishedHtmlPipeline(rendered, db)
+  const html = await applyPublishedHtmlPipeline(rendered, db)
+
+  // Re-bake the Layer-A static artefact when the caller owns an uploads dir.
+  // Without this, baked pages keep serving HTML rendered against the OLD
+  // module registrations / versioned asset URLs — the exact staleness the
+  // site plugin activation coupling exists to prevent.
+  if (uploadsDir) {
+    const urlPath = rendered.slug === 'index' ? '/' : `/${rendered.slug}`
+    await updateArtefactInPlace(uploadsDir, urlPath, html)
+  }
 }
 
 /**
@@ -76,7 +85,7 @@ async function republishSinglePage(db: DbClient, pageId: string): Promise<void>
  * Errors for individual pages are logged and do not abort the batch — the
  * count reflects pages that completed without error.
  */
-export async function republishAllPages(db: DbClient): Promise<number> {
+export async function republishAllPages(db: DbClient, uploadsDir?: string): Promise<number> {
   const { rows } = await db<{ id: string }>`
     select id
     from data_rows
@@ -86,7 +95,7 @@ export async function republishAllPages(db: DbClient): Promise<number> {
       and deleted_at is null
     order by created_at asc
   `
-  const results = await Promise.allSettled(rows.map(row => republishSinglePage(db, row.id)))
+  const results = await Promise.allSettled(rows.map(row => republishSinglePage(db, row.id, uploadsDir)))
   let count = 0
   for (const [i, result] of results.entries()) {
     if (result.status === 'fulfilled') {
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
index 088ba6fde..0ae2d4005 100644
--- a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
@@ -22,6 +22,7 @@ import { SITE_PLUGIN_LOCAL_ID_PATTERN, sitePluginFolder } from '@core/site-plugi
 import { useSitePluginIde } from './useSitePluginIde'
 import { useIdePeers, usePublishIdePresence } from './idePresence'
 import { FileTreePane } from './FileTreePane'
+import { SitePluginPermissionReviewDialog } from './SitePluginPermissionReviewDialog'
 import { IdeFileEditor } from './IdeFileEditor'
 import { DiagnosticsStrip } from './DiagnosticsStrip'
 import { ManifestPane } from './ManifestPane'
@@ -64,6 +65,7 @@ function SitePluginIde({ localId }: { localId: string }) {
   const canEdit = canEditStructure(currentUser)
   const canInstall = canInstallPlugins(currentUser)
   const [pendingDelete, setPendingDelete] = useState<PendingDelete | null>(null)
+  const [reviewOpen, setReviewOpen] = useState(false)
 
   const vm = useSitePluginIde(localId)
   const { session, files, activeFileId, selectFile, runValidation } = vm
@@ -185,7 +187,16 @@ function SitePluginIde({ localId }: { localId: string }) {
             peers={peers}
             canInstall={canInstall}
             activating={vm.activating}
-            onActivate={() => void vm.activate()}
+            onActivate={() => {
+              // Grant-changing activations are consent moments — show the
+              // review (what will be granted/revoked) before building.
+              const summary = vm.summary
+              const grantsChange =
+                summary !== null &&
+                (summary.newPermissions.length > 0 || summary.removedPermissions.length > 0)
+              if (grantsChange) setReviewOpen(true)
+              else void vm.activate()
+            }}
             onPreview={vm.openPreview}
             onRollback={() => void vm.rollback()}
             onSetEnabled={(enabled) => void vm.setEnabled(enabled)}
@@ -203,6 +214,16 @@ function SitePluginIde({ localId }: { localId: string }) {
             }
             onShowDiagnostics={vm.runValidation}
           />
+          {reviewOpen && vm.summary && (
+            <SitePluginPermissionReviewDialog
+              summary={vm.summary}
+              busy={vm.activating}
+              onClose={() => setReviewOpen(false)}
+              onConfirm={() => {
+                void vm.activate().finally(() => setReviewOpen(false))
+              }}
+            />
+          )}
           {pendingDelete && (
             <ConfirmDeleteDialog
               title={pendingDelete.title}
diff --git a/src/admin/pages/plugins/ide/SitePluginPermissionReviewDialog.module.css b/src/admin/pages/plugins/ide/SitePluginPermissionReviewDialog.module.css
new file mode 100644
index 000000000..bb9e644cd
--- /dev/null
+++ b/src/admin/pages/plugins/ide/SitePluginPermissionReviewDialog.module.css
@@ -0,0 +1,59 @@
+.body {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-s);
+}
+
+.intro,
+.removedIntro {
+  margin: 0;
+  font-size: var(--text-s);
+  line-height: 1.5;
+  color: var(--text-subtle);
+}
+
+.list {
+  margin: 0;
+  padding: 0;
+  list-style: none;
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-3xs);
+}
+
+.row,
+.rowRemoved {
+  display: flex;
+  align-items: baseline;
+  gap: var(--space-s);
+  padding: var(--space-3xs) var(--space-s);
+  border-radius: var(--radius-sm);
+  background: var(--bg-surface-3);
+}
+
+.rowRemoved {
+  opacity: 0.6;
+  text-decoration: line-through;
+}
+
+.permissionId {
+  font-family: var(--font-mono);
+  font-size: var(--text-xs);
+  color: var(--text);
+}
+
+.permissionLabel {
+  font-size: var(--text-xs);
+  color: var(--text-subtle);
+}
+
+.dangerNote {
+  margin: 0;
+  padding: var(--space-xs) var(--space-s);
+  border-radius: var(--radius);
+  border-left: 2px solid var(--danger);
+  background: var(--bg-surface-3);
+  font-size: var(--text-xs);
+  line-height: 1.5;
+  color: var(--text);
+}
diff --git a/src/admin/pages/plugins/ide/SitePluginPermissionReviewDialog.tsx b/src/admin/pages/plugins/ide/SitePluginPermissionReviewDialog.tsx
new file mode 100644
index 000000000..f3a2f121b
--- /dev/null
+++ b/src/admin/pages/plugins/ide/SitePluginPermissionReviewDialog.tsx
@@ -0,0 +1,98 @@
+/**
+ * SitePluginPermissionReviewDialog — the consent moment before a
+ * grant-changing activation. Shows exactly what `Build & activate` will
+ * grant (and revoke): new permissions with labels, removed permissions,
+ * and the dangerous-code warning when editor.code is among them. Approval
+ * proceeds to activation, where the server additionally enforces
+ * plugins.install + step-up.
+ */
+import { isPluginPermission, permissionLabel } from '@core/plugin-sdk'
+import type { SitePluginSummary } from '@core/site-plugins'
+import { Button } from '@ui/components/Button'
+import { Dialog } from '@ui/components/Dialog'
+import styles from './SitePluginPermissionReviewDialog.module.css'
+
+interface SitePluginPermissionReviewDialogProps {
+  summary: SitePluginSummary
+  busy: boolean
+  onClose: () => void
+  onConfirm: () => void
+}
+
+export function SitePluginPermissionReviewDialog({
+  summary,
+  busy,
+  onClose,
+  onConfirm,
+}: SitePluginPermissionReviewDialogProps) {
+  const added = summary.newPermissions
+  const removed = summary.removedPermissions
+  const dangerous = added.includes('editor.code')
+
+  return (
+    <Dialog
+      open
+      onClose={busy ? () => {} : onClose}
+      tone={dangerous ? 'danger' : undefined}
+      eyebrow="Permission review"
+      title={`Activate ${summary.name}`}
+      footer={
+        <>
+          <Button variant="secondary" size="sm" type="button" onClick={onClose} disabled={busy}>
+            Cancel
+          </Button>
+          <Button
+            variant={dangerous ? 'destructive' : 'primary'}
+            size="sm"
+            type="button"
+            onClick={onConfirm}
+            disabled={busy}
+            data-testid="confirm-site-plugin-grants"
+          >
+            {busy ? 'Building…' : 'Grant & activate'}
+          </Button>
+        </>
+      }
+    >
+      <div className={styles.body}>
+        <p className={styles.intro}>
+          Building activates this plugin’s current draft with exactly the
+          permissions it declares:
+        </p>
+
+        {added.length > 0 && (
+          <ul className={styles.list} aria-label="Permissions to grant">
+            {added.map((permission) => (
+              <li key={permission} className={styles.row}>
+                <code className={styles.permissionId}>{permission}</code>
+                <span className={styles.permissionLabel}>
+                  {isPluginPermission(permission) ? permissionLabel(permission) : permission}
+                </span>
+              </li>
+            ))}
+          </ul>
+        )}
+
+        {removed.length > 0 && (
+          <>
+            <p className={styles.removedIntro}>No longer requested (grants shrink):</p>
+            <ul className={styles.list} aria-label="Permissions to revoke">
+              {removed.map((permission) => (
+                <li key={permission} className={styles.rowRemoved}>
+                  <code className={styles.permissionId}>{permission}</code>
+                </li>
+              ))}
+            </ul>
+          </>
+        )}
+
+        {dangerous && (
+          <p className={styles.dangerNote} role="alert">
+            editor.code runs this plugin’s JavaScript unsandboxed in every
+            admin’s browser window. Only activate code you trust.
+          </p>
+        )}
+      </div>
+    </Dialog>
+  )
+}
diff --git a/src/admin/pages/plugins/ide/ideCollab.ts b/src/admin/pages/plugins/ide/ideCollab.ts
index 0f2591c1f..b8172ccb1 100644
--- a/src/admin/pages/plugins/ide/ideCollab.ts
+++ b/src/admin/pages/plugins/ide/ideCollab.ts
@@ -15,6 +15,7 @@ import * as Y from 'yjs'
 import {
   applyTextDiff,
   buildSiteFileEntry,
+  buildSiteFilesMap,
   shellMap,
   siteFileContentText,
   MAIN_SITE_DOC_ID,
@@ -84,6 +85,23 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
     return value instanceof Y.Map ? value : null
   }
 
+  /**
+   * The granular files map, upgrading a legacy LWW-array layout in place —
+   * from the EXISTING entries, never an empty map (an empty replacement
+   * would project a shell that lost every other site file). Must run
+   * inside a doc transaction.
+   */
+  const ensureFilesMap = (): Y.Map<unknown> => {
+    const shell = shellMap(doc)
+    const value = shell.get('files')
+    if (value instanceof Y.Map) return value
+    const map = Array.isArray(value)
+      ? buildSiteFilesMap(value as SiteFile[])
+      : new Y.Map<unknown>()
+    shell.set('files', map)
+    return map
+  }
+
   // Observe the whole shell deeply — file metadata changes (path renames,
   // membership) re-notify; pure content keystrokes also fire but the hook
   // layer collapses them via a metadata signature, so React work stays
@@ -95,18 +113,27 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
   }
   shellMap(doc).observeDeep(shellObserver)
 
-  const allFiles = (): Array<{ id: string; entry: Y.Map<unknown> }> => {
+  /** id/path metas across BOTH layouts (granular map, legacy LWW array). */
+  const allFileMetas = (): IdeFileMeta[] => {
     const map = filesMap()
-    if (!map) return []
-    const out: Array<{ id: string; entry: Y.Map<unknown> }> = []
-    for (const [id, entry] of map.entries()) {
-      if (entry instanceof Y.Map) out.push({ id, entry })
+    if (map) {
+      const out: IdeFileMeta[] = []
+      for (const [id, entry] of map.entries()) {
+        if (entry instanceof Y.Map) out.push(projectFileMeta(id, entry))
+      }
+      return out
     }
-    return out
+    const value = shellMap(doc).get('files')
+    if (!Array.isArray(value)) return []
+    return (value as SiteFile[]).map((file) => ({
+      id: file.id,
+      path: file.path,
+      updatedAt: file.updatedAt,
+    }))
   }
 
   const pathTaken = (path: string, exceptFileId?: string): boolean =>
-    allFiles().some(({ id, entry }) => id !== exceptFileId && entry.get('path') === path)
+    allFileMetas().some((file) => file.id !== exceptFileId && file.path === path)
 
   const requireSafePluginPath = (rawPath: string): string => {
     const normalized = normalizePath(rawPath)
@@ -126,8 +153,7 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
     synced: () => binding.synced,
 
     pluginFiles: () =>
-      allFiles()
-        .map(({ id, entry }) => projectFileMeta(id, entry))
+      allFileMetas()
         .filter((file) => file.path.startsWith(folder))
         .sort((a, b) => a.path.localeCompare(b.path)),
 
@@ -169,12 +195,7 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
         updatedAt: now,
       }
       doc.transact(() => {
-        let map = filesMap()
-        if (!map) {
-          map = new Y.Map<unknown>()
-          shellMap(doc).set('files', map)
-        }
-        map.set(id, buildSiteFileEntry(file))
+        ensureFilesMap().set(id, buildSiteFileEntry(file))
       }, IDE_ORIGIN)
       return id
     },
@@ -182,31 +203,28 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
     renameFile: (fileId, nextPath) => {
       const path = requireSafePluginPath(nextPath)
       if (pathTaken(path, fileId)) throw new Error(`A file at "${path}" already exists`)
-      const map = filesMap()
-      const entry = map?.get(fileId)
-      if (!(entry instanceof Y.Map)) return
       doc.transact(() => {
+        const entry = ensureFilesMap().get(fileId)
+        if (!(entry instanceof Y.Map)) return
         entry.set('path', path)
         entry.set('updatedAt', Date.now())
       }, IDE_ORIGIN)
     },
 
     deleteFile: (fileId) => {
-      const map = filesMap()
-      if (!map?.has(fileId)) return
       undoManagers.get(fileId)?.destroy()
       undoManagers.delete(fileId)
       doc.transact(() => {
-        map.delete(fileId)
+        ensureFilesMap().delete(fileId)
       }, IDE_ORIGIN)
     },
 
     replaceFileContent: (fileId, content) => {
-      const text = siteFileContentText(shellMap(doc), fileId)
-      const map = filesMap()
-      const entry = map?.get(fileId)
-      if (!text || !(entry instanceof Y.Map)) return
       doc.transact(() => {
+        const entry = ensureFilesMap().get(fileId)
+        if (!(entry instanceof Y.Map)) return
+        const text = entry.get('content')
+        if (!(text instanceof Y.Text)) return
         // Minimal splice (shared prefix/suffix preserved) so concurrent
         // remote edits outside the change survive the replacement.
         applyTextDiff(text, text.toString(), content)
diff --git a/src/admin/pages/plugins/ide/useSitePluginIde.ts b/src/admin/pages/plugins/ide/useSitePluginIde.ts
index f0c444226..40bc246a0 100644
--- a/src/admin/pages/plugins/ide/useSitePluginIde.ts
+++ b/src/admin/pages/plugins/ide/useSitePluginIde.ts
@@ -18,6 +18,7 @@ import {
 import { pushToast } from '@ui/components/Toast'
 import { StepUpCancelledMessage, useStepUp } from '@admin/shared/StepUp'
 import { useNavigate } from '@admin/lib/routing'
+import { notifyCmsPluginsChanged } from '@plugins/utils/pluginEvents'
 import { createIdeCollabSession, type IdeCollabSession, type IdeFileMeta } from './ideCollab'
 
 const ValidateResponseSchema = Type.Object({
@@ -189,6 +190,9 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
         apiRequest(`/admin/api/cms/site-plugins/${localId}/activate`, { method: 'POST' }),
       )
       pushToast({ kind: 'success', title: 'Site plugin activated' })
+      // Open editor sessions re-run their plugin activation pass so the new
+      // revision's module pack / editor entrypoint load without a reload.
+      notifyCmsPluginsChanged()
       await refreshSummary()
     } catch (err) {
       if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
@@ -210,6 +214,7 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
         apiRequest(`/admin/api/cms/site-plugins/${localId}/rollback`, { method: 'POST' }),
       )
       pushToast({ kind: 'success', title: 'Rolled back to the previous revision' })
+      notifyCmsPluginsChanged()
       await refreshSummary()
     } catch (err) {
       if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
@@ -231,6 +236,7 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
             body: { enabled },
           }),
         )
+        notifyCmsPluginsChanged()
         await refreshSummary()
       } catch (err) {
         if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
@@ -251,6 +257,7 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
         apiRequest(`/admin/api/cms/plugins/site.${localId}/restart`, { method: 'POST' }),
       )
       pushToast({ kind: 'success', title: 'Plugin restarted' })
+      notifyCmsPluginsChanged()
       await refreshSummary()
     } catch (err) {
       if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
@@ -269,6 +276,7 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
         apiRequest(`/admin/api/cms/site-plugins/${localId}`, { method: 'DELETE' }),
       )
       pushToast({ kind: 'success', title: 'Site plugin deleted' })
+      notifyCmsPluginsChanged()
       navigate('/admin/plugins')
     } catch (err) {
       if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
diff --git a/src/core/plugin-sdk/inlineRuntime.ts b/src/core/plugin-sdk/inlineRuntime.ts
new file mode 100644
index 000000000..1e357a033
--- /dev/null
+++ b/src/core/plugin-sdk/inlineRuntime.ts
@@ -0,0 +1,21 @@
+/**
+ * The SDK's INLINABLE runtime surface — what `@instatic/plugin-sdk` resolves
+ * to when a bundle must be self-contained (site plugin builds map the bare
+ * specifier here via the containment policy; sandbox and frontend bundles
+ * have no import map or module resolver).
+ *
+ * Deliberately NOT the full SDK barrel: the barrel re-exports TypeBox-backed
+ * schema modules (`contentSchemas`, `storageSchemas`, `guards`) that weigh
+ * hundreds of kilobytes and have tripped bundler tree-shake edge cases when
+ * inlined. Everything here is a pure data builder with no host-state, React,
+ * or TypeBox dependency. Types are erased at bundle time, so plugin authors
+ * still get the full typed surface from their editor.
+ */
+export { defineModule } from './builders/defineModule'
+export { control } from './builders/controls'
+export { escapeHtml, html, raw, safeUrl } from './builders/html'
+export { sitePluginRoute } from './sitePluginRoute'
+
+// Type-only re-exports — free at runtime, complete in the editor.
+export type * from './modules'
+export type * from './types'

From 80e2f8960b5191881ac816e86f572f0851f8a4e3 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 18:24:46 +0200
Subject: [PATCH 07/36] =?UTF-8?q?fix(plugins):=20IDE=20visual=20parity=20w?=
 =?UTF-8?q?ith=20the=20workspace=20shell=20=E2=80=94=20panel=20chrome,=20c?=
 =?UTF-8?q?anvas=20surface,=20explorer-identical=20tree?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Layout/design review feedback:

- Side panels no longer paint their own gray backgrounds — FileTreePane
  and ManifestPane now render inside the shared Panel shell (transparent
  over the sidebar's --bg-body black, standard PanelHeader with title +
  actions + close), exactly like the DOM panel and Content explorer.
- The editor column gets the standard elevated canvas treatment (the
  Data grid pattern): --bg-surface-2 with 16px rounded top corners over
  the black shell; the diagnostics strip is transparent chrome on that
  surface. All invented backgrounds removed.
- Tree rows recomposed to the Site Explorer's exact pattern: TreeRow as
  the shell with a ghost-Button hit surface (treeRowButton reset),
  TreeChevron + TreeIconSlot(icon=) + TreeLabelGroup, F2/double-click
  inline rename using the explorer's select-all/commit-on-blur behavior.
- The Files panel's ✕ collapses to the rail (state lifted to the page);
  the rail button and the manifest edge-notch reopen their panels —
  same affordances as Content/Data.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../plugins/ide/DiagnosticsStrip.module.css   |   2 +-
 .../pages/plugins/ide/FileTreePane.module.css |  51 ++---
 src/admin/pages/plugins/ide/FileTreePane.tsx  | 197 ++++++++++++------
 src/admin/pages/plugins/ide/IdeSidebar.tsx    |  85 ++++++--
 .../pages/plugins/ide/ManifestPane.module.css |  31 +--
 src/admin/pages/plugins/ide/ManifestPane.tsx  |  23 +-
 .../plugins/ide/SitePluginIdePage.module.css  |  12 +-
 .../pages/plugins/ide/SitePluginIdePage.tsx   |   4 +-
 8 files changed, 260 insertions(+), 145 deletions(-)

diff --git a/src/admin/pages/plugins/ide/DiagnosticsStrip.module.css b/src/admin/pages/plugins/ide/DiagnosticsStrip.module.css
index bc09ab359..cad0980e6 100644
--- a/src/admin/pages/plugins/ide/DiagnosticsStrip.module.css
+++ b/src/admin/pages/plugins/ide/DiagnosticsStrip.module.css
@@ -4,7 +4,7 @@
   display: flex;
   flex-direction: column;
   border-top: 1px solid var(--border-muted);
-  background: var(--bg-surface-2);
+  /* Transparent — part of the editor column's canvas surface. */
 }
 
 .header {
diff --git a/src/admin/pages/plugins/ide/FileTreePane.module.css b/src/admin/pages/plugins/ide/FileTreePane.module.css
index 7299ba980..9cc04f5d8 100644
--- a/src/admin/pages/plugins/ide/FileTreePane.module.css
+++ b/src/admin/pages/plugins/ide/FileTreePane.module.css
@@ -1,25 +1,10 @@
-.pane {
+/* The Panel shell owns chrome + background (transparent over the sidebar's
+   black) — this module only lays out the tree body. */
+
+.body {
   display: flex;
   flex-direction: column;
-  height: 100%;
   min-height: 0;
-  background: var(--bg-surface-2);
-}
-
-.header {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  padding: var(--space-s) var(--space-m);
-  border-bottom: 1px solid var(--border-muted);
-}
-
-.title {
-  font-size: var(--text-xs);
-  font-weight: 600;
-  text-transform: uppercase;
-  letter-spacing: 0.06em;
-  color: var(--text-subtle);
 }
 
 .tree {
@@ -29,6 +14,28 @@
   padding: var(--space-xs) 0;
 }
 
+/* Same reset the Site Explorer applies to its row buttons — the TreeRow
+   owns hover/selection paint; the button is a transparent hit surface. */
+.treeRowButton {
+  flex: 1;
+  min-width: 0;
+  height: 100%;
+  padding: 0;
+  gap: var(--space-4xs);
+  border-radius: 0;
+  background: transparent;
+  color: inherit;
+  font-size: inherit;
+  font-weight: inherit;
+  justify-content: flex-start;
+  text-align: left;
+}
+
+.treeRowButton:hover,
+.treeRowButton:active {
+  background: transparent;
+}
+
 .rowPeers {
   display: inline-flex;
   align-items: center;
@@ -37,12 +44,8 @@
   padding-right: var(--space-xs);
 }
 
-.inlineInput {
-  height: 22px;
-  font-size: var(--text-xs);
-}
-
 .footer {
+  flex-shrink: 0;
   border-top: 1px solid var(--border-muted);
   padding: var(--space-s) var(--space-m);
 }
diff --git a/src/admin/pages/plugins/ide/FileTreePane.tsx b/src/admin/pages/plugins/ide/FileTreePane.tsx
index c9d99d88a..c0e8dc605 100644
--- a/src/admin/pages/plugins/ide/FileTreePane.tsx
+++ b/src/admin/pages/plugins/ide/FileTreePane.tsx
@@ -1,12 +1,14 @@
 /**
  * FileTreePane — the Plugin IDE's file explorer.
  *
- * Rows derive from the plugin's live co-edited file list (folders inferred
- * from paths), rendered with the shared Tree primitives. Context menu on
- * rows offers new file, rename, and delete; new/rename edit inline. Peers
- * editing a file show as identity-colored avatars on its row.
+ * Composed from the SAME primitives as the Site Explorer / DOM panel trees:
+ * the shared `Panel` shell (chrome, header, close) with `TreeRow` rows whose
+ * interactive surface is a ghost Button (`TreeChevron` + `TreeIconSlot` +
+ * `TreeLabelGroup`), F2/double-click inline rename, and the standard
+ * point-anchored context menu. Peers editing a file show as identity
+ * avatars on its row.
  */
-import { useState, type KeyboardEvent, type MouseEvent } from 'react'
+import { useEffect, useRef, useState, type KeyboardEvent, type MouseEvent } from 'react'
 import {
   TreeChevron,
   TreeContainer,
@@ -15,6 +17,7 @@ import {
   TreeLabelGroup,
   TreeRow,
 } from '@site/ui/Tree'
+import { Panel } from '@admin/shared/Panel'
 import { ContextMenu, ContextMenuItem } from '@ui/components/ContextMenu'
 import { Button } from '@ui/components/Button'
 import { Input } from '@ui/components/Input'
@@ -98,6 +101,7 @@ interface FileTreePaneProps {
   onCreate: (relativePath: string) => void
   onRename: (fileId: string, relativePath: string) => void
   onDelete: (fileId: string) => void
+  onClose: () => void
 }
 
 export function FileTreePane({
@@ -110,6 +114,7 @@ export function FileTreePane({
   onCreate,
   onRename,
   onDelete,
+  onClose,
 }: FileTreePaneProps) {
   const folder = sitePluginFolder(localId)
   const [collapsed, setCollapsed] = useState<ReadonlySet<string>>(new Set())
@@ -173,12 +178,18 @@ export function FileTreePane({
   }
 
   return (
-    <div className={styles.pane} data-testid="ide-file-tree">
-      <header className={styles.header}>
-        <span className={styles.title}>Files</span>
+    <Panel
+      panelId="ide-files"
+      title="Files"
+      ariaLabel="Site plugin files"
+      testId="ide-file-tree"
+      body="bare"
+      bodyClassName={styles.body}
+      onClose={onClose}
+      headerActions={(
         <Button
           variant="ghost"
-          size="micro"
+          size="xs"
           iconOnly
           aria-label="New file"
           tooltip={canEdit ? 'New file' : 'Editing requires the site structure permission'}
@@ -188,57 +199,83 @@ export function FileTreePane({
         >
           <FilePlusSolidIcon size={14} aria-hidden="true" />
         </Button>
-      </header>
-
+      )}
+    >
       <div className={styles.tree}>
         <TreeContainer ariaLabel="Site plugin files">
           {rows.map((entry) => {
             const filePeers = entry.fileId ? (peersByFileId.get(entry.fileId) ?? []) : []
+            const isRenaming = entry.kind === 'file' && renamingFileId === entry.fileId
             return (
               <TreeRow
                 key={entry.key}
                 depth={entry.depth}
                 selected={entry.kind === 'file' && entry.fileId === activeFileId}
-                onClick={() => {
-                  if (entry.kind === 'folder') toggleFolder(entry.path)
-                  else if (entry.fileId) onSelect(entry.fileId)
-                }}
-                onContextMenu={(event) => openMenu(event, entry)}
+                role="treeitem"
+                aria-label={entry.label}
+                aria-level={entry.depth + 1}
+                aria-expanded={entry.kind === 'folder' ? !collapsed.has(entry.path) : undefined}
                 data-testid={entry.kind === 'file' ? 'ide-file-row' : 'ide-folder-row'}
                 data-path={entry.path}
               >
-                {entry.kind === 'folder' ? (
+                {isRenaming ? (
                   <>
-                    <TreeChevron expanded={!collapsed.has(entry.path)} />
-                    <TreeIconSlot>
-                      <FolderGlyphIcon size={12} aria-hidden="true" />
-                    </TreeIconSlot>
-                  </>
-                ) : (
-                  <TreeIconSlot>
-                    <FileTextSolidIcon size={12} aria-hidden="true" />
-                  </TreeIconSlot>
-                )}
-                <TreeLabelGroup>
-                  {entry.kind === 'file' && renamingFileId === entry.fileId ? (
-                    <InlinePathInput
-                      defaultValue={entry.path}
-                      onSubmit={(value) => submitRename(entry.fileId!, value)}
+                    <TreeIconSlot icon={FileTextSolidIcon} iconSize={12} />
+                    <InlineRenameInput
+                      value={entry.path}
+                      ariaLabel={`Rename ${entry.label}`}
+                      onCommit={(value) => submitRename(entry.fileId!, value)}
                       onCancel={() => setRenamingFileId(null)}
                     />
-                  ) : (
-                    <TreeLabel>{entry.label}</TreeLabel>
-                  )}
-                </TreeLabelGroup>
-                {filePeers.length > 0 && (
-                  <span
-                    className={styles.rowPeers}
-                    aria-label={`${filePeers.length} peer(s) editing this file`}
+                  </>
+                ) : (
+                  <Button
+                    variant="ghost"
+                    size="sm"
+                    align="start"
+                    className={styles.treeRowButton}
+                    aria-label={entry.label}
+                    onClick={() => {
+                      if (entry.kind === 'folder') toggleFolder(entry.path)
+                      else if (entry.fileId) onSelect(entry.fileId)
+                    }}
+                    onContextMenu={(event) => openMenu(event, entry)}
+                    onDoubleClick={(event) => {
+                      if (entry.kind !== 'file' || !canEdit) return
+                      event.preventDefault()
+                      event.stopPropagation()
+                      setRenamingFileId(entry.fileId ?? null)
+                    }}
+                    onKeyDown={(event) => {
+                      if (event.key === 'F2' && entry.kind === 'file' && canEdit) {
+                        event.preventDefault()
+                        event.stopPropagation()
+                        setRenamingFileId(entry.fileId ?? null)
+                      }
+                    }}
                   >
-                    {filePeers.slice(0, 3).map((peer) => (
-                      <PeerAvatar key={peer.clientId} user={peer.user} size={14} />
-                    ))}
-                  </span>
+                    {entry.kind === 'folder' ? (
+                      <>
+                        <TreeChevron expanded={!collapsed.has(entry.path)} />
+                        <TreeIconSlot icon={FolderGlyphIcon} iconSize={12} />
+                      </>
+                    ) : (
+                      <TreeIconSlot icon={FileTextSolidIcon} iconSize={12} />
+                    )}
+                    <TreeLabelGroup>
+                      <TreeLabel>{entry.label}</TreeLabel>
+                    </TreeLabelGroup>
+                    {filePeers.length > 0 && (
+                      <span
+                        className={styles.rowPeers}
+                        aria-label={`${filePeers.length} peer(s) editing this file`}
+                      >
+                        {filePeers.slice(0, 3).map((peer) => (
+                          <PeerAvatar key={peer.clientId} user={peer.user} size={14} />
+                        ))}
+                      </span>
+                    )}
+                  </Button>
                 )}
               </TreeRow>
             )
@@ -246,17 +283,14 @@ export function FileTreePane({
 
           {pendingNew !== null && (
             <TreeRow depth={pendingNew === '' ? 0 : pendingNew.split('/').length}>
-              <TreeIconSlot>
-                <FilePlusSolidIcon size={12} aria-hidden="true" />
-              </TreeIconSlot>
-              <TreeLabelGroup>
-                <InlinePathInput
-                  defaultValue={pendingNew === '' ? '' : `${pendingNew}/`}
-                  placeholder="path/to/file.ts"
-                  onSubmit={submitNew}
-                  onCancel={() => setPendingNew(null)}
-                />
-              </TreeLabelGroup>
+              <TreeIconSlot icon={FilePlusSolidIcon} iconSize={12} />
+              <InlineRenameInput
+                value={pendingNew === '' ? '' : `${pendingNew}/`}
+                placeholder="path/to/file.ts"
+                ariaLabel="New file path"
+                onCommit={submitNew}
+                onCancel={() => setPendingNew(null)}
+              />
             </TreeRow>
           )}
         </TreeContainer>
@@ -314,38 +348,65 @@ export function FileTreePane({
           )}
         </ContextMenu>
       )}
-    </div>
+    </Panel>
   )
 }
 
-interface InlinePathInputProps {
-  defaultValue: string
+interface InlineRenameInputProps {
+  value: string
+  ariaLabel: string
   placeholder?: string
-  onSubmit: (value: string) => void
+  onCommit: (value: string) => void
   onCancel: () => void
 }
 
-function InlinePathInput({ defaultValue, placeholder, onSubmit, onCancel }: InlinePathInputProps) {
-  const [value, setValue] = useState(defaultValue)
+/** Same behavior as the Site Explorer's inline rename: select-all on mount,
+ *  Enter commits, Escape cancels, blur commits (empty cancels). */
+function InlineRenameInput({
+  value,
+  ariaLabel,
+  placeholder,
+  onCommit,
+  onCancel,
+}: InlineRenameInputProps) {
+  const inputRef = useRef<HTMLInputElement>(null)
+
+  useEffect(() => {
+    requestAnimationFrame(() => inputRef.current?.select())
+  }, [])
+
+  function commit(): void {
+    const trimmed = inputRef.current?.value.trim() ?? ''
+    if (!trimmed) {
+      onCancel()
+      return
+    }
+    onCommit(trimmed)
+  }
+
   const handleKeyDown = (event: KeyboardEvent<HTMLInputElement>): void => {
     if (event.key === 'Enter') {
       event.preventDefault()
-      onSubmit(value)
-    } else if (event.key === 'Escape') {
+      event.stopPropagation()
+      commit()
+    }
+    if (event.key === 'Escape') {
       event.preventDefault()
+      event.stopPropagation()
       onCancel()
     }
   }
+
   return (
     <Input
+      ref={inputRef}
+      fieldSize="xs"
       autoFocus
-      value={value}
+      defaultValue={value}
       placeholder={placeholder}
-      aria-label="File path"
-      className={styles.inlineInput}
-      onChange={(event) => setValue(event.currentTarget.value)}
+      aria-label={ariaLabel}
+      onBlur={commit}
       onKeyDown={handleKeyDown}
-      onBlur={onCancel}
       onClick={(event) => event.stopPropagation()}
     />
   )
diff --git a/src/admin/pages/plugins/ide/IdeSidebar.tsx b/src/admin/pages/plugins/ide/IdeSidebar.tsx
index 125611045..821b47557 100644
--- a/src/admin/pages/plugins/ide/IdeSidebar.tsx
+++ b/src/admin/pages/plugins/ide/IdeSidebar.tsx
@@ -1,43 +1,94 @@
 /**
- * IdeSidebar — the IDE's left sidebar shell: the shared left-sidebar chrome
- * (width CSS vars + resize handle + persisted width) without a panel rail —
- * the IDE has exactly one pane (Files), so a rail would be dead chrome.
+ * IdeSidebar — the IDE's left sidebar, mirroring the Content workspace's
+ * sidebar exactly: the shared left-sidebar chrome (42px icon rail +
+ * absolutely-positioned panel slot + resize handle + persisted width), with
+ * a single Files rail button that toggles the file tree panel.
  */
 import { useRef, type CSSProperties, type ReactNode } from 'react'
+import { Button } from '@ui/components/Button'
+import { FileTextSolidIcon } from 'pixel-art-icons/icons/file-text-solid'
+import { railAccent, railTintVar } from '@ui/railAccent'
 import { useWorkspaceLayout } from '@admin/state/workspaceLayout'
 import { SidebarResizeHandle } from '@admin/shared/SidebarResizeHandle'
 import leftSidebarStyles from '@site/sidebars/LeftSidebar/LeftSidebar.module.css'
+import panelRailStyles from '@site/sidebars/PanelRail/PanelRail.module.css'
 
-export function IdeSidebar({ children }: { children: ReactNode }) {
+interface IdeSidebarProps {
+  children: ReactNode
+  panelOpen: boolean
+  onPanelOpenChange: (open: boolean) => void
+}
+
+export function IdeSidebar({ children, panelOpen, onPanelOpenChange }: IdeSidebarProps) {
   const sidebarRef = useRef<HTMLElement | null>(null)
   const leftSidebarWidth = useWorkspaceLayout((s) => s.leftSidebarWidth)
   const setLeftSidebarWidth = useWorkspaceLayout((s) => s.setLeftSidebarWidth)
+  const panelWidth = panelOpen ? leftSidebarWidth : 0
   const style = {
-    '--left-sidebar-panel-width': `${leftSidebarWidth}px`,
+    '--left-sidebar-panel-width': `${panelWidth}px`,
     '--left-sidebar-panel-layout-width': `${leftSidebarWidth}px`,
   } as CSSProperties
+  const accent = railAccent('pluginIde:files:Files')
+  const railButtonStyle = {
+    '--rail-icon-tint': railTintVar(accent),
+  } as CSSProperties
 
   return (
     <aside
       ref={sidebarRef}
       className={leftSidebarStyles.sidebar}
       data-testid="ide-left-sidebar"
-      data-expanded="true"
-      data-active-panel="files"
+      data-expanded={panelOpen ? 'true' : 'false'}
+      data-active-panel={panelOpen ? 'files' : 'none'}
       style={style}
     >
-      <div className={leftSidebarStyles.panelSlot}>
+      <nav
+        aria-label="Plugin IDE panel dock"
+        className={panelRailStyles.rail}
+        data-testid="ide-panel-rail"
+      >
+        <div className={panelRailStyles.primaryStack}>
+          <div className={panelRailStyles.itemGroup}>
+            <Button
+              variant="ghost"
+              size="md"
+              iconOnly
+              pressed={panelOpen}
+              aria-label={`${panelOpen ? 'Close' : 'Open'} Files panel`}
+              tooltip="Files panel"
+              data-testid="ide-rail-files"
+              data-icon="file-text-solid"
+              data-accent={accent}
+              style={railButtonStyle}
+              onClick={() => onPanelOpenChange(!panelOpen)}
+              className={panelRailStyles.railButton}
+            >
+              <span className={panelRailStyles.activeIndicator} aria-hidden="true" />
+              <FileTextSolidIcon size={16} className={panelRailStyles.railIcon} />
+            </Button>
+          </div>
+        </div>
+      </nav>
+
+      <div
+        className={leftSidebarStyles.panelSlot}
+        data-testid="ide-left-sidebar-panel-slot"
+        inert={panelOpen ? undefined : true}
+      >
         <div className={leftSidebarStyles.panelMount}>{children}</div>
       </div>
-      <SidebarResizeHandle
-        side="left"
-        width={leftSidebarWidth}
-        targetRef={sidebarRef}
-        cssVariable="--left-sidebar-panel-width"
-        layoutCssVariable="--left-sidebar-panel-layout-width"
-        ariaLabel="Resize file tree"
-        onResize={setLeftSidebarWidth}
-      />
+
+      {panelOpen && (
+        <SidebarResizeHandle
+          side="left"
+          width={leftSidebarWidth}
+          targetRef={sidebarRef}
+          cssVariable="--left-sidebar-panel-width"
+          layoutCssVariable="--left-sidebar-panel-layout-width"
+          ariaLabel="Resize file tree"
+          onResize={setLeftSidebarWidth}
+        />
+      )}
     </aside>
   )
 }
diff --git a/src/admin/pages/plugins/ide/ManifestPane.module.css b/src/admin/pages/plugins/ide/ManifestPane.module.css
index 70dd977c1..42eef9297 100644
--- a/src/admin/pages/plugins/ide/ManifestPane.module.css
+++ b/src/admin/pages/plugins/ide/ManifestPane.module.css
@@ -1,31 +1,8 @@
-.pane {
-  display: flex;
-  flex-direction: column;
-  height: 100%;
-  min-height: 0;
+/* The Panel shell owns chrome + background — this module only lays out
+   the scrollable body. */
+.body {
   overflow-y: auto;
-  background: var(--bg-surface-2);
-}
-
-.header {
-  position: sticky;
-  top: 0;
-  z-index: 1;
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  padding: var(--space-s) var(--space-m);
-  border-bottom: 1px solid var(--border-muted);
-  background: var(--bg-surface-2);
-}
-
-.title {
-  margin: 0;
-  font-size: var(--text-xs);
-  font-weight: 600;
-  text-transform: uppercase;
-  letter-spacing: 0.06em;
-  color: var(--text-subtle);
+  min-height: 0;
 }
 
 .sections {
diff --git a/src/admin/pages/plugins/ide/ManifestPane.tsx b/src/admin/pages/plugins/ide/ManifestPane.tsx
index 742e53d8a..f3ccd3dac 100644
--- a/src/admin/pages/plugins/ide/ManifestPane.tsx
+++ b/src/admin/pages/plugins/ide/ManifestPane.tsx
@@ -27,6 +27,8 @@ import { Button } from '@ui/components/Button'
 import { Input } from '@ui/components/Input'
 import { Switch } from '@ui/components/Switch'
 import { Separator } from '@ui/components/Separator'
+import { Panel } from '@admin/shared/Panel'
+import { useWorkspaceLayout } from '@admin/state/workspaceLayout'
 import type { IdeCollabSession, IdeFileMeta } from './ideCollab'
 import styles from './ManifestPane.module.css'
 
@@ -64,6 +66,7 @@ export function ManifestPane({
   canEdit,
   onOpenRawJson,
 }: ManifestPaneProps) {
+  const setRightPanel = useWorkspaceLayout((s) => s.setRightPanel)
   const manifestFile = files.find((file) => file.path.endsWith('/plugin.json')) ?? null
   const manifestFileId = manifestFile?.id ?? null
 
@@ -129,14 +132,22 @@ export function ManifestPane({
   const detectedEntrypoints = detectEntrypoints(files)
 
   return (
-    <div className={styles.pane} data-testid="ide-manifest-pane">
-      <header className={styles.header}>
-        <h2 className={styles.title}>Manifest</h2>
+    // Shared panel shell — chrome, header, transparent background (the
+    // right sidebar owns the surface). The ✕ collapses the panel; the
+    // layout's edge notch reopens it, exactly like Content's settings.
+    <Panel
+      panelId="ide-manifest"
+      title="Manifest"
+      testId="ide-manifest-pane"
+      body="bare"
+      bodyClassName={styles.body}
+      onClose={() => setRightPanel({ collapsed: true })}
+      headerActions={(
         <Button variant="ghost" size="xs" onClick={onOpenRawJson}>
           Edit raw JSON
         </Button>
-      </header>
-
+      )}
+    >
       {parsed.error ? (
         <div className={styles.parseError} role="alert">
           <p>plugin.json can’t be edited structurally right now:</p>
@@ -267,7 +278,7 @@ export function ManifestPane({
           </section>
         </div>
       )}
-    </div>
+    </Panel>
   )
 }
 
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.module.css b/src/admin/pages/plugins/ide/SitePluginIdePage.module.css
index 332eae6b9..499851389 100644
--- a/src/admin/pages/plugins/ide/SitePluginIdePage.module.css
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.module.css
@@ -1,9 +1,19 @@
 .editorColumn {
   display: flex;
   flex-direction: column;
+  /* The layout's .canvasContent is a flex row — without flex:1 the editor
+     column sizes to its content instead of filling the stage. */
+  flex: 1;
+  min-width: 0;
   height: 100%;
   min-height: 0;
-  background: var(--bg-surface);
+  overflow: hidden;
+  /* The standard elevated canvas surface (same treatment as the Data
+     grid): the shell stays --bg-body black; the working area sits on
+     --bg-surface-2 with rounded top corners. */
+  background: var(--bg-surface-2);
+  border-top-left-radius: 16px;
+  border-top-right-radius: 16px;
 }
 
 .editorArea {
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
index 0ae2d4005..d9c89b8cd 100644
--- a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
@@ -66,6 +66,7 @@ function SitePluginIde({ localId }: { localId: string }) {
   const canInstall = canInstallPlugins(currentUser)
   const [pendingDelete, setPendingDelete] = useState<PendingDelete | null>(null)
   const [reviewOpen, setReviewOpen] = useState(false)
+  const [filesPanelOpen, setFilesPanelOpen] = useState(true)
 
   const vm = useSitePluginIde(localId)
   const { session, files, activeFileId, selectFile, runValidation } = vm
@@ -105,8 +106,9 @@ function SitePluginIde({ localId }: { localId: string }) {
     <AdminWorkspaceCanvasLayout
       workspace="pluginIde"
       contentSidebar={(
-        <IdeSidebar>
+        <IdeSidebar panelOpen={filesPanelOpen} onPanelOpenChange={setFilesPanelOpen}>
           <FileTreePane
+            onClose={() => setFilesPanelOpen(false)}
             localId={localId}
             files={files}
             activeFileId={activeFileId}

From ce689c6b968ac70a9959efa1eae43e8a8b768bb4 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 20:18:26 +0200
Subject: [PATCH 08/36] =?UTF-8?q?fix(collab):=20connect=20the=20site=20soc?=
 =?UTF-8?q?ket=20directly=20to=20the=20CMS=20in=20dev=20=E2=80=94=20Vite's?=
 =?UTF-8?q?=20ws=20proxy=20is=20broken=20under=20Bun?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Testing on the standard `bun run dev` stack surfaced that the collab
WebSocket never connects through the Vite proxy: Vite's bundled
http-proxy calls socket.destroySoon on the upgrade path, which Bun's
net.Socket does not implement — upgrades die before establishing (and
the failure can crash Vite outright). Every collab surface (site editor
co-editing AND the Plugin IDE) was stuck at 'Connecting to the live
draft…' in dev.

- vite.config.ts injects __INSTATIC_CMS_DEV_ORIGIN__ (the CMS origin the
  proxy already targets); in dev the collab client connects the socket
  DIRECTLY to it, skipping the proxy hop. Cookies are host-scoped
  (port-agnostic on localhost) and the CMS Origin allowlist admits the
  Vite dev origins, so the direct hop stays fully authenticated.
  Production serves admin + API from one origin and keeps the
  same-origin path (import.meta.env.DEV gates the branch).
- ManifestPane no longer claims 'plugin.json is missing' while the doc
  is still syncing — it shows the connecting state until first sync.
- bundle-size gate: the per-icon-chunk check now verifies chunk CONTENT
  (svg body without a grouped-chunk import) — rolldown legitimately
  names shared feature chunks after member modules ('upload' helpers)
  that collide with icon names.

Verified on a fresh `bun run dev` (vite-on-Bun, :5173/:3001): account
setup → New site plugin → IDE fully loads (tree, buffer, diagnostics,
manifest), site editor reaches 'Draft synced', zero WebSocket errors.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../architecture/bundle-size-budgets.test.ts  | 16 +++++++++---
 .../pages/plugins/ide/ManifestPane.module.css |  7 ++++++
 src/admin/pages/plugins/ide/ManifestPane.tsx  | 10 +++++++-
 .../pages/plugins/ide/SitePluginIdePage.tsx   |  1 +
 src/admin/pages/site/collab/collabProvider.ts | 25 +++++++++++++++++++
 vite.config.ts                                | 13 ++++++++++
 6 files changed, 68 insertions(+), 4 deletions(-)

diff --git a/src/__tests__/architecture/bundle-size-budgets.test.ts b/src/__tests__/architecture/bundle-size-budgets.test.ts
index 1ce6f51da..22b0362a7 100644
--- a/src/__tests__/architecture/bundle-size-budgets.test.ts
+++ b/src/__tests__/architecture/bundle-size-budgets.test.ts
@@ -323,9 +323,19 @@ describe('Bundle size budgets', () => {
     const iconChunkPatterns = vendoredIconNames().map(
       (iconName) => new RegExp(`^${regexEscape(iconName)}-[A-Za-z0-9_-]+\\.js$`),
     )
-    const individualIconChunks = readdirSync(DIST_ASSETS).filter((asset) =>
-      iconChunkPatterns.some((pattern) => pattern.test(asset)),
-    )
+    const individualIconChunks = readdirSync(DIST_ASSETS).filter((asset) => {
+      if (!iconChunkPatterns.some((pattern) => pattern.test(asset))) return false
+      // Name-collision guard: rolldown names shared feature chunks after one
+      // of their modules, and a feature module can legitimately share a name
+      // with an icon (e.g. an "upload" helpers chunk vs the upload icon). A
+      // chunk that IMPORTS the grouped icon chunk is a consumer, not an
+      // escaped icon — only an actual icon module body (svg markup, no
+      // grouped-chunk import) counts as a violation.
+      const source = readFileSync(join(DIST_ASSETS, asset), 'utf8')
+      const importsGroupedIcons = source.includes('./pixel-art-icons-')
+      const looksLikeIconBody = source.includes('viewBox')
+      return !importsGroupedIcons && looksLikeIconBody
+    })
 
     expect(individualIconChunks).toEqual([])
   })
diff --git a/src/admin/pages/plugins/ide/ManifestPane.module.css b/src/admin/pages/plugins/ide/ManifestPane.module.css
index 42eef9297..8bd0e8ab0 100644
--- a/src/admin/pages/plugins/ide/ManifestPane.module.css
+++ b/src/admin/pages/plugins/ide/ManifestPane.module.css
@@ -5,6 +5,13 @@
   min-height: 0;
 }
 
+.connecting {
+  margin: 0;
+  padding: var(--space-m);
+  font-size: var(--text-xs);
+  color: var(--text-subtle);
+}
+
 .sections {
   display: flex;
   flex-direction: column;
diff --git a/src/admin/pages/plugins/ide/ManifestPane.tsx b/src/admin/pages/plugins/ide/ManifestPane.tsx
index f3ccd3dac..eba7e5ce8 100644
--- a/src/admin/pages/plugins/ide/ManifestPane.tsx
+++ b/src/admin/pages/plugins/ide/ManifestPane.tsx
@@ -38,6 +38,9 @@ interface ManifestPaneProps {
   files: IdeFileMeta[]
   summary: SitePluginSummary | null
   canEdit: boolean
+  /** False until the site doc's first sync — the pane must not claim
+   *  plugin.json is missing while the draft is still arriving. */
+  synced: boolean
   onOpenRawJson: () => void
 }
 
@@ -64,6 +67,7 @@ export function ManifestPane({
   files,
   summary,
   canEdit,
+  synced,
   onOpenRawJson,
 }: ManifestPaneProps) {
   const setRightPanel = useWorkspaceLayout((s) => s.setRightPanel)
@@ -148,7 +152,11 @@ export function ManifestPane({
         </Button>
       )}
     >
-      {parsed.error ? (
+      {!synced ? (
+        <p className={styles.connecting} role="status">
+          Connecting to the live draft…
+        </p>
+      ) : parsed.error ? (
         <div className={styles.parseError} role="alert">
           <p>plugin.json can’t be edited structurally right now:</p>
           <p className={styles.parseErrorDetail}>{parsed.error}</p>
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
index d9c89b8cd..112f8c878 100644
--- a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
@@ -175,6 +175,7 @@ function SitePluginIde({ localId }: { localId: string }) {
             files={files}
             summary={vm.summary}
             canEdit={canEdit}
+            synced={vm.synced}
             onOpenRawJson={() => {
               const manifest = files.find((file) => file.path === `${folder}plugin.json`)
               if (manifest) selectFile(manifest.id)
diff --git a/src/admin/pages/site/collab/collabProvider.ts b/src/admin/pages/site/collab/collabProvider.ts
index b22c8a705..166d750e1 100644
--- a/src/admin/pages/site/collab/collabProvider.ts
+++ b/src/admin/pages/site/collab/collabProvider.ts
@@ -58,6 +58,31 @@ const PING_INTERVAL_MS = 10_000
  */
 const MAX_BACKLOG_BYTES = 512 * 1024
 
+/**
+ * Dev-only: the CMS server's own origin, injected by `vite.config.ts`
+ * (`define`). Vite's WebSocket proxying is broken when Vite runs under Bun
+ * (its bundled http-proxy calls `socket.destroySoon`, which Bun's
+ * net.Socket lacks — upgrades die before establishing), so in dev the
+ * socket connects DIRECTLY to the CMS instead of through the proxy.
+ * Cookies are host-scoped (port-agnostic on localhost) and the CMS's
+ * Origin allowlist admits the Vite dev origins, so the direct hop stays
+ * fully authenticated. Production serves admin + API from one origin and
+ * uses the same-origin path.
+ */
+declare const __INSTATIC_CMS_DEV_ORIGIN__: string | undefined
+
+function socketBaseUrl(): string {
+  if (
+    import.meta.env.DEV &&
+    typeof __INSTATIC_CMS_DEV_ORIGIN__ === 'string' &&
+    __INSTATIC_CMS_DEV_ORIGIN__.length > 0
+  ) {
+    return __INSTATIC_CMS_DEV_ORIGIN__.replace(/^http/, 'ws')
+  }
+  const protocol = window.location.protocol === 'https:' ? 'wss' : 'ws'
+  return `${protocol}://${window.location.host}`
+}
+
 /** y-protocols/sync message types (payload's first varUint). */
 const SYNC_STEP_2 = 1
 
diff --git a/vite.config.ts b/vite.config.ts
index 4d9f589c4..f8cbbb02b 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -165,6 +165,19 @@ function vendorChunkName(moduleId: string): string | null {
 
 // https://vite.dev/config/
 export default defineConfig({
+  // Dev-only constant consumed by the collab socket client
+  // (src/admin/pages/site/collab/collabProvider.ts): Vite's WebSocket
+  // proxying is broken when Vite runs under Bun (its bundled http-proxy
+  // calls `socket.destroySoon`, which Bun's net.Socket does not implement,
+  // so upgrades die — and the proxy can crash Vite outright). In dev the
+  // client therefore connects the site socket DIRECTLY to the CMS origin.
+  // Cookies are host-scoped (port-agnostic on localhost) and the CMS's
+  // Origin allowlist admits the Vite dev origins, so the direct hop is
+  // fully authenticated. Production serves admin + API from one origin —
+  // this constant compiles to undefined there and the same-origin path runs.
+  define: {
+    __INSTATIC_CMS_DEV_ORIGIN__: JSON.stringify(CMS_DEV_SERVER_ORIGIN),
+  },
   plugins: [
     publicSiteDevProxyPlugin(),
     react(),

From 2786e801ed451d856468b1379f38d6f23eb05e86 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 20:50:18 +0200
Subject: [PATCH 09/36] refactor(plugin-ide): drop the structured manifest
 panel

The right-side ManifestPane duplicated what the raw plugin.json buffer
already does for the IDE's developer audience: the diagnostics strip names
every manifest mistake, and the activation review dialog is where
permissions get human-readable treatment. Removing it simplifies the IDE
to file tree + co-edited buffer + diagnostics.

- delete ManifestPane (+ CSS module) and the contentRightPanel wiring
- remove the now-dead replaceFileContent from IdeCollabSession
- drop the pluginIde 'manifest' notch label from the workspace layout
- docs: describe raw plugin.json as the only manifest surface

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 docs/features/site-plugins.md                 |  16 +-
 .../AdminWorkspaceCanvasLayout.tsx            |   3 +-
 .../pages/plugins/ide/ManifestPane.module.css | 160 ---------
 src/admin/pages/plugins/ide/ManifestPane.tsx  | 307 ------------------
 .../pages/plugins/ide/SitePluginIdePage.tsx   |  25 +-
 src/admin/pages/plugins/ide/ideCollab.ts      |  16 -
 6 files changed, 14 insertions(+), 513 deletions(-)
 delete mode 100644 src/admin/pages/plugins/ide/ManifestPane.module.css
 delete mode 100644 src/admin/pages/plugins/ide/ManifestPane.tsx

diff --git a/docs/features/site-plugins.md b/docs/features/site-plugins.md
index 9493087e1..978f84011 100644
--- a/docs/features/site-plugins.md
+++ b/docs/features/site-plugins.md
@@ -139,8 +139,10 @@ are disabled with an inline reason, never hidden.
 
 `/admin/plugins/develop/<local-id>` — a full-screen workspace-canvas route
 (`AdminWorkspace: 'pluginIde'`, layout persistence like every canvas):
-file tree (left, resizable), co-edited CodeMirror buffer + diagnostics
-strip (center), structured manifest panel (right, edge-notch reopen).
+file tree (left, resizable) and the co-edited CodeMirror buffer with the
+diagnostics strip beneath it. There is deliberately no right panel:
+`plugin.json` is edited as raw JSON in the buffer (auto-selected on open),
+and every manifest mistake surfaces as a named diagnostic.
 
 **Live multi-author co-editing**: the shell's `files` key is a granular
 Y.Map — one entry per file id, `content` as Y.Text (`@core/collab/filesY.ts`).
@@ -149,7 +151,7 @@ The IDE binds ONLY `site:default` over the site socket (its own
 
 - two admins co-type one file character-level, with per-peer colored carets
   (y-codemirror.next);
-- file CRUD, renames, and manifest edits merge per-field;
+- file CRUD and renames merge per-field;
 - the site editor's code panel rides the same granularity;
 - presence is shared: site editors see IDE users in their roster; IDE rows
   show who's editing which file;
@@ -158,10 +160,10 @@ The IDE binds ONLY `site:default` over the site socket (its own
 There is no save button — the relay persists continuously; Cmd+S re-runs
 diagnostics. Automatic validation runs debounced on every change.
 
-The manifest panel is the PRIMARY `plugin.json` editor (permission
-checklist with the `editor.code` danger note, network hosts, derived fields
-read-only); raw JSON = opening plugin.json in the buffer. Structured writes
-splice the file's Y.Text minimally so concurrent manifest edits merge.
+`plugin.json` has no structured editor — the raw buffer is the manifest
+surface. Manifest coherence (e.g. an `editor/` entry file without
+`editor.code` declared) is enforced by validation, and the human-readable
+permission treatment lives where it matters: the activation review dialog.
 
 ## Publish coupling, retention, preview
 
diff --git a/src/admin/layouts/AdminWorkspaceCanvasLayout/AdminWorkspaceCanvasLayout.tsx b/src/admin/layouts/AdminWorkspaceCanvasLayout/AdminWorkspaceCanvasLayout.tsx
index f1a1d8b61..4e95c2523 100644
--- a/src/admin/layouts/AdminWorkspaceCanvasLayout/AdminWorkspaceCanvasLayout.tsx
+++ b/src/admin/layouts/AdminWorkspaceCanvasLayout/AdminWorkspaceCanvasLayout.tsx
@@ -126,8 +126,7 @@ interface WorkspaceRightPanelNotchProps {
 }
 
 function WorkspaceRightPanelNotch({ workspace, onOpen }: WorkspaceRightPanelNotchProps) {
-  const label =
-    workspace === 'content' ? 'settings' : workspace === 'pluginIde' ? 'manifest' : 'inspector'
+  const label = workspace === 'content' ? 'settings' : 'inspector'
   const testId = workspace === 'content' ? 'content-settings-notch' : `${workspace}-inspector-notch`
   const stopCanvasInteraction = (event: SyntheticEvent) => {
     event.stopPropagation()
diff --git a/src/admin/pages/plugins/ide/ManifestPane.module.css b/src/admin/pages/plugins/ide/ManifestPane.module.css
deleted file mode 100644
index 8bd0e8ab0..000000000
--- a/src/admin/pages/plugins/ide/ManifestPane.module.css
+++ /dev/null
@@ -1,160 +0,0 @@
-/* The Panel shell owns chrome + background — this module only lays out
-   the scrollable body. */
-.body {
-  overflow-y: auto;
-  min-height: 0;
-}
-
-.connecting {
-  margin: 0;
-  padding: var(--space-m);
-  font-size: var(--text-xs);
-  color: var(--text-subtle);
-}
-
-.sections {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-m);
-  padding: var(--space-m);
-}
-
-.section {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-xs);
-}
-
-.sectionTitle {
-  margin: 0;
-  font-size: var(--text-xs);
-  font-weight: 600;
-  color: var(--text);
-}
-
-.sectionHint {
-  margin: 0;
-  font-size: var(--text-xs);
-  line-height: 1.5;
-  color: var(--text-subtle);
-}
-
-.fieldLabel {
-  font-size: var(--text-xs);
-  color: var(--text-subtle);
-}
-
-.permissionList {
-  margin: 0;
-  padding: 0;
-  list-style: none;
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-3xs);
-}
-
-.permissionRow {
-  display: flex;
-  align-items: center;
-  gap: var(--space-s);
-}
-
-.permissionText {
-  display: flex;
-  flex-direction: column;
-  min-width: 0;
-}
-
-.permissionId {
-  font-family: var(--font-mono);
-  font-size: var(--text-2xs);
-  color: var(--text);
-}
-
-.permissionLabel {
-  font-size: var(--text-2xs);
-  color: var(--text-subtle);
-}
-
-.dangerNote {
-  margin: 0;
-  padding: var(--space-xs) var(--space-s);
-  border-radius: var(--radius);
-  font-size: var(--text-xs);
-  line-height: 1.5;
-  color: var(--text);
-  background: var(--bg-surface-3);
-  border-left: 2px solid var(--danger);
-}
-
-.hostList {
-  margin: 0;
-  padding: 0;
-  list-style: none;
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-3xs);
-}
-
-.hostRow {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: var(--space-s);
-}
-
-.hostName {
-  font-family: var(--font-mono);
-  font-size: var(--text-xs);
-  color: var(--text);
-}
-
-.hostAdd {
-  display: flex;
-  align-items: center;
-  gap: var(--space-xs);
-}
-
-.derivedList {
-  display: grid;
-  grid-template-columns: auto 1fr;
-  gap: var(--space-3xs) var(--space-s);
-  margin: 0;
-  font-size: var(--text-xs);
-}
-
-.derivedList dt {
-  color: var(--text-subtle);
-}
-
-.derivedList dd {
-  margin: 0;
-  color: var(--text);
-  overflow-wrap: anywhere;
-}
-
-.derivedList code {
-  font-family: var(--font-mono);
-  font-size: var(--text-2xs);
-}
-
-.parseError {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-s);
-  padding: var(--space-m);
-  font-size: var(--text-xs);
-  color: var(--text);
-}
-
-.parseError p {
-  margin: 0;
-}
-
-.parseErrorDetail {
-  font-family: var(--font-mono);
-  font-size: var(--text-2xs);
-  color: var(--danger);
-  white-space: pre-wrap;
-  word-break: break-word;
-}
diff --git a/src/admin/pages/plugins/ide/ManifestPane.tsx b/src/admin/pages/plugins/ide/ManifestPane.tsx
deleted file mode 100644
index eba7e5ce8..000000000
--- a/src/admin/pages/plugins/ide/ManifestPane.tsx
+++ /dev/null
@@ -1,307 +0,0 @@
-/**
- * ManifestPane — the structured `plugin.json` editor (the IDE's right panel).
- *
- * The panel is the PRIMARY manifest surface: name/description fields,
- * a permission checklist (with the dangerous-code warning on editor.code),
- * network allowlist entries, and read-only derived fields (id, active
- * version, detected entrypoints). Raw JSON stays available by opening
- * plugin.json in the editor — the escape hatch, not the default.
- *
- * Writes rewrite the plugin.json file content as a minimal Y.Text splice,
- * so a peer's concurrent manifest edit merges instead of clobbering.
- */
-import { useSyncExternalStore, useCallback, useRef, useState } from 'react'
-import { safeParseJson } from '@core/utils/jsonValidate'
-import {
-  SitePluginDraftManifestSchema,
-  sitePluginIdFromLocalId,
-  type SitePluginDraftManifest,
-  type SitePluginSummary,
-} from '@core/site-plugins'
-import {
-  PLUGIN_PERMISSION_VALUES,
-  permissionLabel,
-  type PluginPermission,
-} from '@core/plugin-sdk'
-import { Button } from '@ui/components/Button'
-import { Input } from '@ui/components/Input'
-import { Switch } from '@ui/components/Switch'
-import { Separator } from '@ui/components/Separator'
-import { Panel } from '@admin/shared/Panel'
-import { useWorkspaceLayout } from '@admin/state/workspaceLayout'
-import type { IdeCollabSession, IdeFileMeta } from './ideCollab'
-import styles from './ManifestPane.module.css'
-
-interface ManifestPaneProps {
-  session: IdeCollabSession
-  localId: string
-  files: IdeFileMeta[]
-  summary: SitePluginSummary | null
-  canEdit: boolean
-  /** False until the site doc's first sync — the pane must not claim
-   *  plugin.json is missing while the draft is still arriving. */
-  synced: boolean
-  onOpenRawJson: () => void
-}
-
-interface ParsedManifest {
-  manifest: SitePluginDraftManifest | null
-  error: string | null
-  raw: string
-}
-
-function parseManifest(raw: string | null): ParsedManifest {
-  if (raw === null) {
-    return { manifest: null, error: 'plugin.json is missing', raw: '' }
-  }
-  const result = safeParseJson(raw, SitePluginDraftManifestSchema)
-  if (!result.ok) {
-    return { manifest: null, error: result.error.message, raw }
-  }
-  return { manifest: result.value, error: null, raw }
-}
-
-export function ManifestPane({
-  session,
-  localId,
-  files,
-  summary,
-  canEdit,
-  synced,
-  onOpenRawJson,
-}: ManifestPaneProps) {
-  const setRightPanel = useWorkspaceLayout((s) => s.setRightPanel)
-  const manifestFile = files.find((file) => file.path.endsWith('/plugin.json')) ?? null
-  const manifestFileId = manifestFile?.id ?? null
-
-  // Manifest content is CRDT state — subscribe to the file's text and parse
-  // per change (cached snapshot keeps renders referentially stable).
-  const parsedCache = useRef<ParsedManifest & { source: string | null }>({
-    manifest: null,
-    error: 'plugin.json is missing',
-    raw: '',
-    source: null,
-  })
-  const subscribe = useCallback(
-    (onStoreChange: () => void) => session.onFilesChange(onStoreChange),
-    [session],
-  )
-  const getSnapshot = useCallback((): ParsedManifest => {
-    const raw = manifestFileId ? (session.contentText(manifestFileId)?.toString() ?? null) : null
-    if (raw !== parsedCache.current.source) {
-      parsedCache.current = { ...parseManifest(raw), source: raw }
-    }
-    return parsedCache.current
-  }, [session, manifestFileId])
-  const parsed = useSyncExternalStore(subscribe, getSnapshot)
-
-  const [hostDraft, setHostDraft] = useState('')
-
-  const writeManifest = (update: (current: SitePluginDraftManifest) => SitePluginDraftManifest): void => {
-    if (!manifestFileId || !parsed.manifest) return
-    const next = update(parsed.manifest)
-    session.replaceFileContent(manifestFileId, `${JSON.stringify(next, null, 2)}\n`)
-  }
-
-  const permissions = parsed.manifest?.permissions ?? []
-  const togglePermission = (permission: PluginPermission, enabled: boolean): void => {
-    writeManifest((current) => ({
-      ...current,
-      permissions: enabled
-        ? [...(current.permissions ?? []), permission]
-        : (current.permissions ?? []).filter((p) => p !== permission),
-    }))
-  }
-
-  const hosts = parsed.manifest?.networkAllowedHosts ?? []
-  const addHost = (): void => {
-    const host = hostDraft.trim().toLowerCase()
-    if (!host || hosts.includes(host)) return
-    writeManifest((current) => ({
-      ...current,
-      networkAllowedHosts: [...(current.networkAllowedHosts ?? []), host],
-    }))
-    setHostDraft('')
-  }
-  const removeHost = (host: string): void => {
-    writeManifest((current) => {
-      const remaining = (current.networkAllowedHosts ?? []).filter((h) => h !== host)
-      const next = { ...current }
-      if (remaining.length > 0) next.networkAllowedHosts = remaining
-      else delete next.networkAllowedHosts
-      return next
-    })
-  }
-
-  const detectedEntrypoints = detectEntrypoints(files)
-
-  return (
-    // Shared panel shell — chrome, header, transparent background (the
-    // right sidebar owns the surface). The ✕ collapses the panel; the
-    // layout's edge notch reopens it, exactly like Content's settings.
-    <Panel
-      panelId="ide-manifest"
-      title="Manifest"
-      testId="ide-manifest-pane"
-      body="bare"
-      bodyClassName={styles.body}
-      onClose={() => setRightPanel({ collapsed: true })}
-      headerActions={(
-        <Button variant="ghost" size="xs" onClick={onOpenRawJson}>
-          Edit raw JSON
-        </Button>
-      )}
-    >
-      {!synced ? (
-        <p className={styles.connecting} role="status">
-          Connecting to the live draft…
-        </p>
-      ) : parsed.error ? (
-        <div className={styles.parseError} role="alert">
-          <p>plugin.json can’t be edited structurally right now:</p>
-          <p className={styles.parseErrorDetail}>{parsed.error}</p>
-          <Button variant="secondary" size="sm" onClick={onOpenRawJson}>
-            Fix in raw JSON
-          </Button>
-        </div>
-      ) : (
-        <div className={styles.sections}>
-          <section className={styles.section}>
-            <label className={styles.fieldLabel} htmlFor="ide-manifest-name">
-              Name
-            </label>
-            <Input
-              id="ide-manifest-name"
-              value={parsed.manifest?.name ?? ''}
-              disabled={!canEdit}
-              onChange={(event) => {
-                const name = event.currentTarget.value
-                writeManifest((current) => ({ ...current, name }))
-              }}
-            />
-            <label className={styles.fieldLabel} htmlFor="ide-manifest-description">
-              Description
-            </label>
-            <Input
-              id="ide-manifest-description"
-              value={parsed.manifest?.description ?? ''}
-              disabled={!canEdit}
-              onChange={(event) => {
-                const description = event.currentTarget.value
-                writeManifest((current) => ({ ...current, description }))
-              }}
-            />
-          </section>
-
-          <Separator />
-
-          <section className={styles.section}>
-            <h3 className={styles.sectionTitle}>Permissions</h3>
-            <p className={styles.sectionHint}>
-              Declared here; granted by an operator at Build &amp; activate.
-            </p>
-            <ul className={styles.permissionList}>
-              {PLUGIN_PERMISSION_VALUES.map((permission) => (
-                <li key={permission} className={styles.permissionRow}>
-                  <Switch
-                    checked={permissions.includes(permission)}
-                    disabled={!canEdit}
-                    onCheckedChange={(checked) => togglePermission(permission, checked)}
-                    aria-label={`Permission ${permission}`}
-                  />
-                  <span className={styles.permissionText}>
-                    <span className={styles.permissionId}>{permission}</span>
-                    <span className={styles.permissionLabel}>{permissionLabel(permission)}</span>
-                  </span>
-                </li>
-              ))}
-            </ul>
-            {permissions.includes('editor.code') && (
-              <p className={styles.dangerNote} role="note">
-                editor.code runs this plugin’s JavaScript unsandboxed in every
-                admin’s browser. Operators see a warning before granting it.
-              </p>
-            )}
-          </section>
-
-          <Separator />
-
-          <section className={styles.section}>
-            <h3 className={styles.sectionTitle}>Outbound network hosts</h3>
-            <p className={styles.sectionHint}>
-              Requires the network.outbound permission. One hostname per entry;
-              `*.example.com` matches one subdomain level.
-            </p>
-            <ul className={styles.hostList}>
-              {hosts.map((host) => (
-                <li key={host} className={styles.hostRow}>
-                  <code className={styles.hostName}>{host}</code>
-                  <Button
-                    variant="ghost"
-                    size="micro"
-                    disabled={!canEdit}
-                    onClick={() => removeHost(host)}
-                  >
-                    Remove
-                  </Button>
-                </li>
-              ))}
-            </ul>
-            <div className={styles.hostAdd}>
-              <Input
-                value={hostDraft}
-                placeholder="api.example.com"
-                aria-label="Add allowed host"
-                disabled={!canEdit}
-                onChange={(event) => setHostDraft(event.currentTarget.value)}
-                onKeyDown={(event) => {
-                  if (event.key === 'Enter') {
-                    event.preventDefault()
-                    addHost()
-                  }
-                }}
-              />
-              <Button variant="secondary" size="xs" disabled={!canEdit || !hostDraft.trim()} onClick={addHost}>
-                Add
-              </Button>
-            </div>
-          </section>
-
-          <Separator />
-
-          <section className={styles.section}>
-            <h3 className={styles.sectionTitle}>Derived by the build</h3>
-            <dl className={styles.derivedList}>
-              <dt>Plugin id</dt>
-              <dd>
-                <code>{sitePluginIdFromLocalId(localId)}</code>
-              </dd>
-              <dt>Active version</dt>
-              <dd>{summary?.activeVersion ?? 'not built yet'}</dd>
-              <dt>Entrypoints</dt>
-              <dd>
-                {detectedEntrypoints.length > 0 ? detectedEntrypoints.join(', ') : 'none detected'}
-              </dd>
-            </dl>
-          </section>
-        </div>
-      )}
-    </Panel>
-  )
-}
-
-function detectEntrypoints(files: IdeFileMeta[]): string[] {
-  const relative = files.map((file) => file.path.split('/').slice(2).join('/'))
-  const has = (base: string): boolean =>
-    ['ts', 'tsx', 'js', 'mjs'].some(
-      (ext) => relative.includes(`${base}.${ext}`) || relative.includes(`${base}/index.${ext}`),
-    )
-  const detected: string[] = []
-  if (has('server')) detected.push('server')
-  if (has('editor')) detected.push('editor')
-  if (relative.some((p) => p.startsWith('modules/') && /\.(tsx?|m?js)$/.test(p))) {
-    detected.push('modules')
-  }
-  if (relative.some((p) => p.startsWith('frontend/'))) detected.push('frontend')
-  return detected
-}
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
index 112f8c878..0bb65d12b 100644
--- a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
@@ -3,10 +3,10 @@
  * (`/admin/plugins/develop/:localId`).
  *
  * Renders in the same workspace canvas shell Content/Data/Media use:
- * standard toolbar + section nav, a resizable left file tree, the co-edited
- * CodeMirror buffer with the diagnostics strip beneath it, and the
- * collapsible manifest panel on the right (edge-notch reopen, persisted
- * layout — all owned by the layout).
+ * standard toolbar + section nav, a resizable left file tree, and the
+ * co-edited CodeMirror buffer with the diagnostics strip beneath it. There
+ * is no right panel — plugin.json is edited as raw JSON in the buffer, and
+ * the diagnostics strip names every manifest mistake.
  *
  * Everything here co-edits live: files are CRDT state on the site socket,
  * peers' carets render inline, and there is no save button — Cmd+S re-runs
@@ -25,7 +25,6 @@ import { FileTreePane } from './FileTreePane'
 import { SitePluginPermissionReviewDialog } from './SitePluginPermissionReviewDialog'
 import { IdeFileEditor } from './IdeFileEditor'
 import { DiagnosticsStrip } from './DiagnosticsStrip'
-import { ManifestPane } from './ManifestPane'
 import { IdeActions } from './IdeActions'
 import { IdeSidebar } from './IdeSidebar'
 import styles from './SitePluginIdePage.module.css'
@@ -167,22 +166,6 @@ function SitePluginIde({ localId }: { localId: string }) {
           />
         </div>
       )}
-      contentRightPanel={
-        session ? (
-          <ManifestPane
-            session={session}
-            localId={localId}
-            files={files}
-            summary={vm.summary}
-            canEdit={canEdit}
-            synced={vm.synced}
-            onOpenRawJson={() => {
-              const manifest = files.find((file) => file.path === `${folder}plugin.json`)
-              if (manifest) selectFile(manifest.id)
-            }}
-          />
-        ) : null
-      }
       toolbarRightSlot={(
         <>
           <IdeActions
diff --git a/src/admin/pages/plugins/ide/ideCollab.ts b/src/admin/pages/plugins/ide/ideCollab.ts
index b8172ccb1..4034be23c 100644
--- a/src/admin/pages/plugins/ide/ideCollab.ts
+++ b/src/admin/pages/plugins/ide/ideCollab.ts
@@ -13,7 +13,6 @@
  */
 import * as Y from 'yjs'
 import {
-  applyTextDiff,
   buildSiteFileEntry,
   buildSiteFilesMap,
   shellMap,
@@ -52,8 +51,6 @@ export interface IdeCollabSession {
   createFile(path: string, content?: string): string
   renameFile(fileId: string, nextPath: string): void
   deleteFile(fileId: string): void
-  /** Whole-value content replace as a minimal Y.Text splice (manifest panel). */
-  replaceFileContent(fileId: string, content: string): void
   destroy(): void
 }
 
@@ -219,19 +216,6 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
       }, IDE_ORIGIN)
     },
 
-    replaceFileContent: (fileId, content) => {
-      doc.transact(() => {
-        const entry = ensureFilesMap().get(fileId)
-        if (!(entry instanceof Y.Map)) return
-        const text = entry.get('content')
-        if (!(text instanceof Y.Text)) return
-        // Minimal splice (shared prefix/suffix preserved) so concurrent
-        // remote edits outside the change survive the replacement.
-        applyTextDiff(text, text.toString(), content)
-        entry.set('updatedAt', Date.now())
-      }, IDE_ORIGIN)
-    },
-
     destroy: () => {
       shellMap(doc).unobserveDeep(shellObserver)
       for (const manager of undoManagers.values()) manager.destroy()

From e03fab97f1e27621e5cf516ca2fb789067fe1d31 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 21:51:26 +0200
Subject: [PATCH 10/36] =?UTF-8?q?feat(auth):=20plugins.edit=20=E2=80=94=20?=
 =?UTF-8?q?a=20dedicated=20site-plugin=20authoring=20capability?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Plugin source authoring previously borrowed site.structure.edit. Writing
plugin code is a different trust level than editing site structure, and a
plugin-developer persona needs no site rights — so it gets its own
capability, granted to Owner/Admin via the boot-time role sync (no
migration).

- new 'plugins' write-policy category: every change to a type:'plugin'
  file requires plugins.edit on both transports (collab relay + HTTP
  save); full site-writers without it no longer skip the guard
- socket write gate + full-writer fast path include plugins.edit
- scaffold endpoint and IDE/Plugins-page gates move to plugins.edit
- test harness now runs syncSystemRoles like server boot, so new
  capabilities reach the seeded Owner/Admin in tests
- capability picker metadata + docs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 docs/features/site-plugins.md                 |   8 +-
 docs/reference/capabilities.md                |   3 +-
 server/auth/capabilities.ts                   |   1 +
 server/collab/socket.ts                       |  17 +-
 server/handlers/cms/siteDocument.ts           |   5 +
 server/handlers/cms/sitePlugins.ts            |  10 +-
 server/writePolicy/siteDiff.ts                |  26 ++-
 .../server/sitePluginLifecycle.test.ts        |  31 +++-
 .../server/sitePluginWritePolicy.test.ts      | 149 ++++++++++++++++++
 src/admin/access.ts                           |   9 ++
 src/admin/pages/plugins/PluginsPage.tsx       |   4 +-
 .../plugins/components/SitePluginsSection.tsx |   2 +-
 .../pages/plugins/ide/SitePluginIdePage.tsx   |   4 +-
 src/admin/pages/users/utils/capabilities.ts   |   8 +-
 .../shared/CapabilityPicker/capabilityMeta.ts |   4 +
 src/core/capabilities.ts                      |   7 +-
 16 files changed, 264 insertions(+), 24 deletions(-)
 create mode 100644 src/__tests__/server/sitePluginWritePolicy.test.ts

diff --git a/docs/features/site-plugins.md b/docs/features/site-plugins.md
index 978f84011..f48dbfaeb 100644
--- a/docs/features/site-plugins.md
+++ b/docs/features/site-plugins.md
@@ -107,9 +107,11 @@ auto-sync on activation like installed plugins.
 
 ### Authority
 
-- **Authoring** (IDE editing, scaffold) — site write capability
-  (`site.structure.edit` for the scaffold; relay write-policy categories
-  gate live edits). Never `plugins.install`.
+- **Authoring** (IDE editing, scaffold) — `plugins.edit`, its own
+  capability: the scaffold endpoint requires it, and the relay write
+  policy's `plugins` category gates every live edit to a `type: 'plugin'`
+  file (add/rename/delete/content — even full site-writers need it).
+  Never `plugins.install`, never a `site.*` capability.
 - **Validation / preview** — no elevated capability (`site.read`).
 - **`Build & activate` / rollback / delete** — `plugins.install`; step-up
   ONLY on the consent moments: first activation, grant-set changes, and
diff --git a/docs/reference/capabilities.md b/docs/reference/capabilities.md
index 24d986128..9b13d785a 100644
--- a/docs/reference/capabilities.md
+++ b/docs/reference/capabilities.md
@@ -104,12 +104,13 @@ Was a single `runtime.manage`. Split because adapter election (bytes go to a plu
 
 ### Plugins (granular split)
 
-Was a single `plugins.manage`. Split per the four very different blast radii: read / configure / install (RCE-class) / lifecycle.
+Was a single `plugins.manage`. Split per the very different blast radii: read / configure / edit (authoring) / install (RCE-class) / lifecycle.
 
 | Capability             | Grants                                                              | Step-up | Roles         |
 |------------------------|---------------------------------------------------------------------|---------|---------------|
 | `plugins.read`         | List installed plugins; read masked settings; view event SSE stream; read schedule list. Also gates `/dashboard/plugins`. | no | Owner, Admin |
 | `plugins.configure`    | Edit per-plugin settings via `PUT /plugins/:id/settings`; manage plugin records via `/plugins/:id/resources/*`. | yes (settings only) | Owner, Admin |
+| `plugins.edit`         | Author site-plugin source: scaffold via `POST /site-plugins`, create/edit/rename/delete `plugins/<local-id>/**` draft files (Plugin IDE, collab relay `plugins` write category, HTTP save). Authoring only — code runs nothing until a `plugins.install` activation. | no | Owner, Admin |
 | `plugins.install`      | Install / upgrade / uninstall plugins; pack install; inspect-package. **RCE-class — runs third-party code on the host.** | yes (mutations) | Owner, Admin |
 | `plugins.lifecycle`    | Enable / disable / restart plugins; schedule run-now / pause / resume. | yes (mutations) | Owner, Admin |
 
diff --git a/server/auth/capabilities.ts b/server/auth/capabilities.ts
index 6fce8ac89..00d663b08 100644
--- a/server/auth/capabilities.ts
+++ b/server/auth/capabilities.ts
@@ -68,6 +68,7 @@ const adminCapabilities: CoreCapability[] = [
   'storage.migrate',
   'plugins.read',
   'plugins.configure',
+  'plugins.edit',
   'plugins.install',
   'plugins.lifecycle',
   'users.manage',
diff --git a/server/collab/socket.ts b/server/collab/socket.ts
index 790b99203..70d9f3df4 100644
--- a/server/collab/socket.ts
+++ b/server/collab/socket.ts
@@ -58,7 +58,18 @@ import type { CollabRelay, RelayDoc } from './relay'
 
 export { SITE_SOCKET_PATH }
 
-const SITE_WRITE_CAPABILITIES = ['site.structure.edit', 'site.content.edit', 'site.style.edit'] as const
+/**
+ * Any of these grants WRITE on the socket (`plugins.edit` covers the Plugin
+ * IDE persona, which co-edits plugin source over this same relay). Holding
+ * ALL of them makes the connection a "full writer" that skips the per-update
+ * capability guard.
+ */
+const RELAY_WRITE_CAPABILITIES = [
+  'site.structure.edit',
+  'site.content.edit',
+  'site.style.edit',
+  'plugins.edit',
+] as const
 
 /** y-protocols/sync message types (the payload's first varUint). */
 const SYNC_STEP_1 = 0
@@ -165,7 +176,7 @@ export interface CollabSocketData {
   /** The session identity this connection may publish over presence. */
   identity: CollabPresenceIdentity
   /**
-   * True when the user holds ALL of SITE_WRITE_CAPABILITIES — the common
+   * True when the user holds ALL of RELAY_WRITE_CAPABILITIES — the common
    * case, which skips the per-update capability guard entirely. Every other
    * connection — partial writers (e.g. content-only editors) AND read-only
    * viewers (zero write capabilities) — pays a fork+diff validation per
@@ -209,7 +220,7 @@ export async function handleCollabSocketUpgrade(
   }
   const user = await requireCapability(req, db, 'site.read')
   if (user instanceof Response) return user
-  const fullSiteWriter = SITE_WRITE_CAPABILITIES.every((cap) => userHasCapability(user, cap))
+  const fullSiteWriter = RELAY_WRITE_CAPABILITIES.every((cap) => userHasCapability(user, cap))
   const upgraded = server.upgrade(req, {
     data: {
       userId: user.id,
diff --git a/server/handlers/cms/siteDocument.ts b/server/handlers/cms/siteDocument.ts
index ad7e883e7..bb92b13f5 100644
--- a/server/handlers/cms/siteDocument.ts
+++ b/server/handlers/cms/siteDocument.ts
@@ -93,10 +93,15 @@ import { CMS_API_PREFIX } from './shared'
 import { ForbiddenSiteChangeError, validateSiteWriteDiff } from '../../writePolicy/siteDiff'
 import { validatePageWriteDiff } from '../../writePolicy/pageDiff'
 
+// Any of these opens the save endpoint; the per-category diff validator
+// (`validateSiteWriteDiff`) then gates each individual change. `plugins.edit`
+// is included so a plugin-developer persona can persist plugin-source file
+// changes — every non-plugin change still requires the matching site cap.
 const SITE_WRITE_CAPABILITIES = [
   'site.structure.edit',
   'site.content.edit',
   'site.style.edit',
+  'plugins.edit',
 ] satisfies CoreCapability[]
 
 const SiteDocumentBodySchema = Type.Object({
diff --git a/server/handlers/cms/sitePlugins.ts b/server/handlers/cms/sitePlugins.ts
index 23494ea8d..01bc51bf4 100644
--- a/server/handlers/cms/sitePlugins.ts
+++ b/server/handlers/cms/sitePlugins.ts
@@ -12,7 +12,8 @@
  *   DELETE /admin/api/cms/site-plugins/:localId[?force=true]  — uninstall runtime row + delete draft source
  *
  * Authority model (design → "Activation Semantics"):
- *   - authoring (scaffold) needs site write capability, never plugins.install;
+ *   - authoring (scaffold) needs `plugins.edit`, never plugins.install —
+ *     the same capability the collab guard requires for plugin-file writes;
  *   - validation/preview need no elevated capability (site.read);
  *   - activation needs `plugins.install`, with step-up ONLY on the consent
  *     moments — first activation and grant-set changes. Same-grant rebuilds
@@ -574,9 +575,10 @@ export async function handleSitePluginsRoutes(
       return jsonResponse({ sitePlugins: await listSitePlugins(db) })
     }
     if (req.method === 'POST') {
-      // Scaffolding writes draft files — structural site work, NOT a plugin
-      // power grant (activation is where powers happen).
-      const user = await requireCapability(req, db, 'site.structure.edit')
+      // Scaffolding writes plugin source into the draft — the authoring
+      // capability, NOT a plugin power grant (activation is where powers
+      // happen). Same gate as the collab guard on plugin-file writes.
+      const user = await requireCapability(req, db, 'plugins.edit')
       if (user instanceof Response) return user
       return handleScaffold(req, db)
     }
diff --git a/server/writePolicy/siteDiff.ts b/server/writePolicy/siteDiff.ts
index 0f2c6fc63..c17ad9836 100644
--- a/server/writePolicy/siteDiff.ts
+++ b/server/writePolicy/siteDiff.ts
@@ -17,6 +17,9 @@
  *               the "client / copy editor" persona owns).
  *   style     — classes registry contents, settings.framework, settings.fonts,
  *               file contents.
+ *   plugins   — any change to a `type: 'plugin'` file (site-plugin source
+ *               authored in the Plugin IDE). Plugin code is a different trust
+ *               level than site structure, so it has its own capability.
  *
  * Pages are NOT diffed here (managed by /pages endpoint).
  * Visual Components are NOT diffed here (managed as data_rows via /components
@@ -26,6 +29,7 @@
  *   site.structure.edit → structure
  *   site.content.edit   → content
  *   site.style.edit     → style
+ *   plugins.edit        → plugins
  *
  * First-save semantics: when there is no previous shell (`previous === null`),
  * the incoming document is treated as a structural change in its entirety —
@@ -38,7 +42,7 @@ import type {
 } from '@core/page-tree'
 import { deepEqual } from '@core/utils/deepEqual'
 
-type SiteChangeKind = 'structure' | 'content' | 'style'
+type SiteChangeKind = 'structure' | 'content' | 'style' | 'plugins'
 
 export class ForbiddenSiteChangeError extends Error {
   // The TS `erasableSyntaxOnly` lint forbids constructor-parameter properties,
@@ -60,6 +64,7 @@ const CAP_FOR_KIND: Record<SiteChangeKind, CoreCapability> = {
   structure: 'site.structure.edit',
   content: 'site.content.edit',
   style: 'site.style.edit',
+  plugins: 'plugins.edit',
 }
 
 interface DiffContext {
@@ -91,11 +96,14 @@ export function validateSiteWriteDiff(
   capabilities: readonly CoreCapability[],
 ): void {
   // Fast path: a caller with the full set never needs the diff — they can
-  // make any change. Saves cycles on the common case.
+  // make any change. Saves cycles on the common case. `plugins.edit` is part
+  // of the full set: without it, a full site-writer must still be diffed so
+  // plugin-source changes are caught.
   if (
     capabilities.includes('site.structure.edit') &&
     capabilities.includes('site.content.edit') &&
-    capabilities.includes('site.style.edit')
+    capabilities.includes('site.style.edit') &&
+    capabilities.includes('plugins.edit')
   ) {
     return
   }
@@ -226,6 +234,18 @@ function diffFiles(
   for (const id of new Set([...prevById.keys(), ...nextById.keys()])) {
     const a = prevById.get(id)
     const b = nextById.get(id)
+    // Site-plugin source (type 'plugin') is its own trust domain: every
+    // change to it — add, remove, rename, retype, content — requires
+    // plugins.edit, never a site capability. Retyping across the boundary
+    // counts as a plugin change from either side.
+    if (a?.type === 'plugin' || b?.type === 'plugin') {
+      const changed =
+        !a || !b || a.path !== b.path || a.type !== b.type || a.content !== b.content
+      if (changed) {
+        requireChange(ctx, 'plugins', `files.${id}`, 'plugin source changed')
+      }
+      continue
+    }
     if (!a || !b) {
       requireChange(ctx, 'structure', `files.${id}`, a ? 'removed' : 'added')
       continue
diff --git a/src/__tests__/server/sitePluginLifecycle.test.ts b/src/__tests__/server/sitePluginLifecycle.test.ts
index fb56e3460..7ad353bfe 100644
--- a/src/__tests__/server/sitePluginLifecycle.test.ts
+++ b/src/__tests__/server/sitePluginLifecycle.test.ts
@@ -47,11 +47,19 @@ async function updateDraftFile(path: string, content: string): Promise<void> {
 }
 
 describe('site plugin scaffold + validate', () => {
-  test('scaffold requires site.structure.edit', async () => {
+  test('scaffold requires plugins.edit', async () => {
+    // Even a full site editor cannot scaffold — plugin authoring is its own
+    // capability, distinct from site-structure rights.
     const viewer = await harness.createRoleUser({
       name: 'Viewer',
       slug: 'viewer',
-      capabilities: ['plugins.read', 'site.read'],
+      capabilities: [
+        'plugins.read',
+        'site.read',
+        'site.structure.edit',
+        'site.content.edit',
+        'site.style.edit',
+      ],
     })
     const res = await harness.cms('/admin/api/cms/site-plugins', {
       method: 'POST',
@@ -61,6 +69,20 @@ describe('site plugin scaffold + validate', () => {
     await expectForbidden(res)
   })
 
+  test('a plugins.edit-only developer can scaffold', async () => {
+    const developer = await harness.createRoleUser({
+      name: 'Plugin Developer',
+      slug: 'plugin-developer',
+      capabilities: ['site.read', 'plugins.edit'],
+    })
+    const res = await harness.cms('/admin/api/cms/site-plugins', {
+      method: 'POST',
+      cookie: developer.cookie,
+      json: { name: 'Dev Probe', localId: 'dev-probe', template: 'empty' },
+    })
+    expect(res.status).toBe(201)
+  })
+
   test('scaffold creates plugin-typed draft files', async () => {
     const res = await harness.cms('/admin/api/cms/site-plugins', {
       method: 'POST',
@@ -69,7 +91,10 @@ describe('site plugin scaffold + validate', () => {
     })
     expect(res.status).toBe(201)
     const shell = await getDraftSite(harness.db)
-    const pluginFiles = shell?.files.filter((file) => file.type === 'plugin') ?? []
+    // Scope to this plugin's folder — the suite scaffolds other plugins too.
+    const pluginFiles = (shell?.files ?? []).filter(
+      (file) => file.type === 'plugin' && file.path.startsWith('plugins/newsletter/'),
+    )
     expect(pluginFiles.map((file) => file.path).sort()).toEqual([
       'plugins/newsletter/plugin.json',
       'plugins/newsletter/server/index.ts',
diff --git a/src/__tests__/server/sitePluginWritePolicy.test.ts b/src/__tests__/server/sitePluginWritePolicy.test.ts
new file mode 100644
index 000000000..5d7b68e0a
--- /dev/null
+++ b/src/__tests__/server/sitePluginWritePolicy.test.ts
@@ -0,0 +1,149 @@
+/**
+ * plugins.edit write policy — `validateSiteWriteDiff`'s `plugins` change
+ * category. Plugin-source files (`type: 'plugin'`) are their own trust
+ * domain: every change to them requires `plugins.edit`, never a site
+ * capability — and site capabilities alone never authorize one. Shared by
+ * both write transports (HTTP save + collab update guard), so this pure
+ * policy test covers the socket path too.
+ */
+import { describe, expect, test } from 'bun:test'
+import type { CoreCapability } from '@core/capabilities'
+import type { SiteFile } from '@core/files/schemas'
+import type { SiteShell } from '@core/page-tree'
+import {
+  ForbiddenSiteChangeError,
+  validateSiteWriteDiff,
+} from '../../../server/writePolicy/siteDiff'
+
+const ALL_SITE_CAPS: CoreCapability[] = [
+  'site.structure.edit',
+  'site.content.edit',
+  'site.style.edit',
+]
+
+function shell(files: SiteFile[]): SiteShell {
+  return {
+    id: 'project_1',
+    name: 'CMS Site',
+    files,
+    visualComponents: [],
+    breakpoints: [{ id: 'desktop', label: 'Desktop', width: 1440, icon: 'monitor' }],
+    settings: { shortcuts: {} },
+    styleRules: {},
+    packageJson: { dependencies: {}, devDependencies: {} },
+    runtime: { dependencyLock: { version: 1, packages: {}, updatedAt: 0 }, scripts: {} },
+    createdAt: 1000,
+    updatedAt: 2000,
+  }
+}
+
+function pluginFile(overrides: Partial<SiteFile> = {}): SiteFile {
+  return {
+    id: 'f1',
+    path: 'plugins/newsletter/server/index.ts',
+    type: 'plugin',
+    content: 'export {}',
+    updatedAt: 0,
+    ...overrides,
+  }
+}
+
+function expectForbiddenPluginChange(fn: () => void): void {
+  let caught: unknown
+  try {
+    fn()
+  } catch (err) {
+    caught = err
+  }
+  expect(caught).toBeInstanceOf(ForbiddenSiteChangeError)
+  expect((caught as ForbiddenSiteChangeError).kind).toBe('plugins')
+}
+
+describe('validateSiteWriteDiff — plugins category', () => {
+  test('a full site writer WITHOUT plugins.edit cannot add a plugin file', () => {
+    expectForbiddenPluginChange(() =>
+      validateSiteWriteDiff(shell([]), shell([pluginFile()]), ALL_SITE_CAPS),
+    )
+  })
+
+  test('a full site writer WITHOUT plugins.edit cannot edit plugin content', () => {
+    expectForbiddenPluginChange(() =>
+      validateSiteWriteDiff(
+        shell([pluginFile()]),
+        shell([pluginFile({ content: 'export const x = 1' })]),
+        ALL_SITE_CAPS,
+      ),
+    )
+  })
+
+  test('a full site writer WITHOUT plugins.edit cannot delete or rename plugin files', () => {
+    expectForbiddenPluginChange(() =>
+      validateSiteWriteDiff(shell([pluginFile()]), shell([]), ALL_SITE_CAPS),
+    )
+    expectForbiddenPluginChange(() =>
+      validateSiteWriteDiff(
+        shell([pluginFile()]),
+        shell([pluginFile({ path: 'plugins/newsletter/server/renamed.ts' })]),
+        ALL_SITE_CAPS,
+      ),
+    )
+  })
+
+  test('retyping across the plugin boundary requires plugins.edit from either side', () => {
+    // plugin → script: the file leaves the plugin domain.
+    expectForbiddenPluginChange(() =>
+      validateSiteWriteDiff(
+        shell([pluginFile()]),
+        shell([pluginFile({ type: 'script', path: 'src/scripts/escaped.ts' })]),
+        ALL_SITE_CAPS,
+      ),
+    )
+    // script → plugin: the file enters the plugin domain.
+    expectForbiddenPluginChange(() =>
+      validateSiteWriteDiff(
+        shell([pluginFile({ type: 'script', path: 'src/scripts/escaped.ts' })]),
+        shell([pluginFile()]),
+        ALL_SITE_CAPS,
+      ),
+    )
+  })
+
+  test('plugins.edit alone authorizes plugin-file changes and nothing else', () => {
+    const caps: CoreCapability[] = ['plugins.edit']
+    // Full plugin-file lifecycle passes.
+    validateSiteWriteDiff(shell([]), shell([pluginFile()]), caps)
+    validateSiteWriteDiff(
+      shell([pluginFile()]),
+      shell([pluginFile({ content: 'export const x = 1' })]),
+      caps,
+    )
+    validateSiteWriteDiff(shell([pluginFile()]), shell([]), caps)
+
+    // A style-file content edit is still rejected — plugins.edit grants no
+    // site rights.
+    const styleFile: SiteFile = {
+      id: 'f2',
+      path: 'src/styles/site.css',
+      type: 'style',
+      content: 'body {}',
+      updatedAt: 0,
+    }
+    expect(() =>
+      validateSiteWriteDiff(
+        shell([styleFile]),
+        shell([{ ...styleFile, content: 'body { margin: 0 }' }]),
+        caps,
+      ),
+    ).toThrow(ForbiddenSiteChangeError)
+  })
+
+  test('the full-writer fast path requires plugins.edit too', () => {
+    // With all four capabilities the diff is skipped entirely — any change
+    // passes, including plugin files.
+    validateSiteWriteDiff(
+      shell([]),
+      shell([pluginFile()]),
+      [...ALL_SITE_CAPS, 'plugins.edit'],
+    )
+  })
+})
diff --git a/src/admin/access.ts b/src/admin/access.ts
index a4f65906e..a35fcb11d 100644
--- a/src/admin/access.ts
+++ b/src/admin/access.ts
@@ -218,6 +218,15 @@ export function canConfigurePlugins(user: CmsCurrentUser | null): boolean {
   return hasCapability(user, 'plugins.configure')
 }
 
+/**
+ * Caller can author site-plugin source in the Plugin IDE — scaffold plugins
+ * and create/edit/rename/delete files under `plugins/<local-id>/` in the
+ * draft. Authoring only: code runs after a `plugins.install` activation.
+ */
+export function canEditPlugins(user: CmsCurrentUser | null): boolean {
+  return hasCapability(user, 'plugins.edit')
+}
+
 /** Caller can install, upgrade, uninstall, and re-sync plugin packs. */
 export function canInstallPlugins(user: CmsCurrentUser | null): boolean {
   return hasCapability(user, 'plugins.install')
diff --git a/src/admin/pages/plugins/PluginsPage.tsx b/src/admin/pages/plugins/PluginsPage.tsx
index b1bda8778..136348a71 100644
--- a/src/admin/pages/plugins/PluginsPage.tsx
+++ b/src/admin/pages/plugins/PluginsPage.tsx
@@ -12,7 +12,7 @@ import { notifyCmsPluginsChanged } from './utils/pluginEvents'
 import { useAuthenticatedAdminUser } from '@admin/sessionContext'
 import {
   canConfigurePlugins,
-  canEditStructure,
+  canEditPlugins,
   canInstallPlugins,
   canManagePluginLifecycle,
 } from '@admin/access'
@@ -29,7 +29,7 @@ export function PluginsPage() {
   const canConfigure = canConfigurePlugins(currentUser)
   const canInstall = canInstallPlugins(currentUser)
   const canManageLifecycle = canManagePluginLifecycle(currentUser)
-  const canCreateSitePlugins = canEditStructure(currentUser)
+  const canCreateSitePlugins = canEditPlugins(currentUser)
   const vm = usePluginsWorkspace()
   const {
     fileInputRef,
diff --git a/src/admin/pages/plugins/components/SitePluginsSection.tsx b/src/admin/pages/plugins/components/SitePluginsSection.tsx
index 6f8770ea9..c715bf7f5 100644
--- a/src/admin/pages/plugins/components/SitePluginsSection.tsx
+++ b/src/admin/pages/plugins/components/SitePluginsSection.tsx
@@ -71,7 +71,7 @@ export function SitePluginsSection({ canCreate }: SitePluginsSectionProps) {
           variant="secondary"
           size="md"
           disabled={!canCreate}
-          tooltip={canCreate ? undefined : 'Requires the site structure permission'}
+          tooltip={canCreate ? undefined : 'Requires the “Author site plugins” permission'}
           onClick={() => setDialogOpen(true)}
           data-testid="new-site-plugin"
         >
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
index 0bb65d12b..805188a69 100644
--- a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
@@ -16,7 +16,7 @@ import { useEffect, useState } from 'react'
 import { AdminWorkspaceCanvasLayout } from '@admin/layouts/AdminWorkspaceCanvasLayout/AdminWorkspaceCanvasLayout'
 import { useNavigate, useParams } from '@admin/lib/routing'
 import { useAuthenticatedAdminUser } from '@admin/sessionContext'
-import { canEditStructure, canInstallPlugins } from '@admin/access'
+import { canEditPlugins, canInstallPlugins } from '@admin/access'
 import { ConfirmDeleteDialog } from '@admin/shared/dialogs/ConfirmDeleteDialog/ConfirmDeleteDialog'
 import { SITE_PLUGIN_LOCAL_ID_PATTERN, sitePluginFolder } from '@core/site-plugins'
 import { useSitePluginIde } from './useSitePluginIde'
@@ -61,7 +61,7 @@ interface PendingDelete {
 function SitePluginIde({ localId }: { localId: string }) {
   const currentUser = useAuthenticatedAdminUser()
   const navigate = useNavigate()
-  const canEdit = canEditStructure(currentUser)
+  const canEdit = canEditPlugins(currentUser)
   const canInstall = canInstallPlugins(currentUser)
   const [pendingDelete, setPendingDelete] = useState<PendingDelete | null>(null)
   const [reviewOpen, setReviewOpen] = useState(false)
diff --git a/src/admin/pages/users/utils/capabilities.ts b/src/admin/pages/users/utils/capabilities.ts
index 2a5a74f7f..e6b8c33a6 100644
--- a/src/admin/pages/users/utils/capabilities.ts
+++ b/src/admin/pages/users/utils/capabilities.ts
@@ -62,7 +62,13 @@ export const CAPABILITY_GROUPS: CapabilityGroup[] = [
   },
   {
     title: 'Plugins',
-    capabilities: ['plugins.read', 'plugins.configure', 'plugins.install', 'plugins.lifecycle'],
+    capabilities: [
+      'plugins.read',
+      'plugins.configure',
+      'plugins.edit',
+      'plugins.install',
+      'plugins.lifecycle',
+    ],
   },
   {
     title: 'AI',
diff --git a/src/admin/shared/CapabilityPicker/capabilityMeta.ts b/src/admin/shared/CapabilityPicker/capabilityMeta.ts
index ce8bb3349..bb3327247 100644
--- a/src/admin/shared/CapabilityPicker/capabilityMeta.ts
+++ b/src/admin/shared/CapabilityPicker/capabilityMeta.ts
@@ -122,6 +122,10 @@ export const CAPABILITY_META: Record<CoreCapability, CapabilityMeta> = {
     label: 'Configure plugins',
     description: 'Edit per-plugin settings and manage plugin-owned records.',
   },
+  'plugins.edit': {
+    label: 'Author site plugins',
+    description: 'Write plugin source code in the Plugin IDE (create, edit, rename, delete files in the site draft). Code only runs after someone with install rights activates it.',
+  },
   'plugins.install': {
     label: 'Install or uninstall plugins',
     description: 'Install, upgrade, and uninstall plugins. Runs third-party code on the host — RCE-class. Step-up gated.',
diff --git a/src/core/capabilities.ts b/src/core/capabilities.ts
index e289e8629..59a150e96 100644
--- a/src/core/capabilities.ts
+++ b/src/core/capabilities.ts
@@ -52,9 +52,14 @@ export const CORE_CAPABILITIES = [
   'runtime.dependencies',
   'storage.elect',
   'storage.migrate',
-  // Plugins — granular split (read/configure/install/lifecycle).
+  // Plugins — granular split (read/configure/edit/install/lifecycle).
+  // `plugins.edit` = authoring site-plugin source in the draft (Plugin IDE,
+  // file CRUD over the collab socket). Distinct from `site.structure.edit`:
+  // writing plugin code is a different trust level than editing site
+  // structure, and a plugin-developer persona needs no site rights.
   'plugins.read',
   'plugins.configure',
+  'plugins.edit',
   'plugins.install',
   'plugins.lifecycle',
   'users.manage',

From 46994e7a3ffca0242875a605dee0d0602433b093 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 22:11:01 +0200
Subject: [PATCH 11/36] =?UTF-8?q?feat(ai):=20plugin=20chat=20scope=20?=
 =?UTF-8?q?=E2=80=94=20toolset,=20system=20prompt,=20activation=20engine?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fills the reserved 'plugin' ToolScope seat following the content-scope
blueprint:

- shared TypeBox input schemas in @core/ai (browser + server validate the
  same source of truth)
- browser-bridged file tools (list/read/write/patch/rename/delete/open)
  mirroring the site code-asset shapes: paginated reads + SHA-256 hash,
  patch with expectedHash optimistic concurrency
- server-resolved lifecycle tools: plugin_list_plugins, plugin_validate
  (the diagnostics-strip build), plugin_activate (same-grant rebuilds
  only — grant changes remain a human consent moment in the IDE header)
- activation engine extracted from the HTTP route
  (runSitePluginActivation) so both transports share one orchestration;
  audit path accepts req=null for non-HTTP callers
- ToolContext gains uploadsDir (threaded router → chat handler → tools;
  MCP server passes its runtime value)
- plugin-scope system prompt teaching folder conventions, manifest rules,
  containment, and the validate-until-clean → activate workflow

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 server/ai/drivers/types.ts                 |   2 +
 server/ai/handlers/chat.ts                 |  21 ++-
 server/ai/handlers/index.ts                |   3 +-
 server/ai/mcp/server.ts                    |   1 +
 server/ai/runtime/types.ts                 |   6 +
 server/ai/tools/index.ts                   |   8 +-
 server/ai/tools/plugin/fileTools.ts        | 119 +++++++++++++++
 server/ai/tools/plugin/index.ts            |  37 +++++
 server/ai/tools/plugin/lifecycleTools.ts   | 161 +++++++++++++++++++++
 server/ai/tools/plugin/snapshot.ts         |  62 ++++++++
 server/ai/tools/plugin/systemPrompt.ts     |  78 ++++++++++
 server/handlers/cms/plugins/install.ts     |   3 +-
 server/handlers/cms/plugins/pack.ts        |   4 +-
 server/handlers/cms/plugins/shared.ts      |   2 +-
 server/handlers/cms/shared.ts              |   8 +-
 server/handlers/cms/sitePlugins.ts         | 146 ++++++++++++++-----
 server/router.ts                           |   2 +-
 src/__tests__/helpers/capabilityHarness.ts |   2 +-
 src/core/ai/index.ts                       |  14 ++
 src/core/ai/toolSchemas.ts                 |  63 ++++++++
 20 files changed, 690 insertions(+), 52 deletions(-)
 create mode 100644 server/ai/tools/plugin/fileTools.ts
 create mode 100644 server/ai/tools/plugin/index.ts
 create mode 100644 server/ai/tools/plugin/lifecycleTools.ts
 create mode 100644 server/ai/tools/plugin/snapshot.ts
 create mode 100644 server/ai/tools/plugin/systemPrompt.ts

diff --git a/server/ai/drivers/types.ts b/server/ai/drivers/types.ts
index 5f315f45d..69c3681d3 100644
--- a/server/ai/drivers/types.ts
+++ b/server/ai/drivers/types.ts
@@ -157,6 +157,8 @@ export interface ToolContextBase {
    * onSnapshot) so later server read tools see post-mutation state.
    */
   snapshot: unknown
+  /** The server's uploads root — see `ToolContext.uploadsDir`. */
+  readonly uploadsDir: string | null
 }
 
 // ---------------------------------------------------------------------------
diff --git a/server/ai/handlers/chat.ts b/server/ai/handlers/chat.ts
index 286d0011a..2e1cbcc4f 100644
--- a/server/ai/handlers/chat.ts
+++ b/server/ai/handlers/chat.ts
@@ -70,6 +70,11 @@ import {
   buildContentSystemPrompt,
   type ContentSnapshot,
 } from '../tools/content'
+import {
+  buildPluginSystemPrompt,
+  emptyPluginIdeSnapshot,
+  PluginIdeSnapshotSchema,
+} from '../tools/plugin'
 import {
   createBridge,
   createConversationsPersister,
@@ -95,17 +100,19 @@ export function tryHandleAiChat(
   req: Request,
   db: DbClient,
   pathname: string,
+  uploadsDir: string | null,
 ): Promise<Response> | null {
   if (!pathname.startsWith('/admin/api/ai/chat/')) return null
   const scope = pathname.slice('/admin/api/ai/chat/'.length)
   if (!VALID_SCOPES.includes(scope as ToolScope)) return null
-  return handleAiChat(req, db, scope as ToolScope)
+  return handleAiChat(req, db, scope as ToolScope, uploadsDir)
 }
 
 async function handleAiChat(
   req: Request,
   db: DbClient,
   scope: ToolScope,
+  uploadsDir: string | null,
 ): Promise<Response> {
   if (req.method !== 'POST') {
     return jsonResponse({ error: 'Method not allowed' }, { status: 405 })
@@ -378,6 +385,7 @@ async function handleAiChat(
           scope,
           conversationId: conversation.id,
           snapshot,
+          uploadsDir,
         }
         const { bridgeId, bridge, destroy } = createBridge(
           emit,
@@ -517,6 +525,17 @@ export function buildSystemPromptForScope(
   if (scope === 'content') {
     return buildContentSystemPrompt((snapshot ?? emptyContentSnapshot()) as ContentSnapshot)
   }
+  if (scope === 'plugin') {
+    if (snapshot === undefined || snapshot === null) {
+      return buildPluginSystemPrompt(emptyPluginIdeSnapshot())
+    }
+    const result = safeParseValue(PluginIdeSnapshotSchema, snapshot)
+    if (!result.ok) {
+      console.error('[ai/chat] invalid plugin snapshot, using empty fallback:', result.errors)
+      return buildPluginSystemPrompt(emptyPluginIdeSnapshot())
+    }
+    return buildPluginSystemPrompt(result.value)
+  }
   // Other scopes don't have system prompts yet. The driver gets a minimal
   // prompt so the conversation isn't completely contextless.
   return [
diff --git a/server/ai/handlers/index.ts b/server/ai/handlers/index.ts
index 51a28205a..b45b890f5 100644
--- a/server/ai/handlers/index.ts
+++ b/server/ai/handlers/index.ts
@@ -25,6 +25,7 @@ export function tryHandleAi(
   req: Request,
   db: DbClient,
   url: URL,
+  options: { uploadsDir?: string } = {},
 ): Promise<Response> | null {
   const pathname = url.pathname
   if (!pathname.startsWith('/admin/api/ai/')) return null
@@ -44,7 +45,7 @@ export function tryHandleAi(
     tryHandleAiMcpManagement(req, db, pathname) ??
     tryHandleAiEditorBridge(req, db, pathname) ??
     tryHandleAiAudit(req, db, url, pathname) ??
-    tryHandleAiChat(req, db, pathname) ??
+    tryHandleAiChat(req, db, pathname, options.uploadsDir ?? null) ??
     tryHandleAiToolResult(req, db, pathname) ??
     tryHandleAiCredentials(req, db, pathname) ??
     tryHandleAiConversations(req, db, url, pathname) ??
diff --git a/server/ai/mcp/server.ts b/server/ai/mcp/server.ts
index 52dd309f3..bdfb392a0 100644
--- a/server/ai/mcp/server.ts
+++ b/server/ai/mcp/server.ts
@@ -201,6 +201,7 @@ export function buildMcpServer(ctx: McpServerContext): Server {
         scope: tool.scope === 'shared' ? 'content' : tool.scope,
         conversationId: `mcp:${ctx.connectorId}`,
         snapshot: null,
+        uploadsDir: ctx.uploadsDir ?? null,
       })
     } catch (err) {
       // Browser bridge rejection is terminal for a chat turn, but MCP has no
diff --git a/server/ai/runtime/types.ts b/server/ai/runtime/types.ts
index afdc8f51b..baa030efa 100644
--- a/server/ai/runtime/types.ts
+++ b/server/ai/runtime/types.ts
@@ -146,6 +146,12 @@ export interface ToolContext {
   readonly scope: ToolScope
   readonly conversationId: string
   readonly snapshot: unknown
+  /**
+   * The server's uploads root, for tools that build/activate on-disk plugin
+   * revisions (`plugin_activate`). Null when the transport didn't thread it
+   * (tests, misconfigured boot) — such tools fail with a clear error.
+   */
+  readonly uploadsDir: string | null
   readonly signal: AbortSignal
 }
 
diff --git a/server/ai/tools/index.ts b/server/ai/tools/index.ts
index 1c00c6077..0c29bedb0 100644
--- a/server/ai/tools/index.ts
+++ b/server/ai/tools/index.ts
@@ -1,8 +1,8 @@
 /**
  * Tool registry root — selects the right toolset for a chat scope.
  *
- * `site` and `content` scopes have tools registered. `data` and `plugin`
- * are reserved scopes with no toolset yet.
+ * `site`, `content`, and `plugin` scopes have tools registered. `data` is a
+ * reserved scope with no toolset yet.
  *
  * Adding a new scope:
  *   1. Create `server/ai/tools/<scope>/` with its tool files + index.ts.
@@ -25,6 +25,7 @@ import { toolAllowedForCapabilities } from './capabilityGate'
 import type { AiTool, ToolScope } from './types'
 import { siteTools } from './site'
 import { contentTools } from './content'
+import { pluginTools } from './plugin'
 
 function scopeToolset(scope: ToolScope): AiTool[] {
   switch (scope) {
@@ -36,8 +37,7 @@ function scopeToolset(scope: ToolScope): AiTool[] {
       // Reserved: no data-scope toolset yet.
       return []
     case 'plugin':
-      // Reserved: no plugin-scope toolset yet.
-      return []
+      return pluginTools
   }
 }
 
diff --git a/server/ai/tools/plugin/fileTools.ts b/server/ai/tools/plugin/fileTools.ts
new file mode 100644
index 000000000..95c7ecdfd
--- /dev/null
+++ b/server/ai/tools/plugin/fileTools.ts
@@ -0,0 +1,119 @@
+/**
+ * Plugin-scope file tools — browser-bridged.
+ *
+ * All file access goes through the live Plugin IDE session (the CRDT doc is
+ * the source of truth while an editor is open): reads return exactly what
+ * the user sees — including keystrokes still inside the relay's persist
+ * debounce — and writes merge character-level with concurrent human typing
+ * instead of clobbering it. The server defines schema + description only;
+ * `src/admin/pages/plugins/ide/agent/pluginBridge.ts` applies each call
+ * against the IdeCollabSession.
+ *
+ * Shapes mirror the site code-asset tools: `plugin_read_file` paginates and
+ * returns a SHA-256 content hash; `plugin_patch_file` requires the latest
+ * `expectedHash` so stale edits fail instead of silently overwriting a
+ * peer's (or the user's) newer content.
+ *
+ * Capability gates mirror the HTTP/relay equivalents: reads need site.read
+ * or plugins.read (the IDE list/read surface), writes need `plugins.edit`
+ * (the relay's `plugins` write category).
+ */
+import {
+  PluginDeleteFileInputSchema,
+  PluginListFilesInputSchema,
+  PluginOpenFileInputSchema,
+  PluginPatchFileInputSchema,
+  PluginReadFileInputSchema,
+  PluginRenameFileInputSchema,
+  PluginWriteFileInputSchema,
+} from '@core/ai'
+import type { CoreCapability } from '@core/capabilities'
+import type { AiTool } from '../types'
+
+const PLUGIN_READ_CAPS: readonly CoreCapability[] = ['site.read', 'plugins.read']
+const PLUGIN_EDIT_CAPS: readonly CoreCapability[] = ['plugins.edit']
+
+const listFilesTool: AiTool = {
+  name: 'plugin_list_files',
+  scope: 'plugin',
+  execution: 'browser',
+  requiredCapabilities: PLUGIN_READ_CAPS,
+  description:
+    'List the open plugin\'s source files from the live IDE session. Returns each file as { fileId, path, size, hash } — paths are relative to the plugin folder (plugin.json, server/index.ts, …). Use the returned hash as expectedHash for plugin_patch_file.',
+  inputSchema: PluginListFilesInputSchema,
+}
+
+const readFileTool: AiTool = {
+  name: 'plugin_read_file',
+  scope: 'plugin',
+  execution: 'browser',
+  requiredCapabilities: PLUGIN_READ_CAPS,
+  description:
+    'Read one plugin source file by fileId or relative path. Returns the exact content slice, the full-file SHA-256 hash, and pageInfo for pagination. If pageInfo.nextPart is not null, call plugin_read_file again with the same file and part.',
+  inputSchema: PluginReadFileInputSchema,
+}
+
+const writeFileTool: AiTool = {
+  name: 'plugin_write_file',
+  scope: 'plugin',
+  execution: 'browser',
+  requiredCapabilities: PLUGIN_EDIT_CAPS,
+  description:
+    'Create a new plugin source file, or overwrite an existing one, at a path relative to the plugin folder. Prefer plugin_patch_file for edits to existing files — a whole-file write replaces concurrent edits wholesale. The folder layout is meaningful: server/index.ts becomes the sandboxed backend entrypoint, editor/index.ts the admin editor extension (requires the editor.code permission), modules/*.ts canvas modules (requires modules.register), frontend/ published assets.',
+  inputSchema: PluginWriteFileInputSchema,
+}
+
+const patchFileTool: AiTool = {
+  name: 'plugin_patch_file',
+  scope: 'plugin',
+  execution: 'browser',
+  requiredCapabilities: PLUGIN_EDIT_CAPS,
+  description:
+    'Patch an existing plugin file by exact text replacement. Requires the latest `expectedHash` from plugin_read_file/plugin_list_files to prevent stale edits. Each replacement\'s oldText must match exactly; if oldText occurs multiple times, make it more specific or set replaceAll:true. Edits merge live with anyone typing in the same file.',
+  inputSchema: PluginPatchFileInputSchema,
+}
+
+const renameFileTool: AiTool = {
+  name: 'plugin_rename_file',
+  scope: 'plugin',
+  execution: 'browser',
+  requiredCapabilities: PLUGIN_EDIT_CAPS,
+  description:
+    'Rename/move one plugin file to a new path relative to the plugin folder. Renaming across entrypoint folders changes what the build derives (e.g. moving a file into editor/ makes it admin-side code requiring editor.code).',
+  inputSchema: PluginRenameFileInputSchema,
+}
+
+const deleteFileTool: AiTool = {
+  name: 'plugin_delete_file',
+  scope: 'plugin',
+  execution: 'browser',
+  requiredCapabilities: PLUGIN_EDIT_CAPS,
+  description:
+    'Delete one plugin source file from the live draft (for every editor). plugin.json cannot be deleted — every plugin needs its manifest.',
+  inputSchema: PluginDeleteFileInputSchema,
+}
+
+const openFileTool: AiTool = {
+  name: 'plugin_open_file',
+  scope: 'plugin',
+  execution: 'browser',
+  description:
+    'Visibly open a plugin file in the IDE buffer so the user can watch the work. Pure editor-state switch — reading does not require it (plugin_read_file works in the background).',
+  inputSchema: PluginOpenFileInputSchema,
+}
+
+export const pluginFileTools: AiTool[] = [
+  listFilesTool,
+  readFileTool,
+  writeFileTool,
+  patchFileTool,
+  renameFileTool,
+  deleteFileTool,
+  openFileTool,
+]
+
+/** Browser-bridged tools that read/navigate but do not change plugin source. */
+export const PLUGIN_FILE_READ_ONLY_NAMES = new Set([
+  'plugin_list_files',
+  'plugin_read_file',
+])
diff --git a/server/ai/tools/plugin/index.ts b/server/ai/tools/plugin/index.ts
new file mode 100644
index 000000000..d8d7444a6
--- /dev/null
+++ b/server/ai/tools/plugin/index.ts
@@ -0,0 +1,37 @@
+/**
+ * Plugin-scope tool barrel — exports the toolset, system-prompt builder,
+ * and snapshot schema.
+ *
+ * The chat handler imports `pluginTools` for `scope === 'plugin'` and
+ * `buildPluginSystemPrompt` when assembling the prompt for a plugin-scope
+ * conversation. The MCP registry imports `pluginTools` too — file tools
+ * relay to the open Plugin IDE; lifecycle tools run headless.
+ */
+import type { AiTool } from '../types'
+import { pluginFileTools, PLUGIN_FILE_READ_ONLY_NAMES } from './fileTools'
+import {
+  pluginLifecycleTools,
+  PLUGIN_LIFECYCLE_READ_ONLY_NAMES,
+} from './lifecycleTools'
+
+// Stamp the `mutates` flag so `selectToolsForScope` can filter write tools
+// out for callers without `ai.tools.write`. `plugin_open_file` counts as
+// mutating (it moves the user's visible buffer — same policy as
+// content_set_active_document).
+export const pluginTools: AiTool[] = [
+  ...pluginFileTools.map((t) => ({
+    ...t,
+    mutates: !PLUGIN_FILE_READ_ONLY_NAMES.has(t.name),
+  })),
+  ...pluginLifecycleTools.map((t) => ({
+    ...t,
+    mutates: !PLUGIN_LIFECYCLE_READ_ONLY_NAMES.has(t.name),
+  })),
+]
+
+export { buildPluginSystemPrompt } from './systemPrompt'
+export {
+  PluginIdeSnapshotSchema,
+  emptyPluginIdeSnapshot,
+} from './snapshot'
+export type { PluginIdeSnapshot } from './snapshot'
diff --git a/server/ai/tools/plugin/lifecycleTools.ts b/server/ai/tools/plugin/lifecycleTools.ts
new file mode 100644
index 000000000..7b71d8a5e
--- /dev/null
+++ b/server/ai/tools/plugin/lifecycleTools.ts
@@ -0,0 +1,161 @@
+/**
+ * Plugin-scope lifecycle tools — server-resolved.
+ *
+ * These run in-process (the build and the activation lifecycle are server
+ * operations), which also makes them the plugin scope's headless MCP
+ * surface: an external client can list/validate/activate without an open
+ * IDE, following the `site_publish` precedent.
+ *
+ * `plugin_activate` deliberately cannot approve a grant-set change: the
+ * permission review + step-up is a HUMAN consent moment (the IDE header
+ * owns it). A grants-changed activation returns a clear instruction
+ * instead. Same-grant rebuilds — the everyday agent loop of edit →
+ * validate → activate — run without friction.
+ *
+ * The activation engine + list projection live with the site-plugins
+ * handler module (`runSitePluginActivation`, `listSitePlugins`), which owns
+ * that orchestration for every caller; these tools are thin adapters.
+ */
+import { Type } from '@core/utils/typeboxHelpers'
+import type { CoreCapability } from '@core/capabilities'
+import { aiToolError, aiToolOk } from '@core/ai'
+import {
+  discoverSitePlugins,
+  sitePluginIdFromLocalId,
+} from '@core/site-plugins'
+import type { AiTool } from '../types'
+import type { ToolContext } from '../../runtime/types'
+import {
+  listSitePlugins,
+  runSitePluginActivation,
+} from '../../../handlers/cms/sitePlugins'
+import { buildSitePlugin } from '../../../plugins/sitePlugins/build'
+import { runPublishFlush } from '../../../publish/publishFlush'
+import { getDraftSite } from '../../../repositories/site'
+import { getInstalledPlugin } from '../../../repositories/plugins'
+import { findUserById } from '../../../repositories/users'
+import { PluginIdeSnapshotSchema } from './snapshot'
+import { safeParseValue } from '@core/utils/typeboxHelpers'
+
+const PLUGIN_READ_CAPS: readonly CoreCapability[] = ['site.read', 'plugins.read']
+
+/**
+ * `localId` is optional in the panel (defaults to the plugin open in the
+ * IDE, from the snapshot) and required over MCP (snapshot is null there).
+ */
+const LocalIdInputSchema = Type.Object({
+  localId: Type.Optional(Type.String({ minLength: 1 })),
+})
+
+function resolveLocalId(input: { localId?: string }, ctx: ToolContext): string | null {
+  if (input.localId) return input.localId
+  const parsed = safeParseValue(PluginIdeSnapshotSchema, ctx.snapshot)
+  return parsed.ok && parsed.value.localId ? parsed.value.localId : null
+}
+
+const listPluginsTool: AiTool = {
+  name: 'plugin_list_plugins',
+  scope: 'plugin',
+  execution: 'server',
+  requiredCapabilities: PLUGIN_READ_CAPS,
+  description:
+    'List every site plugin (draft folders ∪ runtime rows) with its computed state, active version, declared vs granted permissions, and last runtime error. Use to orient before working on a plugin, or to find the localId for plugin_validate / plugin_activate.',
+  inputSchema: Type.Object({}),
+  handler: async (_input, ctx) => {
+    return { sitePlugins: await listSitePlugins(ctx.db) }
+  },
+}
+
+const validateTool: AiTool = {
+  name: 'plugin_validate',
+  scope: 'plugin',
+  execution: 'server',
+  requiredCapabilities: PLUGIN_READ_CAPS,
+  description:
+    'Run the same validate-only build as the IDE diagnostics strip: TypeScript bundling, import containment, and manifest coherence. Returns { ok, diagnostics }. Iterate until diagnostics is empty before calling plugin_activate. Omit localId to validate the plugin open in the IDE.',
+  inputSchema: LocalIdInputSchema,
+  handler: async (input, ctx) => {
+    const localId = resolveLocalId(input as { localId?: string }, ctx)
+    if (!localId) {
+      return aiToolError('No plugin in scope — pass localId (see plugin_list_plugins).')
+    }
+    await runPublishFlush()
+    const shell = await getDraftSite(ctx.db)
+    const draftFiles = shell?.files.filter((file) => file.type === 'plugin') ?? []
+    const plugin = discoverSitePlugins(draftFiles).find((entry) => entry.localId === localId)
+    if (!plugin) {
+      return aiToolError(`No site plugin source at plugins/${localId}/`)
+    }
+    const rowResult = await getInstalledPlugin(ctx.db, sitePluginIdFromLocalId(localId))
+    const row = rowResult?.kind === 'ok' ? rowResult.plugin : null
+    const result = await buildSitePlugin({
+      localId,
+      files: plugin.files,
+      previousVersion: row?.version ?? null,
+      validateOnly: true,
+    })
+    return aiToolOk({ ok: result.ok, diagnostics: result.ok ? [] : result.diagnostics })
+  },
+}
+
+const activateTool: AiTool = {
+  name: 'plugin_activate',
+  scope: 'plugin',
+  execution: 'server',
+  requiredCapabilities: ['plugins.install'],
+  description:
+    'Build & activate the plugin from the current draft source (install or upgrade, with publish coupling for visitor-facing surfaces). Same-grant rebuilds run directly; if the declared permission set CHANGED, activation is refused — a human must review and confirm the new grants in the IDE header (Build & activate). Run plugin_validate first. Omit localId to activate the plugin open in the IDE.',
+  inputSchema: LocalIdInputSchema,
+  handler: async (input, ctx) => {
+    const localId = resolveLocalId(input as { localId?: string }, ctx)
+    if (!localId) {
+      return aiToolError('No plugin in scope — pass localId (see plugin_list_plugins).')
+    }
+    if (!ctx.uploadsDir) {
+      return aiToolError('Uploads directory is not configured on this server.')
+    }
+    const user = await findUserById(ctx.db, ctx.userId)
+    if (!user) return aiToolError('Calling user no longer exists.')
+
+    const result = await runSitePluginActivation({
+      db: ctx.db,
+      options: { uploadsDir: ctx.uploadsDir },
+      user,
+      req: null,
+      localId,
+      allowGrantChange: false,
+    })
+    switch (result.status) {
+      case 'ok':
+        return aiToolOk({
+          activated: !result.skipped,
+          skipped: result.skipped,
+          pluginId: result.plugin.id,
+          version: result.plugin.version,
+          ...(result.upgrade ? { upgrade: result.upgrade } : {}),
+        })
+      case 'grants-changed':
+        return aiToolError(
+          `Activation needs human consent: the permission grant set changed ` +
+          `(new: ${result.newPermissions.join(', ') || 'none'}; removed: ${result.removedPermissions.join(', ') || 'none'}). ` +
+          `Ask the user to click "Build & activate" in the Plugin IDE header to review and confirm the grants.`,
+        )
+      case 'build-failed':
+        return aiToolError(
+          `Build failed:\n${result.diagnostics.join('\n')}\nFix the diagnostics (plugin_validate) and retry.`,
+        )
+      case 'not-found':
+      case 'invalid':
+      case 'upgrade-error':
+        return aiToolError(result.message)
+    }
+  },
+}
+
+export const pluginLifecycleTools: AiTool[] = [listPluginsTool, validateTool, activateTool]
+
+/** Server tools that only read state. */
+export const PLUGIN_LIFECYCLE_READ_ONLY_NAMES = new Set([
+  'plugin_list_plugins',
+  'plugin_validate',
+])
diff --git a/server/ai/tools/plugin/snapshot.ts b/server/ai/tools/plugin/snapshot.ts
new file mode 100644
index 000000000..b698a24fb
--- /dev/null
+++ b/server/ai/tools/plugin/snapshot.ts
@@ -0,0 +1,62 @@
+/**
+ * PluginIdeSnapshot — payload the chat handler hands to plugin-scope tool
+ * handlers via `ToolContext.snapshot` and the system-prompt builder.
+ *
+ * The browser builds this on every send from the live Plugin IDE state
+ * (open plugin, CRDT file list, active buffer, runtime summary). Shape is
+ * validated at the chat boundary with `PluginIdeSnapshotSchema` — a
+ * malformed snapshot falls back to empty rather than crashing the stream.
+ *
+ * Over MCP the snapshot is null: file tools are browser-bridged to the open
+ * IDE anyway, and the server tools (`plugin_validate`, `plugin_activate`,
+ * `plugin_list_plugins`) take an explicit `localId` instead.
+ */
+import { Type, type Static } from '@core/utils/typeboxHelpers'
+
+export const PluginIdeSnapshotSchema = Type.Object({
+  /** The plugin open in the IDE. */
+  localId: Type.String(),
+  /** Runtime id (`site.<localId>`). */
+  pluginId: Type.String(),
+  /** Paths RELATIVE to the plugin folder (`plugin.json`, `server/index.ts`). */
+  files: Type.Array(
+    Type.Object({
+      id: Type.String(),
+      path: Type.String(),
+    }),
+  ),
+  /** The buffer currently visible in the editor, if any. */
+  activeFile: Type.Union([
+    Type.Object({ id: Type.String(), path: Type.String() }),
+    Type.Null(),
+  ]),
+  /** `computeSitePluginState` vocabulary — 'active', 'draft-changed', …. */
+  state: Type.String(),
+  activeVersion: Type.Union([Type.String(), Type.Null()]),
+  declaredPermissions: Type.Array(Type.String()),
+  grantedPermissions: Type.Array(Type.String()),
+  /** The diagnostics strip's latest result; null = not validated yet. */
+  latestDiagnostics: Type.Union([Type.Array(Type.String()), Type.Null()]),
+  currentUser: Type.Object({
+    id: Type.String(),
+    displayName: Type.String(),
+    email: Type.String(),
+  }),
+})
+
+export type PluginIdeSnapshot = Static<typeof PluginIdeSnapshotSchema>
+
+export function emptyPluginIdeSnapshot(): PluginIdeSnapshot {
+  return {
+    localId: '',
+    pluginId: '',
+    files: [],
+    activeFile: null,
+    state: 'draft-changed',
+    activeVersion: null,
+    declaredPermissions: [],
+    grantedPermissions: [],
+    latestDiagnostics: null,
+    currentUser: { id: '', displayName: '', email: '' },
+  }
+}
diff --git a/server/ai/tools/plugin/systemPrompt.ts b/server/ai/tools/plugin/systemPrompt.ts
new file mode 100644
index 000000000..1d1000d02
--- /dev/null
+++ b/server/ai/tools/plugin/systemPrompt.ts
@@ -0,0 +1,78 @@
+/**
+ * Plugin-scope system prompt.
+ *
+ * Same [staticPrefix, BOUNDARY, dynamicSuffix] shape as the site/content
+ * scopes so Anthropic's prompt cache covers everything before the boundary.
+ * The dynamic suffix carries per-request context: the open plugin, its file
+ * list, runtime state, and the latest diagnostics.
+ */
+import { SYSTEM_PROMPT_DYNAMIC_BOUNDARY } from '../../runtime/types'
+import type { PluginIdeSnapshot } from './snapshot'
+
+const STATIC_PROMPT_PREFIX = `You are a plugin developer working inside the Instatic Plugin IDE, co-editing a SITE PLUGIN's source with the user in real time. You read and write files by calling tools; edits merge live into the user's open editor (CRDT) — there is no save step.
+
+What a site plugin is:
+- Source lives in the site draft under plugins/<local-id>/. All tool paths are RELATIVE to that folder (plugin.json, server/index.ts, …).
+- plugin.json is the manifest the author owns: { name, description, permissions?, networkAllowedHosts?, resources?, adminPages? }. Everything else (id, version, entrypoints) is DERIVED by the build — never write those fields.
+- Entrypoints are derived from the folder convention:
+    server/index.ts  → backend entrypoint, runs in a QuickJS-WASM sandbox on the server (no Node/Bun ambient access; outbound network only with the network.outbound permission + networkAllowedHosts).
+    editor/index.ts  → admin editor extension, runs UNSANDBOXED in every admin's browser — requires the "editor.code" permission.
+    modules/*.ts(x)  → canvas module pack (blocks users drop on pages) — requires "modules.register".
+    frontend/**      → static assets published with the site.
+- Permission coherence is enforced: an entry file whose permission is missing from plugin.json fails validation with a named diagnostic. adminPages requires "admin.navigation"; adminPages with kind:'app' additionally requires "editor.code" (markdown pages don't).
+- Import containment: plugin code may import its own files and "@instatic/plugin-sdk" ONLY. Imports that escape the plugin folder fail the build.
+
+SDK essentials (import from "@instatic/plugin-sdk"):
+- Server: export default defineServerPlugin-style hooks object; routes registered via the hooks receive (req) and return responses. sitePluginRoute(localId, path) builds the public route URL ("/admin/api/cms/plugins/site.<localId>/runtime/<path>").
+- Modules: defineModule({ id, label, html, css, controls }) with control() builders; html uses the tagged html\`\` helper (escapeHtml/raw/safeUrl available).
+- Editor: registerCommand and editor UI APIs (runs in the admin window).
+
+Workflow — validate until clean, then activate:
+1. Orient: the dynamic context below lists the open plugin and its files. plugin_read_file before editing an existing file; plugin_list_files if the layout is unclear.
+2. Edit: plugin_patch_file for targeted edits (needs the latest hash — re-read after the user types), plugin_write_file to create files or rewrite wholesale, plugin_rename_file / plugin_delete_file to reorganize. plugin_open_file to show the user a file you're working on.
+3. Validate: plugin_validate after each meaningful change — it runs the real build (TypeScript, containment, manifest). Fix every diagnostic; the strip in the IDE shows the same list.
+4. Activate: plugin_activate ships the draft as a new revision (same permissions only — a changed grant set needs the user to confirm in the IDE header; say so instead of retrying).
+
+Rules:
+- Bias toward action: execute the request, don't ask scoping questions.
+- Never invent manifest fields, permissions, or SDK APIs. If validation names a missing permission, add exactly that permission to plugin.json.
+- Respect concurrent editing: if a patch fails with a hash mismatch, re-read the file and re-apply — the user (or a peer) typed meanwhile. Never blind-overwrite with plugin_write_file after a mismatch.
+- Code style: plain TypeScript, no external npm imports (they cannot resolve inside the sandbox).
+
+Reply: 1-2 sentences after acting. The tools change the files — the reply just narrates what changed and what's next.`
+
+export function buildPluginSystemPrompt(snap: PluginIdeSnapshot): string[] {
+  return [
+    STATIC_PROMPT_PREFIX,
+    SYSTEM_PROMPT_DYNAMIC_BOUNDARY,
+    buildDynamicSuffix(snap),
+  ]
+}
+
+function buildDynamicSuffix(snap: PluginIdeSnapshot): string {
+  if (!snap.localId) {
+    return 'No plugin is open. Use plugin_list_plugins to find one, then take localId from there for plugin_validate / plugin_activate; file tools need an open IDE.'
+  }
+  const lines: string[] = []
+  lines.push(
+    `Open plugin: ${snap.localId} (runtime id ${snap.pluginId}), state=${snap.state}, active version=${snap.activeVersion ?? 'not built yet'}.`,
+  )
+  lines.push(
+    `Permissions: declared=[${snap.declaredPermissions.join(', ')}] granted=[${snap.grantedPermissions.join(', ')}].`,
+  )
+  lines.push(
+    snap.files.length > 0
+      ? `Files:\n${snap.files.map((file) => `  - ${file.path}`).join('\n')}`
+      : 'Files: (none yet — plugin_write_file creates the first one).',
+  )
+  if (snap.activeFile) {
+    lines.push(`The user is looking at: ${snap.activeFile.path}.`)
+  }
+  if (snap.latestDiagnostics && snap.latestDiagnostics.length > 0) {
+    lines.push(`Current diagnostics:\n${snap.latestDiagnostics.map((d) => `  - ${d}`).join('\n')}`)
+  } else if (snap.latestDiagnostics) {
+    lines.push('Current diagnostics: clean.')
+  }
+  lines.push(`User: ${snap.currentUser.displayName} <${snap.currentUser.email}>.`)
+  return lines.join('\n')
+}
diff --git a/server/handlers/cms/plugins/install.ts b/server/handlers/cms/plugins/install.ts
index 84bdcbc50..3f29fd425 100644
--- a/server/handlers/cms/plugins/install.ts
+++ b/server/handlers/cms/plugins/install.ts
@@ -223,7 +223,8 @@ export interface ActivatePackageFromDiskInput {
   db: DbClient
   options: CmsHandlerOptions
   user: AuthUser
-  req: Request
+  /** Null for non-HTTP callers (AI tools) — audit rows then omit ip/ua. */
+  req: Request | null
   /** Manifest whose assetBasePath already points at files ON DISK. */
   manifest: PluginManifest
   grantedPermissions: PluginPermission[]
diff --git a/server/handlers/cms/plugins/pack.ts b/server/handlers/cms/plugins/pack.ts
index db8469f5f..dee7144d1 100644
--- a/server/handlers/cms/plugins/pack.ts
+++ b/server/handlers/cms/plugins/pack.ts
@@ -60,7 +60,7 @@ async function installPluginPackToSite(
   plugin: InstalledPlugin,
   uploadsDir: string,
   actorUserId: string,
-  req: Request,
+  req: Request | null,
 ): Promise<PluginPackSummary | null> {
   if (!plugin.manifest.pack) return null
   if (!plugin.manifest.assetBasePath) return null
@@ -175,7 +175,7 @@ export async function maybeAutoInstallPluginPack(
   plugin: InstalledPlugin,
   options: CmsHandlerOptions,
   user: AuthUser,
-  req: Request,
+  req: Request | null,
 ): Promise<PluginPackSummary | null> {
   if (!options.uploadsDir) return null
   if (!plugin.manifest.pack) return null
diff --git a/server/handlers/cms/plugins/shared.ts b/server/handlers/cms/plugins/shared.ts
index bca2d8e89..332a4cad5 100644
--- a/server/handlers/cms/plugins/shared.ts
+++ b/server/handlers/cms/plugins/shared.ts
@@ -78,7 +78,7 @@ type PluginAuditAction =
 export async function recordPluginAuditEvent(
   db: DbClient,
   user: AuthUser,
-  req: Request,
+  req: Request | null,
   action: PluginAuditAction,
   pluginId: string,
   metadata: Record<string, unknown> = {},
diff --git a/server/handlers/cms/shared.ts b/server/handlers/cms/shared.ts
index ed88a7a7c..4c91dab23 100644
--- a/server/handlers/cms/shared.ts
+++ b/server/handlers/cms/shared.ts
@@ -45,7 +45,13 @@ export interface CmsHandlerOptions {
   collabRelay?: CollabRelay
 }
 
-export function requestAuditContext(req: Request): { ipAddress: string | null; userAgent: string | null } {
+/**
+ * Audit fields extracted from the HTTP request. `null` covers actions with
+ * no request — e.g. AI-tool-initiated lifecycle operations, where the actor
+ * is recorded but there is no client ip/ua to attribute.
+ */
+export function requestAuditContext(req: Request | null): { ipAddress: string | null; userAgent: string | null } {
+  if (!req) return { ipAddress: null, userAgent: null }
   return {
     ipAddress: clientIp(req),
     userAgent: req.headers.get('user-agent'),
diff --git a/server/handlers/cms/sitePlugins.ts b/server/handlers/cms/sitePlugins.ts
index 01bc51bf4..bbf5f7bad 100644
--- a/server/handlers/cms/sitePlugins.ts
+++ b/server/handlers/cms/sitePlugins.ts
@@ -26,7 +26,7 @@ import { readFile } from 'node:fs/promises'
 import { join } from 'node:path'
 import { nanoid } from 'nanoid'
 import type { SiteFile } from '@core/files/schemas'
-import type { PluginManifest } from '@core/plugin-sdk'
+import type { InstalledPlugin, PluginManifest } from '@core/plugin-sdk'
 import { parsePluginManifest } from '@core/plugins/manifest'
 import {
   SITE_PLUGIN_LOCAL_ID_PATTERN,
@@ -99,7 +99,7 @@ function sameStringSet(a: readonly string[], b: readonly string[]): boolean {
 // GET /site-plugins — the list
 // ---------------------------------------------------------------------------
 
-async function listSitePlugins(db: DbClient): Promise<SitePluginSummary[]> {
+export async function listSitePlugins(db: DbClient): Promise<SitePluginSummary[]> {
   const draftFiles = await readDraftPluginFiles(db)
   let discovered: ReturnType<typeof discoverSitePlugins>
   try {
@@ -310,26 +310,45 @@ async function handlePreviewPack(db: DbClient, localId: string): Promise<Respons
 }
 
 // ---------------------------------------------------------------------------
-// POST /site-plugins/:localId/activate — Build & activate
+// Activation engine — shared by the HTTP route and the AI `plugin_activate`
+// tool. HTTP-free: consent (step-up) stays with the HTTP wrapper; callers
+// that cannot prompt (AI tools, MCP) pass `allowGrantChange: false` and
+// surface the `grants-changed` result as an instruction to confirm in the
+// IDE header.
 // ---------------------------------------------------------------------------
 
-async function handleActivate(
-  req: Request,
-  db: DbClient,
-  options: CmsHandlerOptions,
-  user: AuthUser,
-  localId: string,
-): Promise<Response> {
+export type SitePluginActivationResult =
+  | { status: 'ok'; plugin: InstalledPlugin; upgrade?: { fromVersion: string; toVersion: string }; skipped: boolean }
+  | { status: 'not-found'; message: string }
+  | { status: 'invalid'; message: string }
+  | { status: 'grants-changed'; newPermissions: string[]; removedPermissions: string[] }
+  | { status: 'build-failed'; diagnostics: string[] }
+  | { status: 'upgrade-error'; message: string }
+
+export async function runSitePluginActivation(input: {
+  db: DbClient
+  options: CmsHandlerOptions
+  user: AuthUser
+  /** Null for non-HTTP callers — audit rows then omit ip/ua. */
+  req: Request | null
+  localId: string
+  /**
+   * Whether a grant-set change may proceed. The HTTP route sets this true
+   * only AFTER a successful step-up; tool callers always pass false.
+   */
+  allowGrantChange: boolean
+}): Promise<SitePluginActivationResult> {
+  const { db, options, user, req, localId, allowGrantChange } = input
   if (!options.uploadsDir) {
-    return jsonResponse({ error: 'Uploads directory is not configured' }, { status: 500 })
+    return { status: 'invalid', message: 'Uploads directory is not configured' }
   }
   const draftFiles = await readDraftPluginFiles(db)
   const plugin = discoverSitePlugins(draftFiles).find((entry) => entry.localId === localId)
   if (!plugin) {
-    return jsonResponse({ error: `No site plugin source at plugins/${localId}/` }, { status: 404 })
+    return { status: 'not-found', message: `No site plugin source at plugins/${localId}/` }
   }
   if (!plugin.manifestFile?.content) {
-    return badRequest(`plugins/${localId}/plugin.json is missing`)
+    return { status: 'invalid', message: `plugins/${localId}/plugin.json is missing` }
   }
 
   const rowResult = await getInstalledPlugin(db, sitePluginIdFromLocalId(localId))
@@ -342,16 +361,12 @@ async function handleActivate(
     row.lifecycleStatus === 'active' &&
     contentHashOfVersion(row.version) === contentHash
   ) {
-    return jsonResponse({
-      plugin: await presentPluginSecrets(db, row),
-      skipped: true,
-      sitePlugins: await listSitePlugins(db),
-    })
+    return { status: 'ok', plugin: row, skipped: true }
   }
 
   // Derive BEFORE building: the grant diff decides whether this request is
-  // a consent moment (step-up) — and a manifest error should fail before
-  // any bundling work.
+  // a consent moment — and a manifest error should fail before any
+  // bundling work.
   let manifest: PluginManifest
   try {
     manifest = deriveSitePluginManifest({
@@ -362,16 +377,18 @@ async function handleActivate(
       contentHash,
     })
   } catch (err) {
-    return badRequest(getErrorMessage(err, 'Invalid site plugin manifest'))
+    return { status: 'invalid', message: getErrorMessage(err, 'Invalid site plugin manifest') }
   }
 
-  // Step-up on the consent moments only: first activation, or a changed
-  // grant set. Same-grant rebuilds skip it — the security boundary is the
-  // grant set, not the code revision.
-  const grantsChanged = !row || !sameStringSet(row.grantedPermissions, manifest.permissions)
-  if (grantsChanged) {
-    const stepUp = await requireStepUp(req, db, user)
-    if (stepUp) return stepUp
+  const granted: readonly string[] = row?.grantedPermissions ?? []
+  const declared: readonly string[] = manifest.permissions
+  const grantsChanged = !row || !sameStringSet(granted, declared)
+  if (grantsChanged && !allowGrantChange) {
+    return {
+      status: 'grants-changed',
+      newPermissions: declared.filter((p) => !granted.includes(p)),
+      removedPermissions: granted.filter((p) => !declared.includes(p)),
+    }
   }
 
   const built = await buildSitePlugin({
@@ -382,10 +399,7 @@ async function handleActivate(
     validateOnly: false,
   })
   if (!built.ok) {
-    return jsonResponse(
-      { error: `Site plugin build failed`, diagnostics: built.diagnostics },
-      { status: 400 },
-    )
+    return { status: 'build-failed', diagnostics: built.diagnostics }
   }
 
   // Grants = declared, in both directions: activation grants exactly what
@@ -400,19 +414,73 @@ async function handleActivate(
     source: 'site-local',
   })
   if (outcome.upgradeError) {
-    return jsonResponse(
-      { error: outcome.upgradeError, sitePlugins: await listSitePlugins(db) },
-      { status: 400 },
-    )
+    return { status: 'upgrade-error', message: outcome.upgradeError }
   }
 
   await republishAndSweep(db, options.uploadsDir, built.manifest)
 
-  return jsonResponse({
-    plugin: await presentPluginSecrets(db, outcome.plugin),
+  return {
+    status: 'ok',
+    plugin: outcome.plugin,
     ...(outcome.upgrade ? { upgrade: outcome.upgrade } : {}),
-    sitePlugins: await listSitePlugins(db),
+    skipped: false,
+  }
+}
+
+// ---------------------------------------------------------------------------
+// POST /site-plugins/:localId/activate — Build & activate
+// ---------------------------------------------------------------------------
+
+async function handleActivate(
+  req: Request,
+  db: DbClient,
+  options: CmsHandlerOptions,
+  user: AuthUser,
+  localId: string,
+): Promise<Response> {
+  // First pass without grant-change authority: a `grants-changed` result IS
+  // the consent moment — step up, then re-run with the change allowed. The
+  // repeated pass only re-does the cheap draft read + manifest derivation
+  // (the grant check fails before any build work).
+  let result = await runSitePluginActivation({
+    db, options, user, req, localId, allowGrantChange: false,
   })
+  if (result.status === 'grants-changed') {
+    const stepUp = await requireStepUp(req, db, user)
+    if (stepUp) return stepUp
+    result = await runSitePluginActivation({
+      db, options, user, req, localId, allowGrantChange: true,
+    })
+  }
+
+  switch (result.status) {
+    case 'ok':
+      return jsonResponse({
+        plugin: await presentPluginSecrets(db, result.plugin),
+        ...(result.upgrade ? { upgrade: result.upgrade } : {}),
+        ...(result.skipped ? { skipped: true } : {}),
+        sitePlugins: await listSitePlugins(db),
+      })
+    case 'not-found':
+      return jsonResponse({ error: result.message }, { status: 404 })
+    case 'invalid':
+      return result.message === 'Uploads directory is not configured'
+        ? jsonResponse({ error: result.message }, { status: 500 })
+        : badRequest(result.message)
+    case 'build-failed':
+      return jsonResponse(
+        { error: 'Site plugin build failed', diagnostics: result.diagnostics },
+        { status: 400 },
+      )
+    case 'upgrade-error':
+      return jsonResponse(
+        { error: result.message, sitePlugins: await listSitePlugins(db) },
+        { status: 400 },
+      )
+    case 'grants-changed':
+      // Unreachable — the step-up pass above re-runs with the change allowed.
+      return badRequest('Activation requires grant-change consent')
+  }
 }
 
 /**
diff --git a/server/router.ts b/server/router.ts
index 5da4d651c..8bab70245 100644
--- a/server/router.ts
+++ b/server/router.ts
@@ -155,7 +155,7 @@ function tryServeMcpOAuth(
  * by the CMS dispatcher.
  */
 function tryServeAi(req: Request, runtime: ServerRuntime, url: URL, _pathname: string): Promise<Response> | null {
-  return tryHandleAi(req, runtime.db, url)
+  return tryHandleAi(req, runtime.db, url, { uploadsDir: runtime.uploadsDir })
 }
 
 /**
diff --git a/src/__tests__/helpers/capabilityHarness.ts b/src/__tests__/helpers/capabilityHarness.ts
index cff6181e1..a7d831bde 100644
--- a/src/__tests__/helpers/capabilityHarness.ts
+++ b/src/__tests__/helpers/capabilityHarness.ts
@@ -107,7 +107,7 @@ export async function createCapabilityTestHarness(
 
   const ai = async (path: string, requestOptions: HarnessRequestInit = {}) => {
     const req = buildRequest(path, requestOptions)
-    const response = await tryHandleAi(req, db, new URL(req.url))
+    const response = await tryHandleAi(req, db, new URL(req.url), { uploadsDir: options.uploadsDir })
     return response ?? new Response(JSON.stringify({ error: 'Not found' }), { status: 404 })
   }
 
diff --git a/src/core/ai/index.ts b/src/core/ai/index.ts
index 636fe323e..9d9240eb0 100644
--- a/src/core/ai/index.ts
+++ b/src/core/ai/index.ts
@@ -73,6 +73,13 @@ export {
   SetTypeScaleInputSchema,
   SetSpacingScaleInputSchema,
   RenderSnapshotInputSchema,
+  PluginListFilesInputSchema,
+  PluginReadFileInputSchema,
+  PluginWriteFileInputSchema,
+  PluginPatchFileInputSchema,
+  PluginRenameFileInputSchema,
+  PluginDeleteFileInputSchema,
+  PluginOpenFileInputSchema,
 } from './toolSchemas'
 export type {
   InsertHtmlInput,
@@ -101,6 +108,13 @@ export type {
   DuplicatePageInput,
   SetPageTemplateInput,
   ClearPageTemplateInput,
+  PluginListFilesInput,
+  PluginReadFileInput,
+  PluginWriteFileInput,
+  PluginPatchFileInput,
+  PluginRenameFileInput,
+  PluginDeleteFileInput,
+  PluginOpenFileInput,
 } from './toolSchemas'
 export {
   describeAgentDocuments,
diff --git a/src/core/ai/toolSchemas.ts b/src/core/ai/toolSchemas.ts
index 217377e7b..606d024b8 100644
--- a/src/core/ai/toolSchemas.ts
+++ b/src/core/ai/toolSchemas.ts
@@ -412,3 +412,66 @@ export const RenderSnapshotInputSchema = Type.Object({
   breakpointId: Type.Optional(Type.String({ minLength: 1 })),
   nodeId: Type.Optional(Type.String({ minLength: 1 })),
 })
+
+// ---------------------------------------------------------------------------
+// Plugin IDE tools (`plugin` scope)
+//
+// File paths are RELATIVE to the open plugin's folder (`plugin.json`,
+// `server/index.ts`, …) — the browser bridge resolves them against
+// `plugins/<local-id>/` and validates with isSafePath, so the model can
+// never address a file outside the plugin.
+// ---------------------------------------------------------------------------
+
+/** Address one plugin file by id (stable across renames) or relative path. */
+const PluginFileRefInputSchema = Type.Object({
+  fileId: Type.Optional(Type.String({ minLength: 1 })),
+  path: Type.Optional(Type.String({ minLength: 1 })),
+})
+
+export const PluginListFilesInputSchema = Type.Object({})
+export type PluginListFilesInput = Static<typeof PluginListFilesInputSchema>
+
+export const PluginReadFileInputSchema = Type.Composite([
+  PluginFileRefInputSchema,
+  Type.Object({
+    part: Type.Optional(Type.Integer({ minimum: 1 })),
+    maxChars: Type.Optional(Type.Integer({ minimum: 1, maximum: 100000 })),
+  }),
+])
+export type PluginReadFileInput = Static<typeof PluginReadFileInputSchema>
+
+export const PluginWriteFileInputSchema = Type.Object({
+  path: Type.String({ minLength: 1 }),
+  content: Type.String(),
+})
+export type PluginWriteFileInput = Static<typeof PluginWriteFileInputSchema>
+
+export const PluginPatchFileInputSchema = Type.Composite([
+  PluginFileRefInputSchema,
+  Type.Object({
+    expectedHash: Type.String({ minLength: 1 }),
+    replacements: Type.Array(
+      Type.Object({
+        oldText: Type.String({ minLength: 1 }),
+        newText: Type.String(),
+        replaceAll: Type.Optional(Type.Boolean()),
+      }),
+      { minItems: 1 },
+    ),
+  }),
+])
+export type PluginPatchFileInput = Static<typeof PluginPatchFileInputSchema>
+
+export const PluginRenameFileInputSchema = Type.Composite([
+  PluginFileRefInputSchema,
+  Type.Object({
+    newPath: Type.String({ minLength: 1 }),
+  }),
+])
+export type PluginRenameFileInput = Static<typeof PluginRenameFileInputSchema>
+
+export const PluginDeleteFileInputSchema = PluginFileRefInputSchema
+export type PluginDeleteFileInput = Static<typeof PluginDeleteFileInputSchema>
+
+export const PluginOpenFileInputSchema = PluginFileRefInputSchema
+export type PluginOpenFileInput = Static<typeof PluginOpenFileInputSchema>

From ec96fbd17732cf330de705a1020017caa47eeda7 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 22:34:38 +0200
Subject: [PATCH 12/36] =?UTF-8?q?feat(plugin-ide):=20AI=20chat=20panel=20?=
 =?UTF-8?q?=E2=80=94=20plugin=20scope=20agent=20with=20live=20file=20tools?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The IDE's left rail gains an AI assistant button (ai.chat-gated, the
Content sidebar pattern): the shared AgentPanel docked on the 'plugin'
chat scope, backed by a per-mount agent store, a module-level bridge
handle, and a dispatcher that re-validates every tool input against the
shared @core/ai schemas before touching the CRDT session.

- agent file edits are Y transactions (minimal splices) — they merge
  character-level with concurrent human typing and show up live for
  co-editors; replaceFileContent returns to IdeCollabSession with the
  agent as its consumer
- MCP parity: EditorBridgeScope/McpWorkspaceScope grow 'plugin'; the IDE
  registers its tool bridge for the whole page mount, so external MCP
  connectors reach the open IDE even with the panel closed; plugin tools
  join the MCP registry (lifecycle tools headless)
- sitePlugins handler split into sitePlugins/{index,service}.ts — HTTP
  routing vs transport-independent service layer (the module crossed the
  700-line god-file ceiling); gate tests updated for the new layout
- cmsMigrations role-seed gate reworked: the migration seed is an initial
  snapshot (boot sync owns propagation), so the gate now checks seeded
  capabilities are real instead of demanding completeness
- docs: site-plugins.md AI panel section, mcp-connectors.md plugin scope

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 docs/features/mcp-connectors.md               |   6 +-
 docs/features/site-plugins.md                 |  31 +-
 server/ai/mcp/editorBridge.ts                 |   2 +-
 server/ai/mcp/handlers/editorBridge.ts        |  13 +-
 server/ai/mcp/registry.ts                     |   5 +
 server/ai/mcp/server.ts                       |   3 +-
 .../{sitePlugins.ts => sitePlugins/index.ts}  | 309 ++-------------
 server/handlers/cms/sitePlugins/service.ts    | 292 +++++++++++++++
 .../cms-handlers-capability-gated.test.ts     |   5 +
 .../site-plugin-invariants.test.ts            |  18 +-
 src/__tests__/server/cmsMigrations.test.ts    |  20 +-
 src/admin/ai/useMcpWorkspaceBridge.ts         |   2 +-
 src/admin/pages/plugins/ide/IdeSidebar.tsx    | 123 ++++--
 .../pages/plugins/ide/SitePluginIdePage.tsx   |  96 +++--
 .../plugins/ide/agent/PluginIdeAgentMount.tsx |  24 ++
 .../ide/agent/agentSliceConfig.plugin.ts      |  26 ++
 .../plugins/ide/agent/pluginAgentStore.ts     |  33 ++
 .../pages/plugins/ide/agent/pluginBridge.ts   | 353 ++++++++++++++++++
 .../plugins/ide/agent/pluginBridgeHandle.ts   |  97 +++++
 .../ide/agent/usePluginIdeToolBridge.ts       |  77 ++++
 src/admin/pages/plugins/ide/ideCollab.ts      |  17 +
 21 files changed, 1186 insertions(+), 366 deletions(-)
 rename server/handlers/cms/{sitePlugins.ts => sitePlugins/index.ts} (60%)
 create mode 100644 server/handlers/cms/sitePlugins/service.ts
 create mode 100644 src/admin/pages/plugins/ide/agent/PluginIdeAgentMount.tsx
 create mode 100644 src/admin/pages/plugins/ide/agent/agentSliceConfig.plugin.ts
 create mode 100644 src/admin/pages/plugins/ide/agent/pluginAgentStore.ts
 create mode 100644 src/admin/pages/plugins/ide/agent/pluginBridge.ts
 create mode 100644 src/admin/pages/plugins/ide/agent/pluginBridgeHandle.ts
 create mode 100644 src/admin/pages/plugins/ide/agent/usePluginIdeToolBridge.ts

diff --git a/docs/features/mcp-connectors.md b/docs/features/mcp-connectors.md
index 30febc736..48829d99b 100644
--- a/docs/features/mcp-connectors.md
+++ b/docs/features/mcp-connectors.md
@@ -122,7 +122,7 @@ server/ai/mcp/server.ts + registry.ts
        ▼
 executeAiTool(...) / live editor bridge
   ├─ repositories and publisher for headless tools
-  └─ connection owner's open Site or Content workspace for browser tools
+  └─ connection owner's open Site, Content, or Plugin IDE workspace for browser tools
 ```
 
 ### Module layout
@@ -141,7 +141,7 @@ executeAiTool(...) / live editor bridge
 | `auth.ts` | Resolves OAuth access tokens or personal tokens to `{ connectorId, userId, capabilities }`; returns a discovery-aware 401 otherwise. |
 | `transports/http.ts` | Authenticated, Origin-validated `createMcpHandler` entry for MCP 2026-07-28 plus the stateless 2025 fallback. |
 | `server.ts` / `registry.ts` | Low-level SDK server, TypeBox input schemas, catalog deduplication, and capability filtering. |
-| `editorBridge.ts` | Per-user, per-scope live workspace bridge. The stream carries an **idle lease** (120s, re-armed by every relayed tool request) so an active batch is never cut mid-flight; only quiet streams recycle. The workspace's reconnect loop (`useMcpWorkspaceBridge`) reopens a recycled healthy stream immediately off the stream-end network event — deliberately timer-free, because hidden webviews (backgrounded browser tabs) clamp timers to minutes while network events still fire — and a tab becoming visible short-circuits any pending retry delay. |
+| `editorBridge.ts` | Per-user, per-scope (`site` / `content` / `plugin`) live workspace bridge. The stream carries an **idle lease** (120s, re-armed by every relayed tool request) so an active batch is never cut mid-flight; only quiet streams recycle. The workspace's reconnect loop (`useMcpWorkspaceBridge`) reopens a recycled healthy stream immediately off the stream-end network event — deliberately timer-free, because hidden webviews (backgrounded browser tabs) clamp timers to minutes while network events still fire — and a tab becoming visible short-circuits any pending retry delay. |
 | `tools/publishTool.ts` | Explicit canonical full-site publish with MCP audit metadata. |
 | `tools/uploadMediaTool.ts` | Server-resolved image upload (`media_upload`) — inline base64 or SSRF-guarded `sourceUrl` download, through the shared media pipeline. |
 
@@ -153,7 +153,7 @@ Server-resolved tools work without an editor open. They include content reads, `
 
 `media_upload` is the one server-resolved write that mutates outside the live editor draft: it adds an image to the Media library through the same `acceptUploadedMedia` core the HTTP route uses (magic-byte sniffing, SVG sanitisation, storage dispatch, responsive variants). Bytes arrive inline (base64) or via an https `sourceUrl` the host downloads under the plugin network layer's SSRF blocklist — https-only, DNS-resolved, per-redirect-hop re-validation, size-capped. It requires `ai.tools.write` plus `media.write`.
 
-Browser tools run against the connection owner's live workspace. Site structure, HTML/CSS, page lifecycle, design-token, content mutation, code-asset, and live-DOM tools route to the matching open Site or Content workspace. If that workspace is not open, the tool returns a scope-specific error while headless tools remain available. `tools/list` states that requirement in each browser tool's description, so a client learns the precondition when it picks the tool rather than from a failed call.
+Browser tools run against the connection owner's live workspace. Site structure, HTML/CSS, page lifecycle, design-token, content mutation, code-asset, and live-DOM tools route to the matching open Site, Content, or Plugin IDE workspace; the plugin scope carries the IDE's file tools. If that workspace is not open, the tool returns a scope-specific error while headless tools remain available. `tools/list` states that requirement in each browser tool's description, so a client learns the precondition when it picks the tool rather than from a failed call.
 
 There is intentionally no headless page-tree mutation path. The open editor store is the single source of truth for draft edits; a second DB mutation path would desynchronize node state and overwrite the live document. Relayed edits need no post-tool save step: store mutations stream to the collab relay the moment they land, and every headless read (plus `site_publish`) flushes the relay server-side before it touches the DB — so a following read or publish always observes the edit. There is no client-side save flush, and no window in which the MCP caller can see stale data.
 
diff --git a/docs/features/site-plugins.md b/docs/features/site-plugins.md
index f48dbfaeb..b9477d878 100644
--- a/docs/features/site-plugins.md
+++ b/docs/features/site-plugins.md
@@ -35,7 +35,7 @@ If browser code talks to a plugin's server code, it lives in that plugin's
 | Server build orchestrator (workspace, single-flight, timeout) | `server/plugins/sitePlugins/build.ts` |
 | Workspace materializer | `server/plugins/sitePlugins/workspace.ts` |
 | Revision retention / rollback target | `server/plugins/sitePlugins/retention.ts` |
-| HTTP routes | `server/handlers/cms/sitePlugins.ts` |
+| HTTP routes + service layer (list, activation engine) | `server/handlers/cms/sitePlugins/` |
 | Disk-package activation seam (shared with zip installs) | `server/handlers/cms/plugins/install.ts` → `activatePluginPackageFromDisk` |
 | Plugin IDE | `src/admin/pages/plugins/ide/` |
 | Plugins-page group + scaffold dialog | `src/admin/pages/plugins/components/SitePluginsSection.tsx`, `NewSitePluginDialog.tsx` |
@@ -43,6 +43,7 @@ If browser code talks to a plugin's server code, it lives in that plugin's
 | Collab CodeMirror binding | `src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx` |
 | Granular collab files (Y.Map + Y.Text content) | `src/core/collab/filesY.ts` |
 | SDK route helper | `src/core/plugin-sdk/sitePluginRoute.ts` |
+| AI plugin scope (tools, prompt, snapshot) | `server/ai/tools/plugin/`, `src/admin/pages/plugins/ide/agent/` |
 
 ## Source layout and field ownership
 
@@ -162,6 +163,34 @@ The IDE binds ONLY `site:default` over the site socket (its own
 There is no save button — the relay persists continuously; Cmd+S re-runs
 diagnostics. Automatic validation runs debounced on every change.
 
+### The AI panel (`plugin` chat scope)
+
+The left rail's AI button (gated by `ai.chat`) docks the shared AgentPanel
+— the same chat Site and Content have, on the `plugin` tool scope
+(`server/ai/tools/plugin/`):
+
+- **File tools are browser-bridged** to the live CRDT session: the agent
+  reads exactly what you see (un-persisted keystrokes included) and its
+  edits merge character-level with concurrent typing.
+  `plugin_read_file` paginates + hashes; `plugin_patch_file` requires the
+  latest hash (stale edits fail instead of clobbering); write/rename/
+  delete gate on `plugins.edit`; `plugin_open_file` moves the visible
+  buffer.
+- **Lifecycle tools are server-resolved**: `plugin_list_plugins`,
+  `plugin_validate` (the diagnostics-strip build), and `plugin_activate` —
+  same-grant rebuilds only. A changed grant set is refused with an
+  instruction to confirm in the IDE header: the permission review +
+  step-up stays a human consent moment.
+- The IDE registers its tool bridge for the whole page mount
+  (`usePluginIdeToolBridge`), so **external MCP connectors** reach the
+  open IDE with the panel closed — full parity with Site/Content
+  (docs/features/mcp-connectors.md). Lifecycle tools also run headless
+  over MCP.
+
+The per-request snapshot (open plugin, file list, active buffer, runtime
+state, latest diagnostics) rides every send; the `plugin` scope has its own
+default model row on /admin/ai/defaults.
+
 `plugin.json` has no structured editor — the raw buffer is the manifest
 surface. Manifest coherence (e.g. an `editor/` entry file without
 `editor.code` declared) is enforced by validation, and the human-readable
diff --git a/server/ai/mcp/editorBridge.ts b/server/ai/mcp/editorBridge.ts
index 58a71f9c5..01c9581e0 100644
--- a/server/ai/mcp/editorBridge.ts
+++ b/server/ai/mcp/editorBridge.ts
@@ -31,7 +31,7 @@ interface EditorBridgeEntry {
   destroy: () => void
 }
 
-export type EditorBridgeScope = 'site' | 'content'
+export type EditorBridgeScope = 'site' | 'content' | 'plugin'
 /**
  * How long a stream may sit with NO tool traffic before the server drops it.
  * This is an IDLE lease: every relayed tool request re-arms it, so an active
diff --git a/server/ai/mcp/handlers/editorBridge.ts b/server/ai/mcp/handlers/editorBridge.ts
index d2fd49826..a61724139 100644
--- a/server/ai/mcp/handlers/editorBridge.ts
+++ b/server/ai/mcp/handlers/editorBridge.ts
@@ -29,6 +29,7 @@ const PATH = '/admin/api/ai/editor-bridge'
 const EditorBridgeScopeSchema = Type.Union([
   Type.Literal('site'),
   Type.Literal('content'),
+  Type.Literal('plugin'),
 ])
 
 // Mirrors the Content workspace entry gate in `src/admin/access.ts` and
@@ -65,7 +66,7 @@ async function handle(req: Request, db: DbClient): Promise<Response> {
   )
   if (!scopeResult.ok) {
     return jsonResponse(
-      { error: 'Query parameter `scope` is required (one of: site, content)' },
+      { error: 'Query parameter `scope` is required (one of: site, content, plugin)' },
       { status: 400 },
     )
   }
@@ -73,9 +74,13 @@ async function handle(req: Request, db: DbClient): Promise<Response> {
 
   // Hosting a bridge requires access to the workspace whose live state the
   // browser tool will read or mutate.
-  const hasWorkspaceAccess = scope === 'site'
-    ? userHasCapability(userOrResponse, 'site.read')
-    : userHasAnyCapability(userOrResponse, CONTENT_BRIDGE_CAPABILITIES)
+  const hasWorkspaceAccess =
+    scope === 'site' || scope === 'plugin'
+      // Plugin IDE entry mirrors its page gate: site.read opens the IDE
+      // read-only; write tools re-check plugins.edit in the browser bridge
+      // and at tool selection.
+      ? userHasCapability(userOrResponse, 'site.read')
+      : userHasAnyCapability(userOrResponse, CONTENT_BRIDGE_CAPABILITIES)
   if (!hasWorkspaceAccess) {
     return jsonResponse({ error: 'Forbidden' }, { status: 403 })
   }
diff --git a/server/ai/mcp/registry.ts b/server/ai/mcp/registry.ts
index 3f8a011d0..8fb1381d2 100644
--- a/server/ai/mcp/registry.ts
+++ b/server/ai/mcp/registry.ts
@@ -27,6 +27,7 @@ import type { AiTool } from '../runtime/types'
 import { toolAllowedForCapabilities } from '../tools/capabilityGate'
 import { contentTools } from '../tools/content'
 import { siteTools } from '../tools/site'
+import { pluginTools } from '../tools/plugin'
 import { styleMcpTools } from './tools/styleTools'
 import { contextMcpTools } from './tools/contextTool'
 import { documentMcpTools } from './tools/documentTools'
@@ -56,6 +57,10 @@ function allMcpTools(runtime?: McpPublishRuntime): AiTool[] {
     uploadMediaMcpTool,
     ...contentTools,
     ...siteTools,
+    // Plugin scope: file tools relay to the connector owner's open Plugin
+    // IDE; plugin_list_plugins / plugin_validate / plugin_activate run
+    // headless (server-resolved) — the site_publish precedent.
+    ...pluginTools,
   ]
   const byName = new Map<string, AiTool>()
   for (const tool of ordered) {
diff --git a/server/ai/mcp/server.ts b/server/ai/mcp/server.ts
index bdfb392a0..9f0df9361 100644
--- a/server/ai/mcp/server.ts
+++ b/server/ai/mcp/server.ts
@@ -43,6 +43,7 @@ const NOOP_BRIDGE: AiBrowserBridge = {
 const NO_WORKSPACE_MESSAGE: Record<EditorBridgeScope, string> = {
   site: 'This tool runs in the Instatic Site editor. Open the Site editor in a browser (signed in as the connector owner) and try again.',
   content: 'This tool runs in the Instatic Content workspace. Open the Content workspace in a browser (signed in as the connector owner) and try again.',
+  plugin: 'This tool runs in the Instatic Plugin IDE. Open /admin/plugins/develop/<plugin-id> in a browser (signed in as the connector owner) and try again.',
 }
 
 /**
@@ -149,7 +150,7 @@ export function buildMcpServer(ctx: McpServerContext): Server {
     // Content; keep that invariant explicit instead of guessing a bridge.
     let bridge = NOOP_BRIDGE
     if (tool.execution === 'browser') {
-      if (tool.scope !== 'site' && tool.scope !== 'content') {
+      if (tool.scope !== 'site' && tool.scope !== 'content' && tool.scope !== 'plugin') {
         return project({
           isError: true,
           content: [{ type: 'text', text: `Browser tool "${tool.name}" has unsupported scope "${tool.scope}".` }],
diff --git a/server/handlers/cms/sitePlugins.ts b/server/handlers/cms/sitePlugins/index.ts
similarity index 60%
rename from server/handlers/cms/sitePlugins.ts
rename to server/handlers/cms/sitePlugins/index.ts
index bbf5f7bad..be7bdc050 100644
--- a/server/handlers/cms/sitePlugins.ts
+++ b/server/handlers/cms/sitePlugins/index.ts
@@ -1,6 +1,8 @@
 /**
  * Site plugin admin endpoints — the authoring/lifecycle surface for plugins
- * built from the site draft (docs/features/site-plugins.md).
+ * built from the site draft (docs/features/site-plugins.md). The
+ * transport-independent service layer (list + activation engine) lives in
+ * ./service.ts, shared with the AI plugin tools.
  *
  *   GET    /admin/api/cms/site-plugins                        — union of draft plugins/* folders and
  *                                                               site-local runtime rows, with computed states
@@ -26,45 +28,50 @@ import { readFile } from 'node:fs/promises'
 import { join } from 'node:path'
 import { nanoid } from 'nanoid'
 import type { SiteFile } from '@core/files/schemas'
-import type { InstalledPlugin, PluginManifest } from '@core/plugin-sdk'
+import type { PluginManifest } from '@core/plugin-sdk'
 import { parsePluginManifest } from '@core/plugins/manifest'
 import {
   SITE_PLUGIN_LOCAL_ID_PATTERN,
   SITE_PLUGIN_TEMPLATE_IDS,
-  computeSitePluginContentHash,
-  computeSitePluginState,
-  contentHashOfVersion,
-  deriveSitePluginManifest,
   discoverSitePlugins,
   sitePluginFolder,
   sitePluginIdFromLocalId,
   sitePluginTemplateFiles,
-  type SitePluginSummary,
 } from '@core/site-plugins'
 import { Type } from '@core/utils/typeboxHelpers'
 import { getErrorMessage } from '@core/utils/errorMessage'
-import type { DbClient } from '../../db/client'
-import type { AuthUser } from '../../repositories/users'
+import type { DbClient } from '../../../db/client'
+import type { AuthUser } from '../../../repositories/users'
 import {
   requireAnyCapability,
   requireCapability,
   requireStepUp,
-} from '../../auth/authz'
-import { getDraftSite, saveDraftSite } from '../../repositories/site'
-import { getInstalledPlugin, listInstalledPlugins } from '../../repositories/plugins'
-import { runPublishFlush } from '../../publish/publishFlush'
-import { republishAllPages } from '../../publish/republish'
-import { bumpPublishVersionSerialized } from '../../publish/publishState'
-import { buildSitePlugin } from '../../plugins/sitePlugins/build'
+} from '../../../auth/authz'
+import { getDraftSite, saveDraftSite } from '../../../repositories/site'
+import { getInstalledPlugin } from '../../../repositories/plugins'
+import { runPublishFlush } from '../../../publish/publishFlush'
+import { buildSitePlugin } from '../../../plugins/sitePlugins/build'
+import { previousSitePluginRevision } from '../../../plugins/sitePlugins/retention'
+import { badRequest, jsonResponse, methodNotAllowed, readValidatedBody } from '../../../http'
+import { type CmsHandlerOptions } from '../shared'
+import { activatePluginPackageFromDisk } from '../plugins/install'
+import { presentPluginSecrets } from '../plugins/shared'
+import { uninstallPluginById } from '../plugins/state'
 import {
-  previousSitePluginRevision,
-  sweepSitePluginRevisions,
-} from '../../plugins/sitePlugins/retention'
-import { badRequest, jsonResponse, methodNotAllowed, readValidatedBody } from '../../http'
-import { type CmsHandlerOptions } from './shared'
-import { activatePluginPackageFromDisk } from './plugins/install'
-import { presentPluginSecrets } from './plugins/shared'
-import { uninstallPluginById } from './plugins/state'
+  listSitePlugins,
+  readDraftPluginFiles,
+  republishAndSweep,
+  runSitePluginActivation,
+  sameStringSet,
+} from './service'
+
+// Service re-exports — external consumers (the AI plugin tools) import the
+// engine through this barrel.
+export {
+  listSitePlugins,
+  runSitePluginActivation,
+} from './service'
+export type { SitePluginActivationResult } from './service'
 
 const COLLECTION_PATH = '/admin/api/cms/site-plugins'
 const ITEM_PATTERN = /^\/admin\/api\/cms\/site-plugins\/(?<localId>[^/]+)$/
@@ -73,114 +80,6 @@ const PREVIEW_PACK_PATTERN = /^\/admin\/api\/cms\/site-plugins\/(?<localId>[^/]+
 const ACTIVATE_PATTERN = /^\/admin\/api\/cms\/site-plugins\/(?<localId>[^/]+)\/activate$/
 const ROLLBACK_PATTERN = /^\/admin\/api\/cms\/site-plugins\/(?<localId>[^/]+)\/rollback$/
 
-// ---------------------------------------------------------------------------
-// Draft access
-// ---------------------------------------------------------------------------
-
-/**
- * Read the persisted draft's plugin files — flushing the collab relay first
- * so edits still inside the persist debounce window are included ("flush
- * the editor's pending save, then read the persisted draft").
- */
-async function readDraftPluginFiles(db: DbClient): Promise<SiteFile[]> {
-  await runPublishFlush()
-  const shell = await getDraftSite(db)
-  return shell?.files.filter((file) => file.type === 'plugin') ?? []
-}
-
-function sameStringSet(a: readonly string[], b: readonly string[]): boolean {
-  if (a.length !== b.length) return false
-  const sortedA = [...a].sort()
-  const sortedB = [...b].sort()
-  return sortedA.every((value, index) => value === sortedB[index])
-}
-
-// ---------------------------------------------------------------------------
-// GET /site-plugins — the list
-// ---------------------------------------------------------------------------
-
-export async function listSitePlugins(db: DbClient): Promise<SitePluginSummary[]> {
-  const draftFiles = await readDraftPluginFiles(db)
-  let discovered: ReturnType<typeof discoverSitePlugins>
-  try {
-    discovered = discoverSitePlugins(draftFiles)
-  } catch (err) {
-    // An invalid local id in the draft must not blank the whole list — the
-    // offending folder simply can't be discovered until renamed.
-    console.error('[site-plugins] draft discovery failed:', err)
-    discovered = []
-  }
-  const draftByLocalId = new Map(discovered.map((plugin) => [plugin.localId, plugin]))
-
-  const rows = (await listInstalledPlugins(db))
-    .flatMap((result) => (result.kind === 'ok' ? [result.plugin] : []))
-    .filter((plugin) => plugin.source === 'site-local')
-  const rowByLocalId = new Map(
-    rows.map((plugin) => [plugin.id.replace(/^site\./, ''), plugin]),
-  )
-
-  // Union — a deleted folder must never hide a still-running backend.
-  const localIds = [...new Set([...draftByLocalId.keys(), ...rowByLocalId.keys()])].sort()
-
-  return localIds.map((localId) => {
-    const draft = draftByLocalId.get(localId) ?? null
-    const row = rowByLocalId.get(localId) ?? null
-
-    let manifest: PluginManifest | null = null
-    let manifestError: string | null = null
-    let draftContentHash: string | null = null
-    if (draft) {
-      draftContentHash = computeSitePluginContentHash(draft.files)
-      if (draft.manifestFile?.content) {
-        try {
-          manifest = deriveSitePluginManifest({
-            localId,
-            draftManifestJson: draft.manifestFile.content,
-            files: draft.files,
-            previousVersion: row?.version ?? null,
-            contentHash: draftContentHash,
-          })
-        } catch (err) {
-          manifestError = getErrorMessage(err, 'Invalid site plugin manifest')
-        }
-      } else {
-        manifestError = `plugins/${localId}/plugin.json is missing`
-      }
-    }
-
-    const declared = manifest?.permissions ?? []
-    const granted = row?.grantedPermissions ?? []
-    const grantsChanged = manifest !== null && row !== null && !sameStringSet(declared, granted)
-
-    const state = computeSitePluginState({
-      hasDraftSource: draft !== null,
-      row: row
-        ? { version: row.version, lifecycleStatus: row.lifecycleStatus, enabled: row.enabled }
-        : null,
-      manifestError,
-      draftContentHash,
-      activeContentHash: contentHashOfVersion(row?.version),
-      grantsChanged,
-    })
-
-    return {
-      localId,
-      pluginId: sitePluginIdFromLocalId(localId),
-      name: manifest?.name ?? row?.name ?? localId,
-      state,
-      activeVersion: row?.version ?? null,
-      hasDraftSource: draft !== null,
-      hasModules: Boolean(manifest?.entrypoints?.modules),
-      declaredPermissions: declared,
-      grantedPermissions: granted,
-      newPermissions: declared.filter((permission) => !granted.includes(permission)),
-      removedPermissions: granted.filter((permission) => !declared.includes(permission)),
-      manifestError,
-      lastError: row?.lastError ?? null,
-    }
-  })
-}
-
 // ---------------------------------------------------------------------------
 // POST /site-plugins — scaffold
 // ---------------------------------------------------------------------------
@@ -309,124 +208,6 @@ async function handlePreviewPack(db: DbClient, localId: string): Promise<Respons
   })
 }
 
-// ---------------------------------------------------------------------------
-// Activation engine — shared by the HTTP route and the AI `plugin_activate`
-// tool. HTTP-free: consent (step-up) stays with the HTTP wrapper; callers
-// that cannot prompt (AI tools, MCP) pass `allowGrantChange: false` and
-// surface the `grants-changed` result as an instruction to confirm in the
-// IDE header.
-// ---------------------------------------------------------------------------
-
-export type SitePluginActivationResult =
-  | { status: 'ok'; plugin: InstalledPlugin; upgrade?: { fromVersion: string; toVersion: string }; skipped: boolean }
-  | { status: 'not-found'; message: string }
-  | { status: 'invalid'; message: string }
-  | { status: 'grants-changed'; newPermissions: string[]; removedPermissions: string[] }
-  | { status: 'build-failed'; diagnostics: string[] }
-  | { status: 'upgrade-error'; message: string }
-
-export async function runSitePluginActivation(input: {
-  db: DbClient
-  options: CmsHandlerOptions
-  user: AuthUser
-  /** Null for non-HTTP callers — audit rows then omit ip/ua. */
-  req: Request | null
-  localId: string
-  /**
-   * Whether a grant-set change may proceed. The HTTP route sets this true
-   * only AFTER a successful step-up; tool callers always pass false.
-   */
-  allowGrantChange: boolean
-}): Promise<SitePluginActivationResult> {
-  const { db, options, user, req, localId, allowGrantChange } = input
-  if (!options.uploadsDir) {
-    return { status: 'invalid', message: 'Uploads directory is not configured' }
-  }
-  const draftFiles = await readDraftPluginFiles(db)
-  const plugin = discoverSitePlugins(draftFiles).find((entry) => entry.localId === localId)
-  if (!plugin) {
-    return { status: 'not-found', message: `No site plugin source at plugins/${localId}/` }
-  }
-  if (!plugin.manifestFile?.content) {
-    return { status: 'invalid', message: `plugins/${localId}/plugin.json is missing` }
-  }
-
-  const rowResult = await getInstalledPlugin(db, sitePluginIdFromLocalId(localId))
-  const row = rowResult?.kind === 'ok' ? rowResult.plugin : null
-  const contentHash = computeSitePluginContentHash(plugin.files)
-
-  // Skip when the active revision already matches the draft source.
-  if (
-    row &&
-    row.lifecycleStatus === 'active' &&
-    contentHashOfVersion(row.version) === contentHash
-  ) {
-    return { status: 'ok', plugin: row, skipped: true }
-  }
-
-  // Derive BEFORE building: the grant diff decides whether this request is
-  // a consent moment — and a manifest error should fail before any
-  // bundling work.
-  let manifest: PluginManifest
-  try {
-    manifest = deriveSitePluginManifest({
-      localId,
-      draftManifestJson: plugin.manifestFile.content,
-      files: plugin.files,
-      previousVersion: row?.version ?? null,
-      contentHash,
-    })
-  } catch (err) {
-    return { status: 'invalid', message: getErrorMessage(err, 'Invalid site plugin manifest') }
-  }
-
-  const granted: readonly string[] = row?.grantedPermissions ?? []
-  const declared: readonly string[] = manifest.permissions
-  const grantsChanged = !row || !sameStringSet(granted, declared)
-  if (grantsChanged && !allowGrantChange) {
-    return {
-      status: 'grants-changed',
-      newPermissions: declared.filter((p) => !granted.includes(p)),
-      removedPermissions: granted.filter((p) => !declared.includes(p)),
-    }
-  }
-
-  const built = await buildSitePlugin({
-    localId,
-    files: plugin.files,
-    previousVersion: row?.version ?? null,
-    uploadsDir: options.uploadsDir,
-    validateOnly: false,
-  })
-  if (!built.ok) {
-    return { status: 'build-failed', diagnostics: built.diagnostics }
-  }
-
-  // Grants = declared, in both directions: activation grants exactly what
-  // the draft declares, and dropping a permission shrinks the grant.
-  const outcome = await activatePluginPackageFromDisk({
-    db,
-    options,
-    user,
-    req,
-    manifest: built.manifest,
-    grantedPermissions: built.manifest.permissions,
-    source: 'site-local',
-  })
-  if (outcome.upgradeError) {
-    return { status: 'upgrade-error', message: outcome.upgradeError }
-  }
-
-  await republishAndSweep(db, options.uploadsDir, built.manifest)
-
-  return {
-    status: 'ok',
-    plugin: outcome.plugin,
-    ...(outcome.upgrade ? { upgrade: outcome.upgrade } : {}),
-    skipped: false,
-  }
-}
-
 // ---------------------------------------------------------------------------
 // POST /site-plugins/:localId/activate — Build & activate
 // ---------------------------------------------------------------------------
@@ -483,34 +264,6 @@ async function handleActivate(
   }
 }
 
-/**
- * Publish coupling (design → "Revision/publish coupling — defined"): baked
- * Layer-A HTML embeds versioned asset URLs, so when the plugin has
- * visitor-facing surfaces the host republishes BEFORE any old revision is
- * garbage-collected — published pages must never reference a deleted
- * revision. Backend-only plugins skip the republish and sweep immediately.
- */
-async function republishAndSweep(
-  db: DbClient,
-  uploadsDir: string,
-  manifest: PluginManifest,
-): Promise<void> {
-  const visitorFacing =
-    (manifest.frontend?.assets.length ?? 0) > 0 || Boolean(manifest.entrypoints?.modules)
-  if (visitorFacing) {
-    try {
-      await republishAllPages(db, uploadsDir)
-      await bumpPublishVersionSerialized()
-    } catch (err) {
-      // A failed republish must not fail the activation — but it must also
-      // not trigger the sweep (old revision stays referenced).
-      console.error(`[site-plugins] post-activation republish failed for ${manifest.id}:`, err)
-      return
-    }
-  }
-  await sweepSitePluginRevisions(uploadsDir, manifest.id, manifest.version)
-}
-
 // ---------------------------------------------------------------------------
 // POST /site-plugins/:localId/rollback — re-activate the previous revision
 // ---------------------------------------------------------------------------
diff --git a/server/handlers/cms/sitePlugins/service.ts b/server/handlers/cms/sitePlugins/service.ts
new file mode 100644
index 000000000..ce3c01241
--- /dev/null
+++ b/server/handlers/cms/sitePlugins/service.ts
@@ -0,0 +1,292 @@
+/**
+ * Site plugin service layer — the transport-independent half of the site
+ * plugin surface, shared by the HTTP routes (./index.ts) and the AI
+ * `plugin_*` tools (server/ai/tools/plugin/lifecycleTools.ts):
+ *
+ *   - `listSitePlugins`         — union of draft folders and site-local
+ *                                 runtime rows with computed states
+ *   - `runSitePluginActivation` — the Build & activate engine. HTTP-free:
+ *                                 consent (step-up) stays with the HTTP
+ *                                 wrapper; callers that cannot prompt pass
+ *                                 `allowGrantChange: false` and surface the
+ *                                 `grants-changed` result as an instruction
+ *                                 to confirm in the IDE header
+ *   - `republishAndSweep`       — the activation/rollback publish coupling
+ */
+import type { SiteFile } from '@core/files/schemas'
+import type { InstalledPlugin, PluginManifest } from '@core/plugin-sdk'
+import {
+  computeSitePluginContentHash,
+  computeSitePluginState,
+  contentHashOfVersion,
+  deriveSitePluginManifest,
+  discoverSitePlugins,
+  sitePluginIdFromLocalId,
+  type SitePluginSummary,
+} from '@core/site-plugins'
+import { getErrorMessage } from '@core/utils/errorMessage'
+import type { DbClient } from '../../../db/client'
+import type { AuthUser } from '../../../repositories/users'
+import { getDraftSite } from '../../../repositories/site'
+import { getInstalledPlugin, listInstalledPlugins } from '../../../repositories/plugins'
+import { runPublishFlush } from '../../../publish/publishFlush'
+import { republishAllPages } from '../../../publish/republish'
+import { bumpPublishVersionSerialized } from '../../../publish/publishState'
+import { buildSitePlugin } from '../../../plugins/sitePlugins/build'
+import { sweepSitePluginRevisions } from '../../../plugins/sitePlugins/retention'
+import type { CmsHandlerOptions } from '../shared'
+import { activatePluginPackageFromDisk } from '../plugins/install'
+
+// ---------------------------------------------------------------------------
+// Draft access
+// ---------------------------------------------------------------------------
+
+/**
+ * Read the persisted draft's plugin files — flushing the collab relay first
+ * so edits still inside the persist debounce window are included ("flush
+ * the editor's pending save, then read the persisted draft").
+ */
+export async function readDraftPluginFiles(db: DbClient): Promise<SiteFile[]> {
+  await runPublishFlush()
+  const shell = await getDraftSite(db)
+  return shell?.files.filter((file) => file.type === 'plugin') ?? []
+}
+
+export function sameStringSet(a: readonly string[], b: readonly string[]): boolean {
+  if (a.length !== b.length) return false
+  const sortedA = [...a].sort()
+  const sortedB = [...b].sort()
+  return sortedA.every((value, index) => value === sortedB[index])
+}
+
+// ---------------------------------------------------------------------------
+// GET /site-plugins — the list
+// ---------------------------------------------------------------------------
+
+export async function listSitePlugins(db: DbClient): Promise<SitePluginSummary[]> {
+  const draftFiles = await readDraftPluginFiles(db)
+  let discovered: ReturnType<typeof discoverSitePlugins>
+  try {
+    discovered = discoverSitePlugins(draftFiles)
+  } catch (err) {
+    // An invalid local id in the draft must not blank the whole list — the
+    // offending folder simply can't be discovered until renamed.
+    console.error('[site-plugins] draft discovery failed:', err)
+    discovered = []
+  }
+  const draftByLocalId = new Map(discovered.map((plugin) => [plugin.localId, plugin]))
+
+  const rows = (await listInstalledPlugins(db))
+    .flatMap((result) => (result.kind === 'ok' ? [result.plugin] : []))
+    .filter((plugin) => plugin.source === 'site-local')
+  const rowByLocalId = new Map(
+    rows.map((plugin) => [plugin.id.replace(/^site\./, ''), plugin]),
+  )
+
+  // Union — a deleted folder must never hide a still-running backend.
+  const localIds = [...new Set([...draftByLocalId.keys(), ...rowByLocalId.keys()])].sort()
+
+  return localIds.map((localId) => {
+    const draft = draftByLocalId.get(localId) ?? null
+    const row = rowByLocalId.get(localId) ?? null
+
+    let manifest: PluginManifest | null = null
+    let manifestError: string | null = null
+    let draftContentHash: string | null = null
+    if (draft) {
+      draftContentHash = computeSitePluginContentHash(draft.files)
+      if (draft.manifestFile?.content) {
+        try {
+          manifest = deriveSitePluginManifest({
+            localId,
+            draftManifestJson: draft.manifestFile.content,
+            files: draft.files,
+            previousVersion: row?.version ?? null,
+            contentHash: draftContentHash,
+          })
+        } catch (err) {
+          manifestError = getErrorMessage(err, 'Invalid site plugin manifest')
+        }
+      } else {
+        manifestError = `plugins/${localId}/plugin.json is missing`
+      }
+    }
+
+    const declared = manifest?.permissions ?? []
+    const granted = row?.grantedPermissions ?? []
+    const grantsChanged = manifest !== null && row !== null && !sameStringSet(declared, granted)
+
+    const state = computeSitePluginState({
+      hasDraftSource: draft !== null,
+      row: row
+        ? { version: row.version, lifecycleStatus: row.lifecycleStatus, enabled: row.enabled }
+        : null,
+      manifestError,
+      draftContentHash,
+      activeContentHash: contentHashOfVersion(row?.version),
+      grantsChanged,
+    })
+
+    return {
+      localId,
+      pluginId: sitePluginIdFromLocalId(localId),
+      name: manifest?.name ?? row?.name ?? localId,
+      state,
+      activeVersion: row?.version ?? null,
+      hasDraftSource: draft !== null,
+      hasModules: Boolean(manifest?.entrypoints?.modules),
+      declaredPermissions: declared,
+      grantedPermissions: granted,
+      newPermissions: declared.filter((permission) => !granted.includes(permission)),
+      removedPermissions: granted.filter((permission) => !declared.includes(permission)),
+      manifestError,
+      lastError: row?.lastError ?? null,
+    }
+  })
+}
+
+// ---------------------------------------------------------------------------
+// Activation engine — shared by the HTTP route and the AI `plugin_activate`
+// tool. HTTP-free: consent (step-up) stays with the HTTP wrapper; callers
+// that cannot prompt (AI tools, MCP) pass `allowGrantChange: false` and
+// surface the `grants-changed` result as an instruction to confirm in the
+// IDE header.
+// ---------------------------------------------------------------------------
+
+export type SitePluginActivationResult =
+  | { status: 'ok'; plugin: InstalledPlugin; upgrade?: { fromVersion: string; toVersion: string }; skipped: boolean }
+  | { status: 'not-found'; message: string }
+  | { status: 'invalid'; message: string }
+  | { status: 'grants-changed'; newPermissions: string[]; removedPermissions: string[] }
+  | { status: 'build-failed'; diagnostics: string[] }
+  | { status: 'upgrade-error'; message: string }
+
+export async function runSitePluginActivation(input: {
+  db: DbClient
+  options: CmsHandlerOptions
+  user: AuthUser
+  /** Null for non-HTTP callers — audit rows then omit ip/ua. */
+  req: Request | null
+  localId: string
+  /**
+   * Whether a grant-set change may proceed. The HTTP route sets this true
+   * only AFTER a successful step-up; tool callers always pass false.
+   */
+  allowGrantChange: boolean
+}): Promise<SitePluginActivationResult> {
+  const { db, options, user, req, localId, allowGrantChange } = input
+  if (!options.uploadsDir) {
+    return { status: 'invalid', message: 'Uploads directory is not configured' }
+  }
+  const draftFiles = await readDraftPluginFiles(db)
+  const plugin = discoverSitePlugins(draftFiles).find((entry) => entry.localId === localId)
+  if (!plugin) {
+    return { status: 'not-found', message: `No site plugin source at plugins/${localId}/` }
+  }
+  if (!plugin.manifestFile?.content) {
+    return { status: 'invalid', message: `plugins/${localId}/plugin.json is missing` }
+  }
+
+  const rowResult = await getInstalledPlugin(db, sitePluginIdFromLocalId(localId))
+  const row = rowResult?.kind === 'ok' ? rowResult.plugin : null
+  const contentHash = computeSitePluginContentHash(plugin.files)
+
+  // Skip when the active revision already matches the draft source.
+  if (
+    row &&
+    row.lifecycleStatus === 'active' &&
+    contentHashOfVersion(row.version) === contentHash
+  ) {
+    return { status: 'ok', plugin: row, skipped: true }
+  }
+
+  // Derive BEFORE building: the grant diff decides whether this request is
+  // a consent moment — and a manifest error should fail before any
+  // bundling work.
+  let manifest: PluginManifest
+  try {
+    manifest = deriveSitePluginManifest({
+      localId,
+      draftManifestJson: plugin.manifestFile.content,
+      files: plugin.files,
+      previousVersion: row?.version ?? null,
+      contentHash,
+    })
+  } catch (err) {
+    return { status: 'invalid', message: getErrorMessage(err, 'Invalid site plugin manifest') }
+  }
+
+  const granted: readonly string[] = row?.grantedPermissions ?? []
+  const declared: readonly string[] = manifest.permissions
+  const grantsChanged = !row || !sameStringSet(granted, declared)
+  if (grantsChanged && !allowGrantChange) {
+    return {
+      status: 'grants-changed',
+      newPermissions: declared.filter((p) => !granted.includes(p)),
+      removedPermissions: granted.filter((p) => !declared.includes(p)),
+    }
+  }
+
+  const built = await buildSitePlugin({
+    localId,
+    files: plugin.files,
+    previousVersion: row?.version ?? null,
+    uploadsDir: options.uploadsDir,
+    validateOnly: false,
+  })
+  if (!built.ok) {
+    return { status: 'build-failed', diagnostics: built.diagnostics }
+  }
+
+  // Grants = declared, in both directions: activation grants exactly what
+  // the draft declares, and dropping a permission shrinks the grant.
+  const outcome = await activatePluginPackageFromDisk({
+    db,
+    options,
+    user,
+    req,
+    manifest: built.manifest,
+    grantedPermissions: built.manifest.permissions,
+    source: 'site-local',
+  })
+  if (outcome.upgradeError) {
+    return { status: 'upgrade-error', message: outcome.upgradeError }
+  }
+
+  await republishAndSweep(db, options.uploadsDir, built.manifest)
+
+  return {
+    status: 'ok',
+    plugin: outcome.plugin,
+    ...(outcome.upgrade ? { upgrade: outcome.upgrade } : {}),
+    skipped: false,
+  }
+}
+
+/**
+ * Publish coupling (design → "Revision/publish coupling — defined"): baked
+ * Layer-A HTML embeds versioned asset URLs, so when the plugin has
+ * visitor-facing surfaces the host republishes BEFORE any old revision is
+ * garbage-collected — published pages must never reference a deleted
+ * revision. Backend-only plugins skip the republish and sweep immediately.
+ */
+export async function republishAndSweep(
+  db: DbClient,
+  uploadsDir: string,
+  manifest: PluginManifest,
+): Promise<void> {
+  const visitorFacing =
+    (manifest.frontend?.assets.length ?? 0) > 0 || Boolean(manifest.entrypoints?.modules)
+  if (visitorFacing) {
+    try {
+      await republishAllPages(db, uploadsDir)
+      await bumpPublishVersionSerialized()
+    } catch (err) {
+      // A failed republish must not fail the activation — but it must also
+      // not trigger the sweep (old revision stays referenced).
+      console.error(`[site-plugins] post-activation republish failed for ${manifest.id}:`, err)
+      return
+    }
+  }
+  await sweepSitePluginRevisions(uploadsDir, manifest.id, manifest.version)
+}
diff --git a/src/__tests__/architecture/cms-handlers-capability-gated.test.ts b/src/__tests__/architecture/cms-handlers-capability-gated.test.ts
index 91c88f2d8..311c691fd 100644
--- a/src/__tests__/architecture/cms-handlers-capability-gated.test.ts
+++ b/src/__tests__/architecture/cms-handlers-capability-gated.test.ts
@@ -50,6 +50,11 @@ const ALLOWLIST: ReadonlyMap<string, string> = new Map([
   // Shared utilities — body parsers, audit context helpers, schema
   // exports. No request handlers live here.
   ['shared.ts', 'Shared request helpers; no handlers.'],
+  // Site-plugin service layer — list projection + activation engine shared
+  // by the HTTP routes (sitePlugins/index.ts, which gates every route) and
+  // the AI plugin tools (capability-gated at tool selection + execution).
+  // No request handlers live here.
+  ['sitePlugins/service.ts', 'Transport-independent service layer; sitePlugins/index.ts and the AI tool gates own auth.'],
   ['session.ts', 'Session lookup helper; called from auth.ts which gates.'],
   // Media upload helpers — `acceptUploadedMedia`, `readUploadForm`,
   // file-magic sniffing. Always called by an already-gated parent
diff --git a/src/__tests__/architecture/site-plugin-invariants.test.ts b/src/__tests__/architecture/site-plugin-invariants.test.ts
index 469f1209e..2a0056b53 100644
--- a/src/__tests__/architecture/site-plugin-invariants.test.ts
+++ b/src/__tests__/architecture/site-plugin-invariants.test.ts
@@ -18,7 +18,7 @@ describe('site plugin invariants', () => {
     const allowed = [
       /server\/repositories\/plugins\.ts$/,
       /server\/plugins\/sitePlugins\//,
-      /server\/handlers\/cms\/sitePlugins\.ts$/,
+      /server\/handlers\/cms\/sitePlugins\//,
       /server\/handlers\/cms\/plugins\/install\.ts$/,
       /server\/db\/migrations-(pg|sqlite)\.ts$/, // the source-column migration comment/default
       /src\/core\/plugin-sdk\/types\/installedPlugin\.ts$/,
@@ -62,11 +62,17 @@ describe('site plugin invariants', () => {
   })
 
   test('activation authority stays with plugins.install + conditional step-up', async () => {
-    const text = await Bun.file('server/handlers/cms/sitePlugins.ts').text()
+    const routes = await Bun.file('server/handlers/cms/sitePlugins/index.ts').text()
     // Activate + rollback gate on plugins.install…
-    expect(text.match(/requireCapability\(req, db, 'plugins\.install'\)/g)?.length).toBeGreaterThanOrEqual(2)
-    // …and step-up runs behind the grant-diff, not unconditionally.
-    expect(text).toContain('grantsChanged')
-    expect(text).toContain('requireStepUp')
+    expect(routes.match(/requireCapability\(req, db, 'plugins\.install'\)/g)?.length).toBeGreaterThanOrEqual(2)
+    // …and step-up runs behind the grant-diff (the engine reports
+    // grants-changed; only the HTTP wrapper may step up and re-run).
+    expect(routes).toContain("result.status === 'grants-changed'")
+    expect(routes).toContain('requireStepUp')
+    const service = await Bun.file('server/handlers/cms/sitePlugins/service.ts').text()
+    expect(service).toContain('grantsChanged')
+    // The engine itself must never import interactive auth — consent stays
+    // with the HTTP wrapper.
+    expect(service.includes('requireStepUp')).toBe(false)
   })
 })
diff --git a/src/__tests__/server/cmsMigrations.test.ts b/src/__tests__/server/cmsMigrations.test.ts
index bc8b7fe3f..cf796d82a 100644
--- a/src/__tests__/server/cmsMigrations.test.ts
+++ b/src/__tests__/server/cmsMigrations.test.ts
@@ -62,13 +62,25 @@ describe('CMS migrations', () => {
   it('seeds the expected system roles in both dialects', () => {
     const pgSql = pgMigrations.map((m) => m.sql).join('\n')
     const sqliteSql = sqliteMigrations.map((m) => m.sql).join('\n')
+    // The migration seed is the INITIAL snapshot only — Owner/Admin are
+    // force-resynced from SYSTEM_ROLES on every boot (syncSystemRoles), so a
+    // capability added after the seed migration deliberately never appears
+    // in migration SQL (committed migrations are immutable). The gate here
+    // is: every role slug is seeded, and every capability the seed DOES
+    // grant is still a real capability (no orphaned strings surviving a
+    // rename).
+    const seededCapabilities = new Set(
+      [...`${pgSql}\n${sqliteSql}`.matchAll(/"([a-z]+(?:\.[a-zA-Z]+)+)"/g)]
+        .map((match) => match[1]!)
+        .filter((value) => /^(dashboard|site|pages|content|media|runtime|storage|plugins|users|roles|audit|data|ai)\./.test(value)),
+    )
+    const known = new Set<string>(SYSTEM_ROLES.flatMap((role) => role.capabilities))
+    for (const seeded of seededCapabilities) {
+      expect(known.has(seeded), `migration seeds unknown capability "${seeded}"`).toBe(true)
+    }
     for (const role of SYSTEM_ROLES) {
       expect(pgSql).toContain(`'${role.slug}'`)
       expect(sqliteSql).toContain(`'${role.slug}'`)
-      for (const capability of role.capabilities) {
-        expect(pgSql).toContain(capability)
-        expect(sqliteSql).toContain(capability)
-      }
     }
   })
 
diff --git a/src/admin/ai/useMcpWorkspaceBridge.ts b/src/admin/ai/useMcpWorkspaceBridge.ts
index 7245225f4..1b34fe8ba 100644
--- a/src/admin/ai/useMcpWorkspaceBridge.ts
+++ b/src/admin/ai/useMcpWorkspaceBridge.ts
@@ -35,7 +35,7 @@ const BridgeEventSchema = Type.Union([
   }),
 ])
 
-export type McpWorkspaceScope = 'site' | 'content'
+export type McpWorkspaceScope = 'site' | 'content' | 'plugin'
 export type McpToolDispatcher = (
   toolName: string,
   input: unknown,
diff --git a/src/admin/pages/plugins/ide/IdeSidebar.tsx b/src/admin/pages/plugins/ide/IdeSidebar.tsx
index 821b47557..d49c84cbb 100644
--- a/src/admin/pages/plugins/ide/IdeSidebar.tsx
+++ b/src/admin/pages/plugins/ide/IdeSidebar.tsx
@@ -2,44 +2,54 @@
  * IdeSidebar — the IDE's left sidebar, mirroring the Content workspace's
  * sidebar exactly: the shared left-sidebar chrome (42px icon rail +
  * absolutely-positioned panel slot + resize handle + persisted width), with
- * a single Files rail button that toggles the file tree panel.
+ * a Files rail button for the file tree and — when the user holds ai.chat —
+ * an AI assistant button in the rail's global group, one panel at a time.
  */
 import { useRef, type CSSProperties, type ReactNode } from 'react'
 import { Button } from '@ui/components/Button'
+import type { IconComponent } from 'pixel-art-icons/types'
 import { FileTextSolidIcon } from 'pixel-art-icons/icons/file-text-solid'
+import { AiSettingsSolidIcon } from 'pixel-art-icons/icons/ai-settings-solid'
 import { railAccent, railTintVar } from '@ui/railAccent'
 import { useWorkspaceLayout } from '@admin/state/workspaceLayout'
 import { SidebarResizeHandle } from '@admin/shared/SidebarResizeHandle'
 import leftSidebarStyles from '@site/sidebars/LeftSidebar/LeftSidebar.module.css'
 import panelRailStyles from '@site/sidebars/PanelRail/PanelRail.module.css'
 
+export type IdePanelId = 'files' | 'agent'
+
 interface IdeSidebarProps {
-  children: ReactNode
-  panelOpen: boolean
-  onPanelOpenChange: (open: boolean) => void
+  activePanel: IdePanelId | null
+  onActivePanelChange: (panel: IdePanelId | null) => void
+  filesPanel: ReactNode
+  /** AI assistant panel — same docked variant Content/Site use. */
+  agentPanel: ReactNode
+  canUseAiChat: boolean
 }
 
-export function IdeSidebar({ children, panelOpen, onPanelOpenChange }: IdeSidebarProps) {
+export function IdeSidebar({
+  activePanel,
+  onActivePanelChange,
+  filesPanel,
+  agentPanel,
+  canUseAiChat,
+}: IdeSidebarProps) {
   const sidebarRef = useRef<HTMLElement | null>(null)
   const leftSidebarWidth = useWorkspaceLayout((s) => s.leftSidebarWidth)
   const setLeftSidebarWidth = useWorkspaceLayout((s) => s.setLeftSidebarWidth)
-  const panelWidth = panelOpen ? leftSidebarWidth : 0
+  const panelWidth = activePanel ? leftSidebarWidth : 0
   const style = {
     '--left-sidebar-panel-width': `${panelWidth}px`,
     '--left-sidebar-panel-layout-width': `${leftSidebarWidth}px`,
   } as CSSProperties
-  const accent = railAccent('pluginIde:files:Files')
-  const railButtonStyle = {
-    '--rail-icon-tint': railTintVar(accent),
-  } as CSSProperties
 
   return (
     <aside
       ref={sidebarRef}
       className={leftSidebarStyles.sidebar}
       data-testid="ide-left-sidebar"
-      data-expanded={panelOpen ? 'true' : 'false'}
-      data-active-panel={panelOpen ? 'files' : 'none'}
+      data-expanded={activePanel ? 'true' : 'false'}
+      data-active-panel={activePanel ?? 'none'}
       style={style}
     >
       <nav
@@ -49,46 +59,93 @@ export function IdeSidebar({ children, panelOpen, onPanelOpenChange }: IdeSideba
       >
         <div className={panelRailStyles.primaryStack}>
           <div className={panelRailStyles.itemGroup}>
-            <Button
-              variant="ghost"
-              size="md"
-              iconOnly
-              pressed={panelOpen}
-              aria-label={`${panelOpen ? 'Close' : 'Open'} Files panel`}
-              tooltip="Files panel"
-              data-testid="ide-rail-files"
-              data-icon="file-text-solid"
-              data-accent={accent}
-              style={railButtonStyle}
-              onClick={() => onPanelOpenChange(!panelOpen)}
-              className={panelRailStyles.railButton}
-            >
-              <span className={panelRailStyles.activeIndicator} aria-hidden="true" />
-              <FileTextSolidIcon size={16} className={panelRailStyles.railIcon} />
-            </Button>
+            <IdeRailButton
+              id="files"
+              label="Files"
+              icon={FileTextSolidIcon}
+              iconName="file-text-solid"
+              active={activePanel === 'files'}
+              onToggle={() => onActivePanelChange(activePanel === 'files' ? null : 'files')}
+            />
           </div>
         </div>
+        {canUseAiChat && (
+          <div className={panelRailStyles.globalGroup} data-testid="ide-panel-rail-global">
+            <IdeRailButton
+              id="agent"
+              label="AI assistant"
+              icon={AiSettingsSolidIcon}
+              iconName="ai-settings-solid"
+              active={activePanel === 'agent'}
+              onToggle={() => onActivePanelChange(activePanel === 'agent' ? null : 'agent')}
+            />
+          </div>
+        )}
       </nav>
 
       <div
         className={leftSidebarStyles.panelSlot}
         data-testid="ide-left-sidebar-panel-slot"
-        inert={panelOpen ? undefined : true}
+        inert={activePanel ? undefined : true}
       >
-        <div className={leftSidebarStyles.panelMount}>{children}</div>
+        <div className={leftSidebarStyles.panelMount}>
+          {activePanel === 'files'
+            ? filesPanel
+            : activePanel === 'agent' && canUseAiChat
+              ? agentPanel
+              : null}
+        </div>
       </div>
 
-      {panelOpen && (
+      {activePanel && (
         <SidebarResizeHandle
           side="left"
           width={leftSidebarWidth}
           targetRef={sidebarRef}
           cssVariable="--left-sidebar-panel-width"
           layoutCssVariable="--left-sidebar-panel-layout-width"
-          ariaLabel="Resize file tree"
+          ariaLabel="Resize IDE sidebar"
           onResize={setLeftSidebarWidth}
         />
       )}
     </aside>
   )
 }
+
+interface IdeRailButtonProps {
+  id: IdePanelId
+  label: string
+  icon: IconComponent
+  iconName: string
+  active: boolean
+  onToggle: () => void
+}
+
+function IdeRailButton({ id, label, icon, iconName, active, onToggle }: IdeRailButtonProps) {
+  const RailIcon = icon
+  const action = active ? 'Close' : 'Open'
+  const accent = railAccent(`pluginIde:${id}:${label}`)
+  const style = {
+    '--rail-icon-tint': railTintVar(accent),
+  } as CSSProperties
+
+  return (
+    <Button
+      variant="ghost"
+      size="md"
+      iconOnly
+      pressed={active}
+      aria-label={`${action} ${label} panel`}
+      tooltip={`${label} panel`}
+      data-testid={`ide-rail-${id}`}
+      data-icon={iconName}
+      data-accent={accent}
+      style={style}
+      onClick={onToggle}
+      className={panelRailStyles.railButton}
+    >
+      <span className={panelRailStyles.activeIndicator} aria-hidden="true" />
+      <RailIcon size={16} className={panelRailStyles.railIcon} />
+    </Button>
+  )
+}
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
index 805188a69..597e3ad69 100644
--- a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
@@ -16,7 +16,7 @@ import { useEffect, useState } from 'react'
 import { AdminWorkspaceCanvasLayout } from '@admin/layouts/AdminWorkspaceCanvasLayout/AdminWorkspaceCanvasLayout'
 import { useNavigate, useParams } from '@admin/lib/routing'
 import { useAuthenticatedAdminUser } from '@admin/sessionContext'
-import { canEditPlugins, canInstallPlugins } from '@admin/access'
+import { canEditPlugins, canInstallPlugins, canUseAiChat } from '@admin/access'
 import { ConfirmDeleteDialog } from '@admin/shared/dialogs/ConfirmDeleteDialog/ConfirmDeleteDialog'
 import { SITE_PLUGIN_LOCAL_ID_PATTERN, sitePluginFolder } from '@core/site-plugins'
 import { useSitePluginIde } from './useSitePluginIde'
@@ -26,7 +26,9 @@ import { SitePluginPermissionReviewDialog } from './SitePluginPermissionReviewDi
 import { IdeFileEditor } from './IdeFileEditor'
 import { DiagnosticsStrip } from './DiagnosticsStrip'
 import { IdeActions } from './IdeActions'
-import { IdeSidebar } from './IdeSidebar'
+import { IdeSidebar, type IdePanelId } from './IdeSidebar'
+import { PluginIdeAgentMount } from './agent/PluginIdeAgentMount'
+import { usePluginIdeToolBridge } from './agent/usePluginIdeToolBridge'
 import styles from './SitePluginIdePage.module.css'
 
 export function SitePluginIdePage() {
@@ -63,9 +65,10 @@ function SitePluginIde({ localId }: { localId: string }) {
   const navigate = useNavigate()
   const canEdit = canEditPlugins(currentUser)
   const canInstall = canInstallPlugins(currentUser)
+  const canChat = canUseAiChat(currentUser)
   const [pendingDelete, setPendingDelete] = useState<PendingDelete | null>(null)
   const [reviewOpen, setReviewOpen] = useState(false)
-  const [filesPanelOpen, setFilesPanelOpen] = useState(true)
+  const [activePanel, setActivePanel] = useState<IdePanelId | null>('files')
 
   const vm = useSitePluginIde(localId)
   const { session, files, activeFileId, selectFile, runValidation } = vm
@@ -81,6 +84,25 @@ function SitePluginIde({ localId }: { localId: string }) {
     activeFile ? { fileId: activeFile.id, path: activeFile.path } : null,
   )
 
+  // Agent + MCP tool surface — registered for the whole page mount so an
+  // external MCP client reaches the open IDE even with the AI panel closed.
+  usePluginIdeToolBridge({
+    localId,
+    folder,
+    session,
+    files,
+    activeFile: activeFile ? { id: activeFile.id, path: activeFile.path } : null,
+    summary: vm.summary,
+    diagnostics: vm.diagnostics,
+    selectFile,
+    canEdit,
+    currentUser: {
+      id: currentUser?.id ?? '',
+      displayName: currentUser?.displayName ?? '',
+      email: currentUser?.email ?? '',
+    },
+  })
+
   // Auto-select plugin.json (or the first file) once files arrive.
   useEffect(() => {
     if (activeFileId && files.some((file) => file.id === activeFileId)) return
@@ -105,37 +127,43 @@ function SitePluginIde({ localId }: { localId: string }) {
     <AdminWorkspaceCanvasLayout
       workspace="pluginIde"
       contentSidebar={(
-        <IdeSidebar panelOpen={filesPanelOpen} onPanelOpenChange={setFilesPanelOpen}>
-          <FileTreePane
-            onClose={() => setFilesPanelOpen(false)}
-            localId={localId}
-            files={files}
-            activeFileId={activeFileId}
-            peers={peers}
-            canEdit={canEdit}
-            onSelect={selectFile}
-            onCreate={(relativePath) => {
-              if (!session) return
-              const id = session.createFile(`${folder}${relativePath}`)
-              selectFile(id)
-            }}
-            onRename={(fileId, relativePath) => {
-              session?.renameFile(fileId, `${folder}${relativePath}`)
-            }}
-            onDelete={(fileId) => {
-              const file = files.find((entry) => entry.id === fileId)
-              setPendingDelete({
-                title: `Delete ${file?.path.slice(folder.length) ?? 'this file'}?`,
-                description: 'The file is removed from the live draft for every editor.',
-                confirmLabel: 'Delete file',
-                commit: () => {
-                  session?.deleteFile(fileId)
-                  if (activeFileId === fileId) selectFile(null)
-                },
-              })
-            }}
-          />
-        </IdeSidebar>
+        <IdeSidebar
+          activePanel={activePanel}
+          onActivePanelChange={setActivePanel}
+          canUseAiChat={canChat}
+          agentPanel={<PluginIdeAgentMount isVisible={activePanel === 'agent'} />}
+          filesPanel={(
+            <FileTreePane
+              onClose={() => setActivePanel(null)}
+              localId={localId}
+              files={files}
+              activeFileId={activeFileId}
+              peers={peers}
+              canEdit={canEdit}
+              onSelect={selectFile}
+              onCreate={(relativePath) => {
+                if (!session) return
+                const id = session.createFile(`${folder}${relativePath}`)
+                selectFile(id)
+              }}
+              onRename={(fileId, relativePath) => {
+                session?.renameFile(fileId, `${folder}${relativePath}`)
+              }}
+              onDelete={(fileId) => {
+                const file = files.find((entry) => entry.id === fileId)
+                setPendingDelete({
+                  title: `Delete ${file?.path.slice(folder.length) ?? 'this file'}?`,
+                  description: 'The file is removed from the live draft for every editor.',
+                  confirmLabel: 'Delete file',
+                  commit: () => {
+                    session?.deleteFile(fileId)
+                    if (activeFileId === fileId) selectFile(null)
+                  },
+                })
+              }}
+            />
+          )}
+        />
       )}
       contentCanvas={(
         <div className={styles.editorColumn} data-testid="ide-editor-column">
diff --git a/src/admin/pages/plugins/ide/agent/PluginIdeAgentMount.tsx b/src/admin/pages/plugins/ide/agent/PluginIdeAgentMount.tsx
new file mode 100644
index 000000000..210bd4e4c
--- /dev/null
+++ b/src/admin/pages/plugins/ide/agent/PluginIdeAgentMount.tsx
@@ -0,0 +1,24 @@
+/** The docked Plugin IDE agent UI. Tool registration lives at page level. */
+import { useEffect, useState } from 'react'
+import { AgentStoreProvider } from '@admin/ai/AgentStoreContext'
+import { AgentPanel } from '@site/panels/AgentPanel'
+import { createPluginAgentStore } from './pluginAgentStore'
+
+interface PluginIdeAgentMountProps {
+  isVisible: boolean
+}
+
+export function PluginIdeAgentMount({ isVisible }: PluginIdeAgentMountProps) {
+  const [store] = useState(() => createPluginAgentStore())
+
+  useEffect(() => {
+    if (isVisible) store.getState().openAgent()
+    else store.getState().closeAgent()
+  }, [isVisible, store])
+
+  return (
+    <AgentStoreProvider store={store}>
+      <AgentPanel variant="docked" />
+    </AgentStoreProvider>
+  )
+}
diff --git a/src/admin/pages/plugins/ide/agent/agentSliceConfig.plugin.ts b/src/admin/pages/plugins/ide/agent/agentSliceConfig.plugin.ts
new file mode 100644
index 000000000..14c4983ae
--- /dev/null
+++ b/src/admin/pages/plugins/ide/agent/agentSliceConfig.plugin.ts
@@ -0,0 +1,26 @@
+/**
+ * Plugin-IDE agent-slice config — supplied to `createAgentSlice` when the
+ * IDE's standalone Zustand store is composed.
+ *
+ * Mirrors `agentSliceConfig.content.ts`:
+ *   - declares `scope: 'plugin'` for URL + JSON wiring,
+ *   - snapshots the live IDE (open plugin, files, runtime state) via the
+ *     registered PluginIdeBridgeHandle,
+ *   - dispatches browser tools through `executePluginTool`,
+ *   - points the no-provider error at the "plugin" scope default.
+ */
+import type { AgentSliceConfig } from '@site/agent'
+import { executePluginTool } from './pluginBridge'
+import {
+  emptyPluginIdeAgentSnapshot,
+  getPluginIdeBridgeHandle,
+} from './pluginBridgeHandle'
+
+export const pluginAgentSliceConfig: AgentSliceConfig = {
+  scope: 'plugin',
+  buildSnapshot: () =>
+    getPluginIdeBridgeHandle()?.buildSnapshot() ?? emptyPluginIdeAgentSnapshot(),
+  dispatchTool: executePluginTool,
+  noProviderMessage:
+    'No AI provider configured for the Plugin IDE. Open /admin/ai/providers to add a credential, then /admin/ai/defaults to pick one for the "plugin" scope.',
+}
diff --git a/src/admin/pages/plugins/ide/agent/pluginAgentStore.ts b/src/admin/pages/plugins/ide/agent/pluginAgentStore.ts
new file mode 100644
index 000000000..b04ffd189
--- /dev/null
+++ b/src/admin/pages/plugins/ide/agent/pluginAgentStore.ts
@@ -0,0 +1,33 @@
+/**
+ * Plugin-IDE agent store — a small standalone Zustand instance holding ONLY
+ * the AgentSlice, composed per PluginIdeAgentMount. Same shape and
+ * rationale as the content workspace's `contentAgentStore.ts`: the IDE is
+ * hook-based (no parent Zustand store), and a per-mount instance keeps
+ * stale closures from surviving navigation.
+ *
+ * The `as unknown as ...` cast bridges the slice's site-editor-shaped
+ * return type into our slice-only store — the slice only touches AgentSlice
+ * keys at runtime (see contentAgentStore.ts for the full justification).
+ */
+import { create, type StateCreator } from 'zustand'
+import { mutative } from 'zustand-mutative'
+import { subscribeWithSelector } from 'zustand/middleware'
+import { createAgentSlice, type AgentSlice } from '@site/agent'
+import { pluginAgentSliceConfig } from './agentSliceConfig.plugin'
+
+type PluginAgentStore = AgentSlice
+
+export function createPluginAgentStore() {
+  const sliceCreator = createAgentSlice(pluginAgentSliceConfig) as unknown as
+    StateCreator<AgentSlice, [['zustand/mutative', never]], [], AgentSlice>
+  return create<PluginAgentStore>()(
+    subscribeWithSelector(
+      mutative(
+        (...args) => ({
+          ...sliceCreator(...args),
+        }),
+        { enableAutoFreeze: true },
+      ),
+    ),
+  )
+}
diff --git a/src/admin/pages/plugins/ide/agent/pluginBridge.ts b/src/admin/pages/plugins/ide/agent/pluginBridge.ts
new file mode 100644
index 000000000..1f9c684f5
--- /dev/null
+++ b/src/admin/pages/plugins/ide/agent/pluginBridge.ts
@@ -0,0 +1,353 @@
+/**
+ * Plugin-scope browser bridge — turns a server-issued `toolRequest` into an
+ * operation against the live Plugin IDE via the registered
+ * `PluginIdeBridgeHandle`.
+ *
+ * Both the chat panel and the workspace-scoped MCP relay call
+ * `executePluginTool(name, input)`; each result is posted back through the
+ * shared tool-result endpoint.
+ *
+ * Per-tool inputs are re-validated against the SAME TypeBox schemas the
+ * server advertises (`@core/ai`) — defence in depth at the browser
+ * boundary. File mutations go through the IdeCollabSession, so agent edits
+ * are CRDT transactions that merge character-level with concurrent human
+ * typing, ride the relay's persistence, and appear to co-editors live.
+ *
+ * Tool paths are RELATIVE to the plugin folder; this module joins them
+ * against `plugins/<localId>/` and rejects anything that escapes it.
+ *
+ * Mirrors `contentBridge.ts` / the site executor — same canonical
+ * `AiToolOutput` return type.
+ */
+import {
+  aiToolError,
+  aiToolOk,
+  PluginDeleteFileInputSchema,
+  PluginListFilesInputSchema,
+  PluginOpenFileInputSchema,
+  PluginPatchFileInputSchema,
+  PluginReadFileInputSchema,
+  PluginRenameFileInputSchema,
+  PluginWriteFileInputSchema,
+  type AiToolOutput,
+} from '@core/ai'
+import { isSafePath, normalizePath } from '@core/files/pathValidation'
+import { sitePluginFolder } from '@core/site-plugins'
+import { getErrorMessage } from '@core/utils/errorMessage'
+import { parseValue, type TSchema, type Static } from '@core/utils/typeboxHelpers'
+import type { IdeCollabSession, IdeFileMeta } from '../ideCollab'
+import {
+  getPluginIdeBridgeHandle,
+  type PluginIdeBridgeHandle,
+} from './pluginBridgeHandle'
+
+const DEFAULT_READ_MAX_CHARS = 12000
+const textEncoder = new TextEncoder()
+
+async function hashContent(content: string): Promise<string> {
+  const digest = await crypto.subtle.digest('SHA-256', textEncoder.encode(content))
+  return Array.from(new Uint8Array(digest))
+    .map((byte) => byte.toString(16).padStart(2, '0'))
+    .join('')
+}
+
+interface BridgeCtx {
+  handle: PluginIdeBridgeHandle
+  session: IdeCollabSession
+  folder: string
+}
+
+function requireCtx(): BridgeCtx | AiToolOutput {
+  const handle = getPluginIdeBridgeHandle()
+  if (!handle) {
+    return aiToolError('The Plugin IDE is not open — open /admin/plugins/develop/<id> first.')
+  }
+  const session = handle.session()
+  if (!session) {
+    return aiToolError('The Plugin IDE session is still connecting — retry in a moment.')
+  }
+  return { handle, session, folder: sitePluginFolder(handle.localId) }
+}
+
+function isBridgeCtx(value: BridgeCtx | AiToolOutput): value is BridgeCtx {
+  return !('ok' in value)
+}
+
+/** Join a model-supplied relative path onto the plugin folder, safely. */
+function resolveRelativePath(ctx: BridgeCtx, relative: string): string | null {
+  const normalized = normalizePath(relative)
+  if (!normalized || normalized.startsWith('/') || normalized.split('/').includes('..')) {
+    return null
+  }
+  const full = `${ctx.folder}${normalized}`
+  if (!isSafePath(full) || !full.startsWith(ctx.folder)) return null
+  return full
+}
+
+function relativePathOf(ctx: BridgeCtx, file: IdeFileMeta): string {
+  return file.path.slice(ctx.folder.length)
+}
+
+function resolveFile(
+  ctx: BridgeCtx,
+  ref: { fileId?: string; path?: string },
+): { ok: true; file: IdeFileMeta } | { ok: false; error: string } {
+  if (!ref.fileId && !ref.path) {
+    return { ok: false, error: 'Pass either fileId or path to identify the file.' }
+  }
+  const files = ctx.handle.files()
+
+  let file: IdeFileMeta | undefined
+  if (ref.fileId) {
+    file = files.find((candidate) => candidate.id === ref.fileId)
+    if (!file) return { ok: false, error: `File not found: ${ref.fileId}` }
+  }
+  if (ref.path) {
+    const full = resolveRelativePath(ctx, ref.path)
+    if (!full) return { ok: false, error: `Invalid plugin file path: ${ref.path}` }
+    const pathFile = files.find((candidate) => candidate.path === full)
+    if (!pathFile) return { ok: false, error: `File not found: ${ref.path}` }
+    if (file && pathFile.id !== file.id) {
+      return { ok: false, error: `fileId ${file.id} does not match path ${ref.path}.` }
+    }
+    file = pathFile
+  }
+  return { ok: true, file: file! }
+}
+
+function contentOf(ctx: BridgeCtx, fileId: string): string {
+  return ctx.session.contentText(fileId)?.toString() ?? ''
+}
+
+async function describeFile(ctx: BridgeCtx, file: IdeFileMeta) {
+  const content = contentOf(ctx, file.id)
+  return {
+    fileId: file.id,
+    path: relativePathOf(ctx, file),
+    contentChars: content.length,
+    bytes: textEncoder.encode(content).byteLength,
+    hash: await hashContent(content),
+    updatedAt: file.updatedAt,
+  }
+}
+
+function isManifestFile(ctx: BridgeCtx, file: IdeFileMeta): boolean {
+  return file.path === `${ctx.folder}plugin.json`
+}
+
+function countOccurrences(content: string, search: string): number {
+  let count = 0
+  let index = content.indexOf(search)
+  while (index !== -1) {
+    count++
+    index = content.indexOf(search, index + search.length)
+  }
+  return count
+}
+
+// ---------------------------------------------------------------------------
+// Per-tool runners
+// ---------------------------------------------------------------------------
+
+async function runListFiles(ctx: BridgeCtx): Promise<AiToolOutput> {
+  const files = await Promise.all(ctx.handle.files().map((file) => describeFile(ctx, file)))
+  return aiToolOk({ files })
+}
+
+async function runReadFile(
+  ctx: BridgeCtx,
+  input: Static<typeof PluginReadFileInputSchema>,
+): Promise<AiToolOutput> {
+  const resolved = resolveFile(ctx, input)
+  if (!resolved.ok) return aiToolError(resolved.error)
+
+  const content = contentOf(ctx, resolved.file.id)
+  const maxChars = input.maxChars ?? DEFAULT_READ_MAX_CHARS
+  const totalParts = Math.max(1, Math.ceil(content.length / maxChars))
+  const part = input.part ?? 1
+  if (part > totalParts) {
+    return aiToolError(`File part ${part} is out of range; totalParts is ${totalParts}.`)
+  }
+  const start = (part - 1) * maxChars
+  const end = Math.min(content.length, start + maxChars)
+  return aiToolOk({
+    fileId: resolved.file.id,
+    path: relativePathOf(ctx, resolved.file),
+    content: content.slice(start, end),
+    hash: await hashContent(content),
+    pageInfo: {
+      part,
+      totalParts,
+      nextPart: part < totalParts ? part + 1 : null,
+      maxChars,
+      start,
+      end,
+      totalChars: content.length,
+    },
+  })
+}
+
+async function runWriteFile(
+  ctx: BridgeCtx,
+  input: Static<typeof PluginWriteFileInputSchema>,
+): Promise<AiToolOutput> {
+  const full = resolveRelativePath(ctx, input.path)
+  if (!full) return aiToolError(`Invalid plugin file path: ${input.path}`)
+
+  const existing = ctx.handle.files().find((file) => file.path === full)
+  if (existing) {
+    ctx.session.replaceFileContent(existing.id, input.content)
+    return aiToolOk({ ...(await describeFile(ctx, existing)), created: false })
+  }
+
+  let fileId: string
+  try {
+    fileId = ctx.session.createFile(full, input.content)
+  } catch (err) {
+    return aiToolError(getErrorMessage(err, `Could not create ${input.path}`))
+  }
+  const created = ctx.handle.files().find((file) => file.id === fileId)
+  if (!created) return aiToolError(`Create failed for ${input.path}`)
+  return aiToolOk({ ...(await describeFile(ctx, created)), created: true })
+}
+
+async function runPatchFile(
+  ctx: BridgeCtx,
+  input: Static<typeof PluginPatchFileInputSchema>,
+): Promise<AiToolOutput> {
+  const resolved = resolveFile(ctx, input)
+  if (!resolved.ok) return aiToolError(resolved.error)
+
+  const currentContent = contentOf(ctx, resolved.file.id)
+  const currentHash = await hashContent(currentContent)
+  if (currentHash !== input.expectedHash) {
+    return aiToolError(
+      `Hash mismatch for ${relativePathOf(ctx, resolved.file)} — the file changed since you read it. Call plugin_read_file again before patching.`,
+    )
+  }
+
+  let nextContent = currentContent
+  let replacementCount = 0
+  for (const replacement of input.replacements) {
+    const matches = countOccurrences(nextContent, replacement.oldText)
+    if (matches === 0) {
+      return aiToolError(`Replacement text not found in ${relativePathOf(ctx, resolved.file)}.`)
+    }
+    if (matches > 1 && replacement.replaceAll !== true) {
+      return aiToolError(
+        `Replacement in ${relativePathOf(ctx, resolved.file)} is ambiguous: ${matches} matches. ` +
+          'Use a larger oldText span or set replaceAll:true.',
+      )
+    }
+    if (replacement.replaceAll === true) {
+      nextContent = nextContent.split(replacement.oldText).join(replacement.newText)
+      replacementCount += matches
+    } else {
+      nextContent = nextContent.replace(replacement.oldText, replacement.newText)
+      replacementCount += 1
+    }
+  }
+
+  ctx.session.replaceFileContent(resolved.file.id, nextContent)
+  return aiToolOk({
+    ...(await describeFile(ctx, resolved.file)),
+    replacements: replacementCount,
+  })
+}
+
+async function runRenameFile(
+  ctx: BridgeCtx,
+  input: Static<typeof PluginRenameFileInputSchema>,
+): Promise<AiToolOutput> {
+  const resolved = resolveFile(ctx, input)
+  if (!resolved.ok) return aiToolError(resolved.error)
+  if (isManifestFile(ctx, resolved.file)) {
+    return aiToolError('plugin.json cannot be renamed — the build requires the manifest at the plugin root.')
+  }
+  const full = resolveRelativePath(ctx, input.newPath)
+  if (!full) return aiToolError(`Invalid plugin file path: ${input.newPath}`)
+  try {
+    ctx.session.renameFile(resolved.file.id, full)
+  } catch (err) {
+    return aiToolError(getErrorMessage(err, `Could not rename to ${input.newPath}`))
+  }
+  return aiToolOk({ fileId: resolved.file.id, path: input.newPath })
+}
+
+function runDeleteFile(
+  ctx: BridgeCtx,
+  input: Static<typeof PluginDeleteFileInputSchema>,
+): AiToolOutput {
+  const resolved = resolveFile(ctx, input)
+  if (!resolved.ok) return aiToolError(resolved.error)
+  if (isManifestFile(ctx, resolved.file)) {
+    return aiToolError('plugin.json cannot be deleted — every plugin needs its manifest.')
+  }
+  ctx.session.deleteFile(resolved.file.id)
+  return aiToolOk({ deleted: true, fileId: resolved.file.id })
+}
+
+function runOpenFile(
+  ctx: BridgeCtx,
+  input: Static<typeof PluginOpenFileInputSchema>,
+): AiToolOutput {
+  const resolved = resolveFile(ctx, input)
+  if (!resolved.ok) return aiToolError(resolved.error)
+  ctx.handle.selectFile(resolved.file.id)
+  return aiToolOk({ opened: relativePathOf(ctx, resolved.file) })
+}
+
+// ---------------------------------------------------------------------------
+// Dispatcher
+// ---------------------------------------------------------------------------
+
+const WRITE_TOOLS = new Set([
+  'plugin_write_file',
+  'plugin_patch_file',
+  'plugin_rename_file',
+  'plugin_delete_file',
+])
+
+export async function executePluginTool(
+  toolName: string,
+  input: unknown,
+): Promise<AiToolOutput> {
+  const ctxOrError = requireCtx()
+  if (!isBridgeCtx(ctxOrError)) return ctxOrError
+  const ctx = ctxOrError
+
+  // Capability re-check at the boundary: the server never offers write
+  // tools to callers without plugins.edit, but the bridge validates its own
+  // side too (defence in depth — mirrors the relay's update guard).
+  if (WRITE_TOOLS.has(toolName) && !ctx.handle.canEdit()) {
+    return aiToolError('You do not have the plugins.edit capability.')
+  }
+
+  try {
+    switch (toolName) {
+      case 'plugin_list_files':
+        parse(PluginListFilesInputSchema, input)
+        return await runListFiles(ctx)
+      case 'plugin_read_file':
+        return await runReadFile(ctx, parse(PluginReadFileInputSchema, input))
+      case 'plugin_write_file':
+        return await runWriteFile(ctx, parse(PluginWriteFileInputSchema, input))
+      case 'plugin_patch_file':
+        return await runPatchFile(ctx, parse(PluginPatchFileInputSchema, input))
+      case 'plugin_rename_file':
+        return await runRenameFile(ctx, parse(PluginRenameFileInputSchema, input))
+      case 'plugin_delete_file':
+        return runDeleteFile(ctx, parse(PluginDeleteFileInputSchema, input))
+      case 'plugin_open_file':
+        return runOpenFile(ctx, parse(PluginOpenFileInputSchema, input))
+      default:
+        return aiToolError(`Unknown plugin tool: ${toolName}`)
+    }
+  } catch (err) {
+    return aiToolError(getErrorMessage(err, `Tool ${toolName} failed.`))
+  }
+}
+
+function parse<S extends TSchema>(schema: S, input: unknown): Static<S> {
+  return parseValue(schema, input)
+}
diff --git a/src/admin/pages/plugins/ide/agent/pluginBridgeHandle.ts b/src/admin/pages/plugins/ide/agent/pluginBridgeHandle.ts
new file mode 100644
index 000000000..473173106
--- /dev/null
+++ b/src/admin/pages/plugins/ide/agent/pluginBridgeHandle.ts
@@ -0,0 +1,97 @@
+/**
+ * Plugin IDE bridge handle registry.
+ *
+ * The chat panel and the MCP relay run outside the IDE page's React tree —
+ * the bridge dispatcher needs an imperative entry point onto the live IDE
+ * state (the collab session, the file list, the runtime summary, the
+ * visible buffer). SitePluginIdePage registers a handle here on mount; the
+ * dispatcher reads it and calls methods on it. Same module-level-handle
+ * pattern as the content workspace's `contentBridgeHandle.ts`.
+ *
+ * The snapshot shape structurally mirrors
+ * `server/ai/tools/plugin/snapshot.ts → PluginIdeSnapshot` — defined here
+ * (not imported) so the frontend doesn't reach into `server/`. Keep the two
+ * in sync.
+ */
+import type { SitePluginSummary } from '@core/site-plugins'
+import type { IdeCollabSession, IdeFileMeta } from '../ideCollab'
+
+export interface PluginIdeAgentCurrentUser {
+  id: string
+  displayName: string
+  email: string
+}
+
+/** Mirrors `PluginIdeSnapshot` (server) — see module doc. */
+export interface PluginIdeAgentSnapshot {
+  localId: string
+  pluginId: string
+  files: Array<{ id: string; path: string }>
+  activeFile: { id: string; path: string } | null
+  state: string
+  activeVersion: string | null
+  declaredPermissions: string[]
+  grantedPermissions: string[]
+  latestDiagnostics: string[] | null
+  currentUser: PluginIdeAgentCurrentUser
+}
+
+/**
+ * Imperative surface the IDE page exposes to the agent bridge. Accessors
+ * (not fields) so every call reads the LIVE page state — the handle is
+ * registered once per mount and never goes stale.
+ */
+export interface PluginIdeBridgeHandle {
+  /** The plugin this IDE mount edits. */
+  readonly localId: string
+  /** Per-request snapshot for the system prompt + server tools. */
+  buildSnapshot(): PluginIdeAgentSnapshot
+  /** The live collab session; null for at most the mount render. */
+  session(): IdeCollabSession | null
+  /** Live file metas (full `plugins/<localId>/…` paths), path-sorted. */
+  files(): IdeFileMeta[]
+  /** Switch the visible buffer (plugin_open_file). */
+  selectFile(fileId: string): void
+  /** Whether the current user may author plugin source (plugins.edit). */
+  canEdit(): boolean
+}
+
+let handle: PluginIdeBridgeHandle | null = null
+
+export function setPluginIdeBridgeHandle(next: PluginIdeBridgeHandle | null): void {
+  handle = next
+}
+
+export function getPluginIdeBridgeHandle(): PluginIdeBridgeHandle | null {
+  return handle
+}
+
+export function emptyPluginIdeAgentSnapshot(): PluginIdeAgentSnapshot {
+  return {
+    localId: '',
+    pluginId: '',
+    files: [],
+    activeFile: null,
+    state: 'draft-changed',
+    activeVersion: null,
+    declaredPermissions: [],
+    grantedPermissions: [],
+    latestDiagnostics: null,
+    currentUser: { id: '', displayName: '', email: '' },
+  }
+}
+
+/** Narrow a SitePluginSummary into the snapshot's runtime fields. */
+export function summarySnapshotFields(
+  summary: SitePluginSummary | null,
+): Pick<
+  PluginIdeAgentSnapshot,
+  'state' | 'activeVersion' | 'declaredPermissions' | 'grantedPermissions'
+> {
+  return {
+    state: summary?.state ?? 'draft-changed',
+    activeVersion: summary?.activeVersion ?? null,
+    declaredPermissions: [...(summary?.declaredPermissions ?? [])],
+    grantedPermissions: [...(summary?.grantedPermissions ?? [])],
+  }
+}
diff --git a/src/admin/pages/plugins/ide/agent/usePluginIdeToolBridge.ts b/src/admin/pages/plugins/ide/agent/usePluginIdeToolBridge.ts
new file mode 100644
index 000000000..728524282
--- /dev/null
+++ b/src/admin/pages/plugins/ide/agent/usePluginIdeToolBridge.ts
@@ -0,0 +1,77 @@
+/**
+ * Register the Plugin IDE's imperative tool surface and keep its MCP relay
+ * connected for the entire SitePluginIdePage mount. Deliberately outside
+ * PluginIdeAgentMount: opening or closing the AI panel must not decide
+ * whether an external MCP client can reach the already-open IDE — same
+ * policy as `useContentToolBridge`.
+ */
+import { useEffect, useLayoutEffect, useRef } from 'react'
+import { sitePluginIdFromLocalId, type SitePluginSummary } from '@core/site-plugins'
+import { useMcpWorkspaceBridge } from '@admin/ai/useMcpWorkspaceBridge'
+import type { IdeCollabSession, IdeFileMeta } from '../ideCollab'
+import { executePluginTool } from './pluginBridge'
+import {
+  setPluginIdeBridgeHandle,
+  summarySnapshotFields,
+  type PluginIdeAgentCurrentUser,
+  type PluginIdeAgentSnapshot,
+  type PluginIdeBridgeHandle,
+} from './pluginBridgeHandle'
+
+interface UsePluginIdeToolBridgeOptions {
+  localId: string
+  folder: string
+  session: IdeCollabSession | null
+  files: IdeFileMeta[]
+  activeFile: { id: string; path: string } | null
+  summary: SitePluginSummary | null
+  /** null until the first validation run — distinct from "clean". */
+  diagnostics: string[] | null
+  selectFile: (fileId: string | null) => void
+  canEdit: boolean
+  currentUser: PluginIdeAgentCurrentUser
+}
+
+export function usePluginIdeToolBridge(options: UsePluginIdeToolBridgeOptions): void {
+  const optionsRef = useRef(options)
+  useLayoutEffect(() => {
+    optionsRef.current = options
+  })
+
+  const { localId } = options
+  useEffect(() => {
+    const handle: PluginIdeBridgeHandle = {
+      localId,
+      buildSnapshot(): PluginIdeAgentSnapshot {
+        const current = optionsRef.current
+        return {
+          localId,
+          pluginId: sitePluginIdFromLocalId(localId),
+          files: current.files.map((file) => ({
+            id: file.id,
+            path: file.path.slice(current.folder.length),
+          })),
+          activeFile: current.activeFile
+            ? {
+                id: current.activeFile.id,
+                path: current.activeFile.path.slice(current.folder.length),
+              }
+            : null,
+          ...summarySnapshotFields(current.summary),
+          latestDiagnostics: current.diagnostics,
+          currentUser: current.currentUser,
+        }
+      },
+      session: () => optionsRef.current.session,
+      files: () => optionsRef.current.files,
+      selectFile: (fileId) => optionsRef.current.selectFile(fileId),
+      canEdit: () => optionsRef.current.canEdit,
+    }
+    setPluginIdeBridgeHandle(handle)
+    return () => {
+      setPluginIdeBridgeHandle(null)
+    }
+  }, [localId])
+
+  useMcpWorkspaceBridge('plugin', executePluginTool)
+}
diff --git a/src/admin/pages/plugins/ide/ideCollab.ts b/src/admin/pages/plugins/ide/ideCollab.ts
index 4034be23c..150990900 100644
--- a/src/admin/pages/plugins/ide/ideCollab.ts
+++ b/src/admin/pages/plugins/ide/ideCollab.ts
@@ -13,6 +13,7 @@
  */
 import * as Y from 'yjs'
 import {
+  applyTextDiff,
   buildSiteFileEntry,
   buildSiteFilesMap,
   shellMap,
@@ -51,6 +52,11 @@ export interface IdeCollabSession {
   createFile(path: string, content?: string): string
   renameFile(fileId: string, nextPath: string): void
   deleteFile(fileId: string): void
+  /**
+   * Whole-value content replace as a minimal Y.Text splice (AI agent write
+   * path) — concurrent remote edits outside the changed span survive.
+   */
+  replaceFileContent(fileId: string, content: string): void
   destroy(): void
 }
 
@@ -216,6 +222,17 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
       }, IDE_ORIGIN)
     },
 
+    replaceFileContent: (fileId, content) => {
+      doc.transact(() => {
+        const entry = ensureFilesMap().get(fileId)
+        if (!(entry instanceof Y.Map)) return
+        const text = entry.get('content')
+        if (!(text instanceof Y.Text)) return
+        applyTextDiff(text, text.toString(), content)
+        entry.set('updatedAt', Date.now())
+      }, IDE_ORIGIN)
+    },
+
     destroy: () => {
       shellMap(doc).unobserveDeep(shellObserver)
       for (const manager of undoManagers.values()) manager.destroy()

From 32f7f6528f45d7642ac98dfcd4dead37658f8754 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 22:40:38 +0200
Subject: [PATCH 13/36] test(ai): plugin toolset selection, lifecycle handlers,
 browser bridge

- selection-time capability filtering (reads vs plugins.edit writes vs
  plugins.install activate; open_file as pure editor-state switch)
- lifecycle handlers against the capability harness: validate via
  explicit localId AND via snapshot; first activation refused as a
  consent moment; same-grant rebuild + skip; list states
- browser dispatcher against a Y.Text-backed fake session: relative
  paths + hashes, hash-guarded patches, replaceAll ambiguity, folder
  escape rejection, plugin.json protection, canEdit refusal, closed-IDE
  error
- plugin_list_plugins wraps its payload in aiToolOk for envelope
  consistency

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 server/ai/tools/plugin/lifecycleTools.ts      |   2 +-
 src/__tests__/agent/pluginBridge.test.ts      | 241 ++++++++++++++++++
 .../server/sitePluginAiTools.test.ts          | 187 ++++++++++++++
 3 files changed, 429 insertions(+), 1 deletion(-)
 create mode 100644 src/__tests__/agent/pluginBridge.test.ts
 create mode 100644 src/__tests__/server/sitePluginAiTools.test.ts

diff --git a/server/ai/tools/plugin/lifecycleTools.ts b/server/ai/tools/plugin/lifecycleTools.ts
index 7b71d8a5e..215edcdbe 100644
--- a/server/ai/tools/plugin/lifecycleTools.ts
+++ b/server/ai/tools/plugin/lifecycleTools.ts
@@ -62,7 +62,7 @@ const listPluginsTool: AiTool = {
     'List every site plugin (draft folders ∪ runtime rows) with its computed state, active version, declared vs granted permissions, and last runtime error. Use to orient before working on a plugin, or to find the localId for plugin_validate / plugin_activate.',
   inputSchema: Type.Object({}),
   handler: async (_input, ctx) => {
-    return { sitePlugins: await listSitePlugins(ctx.db) }
+    return aiToolOk({ sitePlugins: await listSitePlugins(ctx.db) })
   },
 }
 
diff --git a/src/__tests__/agent/pluginBridge.test.ts b/src/__tests__/agent/pluginBridge.test.ts
new file mode 100644
index 000000000..26de2bf6f
--- /dev/null
+++ b/src/__tests__/agent/pluginBridge.test.ts
@@ -0,0 +1,241 @@
+/**
+ * Plugin-scope browser bridge — the dispatcher that turns `plugin_*` tool
+ * requests into operations on the live IDE session.
+ *
+ * Runs against a Y.Text-backed fake of IdeCollabSession + a registered
+ * bridge handle, so it exercises the real path/hash/patch logic without a
+ * socket. Invariants: paths never escape the plugin folder, plugin.json is
+ * rename/delete-protected, patches are hash-guarded, and writes without
+ * plugins.edit are refused.
+ */
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
+import * as Y from 'yjs'
+import { executePluginTool } from '../../admin/pages/plugins/ide/agent/pluginBridge'
+import {
+  setPluginIdeBridgeHandle,
+  type PluginIdeBridgeHandle,
+} from '../../admin/pages/plugins/ide/agent/pluginBridgeHandle'
+import type { IdeCollabSession, IdeFileMeta } from '../../admin/pages/plugins/ide/ideCollab'
+
+const FOLDER = 'plugins/probe/'
+
+interface FakeIde {
+  session: IdeCollabSession
+  handle: PluginIdeBridgeHandle
+  metas: IdeFileMeta[]
+  contentOf(fileId: string): string
+  selected: string[]
+  canEdit: boolean
+}
+
+function createFakeIde(seed: Record<string, string>): FakeIde {
+  const doc = new Y.Doc()
+  const texts = new Map<string, Y.Text>()
+  const metas: IdeFileMeta[] = []
+  let counter = 0
+
+  const addFile = (path: string, content: string): string => {
+    const id = `f${++counter}`
+    const text = new Y.Text()
+    doc.getMap('files').set(id, text as unknown as Y.Map<unknown>)
+    text.insert(0, content)
+    texts.set(id, text)
+    metas.push({ id, path, updatedAt: 0 })
+    return id
+  }
+  for (const [relative, content] of Object.entries(seed)) {
+    addFile(`${FOLDER}${relative}`, content)
+  }
+
+  const state: { selected: string[]; canEdit: boolean } = { selected: [], canEdit: true }
+
+  const session = {
+    contentText: (fileId: string) => texts.get(fileId) ?? null,
+    createFile: (path: string, content?: string) => addFile(path, content ?? ''),
+    renameFile: (fileId: string, nextPath: string) => {
+      const meta = metas.find((entry) => entry.id === fileId)
+      if (meta) meta.path = nextPath
+    },
+    deleteFile: (fileId: string) => {
+      const index = metas.findIndex((entry) => entry.id === fileId)
+      if (index >= 0) metas.splice(index, 1)
+      texts.delete(fileId)
+    },
+    replaceFileContent: (fileId: string, content: string) => {
+      const text = texts.get(fileId)
+      if (!text) return
+      text.delete(0, text.length)
+      text.insert(0, content)
+    },
+  } as unknown as IdeCollabSession
+
+  const handle: PluginIdeBridgeHandle = {
+    localId: 'probe',
+    buildSnapshot: () => {
+      throw new Error('not used by the dispatcher')
+    },
+    session: () => session,
+    files: () => metas,
+    selectFile: (fileId) => state.selected.push(fileId),
+    canEdit: () => state.canEdit,
+  }
+
+  return {
+    session,
+    handle,
+    metas,
+    contentOf: (fileId) => texts.get(fileId)?.toString() ?? '',
+    get selected() {
+      return state.selected
+    },
+    set canEdit(value: boolean) {
+      state.canEdit = value
+    },
+    get canEdit() {
+      return state.canEdit
+    },
+  }
+}
+
+let ide: FakeIde
+
+beforeEach(() => {
+  ide = createFakeIde({
+    'plugin.json': '{\n  "name": "Probe"\n}\n',
+    'server/index.ts': 'export const handler = () => new Response("v1")\n',
+  })
+  setPluginIdeBridgeHandle(ide.handle)
+})
+
+afterEach(() => {
+  setPluginIdeBridgeHandle(null)
+})
+
+async function readHash(path: string): Promise<string> {
+  const read = await executePluginTool('plugin_read_file', { path })
+  expect(read.ok).toBe(true)
+  return (read.data as { hash: string }).hash
+}
+
+describe('plugin bridge dispatcher', () => {
+  test('list + read return relative paths and stable hashes', async () => {
+    const list = await executePluginTool('plugin_list_files', {})
+    expect(list.ok).toBe(true)
+    const files = (list.data as { files: Array<{ path: string; hash: string }> }).files
+    expect(files.map((file) => file.path).sort()).toEqual(['plugin.json', 'server/index.ts'])
+
+    const read = await executePluginTool('plugin_read_file', { path: 'server/index.ts' })
+    expect(read.ok).toBe(true)
+    const data = read.data as { content: string; hash: string; pageInfo: { nextPart: number | null } }
+    expect(data.content).toContain('v1')
+    expect(data.pageInfo.nextPart).toBeNull()
+    expect(files.find((file) => file.path === 'server/index.ts')?.hash).toBe(data.hash)
+  })
+
+  test('write creates new files and overwrites existing ones', async () => {
+    const created = await executePluginTool('plugin_write_file', {
+      path: 'editor/index.ts',
+      content: 'export {}\n',
+    })
+    expect(created.ok).toBe(true)
+    expect((created.data as { created: boolean }).created).toBe(true)
+    expect(ide.metas.some((meta) => meta.path === `${FOLDER}editor/index.ts`)).toBe(true)
+
+    const overwritten = await executePluginTool('plugin_write_file', {
+      path: 'editor/index.ts',
+      content: 'export const x = 1\n',
+    })
+    expect(overwritten.ok).toBe(true)
+    expect((overwritten.data as { created: boolean }).created).toBe(false)
+  })
+
+  test('patch applies exact replacements behind the hash guard', async () => {
+    const hash = await readHash('server/index.ts')
+    const patched = await executePluginTool('plugin_patch_file', {
+      path: 'server/index.ts',
+      expectedHash: hash,
+      replacements: [{ oldText: '"v1"', newText: '"v2"' }],
+    })
+    expect(patched.ok).toBe(true)
+    const meta = ide.metas.find((entry) => entry.path === `${FOLDER}server/index.ts`)!
+    expect(ide.contentOf(meta.id)).toContain('v2')
+
+    // The old hash is now stale — a second patch with it must refuse.
+    const stale = await executePluginTool('plugin_patch_file', {
+      path: 'server/index.ts',
+      expectedHash: hash,
+      replacements: [{ oldText: '"v2"', newText: '"v3"' }],
+    })
+    expect(stale.ok).toBe(false)
+    expect(stale.error).toContain('Hash mismatch')
+  })
+
+  test('ambiguous replacements require replaceAll', async () => {
+    await executePluginTool('plugin_write_file', { path: 'notes.ts', content: 'aa aa\n' })
+    const hash = await readHash('notes.ts')
+    const ambiguous = await executePluginTool('plugin_patch_file', {
+      path: 'notes.ts',
+      expectedHash: hash,
+      replacements: [{ oldText: 'aa', newText: 'bb' }],
+    })
+    expect(ambiguous.ok).toBe(false)
+    expect(ambiguous.error).toContain('replaceAll')
+
+    const all = await executePluginTool('plugin_patch_file', {
+      path: 'notes.ts',
+      expectedHash: hash,
+      replacements: [{ oldText: 'aa', newText: 'bb', replaceAll: true }],
+    })
+    expect(all.ok).toBe(true)
+  })
+
+  test('paths cannot escape the plugin folder', async () => {
+    for (const path of ['../evil.ts', '/etc/passwd', 'a/../../evil.ts']) {
+      const result = await executePluginTool('plugin_write_file', { path, content: 'x' })
+      expect(result.ok, `path "${path}" must be rejected`).toBe(false)
+    }
+  })
+
+  test('plugin.json is rename- and delete-protected', async () => {
+    const del = await executePluginTool('plugin_delete_file', { path: 'plugin.json' })
+    expect(del.ok).toBe(false)
+    expect(del.error).toContain('manifest')
+
+    const rename = await executePluginTool('plugin_rename_file', {
+      path: 'plugin.json',
+      newPath: 'manifest.json',
+    })
+    expect(rename.ok).toBe(false)
+
+    // Ordinary files rename + delete fine.
+    const ok = await executePluginTool('plugin_rename_file', {
+      path: 'server/index.ts',
+      newPath: 'server/main.ts',
+    })
+    expect(ok.ok).toBe(true)
+    const gone = await executePluginTool('plugin_delete_file', { path: 'server/main.ts' })
+    expect(gone.ok).toBe(true)
+  })
+
+  test('open_file switches the visible buffer', async () => {
+    const result = await executePluginTool('plugin_open_file', { path: 'plugin.json' })
+    expect(result.ok).toBe(true)
+    expect(ide.selected).toHaveLength(1)
+  })
+
+  test('writes are refused without plugins.edit; reads still work', async () => {
+    ide.canEdit = false
+    const write = await executePluginTool('plugin_write_file', { path: 'x.ts', content: '' })
+    expect(write.ok).toBe(false)
+    expect(write.error).toContain('plugins.edit')
+    const read = await executePluginTool('plugin_read_file', { path: 'plugin.json' })
+    expect(read.ok).toBe(true)
+  })
+
+  test('a closed IDE yields an actionable error', async () => {
+    setPluginIdeBridgeHandle(null)
+    const result = await executePluginTool('plugin_list_files', {})
+    expect(result.ok).toBe(false)
+    expect(result.error).toContain('/admin/plugins/develop')
+  })
+})
diff --git a/src/__tests__/server/sitePluginAiTools.test.ts b/src/__tests__/server/sitePluginAiTools.test.ts
new file mode 100644
index 000000000..bf5bddfd1
--- /dev/null
+++ b/src/__tests__/server/sitePluginAiTools.test.ts
@@ -0,0 +1,187 @@
+/**
+ * Plugin-scope AI tools — selection-time capability filtering and the
+ * server-resolved lifecycle handlers (`plugin_validate`, `plugin_activate`,
+ * `plugin_list_plugins`).
+ *
+ * The activation consent invariant under test: the agent may rebuild
+ * same-grant revisions autonomously, but any grant-set change (including
+ * the first activation) is refused with an instruction to confirm in the
+ * IDE header — the tool path can never replace the human step-up.
+ */
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import type { CoreCapability } from '@core/capabilities'
+import type { AiToolOutput } from '@core/ai'
+import {
+  createCapabilityTestHarness,
+  readJson,
+  type CapabilityTestHarness,
+} from '../helpers/capabilityHarness'
+import { getDraftSite, saveDraftSite } from '../../../server/repositories/site'
+import { selectToolsForScope } from '../../../server/ai/tools'
+import { pluginTools } from '../../../server/ai/tools/plugin'
+import type { AiTool, ToolContext } from '../../../server/ai/runtime/types'
+
+let harness: CapabilityTestHarness
+let uploadsDir: string
+let ownerCookie: string
+let ownerId: string
+
+beforeAll(async () => {
+  uploadsDir = await mkdtemp(join(tmpdir(), 'site-plugin-ai-uploads-'))
+  harness = await createCapabilityTestHarness({ uploadsDir })
+  ownerCookie = await harness.setupOwner()
+  const me = await harness.cms('/admin/api/cms/me', { cookie: ownerCookie })
+  ownerId = (await readJson<{ user: { id: string } }>(me)).user.id
+})
+
+afterAll(async () => {
+  await harness.cleanup()
+  await rm(uploadsDir, { recursive: true, force: true })
+})
+
+function toolByName(name: string): AiTool {
+  const tool = pluginTools.find((candidate) => candidate.name === name)
+  if (!tool) throw new Error(`no plugin tool named ${name}`)
+  return tool
+}
+
+function ctx(capabilities: CoreCapability[], snapshot: unknown = null): ToolContext {
+  return {
+    db: harness.db,
+    userId: ownerId,
+    capabilities,
+    scope: 'plugin',
+    conversationId: 'test',
+    snapshot,
+    uploadsDir,
+    signal: new AbortController().signal,
+  }
+}
+
+const OWNER_CAPS: CoreCapability[] = [
+  'site.read',
+  'plugins.read',
+  'plugins.edit',
+  'plugins.install',
+  'ai.chat',
+  'ai.tools.write',
+]
+
+async function run(name: string, input: unknown, context: ToolContext): Promise<AiToolOutput> {
+  const tool = toolByName(name)
+  return (await tool.handler!(input, context)) as AiToolOutput
+}
+
+describe('plugin toolset selection', () => {
+  test('a reader sees read tools only', () => {
+    const offered = selectToolsForScope('plugin', ['ai.chat', 'site.read'])
+    const names = offered.map((tool) => tool.name).sort()
+    expect(names).toEqual(['plugin_list_files', 'plugin_list_plugins', 'plugin_read_file', 'plugin_validate'])
+  })
+
+  test('write tools require ai.tools.write AND plugins.edit', () => {
+    const withoutEdit = selectToolsForScope('plugin', ['ai.chat', 'ai.tools.write', 'site.read'])
+    expect(withoutEdit.some((tool) => tool.name === 'plugin_write_file')).toBe(false)
+    // plugin_open_file is a pure editor-state switch — write-flag gated only.
+    expect(withoutEdit.some((tool) => tool.name === 'plugin_open_file')).toBe(true)
+
+    const withEdit = selectToolsForScope('plugin', ['ai.chat', 'ai.tools.write', 'plugins.edit'])
+    const names = withEdit.map((tool) => tool.name)
+    expect(names).toContain('plugin_write_file')
+    expect(names).toContain('plugin_patch_file')
+    expect(names).toContain('plugin_rename_file')
+    expect(names).toContain('plugin_delete_file')
+    // …but not activate (plugins.install) or the site.read-gated reads.
+    expect(names).not.toContain('plugin_activate')
+  })
+
+  test('plugin_activate requires plugins.install', () => {
+    const installer = selectToolsForScope('plugin', ['ai.chat', 'ai.tools.write', 'plugins.install'])
+    expect(installer.some((tool) => tool.name === 'plugin_activate')).toBe(true)
+  })
+})
+
+describe('plugin lifecycle tool handlers', () => {
+  test('plugin_validate validates a scaffolded plugin (explicit localId)', async () => {
+    const scaffold = await harness.cms('/admin/api/cms/site-plugins', {
+      method: 'POST',
+      cookie: ownerCookie,
+      json: { name: 'Agent Probe', localId: 'agent-probe', template: 'routes' },
+    })
+    expect(scaffold.status).toBe(201)
+
+    const result = await run('plugin_validate', { localId: 'agent-probe' }, ctx(OWNER_CAPS))
+    expect(result.ok).toBe(true)
+    expect(result.data).toEqual({ ok: true, diagnostics: [] })
+  })
+
+  test('plugin_validate resolves the open plugin from the snapshot', async () => {
+    const snapshot = {
+      localId: 'agent-probe',
+      pluginId: 'site.agent-probe',
+      files: [],
+      activeFile: null,
+      state: 'draft-changed',
+      activeVersion: null,
+      declaredPermissions: [],
+      grantedPermissions: [],
+      latestDiagnostics: null,
+      currentUser: { id: ownerId, displayName: 'Owner', email: 'o@example.com' },
+    }
+    const result = await run('plugin_validate', {}, ctx(OWNER_CAPS, snapshot))
+    expect(result.ok).toBe(true)
+  })
+
+  test('plugin_validate without any plugin in scope names the fix', async () => {
+    const result = await run('plugin_validate', {}, ctx(OWNER_CAPS))
+    expect(result.ok).toBe(false)
+    expect(result.error).toContain('plugin_list_plugins')
+  })
+
+  test('first activation is a consent moment — the tool refuses', async () => {
+    const result = await run('plugin_activate', { localId: 'agent-probe' }, ctx(OWNER_CAPS))
+    expect(result.ok).toBe(false)
+    expect(result.error).toContain('human consent')
+    expect(result.error).toContain('Build & activate')
+  })
+
+  test('same-grant rebuild activates without consent friction', async () => {
+    // Human first-activation via the HTTP route (step-up cookie from setupOwner).
+    const httpActivate = await harness.cms('/admin/api/cms/site-plugins/agent-probe/activate', {
+      method: 'POST',
+      cookie: ownerCookie,
+    })
+    expect(httpActivate.status).toBe(200)
+
+    // Change the source (same grants), then the agent rebuilds autonomously.
+    const shell = await getDraftSite(harness.db)
+    if (!shell) throw new Error('no draft')
+    const files = shell.files.map((file) =>
+      file.path === 'plugins/agent-probe/server/index.ts'
+        ? { ...file, content: `${file.content}\n// agent edit`, updatedAt: Date.now() }
+        : file,
+    )
+    await saveDraftSite(harness.db, { ...shell, files, updatedAt: Date.now() })
+
+    const result = await run('plugin_activate', { localId: 'agent-probe' }, ctx(OWNER_CAPS))
+    expect(result.ok).toBe(true)
+    expect(result.data).toMatchObject({ activated: true, pluginId: 'site.agent-probe' })
+  })
+
+  test('unchanged source re-activation is a skip', async () => {
+    const result = await run('plugin_activate', { localId: 'agent-probe' }, ctx(OWNER_CAPS))
+    expect(result.ok).toBe(true)
+    expect(result.data).toMatchObject({ activated: false, skipped: true })
+  })
+
+  test('plugin_list_plugins reports the runtime state', async () => {
+    const result = await run('plugin_list_plugins', {}, ctx(OWNER_CAPS))
+    expect(result.ok).toBe(true)
+    const { sitePlugins } = result.data as { sitePlugins: Array<{ localId: string; state: string }> }
+    const entry = sitePlugins.find((plugin) => plugin.localId === 'agent-probe')
+    expect(entry?.state).toBe('active')
+  })
+})

From faad2ad94633c7f0b37738732e8997f68ed29ef5 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 22:54:05 +0200
Subject: [PATCH 14/36] =?UTF-8?q?fix(plugin-ide):=20live-test=20fix=20roun?=
 =?UTF-8?q?d=20=E2=80=94=20stale=20metas,=20humanized=20tool=20rows,=20sch?=
 =?UTF-8?q?ema=20teaching,=20code/diff=20blocks?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Four findings from a real agent session in the IDE:

- BRIDGE STALENESS (the 'Create failed for server/index.ts' class): the
  tool bridge read file metas from React state, which lags the Y doc when
  tool calls arrive back-to-back without a render turn — a create could
  not see its own file. Metas now come straight from the live session
  (session.pluginFiles()), for tools and the snapshot both.
- TOOL ROWS: plugin_* names fell through to the raw 'Running plugin read
  file' default. toolCallDisplay now maps every plugin tool to a human
  title + detail (file path, edit count, rename arrow, localId).
- SCHEMA GUESSING: the model invented adminPages content shapes. The
  system prompt now spells out the content union — including the
  kind:'resource' CRUD page, which is the right answer for 'manage
  customers' requests — and says node_modules isn't on disk. The
  'Expected union value' diagnostic gains the same shape hint for humans.
- CODE VISIBILITY: write/patch tool rows (plugin AND site code-asset
  tools) get a 'View code / changes' toggle rendering a lazy read-only
  CodeMirror block — unified diff via @codemirror/merge for patches.
  New AgentCodeView joins the codemirror-lazy-only allowlist; theme +
  language stacks shared with CodeMirrorEditor.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 bun.lock                                      | 795 ++++++++++--------
 package.json                                  |   1 +
 server/ai/tools/plugin/systemPrompt.ts        |   8 +-
 .../architecture/codemirror-lazy-only.test.ts |   3 +
 .../ide/agent/usePluginIdeToolBridge.ts       |  14 +-
 .../pages/site/code-editor/AgentCodeView.tsx  |  95 +++
 .../site/code-editor/CodeMirrorEditor.tsx     |  11 +-
 .../panels/AgentPanel/AgentPanel.module.css   |  22 +
 .../site/panels/AgentPanel/ToolCallRow.tsx    |  56 +-
 .../site/panels/AgentPanel/toolCallDisplay.ts |  82 +-
 src/core/site-plugins/derive.ts               |  23 +-
 11 files changed, 734 insertions(+), 376 deletions(-)
 create mode 100644 src/admin/pages/site/code-editor/AgentCodeView.tsx

diff --git a/bun.lock b/bun.lock
index 9820faad5..80e85e181 100644
--- a/bun.lock
+++ b/bun.lock
@@ -13,6 +13,7 @@
         "@codemirror/lang-markdown": "^6.5.0",
         "@codemirror/language": "^6.12.3",
         "@codemirror/lint": "^6.9.5",
+        "@codemirror/merge": "^6.12.2",
         "@codemirror/state": "^6.6.0",
         "@dnd-kit/core": "^6.3.1",
         "@fontsource-variable/inter": "^5.2.8",
@@ -105,81 +106,83 @@
 
     "@azu/style-format": ["@azu/style-format@1.0.1", "", { "dependencies": { "@azu/format-text": "^1.0.1" } }, "sha512-AHcTojlNBdD/3/KxIKlg8sxIWHfOtQszLvOpagLTO+bjC3u7SAszu1lf//u7JJC50aUSH+BVWDD/KvaA6Gfn5g=="],
 
-    "@babel/code-frame": ["@babel/code-frame@7.29.0", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.28.5", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw=="],
+    "@babel/code-frame": ["@babel/code-frame@7.29.7", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.29.7", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw=="],
 
-    "@babel/compat-data": ["@babel/compat-data@7.29.3", "", {}, "sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg=="],
+    "@babel/compat-data": ["@babel/compat-data@7.29.7", "", {}, "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg=="],
 
-    "@babel/core": ["@babel/core@7.29.0", "", { "dependencies": { "@babel/code-frame": "^7.29.0", "@babel/generator": "^7.29.0", "@babel/helper-compilation-targets": "^7.28.6", "@babel/helper-module-transforms": "^7.28.6", "@babel/helpers": "^7.28.6", "@babel/parser": "^7.29.0", "@babel/template": "^7.28.6", "@babel/traverse": "^7.29.0", "@babel/types": "^7.29.0", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA=="],
+    "@babel/core": ["@babel/core@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.7", "@babel/helper-compilation-targets": "^7.29.7", "@babel/helper-module-transforms": "^7.29.7", "@babel/helpers": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/template": "^7.29.7", "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA=="],
 
-    "@babel/generator": ["@babel/generator@7.29.1", "", { "dependencies": { "@babel/parser": "^7.29.0", "@babel/types": "^7.29.0", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw=="],
+    "@babel/generator": ["@babel/generator@7.29.8", "", { "dependencies": { "@babel/parser": "^7.29.8", "@babel/types": "^7.29.8", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg=="],
 
-    "@babel/helper-annotate-as-pure": ["@babel/helper-annotate-as-pure@7.27.3", "", { "dependencies": { "@babel/types": "^7.27.3" } }, "sha512-fXSwMQqitTGeHLBC08Eq5yXz2m37E4pJX1qAU1+2cNedz/ifv/bVXft90VeSav5nFO61EcNgwr0aJxbyPaWBPg=="],
+    "@babel/helper-annotate-as-pure": ["@babel/helper-annotate-as-pure@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" } }, "sha512-OoK6239jHPuSQOoS0kfTVKn0b/rVTk0seKq4Gd2UMLtmOVLjDC0ki3e+c90Trqv2gMfvJFqkiljrr568+qddiw=="],
 
-    "@babel/helper-compilation-targets": ["@babel/helper-compilation-targets@7.28.6", "", { "dependencies": { "@babel/compat-data": "^7.28.6", "@babel/helper-validator-option": "^7.27.1", "browserslist": "^4.24.0", "lru-cache": "^5.1.1", "semver": "^6.3.1" } }, "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA=="],
+    "@babel/helper-compilation-targets": ["@babel/helper-compilation-targets@7.29.7", "", { "dependencies": { "@babel/compat-data": "^7.29.7", "@babel/helper-validator-option": "^7.29.7", "browserslist": "^4.24.0", "lru-cache": "^5.1.1", "semver": "^6.3.1" } }, "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g=="],
 
-    "@babel/helper-create-class-features-plugin": ["@babel/helper-create-class-features-plugin@7.29.3", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.27.3", "@babel/helper-member-expression-to-functions": "^7.28.5", "@babel/helper-optimise-call-expression": "^7.27.1", "@babel/helper-replace-supers": "^7.28.6", "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1", "@babel/traverse": "^7.29.0", "semver": "^6.3.1" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-RpLYy2sb51oNLjuu1iD3bwBqCBWUzjO0ocp+iaCP/lJtb2CPLcnC2Fftw+4sAzaMELGeWTgExSKADbdo0GFVzA=="],
+    "@babel/helper-create-class-features-plugin": ["@babel/helper-create-class-features-plugin@7.29.7", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.29.7", "@babel/helper-member-expression-to-functions": "^7.29.7", "@babel/helper-optimise-call-expression": "^7.29.7", "@babel/helper-replace-supers": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7", "@babel/traverse": "^7.29.7", "semver": "^6.3.1" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-IY3ZD9Tmooqr3TUhc3DUWxiuo8xx1DWLhd5M7hQ+ZWJamqM2BbalrBJb2MisSLoYorOj75U03qULCxQTY9r3hg=="],
 
-    "@babel/helper-globals": ["@babel/helper-globals@7.28.0", "", {}, "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw=="],
+    "@babel/helper-globals": ["@babel/helper-globals@7.29.7", "", {}, "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA=="],
 
-    "@babel/helper-member-expression-to-functions": ["@babel/helper-member-expression-to-functions@7.28.5", "", { "dependencies": { "@babel/traverse": "^7.28.5", "@babel/types": "^7.28.5" } }, "sha512-cwM7SBRZcPCLgl8a7cY0soT1SptSzAlMH39vwiRpOQkJlh53r5hdHwLSCZpQdVLT39sZt+CRpNwYG4Y2v77atg=="],
+    "@babel/helper-member-expression-to-functions": ["@babel/helper-member-expression-to-functions@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-j+7JYmk1JYDtACIGj0QJqqWZjoUpMoEikQGADMaHgCMCSDqd2+P32rfcibUNrGOMWrlzK1WJBdxrB3JJQZwWtg=="],
 
-    "@babel/helper-module-imports": ["@babel/helper-module-imports@7.28.6", "", { "dependencies": { "@babel/traverse": "^7.28.6", "@babel/types": "^7.28.6" } }, "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw=="],
+    "@babel/helper-module-imports": ["@babel/helper-module-imports@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g=="],
 
-    "@babel/helper-module-transforms": ["@babel/helper-module-transforms@7.28.6", "", { "dependencies": { "@babel/helper-module-imports": "^7.28.6", "@babel/helper-validator-identifier": "^7.28.5", "@babel/traverse": "^7.28.6" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA=="],
+    "@babel/helper-module-transforms": ["@babel/helper-module-transforms@7.29.7", "", { "dependencies": { "@babel/helper-module-imports": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg=="],
 
-    "@babel/helper-optimise-call-expression": ["@babel/helper-optimise-call-expression@7.27.1", "", { "dependencies": { "@babel/types": "^7.27.1" } }, "sha512-URMGH08NzYFhubNSGJrpUEphGKQwMQYBySzat5cAByY1/YgIRkULnIy3tAMeszlL/so2HbeilYloUmSpd7GdVw=="],
+    "@babel/helper-optimise-call-expression": ["@babel/helper-optimise-call-expression@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" } }, "sha512-+kmGVjcT9RGYzoDwdwEqEvGgKe3BYq+O1iGzjFubaNgZHwYHP6lsF2Yghf4kEuv9BV7tYDZ913aBW9am6YKong=="],
 
-    "@babel/helper-plugin-utils": ["@babel/helper-plugin-utils@7.28.6", "", {}, "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug=="],
+    "@babel/helper-plugin-utils": ["@babel/helper-plugin-utils@7.29.7", "", {}, "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw=="],
 
-    "@babel/helper-replace-supers": ["@babel/helper-replace-supers@7.28.6", "", { "dependencies": { "@babel/helper-member-expression-to-functions": "^7.28.5", "@babel/helper-optimise-call-expression": "^7.27.1", "@babel/traverse": "^7.28.6" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-mq8e+laIk94/yFec3DxSjCRD2Z0TAjhVbEJY3UQrlwVo15Lmt7C2wAUbK4bjnTs4APkwsYLTahXRraQXhb1WCg=="],
+    "@babel/helper-replace-supers": ["@babel/helper-replace-supers@7.29.7", "", { "dependencies": { "@babel/helper-member-expression-to-functions": "^7.29.7", "@babel/helper-optimise-call-expression": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-atfGXWSeCiF4DnKZIfmJfQRkSw9b9gNNXR1kqKjbhG4pGYCOnkp8OcTB8E3NXjBu8NpheSnOeNKz8KT7UNFTmQ=="],
 
-    "@babel/helper-skip-transparent-expression-wrappers": ["@babel/helper-skip-transparent-expression-wrappers@7.27.1", "", { "dependencies": { "@babel/traverse": "^7.27.1", "@babel/types": "^7.27.1" } }, "sha512-Tub4ZKEXqbPjXgWLl2+3JpQAYBJ8+ikpQ2Ocj/q/r0LwE3UhENh7EUabyHjz2kCEsrRY83ew2DQdHluuiDQFzg=="],
+    "@babel/helper-skip-transparent-expression-wrappers": ["@babel/helper-skip-transparent-expression-wrappers@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-brcMGQaVzIeUb+6/bs1Av0f8YuNNjKY2JyvfRCsFuFsdKccEQ5Ges2y74D74NZ1Rz8lKJ9ksJkfqwQFJ/iNEyQ=="],
 
-    "@babel/helper-string-parser": ["@babel/helper-string-parser@7.27.1", "", {}, "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA=="],
+    "@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
 
-    "@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.28.5", "", {}, "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q=="],
+    "@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
 
-    "@babel/helper-validator-option": ["@babel/helper-validator-option@7.27.1", "", {}, "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg=="],
+    "@babel/helper-validator-option": ["@babel/helper-validator-option@7.29.7", "", {}, "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw=="],
 
-    "@babel/helpers": ["@babel/helpers@7.29.2", "", { "dependencies": { "@babel/template": "^7.28.6", "@babel/types": "^7.29.0" } }, "sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw=="],
+    "@babel/helpers": ["@babel/helpers@7.29.7", "", { "dependencies": { "@babel/template": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg=="],
 
-    "@babel/parser": ["@babel/parser@7.29.3", "", { "dependencies": { "@babel/types": "^7.29.0" }, "bin": "./bin/babel-parser.js" }, "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA=="],
+    "@babel/parser": ["@babel/parser@7.29.8", "", { "dependencies": { "@babel/types": "^7.29.8" }, "bin": "./bin/babel-parser.js" }, "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA=="],
 
     "@babel/plugin-proposal-private-methods": ["@babel/plugin-proposal-private-methods@7.18.6", "", { "dependencies": { "@babel/helper-create-class-features-plugin": "^7.18.6", "@babel/helper-plugin-utils": "^7.18.6" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-nutsvktDItsNn4rpGItSNV2sz1XwS+nfU0Rg8aCx3W3NOKVzdMjJRu0O5OkgDp3ZGICSTbgRpxZoWsxoKRvbeA=="],
 
-    "@babel/runtime": ["@babel/runtime@7.29.2", "", {}, "sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g=="],
+    "@babel/runtime": ["@babel/runtime@7.29.7", "", {}, "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw=="],
 
-    "@babel/template": ["@babel/template@7.28.6", "", { "dependencies": { "@babel/code-frame": "^7.28.6", "@babel/parser": "^7.28.6", "@babel/types": "^7.28.6" } }, "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ=="],
+    "@babel/template": ["@babel/template@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg=="],
 
-    "@babel/traverse": ["@babel/traverse@7.29.0", "", { "dependencies": { "@babel/code-frame": "^7.29.0", "@babel/generator": "^7.29.0", "@babel/helper-globals": "^7.28.0", "@babel/parser": "^7.29.0", "@babel/template": "^7.28.6", "@babel/types": "^7.29.0", "debug": "^4.3.1" } }, "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA=="],
+    "@babel/traverse": ["@babel/traverse@7.29.8", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.8", "@babel/helper-globals": "^7.29.7", "@babel/parser": "^7.29.8", "@babel/template": "^7.29.7", "@babel/types": "^7.29.8", "debug": "^4.3.1" } }, "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg=="],
 
-    "@babel/types": ["@babel/types@7.29.0", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.28.5" } }, "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A=="],
+    "@babel/types": ["@babel/types@7.29.8", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg=="],
 
     "@bramus/specificity": ["@bramus/specificity@2.4.2", "", { "dependencies": { "css-tree": "^3.0.0" }, "bin": { "specificity": "bin/cli.js" } }, "sha512-ctxtJ/eA+t+6q2++vj5j7FYX3nRu311q1wfYH3xjlLOsczhlhxAg2FWNUXhpGvAw3BWo1xBcvOV6/YLc2r5FJw=="],
 
-    "@codemirror/autocomplete": ["@codemirror/autocomplete@6.20.1", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/common": "^1.0.0" } }, "sha512-1cvg3Vz1dSSToCNlJfRA2WSI4ht3K+WplO0UMOgmUYPivCyy2oueZY6Lx7M9wThm7SDUBViRmuT+OG/i8+ON9A=="],
+    "@codemirror/autocomplete": ["@codemirror/autocomplete@6.20.3", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/common": "^1.0.0" } }, "sha512-tlosUqb+3BbxCxZdu4tKeRghPFC+QM7q4X5YhKV2eCmPG+1r2F3f4AaSz5sCrFqUtX4Jh20VFTKecl16MgiV9g=="],
 
-    "@codemirror/commands": ["@codemirror/commands@6.10.3", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.6.0", "@codemirror/view": "^6.27.0", "@lezer/common": "^1.1.0" } }, "sha512-JFRiqhKu+bvSkDLI+rUhJwSxQxYb759W5GBezE8Uc8mHLqC9aV/9aTC7yJSqCtB3F00pylrLCwnyS91Ap5ej4Q=="],
+    "@codemirror/commands": ["@codemirror/commands@6.11.0", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.7.0", "@codemirror/view": "^6.27.0", "@lezer/common": "^1.1.0" } }, "sha512-/K4Rl5BN0OtTiPWmJCdqODu38XnDMsDxKY5rgrPnCkutPTJf2wVbkoixLfealF5Kwse/s8P8M5jAiURiwSwnFA=="],
 
     "@codemirror/lang-css": ["@codemirror/lang-css@6.3.1", "", { "dependencies": { "@codemirror/autocomplete": "^6.0.0", "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.0.0", "@lezer/common": "^1.0.2", "@lezer/css": "^1.1.7" } }, "sha512-kr5fwBGiGtmz6l0LSJIbno9QrifNMUusivHbnA1H6Dmqy4HZFte3UAICix1VuKo0lMPKQr2rqB+0BkKi/S3Ejg=="],
 
-    "@codemirror/lang-html": ["@codemirror/lang-html@6.4.11", "", { "dependencies": { "@codemirror/autocomplete": "^6.0.0", "@codemirror/lang-css": "^6.0.0", "@codemirror/lang-javascript": "^6.0.0", "@codemirror/language": "^6.4.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/common": "^1.0.0", "@lezer/css": "^1.1.0", "@lezer/html": "^1.3.12" } }, "sha512-9NsXp7Nwp891pQchI7gPdTwBuSuT3K65NGTHWHNJ55HjYcHLllr0rbIZNdOzas9ztc1EUVBlHou85FFZS4BNnw=="],
+    "@codemirror/lang-html": ["@codemirror/lang-html@6.4.12", "", { "dependencies": { "@codemirror/autocomplete": "^6.0.0", "@codemirror/lang-css": "^6.0.0", "@codemirror/lang-javascript": "^6.0.0", "@codemirror/language": "^6.4.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/common": "^1.0.0", "@lezer/css": "^1.1.0", "@lezer/html": "^1.3.12" } }, "sha512-pw2ReWKUqSkbvh76RAT4NYxiogRu+PWkR2ukAwO9uOgrm8uipkzjtKKtNpyeAQwHOqxEeSvAXZ6vr3AfyB9y/w=="],
 
     "@codemirror/lang-javascript": ["@codemirror/lang-javascript@6.2.5", "", { "dependencies": { "@codemirror/autocomplete": "^6.0.0", "@codemirror/language": "^6.6.0", "@codemirror/lint": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/common": "^1.0.0", "@lezer/javascript": "^1.0.0" } }, "sha512-zD4e5mS+50htS7F+TYjBPsiIFGanfVqg4HyUz6WNFikgOPf2BgKlx+TQedI1w6n/IqRBVBbBWmGFdLB/7uxO4A=="],
 
     "@codemirror/lang-json": ["@codemirror/lang-json@6.0.2", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@lezer/json": "^1.0.0" } }, "sha512-x2OtO+AvwEHrEwR0FyyPtfDUiloG3rnVTSZV1W8UteaLL8/MajQd8DpvUb2YVzC+/T18aSDv0H9mu+xw0EStoQ=="],
 
-    "@codemirror/lang-markdown": ["@codemirror/lang-markdown@6.5.0", "", { "dependencies": { "@codemirror/autocomplete": "^6.7.1", "@codemirror/lang-html": "^6.0.0", "@codemirror/language": "^6.3.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.0.0", "@lezer/common": "^1.2.1", "@lezer/markdown": "^1.0.0" } }, "sha512-0K40bZ35jpHya6FriukbgaleaqzBLZfOh7HuzqbMxBXkbYMJDxfF39c23xOgxFezR+3G+tR2/Mup+Xk865OMvw=="],
+    "@codemirror/lang-markdown": ["@codemirror/lang-markdown@6.5.2", "", { "dependencies": { "@codemirror/autocomplete": "^6.7.1", "@codemirror/lang-html": "^6.0.0", "@codemirror/language": "^6.3.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.0.0", "@lezer/common": "^1.2.1", "@lezer/markdown": "^1.0.0" } }, "sha512-AwBOdkWYuA//WcM0xO5PfHPUcmz/O2i5o0Nsg1U69SII/loCJlFI1Romd9xp2HYb1kYJRGZotyqRghuHH5n8Kw=="],
 
-    "@codemirror/language": ["@codemirror/language@6.12.3", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.23.0", "@lezer/common": "^1.5.0", "@lezer/highlight": "^1.0.0", "@lezer/lr": "^1.0.0", "style-mod": "^4.0.0" } }, "sha512-QwCZW6Tt1siP37Jet9Tb02Zs81TQt6qQrZR2H+eGMcFsL1zMrk2/b9CLC7/9ieP1fjIUMgviLWMmgiHoJrj+ZA=="],
+    "@codemirror/language": ["@codemirror/language@6.12.4", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.23.0", "@lezer/common": "^1.5.0", "@lezer/highlight": "^1.0.0", "@lezer/lr": "^1.0.0", "style-mod": "^4.0.0" } }, "sha512-1q4PaT+o6PbgpkJt4Q8Fv5XJxTy4FUZ4MWETtyiDw3J0Pyr9E2vqcKL+k9wcvjNTIsauxvE7OfmWj3FRPHQ76A=="],
 
-    "@codemirror/lint": ["@codemirror/lint@6.9.5", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.35.0", "crelt": "^1.0.5" } }, "sha512-GElsbU9G7QT9xXhpUg1zWGmftA/7jamh+7+ydKRuT0ORpWS3wOSP0yT1FOlIZa7mIJjpVPipErsyvVqB9cfTFA=="],
+    "@codemirror/lint": ["@codemirror/lint@6.9.7", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.42.0", "crelt": "^1.0.5" } }, "sha512-28/+iWLYxKxsvGYhSYL7zaCZqLz5+FFFDq9tVsvGv9kv8RY4fFAchJ5WX9M3YrrRlTIsECjsXPqeNgnSmNP2dg=="],
 
-    "@codemirror/search": ["@codemirror/search@6.7.0", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.37.0", "crelt": "^1.0.5" } }, "sha512-ZvGm99wc/s2cITtMT15LFdn8aH/aS+V+DqyGq/N5ZlV5vWtH+nILvC2nw0zX7ByNoHHDZ2IxxdW38O0tc5nVHg=="],
+    "@codemirror/merge": ["@codemirror/merge@6.12.2", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/highlight": "^1.0.0", "style-mod": "^4.1.0" } }, "sha512-V8JvyAPjHbPupqP7BeMcsdsYCbyPij74jxIbaIJDORI+VZzW44zFmon8bF+oxGWvOKhcRmkiUMXd8MxHr3YA2w=="],
 
-    "@codemirror/state": ["@codemirror/state@6.6.0", "", { "dependencies": { "@marijn/find-cluster-break": "^1.0.0" } }, "sha512-4nbvra5R5EtiCzr9BTHiTLc+MLXK2QGiAVYMyi8PkQd3SR+6ixar/Q/01Fa21TBIDOZXgeWV4WppsQolSreAPQ=="],
+    "@codemirror/search": ["@codemirror/search@6.7.2", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.37.0", "crelt": "^1.0.5" } }, "sha512-gUYkYhT2+n/+VGZ+8EzE5WFkYZUZYm1VOKDudIsNqh42uRVQJ0a6Yss9sdKT3MeOYfuL1N6AZA57oza0Oyr0LA=="],
 
-    "@codemirror/view": ["@codemirror/view@6.41.1", "", { "dependencies": { "@codemirror/state": "^6.6.0", "crelt": "^1.0.6", "style-mod": "^4.1.0", "w3c-keyname": "^2.2.4" } }, "sha512-ToDnWKbBnke+ZLrP6vgTTDScGi5H37YYuZGniQaBzxMVdtCxMrslsmtnOvbPZk4RX9bvkQqnWR/WS/35tJA0qg=="],
+    "@codemirror/state": ["@codemirror/state@6.7.3", "", { "dependencies": { "@marijn/find-cluster-break": "^1.0.0" } }, "sha512-9aCZCzB5okKHVnUXivo+BXVzZz9b0SA4LAmGX60LuCXT7QjNCEHcD/kdmfYg7vAX3g1O+fy4Cpl6xFsWX2H/lQ=="],
+
+    "@codemirror/view": ["@codemirror/view@6.43.11", "", { "dependencies": { "@codemirror/state": "^6.7.0", "crelt": "^1.0.6", "style-mod": "^4.1.0", "w3c-keyname": "^2.2.4" } }, "sha512-2+esucbQX6wB2JYi1eDvdCPFTA31BN8oSy6xCmk3G6CloV11yOvEjYk+gH7kLrP0MuHG94E8WDhjs5oMiu3+Wg=="],
 
     "@colors/colors": ["@colors/colors@1.5.0", "", {}, "sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ=="],
 
@@ -197,6 +200,8 @@
 
     "@dependents/detective-less": ["@dependents/detective-less@5.0.3", "", { "dependencies": { "gonzales-pe": "^4.3.0", "node-source-walk": "^7.0.1" } }, "sha512-v6oD9Ukp+N7V4n6p5I/+mM5fIohSfkrDSGlFm5w/pYmchvbk+sMIHsLxrFJ5Lnujewj1BzWL0K84d88lwZAMQA=="],
 
+    "@discoveryjs/json-ext": ["@discoveryjs/json-ext@1.1.0", "", {}, "sha512-Xc3VhU02wqZ1HvHRJUwL09HkZSTvidqY5Ya0NXBSYOxAp+Ln9dcJr9fySI+CkONzP3PekQo9WdzCv0PGER/mOA=="],
+
     "@dnd-kit/accessibility": ["@dnd-kit/accessibility@3.1.1", "", { "dependencies": { "tslib": "^2.0.0" }, "peerDependencies": { "react": ">=16.8.0" } }, "sha512-2P+YgaXF+gRsIihwwY1gCsQSYnu9Zyj2py8kY5fFvUM1qm2WA2u639R6YNVfU4GWr+ZM5mqEsfHZZLoRONbemw=="],
 
     "@dnd-kit/core": ["@dnd-kit/core@6.3.1", "", { "dependencies": { "@dnd-kit/accessibility": "^3.1.1", "@dnd-kit/utilities": "^3.2.2", "tslib": "^2.0.0" }, "peerDependencies": { "react": ">=16.8.0", "react-dom": ">=16.8.0" } }, "sha512-xkGBRQQab4RLwgXxoqETICr6S5JlogafbhNsidmrkVv2YRs5MLwpjoF2qpiGjQt8S9AoxtIV603s0GIUpY5eYQ=="],
@@ -205,71 +210,71 @@
 
     "@effect/platform-node-shared": ["@effect/platform-node-shared@4.0.0-beta.70", "", { "dependencies": { "@types/ws": "^8.18.1", "ws": "^8.20.0" }, "peerDependencies": { "effect": "^4.0.0-beta.70" } }, "sha512-3VXuL63IDmq13We+ApRKn2JW3Rb9g5gj1YEmfb8u2b73norur1VsIJ/pRE4qjShevg19dQYi2JsLawSZ6gApug=="],
 
-    "@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
+    "@emnapi/core": ["@emnapi/core@1.11.2", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.2", "tslib": "^2.4.0" } }, "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA=="],
 
-    "@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
+    "@emnapi/runtime": ["@emnapi/runtime@1.11.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA=="],
 
-    "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
+    "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA=="],
 
-    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.0", "", { "os": "aix", "cpu": "ppc64" }, "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA=="],
+    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.2", "", { "os": "aix", "cpu": "ppc64" }, "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ=="],
 
-    "@esbuild/android-arm": ["@esbuild/android-arm@0.28.0", "", { "os": "android", "cpu": "arm" }, "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ=="],
+    "@esbuild/android-arm": ["@esbuild/android-arm@0.28.2", "", { "os": "android", "cpu": "arm" }, "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg=="],
 
-    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.0", "", { "os": "android", "cpu": "arm64" }, "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw=="],
+    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.2", "", { "os": "android", "cpu": "arm64" }, "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A=="],
 
-    "@esbuild/android-x64": ["@esbuild/android-x64@0.28.0", "", { "os": "android", "cpu": "x64" }, "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA=="],
+    "@esbuild/android-x64": ["@esbuild/android-x64@0.28.2", "", { "os": "android", "cpu": "x64" }, "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q=="],
 
-    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q=="],
+    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw=="],
 
-    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ=="],
+    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw=="],
 
-    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.0", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q=="],
+    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw=="],
 
-    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw=="],
+    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg=="],
 
-    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.0", "", { "os": "linux", "cpu": "arm" }, "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw=="],
+    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.2", "", { "os": "linux", "cpu": "arm" }, "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w=="],
 
-    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A=="],
+    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug=="],
 
-    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.0", "", { "os": "linux", "cpu": "ia32" }, "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ=="],
+    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.2", "", { "os": "linux", "cpu": "ia32" }, "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ=="],
 
-    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg=="],
+    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ=="],
 
-    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w=="],
+    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA=="],
 
-    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg=="],
+    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ=="],
 
-    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ=="],
+    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA=="],
 
-    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q=="],
+    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg=="],
 
-    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.0", "", { "os": "linux", "cpu": "x64" }, "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ=="],
+    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.2", "", { "os": "linux", "cpu": "x64" }, "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ=="],
 
-    "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw=="],
+    "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw=="],
 
-    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.0", "", { "os": "none", "cpu": "x64" }, "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw=="],
+    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.2", "", { "os": "none", "cpu": "x64" }, "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw=="],
 
-    "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.0", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g=="],
+    "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.2", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ=="],
 
-    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.0", "", { "os": "openbsd", "cpu": "x64" }, "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA=="],
+    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw=="],
 
-    "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w=="],
+    "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q=="],
 
-    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.0", "", { "os": "sunos", "cpu": "x64" }, "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw=="],
+    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.2", "", { "os": "sunos", "cpu": "x64" }, "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g=="],
 
-    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA=="],
+    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ=="],
 
-    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA=="],
+    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.2", "", { "os": "win32", "cpu": "ia32" }, "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA=="],
 
-    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.0", "", { "os": "win32", "cpu": "x64" }, "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw=="],
+    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.2", "", { "os": "win32", "cpu": "x64" }, "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g=="],
 
-    "@eslint-community/eslint-utils": ["@eslint-community/eslint-utils@4.9.1", "", { "dependencies": { "eslint-visitor-keys": "^3.4.3" }, "peerDependencies": { "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0" } }, "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ=="],
+    "@eslint-community/eslint-utils": ["@eslint-community/eslint-utils@4.10.1", "", { "dependencies": { "eslint-visitor-keys": "^3.4.3" }, "peerDependencies": { "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0" } }, "sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg=="],
 
     "@eslint-community/regexpp": ["@eslint-community/regexpp@4.12.2", "", {}, "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew=="],
 
     "@eslint/config-array": ["@eslint/config-array@0.23.5", "", { "dependencies": { "@eslint/object-schema": "^3.0.5", "debug": "^4.3.1", "minimatch": "^10.2.4" } }, "sha512-Y3kKLvC1dvTOT+oGlqNQ1XLqK6D1HU2YXPc52NmAlJZbMMWDzGYXMiPRJ8TYD39muD/OTjlZmNJ4ib7dvSrMBA=="],
 
-    "@eslint/config-helpers": ["@eslint/config-helpers@0.5.5", "", { "dependencies": { "@eslint/core": "^1.2.1" } }, "sha512-eIJYKTCECbP/nsKaaruF6LW967mtbQbsw4JTtSVkUQc9MneSkbrgPJAbKl9nWr0ZeowV8BfsarBmPpBzGelA2w=="],
+    "@eslint/config-helpers": ["@eslint/config-helpers@0.7.0", "", { "dependencies": { "@eslint/core": "^1.2.1" } }, "sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw=="],
 
     "@eslint/core": ["@eslint/core@1.2.1", "", { "dependencies": { "@types/json-schema": "^7.0.15" } }, "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ=="],
 
@@ -277,17 +282,17 @@
 
     "@eslint/object-schema": ["@eslint/object-schema@3.0.5", "", {}, "sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw=="],
 
-    "@eslint/plugin-kit": ["@eslint/plugin-kit@0.7.1", "", { "dependencies": { "@eslint/core": "^1.2.1", "levn": "^0.4.1" } }, "sha512-rZAP3aVgB9ds9KOeUSL+zZ21hPmo8dh6fnIFwRQj5EAZl9gzR7wxYbYXYysAM8CTqGmUGyp2S4kUdV17MnGuWQ=="],
+    "@eslint/plugin-kit": ["@eslint/plugin-kit@0.7.3", "", { "dependencies": { "@eslint/core": "^1.2.1", "levn": "^0.4.1" } }, "sha512-IkO+/KEUvwbVpiURZg+P7zF74z5Jxe0UgJxVni+RtoHQ6IZieXaO02kmadomap/q+l6bc/jdPGGqTjhuZnuz1Q=="],
 
     "@exodus/bytes": ["@exodus/bytes@1.15.1", "", { "peerDependencies": { "@noble/hashes": "^1.8.0 || ^2.0.0" }, "optionalPeers": ["@noble/hashes"] }, "sha512-S6mL0yNB/Abt9Ei4tq8gDhcczc4S3+vQ4ra7vxnAf+YHC02srtqxKKZghx2Dq6p0e66THKwR6r8N6P95wEty7Q=="],
 
-    "@floating-ui/core": ["@floating-ui/core@1.7.5", "", { "dependencies": { "@floating-ui/utils": "^0.2.11" } }, "sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ=="],
+    "@floating-ui/core": ["@floating-ui/core@1.8.0", "", { "dependencies": { "@floating-ui/utils": "^0.2.12" } }, "sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ=="],
 
-    "@floating-ui/dom": ["@floating-ui/dom@1.7.6", "", { "dependencies": { "@floating-ui/core": "^1.7.5", "@floating-ui/utils": "^0.2.11" } }, "sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ=="],
+    "@floating-ui/dom": ["@floating-ui/dom@1.8.0", "", { "dependencies": { "@floating-ui/core": "^1.8.0", "@floating-ui/utils": "^0.2.12" } }, "sha512-yXSrzeHZBTZadLOlfyhCkJHNeLJnHRnRInwdZ40L7ZiaAtrBwoYlsDrX3v5zB1Utk7CLfzcOVnVVWoXEky7Ceg=="],
 
-    "@floating-ui/utils": ["@floating-ui/utils@0.2.11", "", {}, "sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg=="],
+    "@floating-ui/utils": ["@floating-ui/utils@0.2.12", "", {}, "sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww=="],
 
-    "@fontsource-variable/inter": ["@fontsource-variable/inter@5.2.8", "", {}, "sha512-kOfP2D+ykbcX/P3IFnokOhVRNoTozo5/JxhAIVYLpea/UBmCQ/YWPBfWIDuBImXX/15KH+eKh4xpEUyS2sQQGQ=="],
+    "@fontsource-variable/inter": ["@fontsource-variable/inter@5.3.0", "", {}, "sha512-OupL48va4JNofb97w6NYeF9S7W/kHNKM0Er8Dem5nqi4jeOLrVJDoE8tZEpnMJmtkvNbB1EIPPwHcdkF6b1oUA=="],
 
     "@humanfs/core": ["@humanfs/core@0.19.2", "", { "dependencies": { "@humanfs/types": "^0.15.0" } }, "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA=="],
 
@@ -371,23 +376,23 @@
 
     "@jridgewell/resolve-uri": ["@jridgewell/resolve-uri@3.1.2", "", {}, "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw=="],
 
-    "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.5", "", {}, "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og=="],
+    "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.6.0", "", {}, "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw=="],
 
     "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
 
-    "@jscpd/badge-reporter": ["@jscpd/badge-reporter@4.0.5", "", { "dependencies": { "badgen": "^3.2.3", "colors": "^1.4.0", "fs-extra": "^11.2.0" } }, "sha512-SLVhP00R9lkQ//Ivaanfm7k0L9sewpBven670kk1uGec2SWUOa7MVQcuad/TV59KEZ73UIC1lXvi6O9hAnbpUw=="],
+    "@jscpd/badge-reporter": ["@jscpd/badge-reporter@4.2.5", "", { "dependencies": { "badgen": "^3.2.3", "colors": "^1.4.0", "fs-extra": "^11.2.0" } }, "sha512-ktXrjPeRaRyUDktxTroSA2/w5sshXpQplWkUuq/e6XqEpKBSbGEnwZLIaegSijOrMwIcCXPQ9k4feXIz5eVJNA=="],
 
-    "@jscpd/core": ["@jscpd/core@4.0.5", "", { "dependencies": { "eventemitter3": "^5.0.1" } }, "sha512-Udvym21nWzxjYRVXwwpYNBqZ6b50QV2zHN3fFNzOPPg4cfQVYOZerILB7xNDUsXHC1PCr/N52Tq3q7AElvjWWA=="],
+    "@jscpd/core": ["@jscpd/core@4.2.5", "", { "dependencies": { "eventemitter3": "^5.0.1" } }, "sha512-Esf2deHxaoNEjePwf2jqP6Urzj+BAOsJVPFLbnnSsV+q7rLNMcn0UEEoKBXIOOt4qMkrkhl9DfwpMyPPOr6GkQ=="],
 
-    "@jscpd/finder": ["@jscpd/finder@4.0.5", "", { "dependencies": { "@jscpd/core": "4.0.5", "@jscpd/tokenizer": "4.0.5", "blamer": "^1.0.6", "bytes": "^3.1.2", "cli-table3": "^0.6.5", "colors": "^1.4.0", "fast-glob": "^3.3.2", "fs-extra": "^11.2.0", "markdown-table": "^2.0.0", "pug": "^3.0.3" } }, "sha512-/2VkRoVrrfya+51sitZo5I9MdwsRaPKB8X3L3khAYoHFXk4L/mUuG81RmGazDHjUIGg22ItlkQtwzorNZ2+aPw=="],
+    "@jscpd/finder": ["@jscpd/finder@4.3.0", "", { "dependencies": { "@jscpd/core": "4.2.5", "@jscpd/tokenizer": "4.2.6", "blamer": "^1.0.6", "bytes": "^3.1.2", "cli-table3": "^0.6.5", "colors": "^1.4.0", "fast-glob": "^3.3.2", "fs-extra": "^11.3.6", "markdown-table": "^2.0.0", "pug": "^3.0.4" } }, "sha512-MnEUyier0D6P9zRIhAlBoyJUV8BYT6d5FDZuhR7X23FdZAgdMV8yaRRO1Q1EveK9/ReA6WVHT1HE8F15rij71A=="],
 
-    "@jscpd/html-reporter": ["@jscpd/html-reporter@4.0.5", "", { "dependencies": { "colors": "1.4.0", "fs-extra": "^11.2.0", "pug": "^3.0.3" } }, "sha512-drK2J8KyPIW9wvaElSIobZFp4dBO9GA++JW4gx3oihvLdDSp8qSo/CNqH47Dw0XkjQTxND3j/+Wz5JWvYRBgFQ=="],
+    "@jscpd/html-reporter": ["@jscpd/html-reporter@4.2.5", "", { "dependencies": { "colors": "1.4.0", "fs-extra": "^11.2.0", "pug": "^3.0.4" } }, "sha512-zMMIKbvi43dMgeNeHXlHQy1ovf+KJrzNlUubaBvCAVatqP23ksW8d3fmsevIQG9mMMTH0D1xOz+SxUn1FREOPg=="],
 
-    "@jscpd/tokenizer": ["@jscpd/tokenizer@4.0.5", "", { "dependencies": { "@jscpd/core": "4.0.5", "reprism": "^0.0.11", "spark-md5": "^3.0.2" } }, "sha512-WzRujQtN5WedxZVDKuoanxmKAFrxcLrHpcA6kaM4z8AhGtWXZ325yseqgL5TZ8OK7Auwu7kQLlqhfk05fGYG7A=="],
+    "@jscpd/tokenizer": ["@jscpd/tokenizer@4.2.6", "", { "dependencies": { "@jscpd/core": "4.2.5", "spark-md5": "^3.0.2" } }, "sha512-/eyFjINWLs2mrBTU4H681bs855r5oRyl1O3mZxcd7TpL1JIG85a7pps0RkRPAe9c/2KcjVCc82HbhOz86M0n5g=="],
 
     "@lezer/common": ["@lezer/common@1.5.2", "", {}, "sha512-sxQE460fPZyU3sdc8lafxiPwJHBzZRy/udNFynGQky1SePYBdhkBl1kOagA9uT3pxR8K09bOrmTUqA9wb/PjSQ=="],
 
-    "@lezer/css": ["@lezer/css@1.3.3", "", { "dependencies": { "@lezer/common": "^1.2.0", "@lezer/highlight": "^1.0.0", "@lezer/lr": "^1.3.0" } }, "sha512-RzBo8r+/6QJeow7aPHIpGVIH59xTcJXp399820gZoMo9noQDRVpJLheIBUicYwKcsbOYoBRoLZlf2720dG/4Tg=="],
+    "@lezer/css": ["@lezer/css@1.3.6", "", { "dependencies": { "@lezer/common": "^1.2.0", "@lezer/highlight": "^1.0.0", "@lezer/lr": "^1.3.0" } }, "sha512-YJE78Wcg+zX8f10hiHWQ4Az48Qr/c13eId0VtRQYLBpxHDmDeSrXIlkbl+fJGW42rWC/uoUco9mhBZeVWP/A1g=="],
 
     "@lezer/highlight": ["@lezer/highlight@1.2.3", "", { "dependencies": { "@lezer/common": "^1.3.0" } }, "sha512-qXdH7UqTvGfdVBINrgKhDsVTJTxactNNxLk7+UMwZhU13lMHaOBlJe9Vqp907ya56Y3+ed2tlqzys7jDkTmW0g=="],
 
@@ -399,9 +404,9 @@
 
     "@lezer/lr": ["@lezer/lr@1.4.10", "", { "dependencies": { "@lezer/common": "^1.0.0" } }, "sha512-rnCpTIBafOx4mRp43xOxDJbFipJm/c0cia/V5TiGlhmMa+wsSdoGmUN3w5Bqrks/09Q/D4tNAmWaT8p6NRi77A=="],
 
-    "@lezer/markdown": ["@lezer/markdown@1.6.3", "", { "dependencies": { "@lezer/common": "^1.5.0", "@lezer/highlight": "^1.0.0" } }, "sha512-jpGm5Ps+XErS+xA4urw7ogEGkeZOahVQF21Z6oECF0sj+2liwZopd2+I8uH5I/vZsRuuze3OxBREIANLf6KKUw=="],
+    "@lezer/markdown": ["@lezer/markdown@1.7.2", "", { "dependencies": { "@lezer/common": "^1.5.0", "@lezer/highlight": "^1.0.0" } }, "sha512-iTkYvoVcKt3WkeL7qUDyXHONZEwLio4wj8KTNi2dnjQEXBZKMV63BpQrPqfsM+OkvuRbiSTAcycYAsQzLhRNoQ=="],
 
-    "@marijn/find-cluster-break": ["@marijn/find-cluster-break@1.0.2", "", {}, "sha512-l0h88YhZFyKdXIFNfSWpyjStDjGHwZ/U7iobcK1cQQD8sejsONdQtTVU+1wVN1PBw40PiiHB1vA5S7VTfQiP9g=="],
+    "@marijn/find-cluster-break": ["@marijn/find-cluster-break@1.0.4", "", {}, "sha512-Wy0V7+SGUjnF9/TkiM1hKVDPj7jKXduPNboMVtHTA8dySMURWqfg/JZ9E2Sq8JgSJmkl7k7Qe9FLeMSrSraWmQ=="],
 
     "@modelcontextprotocol/client": ["@modelcontextprotocol/client@2.0.0", "", { "dependencies": { "@modelcontextprotocol/core": "2.0.0", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "jose": "^6.1.3", "pkce-challenge": "^5.0.0", "zod": "^4.2.0" } }, "sha512-8f1OghQ2rjzIOfqgUCP+8GiUWqRs89njoWLNqAe8kWmDePv3s1fZXseej+QXemssEuuOvLLmLO/kqM3IQHtISw=="],
 
@@ -421,7 +426,7 @@
 
     "@msgpackr-extract/msgpackr-extract-win32-x64": ["@msgpackr-extract/msgpackr-extract-win32-x64@3.0.4", "", { "os": "win32", "cpu": "x64" }, "sha512-CmCXPQrkbwExx3j946/PtHWHbYJiCRBRDl4BlkRQcJB/YOwQxJRTpoo7aTsortjgoJ1x7opzTSxn7C+ASSLVjQ=="],
 
-    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.4", "", { "dependencies": { "@tybys/wasm-util": "^0.10.1" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow=="],
+    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.2.3", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.4", "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.4" } }, "sha512-UMduMbqO5s5zF2NkNacMT/yK5Y5QiKvWr2+50bzIIxFDwVJ2h49b+oyjaCGPhJxd2/gC2x39EHv/gHVuu36x2Q=="],
 
     "@nodelib/fs.scandir": ["@nodelib/fs.scandir@2.1.5", "", { "dependencies": { "@nodelib/fs.stat": "2.0.5", "run-parallel": "^1.1.9" } }, "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g=="],
 
@@ -429,161 +434,175 @@
 
     "@nodelib/fs.walk": ["@nodelib/fs.walk@1.2.8", "", { "dependencies": { "@nodelib/fs.scandir": "2.1.5", "fastq": "^1.6.0" } }, "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg=="],
 
-    "@oxc-parser/binding-android-arm-eabi": ["@oxc-parser/binding-android-arm-eabi@0.128.0", "", { "os": "android", "cpu": "arm" }, "sha512-aca6ZvzmCBUGOANQRiRQRZuRKYI3ENhcit6GisnknOOmcezfQc7xJ4dxlPU7MV7mOvrC7RNR1u3LAD7xyaiCxA=="],
+    "@opentelemetry/api": ["@opentelemetry/api@1.9.1", "", {}, "sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q=="],
+
+    "@opentelemetry/api-logs": ["@opentelemetry/api-logs@0.220.0", "", { "dependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-CmVa4ImJ+ynfrPMNaAXHET6Bhb44SwzmfyVJFq9ni2jgXJR/l7C6gfVFddNmHP+ZOkP9cf4f9DBe68qVLTHc9w=="],
+
+    "@opentelemetry/core": ["@opentelemetry/core@2.11.0", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.0.0 <1.10.0" } }, "sha512-7YP44XH0tV6+Mb54x2YGf84i7yi+31MBZlE8JwvozkxyTvXbSp10X7cI7YE49ChJ3shMJoBmCJF3+1QFBJctGA=="],
+
+    "@opentelemetry/instrumentation": ["@opentelemetry/instrumentation@0.220.0", "", { "dependencies": { "@opentelemetry/api-logs": "0.220.0", "import-in-the-middle": "^3.0.0", "require-in-the-middle": "^8.0.0" }, "peerDependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-xQx3E2WxP1mDvKzxLxX+CTCtNLa560YJZ3087qYHerl2YmiKpv7AH+dAy7vmx+eVrZ5BwhfWUAVoKOoxCNHcpw=="],
+
+    "@opentelemetry/resources": ["@opentelemetry/resources@2.11.0", "", { "dependencies": { "@opentelemetry/core": "2.11.0", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-Ie7+8q8MDF4FAEQCKVMTx3ReUvxiIAgIiiW3c9JdmP8+HMcDy20puT+AHjexnExgnbvBxjQ9fjkFDWrikJ2jQA=="],
+
+    "@opentelemetry/sdk-trace": ["@opentelemetry/sdk-trace@2.11.0", "", { "dependencies": { "@opentelemetry/core": "2.11.0", "@opentelemetry/resources": "2.11.0", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-fFnTqGm8/G73GQVnxYi7LXa1ZVYEUvgL6XI1LpvV0bPC7WQ/ZGgKxCSl8FnlZBKto9JHHEFTO6s6CUpvvtwFrA=="],
+
+    "@opentelemetry/sdk-trace-base": ["@opentelemetry/sdk-trace-base@2.11.0", "", { "dependencies": { "@opentelemetry/core": "2.11.0", "@opentelemetry/resources": "2.11.0", "@opentelemetry/sdk-trace": "2.11.0", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-H19x/TX/LZdqiYOjM7fqtSxwlplC5pgelavqbQdHbhdq0q/AI/TGkM2dfGuuynTXmJPeF2HoZVoPDu+TGoW78A=="],
+
+    "@opentelemetry/semantic-conventions": ["@opentelemetry/semantic-conventions@1.43.0", "", {}, "sha512-eSYWTm620tTk45EKSedaUL8MFYI8hW164hIXsgIHyxu3VobUB3fFCu5t0hQby6OoWRPsG1KkKUG2M5UadiLiVg=="],
 
-    "@oxc-parser/binding-android-arm64": ["@oxc-parser/binding-android-arm64@0.128.0", "", { "os": "android", "cpu": "arm64" }, "sha512-BbeDmuohoJ7Rz/it5wnkj69i/OsCPS3Z51nLEzwO/Y6YshtC4JU+15oNwhY8v4LRKRYclRc7ggOikwrsJ/eOEQ=="],
+    "@oxc-parser/binding-android-arm-eabi": ["@oxc-parser/binding-android-arm-eabi@0.147.0", "", { "os": "android", "cpu": "arm" }, "sha512-fOtoGvIoirkvxQVw9J1WJPxz571XPgLsPf9uhRD+PJteUnvrJHMDmK9pw2yZEGGyismtRoEsp+JcXUdF/JDMDw=="],
 
-    "@oxc-parser/binding-darwin-arm64": ["@oxc-parser/binding-darwin-arm64@0.128.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-tRUHPt80417QmvNpoSslJT1VY8NUbWdrWR+L14Zn+RbOTcaqB8E6PYE/ZGN8jjWBzqporiA/H4MfO50ew/NCNA=="],
+    "@oxc-parser/binding-android-arm64": ["@oxc-parser/binding-android-arm64@0.147.0", "", { "os": "android", "cpu": "arm64" }, "sha512-emjQHOYJaomo4ykaXQ1EItunr/I94Nk01oqBmU4dSkKSTupIDx6OysVDf2e8Eytm77rb+4ZxzgElyWP7rcEX7A=="],
 
-    "@oxc-parser/binding-darwin-x64": ["@oxc-parser/binding-darwin-x64@0.128.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-rWI2Hb1Nt3U/vKsjyNvZzDC8i/l144U20DKjhzaTmwIhIiSRGeroPWWiImwypmKLqrw8GuIixbWJkpGWLbkzrQ=="],
+    "@oxc-parser/binding-darwin-arm64": ["@oxc-parser/binding-darwin-arm64@0.147.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-kXvBPJL7RmDPJ2mze/vXPPVQimCDtFr9OFLjf7dyhV5Dx64cgcXh9KKrA1sMWvCObvJll9CZZUO0FBlFwD0l6A=="],
 
-    "@oxc-parser/binding-freebsd-x64": ["@oxc-parser/binding-freebsd-x64@0.128.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-hhpdVMaNCLgQxjgNPeeFzSeJMmZPc5lKfv0NGSI3egZq9EdnEGqeC8JsYsQjK7PoQgbvZ17xlj0SO5ziH5Obkg=="],
+    "@oxc-parser/binding-darwin-x64": ["@oxc-parser/binding-darwin-x64@0.147.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-mgFF8pLU6R64LbT27lSrtVRspVC/3IcZ0qyIikzmi78Y3Ik2OPnlAHHI0UEBRcC3qmNgtjaef7zkFt7/uPxIcw=="],
 
-    "@oxc-parser/binding-linux-arm-gnueabihf": ["@oxc-parser/binding-linux-arm-gnueabihf@0.128.0", "", { "os": "linux", "cpu": "arm" }, "sha512-093zNw0zZ/e/obML+rhlSdmnzR0mVZluPcAkxunEc5E3F0yBVsFn24Y1ILfsEte11Ud041qn/gp2OJ1jxNqUng=="],
+    "@oxc-parser/binding-freebsd-x64": ["@oxc-parser/binding-freebsd-x64@0.147.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-v38aiF11qufOTBcCAKL4skgQf0zJ4NEvRlivq7B5kHrlyvjCLjvNrMtNWDTz1SDUL6/xVsJRmLDxv2e+Cp4oWw=="],
 
-    "@oxc-parser/binding-linux-arm-musleabihf": ["@oxc-parser/binding-linux-arm-musleabihf@0.128.0", "", { "os": "linux", "cpu": "arm" }, "sha512-fq7DmKmfC+dvD97IXrgbph6Jzwe0EDu+PYMofmzZ6fv5X1k9vtaqLpDGMuICO9MmUnyKAQmVl+wIv2RNy4Dz8g=="],
+    "@oxc-parser/binding-linux-arm-gnueabihf": ["@oxc-parser/binding-linux-arm-gnueabihf@0.147.0", "", { "os": "linux", "cpu": "arm" }, "sha512-AeIiBbwUaP0H1+4/qGW9l5qHecS/+XA5iMuieVcGb1T+tyc2dVGspFW13BWk/XrLsiGP/CiDJTJqAPLLCzZHkw=="],
 
-    "@oxc-parser/binding-linux-arm64-gnu": ["@oxc-parser/binding-linux-arm64-gnu@0.128.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-Xvm48jJah8TlIrURIjNOP/gNiGe6aKvCB+r06VliflFo8Kq7VOLE8PxtgShJzZIqubrgdMdYfvuPPozn7F6MbQ=="],
+    "@oxc-parser/binding-linux-arm-musleabihf": ["@oxc-parser/binding-linux-arm-musleabihf@0.147.0", "", { "os": "linux", "cpu": "arm" }, "sha512-/41MKPW4RgPY4DJco0NCF0RYX3IMZaVlRNMNzvhaxRavc7tN3Txm+qllZbh0aMRs0VHdgUlbI8TcAOiTai4TKg=="],
 
-    "@oxc-parser/binding-linux-arm64-musl": ["@oxc-parser/binding-linux-arm64-musl@0.128.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-M7iwBGmYJTx+pKOYFjI0buop4gJvlmcVzFGaXPt21DKpQkbQZG1f63Yg7LloIYT/t9yLxCw0Lhfx/RFlAlMSjA=="],
+    "@oxc-parser/binding-linux-arm64-gnu": ["@oxc-parser/binding-linux-arm64-gnu@0.147.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-bmpw/RPhVXgZbtb3xBDuwW5s8+LvZYdqcDSX/sP2ltL77aTio3DP/B5ZTwwgoJ6Mr9vJs4RrmgEKW9XkLNUU1g=="],
 
-    "@oxc-parser/binding-linux-ppc64-gnu": ["@oxc-parser/binding-linux-ppc64-gnu@0.128.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-21LGNIZb1Pcfk5/EGsqabrxv4yqQOWis1407JJrClS7XpFCrbvr74YAB1V+m54cYbwvO6UWwQqS4WecxiyfCRg=="],
+    "@oxc-parser/binding-linux-arm64-musl": ["@oxc-parser/binding-linux-arm64-musl@0.147.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-gd7VX/FDVOw6mjQcu45iIcp4QkgybgJwh3a0OFG2NxmPCj628mQWD96QGu1kK8+mZF9qK4b/gIEyC63vQoB7+Q=="],
 
-    "@oxc-parser/binding-linux-riscv64-gnu": ["@oxc-parser/binding-linux-riscv64-gnu@0.128.0", "", { "os": "linux", "cpu": "none" }, "sha512-gyHjOTFpg9bTTYjxPmQirvufb89+VdZwVfcMtAUyPr6F5H8ZswvCQshK4qOW+Q+2Xyb33hduRgY/eFHJQjU/vQ=="],
+    "@oxc-parser/binding-linux-ppc64-gnu": ["@oxc-parser/binding-linux-ppc64-gnu@0.147.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-HnAzcfki7dSUNHf510Q2NmbJlz8Ys7rn8l9l588Pkx0tYe1BHLZnmELIgqizJ4WPhHGSwN8Ce+B/menVxS3odA=="],
 
-    "@oxc-parser/binding-linux-riscv64-musl": ["@oxc-parser/binding-linux-riscv64-musl@0.128.0", "", { "os": "linux", "cpu": "none" }, "sha512-X6Q2oKUrP5GyDd2xniuEBLk6aFQCZ97W2+aVXGgJXdjx5t4/oFuA9ri0wLOUrBIX+qdSuK581snMBio4z910eA=="],
+    "@oxc-parser/binding-linux-riscv64-gnu": ["@oxc-parser/binding-linux-riscv64-gnu@0.147.0", "", { "os": "linux", "cpu": "none" }, "sha512-qlkOL6wT44U+fT5s/+sR6Shx0OdwvQF83JyIPZUxG/ovqZF5/7atOtjH+JPZ5/7ATQLbFBBSmghcy/+2NVB/ew=="],
 
-    "@oxc-parser/binding-linux-s390x-gnu": ["@oxc-parser/binding-linux-s390x-gnu@0.128.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-BdzTmqxfxoYkpgokoLaSnOX6T+R3/goL42klre2tnG+kHbG2TXS0VN+P5BPofH1axdKOHy5ei4ENZrjmCOt2lA=="],
+    "@oxc-parser/binding-linux-riscv64-musl": ["@oxc-parser/binding-linux-riscv64-musl@0.147.0", "", { "os": "linux", "cpu": "none" }, "sha512-DlefD7L7sMXs/3hIBH23Egk0phj8kG0SA81dVGOQ3S1ekjOlmTLH2E+F2Thwfh1slKx6aH+lNc5fQYAw0GU7/g=="],
 
-    "@oxc-parser/binding-linux-x64-gnu": ["@oxc-parser/binding-linux-x64-gnu@0.128.0", "", { "os": "linux", "cpu": "x64" }, "sha512-OO1nW2Q7sSYYvJZpDHdvyFSdRaVcQqRijZSSmWVMqFxPYy8cEF45zJ9fcdIYuzIT3jYq6YRhEFm/VMWNWhE22Q=="],
+    "@oxc-parser/binding-linux-s390x-gnu": ["@oxc-parser/binding-linux-s390x-gnu@0.147.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-Xqpagk/031IvZ4svrk2FF01YEqM/iN3MJV3SVZadKg/CsGlDCGoREqKHXYnoV5+8SfGe/m6RM1szXFLusTu/Uw=="],
 
-    "@oxc-parser/binding-linux-x64-musl": ["@oxc-parser/binding-linux-x64-musl@0.128.0", "", { "os": "linux", "cpu": "x64" }, "sha512-4NehAe404MRdoZVS9DW8C5XbJwbXIc/KfVlYdpi5vE4081zc9Y0YzKVqyOYj/Puye7/Do+ohaONBFWlEHYl9hw=="],
+    "@oxc-parser/binding-linux-x64-gnu": ["@oxc-parser/binding-linux-x64-gnu@0.147.0", "", { "os": "linux", "cpu": "x64" }, "sha512-QioQOeUbI4ATUr0S2z88uA3Cds2R3Mm5Ge7U8XNYtlTb2GJF3rWlcj70z0AJhhOlbdm0YgVjqPBldUNbFylDIg=="],
 
-    "@oxc-parser/binding-openharmony-arm64": ["@oxc-parser/binding-openharmony-arm64@0.128.0", "", { "os": "none", "cpu": "arm64" }, "sha512-kVbqgW9xLL8bh8oc7aYOJilRKXE5G33+tE0jan+duo/9OriaFRpijcCwT2waWs2oqYROYq0GlE7/p3ywoshVeg=="],
+    "@oxc-parser/binding-linux-x64-musl": ["@oxc-parser/binding-linux-x64-musl@0.147.0", "", { "os": "linux", "cpu": "x64" }, "sha512-NXy1tv/OdC+pPTwf9RiCZWPK53V/Xq/2cjSnjOSyKopajdaDqMIkgtDY+jXZemp2e8px5FeWfY2L2LwhKZQovg=="],
 
-    "@oxc-parser/binding-wasm32-wasi": ["@oxc-parser/binding-wasm32-wasi@0.128.0", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-L38ojghJYHmgiz6fJd7jwLB/ESDBpB02NdFxh+smqVM6P2anCEvHn0jhaSrt5eVNR1Ak8+moOeftUlofeyvniA=="],
+    "@oxc-parser/binding-openharmony-arm64": ["@oxc-parser/binding-openharmony-arm64@0.147.0", "", { "os": "none", "cpu": "arm64" }, "sha512-GpGWZ6oKz4bjCWW9Mz5pCaGPyk2Aaze6zEoaslIQqpSLtpx5pXj/ap5gUNb5Jn2LIbqWyjkGLX9yv3NMuNcBVQ=="],
 
-    "@oxc-parser/binding-win32-arm64-msvc": ["@oxc-parser/binding-win32-arm64-msvc@0.128.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-xgvO35GyHBtjlQ5AEpaYr7Rll1rvY7zqIhT6ty8E3ezBW2J1SFLjIDEvI/tcgDg6oaseDAqVcM+jU1HuCekgZw=="],
+    "@oxc-parser/binding-wasm32-wasi": ["@oxc-parser/binding-wasm32-wasi@0.132.0", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-TlbMppxJI5CjWDes0QaP6G3aneVg1yikBu5QYI+DUShF9WDL66ccgKFNNGmi/Wybtszw6hxwAvv76T4DaPKnHw=="],
 
-    "@oxc-parser/binding-win32-ia32-msvc": ["@oxc-parser/binding-win32-ia32-msvc@0.128.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-OY+3eM2SN72prHKRB22mPz8o5A/7dJ+f5DFLBVvggyZhEaNDAH9IB+ElMjmOkOIwf5MDCUAowCK7pAncNxzpBA=="],
+    "@oxc-parser/binding-win32-arm64-msvc": ["@oxc-parser/binding-win32-arm64-msvc@0.147.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-a8mlt7CC8z7LUdCfaxhff4kCd+vSjE+NEFL0cxA8ukfuSnvAto/pWTjytW4BuVLnQGcCVdHJwcRKOfs++H+tjw=="],
 
-    "@oxc-parser/binding-win32-x64-msvc": ["@oxc-parser/binding-win32-x64-msvc@0.128.0", "", { "os": "win32", "cpu": "x64" }, "sha512-NE9ny+cPUCCObXa0IKLfj0tCdPd7pe/dz9ZpkxpUOymB3miNeMPybdlYYTBSGJUalMWeBM85/4JcCErCNTqOXw=="],
+    "@oxc-parser/binding-win32-ia32-msvc": ["@oxc-parser/binding-win32-ia32-msvc@0.147.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-M5ViVDBcFLnl2632AuuWuP35zEL5oikK1jTx8r3+902VEDeSNHxFZAB6RZyfZ7MU6Oi5QTOG8MmMkIeHsudSaw=="],
 
-    "@oxc-project/types": ["@oxc-project/types@0.127.0", "", {}, "sha512-aIYXQBo4lCbO4z0R3FHeucQHpF46l2LbMdxRvqvuRuW2OxdnSkcng5B8+K12spgLDj93rtN3+J2Vac/TIO+ciQ=="],
+    "@oxc-parser/binding-win32-x64-msvc": ["@oxc-parser/binding-win32-x64-msvc@0.147.0", "", { "os": "win32", "cpu": "x64" }, "sha512-DUaE13OwnUSlHpLZNcC/nuT10ivlWqc5EZgsfgXuAmWYw0r3nDxGeLD1zlGwYwIgVk1/ZMAxoXpV+05stvbHaA=="],
 
-    "@oxc-resolver/binding-android-arm-eabi": ["@oxc-resolver/binding-android-arm-eabi@11.19.1", "", { "os": "android", "cpu": "arm" }, "sha512-aUs47y+xyXHUKlbhqHUjBABjvycq6YSD7bpxSW7vplUmdzAlJ93yXY6ZR0c1o1x5A/QKbENCvs3+NlY8IpIVzg=="],
+    "@oxc-project/types": ["@oxc-project/types@0.148.0", "", {}, "sha512-Nm4s/jB+4FpFsPhWGEC4h7rzksesmtnMXomo6rCMcg/b8zLQuOziRgkCS1fxDCXOlJB/6Q8oABOZ/OP6RIPj9A=="],
 
-    "@oxc-resolver/binding-android-arm64": ["@oxc-resolver/binding-android-arm64@11.19.1", "", { "os": "android", "cpu": "arm64" }, "sha512-oolbkRX+m7Pq2LNjr/kKgYeC7bRDMVTWPgxBGMjSpZi/+UskVo4jsMU3MLheZV55jL6c3rNelPl4oD60ggYmqA=="],
+    "@oxc-resolver/binding-android-arm-eabi": ["@oxc-resolver/binding-android-arm-eabi@11.24.2", "", { "os": "android", "cpu": "arm" }, "sha512-y09e0L0SRI2OA2tUIrjBgoV3eH5hvUKXNkJqXmNo5V2WxIjyC7I7aJfRLMEVpA8yi95f90gFDvO0VMgrDw+vwA=="],
 
-    "@oxc-resolver/binding-darwin-arm64": ["@oxc-resolver/binding-darwin-arm64@11.19.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-nUC6d2i3R5B12sUW4O646qD5cnMXf2oBGPLIIeaRfU9doJRORAbE2SGv4eW6rMqhD+G7nf2Y8TTJTLiiO3Q/dQ=="],
+    "@oxc-resolver/binding-android-arm64": ["@oxc-resolver/binding-android-arm64@11.24.2", "", { "os": "android", "cpu": "arm64" }, "sha512-cl4icWaZFnLdg8m6qtnh5rBMuGbxc/ptStFHLeCNwr+2cZjkjNwQu/jYRS0CHlnPecOJMpuS5M6/BH+0J/YkEg=="],
 
-    "@oxc-resolver/binding-darwin-x64": ["@oxc-resolver/binding-darwin-x64@11.19.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-cV50vE5+uAgNcFa3QY1JOeKDSkM/9ReIcc/9wn4TavhW/itkDGrXhw9jaKnkQnGbjJ198Yh5nbX/Gr2mr4Z5jQ=="],
+    "@oxc-resolver/binding-darwin-arm64": ["@oxc-resolver/binding-darwin-arm64@11.24.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-At29QEMF6HajbQvgY8K6OXnHD1x9rad74xBEfmCB6ZqCGsdq75aK7tOYcTbOanMy8qdIBrfL3SMr3p/lfSlb9w=="],
 
-    "@oxc-resolver/binding-freebsd-x64": ["@oxc-resolver/binding-freebsd-x64@11.19.1", "", { "os": "freebsd", "cpu": "x64" }, "sha512-xZOQiYGFxtk48PBKff+Zwoym7ScPAIVp4c14lfLxizO2LTTTJe5sx9vQNGrBymrf/vatSPNMD4FgsaaRigPkqw=="],
+    "@oxc-resolver/binding-darwin-x64": ["@oxc-resolver/binding-darwin-x64@11.24.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-A5Kqr1EUj4oIL5CF4WRssq/o5P0Y11cwoFouMRmQ7YnC/A8V93nv1nb7aSU8HwcgmXropjLNkVTl4MN87cu28Q=="],
 
-    "@oxc-resolver/binding-linux-arm-gnueabihf": ["@oxc-resolver/binding-linux-arm-gnueabihf@11.19.1", "", { "os": "linux", "cpu": "arm" }, "sha512-lXZYWAC6kaGe/ky2su94e9jN9t6M0/6c+GrSlCqL//XO1cxi5lpAhnJYdyrKfm0ZEr/c7RNyAx3P7FSBcBd5+A=="],
+    "@oxc-resolver/binding-freebsd-x64": ["@oxc-resolver/binding-freebsd-x64@11.24.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-R5xkRBRRz7ceH/P5Jrc6G7FmdUdgpLYyESFAUDVTNQ9K0sGPxcp4ljiwEwEqsvNcQ4sYbMRrWcHHBCu7ksAJVw=="],
 
-    "@oxc-resolver/binding-linux-arm-musleabihf": ["@oxc-resolver/binding-linux-arm-musleabihf@11.19.1", "", { "os": "linux", "cpu": "arm" }, "sha512-veG1kKsuK5+t2IsO9q0DErYVSw2azvCVvWHnfTOS73WE0STdLLB7Q1bB9WR+yHPQM76ASkFyRbogWo1GR1+WbQ=="],
+    "@oxc-resolver/binding-linux-arm-gnueabihf": ["@oxc-resolver/binding-linux-arm-gnueabihf@11.24.2", "", { "os": "linux", "cpu": "arm" }, "sha512-k/RuYL4L/R58IBn3wT5ma3Wh4k62bp1eYCFRWCmMsasUOqL+H6sW0VGFadEzKWXFFlz+2uIMoeMk9ySSZJHgbg=="],
 
-    "@oxc-resolver/binding-linux-arm64-gnu": ["@oxc-resolver/binding-linux-arm64-gnu@11.19.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-heV2+jmXyYnUrpUXSPugqWDRpnsQcDm2AX4wzTuvgdlZfoNYO0O3W2AVpJYaDn9AG4JdM6Kxom8+foE7/BcSig=="],
+    "@oxc-resolver/binding-linux-arm-musleabihf": ["@oxc-resolver/binding-linux-arm-musleabihf@11.24.2", "", { "os": "linux", "cpu": "arm" }, "sha512-bnHAak3ujYfH5pKk4NieFNbvYvernfoQDgwLddbZ3OtMYrem87/qjlA+u+aKG0oZcqSLGCful/6/CEA+aeAgaA=="],
 
-    "@oxc-resolver/binding-linux-arm64-musl": ["@oxc-resolver/binding-linux-arm64-musl@11.19.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-jvo2Pjs1c9KPxMuMPIeQsgu0mOJF9rEb3y3TdpsrqwxRM+AN6/nDDwv45n5ZrUnQMsdBy5gIabioMKnQfWo9ew=="],
+    "@oxc-resolver/binding-linux-arm64-gnu": ["@oxc-resolver/binding-linux-arm64-gnu@11.24.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-vDT3KHgzYp47gmtNOqL2VNhCyl5Zv643eyxm//A68J8DeUGXrvD1pZFiaT4jSfe+RInfnn1R2yVHye4enx6RnA=="],
 
-    "@oxc-resolver/binding-linux-ppc64-gnu": ["@oxc-resolver/binding-linux-ppc64-gnu@11.19.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-vLmdNxWCdN7Uo5suays6A/+ywBby2PWBBPXctWPg5V0+eVuzsJxgAn6MMB4mPlshskYbppjpN2Zg83ArHze9gQ=="],
+    "@oxc-resolver/binding-linux-arm64-musl": ["@oxc-resolver/binding-linux-arm64-musl@11.24.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-+kMlQvbzfyEYtu5FcjE4p+ttBLpKW4d/AsAsuE69BxV6V4twZJeIQZFfD8gh/wqglY0MkPSezWXQH0jBV13MUw=="],
 
-    "@oxc-resolver/binding-linux-riscv64-gnu": ["@oxc-resolver/binding-linux-riscv64-gnu@11.19.1", "", { "os": "linux", "cpu": "none" }, "sha512-/b+WgR+VTSBxzgOhDO7TlMXC1ufPIMR6Vj1zN+/x+MnyXGW7prTLzU9eW85Aj7Th7CCEG9ArCbTeqxCzFWdg2w=="],
+    "@oxc-resolver/binding-linux-ppc64-gnu": ["@oxc-resolver/binding-linux-ppc64-gnu@11.24.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-shjfMhmZ3gq9fv/w7bi3PnZlgOPG+2QAOFf0BJF0EgBSIGZ6PMLN2zbGEblTUYB/NKVDRyYhE2ff3dJ1QqNPkA=="],
 
-    "@oxc-resolver/binding-linux-riscv64-musl": ["@oxc-resolver/binding-linux-riscv64-musl@11.19.1", "", { "os": "linux", "cpu": "none" }, "sha512-YlRdeWb9j42p29ROh+h4eg/OQ3dTJlpHSa+84pUM9+p6i3djtPz1q55yLJhgW9XfDch7FN1pQ/Vd6YP+xfRIuw=="],
+    "@oxc-resolver/binding-linux-riscv64-gnu": ["@oxc-resolver/binding-linux-riscv64-gnu@11.24.2", "", { "os": "linux", "cpu": "none" }, "sha512-zGelwFR5oRo+b69k8Lrzun86DyUHzfKN6cnjbR9l7Z7NIRznOE/2ZvPa1IUKqAL2PzAXOdwkfVqNvO1H2RlpAw=="],
 
-    "@oxc-resolver/binding-linux-s390x-gnu": ["@oxc-resolver/binding-linux-s390x-gnu@11.19.1", "", { "os": "linux", "cpu": "s390x" }, "sha512-EDpafVOQWF8/MJynsjOGFThcqhRHy417sRyLfQmeiamJ8qVhSKAn2Dn2VVKUGCjVB9C46VGjhNo7nOPUi1x6uA=="],
+    "@oxc-resolver/binding-linux-riscv64-musl": ["@oxc-resolver/binding-linux-riscv64-musl@11.24.2", "", { "os": "linux", "cpu": "none" }, "sha512-qxZ1SWCXJY0eyhAlP6Lmo9F2Nrtx7EkYj9oCgL8apDPCwXwCEDA2U697bbT81JIc2IrVjxO4KX6WU2N+oN9Z4w=="],
 
-    "@oxc-resolver/binding-linux-x64-gnu": ["@oxc-resolver/binding-linux-x64-gnu@11.19.1", "", { "os": "linux", "cpu": "x64" }, "sha512-NxjZe+rqWhr+RT8/Ik+5ptA3oz7tUw361Wa5RWQXKnfqwSSHdHyrw6IdcTfYuml9dM856AlKWZIUXDmA9kkiBQ=="],
+    "@oxc-resolver/binding-linux-s390x-gnu": ["@oxc-resolver/binding-linux-s390x-gnu@11.24.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-sGCecF3cx2DFlH4t/z7ApnOnXqN48p5p5mlHDEnHTAukQa2P+qMVE4CwyWE9W+q/m3QJ7kKfGrIjax31f44oFQ=="],
 
-    "@oxc-resolver/binding-linux-x64-musl": ["@oxc-resolver/binding-linux-x64-musl@11.19.1", "", { "os": "linux", "cpu": "x64" }, "sha512-cM/hQwsO3ReJg5kR+SpI69DMfvNCp+A/eVR4b4YClE5bVZwz8rh2Nh05InhwI5HR/9cArbEkzMjcKgTHS6UaNw=="],
+    "@oxc-resolver/binding-linux-x64-gnu": ["@oxc-resolver/binding-linux-x64-gnu@11.24.2", "", { "os": "linux", "cpu": "x64" }, "sha512-k/VlMMcSzMlahb3/fENM4rTlsJ0s3fFROA0KXPBmKggqmTSaE383sl8F3KCOXPLmVsYfW6hCitMhXCEtNeZxxg=="],
 
-    "@oxc-resolver/binding-openharmony-arm64": ["@oxc-resolver/binding-openharmony-arm64@11.19.1", "", { "os": "none", "cpu": "arm64" }, "sha512-QF080IowFB0+9Rh6RcD19bdgh49BpQHUW5TajG1qvWHvmrQznTZZjYlgE2ltLXyKY+qs4F/v5xuX1XS7Is+3qA=="],
+    "@oxc-resolver/binding-linux-x64-musl": ["@oxc-resolver/binding-linux-x64-musl@11.24.2", "", { "os": "linux", "cpu": "x64" }, "sha512-8hbnZyNi97b/8wapYaIF9+t9GmZKBW2vunaOc3h9HGJptH7b7XpvZqOTBSm/MpTjr7H497BlgOaSfLUdhmy2bw=="],
 
-    "@oxc-resolver/binding-wasm32-wasi": ["@oxc-resolver/binding-wasm32-wasi@11.19.1", "", { "dependencies": { "@napi-rs/wasm-runtime": "^1.1.1" }, "cpu": "none" }, "sha512-w8UCKhX826cP/ZLokXDS6+milN8y4X7zidsAttEdWlVoamTNf6lhBJldaWr3ukTDiye7s4HRcuPEPOXNC432Vg=="],
+    "@oxc-resolver/binding-openharmony-arm64": ["@oxc-resolver/binding-openharmony-arm64@11.24.2", "", { "os": "none", "cpu": "arm64" }, "sha512-MvyGik3a6pVgZ0t/kWlbmFxFLmXQJwgLsY2eYFHLpy0wGwRbfzeIGgDwQ3kXqE30z+kSXennRkCrT7TUvkptNg=="],
 
-    "@oxc-resolver/binding-win32-arm64-msvc": ["@oxc-resolver/binding-win32-arm64-msvc@11.19.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-nJ4AsUVZrVKwnU/QRdzPCCrO0TrabBqgJ8pJhXITdZGYOV28TIYystV1VFLbQ7DtAcaBHpocT5/ZJnF78YJPtQ=="],
+    "@oxc-resolver/binding-wasm32-wasi": ["@oxc-resolver/binding-wasm32-wasi@11.24.2", "", { "dependencies": { "@emnapi/core": "1.11.2", "@emnapi/runtime": "1.11.2", "@napi-rs/wasm-runtime": "^1.1.6" }, "cpu": "none" }, "sha512-vHcssMPwO08RTvj/c0iOBz90attxyG3wQJ0dTcyEQK43LRpcdLWZlV5feBhv6Isn6ahbQIzHbCgfa81+RiML0Q=="],
 
-    "@oxc-resolver/binding-win32-ia32-msvc": ["@oxc-resolver/binding-win32-ia32-msvc@11.19.1", "", { "os": "win32", "cpu": "ia32" }, "sha512-EW+ND5q2Tl+a3pH81l1QbfgbF3HmqgwLfDfVithRFheac8OTcnbXt/JxqD2GbDkb7xYEqy1zNaVFRr3oeG8npA=="],
+    "@oxc-resolver/binding-win32-arm64-msvc": ["@oxc-resolver/binding-win32-arm64-msvc@11.24.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-uokJqro2iBqkFvJdKQLP7d8/BUmFwESQFVmIJUQKj1Xn1a/LysJoe1vmeECLF5b3jsV8CAL5sEMJXX6SdK9Nhg=="],
 
-    "@oxc-resolver/binding-win32-x64-msvc": ["@oxc-resolver/binding-win32-x64-msvc@11.19.1", "", { "os": "win32", "cpu": "x64" }, "sha512-6hIU3RQu45B+VNTY4Ru8ppFwjVS/S5qwYyGhBotmjxfEKk41I2DlGtRfGJndZ5+6lneE2pwloqunlOyZuX/XAw=="],
+    "@oxc-resolver/binding-win32-x64-msvc": ["@oxc-resolver/binding-win32-x64-msvc@11.24.2", "", { "os": "win32", "cpu": "x64" }, "sha512-UqGPmo56KDfLlfXFAFIrNflHT8tFxWGEivWg3Zeyp4Uy2NlKN1FGPr6/BxcLGG3+kZ6Wp14g5Uj+n71boqZfiw=="],
 
-    "@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.67.0", "", { "os": "android", "cpu": "arm" }, "sha512-VrSi571rDv1N8HaEDM+DEX8nmT0y9jJo8tzzW13vsOWTx59xQczCIJx68n2zWOXRT5YKZsOZXp4qkHN/10x4mw=="],
+    "@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.81.0", "", { "os": "android", "cpu": "arm" }, "sha512-IcCRsXiedJoJopY6mpZUBEeVFsUrutmrG7dZ87zMuKJlhg70Ora9bBl1WcCxZQtyI10YpnVdEso5oCg7YcfSHw=="],
 
-    "@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.67.0", "", { "os": "android", "cpu": "arm64" }, "sha512-l6+NdYxMoRohix5r5bbigW16LPicceCwGcQ6LKKuE1kUdjgFfQolJjrJsQYPFetIs78Gxj/G/f5TEGoTCwj9nQ=="],
+    "@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.81.0", "", { "os": "android", "cpu": "arm64" }, "sha512-GRrIPyTGVhx3L3h+0T5xT2A0jFAcdPv4+IfuXpGDLIdl6XeYhgg/zw72A5ILZoUgRqZuM8F1y+V/gfDriXSxzQ=="],
 
-    "@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.67.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-jOzXxS1AxFxhImLIRbtGIMrEwaXcgMw3gR57WB1cRk8ai+vpr6726kxXqVvlNsrXtJ/FrmOm8RxlC0m8SW24Qg=="],
+    "@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.81.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-qNQ9tXRgLuKbqSV1S2h9h4KPHjbovO7RRR2/enUOtHzTkFZ7B9X5zqqHJua8dRyc7dBy7Aoyq5pqTSLFVcAzGQ=="],
 
-    "@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.67.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-3DFAVY94OqjIZHXIPz37yGRSWwOFTAqChQ64/M69GYLawzP0KiwdhDNfqdKKYT0bTR/DNxmMnQsj3ns+8+X/Lg=="],
+    "@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.81.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-q0QTm32jWga2Gv4j7IaVZN0jYMi9UV73sWVgFtDA4iIfqwMCLLZ3ve+9KwfYtsaKZSgQhmPaogeZWqDZpcY1Pw=="],
 
-    "@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.67.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-e4dDKZuLu8TR9DEBssWSDahlPgZBwojTTHZUvnjBRJfJJbpxYCjfjKfi0Z1+CSLMiJBwI2yCDtRM1XJQaARjmg=="],
+    "@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.81.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-/+8wVWDXEC7wHVAhOc59Fw/SkMc1arLkFD8iQCaSsmzenK1X4doFqquL9H1wrtGUzaiycVqkf/sSpcILK6W1UA=="],
 
-    "@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.67.0", "", { "os": "linux", "cpu": "arm" }, "sha512-BKytFdcQzbITV3xlnzDUDTEDtbUMCCiC4EaNTDZ4FyT8gdNvBC4gfiLucXp/sQl0XU3p7syTlorUWVVVBZab2g=="],
+    "@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.81.0", "", { "os": "linux", "cpu": "arm" }, "sha512-4xt422FEgioRq9hAL4Tq7fujGUWnc8z1BJ+Oi8RN8vB8axaP+sdK6a2xdlcQCCYnJg9QMuMFS0AucuIFx/EacA=="],
 
-    "@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.67.0", "", { "os": "linux", "cpu": "arm" }, "sha512-XYAv0esBDX7BpTzRDjVX2Vdj+zndd8ll2dFQiaeQ6zTZr7A8GRDTN7fH3FP3jU+O0vCDx85oH/EtG7BzPgAXuw=="],
+    "@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.81.0", "", { "os": "linux", "cpu": "arm" }, "sha512-u3vna8KdGplH4DRCW9K54D68fcMo7IxVrkCJWwXnIhwtBdnDnYrmzOUA/XjmBlPpcLsgw9Z5BNdY4za9+Dj+MQ=="],
 
-    "@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.67.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-zizRMjA0i6u/2B0evgda04iycu+MoNuf1pBy6Eh+1CjC5wMEG7qN5zdDKTCvFc0KSYSDM9QTG3gjZHirgtQuKg=="],
+    "@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.81.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-3j9k+gsYsE7nv71GWotXsqsa2l9/aJenD7dVHNt/CBvsb0SgRjSMnHFeP59IXUAl1wvVFhqGl2wJNMwWU3UBlA=="],
 
-    "@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.67.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-zB/Tf6sUjmmvvbva9Gj3JTJ8rJ9t4I8/U0o6vSRtd0DRIsIuyegBwJAzhSUFQHdMijIRJkW0exs/yBhpw2S20w=="],
+    "@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.81.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-k5iAp3dNxW0/uDCBY+WSm8jKB2szu7SkEQZdgRRpDXvuDd69vvDcqhB3A/pWCfCwXyenjNjFn9Td1fVoyAc+Yg=="],
 
-    "@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.67.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-kgU40Gt74CK0TCsF51KZymkIwN9U0BajKsMijB52zPqOeZU9NAHkA/NSQkZDHEaCakx42DxhXkODiAqf2b4Gug=="],
+    "@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.81.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-TFqLja3uYmVSte6nof9GWrex9Z8WgdZrNiLC6Te5rXGDqXB2y4j/26iFhwosXiAFqDhE9JJVuuCkDKLwptTn1g=="],
 
-    "@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.67.0", "", { "os": "linux", "cpu": "none" }, "sha512-tOYhkk/iaG9aD3FvGpBFd1Lrw0x0RaVoJBxjUkfNzS50rC5NS5BteNCwgr8A2zCdADrIIoze6D7u6U5Ic++/iQ=="],
+    "@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.81.0", "", { "os": "linux", "cpu": "none" }, "sha512-UEcySvGS0NOVo7h7n7CYyJL9+6gFAh7Zc/ToDXVScFvzHSTIxtzkMVU30rmQ6+nQ1LF+UdiRDdJajpDu+OylLg=="],
 
-    "@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.67.0", "", { "os": "linux", "cpu": "none" }, "sha512-sEtywrPb+0b+tHYl1SDCrw903fiC4eyKoNqzP3v+f2JT3Xcv4NEYG+P8rj+eEnX7IWhqV/xj8/JmcmVj21CXaA=="],
+    "@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.81.0", "", { "os": "linux", "cpu": "none" }, "sha512-H+diDbhD00+wI1IRP8Kz88x/lat+DgtoBJzoTthS16xkTJGNaEkfb8gzmd1rzc/2uDQQMl7GNl+JFUacVeWxIA=="],
 
-    "@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.67.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-BvR8Moa0zCLxroOx4vZaZN9nUfwAUpSTwjZdxZyKy4bv3PrzrXrxKR/ZQ0L9wNSvlPhnMJeZfa3q5w6ZCTuN6Q=="],
+    "@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.81.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-8znJ/5TekjOKg1j1Acho4PJMdiAHLtlcXuWEiipOhAMV6rQcXdmDdXCbheyDczN6TjBwiNfjcP81k4AthrKRzw=="],
 
-    "@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.67.0", "", { "os": "linux", "cpu": "x64" }, "sha512-mm2cxM6fksOpq6l0uFws8BUGKAR4dNa/cZCn37Npq7PFbhD5HDJqWfnoIvTaeRKMy5XdS2tO0MA0qbHDrnXAAA=="],
+    "@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.81.0", "", { "os": "linux", "cpu": "x64" }, "sha512-Q2Wj70yFsvn5QjlmifFzbj4H+kJy53bwqc41o1fzoM7MpLV1NIbhg/LpWXRfC6KOkSAdUx1Wd8VJsdPmhp/HRA=="],
 
-    "@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.67.0", "", { "os": "linux", "cpu": "x64" }, "sha512-WmbMuLapKyDlobMkXAaAL0Y+Uczh4LETfIfQsUpbId4Ip8Ai82/jqeYTOoUCkuuhBFapgqP253+d83tLKOksJg=="],
+    "@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.81.0", "", { "os": "linux", "cpu": "x64" }, "sha512-cPInHp/ddEe5qkyK2IiyQ8Q3Mp2oLLEhhsGgTK2oZx4L6+llGam1H1yBvJZ7qHfOXj8N3hxBS8sj4tO+gtFlIg=="],
 
-    "@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.67.0", "", { "os": "none", "cpu": "arm64" }, "sha512-9g/PqxYJelzzTAOR5Y+RiRqdeydhEuXv2KxNeFcAKQ7UsvnWSY1OP4MsuPMbTO2Pf70tz7mFhl1j13H3fyh+8g=="],
+    "@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.81.0", "", { "os": "none", "cpu": "arm64" }, "sha512-0CQxSX4ajqm07AHBf5U33qQzXKdd7wtq/oTL/7vpY6RNNuxrRi8W4bqUV1Jyu/vj+9KmxQyDhxfeVX1nQL6kfg=="],
 
-    "@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.67.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-2VhwE6Gatb0vJGnN0TBuQMbKCOiZlSQ/zJvVWYLK4a9d4iDiJOen/yVQkGpmsJ90MuH66fzi0kEKI0jRQMDxGA=="],
+    "@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.81.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-l0hbeISm9673hVrrQU8j/p2M7YH9Ouoj7p7E/QM55NTrKVLP+P3PF8hLu+OY+x0VtGRW+ggiQKZqmdYps9H+TA=="],
 
-    "@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.67.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-EQ3VExXfeM1InbE5+JjufhZZTWy+kHUwgt3yZR7gQ47Je/mE0WspQPan0OJznh493L5anM210YNJtH1PXjTSFg=="],
+    "@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.81.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-ksqPP5jbFXcYreEQ7zdJh06rJQBymCTyGRCdaXjfcf2aG4f8KxUWY5wcgYHmaTK+FJ4bPG5sUAdOX+6trnH1JA=="],
 
-    "@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.67.0", "", { "os": "win32", "cpu": "x64" }, "sha512-bw24y+/1MHS4QDkons3YyHkPT9uCMoLHHgQhb+mb8NOjTYwub1CZ+K9Ngr8aO5DMrDrkqHwTzlTwFP2vS8Y/ZQ=="],
+    "@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.81.0", "", { "os": "win32", "cpu": "x64" }, "sha512-IZuUCwGw9emG5JtCp+fYGB+Z4OWEoeEcM8R5BA1pYw63/ieYFVdcU2ylxTpHbVHSenZnsYE+ZZ20uHAJszQ4cA=="],
 
-    "@playwright/test": ["@playwright/test@1.60.0", "", { "dependencies": { "playwright": "1.60.0" }, "bin": { "playwright": "cli.js" } }, "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag=="],
+    "@playwright/test": ["@playwright/test@1.62.1", "", { "dependencies": { "playwright": "1.62.1" }, "bin": { "playwright": "cli.js" } }, "sha512-DTcUc8qii+cpHvtOwggMtBRMjKZHXYWdw8syRYu2vtzuq4Wxphqq4NfCs5Zt44L6mA8rfDfj+PHnxFc/FeK6mQ=="],
 
-    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.0-rc.17", "", { "os": "android", "cpu": "arm64" }, "sha512-s70pVGhw4zqGeFnXWvAzJDlvxhlRollagdCCKRgOsgUOH3N1l0LIxf83AtGzmb5SiVM4Hjl5HyarMRfdfj3DaQ=="],
+    "@rolldown/binding-android-arm-eabi": ["@rolldown/binding-android-arm-eabi@1.2.7", "", { "os": "android", "cpu": "arm" }, "sha512-EypzgnYCwyVY4NDHKzGmNJT5b+XaQEBniHxsMdeIQLB/tcCzZnhqrzHpZFbX9iaxx+5RiB8caATBtfvZP7zVxQ=="],
 
-    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.0-rc.17", "", { "os": "darwin", "cpu": "arm64" }, "sha512-4ksWc9n0mhlZpZ9PMZgTGjeOPRu8MB1Z3Tz0Mo02eWfWCHMW1zN82Qz/pL/rC+yQa+8ZnutMF0JjJe7PjwasYw=="],
+    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.2.7", "", { "os": "android", "cpu": "arm64" }, "sha512-l17HE9EweWaqJZhuUuNBN/FzM62xw+DECVnJyvMsxn8vJFAGLy5QfLDoYAcronkAN8VxKZHezDpulHDPx95vFw=="],
 
-    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.0.0-rc.17", "", { "os": "darwin", "cpu": "x64" }, "sha512-SUSDOI6WwUVNcWxd02QEBjLdY1VPHvlEkw6T/8nYG322iYWCTxRb1vzk4E+mWWYehTp7ERibq54LSJGjmouOsw=="],
+    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.2.7", "", { "os": "darwin", "cpu": "arm64" }, "sha512-8ED8ELFvHXc6OCETIn4gXObPiaR6bckM/ipXtbzlPVDRMBfEGjCKgO90F9YtfdpDatVx/ZQw7aZ1vUMf/+T3Mw=="],
 
-    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.0.0-rc.17", "", { "os": "freebsd", "cpu": "x64" }, "sha512-hwnz3nw9dbJ05EDO/PvcjaaewqqDy7Y1rn1UO81l8iIK1GjenME75dl16ajbvSSMfv66WXSRCYKIqfgq2KCfxw=="],
+    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.2.7", "", { "os": "darwin", "cpu": "x64" }, "sha512-/WPripjtiAIZ2tWY7ddijORT0Ujg87wxWW/qcoFVCKAWVDPhtY0xr7Dj0M3GyNGz60jGwTElhro/mkF9dT7dDQ=="],
 
-    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.0.0-rc.17", "", { "os": "linux", "cpu": "arm" }, "sha512-IS+W7epTcwANmFSQFrS1SivEXHtl1JtuQA9wlxrZTcNi6mx+FDOYrakGevvvTwgj2JvWiK8B29/qD9BELZPyXQ=="],
+    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.2.7", "", { "os": "freebsd", "cpu": "x64" }, "sha512-14DI4NcqpvbICxSnGLx3PmtDaWqRP/KGSGb6C+JLLVPeZRl6dKdHba3pGsqT3vpdTqhEYIPG0MMQ8c0xYqoJxA=="],
 
-    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.0.0-rc.17", "", { "os": "linux", "cpu": "arm64" }, "sha512-e6usGaHKW5BMNZOymS1UcEYGowQMWcgZ71Z17Sl/h2+ZziNJ1a9n3Zvcz6LdRyIW5572wBCTH/Z+bKuZouGk9Q=="],
+    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.2.7", "", { "os": "linux", "cpu": "arm" }, "sha512-bxrWIRvHWQvbJwi+VIie/kDJmQxcNE6xxWwZdqF/ExVAigtHkv54WTLQPb+QsZdnFy18fg7JPfWGL0RH6vwIlQ=="],
 
-    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.0.0-rc.17", "", { "os": "linux", "cpu": "arm64" }, "sha512-b/CgbwAJpmrRLp02RPfhbudf5tZnN9nsPWK82znefso832etkem8H7FSZwxrOI9djcdTP7U6YfNhbRnh7djErg=="],
+    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.2.7", "", { "os": "linux", "cpu": "arm64" }, "sha512-toOY2BChBZyuxU7OYX6Tn389di4IzAqPTycVcci0O7FSfBqzRB3RZn+K5Is6ANf4tmgRd/K1yZTsNTXbkXsnLg=="],
 
-    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.0.0-rc.17", "", { "os": "linux", "cpu": "ppc64" }, "sha512-4EII1iNGRUN5WwGbF/kOh/EIkoDN9HsupgLQoXfY+D1oyJm7/F4t5PYU5n8SWZgG0FEwakyM8pGgwcBYruGTlA=="],
+    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.2.7", "", { "os": "linux", "cpu": "arm64" }, "sha512-lAIXTH/aiLRLxsTgQvfhjo4K1ydWIp00+V0voOr9beb/9ZmkUFrSIb03dXNFRgMNvkE6oGsF10ioQ6UsI+vS5Q=="],
 
-    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.0.0-rc.17", "", { "os": "linux", "cpu": "s390x" }, "sha512-AH8oq3XqQo4IibpVXvPeLDI5pzkpYn0WiZAfT05kFzoJ6tQNzwRdDYQ45M8I/gslbodRZwW8uxLhbSBbkv96rA=="],
+    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.2.7", "", { "os": "linux", "cpu": "ppc64" }, "sha512-kdnwS28Pkenp/mZMRwjXXXwxQ7pIsm+bF919LUK93BOyhcLsrVKdP2p9fxpiPNPAbNuch8ypQt0pm2P2LYCAGg=="],
 
-    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.0.0-rc.17", "", { "os": "linux", "cpu": "x64" }, "sha512-cLnjV3xfo7KslbU41Z7z8BH/E1y5mzUYzAqih1d1MDaIGZRCMqTijqLv76/P7fyHuvUcfGsIpqCdddbxLLK9rA=="],
+    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.2.7", "", { "os": "linux", "cpu": "s390x" }, "sha512-516OdsyLdr5E65paF3yBF55t8mfm9+gmtCsK3xI7XKXIT7EfRlHhxL8K/NR6Hu8BWSgF5+1w74lTL0+nxcc8Qw=="],
 
-    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.0.0-rc.17", "", { "os": "linux", "cpu": "x64" }, "sha512-0phclDw1spsL7dUB37sIARuis2tAgomCJXAHZlpt8PXZ4Ba0dRP1e+66lsRqrfhISeN9bEGNjQs+T/Fbd7oYGw=="],
+    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.2.7", "", { "os": "linux", "cpu": "x64" }, "sha512-r8/z8n7GFaYRln3xmP1Cxy0HH/HLM0uBUPkEuSVEfKGDA89M0FsZRZJRSwe/tJjRx+fpH/gjorfhB8tmEbSFLA=="],
 
-    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.0.0-rc.17", "", { "os": "none", "cpu": "arm64" }, "sha512-0ag/hEgXOwgw4t8QyQvUCxvEg+V0KBcA6YuOx9g0r02MprutRF5dyljgm3EmR02O292UX7UeS6HzWHAl6KgyhA=="],
+    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.2.7", "", { "os": "linux", "cpu": "x64" }, "sha512-pAsE8iiDxUg1xBqdhrTfg45AVDVpirjz00sblEYClGNNcMnDb+e8beQgqIAw6LvauX/APvgxUnwrgun/YYGBhw=="],
 
-    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.0.0-rc.17", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-LEXei6vo0E5wTGwpkJ4KoT3OZJRnglwldt5ziLzOlc6qqb55z4tWNq2A+PFqCJuvWWdP53CVhG1Z9NtToDPJrA=="],
+    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.2.7", "", { "os": "none", "cpu": "arm64" }, "sha512-lTcIYmmnQQA8Or/2DatS6oSqcdLHvendjS+zLu+FwgToynWMRSmQdpM65fTANJgIS4mjbMOo5KT2lnT9SAb96w=="],
 
-    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.0.0-rc.17", "", { "os": "win32", "cpu": "arm64" }, "sha512-gUmyzBl3SPMa6hrqFUth9sVfcLBlYsbMzBx5PlexMroZStgzGqlZ26pYG89rBb45Mnia+oil6YAIFeEWGWhoZA=="],
+    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.2.7", "", { "os": "win32", "cpu": "arm64" }, "sha512-e3Gu3WxbNk/UqQhxqU7YIYO+9ZBvWNz3U+h/qRFosscMFzdRPbXYSaSWgSnklv2fz1TgzBTcti2z35c/7irsHw=="],
 
-    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.0.0-rc.17", "", { "os": "win32", "cpu": "x64" }, "sha512-3hkiolcUAvPB9FLb3UZdfjVVNWherN1f/skkGWJP/fgSQhYUZpSIRr0/I8ZK9TkF3F7kxvJAk0+IcKvPHk9qQg=="],
+    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.2.7", "", { "os": "win32", "cpu": "x64" }, "sha512-W/jg5qoRSqjsEv0+dZi4e687mcHqmVuU0P4fK6qS/xjetW2Gmc1W8j//z5nAeNcC8Ttm0hV46IjcYeuVwYhuiw=="],
 
     "@rolldown/plugin-babel": ["@rolldown/plugin-babel@0.2.3", "", { "dependencies": { "picomatch": "^4.0.4" }, "peerDependencies": { "@babel/core": "^7.29.0 || ^8.0.0-rc.1", "@babel/plugin-transform-runtime": "^7.29.0 || ^8.0.0-rc.1", "@babel/runtime": "^7.27.0 || ^8.0.0-rc.1", "rolldown": "^1.0.0-rc.5", "vite": "^8.0.0" }, "optionalPeers": ["@babel/plugin-transform-runtime", "@babel/runtime", "vite"] }, "sha512-+zEk16yGlz1F9STiRr6uG9hmIXb6nprjLczV/htGptYuLoCuxb+itZ03RKCEeOhBpDDd1NU7qF6x1VLMUp62bw=="],
 
-    "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.7", "", {}, "sha512-qujRfC8sFVInYSPPMLQByRh7zhwkGFS4+tyMQ83srV1qrxL4g8E2tyxVVyxd0+8QeBM1mIk9KbWxkegRr76XzA=="],
+    "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.1", "", {}, "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw=="],
 
     "@secretlint/config-creator": ["@secretlint/config-creator@12.3.1", "", { "dependencies": { "@secretlint/types": "12.3.1" } }, "sha512-CCRvPfrQLt2fPg3eWTIDGXNcVFQd6ZnvQCZ5lzclV9OF7iRqXQ4l5lfGO8NS68tIZx7YvBKhcO8/eVxdqm89HA=="],
 
@@ -605,7 +624,19 @@
 
     "@secretlint/types": ["@secretlint/types@12.3.1", "", {}, "sha512-Qv3fKvPkzUJpS9Ps6m2EPjC0RdxS2ZZrRfZAhIdl2u0zSjgf+Z0+AaCngmHRR+3Vtbw6s2FrCf4T6mLirm8Hgg=="],
 
-    "@sinclair/typebox": ["@sinclair/typebox@0.34.49", "", {}, "sha512-brySQQs7Jtn0joV8Xh9ZV/hZb9Ozb0pmazDIASBkYKCjXrXU3mpcFahmK/z4YDhGkQvP9mWJbVyahdtU5wQA+A=="],
+    "@sentry/conventions": ["@sentry/conventions@0.16.0", "", {}, "sha512-fO9PLmHdVURcSPUpWCItWAtgKiMwGdJHbovoSEyLplX5sxs2ugvI4CBPTrkkgqhObnZOD0CnWBKDzSVQYBKEyQ=="],
+
+    "@sentry/core": ["@sentry/core@10.73.0", "", { "dependencies": { "@sentry/conventions": "^0.16.0" } }, "sha512-FLO1UgH19RyasVpofu612WCOgb2nEH0dZy+R72d7p65XU9i0wxlMKm3+sgfwKmiSJp1Qhilaaxs4Jg6BbiM5HA=="],
+
+    "@sentry/node": ["@sentry/node@10.73.0", "", { "dependencies": { "@opentelemetry/api": "^1.9.1", "@opentelemetry/instrumentation": "^0.220.0", "@opentelemetry/sdk-trace-base": "^2.9.0", "@sentry/conventions": "^0.16.0", "@sentry/core": "10.73.0", "@sentry/node-core": "10.73.0", "@sentry/opentelemetry": "10.73.0", "@sentry/server-utils": "10.73.0", "import-in-the-middle": "^3.0.0" } }, "sha512-jiMJ6GgXDw6UMGzJY+o0c8OoeA9OfHqZ/xEpHfDqy75hn+9CEkRkbNGCIdMvsc7wW/Se1Os394hHfTpU+YEskg=="],
+
+    "@sentry/node-core": ["@sentry/node-core@10.73.0", "", { "dependencies": { "@sentry/conventions": "^0.16.0", "@sentry/core": "10.73.0", "@sentry/opentelemetry": "10.73.0", "import-in-the-middle": "^3.0.0" }, "peerDependencies": { "@opentelemetry/api": "^1.9.0", "@opentelemetry/core": "^1.30.1 || ^2.1.0", "@opentelemetry/exporter-trace-otlp-http": ">=0.57.0 <1", "@opentelemetry/instrumentation": ">=0.57.1 <1", "@opentelemetry/sdk-trace-base": "^1.30.1 || ^2.1.0" }, "optionalPeers": ["@opentelemetry/api", "@opentelemetry/core", "@opentelemetry/exporter-trace-otlp-http", "@opentelemetry/instrumentation", "@opentelemetry/sdk-trace-base"] }, "sha512-GHAGUmZPmm6FKfxfv2maVVJ/A99YAmd7oFOuKMDmITI6O/Msl6JB3vPTEpopVAHLW0LYJQBOjddL9C7o+Jt44g=="],
+
+    "@sentry/opentelemetry": ["@sentry/opentelemetry@10.73.0", "", { "dependencies": { "@sentry/conventions": "^0.16.0", "@sentry/core": "10.73.0" }, "peerDependencies": { "@opentelemetry/api": "^1.9.0", "@opentelemetry/core": "^1.30.1 || ^2.1.0", "@opentelemetry/sdk-trace-base": "^1.30.1 || ^2.1.0" } }, "sha512-fQouPQKsH0CQrw6oAn1k0Z2I+tgyochCovifr5qNS69i0OzjknLa03WJyiZ/IuzXc4AVa5jAKfOeE9slABz8Qw=="],
+
+    "@sentry/server-utils": ["@sentry/server-utils@10.73.0", "", { "dependencies": { "@sentry/conventions": "^0.16.0", "@sentry/core": "10.73.0" } }, "sha512-QskripdKFbM/+gipC6mpa2crLwL7+VbkX84IpHg2z9UlYQ1kNKd3aMT+Qk9NLRSw/zu1rSIAvlbWfx4D3rgNAA=="],
+
+    "@sinclair/typebox": ["@sinclair/typebox@0.34.52", "", {}, "sha512-XiMQh7qqVlxZzcVD+kkGMNGMzcTrDMLWI7S4x7z1MkCkbDPrekpZXEUK0eZqZFMuHQg2a2DZOcDIh9o5v3Gonw=="],
 
     "@sindresorhus/merge-streams": ["@sindresorhus/merge-streams@4.0.0", "", {}, "sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ=="],
 
@@ -613,87 +644,87 @@
 
     "@testing-library/dom": ["@testing-library/dom@10.4.1", "", { "dependencies": { "@babel/code-frame": "^7.10.4", "@babel/runtime": "^7.12.5", "@types/aria-query": "^5.0.1", "aria-query": "5.3.0", "dom-accessibility-api": "^0.5.9", "lz-string": "^1.5.0", "picocolors": "1.1.1", "pretty-format": "^27.0.2" } }, "sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg=="],
 
-    "@testing-library/react": ["@testing-library/react@16.3.2", "", { "dependencies": { "@babel/runtime": "^7.12.5" }, "peerDependencies": { "@testing-library/dom": "^10.0.0", "@types/react": "^18.0.0 || ^19.0.0", "@types/react-dom": "^18.0.0 || ^19.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-XU5/SytQM+ykqMnAnvB2umaJNIOsLF3PVv//1Ew4CTcpz0/BRyy/af40qqrt7SjKpDdT1saBMc42CUok5gaw+g=="],
+    "@testing-library/react": ["@testing-library/react@16.3.3", "", { "dependencies": { "@babel/runtime": "^7.12.5" }, "peerDependencies": { "@testing-library/dom": "^10.0.0", "@types/react": "^18.0.0 || ^19.0.0", "@types/react-dom": "^18.0.0 || ^19.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-Uo193NgQbPMz6lrrhtRQQFcMC6Re/ELLFbbuVL30WDlZxlpZf9/lMHTAVxPRLw1q1iu9OJmR1c2BLiENRstdBg=="],
 
-    "@testing-library/user-event": ["@testing-library/user-event@14.6.1", "", { "peerDependencies": { "@testing-library/dom": ">=7.21.4" } }, "sha512-vq7fv0rnt+QTXgPxr5Hjc210p6YKq2kmdziLgnsZGgLJ9e6VAShx1pACLuRjd/AS/sr7phAR58OIIpf0LlmQNw=="],
+    "@testing-library/user-event": ["@testing-library/user-event@14.6.7", "", { "peerDependencies": { "@testing-library/dom": ">=7.21.4" } }, "sha512-MPCpX8bxe8zS+JmmTwLp8jd0dy1rAm60Te/SL8JrQM3qvQJcBOs1d7IefJMyZzqM3EWBrDn/LWDt1BCGu4ASfg=="],
 
-    "@textlint/ast-node-types": ["@textlint/ast-node-types@15.6.0", "", {}, "sha512-CxZHFbYAU7J0A4izz31wV2ZZfySR6aVj2OSR6/3tppZm7VV6hM7nA7sutsLwIiBL/v4lsB1RM79l4Dc/VrH4qw=="],
+    "@textlint/ast-node-types": ["@textlint/ast-node-types@15.8.0", "", {}, "sha512-5CiH9COYmovWmExQgs7763DzX6Gy9zjkjJ7JxCC95wyTcjwQn/8poNF6fv3qzRlmx8CRRde8DHr9FcgAAiPzgw=="],
 
-    "@textlint/linter-formatter": ["@textlint/linter-formatter@15.6.0", "", { "dependencies": { "@azu/format-text": "^1.0.2", "@azu/style-format": "^1.0.1", "@textlint/module-interop": "15.6.0", "@textlint/resolver": "15.6.0", "@textlint/types": "15.6.0", "chalk": "^4.1.2", "debug": "^4.4.3", "js-yaml": "^4.1.1", "lodash": "^4.18.1", "pluralize": "^2.0.0", "string-width": "^4.2.3", "strip-ansi": "^6.0.1", "table": "^6.9.0", "text-table": "^0.2.0" } }, "sha512-IwHRhjwxs0a5t1eNAoKAdV224CDca38LyopPofXpwO/d0J75wBvzf/cBHXNl4TMsLKhYGtR83UprcLEKj/gZsA=="],
+    "@textlint/linter-formatter": ["@textlint/linter-formatter@15.8.0", "", { "dependencies": { "@azu/format-text": "^1.0.2", "@azu/style-format": "^1.0.1", "@textlint/module-interop": "15.8.0", "@textlint/resolver": "15.8.0", "@textlint/types": "15.8.0", "debug": "^4.4.3", "js-yaml": "^4.3.0", "lodash": "^4.18.1", "pluralize": "^2.0.0", "string-width": "^4.2.3", "strip-ansi": "^6.0.1", "table": "^6.9.0", "text-table": "^0.2.0" } }, "sha512-+oU3A235NATv6Lzi4xa4kJ65PuNJlIxesaO4AvDhDWA9FWm7y4XKWaoQCW1esgaQQ6dwnUiFKArQ8TcJ86mC4w=="],
 
-    "@textlint/module-interop": ["@textlint/module-interop@15.6.0", "", {}, "sha512-MHY6pJx9i5kOlrvUSK51887tYZjHAV2qnr6unBm7LtBLGDFo93utdYqHyWep8r9QLsilQdeijWtufJI46z4v4w=="],
+    "@textlint/module-interop": ["@textlint/module-interop@15.8.0", "", {}, "sha512-rt+OR1WYGoLOY8HkA/aBPrqufF6yUUEsKEAh7XohTsT3lp9IyZFT6zOIbjul9P4FAzsmSPkcrYjVx3Bz/IUfkg=="],
 
-    "@textlint/resolver": ["@textlint/resolver@15.6.0", "", {}, "sha512-T1l2Gd3455pwtm0cTewhX/LLy3bL9z6/Fu/am+jj+jjGfXVoknYkjfkZEKrjHlA7xzay0EfUKnu//teYemLeZw=="],
+    "@textlint/resolver": ["@textlint/resolver@15.8.0", "", {}, "sha512-E88tzfX3K8Jykk+38aJ9cy8RquD8ABVOPTO2rFEESq0wcg8x6/ypdAS8ZgR7OKiGqlRF0hkO/m5PbQwVfKM3VA=="],
 
-    "@textlint/types": ["@textlint/types@15.6.0", "", { "dependencies": { "@textlint/ast-node-types": "15.6.0" } }, "sha512-CvgYb1PiqF4BGyoZebGWzAJCZ4ChJAZ9gtWjpQIMKE4Xe2KlSwDA8m8MsiZIV321f5Ibx38BMjC1Z/2ZYP2GQg=="],
+    "@textlint/types": ["@textlint/types@15.8.0", "", { "dependencies": { "@textlint/ast-node-types": "15.8.0" } }, "sha512-Anhc6y5736YIsvqae0U6k0YmB2M/QVHkEeOv2aydAn/WIkdI69dCOiDbe3/+RagS3qstFTSFWJzNRA2lUjv19w=="],
 
-    "@tiptap/core": ["@tiptap/core@3.23.6", "", { "peerDependencies": { "@tiptap/pm": "3.23.6" } }, "sha512-MRB3pHz4Oxqmcawh0cQ5iOGdY5xtNYp/1CoK7hdTLzw5K0C6/gTC2VvanB1R4INaB6EpBkxG/GiWkVirDRnuXw=="],
+    "@tiptap/core": ["@tiptap/core@3.31.3", "", { "peerDependencies": { "@tiptap/pm": "3.31.3" } }, "sha512-Cz50pvciQrxdSxgTkHOVz0uD0Yl/8Xt0QatGD6ILm47jW8EzyHR9RkUGs/D5IqzXKuVPntfw1ttaT926vXfiRg=="],
 
-    "@tiptap/extension-blockquote": ["@tiptap/extension-blockquote@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-2RmnqNqTltZ2k1F7IfjoDNs935Uq4rRDR7d98mqkg3OlDktcQIyBpv0t9dTay6H5bkQeZUuS8ogK2S1E8Edjug=="],
+    "@tiptap/extension-blockquote": ["@tiptap/extension-blockquote@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-fyY2XMbyDDDfOTQ1Qdrnqa1qwC9DWE4n7AfE0EKQI0G8MfLV8RaDlLDcOZDJ9JbMPY7/Gx7EjyK4NKxSW9n2hQ=="],
 
-    "@tiptap/extension-bold": ["@tiptap/extension-bold@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-1LMhjnytdbbhWHSoOwnLxZAOQZWPkKyXVCNmaIk0Mhi4tLPUXptG4qKS5sVYTCveE5H6IBPFrbgBFi5dMI6krA=="],
+    "@tiptap/extension-bold": ["@tiptap/extension-bold@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-dIuYhKk8TitKU/FeDpoTeWZhU42YgDN5npgWNjAmMmRktPdoxnH3/wGSiwXlqZgJWjehN7kPWDePWpJeAImGpQ=="],
 
-    "@tiptap/extension-bubble-menu": ["@tiptap/extension-bubble-menu@3.23.6", "", { "dependencies": { "@floating-ui/dom": "^1.0.0" }, "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-Mwkyp9LkDHFbqmWRIkp63FinRxFu3ajC4qSb9t4mnHsb4kAdbNLLsGtbFg+le0SWk4CxGwAOwM7SzeJ+6UGqCA=="],
+    "@tiptap/extension-bubble-menu": ["@tiptap/extension-bubble-menu@3.31.3", "", { "dependencies": { "@floating-ui/dom": "^1.0.0" }, "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-EV6ZnwKc++2OM/OcD54n8s1B7C9LP7GKAtdEPwu0t3BYJf3sG8Ueoinf7SgGPO9oMPg96GneOkDNm1urMV167g=="],
 
-    "@tiptap/extension-bullet-list": ["@tiptap/extension-bullet-list@3.23.6", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.6" } }, "sha512-RMRgfXZykr/13X8UBOwvpgysVOo9KchwqMoEbvqQSj4YFfU56iIn59C8sbxiQ1sKfeltUf0wH4fPc0I4iwKqAA=="],
+    "@tiptap/extension-bullet-list": ["@tiptap/extension-bullet-list@3.31.3", "", { "peerDependencies": { "@tiptap/extension-list": "3.31.3" } }, "sha512-qEyyoPapPef4LO8XKaN83bxtaNzkJ4kFn/IxLnEKd4BJ3Mvi4MH2yJYlyDqwFnMoev4pMA1zBHRAt/C0THRmZw=="],
 
-    "@tiptap/extension-code": ["@tiptap/extension-code@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-KG8KXFYyLrtYvT7AZ1WGV61ofx8pDe5g9pH658MERxqQGii+Pyfc6xkz04l7XeBts/7+571UQp/0O7i/z560TA=="],
+    "@tiptap/extension-code": ["@tiptap/extension-code@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-SzxOqchrD2AcN3uT67PjKmRFEMOU3vNNiwNaamZJUbZrI6Hmy+bvdHJrc3jrIddyyCrAtsnAfRI0cmorW1jGfg=="],
 
-    "@tiptap/extension-code-block": ["@tiptap/extension-code-block@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-4kccgcn5yHThxrzsIhJny3EwfEZYIk+BjUCL4uIuzOyWvExtGhZ6JMHVCZeMhI8D1/bX1LNkkAKN5DXPzH4lXQ=="],
+    "@tiptap/extension-code-block": ["@tiptap/extension-code-block@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-nvknt4FhyJQjYcvxptmeUlFsIAc8ibua3E5BN4Pim374/9RWepH4cdE9X0/qUTtguHElLx0iKtSIY3rW2qGTFA=="],
 
-    "@tiptap/extension-document": ["@tiptap/extension-document@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-XDAIgG9KcKumFM9KJWUEUhXPbFIhhl47bfy5GknareWTRKke85rcoj/oxKKO9ihLZr8JfpbXjqnS4SCm5yhYPw=="],
+    "@tiptap/extension-document": ["@tiptap/extension-document@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-EexgmqnyDNyGlISxo7SMrp5MygpJYmqD+0cY5jB6L1U6L4CpKKRWUt8OO1sWzEHDE1+TTvwt+WIFoIWAziOtEA=="],
 
-    "@tiptap/extension-dropcursor": ["@tiptap/extension-dropcursor@3.23.6", "", { "peerDependencies": { "@tiptap/extensions": "3.23.6" } }, "sha512-+XWEoRKf3lXxi7Le1aOM2xU1XHwxICGpXjT3m4QaYqUgIpsq8gQEuso6kVg8DnTD7biKQs6+oIQ0o2b/gTW9WA=="],
+    "@tiptap/extension-dropcursor": ["@tiptap/extension-dropcursor@3.31.3", "", { "peerDependencies": { "@tiptap/extensions": "3.31.3" } }, "sha512-NWomSfu5CSC7VacnMSDzKT8qm66SzMfZwVPEtwY5bPpRTJgTiT1rNK0neDrrzfMN27MfylGyKWWf7Q5Qf8w/fg=="],
 
-    "@tiptap/extension-floating-menu": ["@tiptap/extension-floating-menu@3.23.6", "", { "peerDependencies": { "@floating-ui/dom": "^1.0.0", "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-2kjuDcEq69lEcECl75xqY5MyzUSh2zcC5aLrpwP1WwhJz5bxsIFHiaps5AP6h9R4A+ZBj5b2haay2Y1wDUU3VA=="],
+    "@tiptap/extension-floating-menu": ["@tiptap/extension-floating-menu@3.31.3", "", { "peerDependencies": { "@floating-ui/dom": "^1.0.0", "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-rd4VJ9PGSP9Eop8ZTEwaLZcMzMXLuJKe3hUNf58rq+zANpwM+9fI+vB7g9MAc3eXwUNDxNDVACFIL2oeBqpQ3A=="],
 
-    "@tiptap/extension-gapcursor": ["@tiptap/extension-gapcursor@3.23.6", "", { "peerDependencies": { "@tiptap/extensions": "3.23.6" } }, "sha512-wbKmxXsszxWacEkrHucRpSQbiKjz4fmOebD6OVyL9AcrmlbxNk8vcM3iyh/8cVeRy09XY+morM165t/u7/z4IQ=="],
+    "@tiptap/extension-gapcursor": ["@tiptap/extension-gapcursor@3.31.3", "", { "peerDependencies": { "@tiptap/extensions": "3.31.3" } }, "sha512-EBXKb1FrVStsNYCcRGtd9jmzveCvR+eqgg1rVqoONrqFK6U7bga6LN+1dMKroP1kliDVgveYkP3vRYxqw+rFqg=="],
 
-    "@tiptap/extension-hard-break": ["@tiptap/extension-hard-break@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-KeUm+tkUfIVSX9QM9XOIhaay0Fn36sLKUo5NVYjN3uJaxFvaZXZmTlxdO85OTdgF2P5sqh9LomrIgliaFRGk4w=="],
+    "@tiptap/extension-hard-break": ["@tiptap/extension-hard-break@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-QAdCvNO4+yW9ATwsrej11NTkDYFqPLIEQr3ARNrKOK1qaiS7A0fia2SEukb/hrkP3A6mbozhoQt2r2RGUf/DpQ=="],
 
-    "@tiptap/extension-heading": ["@tiptap/extension-heading@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-A/0jPhxnUh9THSZymlu0OGPZe1wdFdwHAXnRCmqvYUCwJjrG7LCC/ahzmcj1tcNzI9hgHyuYPSfev8RXYrNu/w=="],
+    "@tiptap/extension-heading": ["@tiptap/extension-heading@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-rk5VHMAeQcg06SLauN6EGdD2jc0O2qY8QkZYPd0LxNvLblw2BxBx+lxUQSYwLAT9Ie5914gKIK2YbRyO2Ts3ig=="],
 
-    "@tiptap/extension-horizontal-rule": ["@tiptap/extension-horizontal-rule@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-hEUlz4H+I64r+TH6LCuNCRgO7JTHncXGmx9+WbU69EOfY8O0ZurcgeJc8HeiAKL+r9YuC1e5YHfFxgCaaC0jlg=="],
+    "@tiptap/extension-horizontal-rule": ["@tiptap/extension-horizontal-rule@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-YnHGy2KShRwvCseAmmxl9VP7R0qaj8QMp3DA6DJWZqp7r5gLGvDkAqhedxqqefqsE4Y43hjkBdjtB9Ce78LkIw=="],
 
-    "@tiptap/extension-italic": ["@tiptap/extension-italic@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-wol5KdwCPAvpiYhH9PLlvO8ZnJHwZtIboVevrfOGgBcKlXRA3dedR4OAMXHnUtkkzu9KtliLg1+TYzEx4JZG9Q=="],
+    "@tiptap/extension-italic": ["@tiptap/extension-italic@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-ibGvdvAPyfxBMUVNRI43eb9h2/Jka1MRG5GtnGqbcCX/2+Y/y0EOfFrPQPkuYphiWQYyu9+FzPKMB/pjuaLuKQ=="],
 
-    "@tiptap/extension-link": ["@tiptap/extension-link@3.23.6", "", { "dependencies": { "linkifyjs": "^4.3.3" }, "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-KNZz7z7P2/qbQsx5bPAbSPjrKDg1VHsedGlLHJCr8U2VRD5VgmDLkMpkouP1CsDg15qgyUKv/nDib5KgPpLNWA=="],
+    "@tiptap/extension-link": ["@tiptap/extension-link@3.31.3", "", { "dependencies": { "linkifyjs": "^4.3.3" }, "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-986wOQzTL9Zr5lf84LCLpm+YOms8A0K39/8DVoqRfebqcOe0/eq4bnztmAlfabOd+kJY92g3AgZERFUx/w+dcw=="],
 
-    "@tiptap/extension-list": ["@tiptap/extension-list@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-z6vj9+Qht2sjdQkyyHcUpsC/yCIZqTrQiyHDhs/HGKrfvoANyAZGpqdNeKf1wSyjIso+27tQuIH5NDfk8ygyNw=="],
+    "@tiptap/extension-list": ["@tiptap/extension-list@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-LoveGnC0FVdCV4jUNBaG1ZA+KWE07+adzV3kGy6uUYFcJEjbVUHTnPDrBOob3IwOSO3sCwIkvQb6EVYeXn/4yg=="],
 
-    "@tiptap/extension-list-item": ["@tiptap/extension-list-item@3.23.6", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.6" } }, "sha512-3zzyhdkUWcHVpXuvy6KiIwjh29rbH6gEDEqPQqHLrl1XGnO9pnShC7pSHctlCDjmcx3O4n9cd4QMtVBlUerbiA=="],
+    "@tiptap/extension-list-item": ["@tiptap/extension-list-item@3.31.3", "", { "peerDependencies": { "@tiptap/extension-list": "3.31.3" } }, "sha512-4QlKOriJJMvg95QJTEsy9BUYPBQ6UvJyb8WURRwdUtQUkkqb8h32lg/eyQUv2FzW9IT1AdUyNZfVaxH64kRfQA=="],
 
-    "@tiptap/extension-list-keymap": ["@tiptap/extension-list-keymap@3.23.6", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.6" } }, "sha512-x8bPcLViGzg/RAmQM/XtmfqIwQ/Pv9Q8mkd+OgfUiTqjeJqKwVQmiqbLFNa7zw81+H61M+HDU+qGAaQ3vRIMjw=="],
+    "@tiptap/extension-list-keymap": ["@tiptap/extension-list-keymap@3.31.3", "", { "peerDependencies": { "@tiptap/extension-list": "3.31.3" } }, "sha512-If8UOEdDZbPJU6iYTvLtH6DOp2KBy6BKxg9UELL1AevVetGHEF/7lW8hP50Gn1tHMVpPRqmhSzVrJRpEJJgb/Q=="],
 
-    "@tiptap/extension-ordered-list": ["@tiptap/extension-ordered-list@3.23.6", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.6" } }, "sha512-1m/wWB/ZtXcmG2vNdiUkCqsOgqv5vBjCv/mVaHhF9OvV+zQS8YDjoWE7zEuT/GgELdT77Xq8lHrn4nCDudB3/A=="],
+    "@tiptap/extension-ordered-list": ["@tiptap/extension-ordered-list@3.31.3", "", { "peerDependencies": { "@tiptap/extension-list": "3.31.3" } }, "sha512-mp3g11NgA/PYu8rj7J7Ez3l4qBy6WfTSmHIG4PZvEGG5w2oUAIkgb9DU7nPPzjmeme27oazFYZw+AtZA0+u4tw=="],
 
-    "@tiptap/extension-paragraph": ["@tiptap/extension-paragraph@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-+7m58LUSncodjrIyXks4RZ3tLNYrvgT77wRR4l3HnM5OABY3GDsDTqi7c1t1yI29NVOSk/DUacqy6UwYAj1DGg=="],
+    "@tiptap/extension-paragraph": ["@tiptap/extension-paragraph@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-+iPku7wJfy5hbNDNLX8dveFtYVsZMmh7vztjuq8hT3mipSC4IByDehDbU8fzUCjfXiEzmI7mQn7c8LGmHULuzA=="],
 
-    "@tiptap/extension-strike": ["@tiptap/extension-strike@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-oF7FEZ37f15aCe5kPgzGDYf/m+hr7VdQ/Ko/Hds/UM9pX7AG1fdtmRrl6wqkRqDM/incZaC/AQR2/Dpo2VCNGQ=="],
+    "@tiptap/extension-strike": ["@tiptap/extension-strike@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-G29bhKttYwcKHT+BI6emWVFol3RO/gUXxQVcmr/iT8LXXy7j8J6HFUnsKM+Kg5YlP1rxMRgsa65dbrQVahZi0A=="],
 
-    "@tiptap/extension-table": ["@tiptap/extension-table@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-XbhZXjhsS6AP7ThoZxjAnNs+NiR81YRori25l6E+ORqB7quiPkIXOAi5h4AIpkn/CYIqze6ere11lWsYpDjtaQ=="],
+    "@tiptap/extension-table": ["@tiptap/extension-table@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-7cnVPHhdiGGeauYqca6JVyPLTqZbqFEEk9nn2e2E8+fBo6zVtV07AktJBqth/XEzjZxcUmGxjoeuWYAisWjUHg=="],
 
-    "@tiptap/extension-table-cell": ["@tiptap/extension-table-cell@3.23.6", "", { "peerDependencies": { "@tiptap/extension-table": "3.23.6" } }, "sha512-hS9TmmvRlT9/ikT+0ukACS+hmJuii4zQaH47cg3oJkz/Fv7O7tL7GZniKtK6l2OUZGPhY+4SV2RkDB6bD7DXfw=="],
+    "@tiptap/extension-table-cell": ["@tiptap/extension-table-cell@3.31.3", "", { "peerDependencies": { "@tiptap/extension-table": "3.31.3" } }, "sha512-5nueKR/p/IX6B4etWqHjyRsjNfDf6dJZaRgfw1/1l90CJe2h3tTZk4JbUKWN3Mo4FzZuYKzmU3fxcZ8pSVOeJQ=="],
 
-    "@tiptap/extension-table-header": ["@tiptap/extension-table-header@3.23.6", "", { "peerDependencies": { "@tiptap/extension-table": "3.23.6" } }, "sha512-D6o0a1cJXUU0xWakainBFGPnGHinQkPcdu1YqGd/PoFANY38lnuZt/NW2O/OLfLXu5LXDRfpqF1+dsKww27dUA=="],
+    "@tiptap/extension-table-header": ["@tiptap/extension-table-header@3.31.3", "", { "peerDependencies": { "@tiptap/extension-table": "3.31.3" } }, "sha512-sstVtNQiBYX4P16vlhwBYPsthxDnodHWQfGq0EUQM40Z7H796Lgh9t1qYtu8yARQuHKzvINRwJCSy6DZ8YTDtQ=="],
 
-    "@tiptap/extension-table-row": ["@tiptap/extension-table-row@3.23.6", "", { "peerDependencies": { "@tiptap/extension-table": "3.23.6" } }, "sha512-OauWVzkyRQg0rKOqM/a3PuKPc1S7YXMb1LRN7Nh8Ytvglvd7GFRTbl1lVqdZRaz4Jzopag4PQnriIZfMPUpxWw=="],
+    "@tiptap/extension-table-row": ["@tiptap/extension-table-row@3.31.3", "", { "peerDependencies": { "@tiptap/extension-table": "3.31.3" } }, "sha512-up6tDK+hYVTFDeJ3XqKO0WJqBzyXNfGxMoimo5h83jrq9dcNh0oPCOzglZ7rdo8GH9I3VJ2fNKxxU2Eg2HcMoQ=="],
 
-    "@tiptap/extension-text": ["@tiptap/extension-text@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-ipoC2TkIAIOTiF5ByiGgvQB1DqDyfP90wrUB3mohBcgvp7lQnwHszCDGv8dNnmcUek8uXV/uoLu2VXeVQlxjPA=="],
+    "@tiptap/extension-text": ["@tiptap/extension-text@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-gdsWtF+taeaCu6V+5Ct10fGo0ACUy1GnYtbb+mcathBt8OqbT+Ws60p/yEmKesBDz2Hn+B5IcWy6+2BBZl5ZTg=="],
 
-    "@tiptap/extension-text-align": ["@tiptap/extension-text-align@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-pE+gDmvnrSMWHADDnDSzaO7YUi9kOywQkyrqZ9bEPLddZred7ICoJ4NtD2DqLjDSur+HijaJuByResWb78c6FA=="],
+    "@tiptap/extension-text-align": ["@tiptap/extension-text-align@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-26BJ7c28EyvHzJovNpuenKiIgfRI4KsT/OjBB00y58MyZ0kRXc6dwZVclw8y66clupKTLTWYCDUsy0P/xHj+cA=="],
 
-    "@tiptap/extension-underline": ["@tiptap/extension-underline@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-P55wGIZGYTVH92Fq0cgI4/O9AhLCaJC3hhxg15RSERP5/YegM9eJHDK/GQ1EE/DvYA+xpYGOV6agKwAUqfA/Iw=="],
+    "@tiptap/extension-underline": ["@tiptap/extension-underline@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-HghdJaOwRqYzsAxqSyNyb+IWyOMcdCl8IoiBETA9BZCJAqdXzFLcuWp7CqCqJPam9dgkWosSoHqTCAO4nTBfpw=="],
 
-    "@tiptap/extensions": ["@tiptap/extensions@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-X09/Db1teB+ifXzDGVVFmOeQRx7wTAayE9/280spxpsHkHZvJ5bHRvWIzUzviMIjbBz+NPDIKYPK7gMfh9iaig=="],
+    "@tiptap/extensions": ["@tiptap/extensions@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-8sJNPGGUe8f3aDojcOW5cfVL7I5NrBbE0UWxG08qoi9Tea6qWbvQJsCR9tsrOapr/DaLr3kpbGZ9s1gEEfcNcA=="],
 
-    "@tiptap/pm": ["@tiptap/pm@3.23.6", "", { "dependencies": { "prosemirror-changeset": "^2.3.0", "prosemirror-commands": "^1.6.2", "prosemirror-dropcursor": "^1.8.1", "prosemirror-gapcursor": "^1.3.2", "prosemirror-history": "^1.4.1", "prosemirror-keymap": "^1.2.2", "prosemirror-model": "^1.24.1", "prosemirror-schema-list": "^1.5.0", "prosemirror-state": "^1.4.3", "prosemirror-tables": "^1.6.4", "prosemirror-transform": "^1.10.2", "prosemirror-view": "^1.38.1" } }, "sha512-in5CaMaWlJcH2A1q6GJKFtrodE8WLS3M9tIi/f89jPmIVHJShpodC0KZDNyJkrVBQomYk0DEh86Utm6ASXzQww=="],
+    "@tiptap/pm": ["@tiptap/pm@3.31.3", "", { "dependencies": { "prosemirror-changeset": "^2.4.1", "prosemirror-commands": "^1.7.1", "prosemirror-dropcursor": "^1.8.2", "prosemirror-gapcursor": "^1.4.1", "prosemirror-history": "^1.5.0", "prosemirror-inputrules": "^1.5.1", "prosemirror-keymap": "^1.2.3", "prosemirror-model": "^1.25.11", "prosemirror-schema-list": "^1.5.1", "prosemirror-state": "^1.4.4", "prosemirror-tables": "^1.8.5", "prosemirror-transform": "^1.12.0", "prosemirror-view": "^1.42.3" } }, "sha512-sZime0SWsz/k62W2WvHx5Ig7G2h7kVhrrmnqy+wEgIHfDwEfOlelRjaWCiBCFlF7dxGUntJusCh9FxlLhni0Ag=="],
 
-    "@tiptap/react": ["@tiptap/react@3.23.6", "", { "dependencies": { "@types/use-sync-external-store": "^0.0.6", "fast-equals": "^5.3.3", "use-sync-external-store": "^1.4.0" }, "optionalDependencies": { "@tiptap/extension-bubble-menu": "^3.23.6", "@tiptap/extension-floating-menu": "^3.23.6" }, "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6", "@types/react": "^17.0.0 || ^18.0.0 || ^19.0.0", "@types/react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0", "react": "^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-Tw9KZkYqFMk3vaJAEQKqEYIO/iq3cSJe7OUEGBul4k4GaMQeLItLf5EYhUd0GIPXci1WVVPNntKJsHfX25M37w=="],
+    "@tiptap/react": ["@tiptap/react@3.31.3", "", { "dependencies": { "@types/use-sync-external-store": "^0.0.6", "fast-equals": "^5.3.3", "use-sync-external-store": "^1.4.0" }, "optionalDependencies": { "@tiptap/extension-bubble-menu": "^3.31.3", "@tiptap/extension-floating-menu": "^3.31.3" }, "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3", "@types/react": "^17.0.0 || ^18.0.0 || ^19.0.0", "@types/react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0", "react": "^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-QiwQqvaLFLm5EMFu5tg7nAgXJxCUiUTLD8EsK+TqVV5P4bqOoMOCM39khbhXTJyahCuYpiFWx5YOSDtC/JiPtg=="],
 
-    "@tiptap/starter-kit": ["@tiptap/starter-kit@3.23.6", "", { "dependencies": { "@tiptap/core": "^3.23.6", "@tiptap/extension-blockquote": "^3.23.6", "@tiptap/extension-bold": "^3.23.6", "@tiptap/extension-bullet-list": "^3.23.6", "@tiptap/extension-code": "^3.23.6", "@tiptap/extension-code-block": "^3.23.6", "@tiptap/extension-document": "^3.23.6", "@tiptap/extension-dropcursor": "^3.23.6", "@tiptap/extension-gapcursor": "^3.23.6", "@tiptap/extension-hard-break": "^3.23.6", "@tiptap/extension-heading": "^3.23.6", "@tiptap/extension-horizontal-rule": "^3.23.6", "@tiptap/extension-italic": "^3.23.6", "@tiptap/extension-link": "^3.23.6", "@tiptap/extension-list": "^3.23.6", "@tiptap/extension-list-item": "^3.23.6", "@tiptap/extension-list-keymap": "^3.23.6", "@tiptap/extension-ordered-list": "^3.23.6", "@tiptap/extension-paragraph": "^3.23.6", "@tiptap/extension-strike": "^3.23.6", "@tiptap/extension-text": "^3.23.6", "@tiptap/extension-underline": "^3.23.6", "@tiptap/extensions": "^3.23.6", "@tiptap/pm": "^3.23.6" } }, "sha512-gykwtGWrnWCmtql1hid3opac/KV8zQvOAnu3bTqIqcHrn1FusbUwKmNzavSbfGvcktHM3hFjb35W48JyVLyu/A=="],
+    "@tiptap/starter-kit": ["@tiptap/starter-kit@3.31.3", "", { "dependencies": { "@tiptap/core": "3.31.3", "@tiptap/extension-blockquote": "3.31.3", "@tiptap/extension-bold": "3.31.3", "@tiptap/extension-bullet-list": "3.31.3", "@tiptap/extension-code": "3.31.3", "@tiptap/extension-code-block": "3.31.3", "@tiptap/extension-document": "3.31.3", "@tiptap/extension-dropcursor": "3.31.3", "@tiptap/extension-gapcursor": "3.31.3", "@tiptap/extension-hard-break": "3.31.3", "@tiptap/extension-heading": "3.31.3", "@tiptap/extension-horizontal-rule": "3.31.3", "@tiptap/extension-italic": "3.31.3", "@tiptap/extension-link": "3.31.3", "@tiptap/extension-list": "3.31.3", "@tiptap/extension-list-item": "3.31.3", "@tiptap/extension-list-keymap": "3.31.3", "@tiptap/extension-ordered-list": "3.31.3", "@tiptap/extension-paragraph": "3.31.3", "@tiptap/extension-strike": "3.31.3", "@tiptap/extension-text": "3.31.3", "@tiptap/extension-underline": "3.31.3", "@tiptap/extensions": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-WKof9RewdmGHvWJ1wn0/HVNG2mV+HOgVRyJkKekuM9fgr6BZAAH/xZsWE1eon+94JnQ+KtK2ThydXQM/qc6b2A=="],
 
-    "@tiptap/suggestion": ["@tiptap/suggestion@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-YAoI2jctPClcyUhIcpxb1QlrUFG2a1Xsv1gS4tIfgh5KoOuEfGfCoeCq89TKgz/rHeP+ktRhzg1E2E4EY68HEA=="],
+    "@tiptap/suggestion": ["@tiptap/suggestion@3.31.3", "", { "peerDependencies": { "@floating-ui/dom": "^1.0.0", "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-z1OQ/Yx6seMZehi1AcmNkyJ8qkHQzybArmCyRdmreS4YL9C4bPMBe5lbMfFsArYs+KD5JyHwps5j7J/YE5BIuw=="],
 
     "@ts-graphviz/adapter": ["@ts-graphviz/adapter@2.0.6", "", { "dependencies": { "@ts-graphviz/common": "^2.1.5" } }, "sha512-kJ10lIMSWMJkLkkCG5gt927SnGZcBuG0s0HHswGzcHTgvtUe7yk5/3zTEr0bafzsodsOq5Gi6FhQeV775nC35Q=="],
 
@@ -703,31 +734,31 @@
 
     "@ts-graphviz/core": ["@ts-graphviz/core@2.0.7", "", { "dependencies": { "@ts-graphviz/ast": "^2.0.7", "@ts-graphviz/common": "^2.1.5" } }, "sha512-w071DSzP94YfN6XiWhOxnLpYT3uqtxJBDYdh6Jdjzt+Ce6DNspJsPQgpC7rbts/B8tEkq0LHoYuIF/O5Jh5rPg=="],
 
-    "@tybys/wasm-util": ["@tybys/wasm-util@0.10.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg=="],
+    "@tybys/wasm-util": ["@tybys/wasm-util@0.10.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg=="],
 
     "@types/aria-query": ["@types/aria-query@5.0.4", "", {}, "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw=="],
 
-    "@types/bun": ["@types/bun@1.3.13", "", { "dependencies": { "bun-types": "1.3.13" } }, "sha512-9fqXWk5YIHGGnUau9TEi+qdlTYDAnOj+xLCmSTwXfAIqXr2x4tytJb43E9uCvt09zJURKXwAtkoH4nLQfzeTXw=="],
+    "@types/bun": ["@types/bun@1.4.0", "", { "dependencies": { "bun-types": "1.4.0" } }, "sha512-K+lZULY23vRgK/CfTjFIV+tyifaNdSMlPh9j+6mQ/cLfpOznLyAuzgV/JQysyECpkBQLVMSyvjlr2fBUSA9wFQ=="],
 
     "@types/esrecurse": ["@types/esrecurse@4.3.1", "", {}, "sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw=="],
 
-    "@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="],
+    "@types/estree": ["@types/estree@1.0.9", "", {}, "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg=="],
 
     "@types/jsdom": ["@types/jsdom@30.0.0", "", { "dependencies": { "@types/node": "*", "@types/tough-cookie": "*", "parse5": "^8.0.0", "undici-types": "^8.9.0" } }, "sha512-uAHGxujGE0cDaKGdK28zgDotFtNA7MKq5DXl8LrfdxdCI8VHcg15oJz+amHTChPNI5JpgEPQWc2xFdrw3em/nQ=="],
 
     "@types/json-schema": ["@types/json-schema@7.0.15", "", {}, "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="],
 
-    "@types/node": ["@types/node@24.12.2", "", { "dependencies": { "undici-types": "~7.16.0" } }, "sha512-A1sre26ke7HDIuY/M23nd9gfB+nrmhtYyMINbjI1zHJxYteKR6qSMX56FsmjMcDb3SMcjJg5BiRRgOCC/yBD0g=="],
+    "@types/node": ["@types/node@24.13.3", "", { "dependencies": { "undici-types": "~7.18.0" } }, "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q=="],
 
     "@types/normalize-package-data": ["@types/normalize-package-data@2.4.4", "", {}, "sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA=="],
 
-    "@types/react": ["@types/react@19.2.14", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w=="],
+    "@types/react": ["@types/react@19.2.18", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-AnzbBERsrLKtk2XSfTbYRLjQPdy116Sty4q+T+Bp3IC4l6jNBvreVPAHmpq9qhXQM7CXZPjLVmGMw9sy+hxQ3w=="],
 
-    "@types/react-dom": ["@types/react-dom@19.2.3", "", { "peerDependencies": { "@types/react": "^19.2.0" } }, "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ=="],
+    "@types/react-dom": ["@types/react-dom@19.2.7", "", { "peerDependencies": { "@types/react": "^19.2.0" } }, "sha512-I8bPpDLcHBv1qiIiXDCy71Rt8eQDKJP0sMSWJphDdAcdqiJ1sGpZamavoEIRZmYzjia9LuEb2HlYdDpmoENpvQ=="],
 
     "@types/sarif": ["@types/sarif@2.1.7", "", {}, "sha512-kRz0VEkJqWLf1LLVN4pT1cg1Z9wAuvI6L97V3m2f5B76Tg8d413ddvLBPTEHAZJlnn4XSvu0FkZtViCQGVyrXQ=="],
 
-    "@types/semver": ["@types/semver@7.7.1", "", {}, "sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA=="],
+    "@types/semver": ["@types/semver@7.8.0", "", {}, "sha512-1mAINjtQCXXeLkJ9ehXkwOcBpqtLxiVtKhpUf83DdRNdQKV0iXZpaHYqRr7nj+wvxuJzoAmAwXI+sCNMv1CzLQ=="],
 
     "@types/tough-cookie": ["@types/tough-cookie@4.0.5", "", {}, "sha512-/Ad8+nIOV7Rl++6f1BdKxFSMgmoqEoYbHRpPcx3JEfv8VRsQe9Z4mCXeJBzxs7mbHY/XOZZuXlRNfhpVPbs6ZA=="],
 
@@ -739,41 +770,41 @@
 
     "@types/ws": ["@types/ws@8.18.1", "", { "dependencies": { "@types/node": "*" } }, "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg=="],
 
-    "@typescript-eslint/eslint-plugin": ["@typescript-eslint/eslint-plugin@8.59.1", "", { "dependencies": { "@eslint-community/regexpp": "^4.12.2", "@typescript-eslint/scope-manager": "8.59.1", "@typescript-eslint/type-utils": "8.59.1", "@typescript-eslint/utils": "8.59.1", "@typescript-eslint/visitor-keys": "8.59.1", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "@typescript-eslint/parser": "^8.59.1", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-BOziFIfE+6osHO9FoJG4zjoHUcvI7fTNBSpdAwrNH0/TLvzjsk2oo8XSSOT2HhqUyhZPfHv4UOffoJ9oEEQ7Ag=="],
+    "@typescript-eslint/eslint-plugin": ["@typescript-eslint/eslint-plugin@8.69.0", "", { "dependencies": { "@eslint-community/regexpp": "^4.12.2", "@typescript-eslint/scope-manager": "8.69.0", "@typescript-eslint/type-utils": "8.69.0", "@typescript-eslint/utils": "8.69.0", "@typescript-eslint/visitor-keys": "8.69.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "@typescript-eslint/parser": "^8.69.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-t5jQTKPIgVW1PE6dR6H6Qz5gm8zjMlX5/2gRaOGd9eO6V7J+tQc6iWKukEe7dY8u9HyYasQ0yfF0/FSSTEO2gA=="],
 
-    "@typescript-eslint/parser": ["@typescript-eslint/parser@8.59.1", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.59.1", "@typescript-eslint/types": "8.59.1", "@typescript-eslint/typescript-estree": "8.59.1", "@typescript-eslint/visitor-keys": "8.59.1", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-HDQH9O/47Dxi1ceDhBXdaldtf/WV9yRYMjbjCuNk3qnaTD564qwv61Y7+gTxwxRKzSrgO5uhtw584igXVuuZkA=="],
+    "@typescript-eslint/parser": ["@typescript-eslint/parser@8.69.0", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.69.0", "@typescript-eslint/types": "8.69.0", "@typescript-eslint/typescript-estree": "8.69.0", "@typescript-eslint/visitor-keys": "8.69.0", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-l4b0DhWioGg6Gt2ebGlvfkFMOjRsauxtsnDRwUSRX1qHq3HdTfQHV8wW9zEXeciai6HfeaKOedQn2Zoofx3WBw=="],
 
-    "@typescript-eslint/project-service": ["@typescript-eslint/project-service@8.59.1", "", { "dependencies": { "@typescript-eslint/tsconfig-utils": "^8.59.1", "@typescript-eslint/types": "^8.59.1", "debug": "^4.4.3" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-+MuHQlHiEr00Of/IQbE/MmEoi44znZHbR/Pz7Opq4HryUOlRi+/44dro9Ycy8Fyo+/024IWtw8m4JUMCGTYxDg=="],
+    "@typescript-eslint/project-service": ["@typescript-eslint/project-service@8.69.0", "", { "dependencies": { "@typescript-eslint/tsconfig-utils": "^8.69.0", "@typescript-eslint/types": "^8.69.0", "debug": "^4.4.3" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-yi4obFrHMmnsesWehHbkg9zMA7Jt8cXT+mKM08G999pH1yT6nqgsHx7MYm0uY1wAj8CqiBXYRJ7WAT0QdQHQXg=="],
 
-    "@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.59.1", "", { "dependencies": { "@typescript-eslint/types": "8.59.1", "@typescript-eslint/visitor-keys": "8.59.1" } }, "sha512-LwuHQI4pDOYVKvmH2dkaJo6YZCSgouVgnS/z7yBPKBMvgtBvyLqiLy9Z6b7+m/TRcX1NFYUqZetI5Y+aT4GEfg=="],
+    "@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.69.0", "", { "dependencies": { "@typescript-eslint/types": "8.69.0", "@typescript-eslint/visitor-keys": "8.69.0" } }, "sha512-ewfspqWvSxKSOaplqAUNbaSFO0eB6w1EtQ+esfYFRm3614Ty4uNtExkcbgd6nWsXphbqKyf9ZYdbZdv2xEoWEQ=="],
 
-    "@typescript-eslint/tsconfig-utils": ["@typescript-eslint/tsconfig-utils@8.59.1", "", { "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-/0nEyPbX7gRsk0Uwfe4ALwwgxuA66d/l2mhRDNlAvaj4U3juhUtJNq0DsY8M2AYwwb9rEq2hrC3IcIcEt++iJA=="],
+    "@typescript-eslint/tsconfig-utils": ["@typescript-eslint/tsconfig-utils@8.69.0", "", { "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-xNqK7YTDZsLniQMV/4rpFR8Z5JlqeRvVjuG1YgF/mdPVH84HSD19L8CczMA0qg2RfwEV231GHH3VnToJDo4MfQ=="],
 
-    "@typescript-eslint/type-utils": ["@typescript-eslint/type-utils@8.59.1", "", { "dependencies": { "@typescript-eslint/types": "8.59.1", "@typescript-eslint/typescript-estree": "8.59.1", "@typescript-eslint/utils": "8.59.1", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-klWPBR2ciQHS3f++ug/mVnWKPjBUo7icEL3FAO1lhAR1Z1i5NQYZ1EannMSRYcq5qCv5wNALlXr6fksRHyYl7w=="],
+    "@typescript-eslint/type-utils": ["@typescript-eslint/type-utils@8.69.0", "", { "dependencies": { "@typescript-eslint/types": "8.69.0", "@typescript-eslint/typescript-estree": "8.69.0", "@typescript-eslint/utils": "8.69.0", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-ZfoJAVg3JZndQEpEl9petVlxau3lRuElc4HRMuAlLCf8to04/iHz692RUSNmXKDjEuJmIL+KZ2/BsOcBc16dsA=="],
 
-    "@typescript-eslint/types": ["@typescript-eslint/types@8.60.0", "", {}, "sha512-AsE7x2XaAK+CVbeih0Fvbn+r1qHxtpLDJ3XUuFcIinT318T90yHMJC+Zgv+jUuDjQQd06HKwxnDu6sz1IcTilA=="],
+    "@typescript-eslint/types": ["@typescript-eslint/types@8.69.0", "", {}, "sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA=="],
 
-    "@typescript-eslint/typescript-estree": ["@typescript-eslint/typescript-estree@8.59.1", "", { "dependencies": { "@typescript-eslint/project-service": "8.59.1", "@typescript-eslint/tsconfig-utils": "8.59.1", "@typescript-eslint/types": "8.59.1", "@typescript-eslint/visitor-keys": "8.59.1", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", "tinyglobby": "^0.2.15", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-OUd+vJS05sSkOip+BkZ/2NS8RMxrAAJemsC6vU3kmfLyeaJT0TftHkV9mcx2107MmsBVXXexhVu4F0TZXyMl4g=="],
+    "@typescript-eslint/typescript-estree": ["@typescript-eslint/typescript-estree@8.69.0", "", { "dependencies": { "@typescript-eslint/project-service": "8.69.0", "@typescript-eslint/tsconfig-utils": "8.69.0", "@typescript-eslint/types": "8.69.0", "@typescript-eslint/visitor-keys": "8.69.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", "tinyglobby": "^0.2.15", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-AdFkgqck3Vudb/kWnxlyafU/4aBhHrbQ9locP2N4psXTy5mOBg0SHJumnLvx7r6g1gV4DKvUFwV2nJZBoqOD8w=="],
 
-    "@typescript-eslint/utils": ["@typescript-eslint/utils@8.59.1", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", "@typescript-eslint/scope-manager": "8.59.1", "@typescript-eslint/types": "8.59.1", "@typescript-eslint/typescript-estree": "8.59.1" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-3pIeoXhCeYH9FSCBI8P3iNwJlGuzPlYKkTlen2O9T1DSeeg8UG8jstq6BLk+Mda0qup7mgk4z4XL4OzRaxZ8LA=="],
+    "@typescript-eslint/utils": ["@typescript-eslint/utils@8.69.0", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", "@typescript-eslint/scope-manager": "8.69.0", "@typescript-eslint/types": "8.69.0", "@typescript-eslint/typescript-estree": "8.69.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-tUbx60BBqQa31kXF5MCsOOLL5E/WzUuxIn7YpAvq+eaUlqvk8/NXnXMBNAdLCr0icjkzem7iUA5QqWHe/hJ1aw=="],
 
-    "@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.59.1", "", { "dependencies": { "@typescript-eslint/types": "8.59.1", "eslint-visitor-keys": "^5.0.0" } }, "sha512-LdDNl6C5iJExcM0Yh0PwAIBb9PrSiCsWamF/JyEZawm3kFDnRoaq3LGE4bpyRao/fWeGKKyw7icx0YxrLFC5Cg=="],
+    "@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.69.0", "", { "dependencies": { "@typescript-eslint/types": "8.69.0", "eslint-visitor-keys": "^5.0.0" } }, "sha512-+rmdgPA+EXkNgKYvHvFfhrs35utXbwaC5PGpDquSXcoXQDKUA5UjV0LmTucG/4JXkM31BTu4TilHtrN8IVBe8w=="],
 
     "@use-gesture/core": ["@use-gesture/core@10.3.1", "", {}, "sha512-WcINiDt8WjqBdUXye25anHiNxPc0VOrlT8F6LLkU6cycrOGUDyY/yyFmsg3k8i5OLvv25llc0QC45GhR/C8llw=="],
 
     "@use-gesture/react": ["@use-gesture/react@10.3.1", "", { "dependencies": { "@use-gesture/core": "10.3.1" }, "peerDependencies": { "react": ">= 16.8.0" } }, "sha512-Yy19y6O2GJq8f7CHf7L0nxL8bf4PZCPaVOCgJrusOeFHY1LvHgYXnmnXg6N5iwAnbgbZCDjo60SiM6IPJi9C5g=="],
 
-    "@vitejs/plugin-react": ["@vitejs/plugin-react@6.0.1", "", { "dependencies": { "@rolldown/pluginutils": "1.0.0-rc.7" }, "peerDependencies": { "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0", "babel-plugin-react-compiler": "^1.0.0", "vite": "^8.0.0" }, "optionalPeers": ["@rolldown/plugin-babel", "babel-plugin-react-compiler"] }, "sha512-l9X/E3cDb+xY3SWzlG1MOGt2usfEHGMNIaegaUGFsLkb3RCn/k8/TOXBcab+OndDI4TBtktT8/9BwwW8Vi9KUQ=="],
+    "@vitejs/plugin-react": ["@vitejs/plugin-react@6.1.1", "", { "dependencies": { "@rolldown/pluginutils": "^1.0.1" }, "peerDependencies": { "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0", "babel-plugin-react-compiler": "^1.0.0", "oxc-transform-react": "^0.145.0", "vite": "^8.0.0" }, "optionalPeers": ["@rolldown/plugin-babel", "babel-plugin-react-compiler", "oxc-transform-react"] }, "sha512-yxLaQV9gkhS8ezJqCM6+ndU7mDY6gqAg75NQ+0IjwEI8IYOmQCgkRwHKVSfWXW076DsqMo0Dk+0FK1U+M5RgFw=="],
 
-    "@vue/compiler-core": ["@vue/compiler-core@3.5.33", "", { "dependencies": { "@babel/parser": "^7.29.2", "@vue/shared": "3.5.33", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-3PZLQwFw4Za3TC8t0FvTy3wI16Kt+pmwcgNZca4Pj9iWL2E72a/gZlpBtAJvEdDMdCxdG/qq0C7PN0bsJuv0Rw=="],
+    "@vue/compiler-core": ["@vue/compiler-core@3.5.42", "", { "dependencies": { "@babel/parser": "^7.29.8", "@vue/shared": "3.5.42", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-2Ye1ilMtKXxl8qZUrQ5j0CdgenFp/HFQmta6rfRyfEsTG69L6Wk+tWuNoHYHMx9E8tF2Slvdg1FuwDvAXdy1LQ=="],
 
-    "@vue/compiler-dom": ["@vue/compiler-dom@3.5.33", "", { "dependencies": { "@vue/compiler-core": "3.5.33", "@vue/shared": "3.5.33" } }, "sha512-PXq0yrfCLzzL07rbXO4awtXY1Z06LG2eu6Adg3RJFa/j3Cii217XxxLXG22N330gw7GmALCY0Z8RgXEviwgpjA=="],
+    "@vue/compiler-dom": ["@vue/compiler-dom@3.5.42", "", { "dependencies": { "@vue/compiler-core": "3.5.42", "@vue/shared": "3.5.42" } }, "sha512-qbhQZEFmycr+ni/qyuccS4sucNN7VAbDfbkvNxWOX2VfgFm90MNs3/UhRNKoPMEIVn0F8gdlYjLPvqxHwHeQOA=="],
 
-    "@vue/compiler-sfc": ["@vue/compiler-sfc@3.5.33", "", { "dependencies": { "@babel/parser": "^7.29.2", "@vue/compiler-core": "3.5.33", "@vue/compiler-dom": "3.5.33", "@vue/compiler-ssr": "3.5.33", "@vue/shared": "3.5.33", "estree-walker": "^2.0.2", "magic-string": "^0.30.21", "postcss": "^8.5.10", "source-map-js": "^1.2.1" } }, "sha512-UTUvRO9cY+rROrx/pvN9P5Z7FgA6QGfokUCfhQE4EnmUj3rVnK+CHI0LsEO1pg+I7//iRYMUfcNcCPe7tg0CoA=="],
+    "@vue/compiler-sfc": ["@vue/compiler-sfc@3.5.42", "", { "dependencies": { "@babel/parser": "^7.29.8", "@vue/compiler-core": "3.5.42", "@vue/compiler-dom": "3.5.42", "@vue/compiler-ssr": "3.5.42", "@vue/shared": "3.5.42", "estree-walker": "^2.0.2", "magic-string": "^0.30.21", "postcss": "^8.5.19", "source-map-js": "^1.2.1" } }, "sha512-fkCAFB4okcAANGMThboWnScp/gzWjU0ZSkVnjTIiplmMDq2uq0tIB3j+xVu4rhv5rvOgBySCysudmbMd6xRRqw=="],
 
-    "@vue/compiler-ssr": ["@vue/compiler-ssr@3.5.33", "", { "dependencies": { "@vue/compiler-dom": "3.5.33", "@vue/shared": "3.5.33" } }, "sha512-IErjYdnj1qIupG5xxiVIYiiRvDhGWV4zuh/RCrwfYpuL+HWQzeU6lCk/nF9r7olWMnjKxCAkOctT2qFWFkzb1A=="],
+    "@vue/compiler-ssr": ["@vue/compiler-ssr@3.5.42", "", { "dependencies": { "@vue/compiler-dom": "3.5.42", "@vue/shared": "3.5.42" } }, "sha512-xmLk3wLkbizPAiLyomjgFFosf2ys9b5Ghb+oh/k2tnvipNz8OFrQOiTcWCzyK7MpBp9KkyGtfvgfLUivbmuGYA=="],
 
-    "@vue/shared": ["@vue/shared@3.5.33", "", {}, "sha512-5vR2QIlmaLG77Ygd4pMP6+SGQ5yox9VhtnbDWTy9DzMzdmeLxZ1QqxrywEZ9sa1AVubfIJyaCG3ytyWU81ufcQ=="],
+    "@vue/shared": ["@vue/shared@3.5.42", "", {}, "sha512-2rPxex1jQf4jvl9MOHl6YaXCPcrNqz/FstMOEh3QWY+/OME9nQTvl9WYeCwhW7AFjaR0SnngZGlp/wkR6rkI6g=="],
 
     "acorn": ["acorn@8.16.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw=="],
 
@@ -809,23 +840,21 @@
 
     "assert-never": ["assert-never@1.4.0", "", {}, "sha512-5oJg84os6NMQNl27T9LnZkvvqzvAnHu03ShCnoj6bsJwS7L8AO4lf+C/XjK/nvzEqQB744moC6V128RucQd1jA=="],
 
-    "ast-module-types": ["ast-module-types@6.0.1", "", {}, "sha512-WHw67kLXYbZuHTmcdbIrVArCq5wxo6NEuj3hiYAWr8mwJeC+C2mMCIBIWCiDoCye/OF/xelc+teJ1ERoWmnEIA=="],
+    "ast-module-types": ["ast-module-types@6.0.2", "", {}, "sha512-6KuK/7nZ/2Qh7sGuVEiwxjCxzTY2Pdb5mTo5z1e6/J8BA0tvjR7G8vQJKrQMTqwmnA3UPEyKIFX4YUS1DO1Hvw=="],
 
     "astral-regex": ["astral-regex@2.0.0", "", {}, "sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ=="],
 
     "atomically": ["atomically@2.1.1", "", { "dependencies": { "stubborn-fs": "^2.0.0", "when-exit": "^2.1.4" } }, "sha512-P4w9o2dqARji6P7MHprklbfiArZAWvo07yW7qs3pdljb3BWr12FIB7W+p0zJiuiVsUpRO0iZn1kFFcpPegg0tQ=="],
 
-    "babel-plugin-react-compiler": ["babel-plugin-react-compiler@1.0.0", "", { "dependencies": { "@babel/types": "^7.26.0" } }, "sha512-Ixm8tFfoKKIPYdCCKYTsqv+Fd4IJ0DQqMyEimo+pxUOMUR9cVPlwTrFt9Avu+3cb6Zp3mAzl+t1MrG2fxxKsxw=="],
-
     "babel-walk": ["babel-walk@3.0.0-canary-5", "", { "dependencies": { "@babel/types": "^7.9.6" } }, "sha512-GAwkz0AihzY5bkwIY5QDR+LvsRQgB/B+1foMPvi0FZPMl5fjD7ICiznUiBdLYMH1QYe6vqu4gWYytZOccLouFw=="],
 
-    "badgen": ["badgen@3.2.3", "", {}, "sha512-svDuwkc63E/z0ky3drpUppB83s/nlgDciH9m+STwwQoWyq7yCgew1qEfJ+9axkKdNq7MskByptWUN9j1PGMwFA=="],
+    "badgen": ["badgen@3.3.2", "", {}, "sha512-fbQwK9norfdzbdsoPwbLIAmgBXDGEme3jeIyqPAH7o6vp9lmuLHS7uXULvOiQ6XnMLkYNG4gDjILf74hgtTAug=="],
 
     "balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
 
     "base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="],
 
-    "baseline-browser-mapping": ["baseline-browser-mapping@2.10.27", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-zEs/ufmZoUd7WftKpKyXaT6RFxpQ5Qm9xytKRHvJfxFV9DFJkZph9RvJ1LcOUi0Z1ZVijMte65JbILeV+8QQEA=="],
+    "baseline-browser-mapping": ["baseline-browser-mapping@2.11.21", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-uh8vpY/1/YyFkunIDFH/12p7/7VdPKA1hejMVEbdkEaWnUz0Hesvx5EbiU6XxjyHZIOju+ZMbQJkRh+es3/spQ=="],
 
     "bidi-js": ["bidi-js@1.0.3", "", { "dependencies": { "require-from-string": "^2.0.2" } }, "sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw=="],
 
@@ -839,15 +868,17 @@
 
     "boundary": ["boundary@2.0.0", "", {}, "sha512-rJKn5ooC9u8q13IMCrW0RSp31pxBCHE3y9V/tp3TdWSLf8Em3p6Di4NBpfzbJge9YjjFEsD0RtFEjtvHL5VyEA=="],
 
-    "brace-expansion": ["brace-expansion@5.0.5", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ=="],
+    "brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
 
     "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
 
-    "browserslist": ["browserslist@4.28.2", "", { "dependencies": { "baseline-browser-mapping": "^2.10.12", "caniuse-lite": "^1.0.30001782", "electron-to-chromium": "^1.5.328", "node-releases": "^2.0.36", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg=="],
+    "browserslist": ["browserslist@4.28.9", "", { "dependencies": { "baseline-browser-mapping": "^2.11.20", "caniuse-lite": "^1.0.30001810", "electron-to-chromium": "^1.5.420", "node-releases": "^2.0.54", "update-browserslist-db": "^1.3.2" }, "bin": { "browserslist": "cli.js" } }, "sha512-EWazOblFYUvlGZcfGhPUPmYh3nikUxBVb+y9MJun5f3hBi812X+8MSQTujLBtgK3cf51fJWbWfOjyeO954d+Eg=="],
 
     "buffer": ["buffer@5.7.1", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.1.13" } }, "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ=="],
 
-    "bun-types": ["bun-types@1.3.13", "", { "dependencies": { "@types/node": "*" } }, "sha512-QXKeHLlOLqQX9LgYaHJfzdBaV21T63HhFJnvuRCcjZiaUDpbs5ED1MgxbMra71CsryN/1dAoXuJJJwIv/2drVA=="],
+    "buffer-image-size": ["buffer-image-size@0.6.4", "", { "dependencies": { "@types/node": "*" } }, "sha512-nEh+kZOPY1w+gcCMobZ6ETUp9WfibndnosbpwB1iJk/8Gt5ZF2bhS6+B6bPYz424KtwsR6Rflc3tCz1/ghX2dQ=="],
+
+    "bun-types": ["bun-types@1.4.0", "", { "dependencies": { "@types/node": "*" } }, "sha512-iIKw23BspnQQYd3prITOBxeUsxBHnwzX6YJfGMuNOZzeNcMmVqzIIVGRm1l69ogaPQmb4wB6BN8mA5bE9YuC5Q=="],
 
     "bytes": ["bytes@3.1.2", "", {}, "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="],
 
@@ -855,12 +886,14 @@
 
     "call-bound": ["call-bound@1.0.4", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "get-intrinsic": "^1.3.0" } }, "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg=="],
 
-    "caniuse-lite": ["caniuse-lite@1.0.30001791", "", {}, "sha512-yk0l/YSrOnFZk3UROpDLQD9+kC1l4meK/wed583AXrzoarMGJcbRi2Q4RaUYbKxYAsZ8sWmaSa/DsLmdBeI1vQ=="],
+    "caniuse-lite": ["caniuse-lite@1.0.30001810", "", {}, "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg=="],
 
     "chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
 
     "character-parser": ["character-parser@2.2.0", "", { "dependencies": { "is-regex": "^1.0.3" } }, "sha512-+UqJQjFEFaTAs3bNsF2j2kEN1baG/zghZbdqoYEDxGZtJo9LBzl1A+m0D4n3qKx8N2FNv8/Xp6yV9mQmBuptaw=="],
 
+    "cjs-module-lexer": ["cjs-module-lexer@2.2.1", "", {}, "sha512-Ca8swihM+/4yKecYHY52kgJd300hi2lADU/a1RxNTRe+RJ9jvqQlESpbz9DnG9mowez8qwXHB8qYdIUw9e+F5Q=="],
+
     "cli-cursor": ["cli-cursor@3.1.0", "", { "dependencies": { "restore-cursor": "^3.1.0" } }, "sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw=="],
 
     "cli-spinners": ["cli-spinners@2.9.2", "", {}, "sha512-ywqV+5MmyL4E7ybXgKys4DugZbX0FC6LnwrhjuykIjnK9k8OQacQ7axGKnjDXWNhns0xot3bZI5h55H8yo9cJg=="],
@@ -883,11 +916,13 @@
 
     "conf": ["conf@15.1.0", "", { "dependencies": { "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "atomically": "^2.0.3", "debounce-fn": "^6.0.0", "dot-prop": "^10.0.0", "env-paths": "^3.0.0", "json-schema-typed": "^8.0.1", "semver": "^7.7.2", "uint8array-extras": "^1.5.0" } }, "sha512-Uy5YN9KEu0WWDaZAVJ5FAmZoaJt9rdK6kH+utItPyGsCqCgaTKkrmZx3zoE0/3q6S3bcp3Ihkk+ZqPxWxFK5og=="],
 
+    "confbox": ["confbox@0.2.4", "", {}, "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ=="],
+
     "constantinople": ["constantinople@4.0.1", "", { "dependencies": { "@babel/parser": "^7.6.0", "@babel/types": "^7.6.1" } }, "sha512-vCrqcSIq4//Gx74TXXCGnHpulY1dskqLTFGDmhrGxzeXL8lF8kvXv6mpNWlJj1uD4DW23D4ljAqbY4RRaaUZIw=="],
 
     "convert-source-map": ["convert-source-map@2.0.0", "", {}, "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg=="],
 
-    "crelt": ["crelt@1.0.6", "", {}, "sha512-VQ2MBenTq1fWZUH9DJNGti7kKv6EeAuYr3cLwxUWhIu1baTaXh4Ib5W2CqHVqib4/MqbYGJqiL3Zb8GJZr3l4g=="],
+    "crelt": ["crelt@1.0.7", "", {}, "sha512-aK6BbWfhf4U/wCcLHKPJl/xa6VkVstRaPywWtMKGwuOLc/wZTyQYuoxgvZnNsBvv7Kg3YTBQYYBCggcviQczuA=="],
 
     "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
 
@@ -909,13 +944,13 @@
 
     "defaults": ["defaults@1.0.4", "", { "dependencies": { "clone": "^1.0.2" } }, "sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A=="],
 
-    "dependency-cruiser": ["dependency-cruiser@17.4.0", "", { "dependencies": { "acorn": "8.16.0", "acorn-jsx": "5.3.2", "acorn-jsx-walk": "2.0.0", "acorn-loose": "8.5.2", "acorn-walk": "8.3.5", "commander": "14.0.3", "enhanced-resolve": "5.21.0", "ignore": "7.0.5", "interpret": "3.1.1", "is-installed-globally": "1.0.0", "json5": "2.2.3", "picomatch": "4.0.4", "prompts": "2.4.2", "rechoir": "0.8.0", "safe-regex": "2.1.1", "semver": "7.7.4", "tsconfig-paths-webpack-plugin": "4.2.0", "watskeburt": "5.0.3" }, "bin": { "dependency-cruiser": "bin/dependency-cruise.mjs", "dependency-cruise": "bin/dependency-cruise.mjs", "depcruise": "bin/dependency-cruise.mjs", "depcruise-baseline": "bin/depcruise-baseline.mjs", "depcruise-fmt": "bin/depcruise-fmt.mjs", "depcruise-wrap-stream-in-html": "bin/wrap-stream-in-html.mjs" } }, "sha512-+WdFoOb+fT1XNC0iPqOyLpfhLd8xVh7eLXJxPAtiXCS+YmXzGrjqVTte7+L8SZIsnJj0aFhb8LxECIBJY5TTIA=="],
+    "dependency-cruiser": ["dependency-cruiser@17.4.3", "", { "dependencies": { "acorn": "8.16.0", "acorn-jsx": "5.3.2", "acorn-jsx-walk": "2.0.0", "acorn-loose": "8.5.2", "acorn-walk": "8.3.5", "commander": "14.0.3", "enhanced-resolve": "5.22.1", "ignore": "7.0.5", "interpret": "3.1.1", "is-installed-globally": "1.0.0", "json5": "2.2.3", "picomatch": "4.0.4", "prompts": "2.4.2", "rechoir": "0.8.0", "safe-regex": "2.1.1", "semver": "7.8.1", "tsconfig-paths-webpack-plugin": "4.2.0", "watskeburt": "5.0.3" }, "bin": { "depcruise": "bin/dependency-cruise.mjs", "depcruise-fmt": "bin/depcruise-fmt.mjs", "dependency-cruise": "bin/dependency-cruise.mjs", "depcruise-baseline": "bin/depcruise-baseline.mjs", "dependency-cruiser": "bin/dependency-cruise.mjs", "depcruise-wrap-stream-in-html": "bin/wrap-stream-in-html.mjs" } }, "sha512-L4GLuAvmXevWnPCIaFfOz6eD92c+yY+pDgVqgufrLDnW3xYA799CSZQlly2r2N13nhAlnZY6VzY7Rx5pHNvk2w=="],
 
-    "dependency-tree": ["dependency-tree@11.4.3", "", { "dependencies": { "commander": "^12.1.0", "filing-cabinet": "^5.3.0", "precinct": "^12.3.1", "typescript": "^5.9.3" }, "bin": { "dependency-tree": "bin/cli.js" } }, "sha512-Y2gzOJ2Rb2X7MN6pT9llWpXxl5J5s5/11CBpJ5b85DjEqZH7jv3T9RO6HRV/PI/3MDmaKn/g7uoYdYmSb9vLlw=="],
+    "dependency-tree": ["dependency-tree@11.5.0", "", { "dependencies": { "@discoveryjs/json-ext": "^1.1.0", "commander": "^12.1.0", "filing-cabinet": "^5.5.1", "precinct": "^12.3.2", "typescript": "^5.9.3" }, "bin": { "dependency-tree": "bin/cli.js" } }, "sha512-K9zBwKDZrot3RkxizugpVSdImxULAg4Ycp3+ydy2r561k96oiiw6nfsOR15fwNDQ5BF2UXe+2JFM/H5Xz4MGQg=="],
 
     "dequal": ["dequal@2.0.3", "", {}, "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA=="],
 
-    "deslop-js": ["deslop-js@0.0.13", "", { "dependencies": { "@oxc-project/types": "^0.132.0", "fast-glob": "^3.3.3", "minimatch": "^10.2.5", "oxc-parser": "^0.132.0", "oxc-resolver": "^11.19.1", "typescript": "^6.0.3" } }, "sha512-gIXD+wY2/NHkZHpNrb8MWS6NJs3ee0XunAenBCvwHJlWnedDbIrg70hdNR7bDzYZLe9LGJZMLEI1w2CC72Gk5A=="],
+    "deslop-js": ["deslop-js@0.0.14", "", { "dependencies": { "@oxc-project/types": "^0.132.0", "fast-glob": "^3.3.3", "minimatch": "^10.2.5", "oxc-parser": "^0.132.0", "oxc-resolver": "^11.19.1", "typescript": "^6.0.3" } }, "sha512-FY0rNK+mdTozXwNmcJAt5tD9hVOkXEX5ac+Mg77KJvnnsoAh3qIUW64PMnofutjeYz7g1vENMbOcrBmD1v4FlA=="],
 
     "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
 
@@ -925,7 +960,7 @@
 
     "detective-es6": ["detective-es6@5.0.2", "", { "dependencies": { "node-source-walk": "^7.0.1" } }, "sha512-+qHHGYhjupiVs4rnIpI9nZ5B130A4AmE35ZX1w33hb46vcZ7T3jfDbvmPw0FhWtMHn5BS5HHu7ZtnZ53bMcXZA=="],
 
-    "detective-postcss": ["detective-postcss@7.0.1", "", { "dependencies": { "is-url": "^1.2.4", "postcss-values-parser": "^6.0.2" }, "peerDependencies": { "postcss": "^8.4.47" } }, "sha512-bEOVpHU9picRZux5XnwGsmCN4+8oZo7vSW0O0/Enq/TO5R2pIAP2279NsszpJR7ocnQt4WXU0+nnh/0JuK4KHQ=="],
+    "detective-postcss": ["detective-postcss@8.0.4", "", { "dependencies": { "is-url-superb": "^4.0.0", "postcss-values-parser": "^6.0.2" }, "peerDependencies": { "postcss": "^8.4.47" } }, "sha512-DZ7M/hWPZyr17ZUdoQ+TVXaPj70mYr4XXrAE+GeJbca44haCvZgb191L/jLJmFYewhxRJuBd4lUtNSu986TXag=="],
 
     "detective-sass": ["detective-sass@6.0.2", "", { "dependencies": { "gonzales-pe": "^4.3.0", "node-source-walk": "^7.0.1" } }, "sha512-i3xpXHDKS0qI2aFW4asQ7fqlPK00ndOVZELvQapFJCaF0VxYmsNWtd0AmvXbTLMk7bfO5VdIeorhY9KfmHVoVA=="],
 
@@ -941,9 +976,9 @@
 
     "dom-accessibility-api": ["dom-accessibility-api@0.5.16", "", {}, "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg=="],
 
-    "dompurify": ["dompurify@3.4.2", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-lHeS9SA/IKeIFFyYciHBr2n0v1VMPlSj843HdLOwjb2OxNwdq9Xykxqhk+FE42MzAdHvInbAolSE4mhahPpjXA=="],
+    "dompurify": ["dompurify@3.4.14", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-dVoH9z+MY+C9IilgGCk3YfFqjLi3fChm2OiKJMzh6axrJ5qwxqWaZamgmHrpv22CN/KdbZJuGEGgfQoL00LTdg=="],
 
-    "dot-prop": ["dot-prop@10.1.0", "", { "dependencies": { "type-fest": "^5.0.0" } }, "sha512-MVUtAugQMOff5RnBy2d9N31iG0lNwg1qAoAOn7pOK5wf94WIaE3My2p3uwTQuvS2AcqchkcR3bHByjaM0mmi7Q=="],
+    "dot-prop": ["dot-prop@10.2.0", "", { "dependencies": { "type-fest": "^5.0.0" } }, "sha512-BTJ9aZYL3vCfZlZOBLy9v8TUqWGQ0pzFnygKwFZt5udj6viBoFIBviKPUoZLDCPn1FoXffv6McQFDenrm5Krfw=="],
 
     "dunder-proto": ["dunder-proto@1.0.1", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.1", "es-errors": "^1.3.0", "gopd": "^1.2.0" } }, "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A=="],
 
@@ -951,13 +986,13 @@
 
     "effect": ["effect@4.0.0-beta.70", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "fast-check": "^4.8.0", "find-my-way-ts": "^0.1.6", "ini": "^7.0.0", "kubernetes-types": "^1.30.0", "msgpackr": "^2.0.1", "multipasta": "^0.2.7", "toml": "^4.1.1", "uuid": "^14.0.0", "yaml": "^2.9.0" } }, "sha512-8AwGTRiNriirHGEYHrOS0E9fzdhIqCdZjiHP1YXmNo2UyPGS43ILsymsSHT7V0DJS+8dvlKq2RxnrDBUhDNZHg=="],
 
-    "electron-to-chromium": ["electron-to-chromium@1.5.349", "", {}, "sha512-QsWVGyRuY07Aqb234QytTfwd5d9AJlfNIQ5wIOl1L+PZDzI9d9+Fn0FRale/QYlFxt/bUnB0/nLd1jFPGxGK1A=="],
+    "electron-to-chromium": ["electron-to-chromium@1.5.422", "", {}, "sha512-UvA/32XqrLDdZSn7Jllo1AYNcWji/G0d5M0GTViE7KoGBiMunw3a34Sb2KO4ZZyrSEhqsxFoVhWWJshdyfKqJA=="],
 
     "emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
 
     "end-of-stream": ["end-of-stream@1.4.5", "", { "dependencies": { "once": "^1.4.0" } }, "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg=="],
 
-    "enhanced-resolve": ["enhanced-resolve@5.21.0", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.3" } }, "sha512-otxSQPw4lkOZWkHpB3zaEQs6gWYEsmX4xQF68ElXC/TWvGxGMSGOvoNbaLXm6/cS/fSfHtsEdw90y20PCd+sCA=="],
+    "enhanced-resolve": ["enhanced-resolve@5.22.1", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.3" } }, "sha512-6QEuw3zoX1SJQc7b87aBXke/no+mG2bTBgw29gWMQonLmpEkWoCAVkl+M49e48AZlWzxiDzDZzYdp6kobcyLww=="],
 
     "entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
 
@@ -969,9 +1004,11 @@
 
     "es-errors": ["es-errors@1.3.0", "", {}, "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="],
 
-    "es-object-atoms": ["es-object-atoms@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0" } }, "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA=="],
+    "es-module-lexer": ["es-module-lexer@2.3.2", "", {}, "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw=="],
 
-    "esbuild": ["esbuild@0.28.0", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.0", "@esbuild/android-arm": "0.28.0", "@esbuild/android-arm64": "0.28.0", "@esbuild/android-x64": "0.28.0", "@esbuild/darwin-arm64": "0.28.0", "@esbuild/darwin-x64": "0.28.0", "@esbuild/freebsd-arm64": "0.28.0", "@esbuild/freebsd-x64": "0.28.0", "@esbuild/linux-arm": "0.28.0", "@esbuild/linux-arm64": "0.28.0", "@esbuild/linux-ia32": "0.28.0", "@esbuild/linux-loong64": "0.28.0", "@esbuild/linux-mips64el": "0.28.0", "@esbuild/linux-ppc64": "0.28.0", "@esbuild/linux-riscv64": "0.28.0", "@esbuild/linux-s390x": "0.28.0", "@esbuild/linux-x64": "0.28.0", "@esbuild/netbsd-arm64": "0.28.0", "@esbuild/netbsd-x64": "0.28.0", "@esbuild/openbsd-arm64": "0.28.0", "@esbuild/openbsd-x64": "0.28.0", "@esbuild/openharmony-arm64": "0.28.0", "@esbuild/sunos-x64": "0.28.0", "@esbuild/win32-arm64": "0.28.0", "@esbuild/win32-ia32": "0.28.0", "@esbuild/win32-x64": "0.28.0" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw=="],
+    "es-object-atoms": ["es-object-atoms@1.1.2", "", { "dependencies": { "es-errors": "^1.3.0" } }, "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw=="],
+
+    "esbuild": ["esbuild@0.28.2", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.2", "@esbuild/android-arm": "0.28.2", "@esbuild/android-arm64": "0.28.2", "@esbuild/android-x64": "0.28.2", "@esbuild/darwin-arm64": "0.28.2", "@esbuild/darwin-x64": "0.28.2", "@esbuild/freebsd-arm64": "0.28.2", "@esbuild/freebsd-x64": "0.28.2", "@esbuild/linux-arm": "0.28.2", "@esbuild/linux-arm64": "0.28.2", "@esbuild/linux-ia32": "0.28.2", "@esbuild/linux-loong64": "0.28.2", "@esbuild/linux-mips64el": "0.28.2", "@esbuild/linux-ppc64": "0.28.2", "@esbuild/linux-riscv64": "0.28.2", "@esbuild/linux-s390x": "0.28.2", "@esbuild/linux-x64": "0.28.2", "@esbuild/netbsd-arm64": "0.28.2", "@esbuild/netbsd-x64": "0.28.2", "@esbuild/openbsd-arm64": "0.28.2", "@esbuild/openbsd-x64": "0.28.2", "@esbuild/openharmony-arm64": "0.28.2", "@esbuild/sunos-x64": "0.28.2", "@esbuild/win32-arm64": "0.28.2", "@esbuild/win32-ia32": "0.28.2", "@esbuild/win32-x64": "0.28.2" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA=="],
 
     "escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="],
 
@@ -979,13 +1016,13 @@
 
     "escodegen": ["escodegen@2.1.0", "", { "dependencies": { "esprima": "^4.0.1", "estraverse": "^5.2.0", "esutils": "^2.0.2" }, "optionalDependencies": { "source-map": "~0.6.1" }, "bin": { "esgenerate": "bin/esgenerate.js", "escodegen": "bin/escodegen.js" } }, "sha512-2NlIDTwUWJN0mRPQOdtQBzbUHvdGY2P1VXSyU83Q3xKxM7WHX2Ql8dKq782Q9TgQUNOLEzEYu9bzLNj1q88I5w=="],
 
-    "eslint": ["eslint@10.3.0", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.8.0", "@eslint-community/regexpp": "^4.12.2", "@eslint/config-array": "^0.23.5", "@eslint/config-helpers": "^0.5.5", "@eslint/core": "^1.2.1", "@eslint/plugin-kit": "^0.7.1", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", "@humanwhocodes/retry": "^0.4.2", "@types/estree": "^1.0.6", "ajv": "^6.14.0", "cross-spawn": "^7.0.6", "debug": "^4.3.2", "escape-string-regexp": "^4.0.0", "eslint-scope": "^9.1.2", "eslint-visitor-keys": "^5.0.1", "espree": "^11.2.0", "esquery": "^1.7.0", "esutils": "^2.0.2", "fast-deep-equal": "^3.1.3", "file-entry-cache": "^8.0.0", "find-up": "^5.0.0", "glob-parent": "^6.0.2", "ignore": "^5.2.0", "imurmurhash": "^0.1.4", "is-glob": "^4.0.0", "json-stable-stringify-without-jsonify": "^1.0.1", "minimatch": "^10.2.4", "natural-compare": "^1.4.0", "optionator": "^0.9.3" }, "peerDependencies": { "jiti": "*" }, "optionalPeers": ["jiti"], "bin": { "eslint": "bin/eslint.js" } }, "sha512-XbEXaRva5cF0ZQB8w6MluHA0kZZfV2DuCMJ3ozyEOHLwDpZX2Lmm/7Pp0xdJmI0GL1W05VH5VwIFHEm1Vcw2gw=="],
+    "eslint": ["eslint@10.9.1", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.8.0", "@eslint-community/regexpp": "^4.12.2", "@eslint/config-array": "^0.23.5", "@eslint/config-helpers": "^0.7.0", "@eslint/core": "^1.2.1", "@eslint/plugin-kit": "^0.7.2", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", "@humanwhocodes/retry": "^0.4.2", "@types/estree": "^1.0.6", "ajv": "^6.14.0", "cross-spawn": "^7.0.6", "debug": "^4.3.2", "escape-string-regexp": "^4.0.0", "eslint-scope": "^9.1.2", "eslint-visitor-keys": "^5.0.1", "espree": "^11.2.0", "esquery": "^1.7.0", "esutils": "^2.0.2", "fast-deep-equal": "^3.1.3", "file-entry-cache": "^8.0.0", "find-up": "^5.0.0", "glob-parent": "^6.0.2", "ignore": "^5.2.0", "imurmurhash": "^0.1.4", "is-glob": "^4.0.0", "json-stable-stringify-without-jsonify": "^1.0.1", "minimatch": "^10.2.5", "natural-compare": "^1.4.0", "optionator": "^0.9.3" }, "peerDependencies": { "jiti": "*" }, "optionalPeers": ["jiti"], "bin": { "eslint": "bin/eslint.js" } }, "sha512-9VaAkDURekixUQJy0oJYl2DcN6oKMfxay7XzaGYAWQwsb6qfKf+x76R2k1L8kb1boc+FyCAaTA9GmiKaaiaF+A=="],
 
     "eslint-plugin-react-compiler": ["eslint-plugin-react-compiler@19.1.0-rc.2", "", { "dependencies": { "@babel/core": "^7.24.4", "@babel/parser": "^7.24.4", "@babel/plugin-proposal-private-methods": "^7.18.6", "hermes-parser": "^0.25.1", "zod": "^3.22.4", "zod-validation-error": "^3.0.3" }, "peerDependencies": { "eslint": ">=7" } }, "sha512-oKalwDGcD+RX9mf3NEO4zOoUMeLvjSvcbbEOpquzmzqEEM2MQdp7/FY/Hx9NzmUwFzH1W9SKTz5fihfMldpEYw=="],
 
     "eslint-plugin-react-hooks": ["eslint-plugin-react-hooks@7.1.1", "", { "dependencies": { "@babel/core": "^7.24.4", "@babel/parser": "^7.24.4", "hermes-parser": "^0.25.1", "zod": "^3.25.0 || ^4.0.0", "zod-validation-error": "^3.5.0 || ^4.0.0" }, "peerDependencies": { "eslint": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0 || ^10.0.0" } }, "sha512-f2I7Gw6JbvCexzIInuSbZpfdQ44D7iqdWX01FKLvrPgqxoE7oMj8clOfto8U6vYiz4yd5oKu39rRSVOe1zRu0g=="],
 
-    "eslint-plugin-react-refresh": ["eslint-plugin-react-refresh@0.5.2", "", { "peerDependencies": { "eslint": "^9 || ^10" } }, "sha512-hmgTH57GfzoTFjVN0yBwTggnsVUF2tcqi7RJZHqi9lIezSs4eFyAMktA68YD4r5kNw1mxyY4dmkyoFDb3FIqrA=="],
+    "eslint-plugin-react-refresh": ["eslint-plugin-react-refresh@0.5.6", "", { "peerDependencies": { "eslint": "^9 || ^10" } }, "sha512-uZnh24On2bk478AkaDAKcpRiYhS3qFSaSNvpXxV6/Ek/BBDICkWGG7MnBSfjnIlCVBei5vsLlIeQYxbF22+Udg=="],
 
     "eslint-scope": ["eslint-scope@9.1.2", "", { "dependencies": { "@types/esrecurse": "^4.3.1", "@types/estree": "^1.0.8", "esrecurse": "^4.3.0", "estraverse": "^5.2.0" } }, "sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ=="],
 
@@ -1009,15 +1046,15 @@
 
     "eventsource": ["eventsource@3.0.7", "", { "dependencies": { "eventsource-parser": "^3.0.1" } }, "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA=="],
 
-    "eventsource-parser": ["eventsource-parser@3.1.0", "", {}, "sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg=="],
+    "eventsource-parser": ["eventsource-parser@3.1.1", "", {}, "sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ=="],
 
     "execa": ["execa@4.1.0", "", { "dependencies": { "cross-spawn": "^7.0.0", "get-stream": "^5.0.0", "human-signals": "^1.1.1", "is-stream": "^2.0.0", "merge-stream": "^2.0.0", "npm-run-path": "^4.0.0", "onetime": "^5.1.0", "signal-exit": "^3.0.2", "strip-final-newline": "^2.0.0" } }, "sha512-j5W0//W7f8UxAn8hXVnwG8tLwdiUy4FJLcSupCg6maBYZDpyBvTApK7KyuI4bKj8KOh1r2YH+6ucuYtJv1bTZA=="],
 
-    "fast-check": ["fast-check@4.8.0", "", { "dependencies": { "pure-rand": "^8.0.0" } }, "sha512-GOJ158CUMnN6cSahsv4+ExARvIDuzzinFjkp0E9WtiBa5zcVeLozVkWaE4IzFcc+Y48Wp1EDlUZsXRyAztQcSg=="],
+    "fast-check": ["fast-check@4.9.0", "", { "dependencies": { "pure-rand": "^8.0.0" } }, "sha512-7ms6T7SybUev/PQITciI0yLM2pOSFy5zpG8Ty7tQofcVaQUvrMXp6CBwqF6fThLCLOrfBtuHAtwq6Yu4XPCllg=="],
 
     "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="],
 
-    "fast-equals": ["fast-equals@5.4.0", "", {}, "sha512-jt2DW/aNFNwke7AUd+Z+e6pz39KO5rzdbbFCg2sGafS4mk13MI7Z8O5z9cADNn5lhGODIgLwug6TZO2ctf7kcw=="],
+    "fast-equals": ["fast-equals@5.4.2", "", {}, "sha512-Ywe6jodPTWOTL9/k0bV7gdfP8twKL5Y8I8CZ933fAY5gBekICZSUQTbyH6ut2NZCNyB05mSUwAuEqdEIaOOlDQ=="],
 
     "fast-glob": ["fast-glob@3.3.3", "", { "dependencies": { "@nodelib/fs.stat": "^2.0.2", "@nodelib/fs.walk": "^1.2.3", "glob-parent": "^5.1.2", "merge2": "^1.3.0", "micromatch": "^4.0.8" } }, "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg=="],
 
@@ -1025,19 +1062,19 @@
 
     "fast-levenshtein": ["fast-levenshtein@2.0.6", "", {}, "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw=="],
 
-    "fast-uri": ["fast-uri@3.1.1", "", {}, "sha512-h2r7rcm6Ee/J8o0LD5djLuFVcfbZxhvho4vvsbeV0aMvXjUgqv4YpxpkEx0d68l6+IleVfLAdVEfhR7QNMkGHQ=="],
+    "fast-uri": ["fast-uri@3.1.7", "", {}, "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg=="],
 
-    "fastq": ["fastq@1.20.1", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw=="],
+    "fastq": ["fastq@1.20.3", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw=="],
 
     "fd-package-json": ["fd-package-json@2.0.0", "", { "dependencies": { "walk-up-path": "^4.0.0" } }, "sha512-jKmm9YtsNXN789RS/0mSzOC1NUq9mkVd65vbSSVsKdjGvYXBuE4oWe2QOEoFeRmJg+lPuZxpmrfFclNhoRMneQ=="],
 
     "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="],
 
-    "fflate": ["fflate@0.8.2", "", {}, "sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A=="],
+    "fflate": ["fflate@0.8.3", "", {}, "sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA=="],
 
     "file-entry-cache": ["file-entry-cache@8.0.0", "", { "dependencies": { "flat-cache": "^4.0.0" } }, "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ=="],
 
-    "filing-cabinet": ["filing-cabinet@5.4.1", "", { "dependencies": { "app-module-path": "^2.2.0", "commander": "^12.1.0", "enhanced-resolve": "^5.21.0", "module-definition": "^6.0.2", "module-lookup-amd": "^9.1.3", "resolve": "^1.22.12", "resolve-dependency-path": "^4.0.1", "sass-lookup": "^6.1.2", "stylus-lookup": "^6.1.2", "tsconfig-paths": "^4.2.0", "typescript": "^5.9.3" }, "bin": { "filing-cabinet": "bin/cli.js" } }, "sha512-XSZKDRYZ7ijMsr6aTD5rUy5nh4Dsg4+N74bufCHzdhFAh4argabH8CBGcus1ha+hGbJf7OQmbtTVVNnb1uDpmw=="],
+    "filing-cabinet": ["filing-cabinet@5.5.1", "", { "dependencies": { "app-module-path": "^2.2.0", "commander": "^12.1.0", "enhanced-resolve": "^5.21.0", "module-definition": "^6.0.2", "module-lookup-amd": "^9.1.3", "resolve": "^1.22.12", "resolve-dependency-path": "^4.0.1", "sass-lookup": "^6.1.2", "stylus-lookup": "^6.1.2", "tsconfig-paths": "^4.2.0", "typescript": "^5.9.3" }, "bin": { "filing-cabinet": "bin/cli.js" } }, "sha512-PzLBTChlVPn6LnNxF0KWs+XqPziVh3Sfmz/3TXOymHxu6a9yhrDcQn7YwgpcRM6mqhR2WHVGPR8RU4fmcF1IVA=="],
 
     "fill-range": ["fill-range@7.1.1", "", { "dependencies": { "to-regex-range": "^5.0.1" } }, "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg=="],
 
@@ -1047,11 +1084,11 @@
 
     "flat-cache": ["flat-cache@4.0.1", "", { "dependencies": { "flatted": "^3.2.9", "keyv": "^4.5.4" } }, "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw=="],
 
-    "flatted": ["flatted@3.4.2", "", {}, "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA=="],
+    "flatted": ["flatted@3.4.4", "", {}, "sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q=="],
 
-    "formatly": ["formatly@0.3.0", "", { "dependencies": { "fd-package-json": "^2.0.0" }, "bin": { "formatly": "bin/index.mjs" } }, "sha512-9XNj/o4wrRFyhSMJOvsuyMwy8aUfBaZ1VrqHVfohyXf0Sw0e+yfKG+xZaY3arGCOMdwFsqObtzVOc1gU9KiT9w=="],
+    "formatly": ["formatly@0.7.0", "", { "dependencies": { "fd-package-json": "^2.0.0", "package-manager-detector": "^1.8.0" }, "bin": { "formatly": "bin/index.mjs" } }, "sha512-7CXJtIIA0zy/u12StsYk25qVKxvdLA2ep2sTNxK3ov0mGNIIDqIvAXDSgTnAfDJFsPfWjuz0WjfYSdpvnLA5Tg=="],
 
-    "fs-extra": ["fs-extra@11.3.4", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-CTXd6rk/M3/ULNQj8FBqBWHYBVYybQ3VPBw0xGKFe3tuH7ytT6ACnvzpIQ3UZtB8yvUKC2cXn1a+x+5EVQLovA=="],
+    "fs-extra": ["fs-extra@11.4.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-EQsFzMUJkCKGr1ePqlYADkIUmHW1s3ZXr5Yqy6wbGrfUCphpl2maM/kyOIRA2HpP3AaFQTZXD4ldjek+nccddA=="],
 
     "fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="],
 
@@ -1069,15 +1106,15 @@
 
     "get-stream": ["get-stream@5.2.0", "", { "dependencies": { "pump": "^3.0.0" } }, "sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA=="],
 
-    "get-tsconfig": ["get-tsconfig@4.14.0", "", { "dependencies": { "resolve-pkg-maps": "^1.0.0" } }, "sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA=="],
+    "get-tsconfig": ["get-tsconfig@4.14.3", "", { "dependencies": { "resolve-pkg-maps": "^1.0.0" } }, "sha512-++QEw4DIY7WGoukz+/+A/8dGYPT9l9yIadnmSgZ8Rjr3YVSVDipQSO9CdnJo9ePqFqUUqh+wk9uIaoiAwsiPkA=="],
 
     "glob-parent": ["glob-parent@6.0.2", "", { "dependencies": { "is-glob": "^4.0.3" } }, "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A=="],
 
     "global-directory": ["global-directory@4.0.1", "", { "dependencies": { "ini": "4.1.1" } }, "sha512-wHTUcDUoZ1H5/0iVqEudYW4/kAlN5cZ3j/bXn0Dpbizl9iaUVeWSHqiOjsgk6OW2bkLclbBjzewBz6weQ1zA2Q=="],
 
-    "globals": ["globals@17.6.0", "", {}, "sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA=="],
+    "globals": ["globals@17.12.0", "", {}, "sha512-cezEd/DTyyht9cvSSURyygXPfy04GtWO/5e6ZPvH7fCtjKz9PYOmuawphw1Ctd1f6C+5JypXfGD7ahNMXvevBA=="],
 
-    "globby": ["globby@16.2.0", "", { "dependencies": { "@sindresorhus/merge-streams": "^4.0.0", "fast-glob": "^3.3.3", "ignore": "^7.0.5", "is-path-inside": "^4.0.0", "slash": "^5.1.0", "unicorn-magic": "^0.4.0" } }, "sha512-QrJia2qDf5BB/V6HYlDTs0I0lBahyjLzpGQg3KT7FnCdTonAyPy2RtY802m2k4ALx6Dp752f82WsOczEVr3l6Q=="],
+    "globby": ["globby@16.2.4", "", { "dependencies": { "@sindresorhus/merge-streams": "^4.0.0", "fast-glob": "^3.3.3", "ignore": "^7.0.5", "is-path-inside": "^4.0.0", "micromatch": "^4.0.8", "slash": "^5.1.0", "unicorn-magic": "^0.4.0" } }, "sha512-c8B/VNLmxRcmqqenRA9t+9IyOjf9+V6lTxPaUJLqOCONdQkWZ0ETYgX0qbtJqPsgCNusT9MZ5Jeidw8Eb9tn2g=="],
 
     "gonzales-pe": ["gonzales-pe@4.3.0", "", { "dependencies": { "minimist": "^1.2.5" }, "bin": { "gonzales": "bin/gonzales.js" } }, "sha512-otgSPpUmdWJ43VXyiNgEYE4luzHCL2pz4wQ0OnDluC6Eg4Ko3Vexy/SrSynglw/eR+OhkzmqFCZa/OFa/RgAOQ=="],
 
@@ -1085,7 +1122,7 @@
 
     "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],
 
-    "happy-dom": ["happy-dom@20.9.0", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.18.3" } }, "sha512-GZZ9mKe8r646NUAf/zemnGbjYh4Bt8/MqASJY+pSm5ZDtc3YQox+4gsLI7yi1hba6o+eCsGxpHn5+iEVn31/FQ=="],
+    "happy-dom": ["happy-dom@20.14.0", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "buffer-image-size": "^0.6.4", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.21.0" } }, "sha512-4bRh1KzRvKDnFNTlLhzT1RZTpkKhQbQDl9j+7GXszWsvuspYdo29k6OHRf4PwiM6oLb8r/pMWeYiJjkfod5AvQ=="],
 
     "has-flag": ["has-flag@4.0.0", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
 
@@ -1093,7 +1130,7 @@
 
     "has-tostringtag": ["has-tostringtag@1.0.2", "", { "dependencies": { "has-symbols": "^1.0.3" } }, "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw=="],
 
-    "hasown": ["hasown@2.0.3", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg=="],
+    "hasown": ["hasown@2.0.4", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A=="],
 
     "hermes-estree": ["hermes-estree@0.25.1", "", {}, "sha512-0wUoCcLp+5Ev5pDW2OriHC2MJCbwLwuRx+gAqMTOkGKJJiBCLjtrvy4PWUGn6MIVefecRpzoOZ/UV6iGdOr+Cw=="],
 
@@ -1111,7 +1148,7 @@
 
     "ignore": ["ignore@7.0.5", "", {}, "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg=="],
 
-    "immer": ["immer@11.1.5", "", {}, "sha512-3fsh0NseNqMdOT8Qn4yv+JQRPpROG9xB6h3dnfqpktU9sHBuUYHfRHA0Uxk5ctqi7CdpR7Lv0DBr90pzv9jpBg=="],
+    "import-in-the-middle": ["import-in-the-middle@3.4.0", "", { "dependencies": { "cjs-module-lexer": "^2.2.0", "es-module-lexer": "^2.2.0", "module-details-from-path": "^1.0.4" } }, "sha512-Xfjwfarhe+LGmoaof+sexeNo3sGRysb5x56WrZLwHtmqT0OilSKtVWkv0lrCcMgSKyKP9oBogBAisHZvtJH0aw=="],
 
     "imurmurhash": ["imurmurhash@0.1.4", "", {}, "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA=="],
 
@@ -1125,7 +1162,7 @@
 
     "ipaddr.js": ["ipaddr.js@2.5.0", "", {}, "sha512-aq+t5NAc+cS6rZQQVWC2x98CPqGtKKTMDd4Gaodv0wShnItdKg/51djkGJ1hqH+Oy0ivDftCbSLCQob8zso01w=="],
 
-    "is-core-module": ["is-core-module@2.16.1", "", { "dependencies": { "hasown": "^2.0.2" } }, "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w=="],
+    "is-core-module": ["is-core-module@2.16.2", "", { "dependencies": { "hasown": "^2.0.3" } }, "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA=="],
 
     "is-expression": ["is-expression@4.0.0", "", { "dependencies": { "acorn": "^7.1.1", "object-assign": "^4.1.1" } }, "sha512-zMIXX63sxzG3XrkHkrAPvm/OVZVSCPNkwMHU8oTX7/U3AL78I0QXCEICXUM13BIa8TYGZ68PiTKfQz3yaTNr4A=="],
 
@@ -1157,8 +1194,6 @@
 
     "is-unicode-supported": ["is-unicode-supported@0.1.0", "", {}, "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw=="],
 
-    "is-url": ["is-url@1.2.4", "", {}, "sha512-ITvGim8FhRiYe4IQ5uHSkj7pVaPDrCTkNd3yq3cV7iZAcJdHTUMPMEHcqSOy9xZ9qFenQCvi+2wjH9a1nXqHww=="],
-
     "is-url-superb": ["is-url-superb@4.0.0", "", {}, "sha512-GI+WjezhPPcbM+tqE9LnmsY5qqjwHzTvjJ36wxYX5ujNXefSUJ/T17r5bqDV8yLhcgB59KTPNOc9O9cmHTPWsA=="],
 
     "isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
@@ -1167,19 +1202,19 @@
 
     "istextorbinary": ["istextorbinary@9.5.0", "", { "dependencies": { "binaryextensions": "^6.11.0", "editions": "^6.21.0", "textextensions": "^6.11.0" } }, "sha512-5mbUj3SiZXCuRf9fT3ibzbSSEWiy63gFfksmGfdOzujPjW3k+z8WvIBxcJHBoQNlaZaiyB25deviif2+osLmLw=="],
 
-    "jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
+    "jiti": ["jiti@2.7.0", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ=="],
 
-    "jose": ["jose@6.2.3", "", {}, "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw=="],
+    "jose": ["jose@6.2.11", "", {}, "sha512-A5NPn7g8EAzGU3IzRs+Yiq8K5n3ypYS75M5+KKiVHdUexfpWK1kP4ZMq7QnTGDoMj6TJ1dtcEJjW60yZDXS4hg=="],
 
     "js-stringify": ["js-stringify@1.0.2", "", {}, "sha512-rtS5ATOo2Q5k1G+DADISilDA6lv79zIiwFd6CcjuIxGKLFm5C+RLImRscVap9k55i+MOZwgliw+NejvkLuGD5g=="],
 
     "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
 
-    "js-yaml": ["js-yaml@4.1.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA=="],
+    "js-yaml": ["js-yaml@4.3.2", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA=="],
 
-    "jscpd": ["jscpd@4.0.9", "", { "dependencies": { "@jscpd/badge-reporter": "4.0.5", "@jscpd/core": "4.0.5", "@jscpd/finder": "4.0.5", "@jscpd/html-reporter": "4.0.5", "@jscpd/tokenizer": "4.0.5", "colors": "^1.4.0", "commander": "^5.0.0", "fs-extra": "^11.2.0", "jscpd-sarif-reporter": "4.0.7" }, "bin": { "jscpd": "bin/jscpd" } }, "sha512-fp6Sh42W3mIPoQgZmgYmKDLQzEDnnX2vaGlTN4haILkB2vsi+ewcCHEtWR/2CR/QbsBvAvsNo8U5Sa+p9aHiGw=="],
+    "jscpd": ["jscpd@4.3.0", "", { "dependencies": { "@jscpd/badge-reporter": "4.2.5", "@jscpd/core": "4.2.5", "@jscpd/finder": "4.3.0", "@jscpd/html-reporter": "4.2.5", "@jscpd/tokenizer": "4.2.6", "colors": "^1.4.0", "commander": "^15.0.0", "fs-extra": "^11.3.6", "jscpd-sarif-reporter": "4.2.5" }, "bin": { "jscpd": "bin/jscpd" } }, "sha512-yUqcHy/USHvzFamS6Loo49MCSW0Dc+4RL6ELH+Un9o2/jRSQbs9+a5hjfFceV2d3Zgv1opv5PXJ0eZ3fEQdjkg=="],
 
-    "jscpd-sarif-reporter": ["jscpd-sarif-reporter@4.0.7", "", { "dependencies": { "colors": "^1.4.0", "fs-extra": "^11.2.0", "node-sarif-builder": "^3.4.0" } }, "sha512-Q/VlfTI/Nbjc8dZ/2pDVIf1aRi2bM2CTYujcAoeYr7brRnS4o5ZeW86W8q7MM7cQu40gezlNckl+E9wKFSMFiA=="],
+    "jscpd-sarif-reporter": ["jscpd-sarif-reporter@4.2.5", "", { "dependencies": { "colors": "^1.4.0", "fs-extra": "^11.2.0", "node-sarif-builder": "^4.1.0" } }, "sha512-O8LcM9grAS5yO5x1Q0yegYaYcUX//IEBEyvzGFSYCeo1YzHbMnAI6EK7oTrwD+7Csjvfg9m8B8G7OOxzcSlr9w=="],
 
     "jsdom": ["jsdom@30.0.1", "", { "dependencies": { "@asamuzakjp/css-color": "^6.0.5", "@asamuzakjp/dom-selector": "^8.3.0", "@bramus/specificity": "^2.4.2", "@csstools/css-syntax-patches-for-csstree": "^1.1.7", "@exodus/bytes": "^1.15.1", "css-tree": "^3.2.1", "data-urls": "^7.0.0", "decimal.js": "^10.6.0", "html-encoding-sniffer": "^6.0.0", "is-potential-custom-element-name": "^1.0.1", "lru-cache": "^11.5.2", "parse5": "^8.0.1", "saxes": "^6.0.0", "symbol-tree": "^3.2.4", "tough-cookie": "^6.0.2", "undici": "^8.9.0", "w3c-xmlserializer": "^5.0.0", "webidl-conversions": "^8.0.1", "whatwg-mimetype": "^5.0.0", "whatwg-url": "^17.1.0", "xml-name-validator": "^5.0.0" }, "peerDependencies": { "canvas": "^3.2.3" }, "optionalPeers": ["canvas"] }, "sha512-52v7mUVUfNQVYYqE1lcdaymWL0njO7lTLUog6ZvW2U5KsbiLk/GnZlVJ+qx0xfNJZ6Gn+KSpPNE52vurbxZwrA=="],
 
@@ -1205,7 +1240,7 @@
 
     "kleur": ["kleur@3.0.3", "", {}, "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w=="],
 
-    "knip": ["knip@6.11.0", "", { "dependencies": { "fdir": "^6.5.0", "formatly": "^0.3.0", "get-tsconfig": "4.14.0", "jiti": "^2.6.0", "minimist": "^1.2.8", "oxc-parser": "^0.128.0", "oxc-resolver": "^11.19.1", "picomatch": "^4.0.4", "smol-toml": "^1.6.1", "strip-json-comments": "5.0.3", "tinyglobby": "^0.2.16", "unbash": "^3.0.0", "yaml": "^2.8.2", "zod": "^4.1.11" }, "bin": { "knip": "bin/knip.js", "knip-bun": "bin/knip-bun.js" } }, "sha512-84PTlN8Q5smLpTbzs8smTVh8PMbTDXtw0tFksXq/m6auGFC/KSzJykKFmnYh3As38kiWDkoDBvdTTyKk5M1TAQ=="],
+    "knip": ["knip@6.34.0", "", { "dependencies": { "fdir": "^6.5.0", "formatly": "^0.7.0", "get-tsconfig": "4.14.3", "jiti": "^2.7.0", "oxc-parser": "^0.147.0", "oxc-resolver": "11.24.2", "picomatch": "^4.0.7", "smol-toml": "^1.8.0", "strip-json-comments": "5.0.3", "tinyglobby": "^0.2.17", "unbash": "^4.0.10", "yaml": "^2.9.0", "zod": "^4.4.3" }, "bin": { "knip": "bin/knip.js", "knip-bun": "bin/knip-bun.js" } }, "sha512-bbHIrnGspYwe4EBPjjx+lvkUor0F2qfKQc5BPzPI4SOAImYA+k2ueVpIcF7d/W1LEVT7XoJUPt6zELeGZhXBgA=="],
 
     "kubernetes-types": ["kubernetes-types@1.30.0", "", {}, "sha512-Dew1okvhM/SQcIa2rcgujNndZwU8VnSapDgdxlYoB84ZlpAD43U6KLAFqYo17ykSFGHNPrg0qry0bP+GJd9v7Q=="],
 
@@ -1213,29 +1248,29 @@
 
     "lib0": ["lib0@0.2.117", "", { "dependencies": { "isomorphic.js": "^0.2.4" }, "bin": { "0serve": "bin/0serve.js", "0gentesthtml": "bin/gentesthtml.js", "0ecdsa-generate-keypair": "bin/0ecdsa-generate-keypair.js" } }, "sha512-DeXj9X5xDCjgKLU/7RR+/HQEVzuuEUiwldwOGsHK/sfAfELGWEyTcf0x+uOvCvK3O2zPmZePXWL85vtia6GyZw=="],
 
-    "lightningcss": ["lightningcss@1.32.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.32.0", "lightningcss-darwin-arm64": "1.32.0", "lightningcss-darwin-x64": "1.32.0", "lightningcss-freebsd-x64": "1.32.0", "lightningcss-linux-arm-gnueabihf": "1.32.0", "lightningcss-linux-arm64-gnu": "1.32.0", "lightningcss-linux-arm64-musl": "1.32.0", "lightningcss-linux-x64-gnu": "1.32.0", "lightningcss-linux-x64-musl": "1.32.0", "lightningcss-win32-arm64-msvc": "1.32.0", "lightningcss-win32-x64-msvc": "1.32.0" } }, "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ=="],
+    "lightningcss": ["lightningcss@1.33.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.33.0", "lightningcss-darwin-arm64": "1.33.0", "lightningcss-darwin-x64": "1.33.0", "lightningcss-freebsd-x64": "1.33.0", "lightningcss-linux-arm-gnueabihf": "1.33.0", "lightningcss-linux-arm64-gnu": "1.33.0", "lightningcss-linux-arm64-musl": "1.33.0", "lightningcss-linux-x64-gnu": "1.33.0", "lightningcss-linux-x64-musl": "1.33.0", "lightningcss-win32-arm64-msvc": "1.33.0", "lightningcss-win32-x64-msvc": "1.33.0" } }, "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA=="],
 
-    "lightningcss-android-arm64": ["lightningcss-android-arm64@1.32.0", "", { "os": "android", "cpu": "arm64" }, "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg=="],
+    "lightningcss-android-arm64": ["lightningcss-android-arm64@1.33.0", "", { "os": "android", "cpu": "arm64" }, "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg=="],
 
-    "lightningcss-darwin-arm64": ["lightningcss-darwin-arm64@1.32.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ=="],
+    "lightningcss-darwin-arm64": ["lightningcss-darwin-arm64@1.33.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg=="],
 
-    "lightningcss-darwin-x64": ["lightningcss-darwin-x64@1.32.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w=="],
+    "lightningcss-darwin-x64": ["lightningcss-darwin-x64@1.33.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ=="],
 
-    "lightningcss-freebsd-x64": ["lightningcss-freebsd-x64@1.32.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig=="],
+    "lightningcss-freebsd-x64": ["lightningcss-freebsd-x64@1.33.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg=="],
 
-    "lightningcss-linux-arm-gnueabihf": ["lightningcss-linux-arm-gnueabihf@1.32.0", "", { "os": "linux", "cpu": "arm" }, "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw=="],
+    "lightningcss-linux-arm-gnueabihf": ["lightningcss-linux-arm-gnueabihf@1.33.0", "", { "os": "linux", "cpu": "arm" }, "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ=="],
 
-    "lightningcss-linux-arm64-gnu": ["lightningcss-linux-arm64-gnu@1.32.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ=="],
+    "lightningcss-linux-arm64-gnu": ["lightningcss-linux-arm64-gnu@1.33.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg=="],
 
-    "lightningcss-linux-arm64-musl": ["lightningcss-linux-arm64-musl@1.32.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg=="],
+    "lightningcss-linux-arm64-musl": ["lightningcss-linux-arm64-musl@1.33.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ=="],
 
-    "lightningcss-linux-x64-gnu": ["lightningcss-linux-x64-gnu@1.32.0", "", { "os": "linux", "cpu": "x64" }, "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA=="],
+    "lightningcss-linux-x64-gnu": ["lightningcss-linux-x64-gnu@1.33.0", "", { "os": "linux", "cpu": "x64" }, "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg=="],
 
-    "lightningcss-linux-x64-musl": ["lightningcss-linux-x64-musl@1.32.0", "", { "os": "linux", "cpu": "x64" }, "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg=="],
+    "lightningcss-linux-x64-musl": ["lightningcss-linux-x64-musl@1.33.0", "", { "os": "linux", "cpu": "x64" }, "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw=="],
 
-    "lightningcss-win32-arm64-msvc": ["lightningcss-win32-arm64-msvc@1.32.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw=="],
+    "lightningcss-win32-arm64-msvc": ["lightningcss-win32-arm64-msvc@1.33.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA=="],
 
-    "lightningcss-win32-x64-msvc": ["lightningcss-win32-x64-msvc@1.32.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q=="],
+    "lightningcss-win32-x64-msvc": ["lightningcss-win32-x64-msvc@1.33.0", "", { "os": "win32", "cpu": "x64" }, "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA=="],
 
     "linkifyjs": ["linkifyjs@4.3.3", "", {}, "sha512-P8aEP5U/D1/IlTY2OeYsErdwh9bGuLE30NcXtKEjgdHcahveQoQwM2yZNsioQHsWFz0P7KKudisbrzCgR0sDHg=="],
 
@@ -1247,7 +1282,7 @@
 
     "log-symbols": ["log-symbols@4.1.0", "", { "dependencies": { "chalk": "^4.1.0", "is-unicode-supported": "^0.1.0" } }, "sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg=="],
 
-    "lru-cache": ["lru-cache@11.3.6", "", {}, "sha512-Gf/KoL3C/MlI7Bt0PGI9I+TeTC/I6r/csU58N4BSNc4lppLBeKsOdFYkK+dX0ABDUMJNfCHTyPpzwwO21Awd3A=="],
+    "lru-cache": ["lru-cache@11.5.2", "", {}, "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g=="],
 
     "lz-string": ["lz-string@1.5.0", "", { "bin": { "lz-string": "bin/bin.js" } }, "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ=="],
 
@@ -1255,9 +1290,11 @@
 
     "magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="],
 
+    "magicast": ["magicast@0.5.4", "", { "dependencies": { "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7", "source-map-js": "^1.2.1" } }, "sha512-llBEhWm1SacoRwgHUoQJYtwp4PBLF4faQi5TCpIGyGs9n4y5+juI0tDgyKIfpqxckRHaHzouUEph3THklWh03w=="],
+
     "markdown-table": ["markdown-table@2.0.0", "", { "dependencies": { "repeat-string": "^1.0.0" } }, "sha512-Ezda85ToJUBhM6WGaG6veasyym+Tbs3cMAw/ZhOPqXiYsr0jgocBV3j3nx+4lk47plLlIqjwuTm/ywVI+zjJ/A=="],
 
-    "marked": ["marked@18.0.3", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-7VT90JOkDeaRWpfjOReRGPEKn0ecdARBkDGL+tT1wZY0efPPqkUxLUSmzy/C7TIylQYJC9STISEsCHrqb/7VIA=="],
+    "marked": ["marked@18.0.11", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-HnslJfsZkRPBDJRHvVtAaWlZHEpSu7u8LgQuJCELjRKuWR+hpq4A7sLq3p8HaI9ypVoXDXxV34CsQJEe1+J5Aw=="],
 
     "math-intrinsics": ["math-intrinsics@1.1.0", "", {}, "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g=="],
 
@@ -1273,33 +1310,35 @@
 
     "mimic-function": ["mimic-function@5.0.1", "", {}, "sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA=="],
 
-    "minimatch": ["minimatch@10.2.5", "", { "dependencies": { "brace-expansion": "^5.0.5" } }, "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg=="],
+    "minimatch": ["minimatch@10.2.6", "", { "dependencies": { "brace-expansion": "^5.0.8" } }, "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A=="],
 
     "minimist": ["minimist@1.2.8", "", {}, "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA=="],
 
     "module-definition": ["module-definition@6.0.2", "", { "dependencies": { "ast-module-types": "^6.0.1", "node-source-walk": "^7.0.1" }, "bin": { "module-definition": "bin/cli.js" } }, "sha512-SvAU3lB0+Yjbq55yHY3wkRZBOh+fhU1SnIF3IFbTewv6mtAh7yUT8ACHAJ2mGIJ7tCes2QuCL/cl6m0JSZ/ArA=="],
 
+    "module-details-from-path": ["module-details-from-path@1.0.4", "", {}, "sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w=="],
+
     "module-lookup-amd": ["module-lookup-amd@9.1.3", "", { "dependencies": { "commander": "^12.1.0", "requirejs": "^2.3.8", "requirejs-config-file": "^4.0.0" }, "bin": { "lookup-amd": "bin/cli.js" } }, "sha512-Jc3XmOaR9FdfMJSK8+vyLgsCkzm8z2L0NS6vrlRWi12DjS7MY7TMNE7E1yj8yXx837xtMDbKSSgcdXnFlJ2YLg=="],
 
     "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
 
-    "msgpackr": ["msgpackr@2.0.2", "", { "optionalDependencies": { "msgpackr-extract": "^3.0.4" } }, "sha512-c5hYOXFbP79Slh6Dzd2wzk+jnV7mX1UxfMYtilnY1NmalXPqG8DGb5cYCMBrW4AsH3zekBBZd4QrKz9NhtvYLQ=="],
+    "msgpackr": ["msgpackr@2.1.0", "", { "optionalDependencies": { "msgpackr-extract": "^3.0.4" } }, "sha512-p/pBCVO63CsvvpkomUnNNag6+n38rULuDA6HHe70o2gtC8ODI52foF/4ko2qQcp6OiErJXTmrZeXmsGGHsIQNQ=="],
 
     "msgpackr-extract": ["msgpackr-extract@3.0.4", "", { "dependencies": { "node-gyp-build-optional-packages": "5.2.2" }, "optionalDependencies": { "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.4", "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.4", "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.4" }, "bin": { "download-msgpackr-prebuilds": "bin/download-prebuilds.js" } }, "sha512-4kmO/MdyUIkLIvTPr8VHLil4AtoKIoniWPIEk5+CDy0xnWC84azhSFmuJ7PxZdsYtiP5kEeQsORAVIeMgxT+Hw=="],
 
-    "multipasta": ["multipasta@0.2.7", "", {}, "sha512-KPA58d68KgGil15oDqXjkUBEBYc00XvbPj5/X+dyzeo/lWm9Nc25pQRlf1D+gv4OpK7NM0J1odrbu9JNNGvynA=="],
+    "multipasta": ["multipasta@0.2.8", "", {}, "sha512-ZPWuMKyv0cSO29f7hozp+k6+crZbQijV8ipMvxNxRf2SwtYGTX1ZX89Kd20VV4H9Znonx+EQn+iy1wGQsJ+b+Q=="],
 
     "mutative": ["mutative@1.3.0", "", {}, "sha512-8MJj6URmOZAV70dpFe1YnSppRTKC4DsMkXQiBDFayLcDI4ljGokHxmpqaBQuDWa4iAxWaJJ1PS8vAmbntjjKmQ=="],
 
-    "nanoid": ["nanoid@5.1.11", "", { "bin": { "nanoid": "bin/nanoid.js" } }, "sha512-v+KEsUv2ps74PaSKv0gHTxTCgMXOIfBEbaqa6w6ISIGC7ZsvHN4N9oJ8d4cmf0n5oTzQz2SLmThbQWhjd/8eKg=="],
+    "nanoid": ["nanoid@5.1.16", "", { "bin": { "nanoid": "bin/nanoid.js" } }, "sha512-kVrnsrJqMR8+oLJnGEmSWw9BivK5mt7H3FZatVRjrc5wGqFYuBxX1yG7+A7Gi5AefkX6t/oCkizcQgpu0cY1dQ=="],
 
     "natural-compare": ["natural-compare@1.4.0", "", {}, "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw=="],
 
     "node-gyp-build-optional-packages": ["node-gyp-build-optional-packages@5.2.2", "", { "dependencies": { "detect-libc": "^2.0.1" }, "bin": { "node-gyp-build-optional-packages": "bin.js", "node-gyp-build-optional-packages-optional": "optional.js", "node-gyp-build-optional-packages-test": "build-test.js" } }, "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw=="],
 
-    "node-releases": ["node-releases@2.0.38", "", {}, "sha512-3qT/88Y3FbH/Kx4szpQQ4HzUbVrHPKTLVpVocKiLfoYvw9XSGOX2FmD2d6DrXbVYyAQTF2HeF6My8jmzx7/CRw=="],
+    "node-releases": ["node-releases@2.0.54", "", {}, "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ=="],
 
-    "node-sarif-builder": ["node-sarif-builder@3.4.0", "", { "dependencies": { "@types/sarif": "^2.1.7", "fs-extra": "^11.1.1" } }, "sha512-tGnJW6OKRii9u/b2WiUViTJS+h7Apxx17qsMUjsUeNDiMMX5ZFf8F8Fcz7PAQ6omvOxHZtvDTmOYKJQwmfpjeg=="],
+    "node-sarif-builder": ["node-sarif-builder@4.1.0", "", { "dependencies": { "@types/sarif": "^2.1.7", "fs-extra": "^11.1.1" } }, "sha512-IWqZF6u0EI/07HTBm+zZ+MgXgWl09dnSJRGaDCPBSlOqilDcx6pj3Mpb3HvPN8V2Gr+ISw7ZrMsL7STWs1F++w=="],
 
     "node-source-walk": ["node-source-walk@7.0.2", "", { "dependencies": { "@babel/parser": "^7.29.0" } }, "sha512-71kFFjYaSshDTA8/a2HiTYPLdASWjLJxUyJxGE+ffxU+KhxSBtM9kiLUX+R2yooFdSFKMFpi4n3PFtDy6qXv8A=="],
 
@@ -1319,19 +1358,21 @@
 
     "orderedmap": ["orderedmap@2.1.1", "", {}, "sha512-TvAWxi0nDe1j/rtMcWcIj94+Ffe6n7zhow33h40SKxmsmozs6dz/e+EajymfoFcHd7sxNn8yHM8839uixMOV6g=="],
 
-    "oxc-parser": ["oxc-parser@0.128.0", "", { "dependencies": { "@oxc-project/types": "^0.128.0" }, "optionalDependencies": { "@oxc-parser/binding-android-arm-eabi": "0.128.0", "@oxc-parser/binding-android-arm64": "0.128.0", "@oxc-parser/binding-darwin-arm64": "0.128.0", "@oxc-parser/binding-darwin-x64": "0.128.0", "@oxc-parser/binding-freebsd-x64": "0.128.0", "@oxc-parser/binding-linux-arm-gnueabihf": "0.128.0", "@oxc-parser/binding-linux-arm-musleabihf": "0.128.0", "@oxc-parser/binding-linux-arm64-gnu": "0.128.0", "@oxc-parser/binding-linux-arm64-musl": "0.128.0", "@oxc-parser/binding-linux-ppc64-gnu": "0.128.0", "@oxc-parser/binding-linux-riscv64-gnu": "0.128.0", "@oxc-parser/binding-linux-riscv64-musl": "0.128.0", "@oxc-parser/binding-linux-s390x-gnu": "0.128.0", "@oxc-parser/binding-linux-x64-gnu": "0.128.0", "@oxc-parser/binding-linux-x64-musl": "0.128.0", "@oxc-parser/binding-openharmony-arm64": "0.128.0", "@oxc-parser/binding-wasm32-wasi": "0.128.0", "@oxc-parser/binding-win32-arm64-msvc": "0.128.0", "@oxc-parser/binding-win32-ia32-msvc": "0.128.0", "@oxc-parser/binding-win32-x64-msvc": "0.128.0" } }, "sha512-XkOw3eiIxAgQ19WRew/Bq9wc5Ga/guaWIzDBzq80z1PyuDNGvWBpPby9k6YGwV8A8uMw+Nlq3xqlzuDYmUFYUw=="],
+    "oxc-parser": ["oxc-parser@0.147.0", "", { "dependencies": { "@oxc-project/types": "^0.147.0" }, "optionalDependencies": { "@oxc-parser/binding-android-arm-eabi": "0.147.0", "@oxc-parser/binding-android-arm64": "0.147.0", "@oxc-parser/binding-darwin-arm64": "0.147.0", "@oxc-parser/binding-darwin-x64": "0.147.0", "@oxc-parser/binding-freebsd-x64": "0.147.0", "@oxc-parser/binding-linux-arm-gnueabihf": "0.147.0", "@oxc-parser/binding-linux-arm-musleabihf": "0.147.0", "@oxc-parser/binding-linux-arm64-gnu": "0.147.0", "@oxc-parser/binding-linux-arm64-musl": "0.147.0", "@oxc-parser/binding-linux-ppc64-gnu": "0.147.0", "@oxc-parser/binding-linux-riscv64-gnu": "0.147.0", "@oxc-parser/binding-linux-riscv64-musl": "0.147.0", "@oxc-parser/binding-linux-s390x-gnu": "0.147.0", "@oxc-parser/binding-linux-x64-gnu": "0.147.0", "@oxc-parser/binding-linux-x64-musl": "0.147.0", "@oxc-parser/binding-openharmony-arm64": "0.147.0", "@oxc-parser/binding-win32-arm64-msvc": "0.147.0", "@oxc-parser/binding-win32-ia32-msvc": "0.147.0", "@oxc-parser/binding-win32-x64-msvc": "0.147.0" } }, "sha512-5xaug6t7GfV3BO5Iv+xHW1rmQkDEQ3BEu3L8g3InsvWO5i8CYGc4tCZ2X985QcwWNycFJam+aOns6Nr2XAThTA=="],
 
-    "oxc-resolver": ["oxc-resolver@11.19.1", "", { "optionalDependencies": { "@oxc-resolver/binding-android-arm-eabi": "11.19.1", "@oxc-resolver/binding-android-arm64": "11.19.1", "@oxc-resolver/binding-darwin-arm64": "11.19.1", "@oxc-resolver/binding-darwin-x64": "11.19.1", "@oxc-resolver/binding-freebsd-x64": "11.19.1", "@oxc-resolver/binding-linux-arm-gnueabihf": "11.19.1", "@oxc-resolver/binding-linux-arm-musleabihf": "11.19.1", "@oxc-resolver/binding-linux-arm64-gnu": "11.19.1", "@oxc-resolver/binding-linux-arm64-musl": "11.19.1", "@oxc-resolver/binding-linux-ppc64-gnu": "11.19.1", "@oxc-resolver/binding-linux-riscv64-gnu": "11.19.1", "@oxc-resolver/binding-linux-riscv64-musl": "11.19.1", "@oxc-resolver/binding-linux-s390x-gnu": "11.19.1", "@oxc-resolver/binding-linux-x64-gnu": "11.19.1", "@oxc-resolver/binding-linux-x64-musl": "11.19.1", "@oxc-resolver/binding-openharmony-arm64": "11.19.1", "@oxc-resolver/binding-wasm32-wasi": "11.19.1", "@oxc-resolver/binding-win32-arm64-msvc": "11.19.1", "@oxc-resolver/binding-win32-ia32-msvc": "11.19.1", "@oxc-resolver/binding-win32-x64-msvc": "11.19.1" } }, "sha512-qE/CIg/spwrTBFt5aKmwe3ifeDdLfA2NESN30E42X/lII5ClF8V7Wt6WIJhcGZjp0/Q+nQ+9vgxGk//xZNX2hg=="],
+    "oxc-resolver": ["oxc-resolver@11.24.2", "", { "optionalDependencies": { "@oxc-resolver/binding-android-arm-eabi": "11.24.2", "@oxc-resolver/binding-android-arm64": "11.24.2", "@oxc-resolver/binding-darwin-arm64": "11.24.2", "@oxc-resolver/binding-darwin-x64": "11.24.2", "@oxc-resolver/binding-freebsd-x64": "11.24.2", "@oxc-resolver/binding-linux-arm-gnueabihf": "11.24.2", "@oxc-resolver/binding-linux-arm-musleabihf": "11.24.2", "@oxc-resolver/binding-linux-arm64-gnu": "11.24.2", "@oxc-resolver/binding-linux-arm64-musl": "11.24.2", "@oxc-resolver/binding-linux-ppc64-gnu": "11.24.2", "@oxc-resolver/binding-linux-riscv64-gnu": "11.24.2", "@oxc-resolver/binding-linux-riscv64-musl": "11.24.2", "@oxc-resolver/binding-linux-s390x-gnu": "11.24.2", "@oxc-resolver/binding-linux-x64-gnu": "11.24.2", "@oxc-resolver/binding-linux-x64-musl": "11.24.2", "@oxc-resolver/binding-openharmony-arm64": "11.24.2", "@oxc-resolver/binding-wasm32-wasi": "11.24.2", "@oxc-resolver/binding-win32-arm64-msvc": "11.24.2", "@oxc-resolver/binding-win32-x64-msvc": "11.24.2" } }, "sha512-FY91FiDBj7ls5MsFS9jN3tjz2o0/zsdSsymlakySaBwVJZorHhkWyICLZMKxlu1R9vYo+sd3z1jwb4J8x7bNDw=="],
 
-    "oxlint": ["oxlint@1.67.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.67.0", "@oxlint/binding-android-arm64": "1.67.0", "@oxlint/binding-darwin-arm64": "1.67.0", "@oxlint/binding-darwin-x64": "1.67.0", "@oxlint/binding-freebsd-x64": "1.67.0", "@oxlint/binding-linux-arm-gnueabihf": "1.67.0", "@oxlint/binding-linux-arm-musleabihf": "1.67.0", "@oxlint/binding-linux-arm64-gnu": "1.67.0", "@oxlint/binding-linux-arm64-musl": "1.67.0", "@oxlint/binding-linux-ppc64-gnu": "1.67.0", "@oxlint/binding-linux-riscv64-gnu": "1.67.0", "@oxlint/binding-linux-riscv64-musl": "1.67.0", "@oxlint/binding-linux-s390x-gnu": "1.67.0", "@oxlint/binding-linux-x64-gnu": "1.67.0", "@oxlint/binding-linux-x64-musl": "1.67.0", "@oxlint/binding-openharmony-arm64": "1.67.0", "@oxlint/binding-win32-arm64-msvc": "1.67.0", "@oxlint/binding-win32-ia32-msvc": "1.67.0", "@oxlint/binding-win32-x64-msvc": "1.67.0" }, "peerDependencies": { "oxlint-tsgolint": ">=0.22.1", "vite-plus": "*" }, "optionalPeers": ["oxlint-tsgolint", "vite-plus"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-blwwaHPdoH8piQ5/z0KHeoHFR7FZgl12WluKJfu4qFLPkZl6mK04PkLE45Fw1NxfBRSlh40Gu7MkxHUw++ociQ=="],
+    "oxlint": ["oxlint@1.81.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.81.0", "@oxlint/binding-android-arm64": "1.81.0", "@oxlint/binding-darwin-arm64": "1.81.0", "@oxlint/binding-darwin-x64": "1.81.0", "@oxlint/binding-freebsd-x64": "1.81.0", "@oxlint/binding-linux-arm-gnueabihf": "1.81.0", "@oxlint/binding-linux-arm-musleabihf": "1.81.0", "@oxlint/binding-linux-arm64-gnu": "1.81.0", "@oxlint/binding-linux-arm64-musl": "1.81.0", "@oxlint/binding-linux-ppc64-gnu": "1.81.0", "@oxlint/binding-linux-riscv64-gnu": "1.81.0", "@oxlint/binding-linux-riscv64-musl": "1.81.0", "@oxlint/binding-linux-s390x-gnu": "1.81.0", "@oxlint/binding-linux-x64-gnu": "1.81.0", "@oxlint/binding-linux-x64-musl": "1.81.0", "@oxlint/binding-openharmony-arm64": "1.81.0", "@oxlint/binding-win32-arm64-msvc": "1.81.0", "@oxlint/binding-win32-ia32-msvc": "1.81.0", "@oxlint/binding-win32-x64-msvc": "1.81.0" }, "peerDependencies": { "oxlint-tsgolint": ">=7.0.2001", "vite-plus": "*" }, "optionalPeers": ["oxlint-tsgolint", "vite-plus"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-HyrJYqeoOCL0iqaLEzGewGT48ZX99P3hxYh8udAF9RGGIghSamkXE4ClUyBpEDNqasamThgmlPbuMOe7SAZmHg=="],
 
-    "oxlint-plugin-react-doctor": ["oxlint-plugin-react-doctor@0.2.14", "", { "dependencies": { "@typescript-eslint/types": "^8.59.3", "eslint-scope": "^9.1.2", "eslint-visitor-keys": "^5.0.1" } }, "sha512-E3Xb6NFycmmyJlLE7wNLN1kScunwsiHAwf1XCOUSgnSB7sV4dvQbcAVTVoOz2n1yGSPOmcMwBdLPTepVNBZ+OQ=="],
+    "oxlint-plugin-react-doctor": ["oxlint-plugin-react-doctor@0.2.16", "", { "dependencies": { "@typescript-eslint/types": "^8.59.3", "eslint-scope": "^9.1.2", "eslint-visitor-keys": "^5.0.1", "oxc-parser": "^0.132.0" } }, "sha512-Ul1UxcYfjBnt+HjgNaMnkvMJjyewS6rkSZl3LiD1g/QqSll1jiynYH/ZoNpUaGHp1pDQ/xLvCcXNQvqopN0tHA=="],
 
     "p-limit": ["p-limit@3.1.0", "", { "dependencies": { "yocto-queue": "^0.1.0" } }, "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ=="],
 
     "p-locate": ["p-locate@5.0.0", "", { "dependencies": { "p-limit": "^3.0.2" } }, "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw=="],
 
-    "p-map": ["p-map@7.0.4", "", {}, "sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ=="],
+    "p-map": ["p-map@7.0.7", "", {}, "sha512-VaWRu2i4FJNRtiRWCuuQRgfQ1B7a6+gMSrO+3j0EQi/k0ULfS9kosRxGoiqwzIjZTDI02tGfk5mXXltLg6QtfQ=="],
+
+    "package-manager-detector": ["package-manager-detector@1.8.0", "", {}, "sha512-yQA4H19AmPEoMUeavPMDIe1higySl/gH/yaQrkT/s07Qp+7pp2hYz30N3z2l5BkjVkF9Ow6o0wjJamm2y7Sn0A=="],
 
     "parse-json": ["parse-json@8.3.0", "", { "dependencies": { "@babel/code-frame": "^7.26.2", "index-to-position": "^1.1.0", "type-fest": "^4.39.1" } }, "sha512-ybiGyvspI+fAoRQbIPRddCcSTV9/LsJbf0e/S85VLowVGzRmokfneg2kwVW/KU5rOXrPSbF1qAKPMgNTqqROQQ=="],
 
@@ -1347,23 +1388,23 @@
 
     "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
 
-    "picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="],
+    "picomatch": ["picomatch@4.0.7", "", {}, "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA=="],
 
     "pixel-art-icons": ["pixel-art-icons@file:vendor/pixel-art-icons", { "peerDependencies": { "react": ">=18" } }],
 
     "pkce-challenge": ["pkce-challenge@5.0.1", "", {}, "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ=="],
 
-    "playwright": ["playwright@1.60.0", "", { "dependencies": { "playwright-core": "1.60.0" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA=="],
+    "playwright": ["playwright@1.62.1", "", { "dependencies": { "playwright-core": "1.62.1" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg=="],
 
-    "playwright-core": ["playwright-core@1.60.0", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA=="],
+    "playwright-core": ["playwright-core@1.62.1", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw=="],
 
     "pluralize": ["pluralize@8.0.0", "", {}, "sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA=="],
 
-    "postcss": ["postcss@8.5.13", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-qif0+jGGZoLWdHey3UFHHWP0H7Gbmsk8T5VEqyYFbWqPr1XqvLGBbk/sl8V5exGmcYJklJOhOQq1pV9IcsiFag=="],
+    "postcss": ["postcss@8.5.28", "", { "dependencies": { "nanoid": "^3.3.18", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A=="],
 
     "postcss-values-parser": ["postcss-values-parser@6.0.2", "", { "dependencies": { "color-name": "^1.1.4", "is-url-superb": "^4.0.0", "quote-unquote": "^1.0.0" }, "peerDependencies": { "postcss": "^8.2.9" } }, "sha512-YLJpK0N1brcNJrs9WatuJFtHaV9q5aAOj+S4DI5S7jgHlRfm0PIbDCAFRYMQD5SHq7Fy6xsDhyutgS0QOAs0qw=="],
 
-    "precinct": ["precinct@12.3.1", "", { "dependencies": { "@dependents/detective-less": "^5.0.1", "commander": "^12.1.0", "detective-amd": "^6.0.1", "detective-cjs": "^6.1.0", "detective-es6": "^5.0.1", "detective-postcss": "^7.0.1", "detective-sass": "^6.0.1", "detective-scss": "^5.0.1", "detective-stylus": "^5.0.1", "detective-typescript": "^14.1.1", "detective-vue2": "^2.3.0", "module-definition": "^6.0.1", "node-source-walk": "^7.0.1", "postcss": "^8.5.10", "typescript": "^5.9.3" }, "bin": { "precinct": "bin/cli.js" } }, "sha512-wGyTIvtxh2S2NAHxTJj0YymxWOIcEDotu17yHoQUd2Bz2C07LrS28L1nvXDMxrCHvHmV6KTlaIQy5PzRm7Y8rg=="],
+    "precinct": ["precinct@12.3.2", "", { "dependencies": { "@dependents/detective-less": "^5.0.3", "commander": "^12.1.0", "detective-amd": "^6.1.0", "detective-cjs": "^6.1.1", "detective-es6": "^5.0.2", "detective-postcss": "^8.0.3", "detective-sass": "^6.0.2", "detective-scss": "^5.0.2", "detective-stylus": "^5.0.1", "detective-typescript": "^14.1.2", "detective-vue2": "^2.3.0", "module-definition": "^6.0.2", "node-source-walk": "^7.0.2", "postcss": "^8.5.14", "typescript": "^5.9.3" }, "bin": { "precinct": "bin/cli.js" } }, "sha512-JbJevI1K80z8e/WIyDt/4vUN/4qcfBSKKqOjJA4mosPPPb7zODKRJQV7YN7apVWN3k58nZYm/vEsLgEGYmnxwg=="],
 
     "prelude-ls": ["prelude-ls@1.2.1", "", {}, "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g=="],
 
@@ -1375,19 +1416,21 @@
 
     "prompts": ["prompts@2.4.2", "", { "dependencies": { "kleur": "^3.0.3", "sisteransi": "^1.0.5" } }, "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q=="],
 
-    "prosemirror-changeset": ["prosemirror-changeset@2.4.1", "", { "dependencies": { "prosemirror-transform": "^1.0.0" } }, "sha512-96WBLhOaYhJ+kPhLg3uW359Tz6I/MfcrQfL4EGv4SrcqKEMC1gmoGrXHecPE8eOwTVCJ4IwgfzM8fFad25wNfw=="],
+    "prosemirror-changeset": ["prosemirror-changeset@2.4.2", "", { "dependencies": { "prosemirror-transform": "^1.0.0" } }, "sha512-ViYrjMSg3YFiXwIhKaluu+/mi3Yrxt6AR8ri14ulTaGcZtXO1CThl7A2gv79qx5fQnOw8woKwyBU2u+9PVCm3w=="],
 
-    "prosemirror-commands": ["prosemirror-commands@1.7.1", "", { "dependencies": { "prosemirror-model": "^1.0.0", "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.10.2" } }, "sha512-rT7qZnQtx5c0/y/KlYaGvtG411S97UaL6gdp6RIZ23DLHanMYLyfGBV5DtSnZdthQql7W+lEVbpSfwtO8T+L2w=="],
+    "prosemirror-commands": ["prosemirror-commands@1.7.2", "", { "dependencies": { "prosemirror-model": "^1.0.0", "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.10.2" } }, "sha512-q6Q6szxqdu9Xd6EcdKsqXghu5nQdZTpB4Q9yd04WRc7/jt763e/rT60Owh0L1GYY+T46o5rD+9lEN36dZS43tw=="],
 
-    "prosemirror-dropcursor": ["prosemirror-dropcursor@1.8.2", "", { "dependencies": { "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.1.0", "prosemirror-view": "^1.1.0" } }, "sha512-CCk6Gyx9+Tt2sbYk5NK0nB1ukHi2ryaRgadV/LvyNuO3ena1payM2z6Cg0vO1ebK8cxbzo41ku2DE5Axj1Zuiw=="],
+    "prosemirror-dropcursor": ["prosemirror-dropcursor@1.8.3", "", { "dependencies": { "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.1.0", "prosemirror-view": "^1.1.0" } }, "sha512-FoYbsJR8gK+DGlqhNoE29Loa38eIZPzQRIb1VMaDNBoo4OLP6vVof/jR8qFY/6XvUd6Dhug8MDCHl2a/h8RTfQ=="],
 
     "prosemirror-gapcursor": ["prosemirror-gapcursor@1.4.1", "", { "dependencies": { "prosemirror-keymap": "^1.0.0", "prosemirror-model": "^1.0.0", "prosemirror-state": "^1.0.0", "prosemirror-view": "^1.0.0" } }, "sha512-pMdYaEnjNMSwl11yjEGtgTmLkR08m/Vl+Jj443167p9eB3HVQKhYCc4gmHVDsLPODfZfjr/MmirsdyZziXbQKw=="],
 
     "prosemirror-history": ["prosemirror-history@1.5.0", "", { "dependencies": { "prosemirror-state": "^1.2.2", "prosemirror-transform": "^1.0.0", "prosemirror-view": "^1.31.0", "rope-sequence": "^1.3.0" } }, "sha512-zlzTiH01eKA55UAf1MEjtssJeHnGxO0j4K4Dpx+gnmX9n+SHNlDqI2oO1Kv1iPN5B1dm5fsljCfqKF9nFL6HRg=="],
 
+    "prosemirror-inputrules": ["prosemirror-inputrules@1.5.1", "", { "dependencies": { "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.0.0" } }, "sha512-7wj4uMjKaXWAQ1CDgxNzNtR9AlsuwzHfdFH1ygEHA2KHF2DOEaXl1CJfNPAKCg9qNEh4rum975QLaCiQPyY6Fw=="],
+
     "prosemirror-keymap": ["prosemirror-keymap@1.2.3", "", { "dependencies": { "prosemirror-state": "^1.0.0", "w3c-keyname": "^2.2.0" } }, "sha512-4HucRlpiLd1IPQQXNqeo81BGtkY8Ai5smHhKW9jjPKRc2wQIxksg7Hl1tTI2IfT2B/LgX6bfYvXxEpJl7aKYKw=="],
 
-    "prosemirror-model": ["prosemirror-model@1.25.7", "", { "dependencies": { "orderedmap": "^2.0.0" } }, "sha512-A79aN8QEFUwI6cax8Yq4Rpcx1TJZ3Kagn+ii7qLo4/V8H3mMiHrhFyhTyHHvpSnOgMPpWiDGSwM3etwrxE50ug=="],
+    "prosemirror-model": ["prosemirror-model@1.25.11", "", { "dependencies": { "orderedmap": "^2.0.0" } }, "sha512-QWg9RhnpLlogAmp3p96uEFrE5txQpFynd4vhBAELkwgOCWQs/X0yCzB3/hrHqiPwf91RG5KyWq6553zs9JqIOQ=="],
 
     "prosemirror-schema-list": ["prosemirror-schema-list@1.5.1", "", { "dependencies": { "prosemirror-model": "^1.0.0", "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.7.3" } }, "sha512-927lFx/uwyQaGwJxLWCZRkjXG0p48KpMj6ueoYiu4JX05GGuGcgzAy62dfiV8eFZftgyBUvLx76RsMe20fJl+Q=="],
 
@@ -1395,9 +1438,9 @@
 
     "prosemirror-tables": ["prosemirror-tables@1.8.5", "", { "dependencies": { "prosemirror-keymap": "^1.2.3", "prosemirror-model": "^1.25.4", "prosemirror-state": "^1.4.4", "prosemirror-transform": "^1.10.5", "prosemirror-view": "^1.41.4" } }, "sha512-V/0cDCsHKHe/tfWkeCmthNUcEp1IVO3p6vwN8XtwE9PZQLAZJigbw3QoraAdfJPir4NKJtNvOB8oYGKRl+t0Dw=="],
 
-    "prosemirror-transform": ["prosemirror-transform@1.12.0", "", { "dependencies": { "prosemirror-model": "^1.21.0" } }, "sha512-GxboyN4AMIsoHNtz5uf2r2Ru551i5hWeCMD6E2Ib4Eogqoub0NflniaBPVQ4MrGE5yZ8JV9tUHg9qcZTTrcN4w=="],
+    "prosemirror-transform": ["prosemirror-transform@1.12.1", "", { "dependencies": { "prosemirror-model": "^1.21.0" } }, "sha512-t4F5615FycnCqsX7ShTUs8+jfnwcf46kuFRvSl/3qFx2QTZ4DjgowesLHQXcFP7G//TjesqZG3WtgL7vdyVJyA=="],
 
-    "prosemirror-view": ["prosemirror-view@1.41.8", "", { "dependencies": { "prosemirror-model": "^1.20.0", "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.1.0" } }, "sha512-TnKDdohEatgyZNGCDWIdccOHXhYloJwbwU+phw/a23KBvJIR9lWQWW7WHHK3vBdOLDNuF7TaX98GObUZOWkOnA=="],
+    "prosemirror-view": ["prosemirror-view@1.42.3", "", { "dependencies": { "prosemirror-model": "^1.25.8", "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.1.0" } }, "sha512-oTN7EtH+CpwxU9NrwEYWd0UZ4JUx7l048l5A2Xppm4p/60isZYLnth9QVQmC3VRIvdrIWCxwZSd+Uz791G31/w=="],
 
     "pug": ["pug@3.0.4", "", { "dependencies": { "pug-code-gen": "^3.0.4", "pug-filters": "^4.0.0", "pug-lexer": "^5.0.1", "pug-linker": "^4.0.0", "pug-load": "^3.0.0", "pug-parser": "^6.0.0", "pug-runtime": "^3.0.1", "pug-strip-comments": "^2.0.0" } }, "sha512-kFfq5mMzrS7+wrl5pLJzZEzemx34OQ0w4SARfhy/3yxTlhbstsudDwJzhf1hP02yHzbjoVMSXUj/Sz6RNfMyXg=="],
 
@@ -1427,7 +1470,7 @@
 
     "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
 
-    "pure-rand": ["pure-rand@8.4.0", "", {}, "sha512-IoM8YF/jY0hiugFo/wOWqfmarlE6J0wc6fDK1PhftMk7MGhVZl88sZimmqBBFomLOCSmcCCpsfj7wXASCpvK9A=="],
+    "pure-rand": ["pure-rand@8.4.2", "", {}, "sha512-vvuOGgcuPJAirlHvuQw1TrOiw7ptaIXXmIbNuiNOY6lNGJJH49PQ1Kj4nd783nPdQhQdicgOjVI2yI/9BD6/Ng=="],
 
     "queue-microtask": ["queue-microtask@1.2.3", "", {}, "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A=="],
 
@@ -1441,11 +1484,11 @@
 
     "rc-config-loader": ["rc-config-loader@4.1.4", "", { "dependencies": { "debug": "^4.4.3", "js-yaml": "^4.1.1", "json5": "^2.2.3", "require-from-string": "^2.0.2" } }, "sha512-3GiwEzklkbXTDp52UR5nT8iXgYAx1V9ZG/kDZT7p60u2GCv2XTwQq4NzinMoMpNtXhmt3WkhYXcj6HH8HdwCEQ=="],
 
-    "react": ["react@19.2.5", "", {}, "sha512-llUJLzz1zTUBrskt2pwZgLq59AemifIftw4aB7JxOqf1HY2FDaGDxgwpAPVzHU1kdWabH7FauP4i1oEeer2WCA=="],
+    "react": ["react@19.2.8", "", {}, "sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw=="],
 
-    "react-doctor": ["react-doctor@0.2.14", "", { "dependencies": { "@effect/platform-node-shared": "4.0.0-beta.70", "agent-install": "0.0.5", "conf": "^15.1.0", "deslop-js": "^0.0.13", "effect": "4.0.0-beta.70", "eslint-plugin-react-hooks": "^7.1.1", "oxlint": "^1.66.0", "oxlint-plugin-react-doctor": "0.2.14", "prompts": "^2.4.2", "typescript": ">=5.0.4 <7" }, "bin": { "react-doctor": "bin/react-doctor.js" } }, "sha512-IsdCwvd9SFCnsvcS5mKzhEA2FauW0xc2yZlrHCjfRzUEleXeDzKXRhhLXXxg9cZHzjBQl49Rkqo/+t3XwPDR4A=="],
+    "react-doctor": ["react-doctor@0.2.16", "", { "dependencies": { "@babel/code-frame": "^7.29.0", "@effect/platform-node-shared": "4.0.0-beta.70", "@sentry/node": "^10.54.0", "agent-install": "0.0.5", "conf": "^15.1.0", "confbox": "^0.2.4", "deslop-js": "^0.0.14", "effect": "4.0.0-beta.70", "eslint-plugin-react-hooks": "^7.1.1", "jiti": "^2.7.0", "magicast": "^0.5.3", "oxlint": "^1.66.0", "oxlint-plugin-react-doctor": "0.2.16", "prompts": "^2.4.2", "typescript": ">=5.0.4 <7" }, "bin": { "react-doctor": "bin/react-doctor.js" } }, "sha512-o108QscqM/TlC1QmKgDORf/P53PeZ69nZbRsvy53rXkKvWdKZC1Y0u1JRPmThbTh6v+QpMispBwEnFHhlpZQ7w=="],
 
-    "react-dom": ["react-dom@19.2.5", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.5" } }, "sha512-J5bAZz+DXMMwW/wV3xzKke59Af6CHY7G4uYLN1OvBcKEsWOs4pQExj86BBKamxl/Ik5bx9whOrvBlSDfWzgSag=="],
+    "react-dom": ["react-dom@19.2.8", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.8" } }, "sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ=="],
 
     "react-is": ["react-is@17.0.2", "", {}, "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w=="],
 
@@ -1459,10 +1502,10 @@
 
     "repeat-string": ["repeat-string@1.6.1", "", {}, "sha512-PV0dzCYDNfRi1jCDbJzpW7jNNDRuCOG/jI5ctQcGKt/clZD+YcPS3yIlWuTJMmESC8aevCFmWJy5wjAFgNqN6w=="],
 
-    "reprism": ["reprism@0.0.11", "", {}, "sha512-VsxDR5QxZo08M/3nRypNlScw5r3rKeSOPdU/QhDmu3Ai3BJxHn/qgfXGWQp/tAxUtzwYNo9W6997JZR0tPLZsA=="],
-
     "require-from-string": ["require-from-string@2.0.2", "", {}, "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw=="],
 
+    "require-in-the-middle": ["require-in-the-middle@8.0.1", "", { "dependencies": { "debug": "^4.3.5", "module-details-from-path": "^1.0.3" } }, "sha512-QT7FVMXfWOYFbeRBF6nu+I6tr2Tf3u0q8RIEjNob/heKY/nh7drD/k7eeMFmSQgnTtCzLDcCu/XEnpW2wk4xCQ=="],
+
     "requirejs": ["requirejs@2.3.8", "", { "bin": { "r.js": "bin/r.js", "r_js": "bin/r.js" } }, "sha512-7/cTSLOdYkNBNJcDMWf+luFvMriVm7eYxp4BcFCsAX0wF421Vyce5SXP17c+Jd5otXKGNehIonFlyQXSowL6Mw=="],
 
     "requirejs-config-file": ["requirejs-config-file@4.0.0", "", { "dependencies": { "esprima": "^4.0.0", "stringify-object": "^3.2.1" } }, "sha512-jnIre8cbWOyvr8a5F2KuqBnY+SDA4NXr/hzEZJG79Mxm2WiFQz2dzhC8ibtPJS7zkmBEl1mxSwp5HhC1W4qpxw=="],
@@ -1477,7 +1520,7 @@
 
     "reusify": ["reusify@1.1.0", "", {}, "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw=="],
 
-    "rolldown": ["rolldown@1.0.0-rc.17", "", { "dependencies": { "@oxc-project/types": "=0.127.0", "@rolldown/pluginutils": "1.0.0-rc.17" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.0-rc.17", "@rolldown/binding-darwin-arm64": "1.0.0-rc.17", "@rolldown/binding-darwin-x64": "1.0.0-rc.17", "@rolldown/binding-freebsd-x64": "1.0.0-rc.17", "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.17", "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.17", "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.17", "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.17", "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.17", "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.17", "@rolldown/binding-linux-x64-musl": "1.0.0-rc.17", "@rolldown/binding-openharmony-arm64": "1.0.0-rc.17", "@rolldown/binding-wasm32-wasi": "1.0.0-rc.17", "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.17", "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.17" }, "bin": { "rolldown": "bin/cli.mjs" } }, "sha512-ZrT53oAKrtA4+YtBWPQbtPOxIbVDbxT0orcYERKd63VJTF13zPcgXTvD4843L8pcsI7M6MErt8QtON6lrB9tyA=="],
+    "rolldown": ["rolldown@1.2.7", "", { "dependencies": { "@oxc-project/types": "=0.148.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm-eabi": "1.2.7", "@rolldown/binding-android-arm64": "1.2.7", "@rolldown/binding-darwin-arm64": "1.2.7", "@rolldown/binding-darwin-x64": "1.2.7", "@rolldown/binding-freebsd-x64": "1.2.7", "@rolldown/binding-linux-arm-gnueabihf": "1.2.7", "@rolldown/binding-linux-arm64-gnu": "1.2.7", "@rolldown/binding-linux-arm64-musl": "1.2.7", "@rolldown/binding-linux-ppc64-gnu": "1.2.7", "@rolldown/binding-linux-s390x-gnu": "1.2.7", "@rolldown/binding-linux-x64-gnu": "1.2.7", "@rolldown/binding-linux-x64-musl": "1.2.7", "@rolldown/binding-openharmony-arm64": "1.2.7", "@rolldown/binding-win32-arm64-msvc": "1.2.7", "@rolldown/binding-win32-x64-msvc": "1.2.7" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-g0EtLvBjTUB7jhyV0S/TCup3v/XSVl45vUIGbOGU4QPiyjTenCe4mKuFvW9fEgYmS2Fo42AUssRmNuMziXdrig=="],
 
     "rope-sequence": ["rope-sequence@1.3.4", "", {}, "sha512-UT5EDe2cu2E/6O4igUr5PSFs23nvvukicWHx6GnOPlHAiiYbzNuCRQCuiUdHJQcqKalLKlrYJnjY0ySGsXNQXQ=="],
 
@@ -1495,7 +1538,7 @@
 
     "secretlint": ["secretlint@12.3.1", "", { "dependencies": { "@secretlint/config-creator": "12.3.1", "@secretlint/formatter": "12.3.1", "@secretlint/node": "12.3.1", "@secretlint/profiler": "12.3.1", "@secretlint/resolver": "12.3.1", "debug": "^4.4.3", "globby": "^16.2.0", "read-pkg": "^10.1.0" }, "bin": { "secretlint": "bin/secretlint.js" } }, "sha512-wv8TKCjU5hbBxo5jKEX8wIE78VAoL0Ux7pu18+TxtbICMZ2OCbu6EmO3OJLbUbyfUXSPVryNLNmGVgvwY6Z0xw=="],
 
-    "semver": ["semver@7.7.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA=="],
+    "semver": ["semver@7.8.5", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA=="],
 
     "sharp": ["sharp@0.35.4", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.5" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.4", "@img/sharp-darwin-x64": "0.35.4", "@img/sharp-freebsd-wasm32": "0.35.4", "@img/sharp-libvips-darwin-arm64": "1.3.3", "@img/sharp-libvips-darwin-x64": "1.3.3", "@img/sharp-libvips-linux-arm": "1.3.3", "@img/sharp-libvips-linux-arm64": "1.3.3", "@img/sharp-libvips-linux-ppc64": "1.3.3", "@img/sharp-libvips-linux-riscv64": "1.3.3", "@img/sharp-libvips-linux-s390x": "1.3.3", "@img/sharp-libvips-linux-x64": "1.3.3", "@img/sharp-libvips-linuxmusl-arm64": "1.3.3", "@img/sharp-libvips-linuxmusl-x64": "1.3.3", "@img/sharp-linux-arm": "0.35.4", "@img/sharp-linux-arm64": "0.35.4", "@img/sharp-linux-ppc64": "0.35.4", "@img/sharp-linux-riscv64": "0.35.4", "@img/sharp-linux-s390x": "0.35.4", "@img/sharp-linux-x64": "0.35.4", "@img/sharp-linuxmusl-arm64": "0.35.4", "@img/sharp-linuxmusl-x64": "0.35.4", "@img/sharp-webcontainers-wasm32": "0.35.4", "@img/sharp-win32-arm64": "0.35.4", "@img/sharp-win32-ia32": "0.35.4", "@img/sharp-win32-x64": "0.35.4" } }, "sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA=="],
 
@@ -1511,7 +1554,7 @@
 
     "slice-ansi": ["slice-ansi@4.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "astral-regex": "^2.0.0", "is-fullwidth-code-point": "^3.0.0" } }, "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ=="],
 
-    "smol-toml": ["smol-toml@1.6.1", "", {}, "sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg=="],
+    "smol-toml": ["smol-toml@1.8.0", "", {}, "sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ=="],
 
     "source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
 
@@ -1555,7 +1598,7 @@
 
     "supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
 
-    "supports-hyperlinks": ["supports-hyperlinks@4.4.0", "", { "dependencies": { "has-flag": "^5.0.1", "supports-color": "^10.2.2" } }, "sha512-UKbpT93hN5Nr9go5UY7bopIB9YQlMz9nm/ct4IXt/irb5YRkn9WaqrOBJGZ5Pwvsd5FQzSVeYlGdXoCAPQZrPg=="],
+    "supports-hyperlinks": ["supports-hyperlinks@4.5.0", "", { "dependencies": { "has-flag": "^5.0.1", "supports-color": "^10.2.2" } }, "sha512-ZW2OvfeCXrNTbLakPUzjQG922EeGCOteFSVoek5DKStTh898wf7zgtuFlzQN8HfZCxC3Eh02yJVrRW51hADf+w=="],
 
     "supports-preserve-symlinks-flag": ["supports-preserve-symlinks-flag@1.0.0", "", {}, "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w=="],
 
@@ -1573,7 +1616,7 @@
 
     "textextensions": ["textextensions@6.11.0", "", { "dependencies": { "editions": "^6.21.0" } }, "sha512-tXJwSr9355kFJI3lbCkPpUH5cP8/M0GGy2xLO34aZCjMXBaK3SoPnZwr/oWmo1FdCnELcs4npdCIOFtq9W3ruQ=="],
 
-    "tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
+    "tinyglobby": ["tinyglobby@0.2.17", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g=="],
 
     "tldts": ["tldts@7.4.11", "", { "dependencies": { "tldts-core": "^7.4.11" }, "bin": { "tldts": "bin/cli.js" } }, "sha512-aBiNayCfTQxuIJBm06M+xR14cYaYlDlSXZbgsnKzKNxDKUVq7KFwTjwBSsb7m9Y5xO8WfPnBc63WaYFMTGlvqw=="],
 
@@ -1583,7 +1626,7 @@
 
     "token-stream": ["token-stream@1.0.0", "", {}, "sha512-VSsyNPPW74RpHwR8Fc21uubwHY7wMDeJLys2IX5zJNih+OnAnaifKHo+1LHT7DAdloQ7apeaaWg8l7qnf/TnEg=="],
 
-    "toml": ["toml@4.1.1", "", {}, "sha512-EBJnVBr3dTXdA89WVFoAIPUqkBjxPMwRqsfuo1r240tKFHXv3zgca4+NJib/h6TyvGF7vOawz0jGuryJCdNHrw=="],
+    "toml": ["toml@4.3.0", "", {}, "sha512-lVb8X9BsPVuH0M4BKeS91tXAmJvCjQ5UIyAbQFaxkKGyUFK2RPkhwaFSQH8vbpl1d23eu/IBH+dwVMHWaq9A5A=="],
 
     "tough-cookie": ["tough-cookie@6.0.2", "", { "dependencies": { "tldts": "^7.0.5" } }, "sha512-exgYmnmL/sJpR3upZfXG5PoatXQii55xAiXGXzY+sROLZ/Y+SLcp9PgJNI9Vz37HpQ74WvDcLT8eqm+kV3FzrA=="],
 
@@ -1601,15 +1644,15 @@
 
     "type-check": ["type-check@0.4.0", "", { "dependencies": { "prelude-ls": "^1.2.1" } }, "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew=="],
 
-    "type-fest": ["type-fest@5.6.0", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-8ZiHFm91orbSAe2PSAiSVBVko18pbhbiB3U9GglSzF/zCGkR+rxpHx6sEMCUm4kxY4LjDIUGgCfUMtwfZfjfUA=="],
+    "type-fest": ["type-fest@5.9.0", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-yANm3Jr3GiJ1qgJlxGAVxTOIcEOk1rhQHamlXtnrCK7EHP4HeM9OGxtMg/W7HFdrVzw/ZWJKGVIJusVH85sLtw=="],
 
     "typescript": ["typescript@6.0.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw=="],
 
-    "typescript-eslint": ["typescript-eslint@8.59.1", "", { "dependencies": { "@typescript-eslint/eslint-plugin": "8.59.1", "@typescript-eslint/parser": "8.59.1", "@typescript-eslint/typescript-estree": "8.59.1", "@typescript-eslint/utils": "8.59.1" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-xqDcFVBmlrltH64lklOVp1wYxgJr6LVdg3NamBgH2OOQDLFdTKfIZXF5PfghrnXQKXZGTQs8tr1vL7fJvq8CTQ=="],
+    "typescript-eslint": ["typescript-eslint@8.69.0", "", { "dependencies": { "@typescript-eslint/eslint-plugin": "8.69.0", "@typescript-eslint/parser": "8.69.0", "@typescript-eslint/typescript-estree": "8.69.0", "@typescript-eslint/utils": "8.69.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-B3MltX0VqjUBNEe3b3sSuiRbfa6XrfHFtBiPamjT5AsW/dfq+y+bc0wyuS9DxAS1LyzCxRp2+rxzpLUvqM2BvA=="],
 
     "uint8array-extras": ["uint8array-extras@1.5.0", "", {}, "sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A=="],
 
-    "unbash": ["unbash@3.0.0", "", {}, "sha512-FeFPZ/WFT0mbRCuydiZzpPFlrYN8ZUpphQKoq4EeElVIYjYyGzPMxQR/simUwCOJIyVhpFk4RbtyO7RuMpMnHA=="],
+    "unbash": ["unbash@4.0.11", "", {}, "sha512-FoSOKV7NEofQSkAefMVHam4ZPKYMxjAydxiV72UFEDNV/YofxjGfiZ2A9pZjdL/lRJzTjcu4PABo1JYJX8N5iQ=="],
 
     "undici": ["undici@8.10.2", "", {}, "sha512-/y4/bH9YNU5hi9NIrpOuvGXFcxrj3CMrV+/AYpowAYTpHn8gX/XPFjNy766FPoYY0miQhdW977JFWKGNhBdwyQ=="],
 
@@ -1619,7 +1662,7 @@
 
     "universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
 
-    "update-browserslist-db": ["update-browserslist-db@1.2.3", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w=="],
+    "update-browserslist-db": ["update-browserslist-db@1.3.2", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw=="],
 
     "uqr": ["uqr@0.1.3", "", {}, "sha512-0rjE8iEJe4YmT9TOhwsZtqCMRLc5DXZUI2UEYUUg63ikBkqqE5EYWaI0etFe/5KUcmcYwLih2RND1kq+hrUJXA=="],
 
@@ -1629,13 +1672,13 @@
 
     "util-deprecate": ["util-deprecate@1.0.2", "", {}, "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw=="],
 
-    "uuid": ["uuid@14.0.0", "", { "bin": { "uuid": "dist-node/bin/uuid" } }, "sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg=="],
+    "uuid": ["uuid@14.0.2", "", { "bin": { "uuid": "dist-node/bin/uuid" } }, "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ=="],
 
     "validate-npm-package-license": ["validate-npm-package-license@3.0.4", "", { "dependencies": { "spdx-correct": "^3.0.0", "spdx-expression-parse": "^3.0.0" } }, "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew=="],
 
     "version-range": ["version-range@4.15.0", "", {}, "sha512-Ck0EJbAGxHwprkzFO966t4/5QkRuzh+/I1RxhLgUKKwEn+Cd8NwM60mE3AqBZg5gYODoXW0EFsQvbZjRlvdqbg=="],
 
-    "vite": ["vite@8.0.10", "", { "dependencies": { "lightningcss": "^1.32.0", "picomatch": "^4.0.4", "postcss": "^8.5.10", "rolldown": "1.0.0-rc.17", "tinyglobby": "^0.2.16" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.1.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-rZuUu9j6J5uotLDs+cAA4O5H4K1SfPliUlQwqa6YEwSrWDZzP4rhm00oJR5snMewjxF5V/K3D4kctsUTsIU9Mw=="],
+    "vite": ["vite@8.2.2", "", { "dependencies": { "lightningcss": "^1.33.0", "picomatch": "^4.0.5", "postcss": "^8.5.26", "rolldown": "~1.2.4", "tinyglobby": "^0.2.17" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.4.0 || ^0.5.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-cFKLV/PRgAUlIRm5WjMjJ86jrftzpqcgH+Us+DS8mI3CDNiH30Whrz8uHL3+MOLPAgqbMBAqWdAHAphOAM+z/Q=="],
 
     "void-elements": ["void-elements@3.1.0", "", {}, "sha512-Dhxzh5HZuiHQhbvTW9AMetFfBHDMYpo23Uo9btPXgdYP+3T5S+p+jgNy7spra+veYhBP2dCSgxR/i2Y02h5/6w=="],
 
@@ -1667,36 +1710,32 @@
 
     "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
 
-    "ws": ["ws@8.20.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA=="],
+    "ws": ["ws@8.21.3", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw=="],
 
     "xml-name-validator": ["xml-name-validator@5.0.0", "", {}, "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg=="],
 
     "xmlchars": ["xmlchars@2.2.0", "", {}, "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw=="],
 
-    "y-codemirror.next": ["y-codemirror.next@0.3.5", "", { "dependencies": { "lib0": "^0.2.42" }, "peerDependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.0.0", "yjs": "^13.5.6" } }, "sha512-VluNu3e5HfEXybnypnsGwKAj+fKLd4iAnR7JuX1Sfyydmn1jCBS5wwEL/uS04Ch2ib0DnMAOF6ZRR/8kK3wyGw=="],
+    "y-codemirror.next": ["y-codemirror.next@0.3.6", "", { "dependencies": { "lib0": "^0.2.42" }, "peerDependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.0.0", "yjs": "^13.5.6" } }, "sha512-GnmVXhTe+UtoFbbaSdwhq6gdAQZdIY9az0Xj6HR2J4PO6Yw4w3xaaSssU+6T72WhXAI0wf9FbuY2s0Ms+WrexA=="],
 
     "y-protocols": ["y-protocols@1.0.7", "", { "dependencies": { "lib0": "^0.2.85" }, "peerDependencies": { "yjs": "^13.0.0" } }, "sha512-YSVsLoXxO67J6eE/nV4AtFtT3QEotZf5sK5BHxFBXso7VDUT3Tx07IfA6hsu5Q5OmBdMkQVmFZ9QOA7fikWvnw=="],
 
     "yallist": ["yallist@3.1.1", "", {}, "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="],
 
-    "yaml": ["yaml@2.8.4", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-ml/JPOj9fOQK8RNnWojA67GbZ0ApXAUlN2UQclwv2eVgTgn7O9gg9o7paZWKMp4g0H3nTLtS9LVzhkpOFIKzog=="],
+    "yaml": ["yaml@2.9.0", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA=="],
 
-    "yjs": ["yjs@13.6.31", "", { "dependencies": { "lib0": "^0.2.99" } }, "sha512-Eq+5BRfbeGyqGVrTJL3bEcr8gKkxPuyuoHmAwpk52fDb8kOVMrfVSTRPd6yiGgX5Fskb96qCRjzjbRjrL4YEnw=="],
+    "yjs": ["yjs@13.6.32", "", { "dependencies": { "lib0": "^0.2.99" } }, "sha512-lfiJIIC4Xayt5ItynE407ehlE03pCjeOc4hkR4yxxvvNJ4kuiN25B0g+Qp8XagYz361LLL7DCzR5bvFJ81QKtQ=="],
 
     "yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
 
-    "zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+    "zod": ["zod@4.5.4", "", {}, "sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA=="],
 
     "zod-validation-error": ["zod-validation-error@3.5.4", "", { "peerDependencies": { "zod": "^3.24.4" } }, "sha512-+hEiRIiPobgyuFlEojnqjJnhFvg4r/i3cqgcm67eehZf/WBaK3g6cD02YU9mtdVxZjv8CzCA9n/Rhrs3yAAvAw=="],
 
-    "zustand": ["zustand@5.0.12", "", { "peerDependencies": { "@types/react": ">=18.0.0", "immer": ">=9.0.6", "react": ">=18.0.0", "use-sync-external-store": ">=1.2.0" }, "optionalPeers": ["@types/react", "immer", "react", "use-sync-external-store"] }, "sha512-i77ae3aZq4dhMlRhJVCYgMLKuSiZAaUPAct2AksxQ+gOtimhGMdXljRT21P5BNpeT4kXlLIckvkPM029OljD7g=="],
+    "zustand": ["zustand@5.0.15", "", { "peerDependencies": { "@types/react": ">=18.0.0", "immer": ">=9.0.6", "react": ">=18.0.0", "use-sync-external-store": ">=1.2.0" }, "optionalPeers": ["@types/react", "immer", "react", "use-sync-external-store"] }, "sha512-MpSEjRiBkA9crSYeOUH32rJC7SVqAbm0Fqcqge/bUi2PPoLcBWKOsG+C8mevmpr8TwXHBVkChbbJiyvkE+i/3A=="],
 
     "zustand-mutative": ["zustand-mutative@1.3.1", "", { "peerDependencies": { "@types/react": "^18.0 || ^17.0 || ^19.0", "mutative": "^1.3.0", "react": "^18.0 || ^17.0 || ^19.0", "zustand": "^4.0 || ^5.0" } }, "sha512-UU6d/KFdn0f3vlr0EtQGA18yZVaz8E00e0WuuxCwkOCVdmwFwSKOCAdtWgmDdwtbDKjniHCJcxaIIjyymwSk/g=="],
 
-    "@asamuzakjp/css-color/lru-cache": ["lru-cache@11.5.2", "", {}, "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g=="],
-
-    "@asamuzakjp/dom-selector/lru-cache": ["lru-cache@11.5.2", "", {}, "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g=="],
-
     "@babel/core/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
     "@babel/helper-compilation-targets/lru-cache": ["lru-cache@5.1.1", "", { "dependencies": { "yallist": "^3.0.2" } }, "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w=="],
@@ -1709,6 +1748,10 @@
 
     "@img/sharp-wasm32/@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="],
 
+    "@oxc-parser/binding-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
+
+    "@oxc-parser/binding-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
+
     "@secretlint/config-loader/ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
 
     "@secretlint/formatter/chalk": ["chalk@5.6.2", "", {}, "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA=="],
@@ -1717,23 +1760,13 @@
 
     "@textlint/linter-formatter/pluralize": ["pluralize@2.0.0", "", {}, "sha512-TqNZzQCD4S42De9IfnnBvILN7HAW7riLqsCyp8lgjXeysyPlX5HhqKAcJHHHb9XskE4/a+7VGC9zzx8Ls0jOAw=="],
 
-    "@types/node/undici-types": ["undici-types@7.16.0", "", {}, "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw=="],
-
-    "@typescript-eslint/parser/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
-
-    "@typescript-eslint/project-service/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
+    "@types/node/undici-types": ["undici-types@7.18.2", "", {}, "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w=="],
 
-    "@typescript-eslint/scope-manager/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
+    "@typescript-eslint/eslint-plugin/ignore": ["ignore@7.0.8", "", {}, "sha512-YYNsSlXBjMk92SKnkwvB5LOVSa6OznlFUGcsvrFgNJbJCd0M1XKeFVRc8ZByeCqz32FivYNHJVooLmdqrmvp/Q=="],
 
-    "@typescript-eslint/type-utils/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
+    "acorn-loose/acorn": ["acorn@8.18.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ=="],
 
-    "@typescript-eslint/typescript-estree/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
-
-    "@typescript-eslint/utils/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
-
-    "@typescript-eslint/visitor-keys/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
-
-    "agent-install/yaml": ["yaml@2.9.0", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA=="],
+    "acorn-walk/acorn": ["acorn@8.18.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ=="],
 
     "ajv-formats/ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
 
@@ -1745,6 +1778,10 @@
 
     "data-urls/whatwg-url": ["whatwg-url@16.0.1", "", { "dependencies": { "@exodus/bytes": "^1.11.0", "tr46": "^6.0.0", "webidl-conversions": "^8.0.1" } }, "sha512-1to4zXBxmXHV3IiSSEInrreIlu02vUOvrhxJJH5vcxYTBDAx51cqZiKdyTxlecdKNSjj8EcxGBxNf6Vg+945gw=="],
 
+    "dependency-cruiser/picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="],
+
+    "dependency-cruiser/semver": ["semver@7.8.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg=="],
+
     "dependency-tree/commander": ["commander@12.1.0", "", {}, "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="],
 
     "dependency-tree/typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
@@ -1755,13 +1792,11 @@
 
     "effect/ini": ["ini@7.0.0", "", {}, "sha512-ifK0CgjALofS5bkrcTy4RaQ9Vx2Knf/eLeIO+NaswQEpH1UblrtTSCIvN71qQDMq0PeQ/SSPojvEJp9vvvfr+w=="],
 
-    "effect/yaml": ["yaml@2.9.0", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA=="],
-
     "eslint/ignore": ["ignore@5.3.2", "", {}, "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g=="],
 
     "eslint-plugin-react-compiler/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
-    "eslint-plugin-react-hooks/zod-validation-error": ["zod-validation-error@4.0.2", "", { "peerDependencies": { "zod": "^3.25.0 || ^4.0.0" } }, "sha512-Q6/nZLe6jxuU80qb/4uJ4t5v2VEZ44lzQjPDhYJNztRQ4wyWc6VF3D3Kb/fAuPetZQnhS3hnajCf9CsWesghLQ=="],
+    "espree/acorn": ["acorn@8.18.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ=="],
 
     "fast-glob/glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
 
@@ -1771,11 +1806,11 @@
 
     "global-directory/ini": ["ini@4.1.1", "", {}, "sha512-QQnnxNyfvmHFIsj7gkPcYymR8Jdw/o7mp5ZFihxn6h8Ci6fh3Dx4E1gPjpQEpIuPo9XVNY/ZUwh4BPMjGyL01g=="],
 
-    "is-expression/acorn": ["acorn@7.4.1", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A=="],
+    "globby/ignore": ["ignore@7.0.8", "", {}, "sha512-YYNsSlXBjMk92SKnkwvB5LOVSa6OznlFUGcsvrFgNJbJCd0M1XKeFVRc8ZByeCqz32FivYNHJVooLmdqrmvp/Q=="],
 
-    "jscpd/commander": ["commander@5.1.0", "", {}, "sha512-P0CysNDQ7rtVw4QIQtm+MRxV66vKFSvlsQvGYXZWR3qFU0jlMKHZZZgw8e+8DSah4UDKMqnknRDQz+xuQXQ/Zg=="],
+    "is-expression/acorn": ["acorn@7.4.1", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A=="],
 
-    "jsdom/lru-cache": ["lru-cache@11.5.2", "", {}, "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g=="],
+    "jscpd/commander": ["commander@15.0.0", "", {}, "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg=="],
 
     "jsdom/whatwg-mimetype": ["whatwg-mimetype@5.0.0", "", {}, "sha512-sXcNcHOC51uPGF0P/D4NVtrkjSU2fNsm9iog4ZvZJsL3rjoDAzXZhkm2MWt1y+PUdggKAYVoMAIYcs78wJ51Cw=="],
 
@@ -1785,7 +1820,9 @@
 
     "module-lookup-amd/commander": ["commander@12.1.0", "", {}, "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="],
 
-    "oxc-parser/@oxc-project/types": ["@oxc-project/types@0.128.0", "", {}, "sha512-huv1Y/LzBJkBVHt3OlC7u0zHBW9qXf1FdD7sGmc1rXc2P1mTwHssYv7jyGx5KAACSCH+9B3Bhn6Z9luHRvf7pQ=="],
+    "oxc-parser/@oxc-project/types": ["@oxc-project/types@0.147.0", "", {}, "sha512-IJ3s6ltHLp45S0bh7phkX+gJO7A1Wuz2EaqpAhb8WjqDwbzMiWKHhyyT42tskaWjEYXtHtVCPpnBJVT9+dcRLg=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser": ["oxc-parser@0.132.0", "", { "dependencies": { "@oxc-project/types": "^0.132.0" }, "optionalDependencies": { "@oxc-parser/binding-android-arm-eabi": "0.132.0", "@oxc-parser/binding-android-arm64": "0.132.0", "@oxc-parser/binding-darwin-arm64": "0.132.0", "@oxc-parser/binding-darwin-x64": "0.132.0", "@oxc-parser/binding-freebsd-x64": "0.132.0", "@oxc-parser/binding-linux-arm-gnueabihf": "0.132.0", "@oxc-parser/binding-linux-arm-musleabihf": "0.132.0", "@oxc-parser/binding-linux-arm64-gnu": "0.132.0", "@oxc-parser/binding-linux-arm64-musl": "0.132.0", "@oxc-parser/binding-linux-ppc64-gnu": "0.132.0", "@oxc-parser/binding-linux-riscv64-gnu": "0.132.0", "@oxc-parser/binding-linux-riscv64-musl": "0.132.0", "@oxc-parser/binding-linux-s390x-gnu": "0.132.0", "@oxc-parser/binding-linux-x64-gnu": "0.132.0", "@oxc-parser/binding-linux-x64-musl": "0.132.0", "@oxc-parser/binding-openharmony-arm64": "0.132.0", "@oxc-parser/binding-wasm32-wasi": "0.132.0", "@oxc-parser/binding-win32-arm64-msvc": "0.132.0", "@oxc-parser/binding-win32-ia32-msvc": "0.132.0", "@oxc-parser/binding-win32-x64-msvc": "0.132.0" } }, "sha512-+0LAPHaqtfQlvWdpaAa09SmOaZZgP8C552xosEkGJ4+ruEwP1Vgx+sqBgcBCNfR6KDCmagGOZTde8wmAvcI/Hg=="],
 
     "parse-json/type-fest": ["type-fest@4.41.0", "", {}, "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA=="],
 
@@ -1793,7 +1830,7 @@
 
     "playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
 
-    "postcss/nanoid": ["nanoid@3.3.12", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ=="],
+    "postcss/nanoid": ["nanoid@3.3.18", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w=="],
 
     "precinct/commander": ["commander@12.1.0", "", {}, "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="],
 
@@ -1801,12 +1838,8 @@
 
     "rc/strip-json-comments": ["strip-json-comments@2.0.1", "", {}, "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ=="],
 
-    "rolldown/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.17", "", {}, "sha512-n8iosDOt6Ig1UhJ2AYqoIhHWh/isz0xpicHTzpKBeotdVsTEcxsSA/i3EVM7gQAj0rU27OLAxCjzlj15IWY7bg=="],
-
     "sass-lookup/commander": ["commander@12.1.0", "", {}, "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="],
 
-    "sharp/semver": ["semver@7.8.5", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA=="],
-
     "slice-ansi/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
 
     "stylus-lookup/commander": ["commander@12.1.0", "", {}, "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="],
@@ -1819,9 +1852,11 @@
 
     "zod-validation-error/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
+    "@oxc-parser/binding-wasm32-wasi/@emnapi/core/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
+
     "@secretlint/config-loader/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
 
-    "@secretlint/formatter/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
+    "@secretlint/formatter/strip-ansi/ansi-regex": ["ansi-regex@6.3.0", "", {}, "sha512-WpDfL7NO6j7tH88IDBNVdUJxDh9nmCteAVW9dsep846XdwF4naCBK+/tGLX3KJgcpgMRXCFlTM2hKGoK9FsdrQ=="],
 
     "ajv-formats/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
 
@@ -1859,14 +1894,52 @@
 
     "deslop-js/oxc-parser/@oxc-parser/binding-openharmony-arm64": ["@oxc-parser/binding-openharmony-arm64@0.132.0", "", { "os": "none", "cpu": "arm64" }, "sha512-FWzmUGrZ6GUby4U7WIwcCtab6tdmlTO3xTRRKyb5kjIJVEiaUAT8animUG/nK8ZCA8gkRkPOTId4rl6uTqUmJQ=="],
 
-    "deslop-js/oxc-parser/@oxc-parser/binding-wasm32-wasi": ["@oxc-parser/binding-wasm32-wasi@0.132.0", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-TlbMppxJI5CjWDes0QaP6G3aneVg1yikBu5QYI+DUShF9WDL66ccgKFNNGmi/Wybtszw6hxwAvv76T4DaPKnHw=="],
-
     "deslop-js/oxc-parser/@oxc-parser/binding-win32-arm64-msvc": ["@oxc-parser/binding-win32-arm64-msvc@0.132.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-RH/NbFjGKqdUAUi7Oh3LQPxUk2hsWFEEQ38HSnbRQT8QjBZFKqL1fMbmsB3N4jy/KPh9iX94+9dmkEMBBbambw=="],
 
     "deslop-js/oxc-parser/@oxc-parser/binding-win32-ia32-msvc": ["@oxc-parser/binding-win32-ia32-msvc@0.132.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-JUr4jQY9jxoIB/YTLXr6XofSi5xikj6p5/Ns1h0VOBDT0j1jKU+kMsv2xxv51RwnETcXpA1Yw/9oUAfcqfaqEA=="],
 
     "deslop-js/oxc-parser/@oxc-parser/binding-win32-x64-msvc": ["@oxc-parser/binding-win32-x64-msvc@0.132.0", "", { "os": "win32", "cpu": "x64" }, "sha512-2dapgHpA5X8DSXF4AU36hJWYf6zP0tKjMXFRAZFBD62pkevW/uhFDXoFH9Y/3Fd2EtDrw5ByNnR1wVE9X9y0SQ=="],
 
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-android-arm-eabi": ["@oxc-parser/binding-android-arm-eabi@0.132.0", "", { "os": "android", "cpu": "arm" }, "sha512-KrLaPWa5c9Y7LkW+rKkaUE3y7DBDrQtaf7rlsSDfv6KAHUjgzAIRA761Lrrp6//Yd/Rlie/yEOt9YENCoJnOcw=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-android-arm64": ["@oxc-parser/binding-android-arm64@0.132.0", "", { "os": "android", "cpu": "arm64" }, "sha512-SThDrSeamB/kG2+NxcJ5/wSLcV6dUqDknrPLqFYQ0ST/55mtBP4M7Q/f3QbubH6aAd11wpzZn/nwbVRSdobOpg=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-darwin-arm64": ["@oxc-parser/binding-darwin-arm64@0.132.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-Lc0f/TYoKBghE5/2Gsv7bLXk+TJZunx2Tf61X8hG4ARXdc8UYI26dCGccFSd1AyFbK3jfaNXtMnupggDbjPXdQ=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-darwin-x64": ["@oxc-parser/binding-darwin-x64@0.132.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-RG2eJIpf7C21z9HSSXFw1bTArdpKe7Y4fwcJTwRq1yCSe1vSavaN9GA1sm9KqzemTLAGVktQ+7qBTGp0vQeUZg=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-freebsd-x64": ["@oxc-parser/binding-freebsd-x64@0.132.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-wQIPntPLtJ8NcBpvKPbEv3NqzV6k8eP8tP/jE9Rg8HTg/j7urZGFSsTCPCW5k77Qfw2DM4vRvc9p3I4yq/Shvw=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-arm-gnueabihf": ["@oxc-parser/binding-linux-arm-gnueabihf@0.132.0", "", { "os": "linux", "cpu": "arm" }, "sha512-PixKEpeSe3yxQWqNyOCBALRYc72+Tj7ILDofUl3iXo25cVOzLA6jHUhmOINRtWIPh7dbUie3QNeabwaQpZTw6w=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-arm-musleabihf": ["@oxc-parser/binding-linux-arm-musleabihf@0.132.0", "", { "os": "linux", "cpu": "arm" }, "sha512-sCR+DzGHlyHKnbA2z9zWjTUhIo8Sy0enJl4RDsBwPmkxYynPatpwOAWe8W5127SlW0boqUWHGtr1NWn5UwIhXQ=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-arm64-gnu": ["@oxc-parser/binding-linux-arm64-gnu@0.132.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-sQBix5P2cW+IpzTcCwYxnh9yALrKSIkKJThspBvMGcygSMnbzkSvhN7SfuX1hvBk8y1XEChsdkU3ET0V5DmzUw=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-arm64-musl": ["@oxc-parser/binding-linux-arm64-musl@0.132.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-WozHg3Kc//8Sk756HXXgMbEAvqtG+Lzb9JOojwQzIGDtN78Az2dLttkb71akWYUF/8IgYfDSlfKh4Uot8is5Vw=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-ppc64-gnu": ["@oxc-parser/binding-linux-ppc64-gnu@0.132.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-CmX/ulNBOEwWTyVRmcpYKAcAizW6+OjtLJgo7fXoL9OqQvjF4VER8tPomv44vwzfSCy1BHbsB0ZlZYzYJNj4cA=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-riscv64-gnu": ["@oxc-parser/binding-linux-riscv64-gnu@0.132.0", "", { "os": "linux", "cpu": "none" }, "sha512-j9oQS+hM90SdhviNGWbPgT4+Rlq+ac++q/zjgwPD1mVHgxHzATvoRGtDx0sXGmFOQ9J9YkwAhYGb5MAHL6TAsA=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-riscv64-musl": ["@oxc-parser/binding-linux-riscv64-musl@0.132.0", "", { "os": "linux", "cpu": "none" }, "sha512-bLz+Xi+Agnfmd7kWPEsSVwCn2k4EyIalZkNBcQ0OGIv9rqn8VgCPLNd03tM9mKX/5TdlvDXalz0q71BIrOPNqg=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-s390x-gnu": ["@oxc-parser/binding-linux-s390x-gnu@0.132.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-U6t2qbJU0ypTfyj9QV3W1Y6mITDTL8ai/OR6NUn85vyHthOvobKWgXzU4tu0EskSzlpuVFz1g0jFGulDIUKHxQ=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-x64-gnu": ["@oxc-parser/binding-linux-x64-gnu@0.132.0", "", { "os": "linux", "cpu": "x64" }, "sha512-WcEaSNHFk8yz5YFlQQAlhq6jOFmZBB/RKE7uzhyCIf+pF1Lmv9gUH4221mle2Gd9iHyWT3ySNph8yZgb1xYdWg=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-x64-musl": ["@oxc-parser/binding-linux-x64-musl@0.132.0", "", { "os": "linux", "cpu": "x64" }, "sha512-iQrV4iJzQgRwK3BWRmQl1C3C6g3wYpXN2WLdQdyR+efoUnncdShZAVp9OgcojtlD3MDRbuOMGG3SjxF4fL4nlQ=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-openharmony-arm64": ["@oxc-parser/binding-openharmony-arm64@0.132.0", "", { "os": "none", "cpu": "arm64" }, "sha512-FWzmUGrZ6GUby4U7WIwcCtab6tdmlTO3xTRRKyb5kjIJVEiaUAT8animUG/nK8ZCA8gkRkPOTId4rl6uTqUmJQ=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-win32-arm64-msvc": ["@oxc-parser/binding-win32-arm64-msvc@0.132.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-RH/NbFjGKqdUAUi7Oh3LQPxUk2hsWFEEQ38HSnbRQT8QjBZFKqL1fMbmsB3N4jy/KPh9iX94+9dmkEMBBbambw=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-win32-ia32-msvc": ["@oxc-parser/binding-win32-ia32-msvc@0.132.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-JUr4jQY9jxoIB/YTLXr6XofSi5xikj6p5/Ns1h0VOBDT0j1jKU+kMsv2xxv51RwnETcXpA1Yw/9oUAfcqfaqEA=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-win32-x64-msvc": ["@oxc-parser/binding-win32-x64-msvc@0.132.0", "", { "os": "win32", "cpu": "x64" }, "sha512-2dapgHpA5X8DSXF4AU36hJWYf6zP0tKjMXFRAZFBD62pkevW/uhFDXoFH9Y/3Fd2EtDrw5ByNnR1wVE9X9y0SQ=="],
+
+    "oxlint-plugin-react-doctor/oxc-parser/@oxc-project/types": ["@oxc-project/types@0.132.0", "", {}, "sha512-FESMOxil5Se014ui/Eq8fT5uHJo6nIRwH0PfJrZJXs6Gek3ZVFOrpUv3YIZT20m+extU98Hg1Ym72U58rlsxUQ=="],
+
     "table/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
   }
 }
diff --git a/package.json b/package.json
index 3e726616b..567be9315 100644
--- a/package.json
+++ b/package.json
@@ -68,6 +68,7 @@
     "@codemirror/lang-markdown": "^6.5.0",
     "@codemirror/language": "^6.12.3",
     "@codemirror/lint": "^6.9.5",
+    "@codemirror/merge": "^6.12.2",
     "@codemirror/state": "^6.6.0",
     "@dnd-kit/core": "^6.3.1",
     "@fontsource-variable/inter": "^5.2.8",
diff --git a/server/ai/tools/plugin/systemPrompt.ts b/server/ai/tools/plugin/systemPrompt.ts
index 1d1000d02..0ec7606e0 100644
--- a/server/ai/tools/plugin/systemPrompt.ts
+++ b/server/ai/tools/plugin/systemPrompt.ts
@@ -20,7 +20,13 @@ What a site plugin is:
     modules/*.ts(x)  → canvas module pack (blocks users drop on pages) — requires "modules.register".
     frontend/**      → static assets published with the site.
 - Permission coherence is enforced: an entry file whose permission is missing from plugin.json fails validation with a named diagnostic. adminPages requires "admin.navigation"; adminPages with kind:'app' additionally requires "editor.code" (markdown pages don't).
-- Import containment: plugin code may import its own files and "@instatic/plugin-sdk" ONLY. Imports that escape the plugin folder fail the build.
+- Import containment: plugin code may import its own files and "@instatic/plugin-sdk" ONLY. Imports that escape the plugin folder fail the build. There is NO node_modules in the file tree — never try to read SDK sources/types as files; this summary is your API reference.
+
+Admin pages (plugin.json "adminPages": [{ id, title, navLabel?, icon?, content }]) — content is a strict union:
+- { "kind": "markdown", "body": "…markdown…", "heading"? } — static page, no code, no extra permission beyond admin.navigation.
+- { "kind": "resource", "heading": "…", "resource": "<slug>" } — a FULL CRUD table UI (list/create/edit/delete records) rendered by the host for a resource declared in "resources": [{ "slug", "labelField", "fields": [...] }]. This is the way to build "manage X records" pages (customers, leads, bookings) — no custom code needed; records live in plugin storage.
+- { "kind": "map", "heading": "…", "pins"? } — pin map page.
+- { "kind": "app", "heading": "…", "entry": "<frontend asset path>" } — custom JS page; heavyweight: needs a built frontend asset and the editor.code permission. Prefer "resource" for record management.
 
 SDK essentials (import from "@instatic/plugin-sdk"):
 - Server: export default defineServerPlugin-style hooks object; routes registered via the hooks receive (req) and return responses. sitePluginRoute(localId, path) builds the public route URL ("/admin/api/cms/plugins/site.<localId>/runtime/<path>").
diff --git a/src/__tests__/architecture/codemirror-lazy-only.test.ts b/src/__tests__/architecture/codemirror-lazy-only.test.ts
index 7e65c9e78..140853975 100644
--- a/src/__tests__/architecture/codemirror-lazy-only.test.ts
+++ b/src/__tests__/architecture/codemirror-lazy-only.test.ts
@@ -81,6 +81,9 @@ function collectProdFiles(): string[] {
 const ALLOWED_CONSUMERS = new Set([
   'admin/pages/site/code-editor/CodeMirrorEditor.tsx',
   'admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx',
+  // Read-only agent code/diff blocks — lazy-loaded by ToolCallRow, same
+  // chunk graph as the code editor.
+  'admin/pages/site/code-editor/AgentCodeView.tsx',
 ])
 
 // Matches: import ... from 'codemirror' / '@codemirror/...' / '@lezer/...'
diff --git a/src/admin/pages/plugins/ide/agent/usePluginIdeToolBridge.ts b/src/admin/pages/plugins/ide/agent/usePluginIdeToolBridge.ts
index 728524282..bd39c2774 100644
--- a/src/admin/pages/plugins/ide/agent/usePluginIdeToolBridge.ts
+++ b/src/admin/pages/plugins/ide/agent/usePluginIdeToolBridge.ts
@@ -40,6 +40,16 @@ export function usePluginIdeToolBridge(options: UsePluginIdeToolBridgeOptions):
 
   const { localId } = options
   useEffect(() => {
+    // File metas come from the LIVE session (the Y doc), never from React
+    // state: back-to-back tool calls mutate and re-read without giving React
+    // a render turn, so the state array lags one commit behind — a
+    // create-then-describe would miss its own file. Same class of problem
+    // the content bridge solves with flushSync; reading the CRDT directly is
+    // the simpler correct answer here.
+    const liveFiles = () => {
+      const current = optionsRef.current
+      return current.session?.pluginFiles() ?? current.files
+    }
     const handle: PluginIdeBridgeHandle = {
       localId,
       buildSnapshot(): PluginIdeAgentSnapshot {
@@ -47,7 +57,7 @@ export function usePluginIdeToolBridge(options: UsePluginIdeToolBridgeOptions):
         return {
           localId,
           pluginId: sitePluginIdFromLocalId(localId),
-          files: current.files.map((file) => ({
+          files: liveFiles().map((file) => ({
             id: file.id,
             path: file.path.slice(current.folder.length),
           })),
@@ -63,7 +73,7 @@ export function usePluginIdeToolBridge(options: UsePluginIdeToolBridgeOptions):
         }
       },
       session: () => optionsRef.current.session,
-      files: () => optionsRef.current.files,
+      files: liveFiles,
       selectFile: (fileId) => optionsRef.current.selectFile(fileId),
       canEdit: () => optionsRef.current.canEdit,
     }
diff --git a/src/admin/pages/site/code-editor/AgentCodeView.tsx b/src/admin/pages/site/code-editor/AgentCodeView.tsx
new file mode 100644
index 000000000..35af58e44
--- /dev/null
+++ b/src/admin/pages/site/code-editor/AgentCodeView.tsx
@@ -0,0 +1,95 @@
+/**
+ * AgentCodeView — read-only CodeMirror code + unified-diff blocks for the
+ * agent panel's tool rows (what did `plugin_write_file` write, what did
+ * `plugin_patch_file` change).
+ *
+ * LAZY-LOADED via React.lazy() in ToolCallRow — this module MUST NOT be
+ * imported statically from the admin main chunk (CodeMirror is ~150 kB
+ * min+gz; the codemirror-lazy-only gate pins the allowed importers). It
+ * shares the editor chrome theme + language stacks with CodeMirrorEditor.
+ *
+ * `diffOriginal` switches the block into a unified merge view
+ * (@codemirror/merge): deletions render inline above their replacements —
+ * a real diff, not two stacked snippets.
+ */
+import { useEffect, useRef } from 'react'
+import { EditorView, lineNumbers } from '@codemirror/view'
+import { EditorState } from '@codemirror/state'
+import { syntaxHighlighting } from '@codemirror/language'
+import { unifiedMergeView } from '@codemirror/merge'
+import {
+  editorChromeTheme,
+  getLanguageExtensions,
+  readableHighlightStyle,
+  type CodeLanguage,
+} from './CodeMirrorEditor'
+
+/** Map a file path to the highlight language by extension. */
+function codeLanguageForPath(path: string): CodeLanguage {
+  const extension = path.slice(path.lastIndexOf('.') + 1).toLowerCase()
+  switch (extension) {
+    case 'tsx':
+    case 'jsx':
+      return 'tsx'
+    case 'ts':
+    case 'js':
+    case 'mjs':
+      return 'ts'
+    case 'css':
+      return 'css'
+    case 'json':
+      return 'json'
+    case 'md':
+      return 'markdown'
+    case 'html':
+    case 'svg':
+      return 'html'
+    default:
+      return 'text'
+  }
+}
+
+interface AgentCodeViewProps {
+  /** The (new) code to display. */
+  code: string
+  /** Path used only to pick the highlight language. */
+  path: string
+  /** When set, render a unified diff from this original to `code`. */
+  diffOriginal?: string
+}
+
+export default function AgentCodeView({ code, path, diffOriginal }: AgentCodeViewProps) {
+  const hostRef = useRef<HTMLDivElement | null>(null)
+
+  useEffect(() => {
+    const host = hostRef.current
+    if (!host) return
+    const view = new EditorView({
+      parent: host,
+      state: EditorState.create({
+        doc: code,
+        extensions: [
+          EditorState.readOnly.of(true),
+          EditorView.editable.of(false),
+          EditorView.lineWrapping,
+          lineNumbers(),
+          editorChromeTheme,
+          syntaxHighlighting(readableHighlightStyle),
+          ...getLanguageExtensions(codeLanguageForPath(path)),
+          ...(diffOriginal !== undefined
+            ? [
+                unifiedMergeView({
+                  original: diffOriginal,
+                  mergeControls: false,
+                  gutter: true,
+                }),
+              ]
+            : []),
+        ],
+      }),
+    })
+    return () => view.destroy()
+  }, [code, path, diffOriginal])
+
+  return <div ref={hostRef} data-testid="agent-code-view" />
+}
diff --git a/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx b/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
index 747a7b6bb..5889b0d70 100644
--- a/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
+++ b/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
@@ -62,7 +62,7 @@ import { renderMarkdownDocumentation } from './markdownDocumentation'
 // ---------------------------------------------------------------------------
 // All color values are CSS custom properties from globals.css.
 // No hex, rgb(), or hsl() literals in this lazy-loaded editor module.
-const achromatic = EditorView.theme({
+export const editorChromeTheme = EditorView.theme({
   '&': {
     backgroundColor: 'var(--bg-surface)',
     color: 'var(--text)',
@@ -161,7 +161,7 @@ const achromatic = EditorView.theme({
   },
 }, { dark: true })
 
-const readableHighlightStyle = HighlightStyle.define([
+export const readableHighlightStyle = HighlightStyle.define([
   {
     tag: [
       t.comment,
@@ -301,8 +301,9 @@ export type CodeLanguage =
   | 'html'
   | 'text'
 
-/** Map a `CodeLanguage` to its CM6 language extension(s). */
-function getLanguageExtensions(language: CodeLanguage): Extension[] {
+/** Map a `CodeLanguage` to its CM6 language extension(s). Shared with the
+ * read-only agent code/diff views (`AgentCodeView.tsx`, same lazy graph). */
+export function getLanguageExtensions(language: CodeLanguage): Extension[] {
   switch (language) {
     case 'tsx':
       return [javascript({ jsx: true, typescript: true })]
@@ -580,7 +581,7 @@ export default function CodeMirrorEditor({
               ]
             : []),
           readableSyntaxHighlighting,
-          achromatic,
+          editorChromeTheme,
           editorTooltipBoundary,
           lintGutter(),
           EditorView.updateListener.of((update) => {
diff --git a/src/admin/pages/site/panels/AgentPanel/AgentPanel.module.css b/src/admin/pages/site/panels/AgentPanel/AgentPanel.module.css
index 8bc45f60b..2fb2ed54f 100644
--- a/src/admin/pages/site/panels/AgentPanel/AgentPanel.module.css
+++ b/src/admin/pages/site/panels/AgentPanel/AgentPanel.module.css
@@ -473,6 +473,28 @@
   color: var(--text-disabled);
 }
 
+/* Expandable code / diff payload under write- and patch-tool rows. */
+.toolCallCode {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: var(--space-2xs);
+  min-width: 0;
+}
+
+.toolCallCodeBlock {
+  align-self: stretch;
+  max-height: 260px;
+  overflow: auto;
+  border-radius: 12px;
+  background: var(--bg-surface);
+}
+
+/* The read-only viewer sizes to content; the block owns the scroll. */
+.toolCallCodeBlock :global(.cm-editor) {
+  height: auto;
+}
+
 .toolCallStatus {
   display: inline-flex;
   align-items: center;
diff --git a/src/admin/pages/site/panels/AgentPanel/ToolCallRow.tsx b/src/admin/pages/site/panels/AgentPanel/ToolCallRow.tsx
index ae5f4c846..daf0e410b 100644
--- a/src/admin/pages/site/panels/AgentPanel/ToolCallRow.tsx
+++ b/src/admin/pages/site/panels/AgentPanel/ToolCallRow.tsx
@@ -3,10 +3,15 @@
  * human title · muted detail, status glyph, plus optional colour-token
  * swatches and an inline error message. Captured images are grouped by the
  * parent turn so they share the conversation gallery and preview window.
+ *
+ * Write/patch tools additionally expose their code payload behind a
+ * "View code / changes" toggle — a lazy CodeMirror block (unified diff for
+ * patches) so the user can see exactly what the agent wrote.
  */
-import type { CSSProperties } from 'react'
+import { lazy, Suspense, useState, type CSSProperties } from 'react'
 import type { AgentToolCall } from '@site/agent'
 import { cn } from '@ui/cn'
+import { Button } from '@ui/components/Button'
 import { Tooltip } from '@ui/components/Tooltip'
 import { LoaderIcon } from 'pixel-art-icons/icons/loader'
 import { CheckIcon } from 'pixel-art-icons/icons/check'
@@ -30,16 +35,28 @@ import { ColorsSwatchSolidIcon } from 'pixel-art-icons/icons/colors-swatch-solid
 import { LayoutSolidIcon } from 'pixel-art-icons/icons/layout-solid'
 import { UsersSolidIcon } from 'pixel-art-icons/icons/users-solid'
 import { ZapSolidIcon } from 'pixel-art-icons/icons/zap-solid'
-import { getToolCallDisplay, extractColorSwatches, type ToolCallIcon, type ToolCallTone } from './toolCallDisplay'
+import {
+  getToolCallDisplay,
+  extractColorSwatches,
+  extractCodePayload,
+  type ToolCallIcon,
+  type ToolCallTone,
+} from './toolCallDisplay'
 import styles from './AgentPanel.module.css'
 
+// CodeMirror is ~150 kB min+gz — the code/diff block loads on first expand
+// only (same policy as the site code editor).
+const AgentCodeView = lazy(() => import('@site/code-editor/AgentCodeView'))
+
 export function ToolCallRow({ toolCall }: { toolCall: AgentToolCall }) {
+  const [codeOpen, setCodeOpen] = useState(false)
   const isPending = toolCall.status === 'pending'
   const isSuccess = toolCall.status === 'success'
   const isError = toolCall.status === 'error'
 
   const display = getToolCallDisplay(toolCall.actionType, toolCall.params)
   const swatches = extractColorSwatches(toolCall.actionType, toolCall.params)
+  const codePayload = extractCodePayload(toolCall.actionType, toolCall.params)
   const accessibleStatus = isPending ? 'Running' : isSuccess ? 'Completed' : 'Failed'
   const statusLabel = `${accessibleStatus} ${display.title}${display.detail ? ` — ${display.detail}` : ''}`
   const statusClass = isPending
@@ -90,6 +107,41 @@ export function ToolCallRow({ toolCall }: { toolCall: AgentToolCall }) {
           {errorMessage}
         </p>
       )}
+      {codePayload && (
+        <div className={styles.toolCallCode}>
+          <Button
+            variant="ghost"
+            size="xs"
+            onClick={() => setCodeOpen((open) => !open)}
+            aria-expanded={codeOpen}
+          >
+            {codeOpen
+              ? codePayload.kind === 'diff' ? 'Hide changes' : 'Hide code'
+              : codePayload.kind === 'diff' ? 'View changes' : 'View code'}
+          </Button>
+          {codeOpen && (
+            <Suspense fallback={null}>
+              {codePayload.kind === 'code' ? (
+                <div className={styles.toolCallCodeBlock}>
+                  <AgentCodeView code={codePayload.code} path={codePayload.path} />
+                </div>
+              ) : (
+                codePayload.edits.map((edit, index) => (
+                  // Edits are positional within one immutable tool call, so
+                  // the index is a stable key.
+                  <div key={index} className={styles.toolCallCodeBlock}>
+                    <AgentCodeView
+                      code={edit.newText}
+                      diffOriginal={edit.oldText}
+                      path={codePayload.path}
+                    />
+                  </div>
+                ))
+              )}
+            </Suspense>
+          )}
+        </div>
+      )}
     </>
   )
 }
diff --git a/src/admin/pages/site/panels/AgentPanel/toolCallDisplay.ts b/src/admin/pages/site/panels/AgentPanel/toolCallDisplay.ts
index e0fbdc73b..386fd23f6 100644
--- a/src/admin/pages/site/panels/AgentPanel/toolCallDisplay.ts
+++ b/src/admin/pages/site/panels/AgentPanel/toolCallDisplay.ts
@@ -149,6 +149,29 @@ export function getToolCallDisplay(actionType: string, params: unknown): ToolCal
     case 'set_active_collection':
       return display('Opening collection', collectionDetail(p), 'open', 'read')
 
+    // Plugin IDE scope — file tools carry relative paths; lifecycle tools
+    // carry an optional localId (defaulting to the open plugin).
+    case 'list_files':
+      return display('Listing plugin files', '', 'code', 'read')
+    case 'read_file':
+      return display('Reading file', pluginFileDetail(p), 'code', 'read')
+    case 'write_file':
+      return display('Writing file', pluginFileDetail(p), 'code', 'write')
+    case 'patch_file':
+      return display('Editing file', pluginPatchDetail(p), 'code', 'write')
+    case 'rename_file':
+      return display('Renaming file', pluginRenameDetail(p), 'edit', 'write')
+    case 'delete_file':
+      return display('Deleting file', pluginFileDetail(p), 'delete', 'danger')
+    case 'open_file':
+      return display('Opening file', pluginFileDetail(p), 'open', 'read')
+    case 'validate':
+      return display('Validating plugin', optionalString(p.localId), 'runtime', 'read')
+    case 'activate':
+      return display('Building & activating', optionalString(p.localId), 'runtime', 'write')
+    case 'list_plugins':
+      return display('Listing site plugins', '', 'collection', 'read')
+
     default:
       return display(`Running ${humanizeToolName(toolName)}`, '', 'tool', 'neutral')
   }
@@ -158,6 +181,40 @@ function display(title: string, detail: string, icon: ToolCallIcon, tone: ToolCa
   return { title, detail, icon, tone }
 }
 
+/**
+ * Code payload behind a tool row — powers the expandable CodeMirror block.
+ * `code` = full written content (write tools); `diff` = one entry per exact
+ * text replacement (patch tools), rendered as a unified diff.
+ */
+export type ToolCallCodePayload =
+  | { kind: 'code'; path: string; code: string }
+  | { kind: 'diff'; path: string; edits: Array<{ oldText: string; newText: string }> }
+
+export function extractCodePayload(
+  actionType: string,
+  params: unknown,
+): ToolCallCodePayload | null {
+  const toolName = normalizeToolName(actionType)
+  const p = asRecord(params)
+  if (toolName === 'write_file' || toolName === 'write_code_asset') {
+    const path = optionalString(p.path)
+    if (!path || typeof p.content !== 'string' || p.content.length === 0) return null
+    return { kind: 'code', path, code: p.content }
+  }
+  if (toolName === 'patch_file' || toolName === 'patch_code_asset') {
+    const path = optionalString(p.path) || optionalString(p.fileId)
+    if (!Array.isArray(p.replacements)) return null
+    const edits = p.replacements.flatMap((entry) => {
+      const replacement = asRecord(entry)
+      return typeof replacement.oldText === 'string' && typeof replacement.newText === 'string'
+        ? [{ oldText: replacement.oldText, newText: replacement.newText }]
+        : []
+    })
+    return edits.length > 0 ? { kind: 'diff', path, edits } : null
+  }
+  return null
+}
+
 export interface ColorSwatch {
   slug: string
   value: string
@@ -183,12 +240,12 @@ export function extractColorSwatches(actionType: string, params: unknown): Color
 }
 
 // Canonicalise a provider tool name to a stable snake_case key: drop the MCP
-// namespace and the `site_`/`content_` domain prefixes, then fold any camelCase
-// (historical names like `insertHtml`) down to snake_case.
+// namespace and the `site_`/`content_`/`plugin_` domain prefixes, then fold
+// any camelCase (historical names like `insertHtml`) down to snake_case.
 function normalizeToolName(actionType: string): string {
   return actionType
     .replace(/^mcp__instatic__/, '')
-    .replace(/^(site|content)_/, '')
+    .replace(/^(site|content|plugin)_/, '')
     .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
     .toLowerCase()
 }
@@ -269,6 +326,25 @@ function codeAssetDetail(params: Record<string, unknown>): string {
   return optionalString(params.path) || shortId(params.fileId)
 }
 
+function pluginFileDetail(params: Record<string, unknown>): string {
+  return optionalString(params.path) || shortId(params.fileId)
+}
+
+function pluginPatchDetail(params: Record<string, unknown>): string {
+  const file = pluginFileDetail(params)
+  const count = Array.isArray(params.replacements) ? params.replacements.length : 0
+  const edits = count > 1 ? `${count} edits` : ''
+  if (!file) return edits
+  return edits ? `${file} · ${edits}` : file
+}
+
+function pluginRenameDetail(params: Record<string, unknown>): string {
+  const from = pluginFileDetail(params)
+  const to = optionalString(params.newPath)
+  if (!from) return to
+  return to ? `${from} → ${to}` : from
+}
+
 function pageTitleDetail(params: Record<string, unknown>): string {
   return optionalString(params.title) || pageDetail(params.pageId)
 }
diff --git a/src/core/site-plugins/derive.ts b/src/core/site-plugins/derive.ts
index b0c295c50..39a6844f0 100644
--- a/src/core/site-plugins/derive.ts
+++ b/src/core/site-plugins/derive.ts
@@ -90,15 +90,34 @@ function parseDraftManifest(localId: string, raw: string): SitePluginDraftManife
   if (!result.ok) {
     // additionalProperties:false violations usually mean an author-set
     // derived field — name them so a copy-pasted manifest fails helpfully.
+    // Union failures get a shape-specific hint: "Expected union value" alone
+    // sends authors (and agents) guessing at field names.
     throw new Error(
-      `plugin.json for "${localId}" is invalid — ${result.error.message}. ` +
-        `Note: ${SITE_PLUGIN_DERIVED_FIELDS.join(', ')} are derived by the build and must not be set.`,
+      `plugin.json for "${localId}" is invalid — ${result.error.message}.` +
+        adminPageContentHint(result.error.message) +
+        ` Note: ${SITE_PLUGIN_DERIVED_FIELDS.join(', ')} are derived by the build and must not be set.`,
       { cause: result.error },
     )
   }
   return result.value
 }
 
+/**
+ * The adminPages content union is the manifest's most-guessed shape. When
+ * that exact path fails, spell out the allowed variants instead of leaving
+ * TypeBox's opaque "Expected union value".
+ */
+function adminPageContentHint(errorMessage: string): string {
+  if (!/\/adminPages\/\d+\/content/.test(errorMessage)) return ''
+  return (
+    ' adminPages[].content must be one of:' +
+    ' { "kind": "markdown", "body": "…", "heading"? },' +
+    ' { "kind": "resource", "heading": "…", "resource": "<resource-slug from resources[]>" },' +
+    ' { "kind": "map", "heading": "…", "pins"? },' +
+    ' { "kind": "app", "heading": "…", "entry": "<built frontend asset>" }.'
+  )
+}
+
 export function deriveSitePluginManifest(input: DeriveSitePluginManifestInput): PluginManifest {
   const draft = parseDraftManifest(input.localId, input.draftManifestJson)
 

From ad9e86cdedd2bdbc35c2e55704175ce7c78fde82 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 23:21:44 +0200
Subject: [PATCH 15/36] feat(plugins): one merged plugin list + always-visible
 agent code blocks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Plugins page simplification (user feedback):
- site plugins and installed plugins are ONE list — an activated site
  plugin is just an installed row with an 'Open IDE' action next to
  Disable; draft-only site plugins (no runtime row yet) join the same
  list as DraftSitePluginCard reusing the PluginCard chrome
- 'New site plugin' moves into the page header next to Upload Plugin;
  SitePluginsSection is gone (fetching extracted to useSitePlugins)

Agent code blocks:
- always visible — no View/Hide toggle; plain-text <pre> fallback while
  the CodeMirror chunk loads so rows don't jump
- font drops to the fluid --text-xs token (CSS module policy compliant)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/__tests__/plugins/pluginsAdmin.test.tsx   |   7 +-
 .../pages/plugins/PluginsPage.module.css      |   6 -
 src/admin/pages/plugins/PluginsPage.tsx       | 140 ++++++++++++------
 .../components/DraftSitePluginCard.tsx        |  71 +++++++++
 .../components/PluginCard/PluginCard.tsx      |  20 +++
 .../components/SitePluginsSection.module.css  | 113 --------------
 .../plugins/components/SitePluginsSection.tsx | 135 -----------------
 .../pages/plugins/hooks/useSitePlugins.ts     |  51 +++++++
 .../pages/site/code-editor/AgentCodeView.tsx  |   3 +
 .../panels/AgentPanel/AgentPanel.module.css   |  12 ++
 .../site/panels/AgentPanel/ToolCallRow.tsx    |  80 +++++-----
 11 files changed, 301 insertions(+), 337 deletions(-)
 create mode 100644 src/admin/pages/plugins/components/DraftSitePluginCard.tsx
 delete mode 100644 src/admin/pages/plugins/components/SitePluginsSection.module.css
 delete mode 100644 src/admin/pages/plugins/components/SitePluginsSection.tsx
 create mode 100644 src/admin/pages/plugins/hooks/useSitePlugins.ts

diff --git a/src/__tests__/plugins/pluginsAdmin.test.tsx b/src/__tests__/plugins/pluginsAdmin.test.tsx
index e38ad9933..95dff379a 100644
--- a/src/__tests__/plugins/pluginsAdmin.test.tsx
+++ b/src/__tests__/plugins/pluginsAdmin.test.tsx
@@ -95,6 +95,9 @@ function ambientFetchFallback(url: string): Response | undefined {
   if (url.endsWith('/admin/api/cms/site')) {
     return json({ site: null }, 404)
   }
+  if (url.endsWith('/admin/api/cms/site-plugins')) {
+    return json({ sitePlugins: [] })
+  }
   if (url.endsWith('/admin/api/cms/site/publish-status')) {
     return json({ ok: false }, 404)
   }
@@ -234,7 +237,7 @@ describe('PluginsPage', () => {
       </Wrapper>,
     )
 
-    expect(await screen.findByText('No plugins installed yet.')).toBeDefined()
+    expect(await screen.findByText('No plugins yet — upload one, or create a site plugin in the IDE.')).toBeDefined()
 
     const input = screen.getByLabelText('Plugin file')
     fireEvent.change(input, {
@@ -293,7 +296,7 @@ describe('PluginsPage', () => {
       </Wrapper>,
     )
 
-    expect(await screen.findByText('No plugins installed yet.')).toBeDefined()
+    expect(await screen.findByText('No plugins yet — upload one, or create a site plugin in the IDE.')).toBeDefined()
 
     fireEvent.change(screen.getByLabelText('Plugin file'), {
       target: {
diff --git a/src/admin/pages/plugins/PluginsPage.module.css b/src/admin/pages/plugins/PluginsPage.module.css
index 0aa03e412..1eabfb111 100644
--- a/src/admin/pages/plugins/PluginsPage.module.css
+++ b/src/admin/pages/plugins/PluginsPage.module.css
@@ -259,9 +259,3 @@
     }
 }
 
-.groupTitle {
-  margin: var(--space-l) 0 0;
-  font-size: var(--text-l);
-  font-weight: 600;
-  color: var(--text);
-}
diff --git a/src/admin/pages/plugins/PluginsPage.tsx b/src/admin/pages/plugins/PluginsPage.tsx
index 136348a71..507f62cd8 100644
--- a/src/admin/pages/plugins/PluginsPage.tsx
+++ b/src/admin/pages/plugins/PluginsPage.tsx
@@ -1,13 +1,18 @@
+import { useState } from 'react'
 import { Button } from '@ui/components/Button'
 import { UploadIcon } from 'pixel-art-icons/icons/upload'
+import { CodeIcon } from 'pixel-art-icons/icons/code'
 import { AdminPageLayout } from '@admin/layouts/AdminPageLayout'
+import { useNavigate } from '@admin/lib/routing'
 import { PluginCard } from './components/PluginCard/PluginCard'
+import { DraftSitePluginCard } from './components/DraftSitePluginCard'
+import { NewSitePluginDialog } from './components/NewSitePluginDialog'
 import { PluginRemoveDialog } from './components/PluginRemoveDialog/PluginRemoveDialog'
 import { PermissionReviewSection } from './components/PermissionReviewSection'
 import { PluginSettingsDialog } from './components/PluginSettingsDialog/PluginSettingsDialog'
 import { PluginSchedulesDialog } from './components/PluginSchedulesDialog/PluginSchedulesDialog'
-import { SitePluginsSection } from './components/SitePluginsSection'
 import { isSandboxRelatedError, usePluginsWorkspace } from './hooks/usePluginsWorkspace'
+import { useSitePlugins } from './hooks/useSitePlugins'
 import { notifyCmsPluginsChanged } from './utils/pluginEvents'
 import { useAuthenticatedAdminUser } from '@admin/sessionContext'
 import {
@@ -26,6 +31,7 @@ const SKELETON_CARD_COUNT = 3
 
 export function PluginsPage() {
   const currentUser = useAuthenticatedAdminUser()
+  const navigate = useNavigate()
   const canConfigure = canConfigurePlugins(currentUser)
   const canInstall = canInstallPlugins(currentUser)
   const canManageLifecycle = canManagePluginLifecycle(currentUser)
@@ -46,31 +52,59 @@ export function PluginsPage() {
     removeFailure,
   } = vm
 
+  const { sitePlugins } = useSitePlugins()
+  const [newPluginOpen, setNewPluginOpen] = useState(false)
+  const openIde = (localId: string) => navigate(`/admin/plugins/develop/${localId}`)
+
+  // ONE list: installed plugins (any provenance) plus site plugins that only
+  // exist as draft source — an activated site plugin is already an installed
+  // row, so drafts are the only entries the installed payload can't show.
+  const installedIds = new Set(payload.plugins.map((plugin) => plugin.id))
+  const draftOnlySitePlugins = (sitePlugins ?? []).filter(
+    (plugin) => !installedIds.has(plugin.pluginId),
+  )
+  const listEmpty = !loading && payload.plugins.length === 0 && draftOnlySitePlugins.length === 0
+
   return (
     <AdminPageLayout
       workspace="plugins"
       title="Plugins"
       titleId="plugins-title"
       description="Install admin extensions and control what they add to the CMS."
-      actions={canInstall ? (
+      actions={canInstall || canCreateSitePlugins ? (
         <>
-          <Button
-            variant="primary"
-            size="md"
-            disabled={uploading}
-            onClick={() => fileInputRef.current?.click()}
-          >
-            <UploadIcon size={15} aria-hidden="true" />
-            <span>{uploading ? 'Uploading' : 'Upload Plugin'}</span>
-          </Button>
-          <input
-            ref={fileInputRef}
-            className={styles.fileInput}
-            aria-label="Plugin file"
-            type="file"
-            accept="application/json,.json,.plugin.json,.pbplugin,.zip,application/zip"
-            onChange={(event) => void vm.handleUpload(event)}
-          />
+          {canCreateSitePlugins && (
+            <Button
+              variant="secondary"
+              size="md"
+              onClick={() => setNewPluginOpen(true)}
+              data-testid="new-site-plugin"
+            >
+              <CodeIcon size={15} aria-hidden="true" />
+              <span>New site plugin</span>
+            </Button>
+          )}
+          {canInstall && (
+            <>
+              <Button
+                variant="primary"
+                size="md"
+                disabled={uploading}
+                onClick={() => fileInputRef.current?.click()}
+              >
+                <UploadIcon size={15} aria-hidden="true" />
+                <span>{uploading ? 'Uploading' : 'Upload Plugin'}</span>
+              </Button>
+              <input
+                ref={fileInputRef}
+                className={styles.fileInput}
+                aria-label="Plugin file"
+                type="file"
+                accept="application/json,.json,.plugin.json,.pbplugin,.zip,application/zip"
+                onChange={(event) => void vm.handleUpload(event)}
+              />
+            </>
+          )}
         </>
       ) : null}
     >
@@ -133,12 +167,9 @@ export function PluginsPage() {
           />
         )}
 
-        <SitePluginsSection canCreate={canCreateSitePlugins} />
-
-        <h2 className={styles.groupTitle}>Installed</h2>
         <div
           className={styles.pluginsList}
-          aria-label="Installed plugins"
+          aria-label="Plugins"
           aria-busy={loading || undefined}
         >
           {loading ? (
@@ -149,30 +180,53 @@ export function PluginsPage() {
             Array.from({ length: SKELETON_CARD_COUNT }, (_, i) => (
               <PluginCard key={i} loading />
             ))
-          ) : payload.plugins.length === 0 ? (
-            <p className={styles.emptyState}>No plugins installed yet.</p>
+          ) : listEmpty ? (
+            <p className={styles.emptyState}>
+              No plugins yet — upload one, or create a site plugin in the IDE.
+            </p>
           ) : (
-            payload.plugins.map((plugin) => (
-              <PluginCard
-                key={plugin.id}
-                plugin={plugin}
-                busy={busyPluginId === plugin.id}
-                editorActivationError={editorActivationErrors[plugin.id]}
-                canConfigure={canConfigure}
-                canInstall={canInstall}
-                canManageLifecycle={canManageLifecycle}
-                onOpenSettings={(p) => vm.setSettingsPluginId(p.id)}
-                onOpenSchedules={(p) => vm.setSchedulesPluginId(p.id)}
-                onInstallPack={(p) => void vm.installPluginPack(p)}
-                onRestart={(p) => void vm.restartPlugin(p)}
-                onReinstall={() => fileInputRef.current?.click()}
-                onToggle={(p) => void vm.togglePlugin(p)}
-                onRemove={(p) => vm.setPendingRemove({ plugin: p, force: false })}
-              />
-            ))
+            <>
+              {payload.plugins.map((plugin) => (
+                <PluginCard
+                  key={plugin.id}
+                  plugin={plugin}
+                  busy={busyPluginId === plugin.id}
+                  editorActivationError={editorActivationErrors[plugin.id]}
+                  canConfigure={canConfigure}
+                  canInstall={canInstall}
+                  canManageLifecycle={canManageLifecycle}
+                  onOpenSettings={(p) => vm.setSettingsPluginId(p.id)}
+                  onOpenSchedules={(p) => vm.setSchedulesPluginId(p.id)}
+                  onInstallPack={(p) => void vm.installPluginPack(p)}
+                  onRestart={(p) => void vm.restartPlugin(p)}
+                  onReinstall={() => fileInputRef.current?.click()}
+                  onToggle={(p) => void vm.togglePlugin(p)}
+                  onRemove={(p) => vm.setPendingRemove({ plugin: p, force: false })}
+                  onOpenIde={(p) => openIde(p.id.replace(/^site\./, ''))}
+                />
+              ))}
+              {draftOnlySitePlugins.map((plugin) => (
+                <DraftSitePluginCard
+                  key={plugin.pluginId}
+                  plugin={plugin}
+                  onOpenIde={openIde}
+                />
+              ))}
+            </>
           )}
         </div>
 
+        {newPluginOpen && (
+          <NewSitePluginDialog
+            existingLocalIds={(sitePlugins ?? []).map((plugin) => plugin.localId)}
+            onClose={() => setNewPluginOpen(false)}
+            onCreated={(localId) => {
+              setNewPluginOpen(false)
+              openIde(localId)
+            }}
+          />
+        )}
+
         {settingsPluginId && (
           <PluginSettingsDialog
             pluginId={settingsPluginId}
diff --git a/src/admin/pages/plugins/components/DraftSitePluginCard.tsx b/src/admin/pages/plugins/components/DraftSitePluginCard.tsx
new file mode 100644
index 000000000..a1fb10d9a
--- /dev/null
+++ b/src/admin/pages/plugins/components/DraftSitePluginCard.tsx
@@ -0,0 +1,71 @@
+/**
+ * DraftSitePluginCard — a site plugin that exists ONLY as draft source (no
+ * runtime row yet: never activated, or its first build failed). Rendered in
+ * the SAME list as installed plugins, reusing PluginCard's chrome so the
+ * page reads as one consistent surface; the only action a draft can offer
+ * is opening the IDE. Once activated, the plugin becomes an ordinary
+ * installed row and this card disappears.
+ */
+import { Button } from '@ui/components/Button'
+import { CodeIcon } from 'pixel-art-icons/icons/code'
+import {
+  sitePluginStateLabel,
+  type SitePluginSummary,
+} from '@core/site-plugins'
+import styles from './PluginCard/PluginCard.module.css'
+
+/** Map site-plugin states onto PluginCard's status-pill palette. */
+function pillStatus(state: SitePluginSummary['state']): string {
+  switch (state) {
+    case 'active':
+      return 'active'
+    case 'build-failed':
+    case 'runtime-error':
+    case 'source-missing':
+      return 'error'
+    default:
+      return 'installed'
+  }
+}
+
+interface DraftSitePluginCardProps {
+  plugin: SitePluginSummary
+  onOpenIde: (localId: string) => void
+}
+
+export function DraftSitePluginCard({ plugin, onOpenIde }: DraftSitePluginCardProps) {
+  return (
+    <article className={styles.pluginCard} data-testid={`site-plugin-card-${plugin.localId}`}>
+      <header className={styles.pluginHeader}>
+        <div className={styles.pluginHeaderInfo}>
+          <div className={styles.pluginHeaderTitle}>
+            <h2>{plugin.name}</h2>
+            <span className={styles.pluginVersionPill} aria-label="Draft plugin">
+              draft
+            </span>
+            <span className={styles.pluginStatusPill} data-status={pillStatus(plugin.state)}>
+              {sitePluginStateLabel(plugin.state)}
+            </span>
+          </div>
+        </div>
+        <div className={styles.pluginActions}>
+          <Button
+            variant="secondary"
+            size="sm"
+            onClick={() => onOpenIde(plugin.localId)}
+            aria-label={`Open ${plugin.name} in the Plugin IDE`}
+            data-testid={`open-ide-${plugin.localId}`}
+          >
+            <CodeIcon size={14} aria-hidden="true" />
+            <span>Open IDE</span>
+          </Button>
+        </div>
+      </header>
+      <div className={styles.pluginBody}>
+        <p className={styles.pluginDescription}>
+          {plugin.manifestError ?? `${plugin.pluginId} — authored in this site's draft, not activated yet.`}
+        </p>
+      </div>
+    </article>
+  )
+}
diff --git a/src/admin/pages/plugins/components/PluginCard/PluginCard.tsx b/src/admin/pages/plugins/components/PluginCard/PluginCard.tsx
index 5983c0630..cb41f4606 100644
--- a/src/admin/pages/plugins/components/PluginCard/PluginCard.tsx
+++ b/src/admin/pages/plugins/components/PluginCard/PluginCard.tsx
@@ -18,6 +18,7 @@ import { PowerOffIcon } from 'pixel-art-icons/icons/power-off'
 import { ReloadIcon } from 'pixel-art-icons/icons/reload'
 import { TrashSolidIcon } from 'pixel-art-icons/icons/trash-solid'
 import { UploadIcon } from 'pixel-art-icons/icons/upload'
+import { CodeIcon } from 'pixel-art-icons/icons/code'
 import type { InstalledPlugin } from '@core/plugin-sdk'
 import { safeUrl } from '@core/plugin-sdk'
 import styles from './PluginCard.module.css'
@@ -60,6 +61,7 @@ interface PluginCardLoadingProps {
   onReinstall?: never
   onToggle?: never
   onRemove?: never
+  onOpenIde?: never
   canConfigure?: never
   canInstall?: never
   canManageLifecycle?: never
@@ -90,6 +92,11 @@ interface PluginCardDataProps {
   onReinstall: () => void
   onToggle: (plugin: InstalledPlugin) => void
   onRemove: (plugin: InstalledPlugin) => void
+  /**
+   * Opens the Plugin IDE for a `source: 'site-local'` plugin. Rendered
+   * next to Enable/Disable only when the plugin is site-authored.
+   */
+  onOpenIde?: (plugin: InstalledPlugin) => void
 }
 
 type PluginCardProps = PluginCardLoadingProps | PluginCardDataProps
@@ -141,6 +148,7 @@ export function PluginCard(props: PluginCardProps) {
     onReinstall,
     onToggle,
     onRemove,
+    onOpenIde,
   } = props
   const status = pluginStatus(plugin)
   const iconSrc =
@@ -248,6 +256,18 @@ export function PluginCard(props: PluginCardProps) {
               <span>Restart</span>
             </Button>
           )}
+          {onOpenIde && plugin.source === 'site-local' && (
+            <Button
+              variant="secondary"
+              size="sm"
+              disabled={busy}
+              onClick={() => onOpenIde(plugin)}
+              aria-label={`Open ${plugin.name} in the Plugin IDE`}
+            >
+              <CodeIcon size={14} aria-hidden="true" />
+              <span>Open IDE</span>
+            </Button>
+          )}
           {canManageLifecycle && status.status !== 'error' && (
             <Button
               variant="secondary"
diff --git a/src/admin/pages/plugins/components/SitePluginsSection.module.css b/src/admin/pages/plugins/components/SitePluginsSection.module.css
deleted file mode 100644
index be565eeb9..000000000
--- a/src/admin/pages/plugins/components/SitePluginsSection.module.css
+++ /dev/null
@@ -1,113 +0,0 @@
-.section {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-m);
-}
-
-.header {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: var(--space-m);
-}
-
-.title {
-  margin: 0;
-  font-size: var(--text-l);
-  font-weight: 600;
-  color: var(--text);
-}
-
-.subtitle {
-  margin: var(--space-3xs) 0 0;
-  font-size: var(--text-s);
-  line-height: 1.5;
-  color: var(--text-subtle);
-  max-width: 52ch;
-}
-
-.empty {
-  margin: 0;
-  padding: var(--space-l);
-  border-radius: var(--radius);
-  background: var(--bg-surface-2);
-  font-size: var(--text-s);
-  color: var(--text-subtle);
-}
-
-.list {
-  margin: 0;
-  padding: 0;
-  list-style: none;
-  display: grid;
-  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
-  gap: var(--space-s);
-}
-
-.card {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: var(--space-s);
-  padding: var(--space-m);
-  border-radius: 16px;
-  background: var(--bg-surface-2);
-}
-
-.cardBody {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-3xs);
-  min-width: 0;
-}
-
-.cardName {
-  font-size: var(--text-m);
-  font-weight: 600;
-  color: var(--text);
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.cardId {
-  font-family: var(--font-mono);
-  font-size: var(--text-2xs);
-  color: var(--text-subtle);
-}
-
-.cardMeta {
-  display: flex;
-  align-items: center;
-  gap: var(--space-xs);
-}
-
-.stateChip {
-  padding: var(--space-px) var(--space-xs);
-  border-radius: var(--radius-sm);
-  font-size: var(--text-2xs);
-  font-weight: 600;
-  white-space: nowrap;
-  color: var(--text-subtle);
-  background: var(--bg-surface-3);
-}
-
-.stateChip[data-state='active'] {
-  color: var(--success-text);
-}
-
-.stateChip[data-state='build-failed'],
-.stateChip[data-state='runtime-error'],
-.stateChip[data-state='source-missing'] {
-  color: var(--danger);
-}
-
-.stateChip[data-state='permission-review'] {
-  color: var(--warning);
-}
-
-.cardVersion {
-  font-family: var(--font-mono);
-  font-size: var(--text-2xs);
-  color: var(--text-disabled);
-}
diff --git a/src/admin/pages/plugins/components/SitePluginsSection.tsx b/src/admin/pages/plugins/components/SitePluginsSection.tsx
deleted file mode 100644
index c715bf7f5..000000000
--- a/src/admin/pages/plugins/components/SitePluginsSection.tsx
+++ /dev/null
@@ -1,135 +0,0 @@
-/**
- * SitePluginsSection — the "Site plugins" group on the Plugins page.
- *
- * Lists plugins authored in this site's draft (union of draft folders and
- * site-local runtime rows — a deleted folder never hides a still-running
- * backend). Each card shows the runtime state chip and opens the full
- * Plugin IDE; `New site plugin` scaffolds from a template.
- */
-import { useCallback, useEffect, useState } from 'react'
-import { apiRequest } from '@core/http'
-import { getErrorMessage } from '@core/utils/errorMessage'
-import {
-  SitePluginsPayloadSchema,
-  sitePluginStateLabel,
-  type SitePluginSummary,
-} from '@core/site-plugins'
-import { Button } from '@ui/components/Button'
-import { pushToast } from '@ui/components/Toast'
-import { useNavigate } from '@admin/lib/routing'
-import { CodeIcon } from 'pixel-art-icons/icons/code'
-import { NewSitePluginDialog } from './NewSitePluginDialog'
-import styles from './SitePluginsSection.module.css'
-
-interface SitePluginsSectionProps {
-  canCreate: boolean
-}
-
-export function SitePluginsSection({ canCreate }: SitePluginsSectionProps) {
-  const navigate = useNavigate()
-  const [sitePlugins, setSitePlugins] = useState<SitePluginSummary[] | null>(null)
-  const [dialogOpen, setDialogOpen] = useState(false)
-
-  // useCallback kept: stable identity for the load-on-mount effect's dep array.
-  const load = useCallback(async (): Promise<void> => {
-    try {
-      const payload = await apiRequest('/admin/api/cms/site-plugins', {
-        schema: SitePluginsPayloadSchema,
-      })
-      setSitePlugins(payload.sitePlugins)
-    } catch (err) {
-      console.error('[SitePluginsSection] load failed:', err)
-      pushToast({
-        kind: 'error',
-        title: 'Could not load site plugins',
-        body: getErrorMessage(err, 'Unknown error'),
-      })
-      setSitePlugins([])
-    }
-  }, [])
-
-  useEffect(() => {
-    const timer = setTimeout(() => {
-      void load()
-    }, 0)
-    return () => clearTimeout(timer)
-  }, [load])
-
-  return (
-    <section className={styles.section} aria-labelledby="site-plugins-title">
-      <header className={styles.header}>
-        <div>
-          <h2 id="site-plugins-title" className={styles.title}>
-            Site plugins
-          </h2>
-          <p className={styles.subtitle}>
-            Built from this site’s draft in the Plugin IDE — same sandbox,
-            permissions, and lifecycle as installed plugins.
-          </p>
-        </div>
-        <Button
-          variant="secondary"
-          size="md"
-          disabled={!canCreate}
-          tooltip={canCreate ? undefined : 'Requires the “Author site plugins” permission'}
-          onClick={() => setDialogOpen(true)}
-          data-testid="new-site-plugin"
-        >
-          <CodeIcon size={15} aria-hidden="true" />
-          <span>New site plugin</span>
-        </Button>
-      </header>
-
-      {sitePlugins === null ? (
-        <p className={styles.empty}>Loading site plugins…</p>
-      ) : sitePlugins.length === 0 ? (
-        <p className={styles.empty}>
-          No site plugins yet. Create one to add backend routes, canvas
-          modules, or editor commands from this site’s own code.
-        </p>
-      ) : (
-        <ul className={styles.list} aria-label="Site plugins">
-          {sitePlugins.map((plugin) => (
-            <li
-              key={plugin.localId}
-              className={styles.card}
-              data-testid={`site-plugin-card-${plugin.localId}`}
-            >
-              <div className={styles.cardBody}>
-                <span className={styles.cardName}>{plugin.name}</span>
-                <span className={styles.cardId}>{plugin.pluginId}</span>
-                <span className={styles.cardMeta}>
-                  <span className={styles.stateChip} data-state={plugin.state}>
-                    {sitePluginStateLabel(plugin.state)}
-                  </span>
-                  <span className={styles.cardVersion}>
-                    {plugin.activeVersion ?? 'not built yet'}
-                  </span>
-                </span>
-              </div>
-              <Button
-                variant="secondary"
-                size="sm"
-                onClick={() => navigate(`/admin/plugins/develop/${plugin.localId}`)}
-                data-testid={`open-ide-${plugin.localId}`}
-              >
-                Open IDE
-              </Button>
-            </li>
-          ))}
-        </ul>
-      )}
-
-      {dialogOpen && (
-        <NewSitePluginDialog
-          existingLocalIds={(sitePlugins ?? []).map((plugin) => plugin.localId)}
-          onClose={() => setDialogOpen(false)}
-          onCreated={(localId) => {
-            setDialogOpen(false)
-            navigate(`/admin/plugins/develop/${localId}`)
-          }}
-        />
-      )}
-    </section>
-  )
-}
diff --git a/src/admin/pages/plugins/hooks/useSitePlugins.ts b/src/admin/pages/plugins/hooks/useSitePlugins.ts
new file mode 100644
index 000000000..8ea0213ae
--- /dev/null
+++ b/src/admin/pages/plugins/hooks/useSitePlugins.ts
@@ -0,0 +1,51 @@
+/**
+ * Site-plugin summaries for the Plugins page — the union of draft folders
+ * and site-local runtime rows with computed states. Used to merge
+ * draft-only plugins (no runtime row yet) into the single plugin list and
+ * to feed the scaffold dialog's taken-id check.
+ */
+import { useCallback, useEffect, useState } from 'react'
+import { apiRequest } from '@core/http'
+import { getErrorMessage } from '@core/utils/errorMessage'
+import {
+  SitePluginsPayloadSchema,
+  type SitePluginSummary,
+} from '@core/site-plugins'
+import { pushToast } from '@ui/components/Toast'
+
+export interface UseSitePluginsResult {
+  /** Null while the first load is in flight. */
+  sitePlugins: SitePluginSummary[] | null
+  reload: () => Promise<void>
+}
+
+export function useSitePlugins(): UseSitePluginsResult {
+  const [sitePlugins, setSitePlugins] = useState<SitePluginSummary[] | null>(null)
+
+  // useCallback kept: stable identity for the load-on-mount effect's dep array.
+  const reload = useCallback(async (): Promise<void> => {
+    try {
+      const payload = await apiRequest('/admin/api/cms/site-plugins', {
+        schema: SitePluginsPayloadSchema,
+      })
+      setSitePlugins(payload.sitePlugins)
+    } catch (err) {
+      console.error('[useSitePlugins] load failed:', err)
+      pushToast({
+        kind: 'error',
+        title: 'Could not load site plugins',
+        body: getErrorMessage(err, 'Unknown error'),
+      })
+      setSitePlugins([])
+    }
+  }, [])
+
+  useEffect(() => {
+    const timer = setTimeout(() => {
+      void reload()
+    }, 0)
+    return () => clearTimeout(timer)
+  }, [reload])
+
+  return { sitePlugins, reload }
+}
diff --git a/src/admin/pages/site/code-editor/AgentCodeView.tsx b/src/admin/pages/site/code-editor/AgentCodeView.tsx
index 35af58e44..fa68965d4 100644
--- a/src/admin/pages/site/code-editor/AgentCodeView.tsx
+++ b/src/admin/pages/site/code-editor/AgentCodeView.tsx
@@ -69,6 +69,9 @@ export default function AgentCodeView({ code, path, diffOriginal }: AgentCodeVie
       state: EditorState.create({
         doc: code,
         extensions: [
+          // Chat rows are denser than the editor — drop the base 12px to
+          // the fluid --text-xs token (~10-11px).
+          EditorView.theme({ '&': { fontSize: 'var(--text-xs)' } }),
           EditorState.readOnly.of(true),
           EditorView.editable.of(false),
           EditorView.lineWrapping,
diff --git a/src/admin/pages/site/panels/AgentPanel/AgentPanel.module.css b/src/admin/pages/site/panels/AgentPanel/AgentPanel.module.css
index 2fb2ed54f..43afc5042 100644
--- a/src/admin/pages/site/panels/AgentPanel/AgentPanel.module.css
+++ b/src/admin/pages/site/panels/AgentPanel/AgentPanel.module.css
@@ -495,6 +495,18 @@
   height: auto;
 }
 
+/* Plain-text stand-in while the CodeMirror chunk loads. */
+.toolCallCodeFallback {
+  margin: 0;
+  padding: var(--space-s);
+  font-family: var(--font-mono);
+  font-size: var(--text-xs);
+  line-height: 1.5;
+  color: var(--text);
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+
 .toolCallStatus {
   display: inline-flex;
   align-items: center;
diff --git a/src/admin/pages/site/panels/AgentPanel/ToolCallRow.tsx b/src/admin/pages/site/panels/AgentPanel/ToolCallRow.tsx
index daf0e410b..74d611a23 100644
--- a/src/admin/pages/site/panels/AgentPanel/ToolCallRow.tsx
+++ b/src/admin/pages/site/panels/AgentPanel/ToolCallRow.tsx
@@ -4,14 +4,13 @@
  * swatches and an inline error message. Captured images are grouped by the
  * parent turn so they share the conversation gallery and preview window.
  *
- * Write/patch tools additionally expose their code payload behind a
- * "View code / changes" toggle — a lazy CodeMirror block (unified diff for
- * patches) so the user can see exactly what the agent wrote.
+ * Write/patch tools additionally render their code payload inline — a lazy
+ * CodeMirror block (unified diff for patches) so the user always sees
+ * exactly what the agent wrote.
  */
-import { lazy, Suspense, useState, type CSSProperties } from 'react'
+import { lazy, Suspense, type CSSProperties } from 'react'
 import type { AgentToolCall } from '@site/agent'
 import { cn } from '@ui/cn'
-import { Button } from '@ui/components/Button'
 import { Tooltip } from '@ui/components/Tooltip'
 import { LoaderIcon } from 'pixel-art-icons/icons/loader'
 import { CheckIcon } from 'pixel-art-icons/icons/check'
@@ -39,17 +38,18 @@ import {
   getToolCallDisplay,
   extractColorSwatches,
   extractCodePayload,
+  type ToolCallCodePayload,
   type ToolCallIcon,
   type ToolCallTone,
 } from './toolCallDisplay'
 import styles from './AgentPanel.module.css'
 
-// CodeMirror is ~150 kB min+gz — the code/diff block loads on first expand
-// only (same policy as the site code editor).
+// CodeMirror is ~150 kB min+gz — the chunk loads when the first code-bearing
+// tool row renders (same lazy policy as the site code editor); the plain-text
+// fallback shows the same content meanwhile.
 const AgentCodeView = lazy(() => import('@site/code-editor/AgentCodeView'))
 
 export function ToolCallRow({ toolCall }: { toolCall: AgentToolCall }) {
-  const [codeOpen, setCodeOpen] = useState(false)
   const isPending = toolCall.status === 'pending'
   const isSuccess = toolCall.status === 'success'
   const isError = toolCall.status === 'error'
@@ -109,43 +109,47 @@ export function ToolCallRow({ toolCall }: { toolCall: AgentToolCall }) {
       )}
       {codePayload && (
         <div className={styles.toolCallCode}>
-          <Button
-            variant="ghost"
-            size="xs"
-            onClick={() => setCodeOpen((open) => !open)}
-            aria-expanded={codeOpen}
-          >
-            {codeOpen
-              ? codePayload.kind === 'diff' ? 'Hide changes' : 'Hide code'
-              : codePayload.kind === 'diff' ? 'View changes' : 'View code'}
-          </Button>
-          {codeOpen && (
-            <Suspense fallback={null}>
-              {codePayload.kind === 'code' ? (
-                <div className={styles.toolCallCodeBlock}>
-                  <AgentCodeView code={codePayload.code} path={codePayload.path} />
+          <Suspense fallback={<CodeBlockFallback payload={codePayload} />}>
+            {codePayload.kind === 'code' ? (
+              <div className={styles.toolCallCodeBlock}>
+                <AgentCodeView code={codePayload.code} path={codePayload.path} />
+              </div>
+            ) : (
+              codePayload.edits.map((edit, index) => (
+                // Edits are positional within one immutable tool call, so
+                // the index is a stable key.
+                <div key={index} className={styles.toolCallCodeBlock}>
+                  <AgentCodeView
+                    code={edit.newText}
+                    diffOriginal={edit.oldText}
+                    path={codePayload.path}
+                  />
                 </div>
-              ) : (
-                codePayload.edits.map((edit, index) => (
-                  // Edits are positional within one immutable tool call, so
-                  // the index is a stable key.
-                  <div key={index} className={styles.toolCallCodeBlock}>
-                    <AgentCodeView
-                      code={edit.newText}
-                      diffOriginal={edit.oldText}
-                      path={codePayload.path}
-                    />
-                  </div>
-                ))
-              )}
-            </Suspense>
-          )}
+              ))
+            )}
+          </Suspense>
         </div>
       )}
     </>
   )
 }
 
+// Plain-text stand-in while the CodeMirror chunk loads — same box, same
+// content, no highlight. Keeps the row from jumping when the viewer lands.
+function CodeBlockFallback({ payload }: { payload: ToolCallCodePayload }) {
+  const texts = payload.kind === 'code' ? [payload.code] : payload.edits.map((edit) => edit.newText)
+  return (
+    <>
+      {texts.map((text, index) => (
+        // Positional content within one immutable tool call.
+        <pre key={index} className={cn(styles.toolCallCodeBlock, styles.toolCallCodeFallback)}>
+          {text}
+        </pre>
+      ))}
+    </>
+  )
+}
+
 // Per-tool category icon — signals what kind of action ran at a glance.
 function ToolCallLeadingIcon({ icon }: { icon: ToolCallIcon }) {
   switch (icon) {

From cd799f4defad1c727f64f6cc4c8d120bc2b3c97a Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 23:24:35 +0200
Subject: [PATCH 16/36] =?UTF-8?q?refactor(code-editor):=20extract=20codeMi?=
 =?UTF-8?q?rrorShared=20=E2=80=94=20theme=20+=20language=20stacks?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The theme/highlight/language exports added to CodeMirrorEditor.tsx broke
react-refresh (component files must export only components). They move to
a non-component module consumed by all three viewers; the lazy-only gate
lists it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../architecture/codemirror-lazy-only.test.ts |   3 +
 .../pages/site/code-editor/AgentCodeView.tsx  |   2 +-
 .../site/code-editor/CodeMirrorEditor.tsx     | 279 +----------------
 .../site/code-editor/codeMirrorShared.ts      | 285 ++++++++++++++++++
 4 files changed, 298 insertions(+), 271 deletions(-)
 create mode 100644 src/admin/pages/site/code-editor/codeMirrorShared.ts

diff --git a/src/__tests__/architecture/codemirror-lazy-only.test.ts b/src/__tests__/architecture/codemirror-lazy-only.test.ts
index 140853975..27be8e5cb 100644
--- a/src/__tests__/architecture/codemirror-lazy-only.test.ts
+++ b/src/__tests__/architecture/codemirror-lazy-only.test.ts
@@ -84,6 +84,9 @@ const ALLOWED_CONSUMERS = new Set([
   // Read-only agent code/diff blocks — lazy-loaded by ToolCallRow, same
   // chunk graph as the code editor.
   'admin/pages/site/code-editor/AgentCodeView.tsx',
+  // Theme + language stacks shared by the three viewers above (non-component
+  // module so the component files keep react-refresh eligibility).
+  'admin/pages/site/code-editor/codeMirrorShared.ts',
 ])
 
 // Matches: import ... from 'codemirror' / '@codemirror/...' / '@lezer/...'
diff --git a/src/admin/pages/site/code-editor/AgentCodeView.tsx b/src/admin/pages/site/code-editor/AgentCodeView.tsx
index fa68965d4..b5c6cbbac 100644
--- a/src/admin/pages/site/code-editor/AgentCodeView.tsx
+++ b/src/admin/pages/site/code-editor/AgentCodeView.tsx
@@ -22,7 +22,7 @@ import {
   getLanguageExtensions,
   readableHighlightStyle,
   type CodeLanguage,
-} from './CodeMirrorEditor'
+} from './codeMirrorShared'
 
 /** Map a file path to the highlight language by extension. */
 function codeLanguageForPath(path: string): CodeLanguage {
diff --git a/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx b/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
index 5889b0d70..fc1d2b4c9 100644
--- a/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
+++ b/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
@@ -31,19 +31,13 @@
 import { useRef, useEffect, useEffectEvent, useCallback } from 'react'
 import { EditorView, basicSetup } from 'codemirror'
 import { EditorState } from '@codemirror/state'
-import { HighlightStyle, syntaxHighlighting } from '@codemirror/language'
+import { syntaxHighlighting } from '@codemirror/language'
 import {
   autocompletion,
   type CompletionContext,
   type CompletionResult,
 } from '@codemirror/autocomplete'
 import { hoverTooltip, tooltips, type Tooltip } from '@codemirror/view'
-import { javascript } from '@codemirror/lang-javascript'
-import { css } from '@codemirror/lang-css'
-import { json } from '@codemirror/lang-json'
-import { markdown } from '@codemirror/lang-markdown'
-import { html } from '@codemirror/lang-html'
-import { tags as t } from '@lezer/highlight'
 import type { Extension } from '@codemirror/state'
 import { lintGutter, setDiagnostics, type Diagnostic } from '@codemirror/lint'
 import type { SiteRuntimeDiagnostic } from '@core/site-runtime'
@@ -56,227 +50,15 @@ import type {
   TypeScriptProjectFile,
 } from './typescriptProtocol'
 import { renderMarkdownDocumentation } from './markdownDocumentation'
+import {
+  editorChromeTheme,
+  getLanguageExtensions,
+  readableHighlightStyle,
+  type CodeLanguage,
+} from './codeMirrorShared'
+
+export type { CodeLanguage } from './codeMirrorShared'
 
-// ---------------------------------------------------------------------------
-// GitHub Dark-inspired CM6 theme — CSS custom properties only.
-// ---------------------------------------------------------------------------
-// All color values are CSS custom properties from globals.css.
-// No hex, rgb(), or hsl() literals in this lazy-loaded editor module.
-export const editorChromeTheme = EditorView.theme({
-  '&': {
-    backgroundColor: 'var(--bg-surface)',
-    color: 'var(--text)',
-    height: '100%',
-    fontSize: '12px',
-    fontFamily: 'var(--font-mono)',
-  },
-  '&.cm-focused': {
-    outline: 'none',
-  },
-  '.cm-content': {
-    caretColor: 'var(--overlay)',
-    padding: 'var(--space-s) 0',
-  },
-  '.cm-cursor': {
-    borderLeftColor: 'var(--overlay)',
-  },
-  '.cm-selectionBackground': {
-    backgroundColor: 'var(--overlay-10)',
-  },
-  '&.cm-focused .cm-selectionBackground': {
-    backgroundColor: 'var(--overlay-10)',
-  },
-  '.cm-gutters': {
-    backgroundColor: 'var(--bg-surface-3)',
-    borderRight: '1px solid var(--overlay-10)',
-    color: 'var(--text-disabled)',
-  },
-  '.cm-gutter': {
-    minWidth: '3ch',
-  },
-  '.cm-lineNumbers .cm-gutterElement': {
-    color: 'var(--text-disabled)',
-    fontSize: '11px',
-  },
-  '.cm-activeLine': {
-    backgroundColor: 'rgba(255, 255, 255, 0.03)',
-  },
-  '.cm-activeLineGutter': {
-    backgroundColor: 'rgba(255, 255, 255, 0.04)',
-    color: 'var(--text-subtle)',
-  },
-  '.cm-line': {
-    padding: '0 var(--space-l) 0 var(--space-3xs)',
-  },
-  '.cm-tooltip': {
-    backgroundColor: 'var(--bg-surface-2)',
-    border: '1px solid var(--overlay-10)',
-    color: 'var(--text)',
-  },
-  '.cm-typescript-hover': {
-    maxWidth: 'min(340px, calc(100vw - 32px))',
-    padding: 'var(--space-s) var(--space-m)',
-    fontFamily: 'var(--font-mono)',
-    fontSize: 'var(--text-xs)',
-    lineHeight: '1.5',
-    overflowWrap: 'anywhere',
-  },
-  '.cm-typescript-hover-signature': {
-    color: 'var(--syntax-entity)',
-    whiteSpace: 'pre-wrap',
-  },
-  '.cm-typescript-hover-documentation': {
-    marginTop: 'var(--space-xs)',
-    color: 'var(--text-muted)',
-    fontFamily: 'var(--font-sans)',
-    whiteSpace: 'pre-wrap',
-  },
-  '.cm-typescript-hover-documentation p': {
-    margin: '0',
-  },
-  '.cm-typescript-hover-documentation p + p': {
-    marginTop: 'var(--space-xs)',
-  },
-  '.cm-typescript-hover-documentation strong': {
-    color: 'var(--text)',
-    fontWeight: '600',
-  },
-  '.cm-typescript-hover-documentation code': {
-    padding: '0 var(--space-3xs)',
-    borderRadius: 'var(--radius-sm)',
-    backgroundColor: 'var(--overlay-10)',
-    color: 'var(--syntax-string)',
-    fontFamily: 'var(--font-mono)',
-  },
-  '.cm-typescript-hover-documentation a': {
-    color: 'var(--syntax-constant)',
-    textDecoration: 'underline',
-    textUnderlineOffset: '2px',
-  },
-  '.cm-lintRange-error': {
-    textDecorationColor: 'var(--danger)',
-  },
-  '.cm-lint-marker-error': {
-    color: 'var(--danger)',
-  },
-}, { dark: true })
-
-export const readableHighlightStyle = HighlightStyle.define([
-  {
-    tag: [
-      t.comment,
-      t.lineComment,
-      t.blockComment,
-      t.docComment,
-      t.meta,
-    ],
-    color: 'var(--syntax-comment)',
-    fontStyle: 'italic',
-  },
-  {
-    tag: [
-      t.keyword,
-      t.definitionKeyword,
-      t.operatorKeyword,
-      t.modifier,
-      t.controlKeyword,
-    ],
-    color: 'var(--syntax-keyword)',
-    fontWeight: '600',
-  },
-  {
-    tag: [
-      t.labelName,
-      t.typeName,
-      t.className,
-      t.namespace,
-      t.macroName,
-      t.tagName,
-      t.function(t.variableName),
-      t.function(t.propertyName),
-    ],
-    color: 'var(--syntax-entity)',
-  },
-  {
-    tag: [
-      t.propertyName,
-      t.definition(t.propertyName),
-      t.attributeName,
-    ],
-    color: 'var(--syntax-property)',
-  },
-  {
-    tag: [
-      t.variableName,
-      t.definition(t.variableName),
-      t.local(t.variableName),
-      t.special(t.variableName),
-    ],
-    color: 'var(--syntax-variable)',
-  },
-  {
-    tag: [
-      t.atom,
-      t.bool,
-      t.number,
-      t.integer,
-      t.float,
-      t.unit,
-      t.color,
-      t.url,
-      t.literal,
-      t.contentSeparator,
-    ],
-    color: 'var(--syntax-constant)',
-  },
-  {
-    tag: [
-      t.string,
-      t.regexp,
-      t.escape,
-      t.special(t.string),
-      t.inserted,
-      t.deleted,
-    ],
-    color: 'var(--syntax-string)',
-  },
-  {
-    tag: [
-      t.operator,
-      t.arithmeticOperator,
-      t.logicOperator,
-      t.compareOperator,
-      t.definitionOperator,
-      t.derefOperator,
-      t.punctuation,
-      t.separator,
-      t.bracket,
-      t.paren,
-      t.squareBracket,
-      t.brace,
-    ],
-    color: 'var(--syntax-operator)',
-  },
-  {
-    tag: [t.heading, t.strong],
-    color: 'var(--syntax-entity)',
-    fontWeight: '700',
-  },
-  {
-    tag: [t.emphasis],
-    color: 'var(--syntax-string)',
-    fontStyle: 'italic',
-  },
-  {
-    tag: [t.link],
-    color: 'var(--syntax-constant)',
-    textDecoration: 'underline',
-  },
-  {
-    tag: t.invalid,
-    color: 'var(--syntax-invalid)',
-  },
-], { themeType: 'dark' })
 
 const readableSyntaxHighlighting = syntaxHighlighting(readableHighlightStyle)
 
@@ -284,49 +66,6 @@ const readableSyntaxHighlighting = syntaxHighlighting(readableHighlightStyle)
 // Per-type extension stacks
 // ---------------------------------------------------------------------------
 
-/**
- * The set of languages the editor can syntax-highlight. Callers map their
- * source (a SiteFile's type/path, or an arbitrary code buffer like an inline
- * SVG prop) to one of these — keeping the CM6 language imports inside this
- * lazy-loaded chunk.
- */
-export type CodeLanguage =
-  | 'tsx'
-  | 'ts'
-  | 'jsx'
-  | 'javascript'
-  | 'css'
-  | 'json'
-  | 'markdown'
-  | 'html'
-  | 'text'
-
-/** Map a `CodeLanguage` to its CM6 language extension(s). Shared with the
- * read-only agent code/diff views (`AgentCodeView.tsx`, same lazy graph). */
-export function getLanguageExtensions(language: CodeLanguage): Extension[] {
-  switch (language) {
-    case 'tsx':
-      return [javascript({ jsx: true, typescript: true })]
-    case 'ts':
-      return [javascript({ typescript: true })]
-    case 'jsx':
-      return [javascript({ jsx: true })]
-    case 'javascript':
-      return [javascript()]
-    case 'css':
-      return [css()]
-    case 'json':
-      return [json()]
-    case 'markdown':
-      return [markdown()]
-    case 'html':
-      // Used for inline SVG markup (SVG is HTML-compatible XML).
-      return [html()]
-    case 'text':
-    default:
-      return []
-  }
-}
 
 // ---------------------------------------------------------------------------
 // CodeMirrorEditor
diff --git a/src/admin/pages/site/code-editor/codeMirrorShared.ts b/src/admin/pages/site/code-editor/codeMirrorShared.ts
new file mode 100644
index 000000000..25fff41ec
--- /dev/null
+++ b/src/admin/pages/site/code-editor/codeMirrorShared.ts
@@ -0,0 +1,285 @@
+/**
+ * Shared CodeMirror pieces — the editor chrome theme, the readable syntax
+ * highlight style, and the per-language extension stacks. Consumed by the
+ * editable editor (CodeMirrorEditor), the collab variant, and the agent
+ * panel's read-only code/diff viewer (AgentCodeView). Lives in its own
+ * non-component module so component files keep react-refresh eligibility.
+ *
+ * This module imports CodeMirror packages and is therefore part of the
+ * lazy-loaded editor chunk graph — listed in the codemirror-lazy-only gate.
+ */
+import { EditorView } from '@codemirror/view'
+import { HighlightStyle } from '@codemirror/language'
+import { javascript } from '@codemirror/lang-javascript'
+import { css } from '@codemirror/lang-css'
+import { json } from '@codemirror/lang-json'
+import { markdown } from '@codemirror/lang-markdown'
+import { html } from '@codemirror/lang-html'
+import { tags as t } from '@lezer/highlight'
+import type { Extension } from '@codemirror/state'
+
+
+// ---------------------------------------------------------------------------
+// GitHub Dark-inspired CM6 theme — CSS custom properties only.
+// ---------------------------------------------------------------------------
+// All color values are CSS custom properties from globals.css.
+// No hex, rgb(), or hsl() literals in this lazy-loaded editor module.
+export const editorChromeTheme = EditorView.theme({
+  '&': {
+    backgroundColor: 'var(--bg-surface)',
+    color: 'var(--text)',
+    height: '100%',
+    fontSize: '12px',
+    fontFamily: 'var(--font-mono)',
+  },
+  '&.cm-focused': {
+    outline: 'none',
+  },
+  '.cm-content': {
+    caretColor: 'var(--overlay)',
+    padding: 'var(--space-s) 0',
+  },
+  '.cm-cursor': {
+    borderLeftColor: 'var(--overlay)',
+  },
+  '.cm-selectionBackground': {
+    backgroundColor: 'var(--overlay-10)',
+  },
+  '&.cm-focused .cm-selectionBackground': {
+    backgroundColor: 'var(--overlay-10)',
+  },
+  '.cm-gutters': {
+    backgroundColor: 'var(--bg-surface-3)',
+    borderRight: '1px solid var(--overlay-10)',
+    color: 'var(--text-disabled)',
+  },
+  '.cm-gutter': {
+    minWidth: '3ch',
+  },
+  '.cm-lineNumbers .cm-gutterElement': {
+    color: 'var(--text-disabled)',
+    fontSize: '11px',
+  },
+  '.cm-activeLine': {
+    backgroundColor: 'rgba(255, 255, 255, 0.03)',
+  },
+  '.cm-activeLineGutter': {
+    backgroundColor: 'rgba(255, 255, 255, 0.04)',
+    color: 'var(--text-subtle)',
+  },
+  '.cm-line': {
+    padding: '0 var(--space-l) 0 var(--space-3xs)',
+  },
+  '.cm-tooltip': {
+    backgroundColor: 'var(--bg-surface-2)',
+    border: '1px solid var(--overlay-10)',
+    color: 'var(--text)',
+  },
+  '.cm-typescript-hover': {
+    maxWidth: 'min(340px, calc(100vw - 32px))',
+    padding: 'var(--space-s) var(--space-m)',
+    fontFamily: 'var(--font-mono)',
+    fontSize: 'var(--text-xs)',
+    lineHeight: '1.5',
+    overflowWrap: 'anywhere',
+  },
+  '.cm-typescript-hover-signature': {
+    color: 'var(--syntax-entity)',
+    whiteSpace: 'pre-wrap',
+  },
+  '.cm-typescript-hover-documentation': {
+    marginTop: 'var(--space-xs)',
+    color: 'var(--text-muted)',
+    fontFamily: 'var(--font-sans)',
+    whiteSpace: 'pre-wrap',
+  },
+  '.cm-typescript-hover-documentation p': {
+    margin: '0',
+  },
+  '.cm-typescript-hover-documentation p + p': {
+    marginTop: 'var(--space-xs)',
+  },
+  '.cm-typescript-hover-documentation strong': {
+    color: 'var(--text)',
+    fontWeight: '600',
+  },
+  '.cm-typescript-hover-documentation code': {
+    padding: '0 var(--space-3xs)',
+    borderRadius: 'var(--radius-sm)',
+    backgroundColor: 'var(--overlay-10)',
+    color: 'var(--syntax-string)',
+    fontFamily: 'var(--font-mono)',
+  },
+  '.cm-typescript-hover-documentation a': {
+    color: 'var(--syntax-constant)',
+    textDecoration: 'underline',
+    textUnderlineOffset: '2px',
+  },
+  '.cm-lintRange-error': {
+    textDecorationColor: 'var(--danger)',
+  },
+  '.cm-lint-marker-error': {
+    color: 'var(--danger)',
+  },
+}, { dark: true })
+
+export const readableHighlightStyle = HighlightStyle.define([
+  {
+    tag: [
+      t.comment,
+      t.lineComment,
+      t.blockComment,
+      t.docComment,
+      t.meta,
+    ],
+    color: 'var(--syntax-comment)',
+    fontStyle: 'italic',
+  },
+  {
+    tag: [
+      t.keyword,
+      t.definitionKeyword,
+      t.operatorKeyword,
+      t.modifier,
+      t.controlKeyword,
+    ],
+    color: 'var(--syntax-keyword)',
+    fontWeight: '600',
+  },
+  {
+    tag: [
+      t.labelName,
+      t.typeName,
+      t.className,
+      t.namespace,
+      t.macroName,
+      t.tagName,
+      t.function(t.variableName),
+      t.function(t.propertyName),
+    ],
+    color: 'var(--syntax-entity)',
+  },
+  {
+    tag: [
+      t.propertyName,
+      t.definition(t.propertyName),
+      t.attributeName,
+    ],
+    color: 'var(--syntax-property)',
+  },
+  {
+    tag: [
+      t.variableName,
+      t.definition(t.variableName),
+      t.local(t.variableName),
+      t.special(t.variableName),
+    ],
+    color: 'var(--syntax-variable)',
+  },
+  {
+    tag: [
+      t.atom,
+      t.bool,
+      t.number,
+      t.integer,
+      t.float,
+      t.unit,
+      t.color,
+      t.url,
+      t.literal,
+      t.contentSeparator,
+    ],
+    color: 'var(--syntax-constant)',
+  },
+  {
+    tag: [
+      t.string,
+      t.regexp,
+      t.escape,
+      t.special(t.string),
+      t.inserted,
+      t.deleted,
+    ],
+    color: 'var(--syntax-string)',
+  },
+  {
+    tag: [
+      t.operator,
+      t.arithmeticOperator,
+      t.logicOperator,
+      t.compareOperator,
+      t.definitionOperator,
+      t.derefOperator,
+      t.punctuation,
+      t.separator,
+      t.bracket,
+      t.paren,
+      t.squareBracket,
+      t.brace,
+    ],
+    color: 'var(--syntax-operator)',
+  },
+  {
+    tag: [t.heading, t.strong],
+    color: 'var(--syntax-entity)',
+    fontWeight: '700',
+  },
+  {
+    tag: [t.emphasis],
+    color: 'var(--syntax-string)',
+    fontStyle: 'italic',
+  },
+  {
+    tag: [t.link],
+    color: 'var(--syntax-constant)',
+    textDecoration: 'underline',
+  },
+  {
+    tag: t.invalid,
+    color: 'var(--syntax-invalid)',
+  },
+], { themeType: 'dark' })
+
+/**
+ * The set of languages the editor can syntax-highlight. Callers map their
+ * source (a SiteFile's type/path, or an arbitrary code buffer like an inline
+ * SVG prop) to one of these — keeping the CM6 language imports inside this
+ * lazy-loaded chunk.
+ */
+export type CodeLanguage =
+  | 'tsx'
+  | 'ts'
+  | 'jsx'
+  | 'javascript'
+  | 'css'
+  | 'json'
+  | 'markdown'
+  | 'html'
+  | 'text'
+
+/** Map a `CodeLanguage` to its CM6 language extension(s). Shared with the
+ * read-only agent code/diff views (`AgentCodeView.tsx`, same lazy graph). */
+export function getLanguageExtensions(language: CodeLanguage): Extension[] {
+  switch (language) {
+    case 'tsx':
+      return [javascript({ jsx: true, typescript: true })]
+    case 'ts':
+      return [javascript({ typescript: true })]
+    case 'jsx':
+      return [javascript({ jsx: true })]
+    case 'javascript':
+      return [javascript()]
+    case 'css':
+      return [css()]
+    case 'json':
+      return [json()]
+    case 'markdown':
+      return [markdown()]
+    case 'html':
+      // Used for inline SVG markup (SVG is HTML-compatible XML).
+      return [html()]
+    case 'text':
+    default:
+      return []
+  }
+}

From aa55f872f15c2c9456c6029cbc87f8da354305d3 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sun, 12 Jul 2026 23:34:35 +0200
Subject: [PATCH 17/36] =?UTF-8?q?feat(ai):=20plugin=5Fdocs=20=E2=80=94=20a?=
 =?UTF-8?q?uthoritative=20on-demand=20reference=20for=20the=20IDE=20agent?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Live testing showed the model guessing contracts (an .html app-page entry
that validated clean and only failed at runtime) and learning by error.
Two fixes:

- plugin_docs tool: curated author-facing topics (manifest, admin-pages,
  server, modules, editor, frontend, workflow, examples) hand-written
  from the real SDK types and host loaders — the system prompt now
  directs the agent to read the matching topic before writing code in an
  unfamiliar area. Exposed over MCP too (headless).
- derive-time app-entry validation: adminPages kind:'app' entries get the
  same source→bundle rewrite as frontend assets, non-JS entries and
  dangling paths now fail the BUILD with an instructive message instead
  of exploding in the admin shell at runtime.

Also tightens the prompt's SDK summary to the real ServerPluginModule /
defineModule / activate(api) contracts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 docs/features/site-plugins.md                 |   7 +-
 server/ai/tools/plugin/docs.ts                | 352 ++++++++++++++++++
 server/ai/tools/plugin/index.ts               |   2 +
 server/ai/tools/plugin/systemPrompt.ts        |  11 +-
 .../server/sitePluginAiTools.test.ts          |  21 +-
 src/__tests__/sitePlugins/sourceModel.test.ts |  54 +++
 .../site/panels/AgentPanel/toolCallDisplay.ts |   2 +
 src/core/site-plugins/derive.ts               |  28 ++
 8 files changed, 470 insertions(+), 7 deletions(-)
 create mode 100644 server/ai/tools/plugin/docs.ts

diff --git a/docs/features/site-plugins.md b/docs/features/site-plugins.md
index b9477d878..463356623 100644
--- a/docs/features/site-plugins.md
+++ b/docs/features/site-plugins.md
@@ -38,7 +38,7 @@ If browser code talks to a plugin's server code, it lives in that plugin's
 | HTTP routes + service layer (list, activation engine) | `server/handlers/cms/sitePlugins/` |
 | Disk-package activation seam (shared with zip installs) | `server/handlers/cms/plugins/install.ts` → `activatePluginPackageFromDisk` |
 | Plugin IDE | `src/admin/pages/plugins/ide/` |
-| Plugins-page group + scaffold dialog | `src/admin/pages/plugins/components/SitePluginsSection.tsx`, `NewSitePluginDialog.tsx` |
+| Plugins-page integration (merged list, draft cards, scaffold dialog) | `src/admin/pages/plugins/PluginsPage.tsx`, `components/DraftSitePluginCard.tsx`, `components/NewSitePluginDialog.tsx` |
 | Draft canvas preview (editor side) | `src/admin/pages/site/hooks/useDraftModulePackPreview.ts` |
 | Collab CodeMirror binding | `src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx` |
 | Granular collab files (Y.Map + Y.Text content) | `src/core/collab/filesY.ts` |
@@ -176,6 +176,11 @@ The left rail's AI button (gated by `ai.chat`) docks the shared AgentPanel
   latest hash (stale edits fail instead of clobbering); write/rename/
   delete gate on `plugins.edit`; `plugin_open_file` moves the visible
   buffer.
+- **`plugin_docs`** serves the curated author reference (manifest,
+  admin-pages, server, modules, editor, frontend, workflow, examples) so
+  the agent reads contracts instead of guessing them from build errors.
+  Content lives in `server/ai/tools/plugin/docs.ts` and must track the SDK
+  contracts it documents.
 - **Lifecycle tools are server-resolved**: `plugin_list_plugins`,
   `plugin_validate` (the diagnostics-strip build), and `plugin_activate` —
   same-grant rebuilds only. A changed grant set is refused with an
diff --git a/server/ai/tools/plugin/docs.ts b/server/ai/tools/plugin/docs.ts
new file mode 100644
index 000000000..65030a6ac
--- /dev/null
+++ b/server/ai/tools/plugin/docs.ts
@@ -0,0 +1,352 @@
+/**
+ * Plugin-scope documentation tool — `plugin_docs`.
+ *
+ * The system prompt carries only a summary; this tool is the authoritative
+ * on-demand reference so the agent reads the REAL contract before writing
+ * code instead of discovering it through build/runtime errors. Content is
+ * curated by hand from the SDK types and host loaders it documents
+ * (`src/core/plugin-sdk/types/*`, `src/core/plugins/adminRuntime.ts`,
+ * `src/core/site-plugins/templates.ts`) — when those contracts change,
+ * update the matching topic here in the same change.
+ *
+ * Deliberately embedded strings (not repo-file reads): they version with
+ * the build, exist on every install, and stay author-facing rather than
+ * contributor-facing.
+ */
+import { Type } from '@core/utils/typeboxHelpers'
+import { aiToolError, aiToolOk } from '@core/ai'
+import type { AiTool } from '../types'
+
+const TOPICS: Record<string, { summary: string; content: string }> = {
+  manifest: {
+    summary: 'plugin.json fields, permissions list, derived fields, coherence rules',
+    content: `# plugin.json (site plugin draft manifest)
+
+Author-owned fields — everything else is DERIVED by the build and must NOT be set
+(id, version, apiVersion, entrypoints, assetBasePath, pack, grantedPermissions, icon):
+
+{
+  "name": "…",                      // required
+  "description": "…",
+  "permissions": ["…"],             // see list below
+  "networkAllowedHosts": ["api.example.com"],  // required with network.outbound
+  "resources": [ … ],               // plugin-owned record types (see admin-pages topic)
+  "adminPages": [ … ],              // admin navigation pages (see admin-pages topic)
+  "settings": [ … ]                 // operator-editable settings (text/textarea/number/select/toggle variants)
+}
+
+Entrypoints derive from folders: server/index.ts → sandboxed backend;
+editor/index.ts → unsandboxed admin code (requires "editor.code");
+modules/*.ts → canvas module pack (requires "modules.register");
+frontend/* → built/published assets.
+
+Permissions (exact ids):
+- admin.navigation — adminPages appear in the admin nav
+- cms.storage — records via api.cms.storage.collection()
+- cms.routes — register backend HTTP routes; cms.routes.public additionally allows anonymous routes
+- cms.hooks — subscribe to host events
+- cms.content.read / cms.content.write / cms.content.publish / cms.content.delete —
+  the host's content tables via api.cms.content.*; ALSO requires the manifest to
+  list target tables in "contentAccess": [{ "table": "posts", "modes": ["read"] }]
+- cms.content.tables.manage — create user tables (dangerous)
+- editor.code — plugin JS loaded into the admin window (required by editor/ entry AND kind:'app' admin pages)
+- editor.toolbar / editor.commands / editor.canvas / editor.panels /
+  editor.store.read / editor.store.write — specific editor API surfaces
+- modules.register / loops.register / visualComponents.register / dashboard.widgets.register
+- media.storage.adapter / media.url.transform / media.variant.delegate
+- frontend.assets — inject declared tags into published pages (manifest "frontend": { "assets": [...] })
+- network.outbound — fetch() from the sandbox, only to networkAllowedHosts
+- cms.schedule — scheduled jobs via api.cms.schedule
+
+Coherence is enforced at build: an entry file whose permission is missing fails
+validation with a named diagnostic. Grants = declared: activation grants exactly
+the manifest's permission list (changes need human consent in the IDE header).`,
+  },
+  'admin-pages': {
+    summary: 'adminPages content kinds — markdown, resource CRUD, map, app (React)',
+    content: `# Admin pages
+
+"adminPages": [{ "id": "kebab-id", "title": "…", "navLabel": "…", "content": … }]
+Requires the "admin.navigation" permission. content is a strict union:
+
+1. Markdown (static, no code):
+   { "kind": "markdown", "body": "…markdown…", "heading": "optional" }
+
+2. Resource CRUD page — THE way to build "manage records" pages (customers,
+   leads, bookings). The HOST renders the full list/create/delete UI; records
+   live in plugin storage; zero custom code:
+   { "kind": "resource", "heading": "Customers", "resource": "customers" }
+   plus a matching top-level declaration:
+   "resources": [{
+     "slug": "customers",
+     "labelField": "name",
+     "fields": [
+       { "id": "name", "label": "Name", "type": "text", "required": true },
+       { "id": "email", "label": "Email", "type": "text" },
+       { "id": "active", "label": "Active", "type": "boolean" }
+     ]
+   }]
+   Server code reads/writes the same records: api.cms.storage.collection('customers')
+   (requires "cms.storage" for server access; the page itself needs no extra code).
+
+3. Map page: { "kind": "map", "heading": "…", "pins": [{ "label", "x", "y" }] }
+
+4. App page — custom React UI (heavyweight; needs "editor.code"):
+   { "kind": "app", "heading": "…", "entry": "frontend/customers.js" }
+   - entry MUST be a JS module bundled from a TOP-LEVEL frontend/ source
+     (frontend/customers.tsx → frontend/customers.js; the build rewrites and
+     verifies this — .html files are NOT valid entries).
+   - The module's DEFAULT EXPORT must be a React component. The host
+     dynamically import()s it; react / react-dom / @instatic/host-hooks are
+     provided via import map (leave them as plain imports).
+   - Read plugin context with hooks from '@instatic/host-hooks':
+     usePluginContext() → { pluginId, settings, grantedPermissions, routes, … }
+     ctx.routes.fetch(path) / ctx.routes.json(path, schema?) call this plugin's
+     own runtime routes with credentials.
+   Prefer kind:'resource' whenever the page is fundamentally a record table.`,
+  },
+  server: {
+    summary: 'server/index.ts — hooks, routes, storage, settings, content, schedule',
+    content: `# Server entrypoint (server/index.ts — QuickJS sandbox)
+
+Default-export lifecycle hooks; each receives api: ServerPluginApi:
+
+import type { ServerPluginModule } from '@instatic/plugin-sdk'
+const mod: ServerPluginModule = {
+  activate(api) { … },       // every boot + after install/upgrade
+  install(api) { … },        // once, first install
+  deactivate(api) { … },
+  uninstall(api) { … },
+  migrate(ctx, api) { … },   // upgrades; ctx.fromVersion; make idempotent
+}
+export default mod
+
+api.plugin: { id, version, permissions, log(...), assetUrl(path) }
+
+api.cms.routes (permission "cms.routes") — paths mount under
+/admin/api/cms/plugins/<pluginId>/runtime/<path>; browser code builds the URL
+with sitePluginRoute('<localId>', '<path>') from '@instatic/plugin-sdk':
+  api.cms.routes.get('/list', 'plugins.read', handler)      // capability-gated
+  api.cms.routes.authenticated.post('/save', handler)       // any signed-in admin
+  api.cms.routes.public.get('/webhook', handler)            // needs "cms.routes.public"
+Handler: (ctx) => value — ctx = { req, body (pre-parsed JSON/form), user | null }.
+Returned values are JSON-serialized (status 200); return
+{ status, headers?, body } for raw responses.
+
+api.cms.storage.collection('<resource-slug>') (permission "cms.storage"):
+  .list({ …options }) / .create(data) / .update(id, data) / .delete(id)
+  Records persist in the host DB — survive restarts. Declare the resource in
+  the manifest "resources" array.
+
+api.cms.settings — read/replace operator settings declared in the manifest.
+api.cms.schedule (permission "cms.schedule") — cadence handlers (daily/hourly/every-minutes).
+api.cms.hooks (permission "cms.hooks") — host event subscriptions.
+api.cms.content (permissions "cms.content.*" + manifest contentAccess[]):
+  .tables.list()/.get(slug); .table(slug).list/get/getBySlug/create/update/
+  delete/publish/createMany/updateMany/deleteMany;
+  .tree(entryId, fieldId).read/mutate/replace (page-tree operations);
+  .search(query); .getPublishedSnapshot(entryId); .republishAll()
+api.cms.loops.registerSource — loop entity sources (id "<pluginId>.<name>").
+api.cms.media — storage adapter / URL transformer / variant delegate registration.
+
+Sandbox rules: no Node/Bun ambient APIs; fetch() only with "network.outbound" +
+networkAllowedHosts; imports limited to your own files + '@instatic/plugin-sdk'.
+NO persistent in-memory state across restarts — use storage collections.`,
+  },
+  modules: {
+    summary: 'modules/*.ts — defineModule canvas blocks, controls, html helper',
+    content: `# Canvas modules (modules/*.ts — permission "modules.register")
+
+Each top-level modules/ file default-exports defineModule({...}):
+
+import { control, defineModule, html } from '@instatic/plugin-sdk'
+export default defineModule({
+  id: 'site.<localId>.<name>',        // namespace-locked to the plugin id
+  name: 'Display name',
+  description: '…',
+  category: 'Group label',            // module inserter section
+  htmlTag: 'div',
+  defaults: { message: 'Hello' },     // prop defaults
+  schema: {                           // right-panel controls per prop
+    message: control.text('Message'),
+  },
+  render: ({ props }) => ({
+    html: html\`<div class="my-block">\${props.message}</div>\`,
+    css: '.my-block { padding: 12px; }',
+  }),
+})
+
+control builders: text, textarea, number, color, select(label, options),
+toggle, image, url.
+html\`…\` escapes interpolations by default; raw(str) opts out; escapeHtml /
+safeUrl available. render runs in the publisher sandbox AND the editor
+canvas preview — keep it pure (props in, { html, css } out).
+The editor previews DRAFT modules live (no activation needed): use the
+preview action in the IDE header.`,
+  },
+  editor: {
+    summary: 'editor/index.ts — unsandboxed admin extension: commands, toolbar, panels, store',
+    content: `# Editor extension (editor/index.ts — permission "editor.code")
+
+Runs UNSANDBOXED in the admin window (that's why activation shows a red
+consent warning). Export an activate function:
+
+export function activate(api) {
+  api.editor.commands.register({          // permission "editor.commands"
+    id: 'site.<localId>.my-command',
+    label: 'My command',
+    run: () => { … },
+  })
+}
+
+api.editor surfaces (each gated by its own permission):
+- commands.register — command palette + programmatic runs ("editor.commands")
+- toolbar.register — toolbar buttons ("editor.toolbar")
+- palette.register — palette-only commands with subtitles ("editor.commands")
+- panels.register — custom editor panels; panel id must start with the plugin id ("editor.panels")
+- store.read(fn) / store.transaction(mutate) — read or mutate the live editor
+  store ("editor.store.read" / "editor.store.write"); transactions ride the
+  host's undo + collab machinery
+Canvas overlays: "editor.canvas".
+
+Keep editor code minimal — it ships to every admin's browser on every load.`,
+  },
+  frontend: {
+    summary: 'frontend/ assets — bundling rules, published-page injection, admin app entries',
+    content: `# Frontend assets (frontend/)
+
+Bundling: every TOP-LEVEL frontend/<name>.(ts|tsx|js|mjs) becomes
+frontend/<name>.js in the package. Nested folders (frontend/utils/…) are
+helpers only — imported into top-level entries, not bundled separately.
+CSS files are copied as-is.
+
+Two consumers:
+1. Published pages — declare tags in the manifest (permission "frontend.assets"):
+   "frontend": { "assets": [
+     { "kind": "script", "src": "frontend/widget.ts", "placement": "body-end" },
+     { "kind": "style", "src": "frontend/widget.css" }
+   ] }
+   The build rewrites .ts→.js. The host injects the tags into every published
+   page and adjusts CSP. Use api.plugin.assetUrl(path) server-side for URLs.
+2. Admin app pages — adminPages kind:'app' entries point at a built
+   frontend/<name>.js whose default export is a React component (see the
+   admin-pages topic). react / @instatic/host-hooks resolve via import map —
+   import them normally, they are NOT bundled.
+
+Browser → backend: call your own routes with
+sitePluginRoute('<localId>', '/path') from '@instatic/plugin-sdk'
+(equals /admin/api/cms/plugins/site.<localId>/runtime/path).`,
+  },
+  workflow: {
+    summary: 'validate → activate lifecycle, states, consent, publish coupling, rollback',
+    content: `# Build & activation workflow
+
+1. Edit files (live CRDT — no save step). plugin_validate runs the REAL build:
+   bundling, import containment, manifest coherence. Iterate until clean.
+2. plugin_activate builds a new revision (version 1.0.<n>+<contentHash>) and
+   runs the install/upgrade lifecycle. Same-grant rebuilds run without
+   friction; a CHANGED permission set (including first activation) is a human
+   consent moment — ask the user to click "Build & activate" in the IDE header.
+3. Visitor-facing surfaces (modules pack, frontend assets) trigger an
+   automatic republish of baked pages on activation.
+
+States: active · draft-changed (source differs from active revision) ·
+build-failed · permission-review (grants differ) · runtime-error · disabled ·
+source-missing. plugin_list_plugins reports them.
+
+Settings + secrets survive rebuilds. Rollback re-activates the retained
+previous revision (IDE header menu). Deleting the plugin removes the runtime
+row AND the draft folder.
+
+Gotchas:
+- diagnostics are build/containment/manifest errors, NOT TypeScript type checks;
+- in-memory server state resets on restarts/rebuilds — persist via storage;
+- a patch hash mismatch means the file changed (user typing) — re-read, retry.`,
+  },
+  examples: {
+    summary: 'complete minimal examples: routes backend, canvas module, resource CRUD page',
+    content: `# Examples
+
+## Backend route + browser fetch
+plugin.json: { "name": "Status", "permissions": ["cms.routes"] }
+server/index.ts:
+  import type { ServerPluginModule } from '@instatic/plugin-sdk'
+  const mod: ServerPluginModule = {
+    activate(api) {
+      api.cms.routes.get('/status', 'plugins.read', () => ({
+        ok: true, version: api.plugin.version,
+      }))
+    },
+  }
+  export default mod
+Browser side: fetch(sitePluginRoute('<localId>', '/status'), { credentials: 'same-origin' })
+
+## Canvas module
+plugin.json: { "name": "Notice", "permissions": ["modules.register"] }
+modules/notice.ts:
+  import { control, defineModule, html } from '@instatic/plugin-sdk'
+  export default defineModule({
+    id: 'site.<localId>.notice',
+    name: 'Notice', description: 'Callout box', category: 'Notice',
+    htmlTag: 'div',
+    defaults: { message: 'Heads up!' },
+    schema: { message: control.text('Message') },
+    render: ({ props }) => ({
+      html: html\`<div class="notice">\${props.message}</div>\`,
+      css: '.notice { padding: 12px; border-radius: 6px; }',
+    }),
+  })
+
+## Customers CRUD page (records managed from the admin nav — NO custom code)
+plugin.json:
+  {
+    "name": "Customers",
+    "permissions": ["admin.navigation", "cms.storage"],
+    "resources": [{
+      "slug": "customers",
+      "labelField": "name",
+      "fields": [
+        { "id": "name", "label": "Name", "type": "text", "required": true },
+        { "id": "email", "label": "Email", "type": "text" },
+        { "id": "active", "label": "Active", "type": "boolean" }
+      ]
+    }],
+    "adminPages": [{
+      "id": "customers",
+      "title": "Customers",
+      "navLabel": "Customers",
+      "content": { "kind": "resource", "heading": "Customers", "resource": "customers" }
+    }]
+  }
+(cms.storage lets optional server code read the same records:
+api.cms.storage.collection('customers').list())`,
+  },
+}
+
+const TOPIC_IDS = Object.keys(TOPICS).sort()
+
+const DocsInputSchema = Type.Object({
+  topic: Type.Optional(Type.String({ minLength: 1 })),
+})
+
+export const pluginDocsTool: AiTool = {
+  name: 'plugin_docs',
+  scope: 'plugin',
+  execution: 'server',
+  description:
+    `Authoritative plugin-development reference. Call WITHOUT topic for the index; with topic for the full contract. Topics: ${TOPIC_IDS.join(', ')}. Read the matching topic BEFORE writing code in an area you have not touched in this conversation — it is cheaper than discovering contracts through build errors.`,
+  inputSchema: DocsInputSchema,
+  handler: async (input) => {
+    const { topic } = input as { topic?: string }
+    if (!topic) {
+      return aiToolOk({
+        topics: TOPIC_IDS.map((id) => ({ topic: id, summary: TOPICS[id]!.summary })),
+      })
+    }
+    const entry = TOPICS[topic]
+    if (!entry) {
+      return aiToolError(`Unknown docs topic "${topic}". Available: ${TOPIC_IDS.join(', ')}.`)
+    }
+    return aiToolOk({ topic, content: entry.content })
+  },
+}
diff --git a/server/ai/tools/plugin/index.ts b/server/ai/tools/plugin/index.ts
index d8d7444a6..24653a246 100644
--- a/server/ai/tools/plugin/index.ts
+++ b/server/ai/tools/plugin/index.ts
@@ -8,6 +8,7 @@
  * relay to the open Plugin IDE; lifecycle tools run headless.
  */
 import type { AiTool } from '../types'
+import { pluginDocsTool } from './docs'
 import { pluginFileTools, PLUGIN_FILE_READ_ONLY_NAMES } from './fileTools'
 import {
   pluginLifecycleTools,
@@ -19,6 +20,7 @@ import {
 // mutating (it moves the user's visible buffer — same policy as
 // content_set_active_document).
 export const pluginTools: AiTool[] = [
+  { ...pluginDocsTool, mutates: false },
   ...pluginFileTools.map((t) => ({
     ...t,
     mutates: !PLUGIN_FILE_READ_ONLY_NAMES.has(t.name),
diff --git a/server/ai/tools/plugin/systemPrompt.ts b/server/ai/tools/plugin/systemPrompt.ts
index 0ec7606e0..0f0dfff7d 100644
--- a/server/ai/tools/plugin/systemPrompt.ts
+++ b/server/ai/tools/plugin/systemPrompt.ts
@@ -28,12 +28,13 @@ Admin pages (plugin.json "adminPages": [{ id, title, navLabel?, icon?, content }
 - { "kind": "map", "heading": "…", "pins"? } — pin map page.
 - { "kind": "app", "heading": "…", "entry": "<frontend asset path>" } — custom JS page; heavyweight: needs a built frontend asset and the editor.code permission. Prefer "resource" for record management.
 
-SDK essentials (import from "@instatic/plugin-sdk"):
-- Server: export default defineServerPlugin-style hooks object; routes registered via the hooks receive (req) and return responses. sitePluginRoute(localId, path) builds the public route URL ("/admin/api/cms/plugins/site.<localId>/runtime/<path>").
-- Modules: defineModule({ id, label, html, css, controls }) with control() builders; html uses the tagged html\`\` helper (escapeHtml/raw/safeUrl available).
-- Editor: registerCommand and editor UI APIs (runs in the admin window).
+SDK essentials (import from "@instatic/plugin-sdk"; full contracts in plugin_docs):
+- Server: default-export a ServerPluginModule ({ activate(api), install, deactivate, uninstall, migrate }). api.cms.routes.get(path, capability, handler) registers routes under /admin/api/cms/plugins/site.<localId>/runtime/<path> — sitePluginRoute(localId, path) builds that URL for browser code. api.cms.storage.collection(slug) persists records (survives restarts — in-memory state does NOT).
+- Modules: default-export defineModule({ id, name, category, htmlTag, defaults, schema: { prop: control.text(...) }, render: ({ props }) => ({ html, css }) }); html uses the tagged html\`\` helper (escapeHtml/raw/safeUrl available).
+- Editor: export function activate(api) — api.editor.commands.register({ id, label, run }) etc. (runs in the admin window).
 
-Workflow — validate until clean, then activate:
+Workflow — read docs, validate until clean, then activate:
+0. plugin_docs(topic) is the authoritative reference (topics: manifest, admin-pages, server, modules, editor, frontend, workflow, examples). Read the matching topic BEFORE writing code in an area you haven't touched this conversation — guessing contracts costs more than reading them.
 1. Orient: the dynamic context below lists the open plugin and its files. plugin_read_file before editing an existing file; plugin_list_files if the layout is unclear.
 2. Edit: plugin_patch_file for targeted edits (needs the latest hash — re-read after the user types), plugin_write_file to create files or rewrite wholesale, plugin_rename_file / plugin_delete_file to reorganize. plugin_open_file to show the user a file you're working on.
 3. Validate: plugin_validate after each meaningful change — it runs the real build (TypeScript, containment, manifest). Fix every diagnostic; the strip in the IDE shows the same list.
diff --git a/src/__tests__/server/sitePluginAiTools.test.ts b/src/__tests__/server/sitePluginAiTools.test.ts
index bf5bddfd1..c37a79482 100644
--- a/src/__tests__/server/sitePluginAiTools.test.ts
+++ b/src/__tests__/server/sitePluginAiTools.test.ts
@@ -79,7 +79,7 @@ describe('plugin toolset selection', () => {
   test('a reader sees read tools only', () => {
     const offered = selectToolsForScope('plugin', ['ai.chat', 'site.read'])
     const names = offered.map((tool) => tool.name).sort()
-    expect(names).toEqual(['plugin_list_files', 'plugin_list_plugins', 'plugin_read_file', 'plugin_validate'])
+    expect(names).toEqual(['plugin_docs', 'plugin_list_files', 'plugin_list_plugins', 'plugin_read_file', 'plugin_validate'])
   })
 
   test('write tools require ai.tools.write AND plugins.edit', () => {
@@ -177,6 +177,25 @@ describe('plugin lifecycle tool handlers', () => {
     expect(result.data).toMatchObject({ activated: false, skipped: true })
   })
 
+  test('plugin_docs serves an index and full topics', async () => {
+    const index = await run('plugin_docs', {}, ctx(OWNER_CAPS))
+    expect(index.ok).toBe(true)
+    const { topics } = index.data as { topics: Array<{ topic: string; summary: string }> }
+    expect(topics.map((entry) => entry.topic)).toContain('admin-pages')
+
+    const topic = await run('plugin_docs', { topic: 'admin-pages' }, ctx(OWNER_CAPS))
+    expect(topic.ok).toBe(true)
+    const { content } = topic.data as { content: string }
+    // The exact contract the agent guessed wrong in live testing: app entries
+    // are JS modules default-exporting a React component.
+    expect(content).toContain('DEFAULT EXPORT must be a React component')
+    expect(content).toContain('"kind": "resource"')
+
+    const unknown = await run('plugin_docs', { topic: 'nope' }, ctx(OWNER_CAPS))
+    expect(unknown.ok).toBe(false)
+    expect(unknown.error).toContain('admin-pages')
+  })
+
   test('plugin_list_plugins reports the runtime state', async () => {
     const result = await run('plugin_list_plugins', {}, ctx(OWNER_CAPS))
     expect(result.ok).toBe(true)
diff --git a/src/__tests__/sitePlugins/sourceModel.test.ts b/src/__tests__/sitePlugins/sourceModel.test.ts
index 4ef10dd5d..514dc41a4 100644
--- a/src/__tests__/sitePlugins/sourceModel.test.ts
+++ b/src/__tests__/sitePlugins/sourceModel.test.ts
@@ -108,6 +108,60 @@ describe('site plugin manifest derivation', () => {
     expect(asset && asset.kind === 'script' ? asset.src : null).toBe('frontend/tracker.js')
   })
 
+  test('rewrites and verifies adminPages app entries', () => {
+    const appManifest = (entry: string) =>
+      JSON.stringify({
+        name: 'CRM',
+        permissions: ['admin.navigation', 'editor.code'],
+        adminPages: [
+          {
+            id: 'customers',
+            title: 'Customers',
+            content: { kind: 'app', heading: 'Customers', entry },
+          },
+        ],
+      })
+    const files = [
+      file('plugins/crm/plugin.json', ''),
+      file('plugins/crm/frontend/customers.tsx', ''),
+    ]
+
+    // Source path rewrites to the built bundle.
+    const derived = deriveSitePluginManifest({
+      localId: 'crm',
+      draftManifestJson: appManifest('frontend/customers.tsx'),
+      files,
+      previousVersion: null,
+      contentHash: 'abcd1234',
+    })
+    const page = derived.adminPages[0]
+    expect(page && page.content.kind === 'app' ? page.content.entry : null).toBe(
+      'frontend/customers.js',
+    )
+
+    // A non-JS entry fails at BUILD time (used to only fail at runtime).
+    expect(() =>
+      deriveSitePluginManifest({
+        localId: 'crm',
+        draftManifestJson: appManifest('frontend/customers.html'),
+        files: [...files, file('plugins/crm/frontend/customers.html', '<html/>')],
+        previousVersion: null,
+        contentHash: 'abcd1234',
+      }),
+    ).toThrow(/must be a JS module/i)
+
+    // A dangling entry (no matching source) fails too.
+    expect(() =>
+      deriveSitePluginManifest({
+        localId: 'crm',
+        draftManifestJson: appManifest('frontend/missing.ts'),
+        files,
+        previousVersion: null,
+        contentHash: 'abcd1234',
+      }),
+    ).toThrow(/no matching source/i)
+  })
+
   test('rejects author-set derived fields', () => {
     const withId = JSON.stringify({ id: 'acme.evil', name: 'X', permissions: [] })
     expect(() =>
diff --git a/src/admin/pages/site/panels/AgentPanel/toolCallDisplay.ts b/src/admin/pages/site/panels/AgentPanel/toolCallDisplay.ts
index 386fd23f6..722d384f9 100644
--- a/src/admin/pages/site/panels/AgentPanel/toolCallDisplay.ts
+++ b/src/admin/pages/site/panels/AgentPanel/toolCallDisplay.ts
@@ -171,6 +171,8 @@ export function getToolCallDisplay(actionType: string, params: unknown): ToolCal
       return display('Building & activating', optionalString(p.localId), 'runtime', 'write')
     case 'list_plugins':
       return display('Listing site plugins', '', 'collection', 'read')
+    case 'docs':
+      return display('Reading plugin docs', optionalString(p.topic) || 'index', 'document', 'read')
 
     default:
       return display(`Running ${humanizeToolName(toolName)}`, '', 'tool', 'neutral')
diff --git a/src/core/site-plugins/derive.ts b/src/core/site-plugins/derive.ts
index 39a6844f0..e6df6b9f1 100644
--- a/src/core/site-plugins/derive.ts
+++ b/src/core/site-plugins/derive.ts
@@ -159,10 +159,38 @@ export function deriveSitePluginManifest(input: DeriveSitePluginManifestInput):
       }
     : undefined
 
+  // adminPages `kind:'app'` entries get the same source→bundle rewrite AND
+  // an existence check: the admin shell dynamically import()s the entry as
+  // a JS module, so a dangling path (typo) or a non-JS file (.html) would
+  // otherwise pass validation and only fail at runtime in the admin.
+  const adminPages = draft.adminPages?.map((page) => {
+    if (page.content.kind !== 'app') return page
+    const entry = page.content.entry.replace(/\.(tsx?|mjs)$/, '.js')
+    if (!/^frontend\/[^/]+\.js$/.test(entry)) {
+      throw new Error(
+        `adminPages "${page.id}": app entry "${page.content.entry}" must be a JS module built from a ` +
+          `top-level frontend/ source (e.g. "frontend/${page.id}.js" from frontend/${page.id}.tsx). ` +
+          `App pages are dynamically import()ed and must default-export a React component — HTML files cannot be app entries.`,
+      )
+    }
+    const sourceBase = entry.slice('frontend/'.length, -'.js'.length)
+    const hasSource = ['ts', 'tsx', 'js', 'mjs'].some((ext) =>
+      relativePaths.has(`frontend/${sourceBase}.${ext}`),
+    )
+    if (!hasSource) {
+      throw new Error(
+        `adminPages "${page.id}": app entry "${page.content.entry}" has no matching source — ` +
+          `create frontend/${sourceBase}.tsx (default-exporting a React component) or fix the path.`,
+      )
+    }
+    return { ...page, content: { ...page.content, entry } }
+  })
+
   // Validate through the REAL parser — the same contract a zip has.
   return parsePluginManifest({
     ...draft,
     ...(frontend ? { frontend } : {}),
+    ...(adminPages ? { adminPages } : {}),
     id,
     version,
     apiVersion: PLUGIN_API_VERSION,

From b0f7a466bd933558ba62f80c3c90e02f6248acca Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Wed, 2 Sep 2026 17:19:17 +0200
Subject: [PATCH 18/36] fix(ai): insert patch replacement text verbatim

String.prototype.replace with a string replacement interprets $$, $&, $` and $'
in the replacement text. An agent patching a template literal to $${props.price}
silently got ${props.price} written back, and the returned hash was of the
corrupted content. Both patch tools now go through one slice-and-join engine
(applyExactReplacements in @core/ai) that never interprets the replacement.
---
 src/__tests__/ai/textReplacements.test.ts    | 57 ++++++++++++++++++
 src/admin/pages/site/agent/codeAssetTools.ts | 43 ++++---------
 src/core/ai/index.ts                         |  2 +
 src/core/ai/textReplacements.ts              | 63 ++++++++++++++++++++
 4 files changed, 133 insertions(+), 32 deletions(-)
 create mode 100644 src/__tests__/ai/textReplacements.test.ts
 create mode 100644 src/core/ai/textReplacements.ts

diff --git a/src/__tests__/ai/textReplacements.test.ts b/src/__tests__/ai/textReplacements.test.ts
new file mode 100644
index 000000000..756d62059
--- /dev/null
+++ b/src/__tests__/ai/textReplacements.test.ts
@@ -0,0 +1,57 @@
+/**
+ * Exact-text replacement engine shared by the code-asset and plugin-file
+ * patch tools. The one property that matters most: replacement text is
+ * inserted VERBATIM — `$$`, `$&` and friends are never interpreted the way
+ * `String.prototype.replace` would.
+ */
+import { describe, expect, test } from 'bun:test'
+import { applyExactReplacements, countOccurrences } from '@core/ai'
+
+describe('applyExactReplacements', () => {
+  test('inserts replacement text verbatim, including dollar patterns', () => {
+    const source = 'const price = html`<p>${props.price}</p>`'
+    const result = applyExactReplacements(source, [
+      { oldText: '${props.price}', newText: '$${props.price}' },
+    ])
+    expect(result.ok).toBe(true)
+    if (!result.ok) return
+    expect(result.content).toBe('const price = html`<p>$${props.price}</p>`')
+    expect(result.replaced).toBe(1)
+
+    const special = applyExactReplacements('a-b', [{ oldText: '-', newText: "$& $' $` $$ $1" }])
+    expect(special.ok).toBe(true)
+    if (special.ok) expect(special.content).toBe("a$& $' $` $$ $1b")
+  })
+
+  test('replaceAll substitutes every occurrence and counts them', () => {
+    const result = applyExactReplacements('x.x.x', [{ oldText: 'x', newText: '$y', replaceAll: true }])
+    expect(result).toEqual({ ok: true, content: '$y.$y.$y', replaced: 3 })
+  })
+
+  test('a missing or ambiguous match aborts and names the replacement', () => {
+    const missing = applyExactReplacements('abc', [{ oldText: 'zzz', newText: '' }])
+    expect(missing.ok).toBe(false)
+    if (!missing.ok) expect(missing.reason).toBe('not-found')
+
+    const ambiguous = applyExactReplacements('aXa', [{ oldText: 'a', newText: 'b' }])
+    expect(ambiguous.ok).toBe(false)
+    if (!ambiguous.ok) {
+      expect(ambiguous.reason).toBe('ambiguous')
+      expect(ambiguous.matches).toBe(2)
+      expect(ambiguous.replacement.oldText).toBe('a')
+    }
+  })
+
+  test('replacements apply in order, each against the previous result', () => {
+    const result = applyExactReplacements('one two', [
+      { oldText: 'one', newText: 'two' },
+      { oldText: 'two', newText: 'three', replaceAll: true },
+    ])
+    expect(result).toEqual({ ok: true, content: 'three three', replaced: 3 })
+  })
+
+  test('countOccurrences counts non-overlapping matches and treats an empty search as none', () => {
+    expect(countOccurrences('aaaa', 'aa')).toBe(2)
+    expect(countOccurrences('abc', '')).toBe(0)
+  })
+})
diff --git a/src/admin/pages/site/agent/codeAssetTools.ts b/src/admin/pages/site/agent/codeAssetTools.ts
index 90106ad27..6252d6a28 100644
--- a/src/admin/pages/site/agent/codeAssetTools.ts
+++ b/src/admin/pages/site/agent/codeAssetTools.ts
@@ -1,6 +1,7 @@
 import {
   aiToolError,
   aiToolOk,
+  applyExactReplacements,
   type AiToolOutput,
   type InspectCodeRuntimeInput,
   type ListCodeAssetsInput,
@@ -158,16 +159,6 @@ function normalizeRequestedRuntimeDependencies(
   return { ok: true, dependencies }
 }
 
-function countOccurrences(content: string, search: string): number {
-  let count = 0
-  let index = content.indexOf(search)
-  while (index !== -1) {
-    count++
-    index = content.indexOf(search, index + search.length)
-  }
-  return count
-}
-
 function runtimeInspectionPage(
   store: EditorStore,
   input: InspectCodeRuntimeInput,
@@ -312,30 +303,18 @@ export async function runPatchCodeAsset(input: PatchCodeAssetInput): Promise<AiT
     )
   }
 
-  let nextContent = currentContent
-  let replacementCount = 0
-  for (const replacement of input.replacements) {
-    const matches = countOccurrences(nextContent, replacement.oldText)
-    if (matches === 0) {
-      return aiToolError(`Replacement text not found in ${resolved.file.path}.`)
-    }
-    if (matches > 1 && replacement.replaceAll !== true) {
-      return aiToolError(
-        `Replacement for ${resolved.file.path} is ambiguous: ${matches} matches. ` +
-          'Use a larger oldText span or set replaceAll:true.',
-      )
-    }
-
-    if (replacement.replaceAll === true) {
-      nextContent = nextContent.split(replacement.oldText).join(replacement.newText)
-      replacementCount += matches
-    } else {
-      nextContent = nextContent.replace(replacement.oldText, replacement.newText)
-      replacementCount += 1
-    }
+  const applied = applyExactReplacements(currentContent, input.replacements)
+  if (!applied.ok) {
+    return aiToolError(
+      applied.reason === 'not-found'
+        ? `Replacement text not found in ${resolved.file.path}.`
+        : `Replacement for ${resolved.file.path} is ambiguous: ${applied.matches} matches. ` +
+            'Use a larger oldText span or set replaceAll:true.',
+    )
   }
+  const replacementCount = applied.replaced
 
-  store.updateFileContent(resolved.file.id, nextContent)
+  store.updateFileContent(resolved.file.id, applied.content)
   const afterStore = getStoreState()
   const file = afterStore.site?.files.find((candidate) => candidate.id === resolved.file.id)
   if (!file || !isCodeAssetFile(file)) {
diff --git a/src/core/ai/index.ts b/src/core/ai/index.ts
index 9d9240eb0..012ec9fec 100644
--- a/src/core/ai/index.ts
+++ b/src/core/ai/index.ts
@@ -116,6 +116,8 @@ export type {
   PluginDeleteFileInput,
   PluginOpenFileInput,
 } from './toolSchemas'
+export { applyExactReplacements, countOccurrences } from './textReplacements'
+export type { ExactReplacementResult, ExactTextReplacement } from './textReplacements'
 export {
   describeAgentDocuments,
   documentRefEquals,
diff --git a/src/core/ai/textReplacements.ts b/src/core/ai/textReplacements.ts
new file mode 100644
index 000000000..38ac2a225
--- /dev/null
+++ b/src/core/ai/textReplacements.ts
@@ -0,0 +1,63 @@
+/**
+ * Exact-text replacement engine shared by every "patch this file" agent
+ * tool (site code assets, plugin IDE files).
+ *
+ * Deliberately never uses `String.prototype.replace` with a string
+ * replacement: that API interprets `$$`, `$&`, `` $` `` and `$'` in the
+ * replacement text, so an agent patching a template literal to
+ * `$${props.price}` would silently get `${props.price}` written back. Every
+ * substitution here is a plain slice-and-join.
+ */
+
+export interface ExactTextReplacement {
+  oldText: string
+  newText: string
+  replaceAll?: boolean
+}
+
+export type ExactReplacementResult =
+  | { ok: true; content: string; replaced: number }
+  | { ok: false; reason: 'not-found' | 'ambiguous'; matches: number; replacement: ExactTextReplacement }
+
+/** Non-overlapping occurrences of `search` in `content`; 0 for an empty search. */
+export function countOccurrences(content: string, search: string): number {
+  if (search.length === 0) return 0
+  let count = 0
+  let index = content.indexOf(search)
+  while (index !== -1) {
+    count++
+    index = content.indexOf(search, index + search.length)
+  }
+  return count
+}
+
+/**
+ * Apply `replacements` in order. Each `oldText` must occur exactly once
+ * unless `replaceAll` is set; the first miss or ambiguity aborts and reports
+ * which replacement failed so the caller can name the file.
+ */
+export function applyExactReplacements(
+  content: string,
+  replacements: readonly ExactTextReplacement[],
+): ExactReplacementResult {
+  let next = content
+  let replaced = 0
+  for (const replacement of replacements) {
+    const matches = countOccurrences(next, replacement.oldText)
+    if (matches === 0) {
+      return { ok: false, reason: 'not-found', matches, replacement }
+    }
+    if (matches > 1 && replacement.replaceAll !== true) {
+      return { ok: false, reason: 'ambiguous', matches, replacement }
+    }
+    if (replacement.replaceAll === true) {
+      next = next.split(replacement.oldText).join(replacement.newText)
+      replaced += matches
+    } else {
+      const index = next.indexOf(replacement.oldText)
+      next = next.slice(0, index) + replacement.newText + next.slice(index + replacement.oldText.length)
+      replaced += 1
+    }
+  }
+  return { ok: true, content: next, replaced }
+}

From 21f0d467c2e9eaa3b0c1adb871b61ea43d6b36ba Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Wed, 2 Sep 2026 17:19:19 +0200
Subject: [PATCH 19/36] fix(plugin-build): refuse build-time macros before Bun
 parses draft source

Bun evaluates `import x from './m.ts' with { type: 'macro' }` inside the host
process at bundle time with full Node/Bun access. Path containment cannot catch
it (the macro module resolves inside the workspace) and the sandbox scan runs
on the output after the macro already executed, so it was reachable through
the site.read-gated validate and preview-pack routes. Bun's own Transpiler.scan
runs macros too, so the guard is a textual onLoad check that fails closed:
only json/text/file/toml attribute clauses pass; a macro, a comment inside the
clause, an escaped key or a trailing field fails the build. The gate test
covers the real build path (the marker file must not appear) and the clause
spellings.
---
 .../plugins/pluginBuildContainment.test.ts    | 75 ++++++++++++++++++-
 src/core/plugin-build/containment.ts          | 57 +++++++++++++-
 src/core/plugin-build/index.ts                |  2 +-
 3 files changed, 131 insertions(+), 3 deletions(-)

diff --git a/src/__tests__/plugins/pluginBuildContainment.test.ts b/src/__tests__/plugins/pluginBuildContainment.test.ts
index 804edabb7..be1d01557 100644
--- a/src/__tests__/plugins/pluginBuildContainment.test.ts
+++ b/src/__tests__/plugins/pluginBuildContainment.test.ts
@@ -11,7 +11,7 @@ import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'
 import { existsSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
-import { buildPluginPackage } from '@core/plugin-build'
+import { assertNoBuildTimeMacros, buildPluginPackage } from '@core/plugin-build'
 import { parsePluginManifest } from '@core/plugins/manifest'
 
 async function workspace(files: Record<string, string>): Promise<string> {
@@ -96,6 +96,79 @@ describe('plugin build import containment', () => {
     }
   })
 
+  test('a build-time macro import fails the build before the macro runs', async () => {
+    // Bun evaluates `with { type: 'macro' }` imports in the host process at
+    // bundle time. The macro module resolves INSIDE the workspace, so path
+    // containment cannot catch it — the source scan must refuse it first.
+    const marker = join(tmpdir(), `containment-macro-${process.pid}-${Date.now()}.txt`)
+    const root = await workspace({
+      'server/m.ts':
+        `import { writeFileSync } from 'node:fs'\n` +
+        `export function pwn() { writeFileSync(${JSON.stringify(marker)}, 'ran'); return 1 }\n`,
+      'server/index.ts':
+        "import { pwn } from './m.ts' with { type: 'macro' }\nexport function activate() { return pwn() }\n",
+    })
+    try {
+      await expect(
+        buildPluginPackage({
+          sourceDir: root,
+          outputDir: join(root, '.dist'),
+          manifest: MANIFEST,
+          resolve: { workspaceRoot: root, bareSpecifiers: {} },
+        }),
+      ).rejects.toThrow(/build-time macros/)
+      expect(existsSync(marker)).toBe(false)
+    } finally {
+      await rm(marker, { force: true })
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  test('inert import attributes inside the workspace still bundle', async () => {
+    const root = await workspace({
+      'server/index.ts':
+        "import data from './data.json' with { type: 'json' }\nexport function activate() { return data.answer }",
+      'server/data.json': '{ "answer": 42 }',
+    })
+    try {
+      const result = await buildPluginPackage({
+        sourceDir: root,
+        outputDir: join(root, '.dist'),
+        manifest: MANIFEST,
+        resolve: { workspaceRoot: root, bareSpecifiers: {} },
+      })
+      expect(result.files).toContain('server/index.js')
+    } finally {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  test('the macro scan is fail-closed against every spelling of the clause', () => {
+    const rejected = [
+      "import { x } from './m.ts' with { type: 'macro' }",
+      'import { x } from "./m.ts" with {type:"macro"}',
+      "import { x } from './m.ts' assert { type: 'macro' }",
+      "import { x } from './m.ts' with /* hidden */ { type: 'macro' }",
+      "import { x } from './m.ts' with { 'type': 'macro' }",
+      "import { x } from './m.ts' with { type: 'macro' /* } */ }",
+      "import { x } from './m.ts' with { type: 'json', extra: 1 }",
+      "const m = await import('./m.ts', { with: { type: 'macro' } })",
+      "import { x } from './m.ts' with { \\u0074ype: 'macro' }",
+    ]
+    for (const source of rejected) {
+      expect(() => assertNoBuildTimeMacros(source, 'index.ts')).toThrow(/not allowed/)
+    }
+    const accepted = [
+      "import data from './d.json' with { type: 'json' }",
+      'import text from "./t.txt" with { "type": "text" }',
+      "import cfg from './c.toml' assert { type: 'toml' }",
+      "import { pwn } from './m.ts'\nexport const withBraces = { with: 1 }",
+    ]
+    for (const source of accepted) {
+      expect(() => assertNoBuildTimeMacros(source, 'index.ts')).not.toThrow()
+    }
+  })
+
   test('unlisted bare specifier fails; mapped one resolves to the host SDK', async () => {
     const rejected = await workspace({
       'server/index.ts': "import { html } from '@instatic/plugin-sdk'\nexport function activate() { return html }",
diff --git a/src/core/plugin-build/containment.ts b/src/core/plugin-build/containment.ts
index d3e21d25e..29ec4d66b 100644
--- a/src/core/plugin-build/containment.ts
+++ b/src/core/plugin-build/containment.ts
@@ -1,7 +1,52 @@
-import { realpathSync } from 'node:fs'
+import { readFileSync, realpathSync } from 'node:fs'
 import { dirname, isAbsolute, resolve, sep } from 'node:path'
 import type { BunPlugin } from 'bun'
 
+/**
+ * Import attributes a workspace file may carry.
+ *
+ * Bun evaluates `import x from './m.ts' with { type: 'macro' }` AT BUILD
+ * TIME, inside the host process, with full Node/Bun access — a macro module
+ * can read or write anything the server can. Path containment cannot stop
+ * it (the macro module resolves inside the workspace), and the sandbox
+ * literal scan runs on the OUTPUT, after the macro has already executed.
+ * Bun's own `Transpiler.scan` runs macros too, so the only safe check is a
+ * textual one on the raw source before Bun parses it.
+ *
+ * Policy is fail-closed: every `with { … }` / `assert { … }` clause (and the
+ * dynamic-import `{ with: { … } }` option form) must be exactly one of the
+ * inert loaders below. Anything else — `macro`, a comment inside the clause,
+ * an escaped key, a trailing field — fails the build. False positives on
+ * prose that happens to contain `with {` are acceptable; a false negative
+ * is host code execution.
+ */
+const INERT_IMPORT_ATTRIBUTE =
+  /^\s*(?:type|"type"|'type')\s*:\s*(?:"(?:json|text|file|toml)"|'(?:json|text|file|toml)')\s*,?\s*$/
+// `with` / `assert`, optional comments, optional `:` (dynamic-import option
+// object), optional comments, then the brace clause.
+const TRIVIA = String.raw`(?:\s|\/\*[\s\S]*?\*\/|\/\/[^\n]*)*`
+const IMPORT_ATTRIBUTE_CLAUSE = new RegExp(
+  String.raw`\b(?:with|assert)${TRIVIA}:?${TRIVIA}\{([^}]*)\}`,
+  'g',
+)
+const GUARDED_SOURCE = /\.(?:[cm]?[jt]sx?)$/
+
+/**
+ * Throw when `source` carries an import attribute clause that is not one
+ * of the inert loaders. Exported for the containment gate test.
+ */
+export function assertNoBuildTimeMacros(source: string, filePath: string): void {
+  for (const match of source.matchAll(IMPORT_ATTRIBUTE_CLAUSE)) {
+    const clause = match[1] ?? ''
+    if (INERT_IMPORT_ATTRIBUTE.test(clause)) continue
+    throw new Error(
+      `${filePath}: import attribute clause "{${clause.trim()}}" is not allowed in a site plugin. ` +
+        `Only { type: 'json' | 'text' | 'file' | 'toml' } may be used — build-time macros ` +
+        `(type: 'macro') would run on the host during the build.`,
+    )
+  }
+}
+
 /**
  * Import-containment seam. Absent on a bundle = default resolution (CLI
  * behavior). The site plugin frontend supplies a policy that fails any
@@ -80,6 +125,16 @@ export function containmentPlugin(policy: ImportResolverPolicy): BunPlugin {
   return {
     name: 'instatic-plugin-workspace-containment',
     setup(build) {
+      // Runs BEFORE Bun parses a workspace file — the only moment a macro
+      // import can still be refused. Host-owned files (the mapped SDK) are
+      // not draft-controlled and skip the scan. Returning undefined hands
+      // the unchanged file to the default loader.
+      build.onLoad({ filter: GUARDED_SOURCE }, (args) => {
+        if (!isInsideAny(roots, args.path)) return undefined
+        assertNoBuildTimeMacros(readFileSync(args.path, 'utf8'), args.path)
+        return undefined
+      })
+
       build.onResolve({ filter: /.*/ }, (args) => {
         const specifier = args.path
 
diff --git a/src/core/plugin-build/index.ts b/src/core/plugin-build/index.ts
index 6b4edfdac..6cd1f6345 100644
--- a/src/core/plugin-build/index.ts
+++ b/src/core/plugin-build/index.ts
@@ -12,6 +12,6 @@ export {
   type BuildPackageInput,
   type BuildPackageResult,
 } from './buildPackage'
-export type { ImportResolverPolicy } from './containment'
+export { assertNoBuildTimeMacros, type ImportResolverPolicy } from './containment'
 export { bundleEntrypoint, HOST_RUNTIME_EXTERNALS, type BundleOptions } from './bundle'
 export { generateModulesFacade, generateSandboxFacade } from './facades'

From ee8c4e1d1a2f2980bc579dbdad479f73b72fd64c Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Wed, 2 Sep 2026 17:19:21 +0200
Subject: [PATCH 20/36] fix(site-plugins): serialize lifecycle per plugin and
 re-bake data rows before sweeping

Only the build was single-flight; two overlapping activations both read the
same row version, derived the same next counter and raced the upgrade path.
Activation, rollback and delete now serialize per local id through one keyed
promise-chain helper shared with the build.

The post-activation republish only re-baked pages, so entry-template data
rows (/posts/hello) kept HTML pointing at the revision the sweep then deleted.
The data-row bake takes a write target, the full publish and the in-place
republish share it, and the republish runs under the publish lock at N+1
before bumping, the same ordering the full publish uses, so hole shells are
never stamped stale.
---
 docs/features/site-plugins.md              | 48 +++++++++++++--
 server/handlers/cms/sitePlugins/index.ts   |  7 ++-
 server/handlers/cms/sitePlugins/service.ts | 56 ++++++++++++++---
 server/plugins/sitePlugins/build.ts        | 14 +----
 server/publish/bakeDataRows.ts             | 38 ++++++++----
 server/publish/publishSite.ts              |  5 +-
 server/publish/republish.ts                | 47 +++++++++++++--
 server/util/keyedSerial.ts                 | 27 +++++++++
 src/__tests__/server/keyedSerial.test.ts   | 70 ++++++++++++++++++++++
 9 files changed, 271 insertions(+), 41 deletions(-)
 create mode 100644 server/util/keyedSerial.ts
 create mode 100644 src/__tests__/server/keyedSerial.test.ts

diff --git a/docs/features/site-plugins.md b/docs/features/site-plugins.md
index 463356623..73667cac9 100644
--- a/docs/features/site-plugins.md
+++ b/docs/features/site-plugins.md
@@ -79,12 +79,25 @@ derive the manifest, materialize a temp workspace, and run the shared
   (`with { type: 'text' }`) fail the build (without this, draft code could
   embed `.env`/DB files into a bundle and exfiltrate them through the
   plugin's own routes — the sandbox literal scan does not cover this class);
+- **build-time macros are refused before Bun parses the file.** Bun runs
+  `import x from './m.ts' with { type: 'macro' }` inside the host process at
+  bundle time, with full Node/Bun access; the macro module resolves inside
+  the workspace, so path containment cannot catch it, and the sandbox scan
+  runs on the output after the macro already executed. The containment
+  plugin's `onLoad` hook (`assertNoBuildTimeMacros`) scans every workspace
+  source textually and fails closed: only `{ type: 'json' | 'text' | 'file'
+  | 'toml' }` attribute clauses are allowed, anything else (a macro, a
+  comment inside the clause, an escaped key) is a build error;
 - exactly one bare specifier is mapped: `@instatic/plugin-sdk` → the host
   SDK entry (pure data builders inline into sandbox bundles);
 - editor/admin bundles keep the host-runtime externals (import-map
   resolved).
 
-Builds are single-flight per plugin with a 30 s timeout. Validate-only mode
+Builds are single-flight per plugin with a 30 s timeout, and every
+lifecycle transition (activate, rollback, delete) is serialized per plugin
+id on top of that (`withSitePluginLock` in the service layer) — two
+overlapping activations would otherwise both read the same row version,
+derive the same next counter, and race the upgrade path. Validate-only mode
 writes into the throwaway workspace (never uploads), returns diagnostics,
 and can return the built modules bundle text (the preview-pack route).
 Diagnostics are bundle/parse errors, sandbox-scan violations, containment
@@ -155,10 +168,29 @@ The IDE binds ONLY `site:default` over the site socket (its own
 - two admins co-type one file character-level, with per-peer colored carets
   (y-codemirror.next);
 - file CRUD and renames merge per-field;
-- the site editor's code panel rides the same granularity;
+- the shell's `files` value is granular for every consumer of the site doc
+  (the site editor's Scripts panel still writes whole strings at the store
+  layer, so it is the IDE that co-edits character-level);
 - presence is shared: site editors see IDE users in their roster; IDE rows
   show who's editing which file;
-- undo is per-file and local-only (Y.UndoManager).
+- undo is per-file and local-only: the co-edited buffer mounts WITHOUT
+  CodeMirror's own `history()` (which would record peers' deltas as
+  undoable steps) and the Y.UndoManager keymap takes precedence over every
+  other Mod-z binding.
+
+Two lifecycle rules keep the session safe:
+
+- **nothing writes before the first sync.** An unsynced doc has no `files`
+  map; creating one client-side would win the merge (the server seeds with
+  client id 1) and replace every site file with the one just created. Every
+  mutating session method throws `IdeNotSyncedError` until `synced()` is
+  true, the file tree keeps New file / rename / delete disabled with the
+  reason, and the agent bridge answers "still connecting";
+- **a relay reset rebinds.** `FRAME_RESET` (an out-of-relay shell write —
+  scaffold, delete, settings save, import — reseeded the doc) destroys the
+  bound Y.Doc. The session rebinds at once, bumps its `generation`, drops
+  the undo managers that referenced the dead Y.Text, and the buffer
+  remounts keyed on the generation instead of typing into a destroyed type.
 
 There is no save button — the relay persists continuously; Cmd+S re-runs
 diagnostics. Automatic validation runs debounced on every change.
@@ -205,8 +237,11 @@ permission treatment lives where it matters: the activation review dialog.
 
 - Activating a revision with visitor-facing surfaces (frontend assets or a
   module pack) **republishes before sweeping** — baked Layer-A HTML embeds
-  versioned asset URLs and must never reference a deleted revision.
-  Backend-only plugins skip the republish.
+  versioned asset URLs and must never reference a deleted revision. Both
+  artefact kinds are re-baked in place under the publish lock: pages
+  (`republishAllPages`) and entry-template data rows such as `/posts/hello`
+  (`republishAllDataRows`), stamped with the version that becomes current
+  at the bump that follows. Backend-only plugins skip the republish.
 - Retention keeps the active revision + the immediately previous one (the
   `Rollback to previous revision` target — source rolls forward only, so
   the artifact is the only rollback). Uninstall sweeps the whole
@@ -245,6 +280,9 @@ import map); editor/admin bundles resolve it through the host import map.
 - Provenance branches in runtime machinery (gated).
 - Calling `buildPluginPackage` server-side without the containment policy
   (gated).
+- `with { type: 'macro' }` (or any non-inert import attribute) in draft
+  source — refused before Bun parses the file (gated).
+- Writing to the IDE session before `synced()` is true.
 
 ## Gate tests
 
diff --git a/server/handlers/cms/sitePlugins/index.ts b/server/handlers/cms/sitePlugins/index.ts
index be7bdc050..a54c45770 100644
--- a/server/handlers/cms/sitePlugins/index.ts
+++ b/server/handlers/cms/sitePlugins/index.ts
@@ -63,6 +63,7 @@ import {
   republishAndSweep,
   runSitePluginActivation,
   sameStringSet,
+  withSitePluginLock,
 } from './service'
 
 // Service re-exports — external consumers (the AI plugin tools) import the
@@ -435,7 +436,8 @@ export async function handleSitePluginsRoutes(
     if (req.method !== 'POST') return methodNotAllowed()
     const user = await requireCapability(req, db, 'plugins.install')
     if (user instanceof Response) return user
-    return handleRollback(req, db, options, user, rollbackMatch.groups['localId']!)
+    const localId = rollbackMatch.groups['localId']!
+    return withSitePluginLock(localId, () => handleRollback(req, db, options, user, localId))
   }
 
   const itemMatch = ITEM_PATTERN.exec(pathname)
@@ -447,7 +449,8 @@ export async function handleSitePluginsRoutes(
     if (user instanceof Response) return user
     const stepUp = await requireStepUp(req, db, user)
     if (stepUp) return stepUp
-    return handleDelete(req, db, options, user, itemMatch.groups['localId']!)
+    const localId = itemMatch.groups['localId']!
+    return withSitePluginLock(localId, () => handleDelete(req, db, options, user, localId))
   }
 
   return jsonResponse({ error: 'Not found' }, { status: 404 })
diff --git a/server/handlers/cms/sitePlugins/service.ts b/server/handlers/cms/sitePlugins/service.ts
index ce3c01241..9228147d3 100644
--- a/server/handlers/cms/sitePlugins/service.ts
+++ b/server/handlers/cms/sitePlugins/service.ts
@@ -30,13 +30,35 @@ import type { AuthUser } from '../../../repositories/users'
 import { getDraftSite } from '../../../repositories/site'
 import { getInstalledPlugin, listInstalledPlugins } from '../../../repositories/plugins'
 import { runPublishFlush } from '../../../publish/publishFlush'
-import { republishAllPages } from '../../../publish/republish'
-import { bumpPublishVersionSerialized } from '../../../publish/publishState'
+import { republishAllDataRows, republishAllPages } from '../../../publish/republish'
+import {
+  bumpPublishVersion,
+  getPublishVersion,
+  withPublishLock,
+} from '../../../publish/publishState'
 import { buildSitePlugin } from '../../../plugins/sitePlugins/build'
 import { sweepSitePluginRevisions } from '../../../plugins/sitePlugins/retention'
+import { createKeyedSerializer } from '../../../util/keyedSerial'
 import type { CmsHandlerOptions } from '../shared'
 import { activatePluginPackageFromDisk } from '../plugins/install'
 
+// ---------------------------------------------------------------------------
+// Per-plugin lifecycle lock
+// ---------------------------------------------------------------------------
+
+const serializeLifecycle = createKeyedSerializer()
+
+/**
+ * Serialize lifecycle transitions (activate, rollback, delete) per local id.
+ * Two overlapping activations would otherwise both read the same row
+ * version, derive the same next counter, and race the upgrade path — the
+ * build below is single-flight on its own, but the read-row → derive →
+ * activate window around it was not.
+ */
+export function withSitePluginLock<T>(localId: string, fn: () => Promise<T>): Promise<T> {
+  return serializeLifecycle(localId, fn)
+}
+
 // ---------------------------------------------------------------------------
 // Draft access
 // ---------------------------------------------------------------------------
@@ -161,7 +183,7 @@ export type SitePluginActivationResult =
   | { status: 'build-failed'; diagnostics: string[] }
   | { status: 'upgrade-error'; message: string }
 
-export async function runSitePluginActivation(input: {
+export interface SitePluginActivationInput {
   db: DbClient
   options: CmsHandlerOptions
   user: AuthUser
@@ -173,7 +195,17 @@ export async function runSitePluginActivation(input: {
    * only AFTER a successful step-up; tool callers always pass false.
    */
   allowGrantChange: boolean
-}): Promise<SitePluginActivationResult> {
+}
+
+export function runSitePluginActivation(
+  input: SitePluginActivationInput,
+): Promise<SitePluginActivationResult> {
+  return withSitePluginLock(input.localId, () => activateUnlocked(input))
+}
+
+async function activateUnlocked(
+  input: SitePluginActivationInput,
+): Promise<SitePluginActivationResult> {
   const { db, options, user, req, localId, allowGrantChange } = input
   if (!options.uploadsDir) {
     return { status: 'invalid', message: 'Uploads directory is not configured' }
@@ -268,7 +300,10 @@ export async function runSitePluginActivation(input: {
  * Layer-A HTML embeds versioned asset URLs, so when the plugin has
  * visitor-facing surfaces the host republishes BEFORE any old revision is
  * garbage-collected — published pages must never reference a deleted
- * revision. Backend-only plugins skip the republish and sweep immediately.
+ * revision. Both artefact kinds are re-baked: pages AND entry-template
+ * data rows (`/posts/hello`), which a page-only republish would leave
+ * pointing at the swept directory. Backend-only plugins skip the republish
+ * and sweep immediately.
  */
 export async function republishAndSweep(
   db: DbClient,
@@ -279,8 +314,15 @@ export async function republishAndSweep(
     (manifest.frontend?.assets.length ?? 0) > 0 || Boolean(manifest.entrypoints?.modules)
   if (visitorFacing) {
     try {
-      await republishAllPages(db, uploadsDir)
-      await bumpPublishVersionSerialized()
+      // Under the publish lock, with the same version ordering the full
+      // publish uses: bake at N+1, then bump. Baking at N and bumping after
+      // would stamp every hole shell one version stale.
+      await withPublishLock(async () => {
+        const nextVersion = getPublishVersion() + 1
+        await republishAllPages(db, uploadsDir, nextVersion)
+        await republishAllDataRows(db, uploadsDir, nextVersion)
+        bumpPublishVersion()
+      })
     } catch (err) {
       // A failed republish must not fail the activation — but it must also
       // not trigger the sweep (old revision stays referenced).
diff --git a/server/plugins/sitePlugins/build.ts b/server/plugins/sitePlugins/build.ts
index d574d5889..90c2c1b10 100644
--- a/server/plugins/sitePlugins/build.ts
+++ b/server/plugins/sitePlugins/build.ts
@@ -22,6 +22,7 @@ import {
   sitePluginFolder,
 } from '@core/site-plugins'
 import { getErrorMessage } from '@core/utils/errorMessage'
+import { createKeyedSerializer } from '../../util/keyedSerial'
 import { materializeSitePluginWorkspace } from './workspace'
 
 /**
@@ -68,19 +69,10 @@ export interface SitePluginBuildFailure {
 export type SitePluginBuildResult = SitePluginBuildSuccess | SitePluginBuildFailure
 
 // Single-flight per localId — later builds chain behind earlier ones.
-const inflight = new Map<string, Promise<unknown>>()
+const serializeBuild = createKeyedSerializer()
 
 export function buildSitePlugin(input: SitePluginBuildInput): Promise<SitePluginBuildResult> {
-  const previous = inflight.get(input.localId) ?? Promise.resolve()
-  const next = previous.then(
-    () => runBuild(input),
-    () => runBuild(input),
-  )
-  inflight.set(input.localId, next)
-  void next.finally(() => {
-    if (inflight.get(input.localId) === next) inflight.delete(input.localId)
-  })
-  return next
+  return serializeBuild(input.localId, () => runBuild(input))
 }
 
 async function runBuild(input: SitePluginBuildInput): Promise<SitePluginBuildResult> {
diff --git a/server/publish/bakeDataRows.ts b/server/publish/bakeDataRows.ts
index 146c96393..c96d1907e 100644
--- a/server/publish/bakeDataRows.ts
+++ b/server/publish/bakeDataRows.ts
@@ -30,10 +30,24 @@ import {
 } from '../repositories/data/publish'
 import { renderPublishedDataRowTemplate } from './publicRenderer'
 import { applyPublishedHtmlPipeline } from './publishedHtmlPipeline'
-import { writeArtefact } from './staticArtefact'
 import { getLatestSnapshotForVersion } from './publishedSnapshotCache'
 import { snapshotForEntryRoute } from './entryTemplateSnapshot'
 
+export interface DataRowBakeTarget {
+  /**
+   * The publish version the baked shells must carry — the NEXT version for
+   * a full publish (the bake runs before `bumpPublishVersion()`), and
+   * likewise for an in-place republish that bumps right after.
+   */
+  publishVersion: number
+  /**
+   * Where each route's HTML goes: `writeArtefact` into the inactive slot
+   * for a full publish, `updateArtefactInPlace` into the active slot for a
+   * republish. The render path is identical either way.
+   */
+  write: (urlPath: string, html: string) => Promise<void>
+}
+
 interface DataRowBakeResult {
   /** Routes successfully baked into the slot. */
   baked: number
@@ -51,20 +65,22 @@ function publicRowPath(routeBase: string, slug: string): string {
 }
 
 /**
- * Bake every published data-row route into `slotDir`. Called by the full
- * publish AFTER its transaction commits (the row list and snapshot reads see
- * the freshly-committed publish) and BEFORE the slot swap.
+ * Bake every published data-row route through `target.write`. The full
+ * publish calls this AFTER its transaction commits (the row list and
+ * snapshot reads see the freshly-committed publish) and BEFORE the slot
+ * swap; a site plugin activation calls it to refresh the active slot in
+ * place.
  *
- * `publishVersion` is the NEXT publish version — the bake runs before
- * `bumpPublishVersion()`, so baked hole shells must carry the version that
- * becomes current at the swap. Passing it to the versioned snapshot memo
- * also pre-warms the cache visitors are about to read.
+ * `target.publishVersion` is the version that becomes current at the
+ * caller's swap or bump, so baked hole shells are never stamped stale.
+ * Passing it to the versioned snapshot memo also pre-warms the cache
+ * visitors are about to read.
  */
 export async function bakePublishedDataRowArtefacts(
   db: DbClient,
-  slotDir: string,
-  publishVersion: number,
+  target: DataRowBakeTarget,
 ): Promise<DataRowBakeResult> {
+  const { publishVersion } = target
   const result: DataRowBakeResult = { baked: 0, cssBundles: [] }
 
   const routes = await listPublishedRowRoutes(db)
@@ -102,7 +118,7 @@ export async function bakePublishedDataRowArtefacts(
       })
       if (!rendered) continue
       const html = await applyPublishedHtmlPipeline(rendered, db)
-      await writeArtefact(slotDir, urlPath, html)
+      await target.write(urlPath, html)
       result.cssBundles.push(rendered.cssBundle)
       result.baked++
     } catch (err) {
diff --git a/server/publish/publishSite.ts b/server/publish/publishSite.ts
index 913b40ca0..09bdaec0a 100644
--- a/server/publish/publishSite.ts
+++ b/server/publish/publishSite.ts
@@ -294,7 +294,10 @@ async function publishDraftSiteLocked(
       // template bakes into the same slot. Without this the slot swap would
       // strand every previously-baked row artefact in the inactive slot and
       // ALL row routes would fall to the live renderer after a full publish.
-      const rowBake = await bakePublishedDataRowArtefacts(db, slotDir, nextPublishVersion)
+      const rowBake = await bakePublishedDataRowArtefacts(db, {
+        publishVersion: nextPublishVersion,
+        write: (urlPath, html) => writeArtefact(slotDir, urlPath, html),
+      })
       for (const cssBundle of rowBake.cssBundles) collectCssFiles(cssBundle)
 
       for (const [publicPath, bytes] of assetsByPath) {
diff --git a/server/publish/republish.ts b/server/publish/republish.ts
index b5f79d898..261c3caeb 100644
--- a/server/publish/republish.ts
+++ b/server/publish/republish.ts
@@ -17,6 +17,7 @@
 
 import type { DbClient } from '../db/client'
 import { getPublishedPageSnapshotById } from '../repositories/publish'
+import { bakePublishedDataRowArtefacts } from './bakeDataRows'
 import { renderPublishedSnapshot } from './publicRenderer'
 import { applyPublishedHtmlPipeline } from './publishedHtmlPipeline'
 import { updateArtefactInPlace } from './staticArtefact'
@@ -48,7 +49,12 @@ class PageNotPublishedError extends Error {
  * Throws `PageNotPublishedError` if the page is not found or is not
  * currently published.
  */
-async function republishSinglePage(db: DbClient, pageId: string, uploadsDir?: string): Promise<void> {
+async function republishSinglePage(
+  db: DbClient,
+  pageId: string,
+  uploadsDir?: string,
+  publishVersion?: number,
+): Promise<void> {
   // Typed read through the publish repository — the snapshot column is parsed
   // by the DbClient (`*_json` auto-parse) and typed as `PublishedPageSnapshot`,
   // so there is no boundary cast here.
@@ -65,7 +71,11 @@ async function republishSinglePage(db: DbClient, pageId: string, uploadsDir?: st
   // Drive the full pipeline (publish.before → frontend.assets injection →
   // publish.html filter → publish.after) — plugin hook listeners and
   // filters catch up on pages published before the plugin was activated.
-  const rendered = await renderPublishedSnapshot(snapshot, { db, url: syntheticUrl })
+  const rendered = await renderPublishedSnapshot(snapshot, {
+    db,
+    url: syntheticUrl,
+    ...(publishVersion !== undefined ? { publishVersion } : {}),
+  })
   const html = await applyPublishedHtmlPipeline(rendered, db)
 
   // Re-bake the Layer-A static artefact when the caller owns an uploads dir.
@@ -82,10 +92,18 @@ async function republishSinglePage(db: DbClient, pageId: string, uploadsDir?: st
  * Republish every currently-published page. Iterates all published pages and
  * calls `republishSinglePage` for each. Returns the total count published.
  *
+ * `publishVersion` is the version the re-baked shells must carry when the
+ * caller bumps the counter right after (site plugin activation does; the
+ * plugin-host `republishAll` does not and leaves it unset).
+ *
  * Errors for individual pages are logged and do not abort the batch — the
  * count reflects pages that completed without error.
  */
-export async function republishAllPages(db: DbClient, uploadsDir?: string): Promise<number> {
+export async function republishAllPages(
+  db: DbClient,
+  uploadsDir?: string,
+  publishVersion?: number,
+): Promise<number> {
   const { rows } = await db<{ id: string }>`
     select id
     from data_rows
@@ -95,7 +113,9 @@ export async function republishAllPages(db: DbClient, uploadsDir?: string): Prom
       and deleted_at is null
     order by created_at asc
   `
-  const results = await Promise.allSettled(rows.map(row => republishSinglePage(db, row.id, uploadsDir)))
+  const results = await Promise.allSettled(
+    rows.map((row) => republishSinglePage(db, row.id, uploadsDir, publishVersion)),
+  )
   let count = 0
   for (const [i, result] of results.entries()) {
     if (result.status === 'fulfilled') {
@@ -106,3 +126,22 @@ export async function republishAllPages(db: DbClient, uploadsDir?: string): Prom
   }
   return count
 }
+
+/**
+ * Re-bake every published data-row route (entry-template pages such as
+ * `/posts/hello`) into the ACTIVE slot in place. The page republish above
+ * never touches these — they are produced by the data-row bake — so a site
+ * plugin activation that changes visitor-facing assets must run both before
+ * the old revision is swept. Returns the number of routes re-baked.
+ */
+export async function republishAllDataRows(
+  db: DbClient,
+  uploadsDir: string,
+  publishVersion: number,
+): Promise<number> {
+  const result = await bakePublishedDataRowArtefacts(db, {
+    publishVersion,
+    write: (urlPath, html) => updateArtefactInPlace(uploadsDir, urlPath, html),
+  })
+  return result.baked
+}
diff --git a/server/util/keyedSerial.ts b/server/util/keyedSerial.ts
new file mode 100644
index 000000000..0749bf34a
--- /dev/null
+++ b/server/util/keyedSerial.ts
@@ -0,0 +1,27 @@
+/**
+ * Per-key promise-chain serializer. Calls for the same key run one after
+ * another in arrival order; calls for different keys run concurrently. A
+ * rejected call does not block the ones queued behind it. JS is
+ * single-threaded, so a promise chain is a sufficient lock — the same
+ * shape `withPublishLock` uses for the one global publish key.
+ *
+ * Used to serialize site plugin builds and lifecycle transitions per plugin
+ * id: two overlapping activations must not both read the same row version,
+ * derive the same next version, and race the upgrade path.
+ */
+export type KeyedSerializer = <T>(key: string, fn: () => Promise<T>) => Promise<T>
+
+export function createKeyedSerializer(): KeyedSerializer {
+  const chains = new Map<string, Promise<unknown>>()
+  return <T>(key: string, fn: () => Promise<T>): Promise<T> => {
+    const previous = chains.get(key) ?? Promise.resolve()
+    const run = (): Promise<T> => fn()
+    const next = previous.then(run, run)
+    chains.set(key, next)
+    const release = (): void => {
+      if (chains.get(key) === next) chains.delete(key)
+    }
+    next.then(release, release)
+    return next
+  }
+}
diff --git a/src/__tests__/server/keyedSerial.test.ts b/src/__tests__/server/keyedSerial.test.ts
new file mode 100644
index 000000000..9aaa0a8d4
--- /dev/null
+++ b/src/__tests__/server/keyedSerial.test.ts
@@ -0,0 +1,70 @@
+/**
+ * Per-key promise serializer — same-key calls run one at a time in order,
+ * different keys interleave, and a rejection never blocks the queue.
+ */
+import { describe, expect, test } from 'bun:test'
+import { createKeyedSerializer } from '../../../server/util/keyedSerial'
+
+function deferred<T>(): { promise: Promise<T>; resolve: (value: T) => void; reject: (err: unknown) => void } {
+  let resolve!: (value: T) => void
+  let reject!: (err: unknown) => void
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res
+    reject = rej
+  })
+  return { promise, resolve, reject }
+}
+
+describe('createKeyedSerializer', () => {
+  test('same-key calls never overlap and keep arrival order', async () => {
+    const serialize = createKeyedSerializer()
+    const events: string[] = []
+    const first = deferred<void>()
+
+    const a = serialize('plugin', async () => {
+      events.push('a:start')
+      await first.promise
+      events.push('a:end')
+      return 'a'
+    })
+    const b = serialize('plugin', async () => {
+      events.push('b:start')
+      return 'b'
+    })
+
+    await Promise.resolve()
+    expect(events).toEqual(['a:start'])
+    first.resolve()
+    expect(await a).toBe('a')
+    expect(await b).toBe('b')
+    expect(events).toEqual(['a:start', 'a:end', 'b:start'])
+  })
+
+  test('different keys run concurrently', async () => {
+    const serialize = createKeyedSerializer()
+    const gate = deferred<void>()
+    const events: string[] = []
+
+    const a = serialize('one', async () => {
+      events.push('one')
+      await gate.promise
+    })
+    const b = serialize('two', async () => {
+      events.push('two')
+    })
+    await b
+    expect(events).toEqual(['one', 'two'])
+    gate.resolve()
+    await a
+  })
+
+  test('a rejected call surfaces to its caller and does not block the next one', async () => {
+    const serialize = createKeyedSerializer()
+    const failing = serialize('plugin', async () => {
+      throw new Error('boom')
+    })
+    const following = serialize('plugin', async () => 'ok')
+    await expect(failing).rejects.toThrow('boom')
+    expect(await following).toBe('ok')
+  })
+})

From 22eb4d3c8090c0740b94451dd53c5da7bbed5b64 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Wed, 2 Sep 2026 17:19:22 +0200
Subject: [PATCH 21/36] fix(code-editor): keep CodeMirror history out of the
 co-edited buffer

basicSetup put history() and its Mod-z binding ahead of the Yjs undo keymap,
so remote peers' deltas entered local history and Cmd+Z reverted a peer's
typing (and broadcast the revert). The base stack is now spelled out from the
@codemirror packages with a localHistory switch; the collab buffer mounts
without history() and gives the Y.UndoManager keymap high precedence. The
codemirror meta-package is no longer imported and is dropped.
---
 bun.lock                                      | 15 +---
 package.json                                  |  3 +-
 .../site/code-editor/CodeMirrorEditor.tsx     | 12 ++-
 .../code-editor/CollabCodeMirrorEditor.tsx    | 13 ++--
 .../site/code-editor/codeMirrorShared.ts      | 77 ++++++++++++++++++-
 5 files changed, 96 insertions(+), 24 deletions(-)

diff --git a/bun.lock b/bun.lock
index 80e85e181..3547be558 100644
--- a/bun.lock
+++ b/bun.lock
@@ -6,6 +6,7 @@
       "name": "instatic",
       "dependencies": {
         "@codemirror/autocomplete": "^6.20.1",
+        "@codemirror/commands": "^6.10.3",
         "@codemirror/lang-css": "^6.3.1",
         "@codemirror/lang-html": "^6.4.11",
         "@codemirror/lang-javascript": "^6.2.5",
@@ -14,6 +15,7 @@
         "@codemirror/language": "^6.12.3",
         "@codemirror/lint": "^6.9.5",
         "@codemirror/merge": "^6.12.2",
+        "@codemirror/search": "^6.7.0",
         "@codemirror/state": "^6.6.0",
         "@dnd-kit/core": "^6.3.1",
         "@fontsource-variable/inter": "^5.2.8",
@@ -34,7 +36,6 @@
         "@tiptap/suggestion": "^3",
         "@use-gesture/react": "^10.3.1",
         "blurhash": "^2.0.5",
-        "codemirror": "^6.0.2",
         "dompurify": "^3.4.2",
         "esbuild": "^0.28.0",
         "fflate": "^0.8.2",
@@ -902,8 +903,6 @@
 
     "clone": ["clone@1.0.4", "", {}, "sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg=="],
 
-    "codemirror": ["codemirror@6.0.2", "", { "dependencies": { "@codemirror/autocomplete": "^6.0.0", "@codemirror/commands": "^6.0.0", "@codemirror/language": "^6.0.0", "@codemirror/lint": "^6.0.0", "@codemirror/search": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.0.0" } }, "sha512-VhydHotNW5w1UGK0Qj96BwSk/Zqbp9WbnyK2W/eVMv4QyF41INRGpjUhFJY7/uDNuudSc33a/PKr4iDqRduvHw=="],
-
     "color-convert": ["color-convert@2.0.1", "", { "dependencies": { "color-name": "~1.1.4" } }, "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ=="],
 
     "color-name": ["color-name@1.1.4", "", {}, "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="],
@@ -1762,12 +1761,6 @@
 
     "@types/node/undici-types": ["undici-types@7.18.2", "", {}, "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w=="],
 
-    "@typescript-eslint/eslint-plugin/ignore": ["ignore@7.0.8", "", {}, "sha512-YYNsSlXBjMk92SKnkwvB5LOVSa6OznlFUGcsvrFgNJbJCd0M1XKeFVRc8ZByeCqz32FivYNHJVooLmdqrmvp/Q=="],
-
-    "acorn-loose/acorn": ["acorn@8.18.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ=="],
-
-    "acorn-walk/acorn": ["acorn@8.18.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ=="],
-
     "ajv-formats/ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
 
     "chalk/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
@@ -1796,8 +1789,6 @@
 
     "eslint-plugin-react-compiler/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
-    "espree/acorn": ["acorn@8.18.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ=="],
-
     "fast-glob/glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
 
     "filing-cabinet/commander": ["commander@12.1.0", "", {}, "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="],
@@ -1806,8 +1797,6 @@
 
     "global-directory/ini": ["ini@4.1.1", "", {}, "sha512-QQnnxNyfvmHFIsj7gkPcYymR8Jdw/o7mp5ZFihxn6h8Ci6fh3Dx4E1gPjpQEpIuPo9XVNY/ZUwh4BPMjGyL01g=="],
 
-    "globby/ignore": ["ignore@7.0.8", "", {}, "sha512-YYNsSlXBjMk92SKnkwvB5LOVSa6OznlFUGcsvrFgNJbJCd0M1XKeFVRc8ZByeCqz32FivYNHJVooLmdqrmvp/Q=="],
-
     "is-expression/acorn": ["acorn@7.4.1", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A=="],
 
     "jscpd/commander": ["commander@15.0.0", "", {}, "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg=="],
diff --git a/package.json b/package.json
index 567be9315..2ec39cbff 100644
--- a/package.json
+++ b/package.json
@@ -61,6 +61,7 @@
   },
   "dependencies": {
     "@codemirror/autocomplete": "^6.20.1",
+    "@codemirror/commands": "^6.10.3",
     "@codemirror/lang-css": "^6.3.1",
     "@codemirror/lang-html": "^6.4.11",
     "@codemirror/lang-javascript": "^6.2.5",
@@ -69,6 +70,7 @@
     "@codemirror/language": "^6.12.3",
     "@codemirror/lint": "^6.9.5",
     "@codemirror/merge": "^6.12.2",
+    "@codemirror/search": "^6.7.0",
     "@codemirror/state": "^6.6.0",
     "@dnd-kit/core": "^6.3.1",
     "@fontsource-variable/inter": "^5.2.8",
@@ -89,7 +91,6 @@
     "@tiptap/suggestion": "^3",
     "@use-gesture/react": "^10.3.1",
     "blurhash": "^2.0.5",
-    "codemirror": "^6.0.2",
     "dompurify": "^3.4.2",
     "esbuild": "^0.28.0",
     "fflate": "^0.8.2",
diff --git a/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx b/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
index fc1d2b4c9..bdfe4da91 100644
--- a/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
+++ b/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
@@ -29,7 +29,7 @@
  */
 
 import { useRef, useEffect, useEffectEvent, useCallback } from 'react'
-import { EditorView, basicSetup } from 'codemirror'
+import { EditorView } from '@codemirror/view'
 import { EditorState } from '@codemirror/state'
 import { syntaxHighlighting } from '@codemirror/language'
 import {
@@ -51,6 +51,7 @@ import type {
 } from './typescriptProtocol'
 import { renderMarkdownDocumentation } from './markdownDocumentation'
 import {
+  editingSetup,
   editorChromeTheme,
   getLanguageExtensions,
   readableHighlightStyle,
@@ -96,6 +97,12 @@ interface CodeMirrorEditorProps {
    * change (which remounts the view).
    */
   extensions?: Extension[]
+  /**
+   * Whether the buffer keeps CodeMirror's own undo history (default). The
+   * co-edited buffer passes false: its undo is the Y.UndoManager, and a
+   * local history would record remote peers' edits as undoable steps.
+   */
+  localHistory?: boolean
   /** Authoritative publisher-compiler diagnostics for this document. */
   diagnostics?: SiteRuntimeDiagnostic[]
   /** Site-relative path used by the TypeScript language-service project. */
@@ -252,6 +259,7 @@ export default function CodeMirrorEditor({
   projectFiles = EMPTY_PROJECT_FILES,
   onTypeScriptDiagnosticsChange,
   extensions,
+  localHistory = true,
 }: CodeMirrorEditorProps) {
   const containerRef = useRef<HTMLDivElement | null>(null)
   const viewRef = useRef<EditorView | null>(null)
@@ -311,7 +319,7 @@ export default function CodeMirrorEditor({
       state: EditorState.create({
         doc: value,
         extensions: [
-          basicSetup,
+          ...editingSetup({ localHistory }),
           ...getLanguageExtensions(language),
           ...(typeScriptClient && filePath
             ? [
diff --git a/src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx b/src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx
index 67f583b2c..ad84bdc27 100644
--- a/src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx
+++ b/src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx
@@ -7,11 +7,13 @@
  * y-codemirror.next's `yCollab` extension: local keystrokes splice the
  * bound Y.Text, remote peers' edits apply character-precise, and their
  * carets/selections render inline colored by each peer's awareness
- * identity. Undo is the passed Y.UndoManager — local-only by construction.
+ * identity. Undo is the passed Y.UndoManager — local-only by construction:
+ * the base editor mounts WITHOUT its own `history()` (which would record
+ * remote deltas as undoable steps), and the Y undo keymap takes precedence
+ * over every other Mod-z binding in the stack.
  */
-import { keymap } from '@codemirror/view'
-import { EditorState, type Extension } from '@codemirror/state'
-import { EditorView } from 'codemirror'
+import { EditorView, keymap } from '@codemirror/view'
+import { EditorState, Prec, type Extension } from '@codemirror/state'
 import type * as Y from 'yjs'
 import type { Awareness } from 'y-protocols/awareness'
 import { yCollab, yUndoManagerKeymap } from 'y-codemirror.next'
@@ -96,7 +98,7 @@ export default function CollabCodeMirrorEditor({
   // Recomputed per render is fine: CodeMirrorEditor captures `value` and
   // `extensions` at mount and only remounts when `docKey` changes.
   const extensions: Extension[] = [
-    keymap.of(yUndoManagerKeymap),
+    Prec.high(keymap.of(yUndoManagerKeymap)),
     yCollab(text, awareness, { undoManager }),
     remotePeerTheme,
     ...(readOnly ? [EditorState.readOnly.of(true), EditorView.editable.of(false)] : []),
@@ -111,6 +113,7 @@ export default function CollabCodeMirrorEditor({
       // onChange stays a no-op so nothing double-writes.
       onChange={() => {}}
       extensions={extensions}
+      localHistory={false}
     />
   )
 }
diff --git a/src/admin/pages/site/code-editor/codeMirrorShared.ts b/src/admin/pages/site/code-editor/codeMirrorShared.ts
index 25fff41ec..3e5f36805 100644
--- a/src/admin/pages/site/code-editor/codeMirrorShared.ts
+++ b/src/admin/pages/site/code-editor/codeMirrorShared.ts
@@ -8,15 +8,86 @@
  * This module imports CodeMirror packages and is therefore part of the
  * lazy-loaded editor chunk graph — listed in the codemirror-lazy-only gate.
  */
-import { EditorView } from '@codemirror/view'
-import { HighlightStyle } from '@codemirror/language'
+import {
+  EditorView,
+  crosshairCursor,
+  drawSelection,
+  dropCursor,
+  highlightActiveLine,
+  highlightActiveLineGutter,
+  highlightSpecialChars,
+  keymap,
+  lineNumbers,
+  rectangularSelection,
+} from '@codemirror/view'
+import { EditorState, type Extension } from '@codemirror/state'
+import {
+  HighlightStyle,
+  bracketMatching,
+  defaultHighlightStyle,
+  foldGutter,
+  foldKeymap,
+  indentOnInput,
+  syntaxHighlighting,
+} from '@codemirror/language'
+import { defaultKeymap, history, historyKeymap } from '@codemirror/commands'
+import { highlightSelectionMatches, searchKeymap } from '@codemirror/search'
+import {
+  autocompletion,
+  closeBrackets,
+  closeBracketsKeymap,
+  completionKeymap,
+} from '@codemirror/autocomplete'
+import { lintKeymap } from '@codemirror/lint'
 import { javascript } from '@codemirror/lang-javascript'
 import { css } from '@codemirror/lang-css'
 import { json } from '@codemirror/lang-json'
 import { markdown } from '@codemirror/lang-markdown'
 import { html } from '@codemirror/lang-html'
 import { tags as t } from '@lezer/highlight'
-import type { Extension } from '@codemirror/state'
+
+/**
+ * The editor's base extension stack — `codemirror`'s `basicSetup`, spelled
+ * out so the LOCAL undo history can be left out.
+ *
+ * The co-edited buffer must not carry CodeMirror's own `history()`: the
+ * Yjs binding dispatches remote peers' deltas as ordinary transactions,
+ * `history()` records them as undoable steps, and Cmd+Z would revert a
+ * peer's typing — then broadcast the revert. That buffer gets its undo from
+ * `Y.UndoManager` through y-codemirror's keymap instead, which only ever
+ * tracks local origins. Everything else (gutters, folding, brackets,
+ * completion, search) is identical between the two editors.
+ */
+export function editingSetup(options: { localHistory: boolean }): Extension[] {
+  return [
+    lineNumbers(),
+    highlightActiveLineGutter(),
+    highlightSpecialChars(),
+    ...(options.localHistory ? [history()] : []),
+    foldGutter(),
+    drawSelection(),
+    dropCursor(),
+    EditorState.allowMultipleSelections.of(true),
+    indentOnInput(),
+    syntaxHighlighting(defaultHighlightStyle, { fallback: true }),
+    bracketMatching(),
+    closeBrackets(),
+    autocompletion(),
+    rectangularSelection(),
+    crosshairCursor(),
+    highlightActiveLine(),
+    highlightSelectionMatches(),
+    keymap.of([
+      ...closeBracketsKeymap,
+      ...defaultKeymap,
+      ...searchKeymap,
+      ...(options.localHistory ? historyKeymap : []),
+      ...foldKeymap,
+      ...completionKeymap,
+      ...lintKeymap,
+    ]),
+  ]
+}
 
 
 // ---------------------------------------------------------------------------

From 9e1086522439fe35dae007b793f915fe16f54a0d Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Wed, 2 Sep 2026 17:19:24 +0200
Subject: [PATCH 22/36] fix(plugin-ide): gate writes on sync, rebind after
 relay resets, gate lifecycle actions

A file created before the server's initial sync built an empty files map
client-side; the server seeds with client id 1, so that map won the merge and
the persisted shell lost every other site file. Every mutating session method
now throws IdeNotSyncedError until synced, the file tree keeps New file,
rename and delete disabled with the reason, and the agent bridge answers
"still connecting".

A relay reset (scaffold, delete, settings save, import) destroyed the bound
doc while the IDE kept typing into it. The session now rebinds, bumps a
generation the buffer remounts on, drops the undo managers that referenced
the dead text, and the editor reads the live Y.Text through a sync
subscription so the compiler cannot hand back the destroyed instance. The
auto-select effect ignores the empty list during the reset window instead of
jumping to the manifest.

Deactivate, Restart and Activate are gated on plugins.lifecycle with an
inline reason, matching the server. The bridge's patch tool rides the shared
verbatim replacement engine and re-reads the live text after the digest.
---
 src/__tests__/agent/pluginBridge.test.ts      |  40 ++++-
 src/admin/pages/plugins/ide/FileTreePane.tsx  |  23 ++-
 src/admin/pages/plugins/ide/IdeActions.tsx    |  40 +++--
 src/admin/pages/plugins/ide/IdeFileEditor.tsx |  25 ++-
 .../pages/plugins/ide/SitePluginIdePage.tsx   |  19 ++-
 .../pages/plugins/ide/agent/pluginBridge.ts   |  54 +++----
 src/admin/pages/plugins/ide/ideCollab.ts      | 144 +++++++++++++-----
 .../pages/plugins/ide/useSitePluginIde.ts     |  23 +--
 8 files changed, 266 insertions(+), 102 deletions(-)

diff --git a/src/__tests__/agent/pluginBridge.test.ts b/src/__tests__/agent/pluginBridge.test.ts
index 26de2bf6f..da2442c0e 100644
--- a/src/__tests__/agent/pluginBridge.test.ts
+++ b/src/__tests__/agent/pluginBridge.test.ts
@@ -26,6 +26,7 @@ interface FakeIde {
   contentOf(fileId: string): string
   selected: string[]
   canEdit: boolean
+  synced: boolean
 }
 
 function createFakeIde(seed: Record<string, string>): FakeIde {
@@ -47,9 +48,14 @@ function createFakeIde(seed: Record<string, string>): FakeIde {
     addFile(`${FOLDER}${relative}`, content)
   }
 
-  const state: { selected: string[]; canEdit: boolean } = { selected: [], canEdit: true }
+  const state: { selected: string[]; canEdit: boolean; synced: boolean } = {
+    selected: [],
+    canEdit: true,
+    synced: true,
+  }
 
   const session = {
+    synced: () => state.synced,
     contentText: (fileId: string) => texts.get(fileId) ?? null,
     createFile: (path: string, content?: string) => addFile(path, content ?? ''),
     renameFile: (fileId: string, nextPath: string) => {
@@ -94,6 +100,12 @@ function createFakeIde(seed: Record<string, string>): FakeIde {
     get canEdit() {
       return state.canEdit
     },
+    set synced(value: boolean) {
+      state.synced = value
+    },
+    get synced() {
+      return state.synced
+    },
   }
 }
 
@@ -170,6 +182,32 @@ describe('plugin bridge dispatcher', () => {
     expect(stale.error).toContain('Hash mismatch')
   })
 
+  test('patch inserts replacement text verbatim — dollar patterns are never interpreted', async () => {
+    await executePluginTool('plugin_write_file', {
+      path: 'price.ts',
+      content: 'const p = html`<p>${props.price}</p>`\n',
+    })
+    const hash = await readHash('price.ts')
+    const patched = await executePluginTool('plugin_patch_file', {
+      path: 'price.ts',
+      expectedHash: hash,
+      replacements: [{ oldText: '${props.price}', newText: '$${props.price}' }],
+    })
+    expect(patched.ok).toBe(true)
+    const meta = ide.metas.find((entry) => entry.path === `${FOLDER}price.ts`)!
+    expect(ide.contentOf(meta.id)).toBe('const p = html`<p>$${props.price}</p>`\n')
+  })
+
+  test('every tool waits for the initial sync', async () => {
+    ide.synced = false
+    const read = await executePluginTool('plugin_read_file', { path: 'plugin.json' })
+    expect(read.ok).toBe(false)
+    if (!read.ok) expect(read.error).toContain('still connecting')
+    const write = await executePluginTool('plugin_write_file', { path: 'early.ts', content: '' })
+    expect(write.ok).toBe(false)
+    expect(ide.metas.some((entry) => entry.path === `${FOLDER}early.ts`)).toBe(false)
+  })
+
   test('ambiguous replacements require replaceAll', async () => {
     await executePluginTool('plugin_write_file', { path: 'notes.ts', content: 'aa aa\n' })
     const hash = await readHash('notes.ts')
diff --git a/src/admin/pages/plugins/ide/FileTreePane.tsx b/src/admin/pages/plugins/ide/FileTreePane.tsx
index c0e8dc605..0e5c03419 100644
--- a/src/admin/pages/plugins/ide/FileTreePane.tsx
+++ b/src/admin/pages/plugins/ide/FileTreePane.tsx
@@ -97,6 +97,12 @@ interface FileTreePaneProps {
   activeFileId: string | null
   peers: IdePeer[]
   canEdit: boolean
+  /**
+   * False until the live draft has synced. Creating, renaming, or deleting
+   * before that would write into an unseeded doc — the session refuses it,
+   * and the tree keeps the controls disabled with the reason.
+   */
+  ready: boolean
   onSelect: (fileId: string) => void
   onCreate: (relativePath: string) => void
   onRename: (fileId: string, relativePath: string) => void
@@ -110,6 +116,7 @@ export function FileTreePane({
   activeFileId,
   peers,
   canEdit,
+  ready,
   onSelect,
   onCreate,
   onRename,
@@ -117,6 +124,12 @@ export function FileTreePane({
   onClose,
 }: FileTreePaneProps) {
   const folder = sitePluginFolder(localId)
+  const canMutate = canEdit && ready
+  const mutateBlockedReason = !canEdit
+    ? 'Requires the plugins.edit permission'
+    : !ready
+      ? 'Connecting to the live draft…'
+      : null
   const [collapsed, setCollapsed] = useState<ReadonlySet<string>>(new Set())
   const [pendingNew, setPendingNew] = useState<string | null>(null) // parent folder ('' = root)
   const [renamingFileId, setRenamingFileId] = useState<string | null>(null)
@@ -141,7 +154,7 @@ export function FileTreePane({
   }
 
   const openMenu = (event: MouseEvent, entry: TreeEntry): void => {
-    if (!canEdit) return
+    if (!canMutate) return
     event.preventDefault()
     event.stopPropagation()
     setMenu({ x: event.clientX, y: event.clientY, entry })
@@ -192,8 +205,8 @@ export function FileTreePane({
           size="xs"
           iconOnly
           aria-label="New file"
-          tooltip={canEdit ? 'New file' : 'Editing requires the site structure permission'}
-          disabled={!canEdit}
+          tooltip={mutateBlockedReason ?? 'New file'}
+          disabled={!canMutate}
           onClick={() => setPendingNew('')}
           data-testid="ide-new-file"
         >
@@ -241,13 +254,13 @@ export function FileTreePane({
                     }}
                     onContextMenu={(event) => openMenu(event, entry)}
                     onDoubleClick={(event) => {
-                      if (entry.kind !== 'file' || !canEdit) return
+                      if (entry.kind !== 'file' || !canMutate) return
                       event.preventDefault()
                       event.stopPropagation()
                       setRenamingFileId(entry.fileId ?? null)
                     }}
                     onKeyDown={(event) => {
-                      if (event.key === 'F2' && entry.kind === 'file' && canEdit) {
+                      if (event.key === 'F2' && entry.kind === 'file' && canMutate) {
                         event.preventDefault()
                         event.stopPropagation()
                         setRenamingFileId(entry.fileId ?? null)
diff --git a/src/admin/pages/plugins/ide/IdeActions.tsx b/src/admin/pages/plugins/ide/IdeActions.tsx
index c2fb9e08f..717f9ee66 100644
--- a/src/admin/pages/plugins/ide/IdeActions.tsx
+++ b/src/admin/pages/plugins/ide/IdeActions.tsx
@@ -20,7 +20,10 @@ import styles from './IdeActions.module.css'
 interface IdeActionsProps {
   summary: SitePluginSummary | null
   peers: IdePeer[]
+  /** plugins.install — build & activate, rollback, delete. */
   canInstall: boolean
+  /** plugins.lifecycle — enable, deactivate, restart (server-gated + step-up). */
+  canManageLifecycle: boolean
   activating: boolean
   onActivate: () => void
   onPreview: () => void
@@ -37,6 +40,7 @@ export function IdeActions({
   summary,
   peers,
   canInstall,
+  canManageLifecycle,
   activating,
   onActivate,
   onPreview,
@@ -84,8 +88,23 @@ export function IdeActions({
     }
   }
 
-  const needsInstallCap = primary?.action === 'activate' || primary?.action === 'review' || primary?.action === 'enable' || primary?.action === 'delete'
-  const primaryDisabled = activating || (needsInstallCap && !canInstall)
+  // Same split as the server: install-class actions need plugins.install,
+  // enable/disable/restart need plugins.lifecycle.
+  const needsInstallCap =
+    primary?.action === 'activate' || primary?.action === 'review' || primary?.action === 'delete'
+  const needsLifecycleCap = primary?.action === 'enable'
+  const primaryBlockedReason =
+    needsInstallCap && !canInstall
+      ? 'Requires the plugins.install permission'
+      : needsLifecycleCap && !canManageLifecycle
+        ? 'Requires the plugins.lifecycle permission'
+        : null
+  const primaryDisabled = activating || primaryBlockedReason !== null
+  const lifecycleBlockedReason = !canManageLifecycle
+    ? 'Requires the plugins.lifecycle permission'
+    : !summary?.activeVersion
+      ? 'Nothing is activated yet'
+      : null
 
   return (
     <div className={styles.actions}>
@@ -114,11 +133,7 @@ export function IdeActions({
           variant="primary"
           size="sm"
           disabled={primaryDisabled}
-          tooltip={
-            needsInstallCap && !canInstall
-              ? 'Requires the plugins.install permission'
-              : undefined
-          }
+          tooltip={primaryBlockedReason ?? undefined}
           onClick={runPrimary}
           data-testid="ide-primary-action"
         >
@@ -182,8 +197,11 @@ export function IdeActions({
             Rollback to previous revision
           </ContextMenuItem>
           <ContextMenuItem
-            disabled={!summary?.activeVersion || summary.state === 'disabled'}
-            tooltip={!summary?.activeVersion ? 'Nothing is activated yet' : undefined}
+            disabled={lifecycleBlockedReason !== null || summary?.state === 'disabled'}
+            tooltip={
+              lifecycleBlockedReason ??
+              (summary?.state === 'disabled' ? 'Already deactivated' : undefined)
+            }
             onClick={() => {
               onSetEnabled(false)
               setMenuOpen(false)
@@ -192,8 +210,8 @@ export function IdeActions({
             Deactivate
           </ContextMenuItem>
           <ContextMenuItem
-            disabled={!summary?.activeVersion}
-            tooltip={!summary?.activeVersion ? 'Nothing is activated yet' : undefined}
+            disabled={lifecycleBlockedReason !== null}
+            tooltip={lifecycleBlockedReason ?? undefined}
             onClick={() => {
               onRestart()
               setMenuOpen(false)
diff --git a/src/admin/pages/plugins/ide/IdeFileEditor.tsx b/src/admin/pages/plugins/ide/IdeFileEditor.tsx
index a55140197..e2f10c3d6 100644
--- a/src/admin/pages/plugins/ide/IdeFileEditor.tsx
+++ b/src/admin/pages/plugins/ide/IdeFileEditor.tsx
@@ -6,7 +6,7 @@
  * over the site socket, peers' edits and carets render in place, undo is
  * per-file and local-only.
  */
-import { lazy, Suspense } from 'react'
+import { lazy, Suspense, useSyncExternalStore } from 'react'
 import type { IdeCollabSession } from './ideCollab'
 import { ideLanguageForPath } from './ideLanguage'
 import styles from './SitePluginIdePage.module.css'
@@ -19,11 +19,26 @@ interface IdeFileEditorProps {
   session: IdeCollabSession
   fileId: string
   path: string
+  /**
+   * The session's rebind generation. A relay reset replaces the Y.Text this
+   * buffer is bound to; keying the mount on the generation remounts the
+   * editor onto the fresh text instead of leaving it on the destroyed one.
+   */
+  generation: number
   readOnly: boolean
 }
 
-export function IdeFileEditor({ session, fileId, path, readOnly }: IdeFileEditorProps) {
-  const text = session.contentText(fileId)
+export function IdeFileEditor({ session, fileId, path, generation, readOnly }: IdeFileEditorProps) {
+  // The live Y.Text is read through the session's sync subscription, not as
+  // a plain derived value: a relay reset swaps the underlying doc while
+  // `session` and `fileId` stay the same, so the React Compiler would keep
+  // handing back the memoized, destroyed text. Both snapshots are stable
+  // per binding (map lookups), which is what useSyncExternalStore needs.
+  const text = useSyncExternalStore(session.onSyncChange, () => session.contentText(fileId))
+  const undoManager = useSyncExternalStore(
+    session.onSyncChange,
+    () => (text ? session.undoManagerFor(fileId) : null),
+  )
   if (!text) {
     return <div className={styles.editorEmpty}>This file has no editable text content.</div>
   }
@@ -32,11 +47,11 @@ export function IdeFileEditor({ session, fileId, path, readOnly }: IdeFileEditor
     <Suspense fallback={<div className={styles.editorEmpty}>Loading editor…</div>}>
       <div className={styles.editorMount} data-testid="ide-code-editor">
         <CollabCodeMirrorEditor
-          docKey={fileId}
+          docKey={`${fileId}:${generation}`}
           language={ideLanguageForPath(path)}
           text={text}
           awareness={session.provider.awareness}
-          undoManager={session.undoManagerFor(fileId) ?? false}
+          undoManager={undoManager ?? false}
           readOnly={readOnly}
         />
       </div>
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
index 597e3ad69..d02ee1b3a 100644
--- a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
@@ -16,7 +16,12 @@ import { useEffect, useState } from 'react'
 import { AdminWorkspaceCanvasLayout } from '@admin/layouts/AdminWorkspaceCanvasLayout/AdminWorkspaceCanvasLayout'
 import { useNavigate, useParams } from '@admin/lib/routing'
 import { useAuthenticatedAdminUser } from '@admin/sessionContext'
-import { canEditPlugins, canInstallPlugins, canUseAiChat } from '@admin/access'
+import {
+  canEditPlugins,
+  canInstallPlugins,
+  canManagePluginLifecycle,
+  canUseAiChat,
+} from '@admin/access'
 import { ConfirmDeleteDialog } from '@admin/shared/dialogs/ConfirmDeleteDialog/ConfirmDeleteDialog'
 import { SITE_PLUGIN_LOCAL_ID_PATTERN, sitePluginFolder } from '@core/site-plugins'
 import { useSitePluginIde } from './useSitePluginIde'
@@ -65,6 +70,7 @@ function SitePluginIde({ localId }: { localId: string }) {
   const navigate = useNavigate()
   const canEdit = canEditPlugins(currentUser)
   const canInstall = canInstallPlugins(currentUser)
+  const canManageLifecycle = canManagePluginLifecycle(currentUser)
   const canChat = canUseAiChat(currentUser)
   const [pendingDelete, setPendingDelete] = useState<PendingDelete | null>(null)
   const [reviewOpen, setReviewOpen] = useState(false)
@@ -103,12 +109,16 @@ function SitePluginIde({ localId }: { localId: string }) {
     },
   })
 
-  // Auto-select plugin.json (or the first file) once files arrive.
+  // Auto-select plugin.json (or the first file) once files arrive. Only
+  // while synced: during a relay reset the file list is empty for a moment,
+  // and reacting to that would drop the active buffer and land the user in
+  // the manifest when the reseeded doc (same file ids) comes back.
   useEffect(() => {
+    if (!vm.synced) return
     if (activeFileId && files.some((file) => file.id === activeFileId)) return
     const manifest = files.find((file) => file.path === `${folder}plugin.json`)
     selectFile(manifest?.id ?? files[0]?.id ?? null)
-  }, [files, activeFileId, folder, selectFile])
+  }, [vm.synced, files, activeFileId, folder, selectFile])
 
   // Cmd+S — there is nothing to save (edits persist live); honor the muscle
   // memory by re-running diagnostics instead of the browser save dialog.
@@ -140,6 +150,7 @@ function SitePluginIde({ localId }: { localId: string }) {
               activeFileId={activeFileId}
               peers={peers}
               canEdit={canEdit}
+              ready={vm.synced}
               onSelect={selectFile}
               onCreate={(relativePath) => {
                 if (!session) return
@@ -177,6 +188,7 @@ function SitePluginIde({ localId }: { localId: string }) {
                 session={session}
                 fileId={activeFile.id}
                 path={activeFile.path}
+                generation={vm.generation}
                 readOnly={!canEdit}
               />
             ) : (
@@ -200,6 +212,7 @@ function SitePluginIde({ localId }: { localId: string }) {
             summary={vm.summary}
             peers={peers}
             canInstall={canInstall}
+            canManageLifecycle={canManageLifecycle}
             activating={vm.activating}
             onActivate={() => {
               // Grant-changing activations are consent moments — show the
diff --git a/src/admin/pages/plugins/ide/agent/pluginBridge.ts b/src/admin/pages/plugins/ide/agent/pluginBridge.ts
index 1f9c684f5..333493edf 100644
--- a/src/admin/pages/plugins/ide/agent/pluginBridge.ts
+++ b/src/admin/pages/plugins/ide/agent/pluginBridge.ts
@@ -22,6 +22,7 @@
 import {
   aiToolError,
   aiToolOk,
+  applyExactReplacements,
   PluginDeleteFileInputSchema,
   PluginListFilesInputSchema,
   PluginOpenFileInputSchema,
@@ -63,7 +64,7 @@ function requireCtx(): BridgeCtx | AiToolOutput {
     return aiToolError('The Plugin IDE is not open — open /admin/plugins/develop/<id> first.')
   }
   const session = handle.session()
-  if (!session) {
+  if (!session || !session.synced()) {
     return aiToolError('The Plugin IDE session is still connecting — retry in a moment.')
   }
   return { handle, session, folder: sitePluginFolder(handle.localId) }
@@ -135,16 +136,6 @@ function isManifestFile(ctx: BridgeCtx, file: IdeFileMeta): boolean {
   return file.path === `${ctx.folder}plugin.json`
 }
 
-function countOccurrences(content: string, search: string): number {
-  let count = 0
-  let index = content.indexOf(search)
-  while (index !== -1) {
-    count++
-    index = content.indexOf(search, index + search.length)
-  }
-  return count
-}
-
 // ---------------------------------------------------------------------------
 // Per-tool runners
 // ---------------------------------------------------------------------------
@@ -226,32 +217,29 @@ async function runPatchFile(
     )
   }
 
-  let nextContent = currentContent
-  let replacementCount = 0
-  for (const replacement of input.replacements) {
-    const matches = countOccurrences(nextContent, replacement.oldText)
-    if (matches === 0) {
-      return aiToolError(`Replacement text not found in ${relativePathOf(ctx, resolved.file)}.`)
-    }
-    if (matches > 1 && replacement.replaceAll !== true) {
-      return aiToolError(
-        `Replacement in ${relativePathOf(ctx, resolved.file)} is ambiguous: ${matches} matches. ` +
-          'Use a larger oldText span or set replaceAll:true.',
-      )
-    }
-    if (replacement.replaceAll === true) {
-      nextContent = nextContent.split(replacement.oldText).join(replacement.newText)
-      replacementCount += matches
-    } else {
-      nextContent = nextContent.replace(replacement.oldText, replacement.newText)
-      replacementCount += 1
-    }
+  const applied = applyExactReplacements(currentContent, input.replacements)
+  if (!applied.ok) {
+    const path = relativePathOf(ctx, resolved.file)
+    return aiToolError(
+      applied.reason === 'not-found'
+        ? `Replacement text not found in ${path}.`
+        : `Replacement in ${path} is ambiguous: ${applied.matches} matches. ` +
+            'Use a larger oldText span or set replaceAll:true.',
+    )
+  }
+
+  // The hash check awaited a digest; a remote keystroke that landed in that
+  // window would be reverted by a diff computed from the pre-digest text.
+  if (contentOf(ctx, resolved.file.id) !== currentContent) {
+    return aiToolError(
+      `${relativePathOf(ctx, resolved.file)} changed while patching. Call plugin_read_file again before patching.`,
+    )
   }
 
-  ctx.session.replaceFileContent(resolved.file.id, nextContent)
+  ctx.session.replaceFileContent(resolved.file.id, applied.content)
   return aiToolOk({
     ...(await describeFile(ctx, resolved.file)),
-    replacements: replacementCount,
+    replacements: applied.replaced,
   })
 }
 
diff --git a/src/admin/pages/plugins/ide/ideCollab.ts b/src/admin/pages/plugins/ide/ideCollab.ts
index 150990900..1d11ff515 100644
--- a/src/admin/pages/plugins/ide/ideCollab.ts
+++ b/src/admin/pages/plugins/ide/ideCollab.ts
@@ -10,6 +10,19 @@
  * persists on its debounce and the site editor's projection picks changes
  * up live. Per-file Y.UndoManagers give each buffer its own local-only
  * undo (the yCollab binding registers its origin on them).
+ *
+ * Two lifecycle rules keep the session honest:
+ *   - Nothing writes before the server's initial sync. An unsynced doc has
+ *     no `files` map yet; creating one client-side would win the merge
+ *     (the server seeds with client id 1) and replace EVERY site file with
+ *     the one just created. Every mutating method throws
+ *     `IdeNotSyncedError` until `synced()` is true.
+ *   - A relay reset (`FRAME_RESET` — an out-of-relay shell write such as a
+ *     scaffold, a delete, a settings save, or an import reseeded the doc)
+ *     destroys the bound Y.Doc. The session rebinds immediately, bumps its
+ *     `generation`, and drops the undo managers that referenced the dead
+ *     Y.Text; editors key their mounts on the generation so the buffer
+ *     remounts onto the fresh text instead of typing into a destroyed one.
  */
 import * as Y from 'yjs'
 import {
@@ -26,12 +39,21 @@ import { sitePluginFolder } from '@core/site-plugins'
 import { nanoid } from 'nanoid'
 import {
   createCollabProvider,
+  type BoundCollabDoc,
   type CollabProvider,
 } from '@site/collab/collabProvider'
 
 /** Origin for IDE-local transactions — streamed by the provider (≠ remote). */
 export const IDE_ORIGIN = Symbol('plugin-ide-local')
 
+/** Thrown by every mutating session method before the initial sync lands. */
+export class IdeNotSyncedError extends Error {
+  constructor() {
+    super('The live draft is still connecting — try again in a moment.')
+    this.name = 'IdeNotSyncedError'
+  }
+}
+
 export interface IdeFileMeta {
   id: string
   path: string
@@ -40,9 +62,18 @@ export interface IdeFileMeta {
 
 export interface IdeCollabSession {
   provider: CollabProvider
-  doc: Y.Doc
-  whenSynced: Promise<void>
+  /**
+   * True once the server's initial sync landed for the CURRENT binding —
+   * false again during a relay reset until the reseeded doc arrives.
+   */
   synced(): boolean
+  /** Fires on every sync transition, including the rebind after a reset. */
+  onSyncChange(listener: () => void): () => void
+  /**
+   * Increments on every rebind. Editors key their mounts on it so a reset
+   * remounts the buffer onto the fresh Y.Text.
+   */
+  generation(): number
   /** Metadata of this plugin's files, path-sorted. Content stays in Y.Text. */
   pluginFiles(): IdeFileMeta[]
   onFilesChange(listener: () => void): () => void
@@ -70,21 +101,56 @@ function projectFileMeta(id: string, entry: Y.Map<unknown>): IdeFileMeta {
   }
 }
 
+function notify(listeners: ReadonlySet<() => void>): void {
+  for (const listener of listeners) listener()
+}
+
 export function createIdeCollabSession(localId: string): IdeCollabSession {
   const provider = createCollabProvider()
-  const binding = provider.bind(MAIN_SITE_DOC_ID)
-  const doc = binding.doc
   const folder = sitePluginFolder(localId)
   const filesListeners = new Set<() => void>()
+  const syncListeners = new Set<() => void>()
   const undoManagers = new Map<string, Y.UndoManager>()
-  let observedFilesMap: Y.Map<unknown> | null = null
+  let binding: BoundCollabDoc
+  let generation = 0
+  let destroyed = false
 
-  const notifyFiles = (): void => {
-    for (const listener of filesListeners) listener()
+  const shell = (): Y.Map<unknown> => shellMap(binding.doc)
+
+  // Observe the whole shell deeply — file metadata changes (path renames,
+  // membership) re-notify; pure content keystrokes also fire but the hook
+  // layer collapses them via a metadata signature, so React work stays
+  // proportional to structural changes.
+  const shellObserver = (): void => notify(filesListeners)
+
+  const attach = (): void => {
+    binding = provider.bind(MAIN_SITE_DOC_ID)
+    shell().observeDeep(shellObserver)
+    const bound = binding
+    void bound.whenSynced.then(() => {
+      // A binding unbound by a reset resolves its promise too — only the
+      // current binding's sync is news.
+      if (destroyed || binding !== bound) return
+      notify(syncListeners)
+      notify(filesListeners)
+    })
   }
+  attach()
+
+  const detachReset = provider.onReset((docId) => {
+    if (docId !== SITE_DOC_ID || destroyed) return
+    // The provider already destroyed the old doc; the undo managers hold
+    // its Y.Text instances and must not outlive it.
+    for (const manager of undoManagers.values()) manager.destroy()
+    undoManagers.clear()
+    generation += 1
+    attach()
+    notify(syncListeners)
+    notify(filesListeners)
+  })
 
   const filesMap = (): Y.Map<unknown> | null => {
-    const value = shellMap(doc).get('files')
+    const value = shell().get('files')
     return value instanceof Y.Map ? value : null
   }
 
@@ -92,29 +158,27 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
    * The granular files map, upgrading a legacy LWW-array layout in place —
    * from the EXISTING entries, never an empty map (an empty replacement
    * would project a shell that lost every other site file). Must run
-   * inside a doc transaction.
+   * inside a doc transaction, after sync.
    */
   const ensureFilesMap = (): Y.Map<unknown> => {
-    const shell = shellMap(doc)
-    const value = shell.get('files')
+    const current = shell()
+    const value = current.get('files')
     if (value instanceof Y.Map) return value
-    const map = Array.isArray(value)
-      ? buildSiteFilesMap(value as SiteFile[])
-      : new Y.Map<unknown>()
-    shell.set('files', map)
-    return map
+    if (Array.isArray(value)) {
+      const map = buildSiteFilesMap(value as SiteFile[])
+      current.set('files', map)
+      return map
+    }
+    // Absent after sync means the server seed is broken. Never paper over
+    // it with an empty map — that map would win the merge and erase every
+    // other site file.
+    throw new Error('The live draft has no files map — refusing to write')
   }
 
-  // Observe the whole shell deeply — file metadata changes (path renames,
-  // membership) re-notify; pure content keystrokes also fire but the hook
-  // layer collapses them via a metadata signature, so React work stays
-  // proportional to structural changes.
-  const shellObserver = (): void => {
-    const current = filesMap()
-    if (current !== observedFilesMap) observedFilesMap = current
-    notifyFiles()
+  const assertWritable = (): void => {
+    if (destroyed) throw new Error('The Plugin IDE session is closed')
+    if (!binding.synced) throw new IdeNotSyncedError()
   }
-  shellMap(doc).observeDeep(shellObserver)
 
   /** id/path metas across BOTH layouts (granular map, legacy LWW array). */
   const allFileMetas = (): IdeFileMeta[] => {
@@ -126,7 +190,7 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
       }
       return out
     }
-    const value = shellMap(doc).get('files')
+    const value = shell().get('files')
     if (!Array.isArray(value)) return []
     return (value as SiteFile[]).map((file) => ({
       id: file.id,
@@ -151,9 +215,14 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
 
   return {
     provider,
-    doc,
-    whenSynced: binding.whenSynced,
     synced: () => binding.synced,
+    onSyncChange: (listener) => {
+      syncListeners.add(listener)
+      return () => {
+        syncListeners.delete(listener)
+      }
+    },
+    generation: () => generation,
 
     pluginFiles: () =>
       allFileMetas()
@@ -167,12 +236,12 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
       }
     },
 
-    contentText: (fileId) => siteFileContentText(shellMap(doc), fileId),
+    contentText: (fileId) => siteFileContentText(shell(), fileId),
 
     undoManagerFor: (fileId) => {
       const existing = undoManagers.get(fileId)
       if (existing) return existing
-      const text = siteFileContentText(shellMap(doc), fileId)
+      const text = siteFileContentText(shell(), fileId)
       if (!text) return null
       // Tracks IDE transactions + whatever origins the yCollab binding
       // registers on it; remote peers' edits are never undone locally.
@@ -185,6 +254,7 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
     },
 
     createFile: (rawPath, content = '') => {
+      assertWritable()
       const path = requireSafePluginPath(rawPath)
       if (pathTaken(path)) throw new Error(`A file at "${path}" already exists`)
       const id = nanoid()
@@ -197,16 +267,17 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
         createdAt: now,
         updatedAt: now,
       }
-      doc.transact(() => {
+      binding.doc.transact(() => {
         ensureFilesMap().set(id, buildSiteFileEntry(file))
       }, IDE_ORIGIN)
       return id
     },
 
     renameFile: (fileId, nextPath) => {
+      assertWritable()
       const path = requireSafePluginPath(nextPath)
       if (pathTaken(path, fileId)) throw new Error(`A file at "${path}" already exists`)
-      doc.transact(() => {
+      binding.doc.transact(() => {
         const entry = ensureFilesMap().get(fileId)
         if (!(entry instanceof Y.Map)) return
         entry.set('path', path)
@@ -215,15 +286,17 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
     },
 
     deleteFile: (fileId) => {
+      assertWritable()
       undoManagers.get(fileId)?.destroy()
       undoManagers.delete(fileId)
-      doc.transact(() => {
+      binding.doc.transact(() => {
         ensureFilesMap().delete(fileId)
       }, IDE_ORIGIN)
     },
 
     replaceFileContent: (fileId, content) => {
-      doc.transact(() => {
+      assertWritable()
+      binding.doc.transact(() => {
         const entry = ensureFilesMap().get(fileId)
         if (!(entry instanceof Y.Map)) return
         const text = entry.get('content')
@@ -234,7 +307,8 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
     },
 
     destroy: () => {
-      shellMap(doc).unobserveDeep(shellObserver)
+      destroyed = true
+      detachReset()
       for (const manager of undoManagers.values()) manager.destroy()
       undoManagers.clear()
       provider.destroy()
diff --git a/src/admin/pages/plugins/ide/useSitePluginIde.ts b/src/admin/pages/plugins/ide/useSitePluginIde.ts
index 40bc246a0..123532afc 100644
--- a/src/admin/pages/plugins/ide/useSitePluginIde.ts
+++ b/src/admin/pages/plugins/ide/useSitePluginIde.ts
@@ -33,6 +33,8 @@ export interface SitePluginIdeVm {
   session: IdeCollabSession | null
   files: IdeFileMeta[]
   synced: boolean
+  /** Bumps on every relay reset — the editor buffer remounts on it. */
+  generation: number
   activeFileId: string | null
   selectFile: (fileId: string | null) => void
   summary: SitePluginSummary | null
@@ -56,8 +58,6 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
   // One session per (mounted page, localId) — StrictMode-safe via ref-count
   // free create/destroy in the effect below.
   const [session, setSession] = useState<IdeCollabSession | null>(null)
-  const sessionRef = useRef<IdeCollabSession | null>(null)
-  const [synced, setSynced] = useState(false)
   const [activeFileId, setActiveFileId] = useState<string | null>(null)
   const [summary, setSummary] = useState<SitePluginSummary | null>(null)
   const [diagnostics, setDiagnostics] = useState<string[]>([])
@@ -68,7 +68,6 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
 
   useEffect(() => {
     const created = createIdeCollabSession(localId)
-    sessionRef.current = created
     let alive = true
     // Deferred so the effect body never sets state synchronously (lint rule
     // react-hooks/set-state-in-effect) — one tick is invisible next to the
@@ -76,21 +75,26 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
     const publish = setTimeout(() => {
       if (!alive) return
       setSession(created)
-      setSynced(created.synced())
       setActiveFileId(null)
     }, 0)
-    void created.whenSynced.then(() => {
-      if (!alive) return
-      setSynced(true)
-    })
     return () => {
       alive = false
       clearTimeout(publish)
-      sessionRef.current = null
       created.destroy()
     }
   }, [localId])
 
+  // Sync state and the rebind generation come straight from the session —
+  // both flip on a relay reset (synced → false → true, generation + 1), and
+  // the editor buffer remounts on the generation.
+  // useCallback kept: useSyncExternalStore resubscribes on identity change.
+  const subscribeSync = useCallback(
+    (onStoreChange: () => void) => session?.onSyncChange(onStoreChange) ?? (() => {}),
+    [session],
+  )
+  const synced = useSyncExternalStore(subscribeSync, () => session?.synced() ?? false)
+  const generation = useSyncExternalStore(subscribeSync, () => session?.generation() ?? 0)
+
   // Files metadata via useSyncExternalStore — content keystrokes fire the
   // underlying observer too, so the snapshot is signature-cached and only
   // re-renders on structural/metadata changes.
@@ -297,6 +301,7 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
     session,
     files,
     synced,
+    generation,
     activeFileId,
     selectFile: setActiveFileId,
     summary,

From 4f8c609dc31f302b0454aed0447611577fb4cafc Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Thu, 3 Sep 2026 09:11:58 +0200
Subject: [PATCH 23/36] fix(plugin-build): report bundler positions against the
 author's file

A syntax error in a module file came back as "Failed to bundle
plugins/x/__modules-facade.ts" with two bare bundler messages and no line
number. Bun reports a position for every log; it was dropped. Diagnostics
now read plugins/x/modules/foo.ts:22:16: <message> (1-based column), and
the modules pack's generated facade is labelled as the modules pack instead
of leaking its synthetic file name.
---
 server/ai/tools/plugin/snapshot.ts            | 62 -------------------
 .../plugins/pluginBuildDiagnostics.test.ts    | 61 ++++++++++++++++++
 .../pages/content/agent/contentAgentStore.ts  | 55 ----------------
 .../plugins/ide/agent/pluginAgentStore.ts     | 33 ----------
 src/core/plugin-build/buildPackage.ts         |  3 +
 src/core/plugin-build/bundle.ts               | 38 ++++++++++--
 src/core/plugin-build/index.ts                |  8 ++-
 7 files changed, 105 insertions(+), 155 deletions(-)
 delete mode 100644 server/ai/tools/plugin/snapshot.ts
 create mode 100644 src/__tests__/plugins/pluginBuildDiagnostics.test.ts
 delete mode 100644 src/admin/pages/content/agent/contentAgentStore.ts
 delete mode 100644 src/admin/pages/plugins/ide/agent/pluginAgentStore.ts

diff --git a/server/ai/tools/plugin/snapshot.ts b/server/ai/tools/plugin/snapshot.ts
deleted file mode 100644
index b698a24fb..000000000
--- a/server/ai/tools/plugin/snapshot.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-/**
- * PluginIdeSnapshot — payload the chat handler hands to plugin-scope tool
- * handlers via `ToolContext.snapshot` and the system-prompt builder.
- *
- * The browser builds this on every send from the live Plugin IDE state
- * (open plugin, CRDT file list, active buffer, runtime summary). Shape is
- * validated at the chat boundary with `PluginIdeSnapshotSchema` — a
- * malformed snapshot falls back to empty rather than crashing the stream.
- *
- * Over MCP the snapshot is null: file tools are browser-bridged to the open
- * IDE anyway, and the server tools (`plugin_validate`, `plugin_activate`,
- * `plugin_list_plugins`) take an explicit `localId` instead.
- */
-import { Type, type Static } from '@core/utils/typeboxHelpers'
-
-export const PluginIdeSnapshotSchema = Type.Object({
-  /** The plugin open in the IDE. */
-  localId: Type.String(),
-  /** Runtime id (`site.<localId>`). */
-  pluginId: Type.String(),
-  /** Paths RELATIVE to the plugin folder (`plugin.json`, `server/index.ts`). */
-  files: Type.Array(
-    Type.Object({
-      id: Type.String(),
-      path: Type.String(),
-    }),
-  ),
-  /** The buffer currently visible in the editor, if any. */
-  activeFile: Type.Union([
-    Type.Object({ id: Type.String(), path: Type.String() }),
-    Type.Null(),
-  ]),
-  /** `computeSitePluginState` vocabulary — 'active', 'draft-changed', …. */
-  state: Type.String(),
-  activeVersion: Type.Union([Type.String(), Type.Null()]),
-  declaredPermissions: Type.Array(Type.String()),
-  grantedPermissions: Type.Array(Type.String()),
-  /** The diagnostics strip's latest result; null = not validated yet. */
-  latestDiagnostics: Type.Union([Type.Array(Type.String()), Type.Null()]),
-  currentUser: Type.Object({
-    id: Type.String(),
-    displayName: Type.String(),
-    email: Type.String(),
-  }),
-})
-
-export type PluginIdeSnapshot = Static<typeof PluginIdeSnapshotSchema>
-
-export function emptyPluginIdeSnapshot(): PluginIdeSnapshot {
-  return {
-    localId: '',
-    pluginId: '',
-    files: [],
-    activeFile: null,
-    state: 'draft-changed',
-    activeVersion: null,
-    declaredPermissions: [],
-    grantedPermissions: [],
-    latestDiagnostics: null,
-    currentUser: { id: '', displayName: '', email: '' },
-  }
-}
diff --git a/src/__tests__/plugins/pluginBuildDiagnostics.test.ts b/src/__tests__/plugins/pluginBuildDiagnostics.test.ts
new file mode 100644
index 000000000..327a67f16
--- /dev/null
+++ b/src/__tests__/plugins/pluginBuildDiagnostics.test.ts
@@ -0,0 +1,61 @@
+/**
+ * Build diagnostics name the author's file with a 1-based line and column,
+ * and the modules pack's generated facade never appears as the location —
+ * the position inside the author's module file does.
+ */
+import { describe, expect, test } from 'bun:test'
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { buildPluginPackage, formatBuildLog } from '@core/plugin-build'
+import { parsePluginManifest } from '@core/plugins/manifest'
+
+async function workspace(files: Record<string, string>): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'diagnostics-'))
+  for (const [path, content] of Object.entries(files)) {
+    const absolute = join(root, path)
+    await mkdir(dirname(absolute), { recursive: true })
+    await writeFile(absolute, content, 'utf8')
+  }
+  return root
+}
+
+describe('plugin build diagnostics', () => {
+  test('formatBuildLog prefixes file:line:col with a 1-based column', () => {
+    expect(
+      formatBuildLog({
+        message: 'Expected identifier but found "{"',
+        position: { file: 'plugins/x/modules/foo.ts', line: 3, column: 17 },
+      }),
+    ).toBe('plugins/x/modules/foo.ts:3:18: Expected identifier but found "{"')
+    expect(formatBuildLog({ message: 'no position', position: null })).toBe('no position')
+  })
+
+  test('a syntax error in a module file is reported at that file, not the facade', async () => {
+    const root = await workspace({
+      'modules/banner.ts': 'export default {\n  id: "x",\n  broken: {{{\n}\n',
+    })
+    const manifest = parsePluginManifest({
+      id: 'site.demo',
+      name: 'Demo',
+      version: '1.0.1+aaaa1111',
+      apiVersion: 1,
+      permissions: ['modules.register'],
+      resources: [],
+      adminPages: [],
+      entrypoints: { modules: 'modules/index.js' },
+    })
+    try {
+      await expect(
+        buildPluginPackage({
+          sourceDir: root,
+          outputDir: join(root, '.dist'),
+          manifest,
+          resolve: { workspaceRoot: root, bareSpecifiers: {} },
+        }),
+      ).rejects.toThrow(/the modules pack \(modules\/\*\)[\s\S]*modules\/banner\.ts:3:\d+: /)
+    } finally {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/src/admin/pages/content/agent/contentAgentStore.ts b/src/admin/pages/content/agent/contentAgentStore.ts
deleted file mode 100644
index 67886ddcc..000000000
--- a/src/admin/pages/content/agent/contentAgentStore.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- * Content-workspace agent store — a small standalone Zustand instance
- * holding ONLY the AgentSlice. Composed per ContentPage mount via
- * `createContentAgentStore(currentUser)`.
- *
- * Why standalone (not part of a bigger content store): the content
- * workspace is built on React hooks, not Zustand, so there's no parent
- * store to compose into. Building a content workspace store JUST for the
- * agent would be overkill — a per-mount tiny Zustand instance with one
- * slice is the smallest correct shape.
- *
- * Why per-mount (not module-level like useEditorStore): the content page
- * mounts/unmounts as the user navigates between admin pages; rebuilding
- * the store each mount keeps memory in check and ensures stale snapshot
- * closures don't survive a logout / user-swap. The site editor's store
- * is module-level because the editor session is the entire admin
- * lifetime, which doesn't apply here.
- */
-import { create, type StateCreator } from 'zustand'
-import { mutative } from 'zustand-mutative'
-import { subscribeWithSelector } from 'zustand/middleware'
-import {
-  createAgentSlice,
-  type AgentSlice,
-} from '@site/agent'
-import { contentAgentSliceConfig } from './agentSliceConfig.content'
-
-type ContentAgentStore = AgentSlice
-
-/**
- * Build a fresh Zustand store for the content workspace's agent panel.
- * No parameters — the agent's view of the world is reactive via the
- * registered ContentBridgeHandle, not closed-over at store-creation time.
- *
- * The `as unknown as ...` cast bridges the slice's site-editor-shaped
- * return type (`EditorStoreSliceCreator<AgentSlice>` — typed for the
- * combined site store) into our slice-only store. The slice only ever
- * touches AgentSlice keys at runtime, so the cast is structurally safe;
- * we accept the type widening here to avoid duplicating the slice
- * factory's logic for each store shape.
- */
-export function createContentAgentStore() {
-  const sliceCreator = createAgentSlice(contentAgentSliceConfig) as unknown as
-    StateCreator<AgentSlice, [['zustand/mutative', never]], [], AgentSlice>
-  return create<ContentAgentStore>()(
-    subscribeWithSelector(
-      mutative(
-        (...args) => ({
-          ...sliceCreator(...args),
-        }),
-        { enableAutoFreeze: true },
-      ),
-    ),
-  )
-}
diff --git a/src/admin/pages/plugins/ide/agent/pluginAgentStore.ts b/src/admin/pages/plugins/ide/agent/pluginAgentStore.ts
deleted file mode 100644
index b04ffd189..000000000
--- a/src/admin/pages/plugins/ide/agent/pluginAgentStore.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * Plugin-IDE agent store — a small standalone Zustand instance holding ONLY
- * the AgentSlice, composed per PluginIdeAgentMount. Same shape and
- * rationale as the content workspace's `contentAgentStore.ts`: the IDE is
- * hook-based (no parent Zustand store), and a per-mount instance keeps
- * stale closures from surviving navigation.
- *
- * The `as unknown as ...` cast bridges the slice's site-editor-shaped
- * return type into our slice-only store — the slice only touches AgentSlice
- * keys at runtime (see contentAgentStore.ts for the full justification).
- */
-import { create, type StateCreator } from 'zustand'
-import { mutative } from 'zustand-mutative'
-import { subscribeWithSelector } from 'zustand/middleware'
-import { createAgentSlice, type AgentSlice } from '@site/agent'
-import { pluginAgentSliceConfig } from './agentSliceConfig.plugin'
-
-type PluginAgentStore = AgentSlice
-
-export function createPluginAgentStore() {
-  const sliceCreator = createAgentSlice(pluginAgentSliceConfig) as unknown as
-    StateCreator<AgentSlice, [['zustand/mutative', never]], [], AgentSlice>
-  return create<PluginAgentStore>()(
-    subscribeWithSelector(
-      mutative(
-        (...args) => ({
-          ...sliceCreator(...args),
-        }),
-        { enableAutoFreeze: true },
-      ),
-    ),
-  )
-}
diff --git a/src/core/plugin-build/buildPackage.ts b/src/core/plugin-build/buildPackage.ts
index 8148b0fa2..a0b8371bd 100644
--- a/src/core/plugin-build/buildPackage.ts
+++ b/src/core/plugin-build/buildPackage.ts
@@ -125,6 +125,9 @@ export async function buildPluginPackage(input: BuildPackageInput): Promise<Buil
       // sandbox path has no import map / module resolver.
       await bundleEntrypoint(modulesFacadePath, join(outputDir, entrypoints.modules), {
         inlineHostRuntime: true,
+        // Diagnostics name the author's module file via their position; the
+        // header must not point at the synthetic facade.
+        label: 'the modules pack (modules/*)',
         ...(input.resolve ? { resolve: input.resolve } : {}),
       })
       files.push(entrypoints.modules)
diff --git a/src/core/plugin-build/bundle.ts b/src/core/plugin-build/bundle.ts
index 75483305c..a39ba5b53 100644
--- a/src/core/plugin-build/bundle.ts
+++ b/src/core/plugin-build/bundle.ts
@@ -103,6 +103,36 @@ export interface BundleOptions {
    * is byte-identical to the historical CLI build.
    */
   resolve?: ImportResolverPolicy
+  /**
+   * How the failure header names this bundle. Defaults to `sourcePath`;
+   * generated entrypoints (the modules facade) pass something an author
+   * recognizes instead of the synthetic file name.
+   */
+  label?: string
+}
+
+/**
+ * One bundler message, positioned. Bun reports 1-based lines and 0-based
+ * columns; authors read `file:line:col` the way their editor shows it, so
+ * the column is shifted to 1-based here.
+ */
+export interface BuildLogLike {
+  message: string
+  position?: { file?: string; line?: number; column?: number } | null
+}
+
+export function formatBuildLog(log: BuildLogLike): string {
+  const position = log.position
+  if (!position?.file) return log.message
+  const where =
+    position.line !== undefined
+      ? `${position.file}:${position.line}${position.column !== undefined ? `:${position.column + 1}` : ''}`
+      : position.file
+  return `${where}: ${log.message}`
+}
+
+function isBuildLogLike(value: unknown): value is BuildLogLike {
+  return typeof value === 'object' && value !== null && 'message' in value
 }
 
 export async function bundleEntrypoint(
@@ -189,15 +219,15 @@ export async function bundleEntrypoint(
     }).catch((err: unknown) => {
       if (err instanceof AggregateError && err.errors.length > 0) {
         const messages = err.errors
-          .map((e) => (e instanceof Error ? e.message : String(e)))
+          .map((e) => (isBuildLogLike(e) ? formatBuildLog(e) : String(e)))
           .join('\n')
-        throw new Error(`Failed to bundle ${sourcePath}:\n${messages}`, { cause: err })
+        throw new Error(`Failed to bundle ${options.label ?? sourcePath}:\n${messages}`, { cause: err })
       }
       throw err
     })
     if (!result.success) {
-      const messages = result.logs.map((l) => l.message).join('\n')
-      throw new Error(`Failed to bundle ${sourcePath}:\n${messages}`)
+      const messages = result.logs.map(formatBuildLog).join('\n')
+      throw new Error(`Failed to bundle ${options.label ?? sourcePath}:\n${messages}`)
     }
     const built = result.outputs[0]
     if (!built) throw new Error(`No output from Bun.build for ${sourcePath}`)
diff --git a/src/core/plugin-build/index.ts b/src/core/plugin-build/index.ts
index 6cd1f6345..81e5f1731 100644
--- a/src/core/plugin-build/index.ts
+++ b/src/core/plugin-build/index.ts
@@ -13,5 +13,11 @@ export {
   type BuildPackageResult,
 } from './buildPackage'
 export { assertNoBuildTimeMacros, type ImportResolverPolicy } from './containment'
-export { bundleEntrypoint, HOST_RUNTIME_EXTERNALS, type BundleOptions } from './bundle'
+export {
+  bundleEntrypoint,
+  formatBuildLog,
+  HOST_RUNTIME_EXTERNALS,
+  type BuildLogLike,
+  type BundleOptions,
+} from './bundle'
 export { generateModulesFacade, generateSandboxFacade } from './facades'

From 1d58fe2b64a673caa3b06f1d34e1c91022aa1c3d Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Thu, 3 Sep 2026 09:12:00 +0200
Subject: [PATCH 24/36] fix(plugin-ide): runtime errors inline, honest actions,
 Escape closes the overflow

The diagnostics strip shows the active revision's runtime error while the
plugin is parked, the one problem validation cannot see. "View logs" and
"Open plugin settings" both navigated to the Plugins list; both now say
"Open on Plugins page". The duplicate "Preview in canvas" overflow item is
gone. The overflow trigger takes focus after opening so Escape closes the
menu (the menu itself is not focusable). The permission review says a
password prompt follows. Presence updates the active-file field instead of
replacing the whole awareness state, which showed peers a leave and a
rejoin on every file switch. The IDE route now maps to its workspace so the
persisted sidebar width applies on a direct load.
---
 .../pages/plugins/ide/DiagnosticsStrip.tsx    | 32 +++++++++---
 src/admin/pages/plugins/ide/IdeActions.tsx    | 52 ++++++++++---------
 .../pages/plugins/ide/SitePluginIdePage.tsx   |  6 +--
 .../ide/SitePluginPermissionReviewDialog.tsx  |  3 +-
 src/admin/pages/plugins/ide/idePresence.ts    | 24 ++++++---
 src/admin/state/workspaceLayoutStorage.ts     |  1 +
 src/core/site-plugins/state.ts                |  6 ++-
 7 files changed, 81 insertions(+), 43 deletions(-)

diff --git a/src/admin/pages/plugins/ide/DiagnosticsStrip.tsx b/src/admin/pages/plugins/ide/DiagnosticsStrip.tsx
index ff4710f93..a635f321c 100644
--- a/src/admin/pages/plugins/ide/DiagnosticsStrip.tsx
+++ b/src/admin/pages/plugins/ide/DiagnosticsStrip.tsx
@@ -1,7 +1,9 @@
 /**
  * DiagnosticsStrip — the bottom strip under the code editor. Shows the
  * automatic validation's bundle / manifest / sandbox / containment
- * diagnostics as they land (debounced on save-less live edits).
+ * diagnostics as they land (debounced on save-less live edits), plus the
+ * active revision's runtime error when the plugin is parked in
+ * `runtime-error` — the one problem validation cannot see.
  */
 import { WarningDiamondSolidIcon } from 'pixel-art-icons/icons/warning-diamond-solid'
 import { CheckIcon } from 'pixel-art-icons/icons/check'
@@ -9,30 +11,48 @@ import styles from './DiagnosticsStrip.module.css'
 
 interface DiagnosticsStripProps {
   diagnostics: string[]
+  /** `lastError` of the active revision while its state is runtime-error. */
+  runtimeError: string | null
   validating: boolean
   synced: boolean
 }
 
-export function DiagnosticsStrip({ diagnostics, validating, synced }: DiagnosticsStripProps) {
+export function DiagnosticsStrip({
+  diagnostics,
+  runtimeError,
+  validating,
+  synced,
+}: DiagnosticsStripProps) {
+  const problems = runtimeError
+    ? [`Runtime error in the active revision: ${runtimeError}`, ...diagnostics]
+    : diagnostics
+  const status = !synced
+    ? 'connecting…'
+    : validating
+      ? 'validating…'
+      : problems.length === 0
+        ? 'clean'
+        : `${problems.length} problem${problems.length === 1 ? '' : 's'}`
+
   return (
     <section className={styles.strip} aria-label="Diagnostics" data-testid="ide-diagnostics">
       <header className={styles.header}>
         <span className={styles.title}>Diagnostics</span>
         <span className={styles.status} role="status">
-          {!synced ? 'connecting…' : validating ? 'validating…' : diagnostics.length === 0 ? 'clean' : `${diagnostics.length} problem${diagnostics.length === 1 ? '' : 's'}`}
+          {status}
         </span>
       </header>
-      {diagnostics.length === 0 ? (
+      {problems.length === 0 ? (
         <p className={styles.empty}>
           <CheckIcon size={12} aria-hidden="true" className={styles.okIcon} />
           No diagnostics — the draft builds cleanly.
         </p>
       ) : (
         <ul className={styles.list}>
-          {diagnostics.map((diagnostic, index) => (
+          {problems.map((problem, index) => (
             <li key={index} className={styles.item}>
               <WarningDiamondSolidIcon size={12} aria-hidden="true" className={styles.errorIcon} />
-              <span className={styles.message}>{diagnostic}</span>
+              <span className={styles.message}>{problem}</span>
             </li>
           ))}
         </ul>
diff --git a/src/admin/pages/plugins/ide/IdeActions.tsx b/src/admin/pages/plugins/ide/IdeActions.tsx
index 717f9ee66..555acda86 100644
--- a/src/admin/pages/plugins/ide/IdeActions.tsx
+++ b/src/admin/pages/plugins/ide/IdeActions.tsx
@@ -4,7 +4,7 @@
  * `Preview in canvas` secondary (module drafts), and the overflow menu.
  * Unavailable actions are disabled with an inline reason, never hidden.
  */
-import { useRef, useState } from 'react'
+import { useEffect, useRef, useState } from 'react'
 import {
   sitePluginPrimaryAction,
   sitePluginStateLabel,
@@ -30,10 +30,10 @@ interface IdeActionsProps {
   onRollback: () => void
   onSetEnabled: (enabled: boolean) => void
   onRestart: () => void
-  onRerunDiagnostics: () => void
-  onOpenSettings: () => void
+  onRunDiagnostics: () => void
+  /** Logs, settings, schedules and restart-after-crash live on the Plugins page. */
+  onOpenPluginsPage: () => void
   onDelete: () => void
-  onShowDiagnostics: () => void
 }
 
 export function IdeActions({
@@ -47,14 +47,21 @@ export function IdeActions({
   onRollback,
   onSetEnabled,
   onRestart,
-  onRerunDiagnostics,
-  onOpenSettings,
+  onRunDiagnostics,
+  onOpenPluginsPage,
   onDelete,
-  onShowDiagnostics,
 }: IdeActionsProps) {
   const [menuOpen, setMenuOpen] = useState(false)
   const overflowRef = useRef<HTMLButtonElement | null>(null)
 
+  // The menu is not focusable and a mouse click does not leave focus on
+  // the trigger (the Button's tooltip wrapper re-renders it once
+  // aria-expanded flips), so put focus on the trigger after the open
+  // commits: Escape then closes what the click opened.
+  useEffect(() => {
+    if (menuOpen) overflowRef.current?.focus()
+  }, [menuOpen])
+
   const state = summary?.state ?? null
   const primary = state ? sitePluginPrimaryAction(state) : null
 
@@ -72,10 +79,10 @@ export function IdeActions({
         onActivate()
         return
       case 'diagnostics':
-        onShowDiagnostics()
+        onRunDiagnostics()
         return
-      case 'logs':
-        onOpenSettings()
+      case 'open-plugins-page':
+        onOpenPluginsPage()
         return
       case 'delete':
         onDelete()
@@ -148,7 +155,14 @@ export function IdeActions({
         iconOnly
         aria-label="More actions"
         tooltip="More actions"
+        aria-expanded={menuOpen}
         onClick={() => setMenuOpen((open) => !open)}
+        onKeyDown={(event) => {
+          if (event.key === 'Escape' && menuOpen) {
+            event.preventDefault()
+            setMenuOpen(false)
+          }
+        }}
         data-testid="ide-overflow"
       >
         <MoreHorizontalSolidIcon size={14} aria-hidden="true" />
@@ -161,19 +175,9 @@ export function IdeActions({
           onClose={() => setMenuOpen(false)}
           minWidth={230}
         >
-          <ContextMenuItem
-            disabled={!summary?.hasModules || !summary.hasDraftSource}
-            tooltip={!summary?.hasModules ? 'The draft declares no module pack' : undefined}
-            onClick={() => {
-              onPreview()
-              setMenuOpen(false)
-            }}
-          >
-            Preview in canvas
-          </ContextMenuItem>
           <ContextMenuItem
             onClick={() => {
-              onRerunDiagnostics()
+              onRunDiagnostics()
               setMenuOpen(false)
             }}
           >
@@ -220,14 +224,12 @@ export function IdeActions({
             Restart
           </ContextMenuItem>
           <ContextMenuItem
-            disabled={!summary?.activeVersion}
-            tooltip={!summary?.activeVersion ? 'Settings exist after the first activation' : undefined}
             onClick={() => {
-              onOpenSettings()
+              onOpenPluginsPage()
               setMenuOpen(false)
             }}
           >
-            Open plugin settings
+            Open on Plugins page
           </ContextMenuItem>
           <ContextMenuSeparator />
           <ContextMenuItem
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
index d02ee1b3a..d0f89db62 100644
--- a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
@@ -201,6 +201,7 @@ function SitePluginIde({ localId }: { localId: string }) {
           </div>
           <DiagnosticsStrip
             diagnostics={vm.diagnostics}
+            runtimeError={vm.summary?.state === 'runtime-error' ? vm.summary.lastError : null}
             validating={vm.validating}
             synced={vm.synced}
           />
@@ -228,8 +229,8 @@ function SitePluginIde({ localId }: { localId: string }) {
             onRollback={() => void vm.rollback()}
             onSetEnabled={(enabled) => void vm.setEnabled(enabled)}
             onRestart={() => void vm.restart()}
-            onRerunDiagnostics={vm.runValidation}
-            onOpenSettings={() => navigate('/admin/plugins')}
+            onRunDiagnostics={vm.runValidation}
+            onOpenPluginsPage={() => navigate('/admin/plugins')}
             onDelete={() =>
               setPendingDelete({
                 title: `Delete site plugin “${localId}”?`,
@@ -239,7 +240,6 @@ function SitePluginIde({ localId }: { localId: string }) {
                 commit: () => void vm.deletePlugin(),
               })
             }
-            onShowDiagnostics={vm.runValidation}
           />
           {reviewOpen && vm.summary && (
             <SitePluginPermissionReviewDialog
diff --git a/src/admin/pages/plugins/ide/SitePluginPermissionReviewDialog.tsx b/src/admin/pages/plugins/ide/SitePluginPermissionReviewDialog.tsx
index f3a2f121b..54b1f7a6d 100644
--- a/src/admin/pages/plugins/ide/SitePluginPermissionReviewDialog.tsx
+++ b/src/admin/pages/plugins/ide/SitePluginPermissionReviewDialog.tsx
@@ -57,7 +57,8 @@ export function SitePluginPermissionReviewDialog({
       <div className={styles.body}>
         <p className={styles.intro}>
           Building activates this plugin’s current draft with exactly the
-          permissions it declares:
+          permissions it declares. You will be asked for your password to
+          confirm.
         </p>
 
         {added.length > 0 && (
diff --git a/src/admin/pages/plugins/ide/idePresence.ts b/src/admin/pages/plugins/ide/idePresence.ts
index 9f5a46890..30b9cc0cb 100644
--- a/src/admin/pages/plugins/ide/idePresence.ts
+++ b/src/admin/pages/plugins/ide/idePresence.ts
@@ -8,6 +8,10 @@
  * their toolbar roster; the extra `ideFile` field is what IDE peers key on.
  * Character-precise remote carets inside a code buffer ride y-codemirror's
  * own `cursor` awareness field — this module never touches it.
+ *
+ * Identity is set once per session; the active file is a FIELD update. A
+ * whole-state replace on every file switch would drop and re-add this
+ * client in every peer's roster (a visible leave + rejoin).
  */
 import { useEffect, useState } from 'react'
 import { safeParseValue, Type, type Static } from '@core/utils/typeboxHelpers'
@@ -46,13 +50,10 @@ export function usePublishIdePresence(
   localId: string,
   activeFile: { fileId: string; path: string } | null,
 ): void {
-  const fileId = activeFile?.fileId ?? null
-  const path = activeFile?.path ?? null
-
   useEffect(() => {
     if (!session) return undefined
     const awareness = session.provider.awareness
-    const previous = awareness.getLocalState()
+    const previous: Record<string, unknown> | null = awareness.getLocalState()
     awareness.setLocalState({
       ...previous,
       user: {
@@ -68,12 +69,23 @@ export function usePublishIdePresence(
       editingNodeId: null,
       pointer: null,
       textCaret: null,
-      ideFile: fileId && path ? { localId, fileId, path } : null,
+      // Keep whatever file the field effect below already published.
+      ideFile: previous?.['ideFile'] ?? null,
     })
     return () => {
       awareness.setLocalState(null)
     }
-  }, [session, user.id, user.displayName, user.avatarUrl, user.gravatarHash, localId, fileId, path])
+  }, [session, user.id, user.displayName, user.avatarUrl, user.gravatarHash])
+
+  const fileId = activeFile?.fileId ?? null
+  const path = activeFile?.path ?? null
+  useEffect(() => {
+    if (!session) return
+    session.provider.awareness.setLocalStateField(
+      'ideFile',
+      fileId && path ? { localId, fileId, path } : null,
+    )
+  }, [session, localId, fileId, path])
 }
 
 function readIdePeers(session: IdeCollabSession, localId: string): IdePeer[] {
diff --git a/src/admin/state/workspaceLayoutStorage.ts b/src/admin/state/workspaceLayoutStorage.ts
index 6b90a0bce..87c1dfc6a 100644
--- a/src/admin/state/workspaceLayoutStorage.ts
+++ b/src/admin/state/workspaceLayoutStorage.ts
@@ -289,5 +289,6 @@ export function workspaceFromPathname(pathname: string): EditorWorkspaceId | nul
   if (pathname.startsWith('/admin/content')) return 'content'
   if (pathname.startsWith('/admin/data')) return 'data'
   if (pathname.startsWith('/admin/media')) return 'media'
+  if (pathname.startsWith('/admin/plugins/develop')) return 'pluginIde'
   return null
 }
diff --git a/src/core/site-plugins/state.ts b/src/core/site-plugins/state.ts
index c6f4c617a..2d5ca0a5b 100644
--- a/src/core/site-plugins/state.ts
+++ b/src/core/site-plugins/state.ts
@@ -93,7 +93,7 @@ export type SitePluginPrimaryActionKind =
   | 'activate'
   | 'review'
   | 'diagnostics'
-  | 'logs'
+  | 'open-plugins-page'
   | 'delete'
   | 'enable'
   | null
@@ -114,7 +114,9 @@ export function sitePluginPrimaryAction(state: SitePluginRuntimeState): SitePlug
     case 'build-failed':
       return { label: 'View diagnostics', action: 'diagnostics' }
     case 'runtime-error':
-      return { label: 'View logs', action: 'logs' }
+      // The IDE shows the runtime error inline; logs and restart live on the
+      // Plugins page, and the label says exactly where the click goes.
+      return { label: 'Open on Plugins page', action: 'open-plugins-page' }
     case 'source-missing':
       return { label: 'Delete site plugin', action: 'delete' }
     case 'disabled':

From aaa169def969bdd3fd89bb815ef7751ad71ce53c Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Thu, 3 Sep 2026 09:12:01 +0200
Subject: [PATCH 25/36] fix(site-plugins): refuse rebuilds of a deactivated
 plugin, surface republish failures, one validate path

A same-grant rebuild (the everyday agent loop over MCP included) silently
re-enabled a plugin an operator had deactivated; the engine now refuses
with a pointer to the Activate action. A failed post-activation republish
was logged and forgotten while the response said success; it now comes
back as a warning on the activate and rollback responses and the AI tool
result. The validate route, the preview-pack route and plugin_validate ran
three copies of the same discover-and-build; they share
buildDraftSitePlugin in the service layer. The agent reference's style
asset example used src where the manifest requires href.
---
 server/ai/tools/plugin/docs.ts             |  2 +-
 server/ai/tools/plugin/lifecycleTools.ts   | 29 +++-------
 server/handlers/cms/sitePlugins/index.ts   | 42 ++++----------
 server/handlers/cms/sitePlugins/service.ts | 66 ++++++++++++++++++++--
 4 files changed, 81 insertions(+), 58 deletions(-)

diff --git a/server/ai/tools/plugin/docs.ts b/server/ai/tools/plugin/docs.ts
index 65030a6ac..4476a365f 100644
--- a/server/ai/tools/plugin/docs.ts
+++ b/server/ai/tools/plugin/docs.ts
@@ -224,7 +224,7 @@ Two consumers:
 1. Published pages — declare tags in the manifest (permission "frontend.assets"):
    "frontend": { "assets": [
      { "kind": "script", "src": "frontend/widget.ts", "placement": "body-end" },
-     { "kind": "style", "src": "frontend/widget.css" }
+     { "kind": "style", "href": "frontend/widget.css" }
    ] }
    The build rewrites .ts→.js. The host injects the tags into every published
    page and adjusts CSP. Use api.plugin.assetUrl(path) server-side for URLs.
diff --git a/server/ai/tools/plugin/lifecycleTools.ts b/server/ai/tools/plugin/lifecycleTools.ts
index 215edcdbe..c72e4dfb1 100644
--- a/server/ai/tools/plugin/lifecycleTools.ts
+++ b/server/ai/tools/plugin/lifecycleTools.ts
@@ -19,22 +19,15 @@
 import { Type } from '@core/utils/typeboxHelpers'
 import type { CoreCapability } from '@core/capabilities'
 import { aiToolError, aiToolOk } from '@core/ai'
-import {
-  discoverSitePlugins,
-  sitePluginIdFromLocalId,
-} from '@core/site-plugins'
 import type { AiTool } from '../types'
 import type { ToolContext } from '../../runtime/types'
 import {
+  buildDraftSitePlugin,
   listSitePlugins,
   runSitePluginActivation,
 } from '../../../handlers/cms/sitePlugins'
-import { buildSitePlugin } from '../../../plugins/sitePlugins/build'
-import { runPublishFlush } from '../../../publish/publishFlush'
-import { getDraftSite } from '../../../repositories/site'
-import { getInstalledPlugin } from '../../../repositories/plugins'
 import { findUserById } from '../../../repositories/users'
-import { PluginIdeSnapshotSchema } from './snapshot'
+import { PluginIdeSnapshotSchema } from '@core/ai'
 import { safeParseValue } from '@core/utils/typeboxHelpers'
 
 const PLUGIN_READ_CAPS: readonly CoreCapability[] = ['site.read', 'plugins.read']
@@ -79,21 +72,10 @@ const validateTool: AiTool = {
     if (!localId) {
       return aiToolError('No plugin in scope — pass localId (see plugin_list_plugins).')
     }
-    await runPublishFlush()
-    const shell = await getDraftSite(ctx.db)
-    const draftFiles = shell?.files.filter((file) => file.type === 'plugin') ?? []
-    const plugin = discoverSitePlugins(draftFiles).find((entry) => entry.localId === localId)
-    if (!plugin) {
+    const result = await buildDraftSitePlugin(ctx.db, localId)
+    if (!result) {
       return aiToolError(`No site plugin source at plugins/${localId}/`)
     }
-    const rowResult = await getInstalledPlugin(ctx.db, sitePluginIdFromLocalId(localId))
-    const row = rowResult?.kind === 'ok' ? rowResult.plugin : null
-    const result = await buildSitePlugin({
-      localId,
-      files: plugin.files,
-      previousVersion: row?.version ?? null,
-      validateOnly: true,
-    })
     return aiToolOk({ ok: result.ok, diagnostics: result.ok ? [] : result.diagnostics })
   },
 }
@@ -133,7 +115,10 @@ const activateTool: AiTool = {
           pluginId: result.plugin.id,
           version: result.plugin.version,
           ...(result.upgrade ? { upgrade: result.upgrade } : {}),
+          ...(result.warning ? { warning: result.warning } : {}),
         })
+      case 'disabled':
+        return aiToolError(result.message)
       case 'grants-changed':
         return aiToolError(
           `Activation needs human consent: the permission grant set changed ` +
diff --git a/server/handlers/cms/sitePlugins/index.ts b/server/handlers/cms/sitePlugins/index.ts
index a54c45770..ec37c1a9e 100644
--- a/server/handlers/cms/sitePlugins/index.ts
+++ b/server/handlers/cms/sitePlugins/index.ts
@@ -33,7 +33,6 @@ import { parsePluginManifest } from '@core/plugins/manifest'
 import {
   SITE_PLUGIN_LOCAL_ID_PATTERN,
   SITE_PLUGIN_TEMPLATE_IDS,
-  discoverSitePlugins,
   sitePluginFolder,
   sitePluginIdFromLocalId,
   sitePluginTemplateFiles,
@@ -50,7 +49,6 @@ import {
 import { getDraftSite, saveDraftSite } from '../../../repositories/site'
 import { getInstalledPlugin } from '../../../repositories/plugins'
 import { runPublishFlush } from '../../../publish/publishFlush'
-import { buildSitePlugin } from '../../../plugins/sitePlugins/build'
 import { previousSitePluginRevision } from '../../../plugins/sitePlugins/retention'
 import { badRequest, jsonResponse, methodNotAllowed, readValidatedBody } from '../../../http'
 import { type CmsHandlerOptions } from '../shared'
@@ -58,8 +56,8 @@ import { activatePluginPackageFromDisk } from '../plugins/install'
 import { presentPluginSecrets } from '../plugins/shared'
 import { uninstallPluginById } from '../plugins/state'
 import {
+  buildDraftSitePlugin,
   listSitePlugins,
-  readDraftPluginFiles,
   republishAndSweep,
   runSitePluginActivation,
   sameStringSet,
@@ -69,6 +67,7 @@ import {
 // Service re-exports — external consumers (the AI plugin tools) import the
 // engine through this barrel.
 export {
+  buildDraftSitePlugin,
   listSitePlugins,
   runSitePluginActivation,
 } from './service'
@@ -151,23 +150,11 @@ async function handleScaffold(req: Request, db: DbClient): Promise<Response> {
 // ---------------------------------------------------------------------------
 
 async function handleValidate(db: DbClient, localId: string): Promise<Response> {
-  const draftFiles = await readDraftPluginFiles(db)
-  const plugin = discoverSitePlugins(draftFiles).find((entry) => entry.localId === localId)
-  if (!plugin) {
+  const result = await buildDraftSitePlugin(db, localId)
+  if (!result) {
     return jsonResponse({ error: `No site plugin source at plugins/${localId}/` }, { status: 404 })
   }
-  const rowResult = await getInstalledPlugin(db, sitePluginIdFromLocalId(localId))
-  const row = rowResult?.kind === 'ok' ? rowResult.plugin : null
-  const result = await buildSitePlugin({
-    localId,
-    files: plugin.files,
-    previousVersion: row?.version ?? null,
-    validateOnly: true,
-  })
-  if (!result.ok) {
-    return jsonResponse({ ok: false, diagnostics: result.diagnostics })
-  }
-  return jsonResponse({ ok: true, diagnostics: [] })
+  return jsonResponse({ ok: result.ok, diagnostics: result.ok ? [] : result.diagnostics })
 }
 
 // ---------------------------------------------------------------------------
@@ -175,19 +162,10 @@ async function handleValidate(db: DbClient, localId: string): Promise<Response>
 // ---------------------------------------------------------------------------
 
 async function handlePreviewPack(db: DbClient, localId: string): Promise<Response> {
-  const draftFiles = await readDraftPluginFiles(db)
-  const plugin = discoverSitePlugins(draftFiles).find((entry) => entry.localId === localId)
-  if (!plugin) {
+  const result = await buildDraftSitePlugin(db, localId)
+  if (!result) {
     return jsonResponse({ error: `No site plugin source at plugins/${localId}/` }, { status: 404 })
   }
-  const rowResult = await getInstalledPlugin(db, sitePluginIdFromLocalId(localId))
-  const row = rowResult?.kind === 'ok' ? rowResult.plugin : null
-  const result = await buildSitePlugin({
-    localId,
-    files: plugin.files,
-    previousVersion: row?.version ?? null,
-    validateOnly: true,
-  })
   if (!result.ok) {
     return jsonResponse(
       { error: `Draft build failed: ${result.diagnostics.join('; ')}` },
@@ -241,10 +219,13 @@ async function handleActivate(
         plugin: await presentPluginSecrets(db, result.plugin),
         ...(result.upgrade ? { upgrade: result.upgrade } : {}),
         ...(result.skipped ? { skipped: true } : {}),
+        ...(result.warning ? { warning: result.warning } : {}),
         sitePlugins: await listSitePlugins(db),
       })
     case 'not-found':
       return jsonResponse({ error: result.message }, { status: 404 })
+    case 'disabled':
+      return jsonResponse({ error: result.message }, { status: 409 })
     case 'invalid':
       return result.message === 'Uploads directory is not configured'
         ? jsonResponse({ error: result.message }, { status: 500 })
@@ -330,11 +311,12 @@ async function handleRollback(
     )
   }
 
-  await republishAndSweep(db, options.uploadsDir, manifest)
+  const warning = await republishAndSweep(db, options.uploadsDir, manifest)
 
   return jsonResponse({
     plugin: await presentPluginSecrets(db, outcome.plugin),
     rolledBackTo: previousVersion,
+    ...(warning ? { warning } : {}),
     sitePlugins: await listSitePlugins(db),
   })
 }
diff --git a/server/handlers/cms/sitePlugins/service.ts b/server/handlers/cms/sitePlugins/service.ts
index 9228147d3..14b76102a 100644
--- a/server/handlers/cms/sitePlugins/service.ts
+++ b/server/handlers/cms/sitePlugins/service.ts
@@ -36,7 +36,10 @@ import {
   getPublishVersion,
   withPublishLock,
 } from '../../../publish/publishState'
-import { buildSitePlugin } from '../../../plugins/sitePlugins/build'
+import {
+  buildSitePlugin,
+  type SitePluginBuildResult,
+} from '../../../plugins/sitePlugins/build'
 import { sweepSitePluginRevisions } from '../../../plugins/sitePlugins/retention'
 import { createKeyedSerializer } from '../../../util/keyedSerial'
 import type { CmsHandlerOptions } from '../shared'
@@ -74,6 +77,28 @@ export async function readDraftPluginFiles(db: DbClient): Promise<SiteFile[]> {
   return shell?.files.filter((file) => file.type === 'plugin') ?? []
 }
 
+/**
+ * Validate-only build of one draft plugin — the diagnostics strip, the
+ * preview-pack route and the AI `plugin_validate` tool all run exactly
+ * this. Null when no `plugins/<localId>/` source exists.
+ */
+export async function buildDraftSitePlugin(
+  db: DbClient,
+  localId: string,
+): Promise<SitePluginBuildResult | null> {
+  const draftFiles = await readDraftPluginFiles(db)
+  const plugin = discoverSitePlugins(draftFiles).find((entry) => entry.localId === localId)
+  if (!plugin) return null
+  const rowResult = await getInstalledPlugin(db, sitePluginIdFromLocalId(localId))
+  const row = rowResult?.kind === 'ok' ? rowResult.plugin : null
+  return buildSitePlugin({
+    localId,
+    files: plugin.files,
+    previousVersion: row?.version ?? null,
+    validateOnly: true,
+  })
+}
+
 export function sameStringSet(a: readonly string[], b: readonly string[]): boolean {
   if (a.length !== b.length) return false
   const sortedA = [...a].sort()
@@ -176,9 +201,18 @@ export async function listSitePlugins(db: DbClient): Promise<SitePluginSummary[]
 // ---------------------------------------------------------------------------
 
 export type SitePluginActivationResult =
-  | { status: 'ok'; plugin: InstalledPlugin; upgrade?: { fromVersion: string; toVersion: string }; skipped: boolean }
+  | {
+      status: 'ok'
+      plugin: InstalledPlugin
+      upgrade?: { fromVersion: string; toVersion: string }
+      skipped: boolean
+      /** The activation succeeded but the coupled republish did not. */
+      warning?: string
+    }
   | { status: 'not-found'; message: string }
   | { status: 'invalid'; message: string }
+  /** The row is deactivated; rebuilding must not silently re-enable it. */
+  | { status: 'disabled'; message: string }
   | { status: 'grants-changed'; newPermissions: string[]; removedPermissions: string[] }
   | { status: 'build-failed'; diagnostics: string[] }
   | { status: 'upgrade-error'; message: string }
@@ -223,6 +257,18 @@ async function activateUnlocked(
   const row = rowResult?.kind === 'ok' ? rowResult.plugin : null
   const contentHash = computeSitePluginContentHash(plugin.files)
 
+  // An operator deactivated this plugin on purpose. A rebuild (the everyday
+  // agent loop over MCP included) must not bring it back as a side effect:
+  // enabling is a lifecycle action with its own capability and step-up.
+  if (row && (!row.enabled || row.lifecycleStatus === 'disabled')) {
+    return {
+      status: 'disabled',
+      message:
+        `Site plugin "${localId}" is deactivated. Activate it first (the Activate action ` +
+        'on the Plugins page or in the IDE header), then build again.',
+    }
+  }
+
   // Skip when the active revision already matches the draft source.
   if (
     row &&
@@ -285,13 +331,14 @@ async function activateUnlocked(
     return { status: 'upgrade-error', message: outcome.upgradeError }
   }
 
-  await republishAndSweep(db, options.uploadsDir, built.manifest)
+  const warning = await republishAndSweep(db, options.uploadsDir, built.manifest)
 
   return {
     status: 'ok',
     plugin: outcome.plugin,
     ...(outcome.upgrade ? { upgrade: outcome.upgrade } : {}),
     skipped: false,
+    ...(warning ? { warning } : {}),
   }
 }
 
@@ -304,12 +351,17 @@ async function activateUnlocked(
  * data rows (`/posts/hello`), which a page-only republish would leave
  * pointing at the swept directory. Backend-only plugins skip the republish
  * and sweep immediately.
+ *
+ * Returns a warning for the caller to surface when the republish failed:
+ * the activation stands, the old revision stays on disk (unswept, so
+ * published pages keep working), and the operator has to publish to move
+ * visitors onto the new revision.
  */
 export async function republishAndSweep(
   db: DbClient,
   uploadsDir: string,
   manifest: PluginManifest,
-): Promise<void> {
+): Promise<string | null> {
   const visitorFacing =
     (manifest.frontend?.assets.length ?? 0) > 0 || Boolean(manifest.entrypoints?.modules)
   if (visitorFacing) {
@@ -327,8 +379,12 @@ export async function republishAndSweep(
       // A failed republish must not fail the activation — but it must also
       // not trigger the sweep (old revision stays referenced).
       console.error(`[site-plugins] post-activation republish failed for ${manifest.id}:`, err)
-      return
+      return (
+        `Activated, but republishing the site failed: ${getErrorMessage(err, 'unknown error')}. ` +
+        'Published pages still use the previous revision until you publish the site.'
+      )
     }
   }
   await sweepSitePluginRevisions(uploadsDir, manifest.id, manifest.version)
+  return null
 }

From 8c34c66aeba1a768559470bb1ed8fa5c16bab347 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Thu, 3 Sep 2026 09:12:03 +0200
Subject: [PATCH 26/36] refactor(plugin-ide): shared text helpers, scoped agent
 store, single snapshot schema, hook cleanup

The two code-asset bridges carried line-for-line copies of hashing and
pagination; both now use hashText and paginateText from @core/ai. The
content and plugin agent stores were the same factory with a different
config; createScopedAgentStore replaces both files. The IDE snapshot schema
lives once in @core/ai and both the browser handle and the server tools
derive their type from it. The view-model hook drops six useCallbacks no
dependency array reads, folds five lifecycle actions into one helper that
also toasts republish warnings, loads the summary through useAsyncResource,
and lets the session cache the file list so keystrokes never re-render the
tree. Dead exports removed: the seven Plugin*Input types, the bridge's parse
alias, the orphaned dialog error class. The scaffold dialog toasts request
failures and stops emitting aria-pressed on radio buttons. The base editor
installs no change listener when nothing owns persistence. The draft
preview badge subscribes to its store. Docs: the site-plugins design doc no
longer links two plan files that do not exist, site-shell's document model
mentions the granular files map, agent.md lists the plugin scope, and the
store references point at createScopedAgentStore.
---
 docs/features/agent.md                        |  10 +-
 docs/features/content-workspace.md            |   2 +-
 docs/features/site-plugins.md                 |  15 +-
 docs/features/site-shell.md                   |   5 +-
 server/ai/tools/plugin/index.ts               |   9 +-
 server/ai/tools/plugin/systemPrompt.ts        |   2 +-
 src/admin/ai/createScopedAgentStore.ts        |  43 ++++
 .../pages/content/agent/ContentAgentMount.tsx |   5 +-
 src/admin/pages/plugins/PluginsPage.tsx       |   6 +-
 .../components/NewSitePluginDialog.module.css |   5 -
 .../components/NewSitePluginDialog.tsx        |  32 +--
 .../plugins/ide/agent/PluginIdeAgentMount.tsx |   5 +-
 .../ide/agent/agentSliceConfig.plugin.ts      |   7 +-
 .../pages/plugins/ide/agent/pluginBridge.ts   |  78 +++---
 .../plugins/ide/agent/pluginBridgeHandle.ts   |  47 +---
 .../ide/agent/usePluginIdeToolBridge.ts       |   4 +-
 src/admin/pages/plugins/ide/ideCollab.ts      |  14 +-
 .../pages/plugins/ide/useSitePluginIde.ts     | 239 ++++++++----------
 src/admin/pages/site/agent/agentSlice.ts      |   2 +-
 src/admin/pages/site/agent/codeAssetTools.ts  |  47 ++--
 .../site/code-editor/CodeMirrorEditor.tsx     |  17 +-
 .../code-editor/CollabCodeMirrorEditor.tsx    |   4 +-
 .../site/hooks/draftModulePreviewState.ts     |   9 +-
 .../ModuleInserterItemButton.tsx              |   8 +-
 src/core/ai/index.ts                          |  11 +-
 src/core/ai/pluginIdeSnapshot.ts              |  61 +++++
 src/core/ai/textPages.ts                      |  67 +++++
 src/core/ai/toolSchemas.ts                    |   7 -
 src/core/site-plugins/index.ts                |   1 +
 src/core/site-plugins/schemas.ts              |  14 +
 30 files changed, 433 insertions(+), 343 deletions(-)
 create mode 100644 src/admin/ai/createScopedAgentStore.ts
 create mode 100644 src/core/ai/pluginIdeSnapshot.ts
 create mode 100644 src/core/ai/textPages.ts

diff --git a/docs/features/agent.md b/docs/features/agent.md
index cc3c90be2..45b3b44df 100644
--- a/docs/features/agent.md
+++ b/docs/features/agent.md
@@ -104,7 +104,7 @@ src/admin/pages/site/agent/
 
 src/admin/pages/content/agent/
 ├── agentSliceConfig.content.ts — content-workspace config: scope, snapshot builder, executor wiring
-├── contentAgentStore.ts        — standalone per-mount Zustand store (AgentSlice only)
+├── (store: src/admin/ai/createScopedAgentStore.ts — one AgentSlice-only Zustand instance per mount, shared with the Plugin IDE)
 ├── contentBridge.ts            — content workspace write-tool executor
 ├── contentBridgeHandle.ts      — live ContentPage operation handle
 └── useContentToolBridge.ts     — always-mounted handle + content-scope MCP relay
@@ -316,7 +316,7 @@ The handler (`server/ai/handlers/chat.ts`):
 7. Calls `runChat(...)` with the full history as `req.messages`. Direct HTTP drivers have no server-side session, so each driver maps the whole `AiMessage[]` log into the provider's native message array every turn (the Anthropic driver pairs assistant `tool_use` blocks with their following `tool_result` turns). The runner pipes all stream events to the HTTP response. Before recording a terminal usage event, the runner flushes any pending assistant text so text-only replies have an assistant message row for per-turn usage and audit rollups. The multi-turn agentic loop lives in `drivers/http/toolLoop.ts`, not in a provider SDK.
 8. Emits a terminal `ai.chat.completed` / `ai.chat.failed` audit event.
 
-Valid scopes are `site`, `content`, `data`, and `plugin`; only `site` and `content` currently register tools and prompts. The handler rejects a request when the URL scope does not match the `ai_conversations.scope` row.
+Valid scopes are `site`, `content`, `data`, and `plugin`; `site`, `content`, and `plugin` register tools and prompts, `data` has none yet. The handler rejects a request when the URL scope does not match the `ai_conversations.scope` row.
 
 ### `GET /admin/api/ai/audit?since=ISO&tz=IANA`
 
@@ -520,7 +520,7 @@ When a node-targeting write tool (`site_insert_html`, `site_get_node_html`, `sit
 Content-scope tools are registered under `server/ai/tools/content/`. They use the same `POST /admin/api/ai/chat/content` stream and `POST /admin/api/ai/tool-result` bridge as the Site editor, but the snapshot and browser executor are content-specific:
 
 - `ContentAgentMount` builds a `ContentSnapshot` from the live Content workspace: visible `postType` collections, active collection id, active document fields/schema, and current user identity.
-- `contentAgentStore.ts` mounts a standalone `AgentSlice` instance per `ContentPage` mount. The Content workspace is hook-based rather than a global Zustand store, so the bridge is exposed through `contentBridgeHandle.ts`.
+- `ContentAgentMount` creates a standalone `AgentSlice` instance per `ContentPage` mount through `createScopedAgentStore` (`src/admin/ai/`, shared with the Plugin IDE). The Content workspace is hook-based rather than a global Zustand store, so the bridge is exposed through `contentBridgeHandle.ts`.
 - Server read tools hit the data, media, and user repositories through `ctx.db`; write tools are browser-bridged so unsaved draft state in `useContentEntryDraft` and the Tiptap body editor stay authoritative.
 
 **Server-side content reads — 7**
@@ -634,7 +634,7 @@ export const siteAgentSliceConfig: AgentSliceConfig = {
 
 `getAgentStoreApi` reads the live store via `storeRef.ts`, wired in `store.ts` after store creation (`setAgentStoreApi(useEditorStore)`). This avoids a static import cycle: executor → store → agentSlice → executor.
 
-The content workspace uses the same factory with `contentAgentSliceConfig` mounted in a standalone per-page store (`contentAgentStore.ts`).
+The content workspace uses the same factory with `contentAgentSliceConfig` mounted in a standalone per-page store (`createScopedAgentStore`, shared with the Plugin IDE).
 
 `agentProviderUpdate.ts` owns the existing-conversation provider/model PUT and its failure reconciliation. A definite 4xx can roll the picker back to the re-read row; a timeout, network failure, or 5xx stays fail-closed unless the re-read already proves that the requested selection committed. `agentSlice.ts` keeps the ordering queue and Send lock because those coordinate store actions rather than HTTP persistence.
 
@@ -864,7 +864,7 @@ unblocks deletion of the credential that had been protected by the default FK.
   - `src/admin/pages/site/agent/types.ts` — `ServerStreamEvent`, `AgentMessage`, `AgentRequestBody`, …
   - `src/admin/pages/site/agent/index.ts` — public barrel
   - `src/admin/pages/content/agent/ContentAgentMount.tsx` — content workspace AgentPanel mount + live bridge handle registration
-  - `src/admin/pages/content/agent/contentAgentStore.ts` — standalone content-workspace agent store
+  - `src/admin/ai/createScopedAgentStore.ts` — standalone per-mount agent store factory (Content workspace, Plugin IDE)
   - `src/admin/pages/content/agent/contentBridge.ts` — content write-tool browser dispatcher
   - `src/admin/pages/content/agent/contentBridgeHandle.ts` — imperative bridge handle registered by ContentPage
   - `src/admin/pages/site/panels/AgentPanel/AgentComposer.tsx` — resolves model window/pricing/capabilities and places the meter in the action row
diff --git a/docs/features/content-workspace.md b/docs/features/content-workspace.md
index 9db04a222..0bae443ca 100644
--- a/docs/features/content-workspace.md
+++ b/docs/features/content-workspace.md
@@ -149,7 +149,7 @@ The mode switch is client-only. The markdown body is the source of truth in both
 
 The Content workspace has its own `content` chat scope, mounted as the `agent` panel in `ContentSidebar` when the current user has `ai.chat`.
 
-`ContentAgentMount` creates a fresh per-page `AgentSlice` store (`contentAgentStore.ts`) for the visible chat panel. Independently, `ContentPage` always mounts `useContentToolBridge`, which registers a `ContentBridgeHandle` and the `content` MCP stream for as long as the workspace is open. The handle reads the current collections, selected entry, draft fields, schema, and current user via refs so either caller sees the same state the user sees. Tool writes go through that handle and then through `useContentWorkspace` / `useContentEntryDraft`, which keeps unsaved body/title/SEO/media changes and sidebar selection in sync. `content_set_active_document` loads an uncached row by id, switches across post-type collections without waiting for the target sidebar list, and commits the workspace and draft focus before it returns so an immediately following write targets the selected document.
+`ContentAgentMount` creates a fresh per-page `AgentSlice` store (`createScopedAgentStore`) for the visible chat panel. Independently, `ContentPage` always mounts `useContentToolBridge`, which registers a `ContentBridgeHandle` and the `content` MCP stream for as long as the workspace is open. The handle reads the current collections, selected entry, draft fields, schema, and current user via refs so either caller sees the same state the user sees. Tool writes go through that handle and then through `useContentWorkspace` / `useContentEntryDraft`, which keeps unsaved body/title/SEO/media changes and sidebar selection in sync. `content_set_active_document` loads an uncached row by id, switches across post-type collections without waiting for the target sidebar list, and commits the workspace and draft focus before it returns so an immediately following write targets the selected document.
 
 The server registers 15 content-scope tools:
 
diff --git a/docs/features/site-plugins.md b/docs/features/site-plugins.md
index 73667cac9..e64c9d2b0 100644
--- a/docs/features/site-plugins.md
+++ b/docs/features/site-plugins.md
@@ -8,8 +8,8 @@ compiled server-side into packages **byte-compatible with installed plugins**
 exact same install/upgrade lifecycle, sandbox, permissions, settings, and
 crash handling. The runtime never branches on provenance.
 
-Design history: `docs/plans/2026-07-02-site-local-integrations-design.md`
-(spec) and `docs/plans/2026-07-03-site-plugins-implementation.md` (plan).
+This document is the design of record; the original spec and implementation
+plan were working notes and are not kept in the repository.
 
 ## The user-facing model
 
@@ -97,7 +97,11 @@ Builds are single-flight per plugin with a 30 s timeout, and every
 lifecycle transition (activate, rollback, delete) is serialized per plugin
 id on top of that (`withSitePluginLock` in the service layer) — two
 overlapping activations would otherwise both read the same row version,
-derive the same next counter, and race the upgrade path. Validate-only mode
+derive the same next counter, and race the upgrade path. The diagnostics
+strip, the preview-pack route and the AI `plugin_validate` tool all run the
+same `buildDraftSitePlugin` (service layer). Diagnostics carry the author's
+file, line and column (`plugins/<id>/modules/foo.ts:22:16: …`); the modules
+pack's generated facade never appears in them. Validate-only mode
 writes into the throwaway workspace (never uploads), returns diagnostics,
 and can return the built modules bundle text (the preview-pack route).
 Diagnostics are bundle/parse errors, sandbox-scan violations, containment
@@ -148,8 +152,9 @@ deactivate/delete):
 `runtime-error` · `disabled` · `source-missing`
 
 Each state maps to ONE smart primary action (`sitePluginPrimaryAction`),
-used by both the Plugins-page card and the IDE header. Unavailable actions
-are disabled with an inline reason, never hidden.
+rendered in the IDE header; the Plugins-page draft card only offers `Open
+IDE` (an activated site plugin is an ordinary installed row there).
+Unavailable actions are disabled with an inline reason, never hidden.
 
 ## The Plugin IDE
 
diff --git a/docs/features/site-shell.md b/docs/features/site-shell.md
index d4abffdf7..d89946ff6 100644
--- a/docs/features/site-shell.md
+++ b/docs/features/site-shell.md
@@ -513,8 +513,9 @@ plus one `site:<branch>` doc per branch for the shell and the roster order
 as a Y.Map with the module's inline-text prop as Y.Text, nested
 `breakpointOverrides` Y.Maps, `children` as Y.Array; `parentId` is derived,
 never stored). Layout snapshots are whole-value LWW. The shell keeps
-`settings` / `styleRules` / `explorer` as per-entry Y.Maps and everything
-else plain. Deterministic reconciles (`integrity.ts` tree repair, roster
+`settings` / `styleRules` / `explorer` as per-entry Y.Maps, `files` as a
+per-file Y.Map whose `content` is a Y.Text (`filesY.ts`, so code files
+co-edit character-level), and everything else plain. Deterministic reconciles (`integrity.ts` tree repair, roster
 order) run identically on every peer.
 
 **Editor write path** (`src/admin/pages/site/store/slices/site/collabBinding.ts`):
diff --git a/server/ai/tools/plugin/index.ts b/server/ai/tools/plugin/index.ts
index 24653a246..f3fa97569 100644
--- a/server/ai/tools/plugin/index.ts
+++ b/server/ai/tools/plugin/index.ts
@@ -32,8 +32,7 @@ export const pluginTools: AiTool[] = [
 ]
 
 export { buildPluginSystemPrompt } from './systemPrompt'
-export {
-  PluginIdeSnapshotSchema,
-  emptyPluginIdeSnapshot,
-} from './snapshot'
-export type { PluginIdeSnapshot } from './snapshot'
+// The snapshot schema lives in @core/ai so the IDE and the server derive
+// the same type; re-exported here for the chat handler's scope wiring.
+export { PluginIdeSnapshotSchema, emptyPluginIdeSnapshot } from '@core/ai'
+export type { PluginIdeSnapshot } from '@core/ai'
diff --git a/server/ai/tools/plugin/systemPrompt.ts b/server/ai/tools/plugin/systemPrompt.ts
index 0f0dfff7d..1de456a6a 100644
--- a/server/ai/tools/plugin/systemPrompt.ts
+++ b/server/ai/tools/plugin/systemPrompt.ts
@@ -7,7 +7,7 @@
  * list, runtime state, and the latest diagnostics.
  */
 import { SYSTEM_PROMPT_DYNAMIC_BOUNDARY } from '../../runtime/types'
-import type { PluginIdeSnapshot } from './snapshot'
+import type { PluginIdeSnapshot } from '@core/ai'
 
 const STATIC_PROMPT_PREFIX = `You are a plugin developer working inside the Instatic Plugin IDE, co-editing a SITE PLUGIN's source with the user in real time. You read and write files by calling tools; edits merge live into the user's open editor (CRDT) — there is no save step.
 
diff --git a/src/admin/ai/createScopedAgentStore.ts b/src/admin/ai/createScopedAgentStore.ts
new file mode 100644
index 000000000..97dcc83dd
--- /dev/null
+++ b/src/admin/ai/createScopedAgentStore.ts
@@ -0,0 +1,43 @@
+/**
+ * A standalone Zustand store holding ONLY the AgentSlice — the shape the
+ * hook-based workspaces (Content, Plugin IDE) compose per page mount.
+ *
+ * Why standalone: those workspaces are built on React hooks, not Zustand,
+ * so there is no parent store to compose the slice into, and building a
+ * whole workspace store just for the agent would be overkill.
+ *
+ * Why per mount (not module-level like useEditorStore): the pages mount and
+ * unmount as the user navigates; rebuilding the store each mount keeps
+ * memory in check and makes sure stale snapshot closures do not survive a
+ * logout or user swap. The site editor's store is module-level because the
+ * editor session is the entire admin lifetime, which does not apply here.
+ *
+ * The `as unknown as …` cast bridges the slice factory's site-editor-shaped
+ * return type (`EditorStoreSliceCreator<AgentSlice>`, typed for the combined
+ * site store) into a slice-only store. The slice only ever touches
+ * AgentSlice keys at runtime, so the widening is structurally safe and
+ * beats duplicating the factory per store shape.
+ */
+import { create, type StateCreator } from 'zustand'
+import { mutative } from 'zustand-mutative'
+import { subscribeWithSelector } from 'zustand/middleware'
+import { createAgentSlice, type AgentSlice, type AgentSliceConfig } from '@site/agent'
+
+export function createScopedAgentStore(config: AgentSliceConfig) {
+  const sliceCreator = createAgentSlice(config) as unknown as StateCreator<
+    AgentSlice,
+    [['zustand/mutative', never]],
+    [],
+    AgentSlice
+  >
+  return create<AgentSlice>()(
+    subscribeWithSelector(
+      mutative(
+        (...args) => ({
+          ...sliceCreator(...args),
+        }),
+        { enableAutoFreeze: true },
+      ),
+    ),
+  )
+}
diff --git a/src/admin/pages/content/agent/ContentAgentMount.tsx b/src/admin/pages/content/agent/ContentAgentMount.tsx
index 2dca58651..e8a0bba42 100644
--- a/src/admin/pages/content/agent/ContentAgentMount.tsx
+++ b/src/admin/pages/content/agent/ContentAgentMount.tsx
@@ -1,15 +1,16 @@
 /** The docked Content agent UI. Tool registration lives at ContentPage level. */
 import { useEffect, useState } from 'react'
 import { AgentStoreProvider } from '@admin/ai/AgentStoreContext'
+import { createScopedAgentStore } from '@admin/ai/createScopedAgentStore'
 import { AgentPanel } from '@site/panels/AgentPanel'
-import { createContentAgentStore } from './contentAgentStore'
+import { contentAgentSliceConfig } from './agentSliceConfig.content'
 
 interface ContentAgentMountProps {
   isVisible: boolean
 }
 
 export function ContentAgentMount({ isVisible }: ContentAgentMountProps) {
-  const [store] = useState(() => createContentAgentStore())
+  const [store] = useState(() => createScopedAgentStore(contentAgentSliceConfig))
 
   useEffect(() => {
     if (isVisible) store.getState().openAgent()
diff --git a/src/admin/pages/plugins/PluginsPage.tsx b/src/admin/pages/plugins/PluginsPage.tsx
index 507f62cd8..d86436291 100644
--- a/src/admin/pages/plugins/PluginsPage.tsx
+++ b/src/admin/pages/plugins/PluginsPage.tsx
@@ -13,6 +13,7 @@ import { PluginSettingsDialog } from './components/PluginSettingsDialog/PluginSe
 import { PluginSchedulesDialog } from './components/PluginSchedulesDialog/PluginSchedulesDialog'
 import { isSandboxRelatedError, usePluginsWorkspace } from './hooks/usePluginsWorkspace'
 import { useSitePlugins } from './hooks/useSitePlugins'
+import { localIdFromSitePluginId } from '@core/site-plugins'
 import { notifyCmsPluginsChanged } from './utils/pluginEvents'
 import { useAuthenticatedAdminUser } from '@admin/sessionContext'
 import {
@@ -202,7 +203,10 @@ export function PluginsPage() {
                   onReinstall={() => fileInputRef.current?.click()}
                   onToggle={(p) => void vm.togglePlugin(p)}
                   onRemove={(p) => vm.setPendingRemove({ plugin: p, force: false })}
-                  onOpenIde={(p) => openIde(p.id.replace(/^site\./, ''))}
+                  onOpenIde={(p) => {
+                    const localId = localIdFromSitePluginId(p.id)
+                    if (localId) openIde(localId)
+                  }}
                 />
               ))}
               {draftOnlySitePlugins.map((plugin) => (
diff --git a/src/admin/pages/plugins/components/NewSitePluginDialog.module.css b/src/admin/pages/plugins/components/NewSitePluginDialog.module.css
index 62234cbc9..9b26d4316 100644
--- a/src/admin/pages/plugins/components/NewSitePluginDialog.module.css
+++ b/src/admin/pages/plugins/components/NewSitePluginDialog.module.css
@@ -52,8 +52,3 @@
   color: var(--text-subtle);
 }
 
-.error {
-  margin: 0;
-  font-size: var(--text-xs);
-  color: var(--danger);
-}
diff --git a/src/admin/pages/plugins/components/NewSitePluginDialog.tsx b/src/admin/pages/plugins/components/NewSitePluginDialog.tsx
index 0946aa27c..0a645b3ee 100644
--- a/src/admin/pages/plugins/components/NewSitePluginDialog.tsx
+++ b/src/admin/pages/plugins/components/NewSitePluginDialog.tsx
@@ -13,11 +13,13 @@ import { getErrorMessage } from '@core/utils/errorMessage'
 import {
   SITE_PLUGIN_LOCAL_ID_PATTERN,
   SITE_PLUGIN_TEMPLATES,
+  sitePluginLocalIdFromName,
   type SitePluginTemplateId,
 } from '@core/site-plugins'
 import { Button } from '@ui/components/Button'
 import { Dialog } from '@ui/components/Dialog'
 import { Input } from '@ui/components/Input'
+import { pushToast } from '@ui/components/Toast'
 import styles from './NewSitePluginDialog.module.css'
 
 const ScaffoldResponseSchema = Type.Object({
@@ -26,15 +28,6 @@ const ScaffoldResponseSchema = Type.Object({
   files: Type.Array(Type.String()),
 })
 
-function deriveLocalId(name: string): string {
-  return name
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, '-')
-    .replace(/^-+|-+$/g, '')
-    .replace(/^[^a-z]+/, '')
-    .slice(0, 40)
-}
-
 interface NewSitePluginDialogProps {
   existingLocalIds: string[]
   onClose: () => void
@@ -51,15 +44,14 @@ export function NewSitePluginDialog({
   const [localId, setLocalId] = useState('')
   const [template, setTemplate] = useState<SitePluginTemplateId>('module')
   const [busy, setBusy] = useState(false)
-  const [error, setError] = useState<string | null>(null)
 
-  const effectiveLocalId = localIdTouched ? localId : deriveLocalId(name)
+  const effectiveLocalId = localIdTouched ? localId : sitePluginLocalIdFromName(name)
   const idValid = SITE_PLUGIN_LOCAL_ID_PATTERN.test(effectiveLocalId)
   const idTaken = existingLocalIds.includes(effectiveLocalId)
   const canSubmit = name.trim().length > 0 && idValid && !idTaken && !busy
 
-  // Field-local validation stays inline (allowed exception); operation
-  // failures surface via the dialog-level alert below.
+  // Field-local validation stays inline (the allowed exception); the scaffold
+  // request itself is an operation and toasts on failure.
   const idHint = !effectiveLocalId
     ? null
     : !idValid
@@ -71,7 +63,6 @@ export function NewSitePluginDialog({
   const submit = async (): Promise<void> => {
     if (!canSubmit) return
     setBusy(true)
-    setError(null)
     try {
       const result = await apiRequest('/admin/api/cms/site-plugins', {
         method: 'POST',
@@ -80,7 +71,11 @@ export function NewSitePluginDialog({
       })
       onCreated(result.localId)
     } catch (err) {
-      setError(getErrorMessage(err, 'Could not create the site plugin'))
+      pushToast({
+        kind: 'error',
+        title: 'Could not create the site plugin',
+        body: getErrorMessage(err, 'Unknown error'),
+      })
       setBusy(false)
     }
   }
@@ -153,7 +148,6 @@ export function NewSitePluginDialog({
               size="sm"
               role="radio"
               aria-checked={template === option.id}
-              pressed={template === option.id}
               className={styles.templateCard}
               onClick={() => setTemplate(option.id)}
               data-testid={`template-${option.id}`}
@@ -163,12 +157,6 @@ export function NewSitePluginDialog({
             </Button>
           ))}
         </div>
-
-        {error && (
-          <p className={styles.error} role="alert">
-            {error}
-          </p>
-        )}
       </div>
     </Dialog>
   )
diff --git a/src/admin/pages/plugins/ide/agent/PluginIdeAgentMount.tsx b/src/admin/pages/plugins/ide/agent/PluginIdeAgentMount.tsx
index 210bd4e4c..b803a0f74 100644
--- a/src/admin/pages/plugins/ide/agent/PluginIdeAgentMount.tsx
+++ b/src/admin/pages/plugins/ide/agent/PluginIdeAgentMount.tsx
@@ -1,15 +1,16 @@
 /** The docked Plugin IDE agent UI. Tool registration lives at page level. */
 import { useEffect, useState } from 'react'
 import { AgentStoreProvider } from '@admin/ai/AgentStoreContext'
+import { createScopedAgentStore } from '@admin/ai/createScopedAgentStore'
 import { AgentPanel } from '@site/panels/AgentPanel'
-import { createPluginAgentStore } from './pluginAgentStore'
+import { pluginAgentSliceConfig } from './agentSliceConfig.plugin'
 
 interface PluginIdeAgentMountProps {
   isVisible: boolean
 }
 
 export function PluginIdeAgentMount({ isVisible }: PluginIdeAgentMountProps) {
-  const [store] = useState(() => createPluginAgentStore())
+  const [store] = useState(() => createScopedAgentStore(pluginAgentSliceConfig))
 
   useEffect(() => {
     if (isVisible) store.getState().openAgent()
diff --git a/src/admin/pages/plugins/ide/agent/agentSliceConfig.plugin.ts b/src/admin/pages/plugins/ide/agent/agentSliceConfig.plugin.ts
index 14c4983ae..6a4df3d21 100644
--- a/src/admin/pages/plugins/ide/agent/agentSliceConfig.plugin.ts
+++ b/src/admin/pages/plugins/ide/agent/agentSliceConfig.plugin.ts
@@ -11,15 +11,12 @@
  */
 import type { AgentSliceConfig } from '@site/agent'
 import { executePluginTool } from './pluginBridge'
-import {
-  emptyPluginIdeAgentSnapshot,
-  getPluginIdeBridgeHandle,
-} from './pluginBridgeHandle'
+import { emptyPluginIdeSnapshot, getPluginIdeBridgeHandle } from './pluginBridgeHandle'
 
 export const pluginAgentSliceConfig: AgentSliceConfig = {
   scope: 'plugin',
   buildSnapshot: () =>
-    getPluginIdeBridgeHandle()?.buildSnapshot() ?? emptyPluginIdeAgentSnapshot(),
+    getPluginIdeBridgeHandle()?.buildSnapshot() ?? emptyPluginIdeSnapshot(),
   dispatchTool: executePluginTool,
   noProviderMessage:
     'No AI provider configured for the Plugin IDE. Open /admin/ai/providers to add a credential, then /admin/ai/defaults to pick one for the "plugin" scope.',
diff --git a/src/admin/pages/plugins/ide/agent/pluginBridge.ts b/src/admin/pages/plugins/ide/agent/pluginBridge.ts
index 333493edf..eaf83f220 100644
--- a/src/admin/pages/plugins/ide/agent/pluginBridge.ts
+++ b/src/admin/pages/plugins/ide/agent/pluginBridge.ts
@@ -23,6 +23,9 @@ import {
   aiToolError,
   aiToolOk,
   applyExactReplacements,
+  hashText,
+  paginateText,
+  utf8ByteLength,
   PluginDeleteFileInputSchema,
   PluginListFilesInputSchema,
   PluginOpenFileInputSchema,
@@ -35,7 +38,7 @@ import {
 import { isSafePath, normalizePath } from '@core/files/pathValidation'
 import { sitePluginFolder } from '@core/site-plugins'
 import { getErrorMessage } from '@core/utils/errorMessage'
-import { parseValue, type TSchema, type Static } from '@core/utils/typeboxHelpers'
+import { parseValue, type Static } from '@core/utils/typeboxHelpers'
 import type { IdeCollabSession, IdeFileMeta } from '../ideCollab'
 import {
   getPluginIdeBridgeHandle,
@@ -43,14 +46,6 @@ import {
 } from './pluginBridgeHandle'
 
 const DEFAULT_READ_MAX_CHARS = 12000
-const textEncoder = new TextEncoder()
-
-async function hashContent(content: string): Promise<string> {
-  const digest = await crypto.subtle.digest('SHA-256', textEncoder.encode(content))
-  return Array.from(new Uint8Array(digest))
-    .map((byte) => byte.toString(16).padStart(2, '0'))
-    .join('')
-}
 
 interface BridgeCtx {
   handle: PluginIdeBridgeHandle
@@ -116,18 +111,23 @@ function resolveFile(
   return { ok: true, file: file! }
 }
 
-function contentOf(ctx: BridgeCtx, fileId: string): string {
-  return ctx.session.contentText(fileId)?.toString() ?? ''
+/** Live text of a file, or null when the entry carries no editable text. */
+function contentOf(ctx: BridgeCtx, fileId: string): string | null {
+  return ctx.session.contentText(fileId)?.toString() ?? null
+}
+
+function noTextError(ctx: BridgeCtx, file: IdeFileMeta): AiToolOutput {
+  return aiToolError(`${relativePathOf(ctx, file)} has no editable text content.`)
 }
 
 async function describeFile(ctx: BridgeCtx, file: IdeFileMeta) {
-  const content = contentOf(ctx, file.id)
+  const content = contentOf(ctx, file.id) ?? ''
   return {
     fileId: file.id,
     path: relativePathOf(ctx, file),
     contentChars: content.length,
-    bytes: textEncoder.encode(content).byteLength,
-    hash: await hashContent(content),
+    bytes: utf8ByteLength(content),
+    hash: await hashText(content),
     updatedAt: file.updatedAt,
   }
 }
@@ -153,28 +153,19 @@ async function runReadFile(
   if (!resolved.ok) return aiToolError(resolved.error)
 
   const content = contentOf(ctx, resolved.file.id)
-  const maxChars = input.maxChars ?? DEFAULT_READ_MAX_CHARS
-  const totalParts = Math.max(1, Math.ceil(content.length / maxChars))
-  const part = input.part ?? 1
-  if (part > totalParts) {
-    return aiToolError(`File part ${part} is out of range; totalParts is ${totalParts}.`)
-  }
-  const start = (part - 1) * maxChars
-  const end = Math.min(content.length, start + maxChars)
+  if (content === null) return noTextError(ctx, resolved.file)
+  const page = paginateText(content, {
+    part: input.part,
+    maxChars: input.maxChars,
+    defaultMaxChars: DEFAULT_READ_MAX_CHARS,
+  })
+  if (!page.ok) return aiToolError(page.error)
   return aiToolOk({
     fileId: resolved.file.id,
     path: relativePathOf(ctx, resolved.file),
-    content: content.slice(start, end),
-    hash: await hashContent(content),
-    pageInfo: {
-      part,
-      totalParts,
-      nextPart: part < totalParts ? part + 1 : null,
-      maxChars,
-      start,
-      end,
-      totalChars: content.length,
-    },
+    content: page.content,
+    hash: await hashText(content),
+    pageInfo: page.pageInfo,
   })
 }
 
@@ -210,7 +201,8 @@ async function runPatchFile(
   if (!resolved.ok) return aiToolError(resolved.error)
 
   const currentContent = contentOf(ctx, resolved.file.id)
-  const currentHash = await hashContent(currentContent)
+  if (currentContent === null) return noTextError(ctx, resolved.file)
+  const currentHash = await hashText(currentContent)
   if (currentHash !== input.expectedHash) {
     return aiToolError(
       `Hash mismatch for ${relativePathOf(ctx, resolved.file)} — the file changed since you read it. Call plugin_read_file again before patching.`,
@@ -314,20 +306,20 @@ export async function executePluginTool(
   try {
     switch (toolName) {
       case 'plugin_list_files':
-        parse(PluginListFilesInputSchema, input)
+        parseValue(PluginListFilesInputSchema, input)
         return await runListFiles(ctx)
       case 'plugin_read_file':
-        return await runReadFile(ctx, parse(PluginReadFileInputSchema, input))
+        return await runReadFile(ctx, parseValue(PluginReadFileInputSchema, input))
       case 'plugin_write_file':
-        return await runWriteFile(ctx, parse(PluginWriteFileInputSchema, input))
+        return await runWriteFile(ctx, parseValue(PluginWriteFileInputSchema, input))
       case 'plugin_patch_file':
-        return await runPatchFile(ctx, parse(PluginPatchFileInputSchema, input))
+        return await runPatchFile(ctx, parseValue(PluginPatchFileInputSchema, input))
       case 'plugin_rename_file':
-        return await runRenameFile(ctx, parse(PluginRenameFileInputSchema, input))
+        return await runRenameFile(ctx, parseValue(PluginRenameFileInputSchema, input))
       case 'plugin_delete_file':
-        return runDeleteFile(ctx, parse(PluginDeleteFileInputSchema, input))
+        return runDeleteFile(ctx, parseValue(PluginDeleteFileInputSchema, input))
       case 'plugin_open_file':
-        return runOpenFile(ctx, parse(PluginOpenFileInputSchema, input))
+        return runOpenFile(ctx, parseValue(PluginOpenFileInputSchema, input))
       default:
         return aiToolError(`Unknown plugin tool: ${toolName}`)
     }
@@ -335,7 +327,3 @@ export async function executePluginTool(
     return aiToolError(getErrorMessage(err, `Tool ${toolName} failed.`))
   }
 }
-
-function parse<S extends TSchema>(schema: S, input: unknown): Static<S> {
-  return parseValue(schema, input)
-}
diff --git a/src/admin/pages/plugins/ide/agent/pluginBridgeHandle.ts b/src/admin/pages/plugins/ide/agent/pluginBridgeHandle.ts
index 473173106..1ea14fd08 100644
--- a/src/admin/pages/plugins/ide/agent/pluginBridgeHandle.ts
+++ b/src/admin/pages/plugins/ide/agent/pluginBridgeHandle.ts
@@ -8,33 +8,17 @@
  * dispatcher reads it and calls methods on it. Same module-level-handle
  * pattern as the content workspace's `contentBridgeHandle.ts`.
  *
- * The snapshot shape structurally mirrors
- * `server/ai/tools/plugin/snapshot.ts → PluginIdeSnapshot` — defined here
- * (not imported) so the frontend doesn't reach into `server/`. Keep the two
- * in sync.
+ * The snapshot shape is `PluginIdeSnapshot` from `@core/ai` — the same
+ * schema the server validates against, so the two sides cannot drift.
  */
+import type { PluginIdeSnapshot } from '@core/ai'
 import type { SitePluginSummary } from '@core/site-plugins'
 import type { IdeCollabSession, IdeFileMeta } from '../ideCollab'
 
-export interface PluginIdeAgentCurrentUser {
-  id: string
-  displayName: string
-  email: string
-}
+export type { PluginIdeSnapshot } from '@core/ai'
+export { emptyPluginIdeSnapshot } from '@core/ai'
 
-/** Mirrors `PluginIdeSnapshot` (server) — see module doc. */
-export interface PluginIdeAgentSnapshot {
-  localId: string
-  pluginId: string
-  files: Array<{ id: string; path: string }>
-  activeFile: { id: string; path: string } | null
-  state: string
-  activeVersion: string | null
-  declaredPermissions: string[]
-  grantedPermissions: string[]
-  latestDiagnostics: string[] | null
-  currentUser: PluginIdeAgentCurrentUser
-}
+export type PluginIdeAgentCurrentUser = PluginIdeSnapshot['currentUser']
 
 /**
  * Imperative surface the IDE page exposes to the agent bridge. Accessors
@@ -45,7 +29,7 @@ export interface PluginIdeBridgeHandle {
   /** The plugin this IDE mount edits. */
   readonly localId: string
   /** Per-request snapshot for the system prompt + server tools. */
-  buildSnapshot(): PluginIdeAgentSnapshot
+  buildSnapshot(): PluginIdeSnapshot
   /** The live collab session; null for at most the mount render. */
   session(): IdeCollabSession | null
   /** Live file metas (full `plugins/<localId>/…` paths), path-sorted. */
@@ -66,26 +50,11 @@ export function getPluginIdeBridgeHandle(): PluginIdeBridgeHandle | null {
   return handle
 }
 
-export function emptyPluginIdeAgentSnapshot(): PluginIdeAgentSnapshot {
-  return {
-    localId: '',
-    pluginId: '',
-    files: [],
-    activeFile: null,
-    state: 'draft-changed',
-    activeVersion: null,
-    declaredPermissions: [],
-    grantedPermissions: [],
-    latestDiagnostics: null,
-    currentUser: { id: '', displayName: '', email: '' },
-  }
-}
-
 /** Narrow a SitePluginSummary into the snapshot's runtime fields. */
 export function summarySnapshotFields(
   summary: SitePluginSummary | null,
 ): Pick<
-  PluginIdeAgentSnapshot,
+  PluginIdeSnapshot,
   'state' | 'activeVersion' | 'declaredPermissions' | 'grantedPermissions'
 > {
   return {
diff --git a/src/admin/pages/plugins/ide/agent/usePluginIdeToolBridge.ts b/src/admin/pages/plugins/ide/agent/usePluginIdeToolBridge.ts
index bd39c2774..327c77fe0 100644
--- a/src/admin/pages/plugins/ide/agent/usePluginIdeToolBridge.ts
+++ b/src/admin/pages/plugins/ide/agent/usePluginIdeToolBridge.ts
@@ -14,8 +14,8 @@ import {
   setPluginIdeBridgeHandle,
   summarySnapshotFields,
   type PluginIdeAgentCurrentUser,
-  type PluginIdeAgentSnapshot,
   type PluginIdeBridgeHandle,
+  type PluginIdeSnapshot,
 } from './pluginBridgeHandle'
 
 interface UsePluginIdeToolBridgeOptions {
@@ -52,7 +52,7 @@ export function usePluginIdeToolBridge(options: UsePluginIdeToolBridgeOptions):
     }
     const handle: PluginIdeBridgeHandle = {
       localId,
-      buildSnapshot(): PluginIdeAgentSnapshot {
+      buildSnapshot(): PluginIdeSnapshot {
         const current = optionsRef.current
         return {
           localId,
diff --git a/src/admin/pages/plugins/ide/ideCollab.ts b/src/admin/pages/plugins/ide/ideCollab.ts
index 1d11ff515..70d26c657 100644
--- a/src/admin/pages/plugins/ide/ideCollab.ts
+++ b/src/admin/pages/plugins/ide/ideCollab.ts
@@ -114,6 +114,7 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
   let binding: BoundCollabDoc
   let generation = 0
   let destroyed = false
+  let filesCache: { signature: string; files: IdeFileMeta[] } = { signature: '', files: [] }
 
   const shell = (): Y.Map<unknown> => shellMap(binding.doc)
 
@@ -224,10 +225,17 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
     },
     generation: () => generation,
 
-    pluginFiles: () =>
-      allFileMetas()
+    pluginFiles: () => {
+      const next = allFileMetas()
         .filter((file) => file.path.startsWith(folder))
-        .sort((a, b) => a.path.localeCompare(b.path)),
+        .sort((a, b) => a.path.localeCompare(b.path))
+      // Same array back while ids and paths are unchanged, so a keystroke
+      // (which fires the same observer) is not a structural change to
+      // whoever renders the list.
+      const signature = next.map((file) => `${file.id}:${file.path}`).join('|')
+      if (signature !== filesCache.signature) filesCache = { signature, files: next }
+      return filesCache.files
+    },
 
     onFilesChange: (listener) => {
       filesListeners.add(listener)
diff --git a/src/admin/pages/plugins/ide/useSitePluginIde.ts b/src/admin/pages/plugins/ide/useSitePluginIde.ts
index 123532afc..935d262ff 100644
--- a/src/admin/pages/plugins/ide/useSitePluginIde.ts
+++ b/src/admin/pages/plugins/ide/useSitePluginIde.ts
@@ -7,16 +7,14 @@
  * (activate / rollback / deactivate / delete / preview) with the same
  * step-up retry pattern the Plugins page uses.
  */
-import { useEffect, useRef, useState, useSyncExternalStore, useCallback } from 'react'
+import { useCallback, useEffect, useRef, useState, useSyncExternalStore } from 'react'
 import { apiRequest } from '@core/http'
 import { Type } from '@core/utils/typeboxHelpers'
 import { getErrorMessage } from '@core/utils/errorMessage'
-import {
-  SitePluginsPayloadSchema,
-  type SitePluginSummary,
-} from '@core/site-plugins'
+import { SitePluginsPayloadSchema, type SitePluginSummary } from '@core/site-plugins'
 import { pushToast } from '@ui/components/Toast'
 import { StepUpCancelledMessage, useStepUp } from '@admin/shared/StepUp'
+import { useAsyncResource } from '@admin/lib/useAsyncResource'
 import { useNavigate } from '@admin/lib/routing'
 import { notifyCmsPluginsChanged } from '@plugins/utils/pluginEvents'
 import { createIdeCollabSession, type IdeCollabSession, type IdeFileMeta } from './ideCollab'
@@ -26,9 +24,16 @@ const ValidateResponseSchema = Type.Object({
   diagnostics: Type.Array(Type.String()),
 })
 
+/** Every lifecycle route may carry a non-fatal warning (a failed republish). */
+const LifecycleResponseSchema = Type.Object({
+  warning: Type.Optional(Type.String()),
+})
+
 const AUTO_VALIDATE_DEBOUNCE_MS = 900
+const NO_FILES: IdeFileMeta[] = []
+const noop = (): void => {}
 
-export interface SitePluginIdeVm {
+interface SitePluginIdeVm {
   /** Null for at most one render — the mount effect creates it. */
   session: IdeCollabSession | null
   files: IdeFileMeta[]
@@ -38,7 +43,6 @@ export interface SitePluginIdeVm {
   activeFileId: string | null
   selectFile: (fileId: string | null) => void
   summary: SitePluginSummary | null
-  refreshSummary: () => Promise<void>
   diagnostics: string[]
   validating: boolean
   runValidation: () => void
@@ -59,7 +63,6 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
   // free create/destroy in the effect below.
   const [session, setSession] = useState<IdeCollabSession | null>(null)
   const [activeFileId, setActiveFileId] = useState<string | null>(null)
-  const [summary, setSummary] = useState<SitePluginSummary | null>(null)
   const [diagnostics, setDiagnostics] = useState<string[]>([])
   const [validating, setValidating] = useState(false)
   const [activating, setActivating] = useState(false)
@@ -89,51 +92,44 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
   // the editor buffer remounts on the generation.
   // useCallback kept: useSyncExternalStore resubscribes on identity change.
   const subscribeSync = useCallback(
-    (onStoreChange: () => void) => session?.onSyncChange(onStoreChange) ?? (() => {}),
+    (onStoreChange: () => void) => session?.onSyncChange(onStoreChange) ?? noop,
     [session],
   )
   const synced = useSyncExternalStore(subscribeSync, () => session?.synced() ?? false)
   const generation = useSyncExternalStore(subscribeSync, () => session?.generation() ?? 0)
 
-  // Files metadata via useSyncExternalStore — content keystrokes fire the
-  // underlying observer too, so the snapshot is signature-cached and only
-  // re-renders on structural/metadata changes.
-  const filesCache = useRef<{ signature: string; files: IdeFileMeta[] }>({
-    signature: '',
-    files: [],
-  })
+  // File metadata. The session hands back the same array until an id or a
+  // path changes, so content keystrokes (which fire the same observer)
+  // never re-render the tree.
+  // useCallback kept: same reason as subscribeSync.
   const subscribeFiles = useCallback(
-    (onStoreChange: () => void) => session?.onFilesChange(onStoreChange) ?? (() => {}),
+    (onStoreChange: () => void) => session?.onFilesChange(onStoreChange) ?? noop,
     [session],
   )
-  const getFilesSnapshot = useCallback((): IdeFileMeta[] => {
-    const files = session?.pluginFiles() ?? []
-    const signature = files.map((file) => `${file.id}:${file.path}`).join('|')
-    if (signature !== filesCache.current.signature) {
-      filesCache.current = { signature, files }
-    }
-    return filesCache.current.files
-  }, [session])
-  const files = useSyncExternalStore(subscribeFiles, getFilesSnapshot)
+  const files = useSyncExternalStore(subscribeFiles, () => session?.pluginFiles() ?? NO_FILES)
 
-  const refreshSummary = useCallback(async (): Promise<void> => {
-    try {
-      const payload = await apiRequest('/admin/api/cms/site-plugins', {
+  // The runtime summary (state chip, grants, active version): one GET, the
+  // canonical single-resource shape.
+  const summaryResource = useAsyncResource(
+    (signal) =>
+      apiRequest('/admin/api/cms/site-plugins', {
         schema: SitePluginsPayloadSchema,
-      })
-      setSummary(payload.sitePlugins.find((entry) => entry.localId === localId) ?? null)
-    } catch (err) {
-      console.error('[SitePluginIde] summary load failed:', err)
-    }
-  }, [localId])
-
+        signal,
+      }).then(
+        (payload) => payload.sitePlugins.find((entry) => entry.localId === localId) ?? null,
+      ),
+    [localId],
+    { fallbackError: 'Could not load the plugin state' },
+  )
+  const summary = summaryResource.data
+  const refreshSummary = summaryResource.refresh
   useEffect(() => {
-    const timer = setTimeout(() => {
-      void refreshSummary()
-    }, 0)
-    return () => clearTimeout(timer)
-  }, [refreshSummary])
+    if (summaryResource.error) {
+      console.error('[SitePluginIde] summary load failed:', summaryResource.error)
+    }
+  }, [summaryResource.error])
 
+  // useCallback kept: runValidation is a dependency of the effects below.
   const runValidation = useCallback((): void => {
     const seq = ++validateSeq.current
     setValidating(true)
@@ -154,7 +150,7 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
       })
     // State chips (draft-changed vs active) key off the content hash — keep
     // the summary fresh alongside diagnostics.
-    void refreshSummary()
+    refreshSummary()
   }, [localId, refreshSummary])
 
   // Automatic validation — debounced on every file change (metadata or
@@ -187,115 +183,81 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
     return () => clearTimeout(timer)
   }, [synced, runValidation])
 
-  const activate = useCallback(async (): Promise<void> => {
-    setActivating(true)
+  /**
+   * Every lifecycle action has the same shape: a step-up-aware request, a
+   * success toast, a nudge to open editors (so a new revision's module pack
+   * or editor entrypoint loads without a reload), then a summary refresh.
+   * A cancelled step-up is silent; anything else toasts as an error.
+   */
+  const runLifecycle = async (
+    request: () => Promise<{ warning?: string }>,
+    labels: { success: string | null; failure: string },
+    hooks: { after?: () => void; onFailure?: () => void } = {},
+  ): Promise<void> => {
     try {
-      await runStepUp(() =>
-        apiRequest(`/admin/api/cms/site-plugins/${localId}/activate`, { method: 'POST' }),
-      )
-      pushToast({ kind: 'success', title: 'Site plugin activated' })
-      // Open editor sessions re-run their plugin activation pass so the new
-      // revision's module pack / editor entrypoint load without a reload.
-      notifyCmsPluginsChanged()
-      await refreshSummary()
-    } catch (err) {
-      if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
-        pushToast({
-          kind: 'error',
-          title: 'Build & activate failed',
-          body: getErrorMessage(err, 'Unknown activation error'),
-        })
-        runValidation()
+      const result = await runStepUp(request)
+      if (labels.success) pushToast({ kind: 'success', title: labels.success })
+      if (result.warning) {
+        pushToast({ kind: 'warning', title: 'Completed with a warning', body: result.warning })
       }
-    } finally {
-      setActivating(false)
-    }
-  }, [localId, refreshSummary, runStepUp, runValidation])
-
-  const rollback = useCallback(async (): Promise<void> => {
-    try {
-      await runStepUp(() =>
-        apiRequest(`/admin/api/cms/site-plugins/${localId}/rollback`, { method: 'POST' }),
-      )
-      pushToast({ kind: 'success', title: 'Rolled back to the previous revision' })
       notifyCmsPluginsChanged()
-      await refreshSummary()
+      ;(hooks.after ?? refreshSummary)()
     } catch (err) {
-      if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
-        pushToast({
-          kind: 'error',
-          title: 'Rollback failed',
-          body: getErrorMessage(err, 'Unknown rollback error'),
-        })
-      }
+      if (err instanceof Error && err.message === StepUpCancelledMessage) return
+      pushToast({ kind: 'error', title: labels.failure, body: getErrorMessage(err, 'Unknown error') })
+      hooks.onFailure?.()
     }
-  }, [localId, refreshSummary, runStepUp])
+  }
 
-  const setEnabled = useCallback(
-    async (enabled: boolean): Promise<void> => {
-      try {
-        await runStepUp(() =>
-          apiRequest(`/admin/api/cms/plugins/site.${localId}`, {
-            method: 'PATCH',
-            body: { enabled },
-          }),
-        )
-        notifyCmsPluginsChanged()
-        await refreshSummary()
-      } catch (err) {
-        if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
-          pushToast({
-            kind: 'error',
-            title: enabled ? 'Could not activate' : 'Could not deactivate',
-            body: getErrorMessage(err, 'Unknown error'),
-          })
-        }
-      }
-    },
-    [localId, refreshSummary, runStepUp],
-  )
+  const lifecycleRequest =
+    (path: string, init: { method: 'POST' | 'PATCH' | 'DELETE'; body?: unknown }) =>
+    () =>
+      apiRequest(path, { ...init, schema: LifecycleResponseSchema })
 
-  const restart = useCallback(async (): Promise<void> => {
+  const activate = async (): Promise<void> => {
+    setActivating(true)
     try {
-      await runStepUp(() =>
-        apiRequest(`/admin/api/cms/plugins/site.${localId}/restart`, { method: 'POST' }),
+      await runLifecycle(
+        lifecycleRequest(`/admin/api/cms/site-plugins/${localId}/activate`, { method: 'POST' }),
+        { success: 'Site plugin activated', failure: 'Build & activate failed' },
+        { onFailure: runValidation },
       )
-      pushToast({ kind: 'success', title: 'Plugin restarted' })
-      notifyCmsPluginsChanged()
-      await refreshSummary()
-    } catch (err) {
-      if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
-        pushToast({
-          kind: 'error',
-          title: 'Restart failed',
-          body: getErrorMessage(err, 'Unknown error'),
-        })
-      }
+    } finally {
+      setActivating(false)
     }
-  }, [localId, refreshSummary, runStepUp])
+  }
 
-  const deletePlugin = useCallback(async (): Promise<void> => {
-    try {
-      await runStepUp(() =>
-        apiRequest(`/admin/api/cms/site-plugins/${localId}`, { method: 'DELETE' }),
-      )
-      pushToast({ kind: 'success', title: 'Site plugin deleted' })
-      notifyCmsPluginsChanged()
-      navigate('/admin/plugins')
-    } catch (err) {
-      if (!(err instanceof Error && err.message === StepUpCancelledMessage)) {
-        pushToast({
-          kind: 'error',
-          title: 'Delete failed',
-          body: getErrorMessage(err, 'Unknown error'),
-        })
-      }
-    }
-  }, [localId, navigate, runStepUp])
+  const rollback = (): Promise<void> =>
+    runLifecycle(
+      lifecycleRequest(`/admin/api/cms/site-plugins/${localId}/rollback`, { method: 'POST' }),
+      { success: 'Rolled back to the previous revision', failure: 'Rollback failed' },
+    )
+
+  const setEnabled = (enabled: boolean): Promise<void> =>
+    runLifecycle(
+      lifecycleRequest(`/admin/api/cms/plugins/site.${localId}`, {
+        method: 'PATCH',
+        body: { enabled },
+      }),
+      { success: null, failure: enabled ? 'Could not activate' : 'Could not deactivate' },
+    )
+
+  const restart = (): Promise<void> =>
+    runLifecycle(
+      lifecycleRequest(`/admin/api/cms/plugins/site.${localId}/restart`, { method: 'POST' }),
+      { success: 'Plugin restarted', failure: 'Restart failed' },
+    )
 
-  const openPreview = useCallback((): void => {
+  const deletePlugin = (): Promise<void> =>
+    runLifecycle(
+      lifecycleRequest(`/admin/api/cms/site-plugins/${localId}`, { method: 'DELETE' }),
+      { success: 'Site plugin deleted', failure: 'Delete failed' },
+      { after: () => navigate('/admin/plugins') },
+    )
+
+  const openPreview = (): void => {
     navigate(`/admin/site?previewSitePlugin=${encodeURIComponent(localId)}`)
-  }, [localId, navigate])
+  }
 
   return {
     session,
@@ -305,7 +267,6 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
     activeFileId,
     selectFile: setActiveFileId,
     summary,
-    refreshSummary,
     diagnostics,
     validating,
     runValidation,
diff --git a/src/admin/pages/site/agent/agentSlice.ts b/src/admin/pages/site/agent/agentSlice.ts
index 753ef8681..3bde33981 100644
--- a/src/admin/pages/site/agent/agentSlice.ts
+++ b/src/admin/pages/site/agent/agentSlice.ts
@@ -205,7 +205,7 @@ function surfaceAssistantError(
  * Return type is intentionally an `EditorStoreSliceCreator<AgentSlice>` so
  * the site editor's existing composition keeps working. The content
  * workspace's standalone AgentSlice-only store calls it with a small cast
- * (see `contentAgentStore.ts`) — both at compile time and at runtime the
+ * (see `src/admin/ai/createScopedAgentStore.ts`) — both at compile time and at runtime the
  * slice only touches AgentSlice keys, so wider stores compose cleanly.
  */
 export function createAgentSlice(
diff --git a/src/admin/pages/site/agent/codeAssetTools.ts b/src/admin/pages/site/agent/codeAssetTools.ts
index 6252d6a28..ef98544ca 100644
--- a/src/admin/pages/site/agent/codeAssetTools.ts
+++ b/src/admin/pages/site/agent/codeAssetTools.ts
@@ -2,6 +2,9 @@ import {
   aiToolError,
   aiToolOk,
   applyExactReplacements,
+  hashText,
+  paginateText,
+  utf8ByteLength,
   type AiToolOutput,
   type InspectCodeRuntimeInput,
   type ListCodeAssetsInput,
@@ -33,8 +36,6 @@ type CodeAssetLookup = {
   type?: CodeAssetType
 }
 
-const textEncoder = new TextEncoder()
-
 // Live access to the editor store. Routed through `./storeRef` so this module
 // has no static import edge back into `editor-store/store.ts`.
 const getStoreState = (): EditorStore => getAgentStoreApi<EditorStore>().getState()
@@ -47,13 +48,6 @@ function contentForCodeAsset(file: CodeAssetFile): string {
   return file.content ?? ''
 }
 
-async function hashCodeAssetContent(content: string): Promise<string> {
-  const digest = await crypto.subtle.digest('SHA-256', textEncoder.encode(content))
-  return Array.from(new Uint8Array(digest))
-    .map((byte) => byte.toString(16).padStart(2, '0'))
-    .join('')
-}
-
 function normalizeCodeAssetPath(path: string): string | null {
   const normalized = normalizePath(path)
   return isSafePath(normalized) ? normalized : null
@@ -73,8 +67,8 @@ async function describeCodeAsset(store: EditorStore, file: CodeAssetFile) {
     path: file.path,
     type: file.type,
     contentChars: content.length,
-    bytes: textEncoder.encode(content).byteLength,
-    hash: await hashCodeAssetContent(content),
+    bytes: utf8ByteLength(content),
+    hash: await hashText(content),
     createdAt: file.createdAt,
     updatedAt: file.updatedAt,
     generated: file.generated === true,
@@ -211,31 +205,20 @@ export async function runReadCodeAsset(input: ReadCodeAssetInput): Promise<AiToo
   if (!resolved.ok) return aiToolError(resolved.error)
 
   const content = contentForCodeAsset(resolved.file)
-  const maxChars = input.maxChars ?? 12000
-  const totalParts = Math.max(1, Math.ceil(content.length / maxChars))
-  const part = input.part ?? 1
-  if (part > totalParts) {
-    return aiToolError(`Code asset part ${part} is out of range; totalParts is ${totalParts}.`)
-  }
-
-  const start = (part - 1) * maxChars
-  const end = Math.min(content.length, start + maxChars)
+  const page = paginateText(content, {
+    part: input.part,
+    maxChars: input.maxChars,
+    defaultMaxChars: 12000,
+  })
+  if (!page.ok) return aiToolError(`Code asset ${page.error}`)
   return aiToolOk({
     fileId: resolved.file.id,
     path: resolved.file.path,
     type: resolved.file.type,
-    content: content.slice(start, end),
-    hash: await hashCodeAssetContent(content),
+    content: page.content,
+    hash: await hashText(content),
     runtime: codeAssetRuntime(store, resolved.file),
-    pageInfo: {
-      part,
-      totalParts,
-      nextPart: part < totalParts ? part + 1 : null,
-      maxChars,
-      start,
-      end,
-      totalChars: content.length,
-    },
+    pageInfo: page.pageInfo,
   })
 }
 
@@ -296,7 +279,7 @@ export async function runPatchCodeAsset(input: PatchCodeAssetInput): Promise<AiT
   if (!resolved.ok) return aiToolError(resolved.error)
 
   const currentContent = contentForCodeAsset(resolved.file)
-  const currentHash = await hashCodeAssetContent(currentContent)
+  const currentHash = await hashText(currentContent)
   if (currentHash !== input.expectedHash) {
     return aiToolError(
       `Code asset hash mismatch for ${resolved.file.path}; read_code_asset again before patching.`,
diff --git a/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx b/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
index bdfe4da91..a7d8511b7 100644
--- a/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
+++ b/src/admin/pages/site/code-editor/CodeMirrorEditor.tsx
@@ -83,8 +83,12 @@ interface CodeMirrorEditorProps {
   value: string
   /** Which language extensions to load for highlighting. */
   language: CodeLanguage
-  /** Debounced (250 ms) on every edit, and flushed immediately on docKey switch. */
-  onChange: (content: string) => void
+  /**
+   * Debounced (250 ms) on every edit, and flushed immediately on docKey
+   * switch. Omit it when something else owns persistence (the co-edited
+   * buffer's Y binding): no listener is installed and nothing is buffered.
+   */
+  onChange?: (content: string) => void
   /**
    * Change propagation delay. File editors keep the 250 ms default; modal
    * command surfaces can pass 0 so their primary action never reads stale text.
@@ -294,7 +298,7 @@ export default function CodeMirrorEditor({
     }
     if (pendingContentRef.current !== null) {
       // Flush-on-switch: persist pending edit before unmounting.
-      onChangeRef.current(pendingContentRef.current)
+      onChangeRef.current?.(pendingContentRef.current)
       pendingContentRef.current = null
     }
   }, [])
@@ -334,6 +338,8 @@ export default function CodeMirrorEditor({
           EditorView.updateListener.of((update) => {
             if (!update.docChanged) return
             const content = update.state.doc.toString()
+            // The language service tracks the buffer even in a read-only
+            // view (no `onChange`), so diagnostics stay honest.
             if (typeScriptClient && filePath) {
               typeScriptClient.updateFile(filePath, content)
               if (typeScriptDiagnosticsTimer) clearTimeout(typeScriptDiagnosticsTimer)
@@ -342,20 +348,21 @@ export default function CodeMirrorEditor({
                 typeScriptDiagnosticsTimer = null
               }, 300)
             }
+            if (!onChange) return
             if (changeDelayMs <= 0) {
               if (timerRef.current) {
                 clearTimeout(timerRef.current)
                 timerRef.current = null
               }
               pendingContentRef.current = null
-              onChangeRef.current(content)
+              onChangeRef.current?.(content)
               return
             }
             pendingContentRef.current = content
             if (timerRef.current) clearTimeout(timerRef.current)
             timerRef.current = setTimeout(() => {
               if (pendingContentRef.current !== null) {
-                onChangeRef.current(pendingContentRef.current)
+                onChangeRef.current?.(pendingContentRef.current)
                 pendingContentRef.current = null
               }
               timerRef.current = null
diff --git a/src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx b/src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx
index ad84bdc27..5547a4ff0 100644
--- a/src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx
+++ b/src/admin/pages/site/code-editor/CollabCodeMirrorEditor.tsx
@@ -109,9 +109,7 @@ export default function CollabCodeMirrorEditor({
       docKey={docKey}
       value={text.toString()}
       language={language}
-      // Content persistence is the Y binding's job — the store-style
-      // onChange stays a no-op so nothing double-writes.
-      onChange={() => {}}
+      // Content persistence is the Y binding's job — no onChange, no listener.
       extensions={extensions}
       localHistory={false}
     />
diff --git a/src/admin/pages/site/hooks/draftModulePreviewState.ts b/src/admin/pages/site/hooks/draftModulePreviewState.ts
index f670fff5a..06f39a2ef 100644
--- a/src/admin/pages/site/hooks/draftModulePreviewState.ts
+++ b/src/admin/pages/site/hooks/draftModulePreviewState.ts
@@ -4,6 +4,8 @@
  * revision). The module inserter reads this to render the `Draft` badge;
  * nothing here is ever persisted or server-side.
  */
+import { useSyncExternalStore } from 'react'
+
 const draftModuleIds = new Set<string>()
 const listeners = new Set<() => void>()
 
@@ -21,9 +23,14 @@ export function isDraftPreviewModule(moduleId: string): boolean {
   return draftModuleIds.has(moduleId)
 }
 
-export function onDraftPreviewModulesChange(listener: () => void): () => void {
+function onDraftPreviewModulesChange(listener: () => void): () => void {
   listeners.add(listener)
   return () => {
     listeners.delete(listener)
   }
 }
+
+/** Reactive read for the inserter — re-renders when the draft pack loads or unloads. */
+export function useIsDraftPreviewModule(moduleId: string): boolean {
+  return useSyncExternalStore(onDraftPreviewModulesChange, () => isDraftPreviewModule(moduleId))
+}
diff --git a/src/admin/pages/site/module-picker/ModuleInserterItemButton.tsx b/src/admin/pages/site/module-picker/ModuleInserterItemButton.tsx
index 9cc2b9b73..fe8769d05 100644
--- a/src/admin/pages/site/module-picker/ModuleInserterItemButton.tsx
+++ b/src/admin/pages/site/module-picker/ModuleInserterItemButton.tsx
@@ -18,7 +18,7 @@ import {
   type ModuleInserterSectionId,
 } from './moduleInserterModel'
 import { ModuleWireframe } from './ModuleWireframe'
-import { isDraftPreviewModule } from '@site/hooks/draftModulePreviewState'
+import { useIsDraftPreviewModule } from '@site/hooks/draftModulePreviewState'
 import styles from './ModuleInserterDialog.module.css'
 
 export type InserterView = 'grid' | 'list'
@@ -123,6 +123,7 @@ export function ModuleInserterItemButton({
 }
 
 function ItemTile({ item }: { item: ModuleInserterItem }) {
+  const draftPreview = useIsDraftPreviewModule(item.id)
   return (
     <>
       <span className={styles.dragGrip} aria-hidden="true">
@@ -138,7 +139,7 @@ function ItemTile({ item }: { item: ModuleInserterItem }) {
         <span className={styles.itemTitle}>
           <ItemIcon item={item} />
           <span>{item.name}</span>
-          {item.kind === 'module' && isDraftPreviewModule(item.id) && (
+          {item.kind === 'module' && draftPreview && (
             <span className={styles.draftBadge}>Draft</span>
           )}
         </span>
@@ -149,6 +150,7 @@ function ItemTile({ item }: { item: ModuleInserterItem }) {
 }
 
 function ItemRow({ item }: { item: ModuleInserterItem }) {
+  const draftPreview = useIsDraftPreviewModule(item.id)
   return (
     <>
       <span className={styles.rowGrip} aria-hidden="true">
@@ -161,7 +163,7 @@ function ItemRow({ item }: { item: ModuleInserterItem }) {
         <span className={styles.itemTitle}>
           <ItemIcon item={item} />
           <span>{item.name}</span>
-          {item.kind === 'module' && isDraftPreviewModule(item.id) && (
+          {item.kind === 'module' && draftPreview && (
             <span className={styles.draftBadge}>Draft</span>
           )}
         </span>
diff --git a/src/core/ai/index.ts b/src/core/ai/index.ts
index 012ec9fec..b87f04326 100644
--- a/src/core/ai/index.ts
+++ b/src/core/ai/index.ts
@@ -108,16 +108,13 @@ export type {
   DuplicatePageInput,
   SetPageTemplateInput,
   ClearPageTemplateInput,
-  PluginListFilesInput,
-  PluginReadFileInput,
-  PluginWriteFileInput,
-  PluginPatchFileInput,
-  PluginRenameFileInput,
-  PluginDeleteFileInput,
-  PluginOpenFileInput,
 } from './toolSchemas'
 export { applyExactReplacements, countOccurrences } from './textReplacements'
 export type { ExactReplacementResult, ExactTextReplacement } from './textReplacements'
+export { hashText, paginateText, utf8ByteLength } from './textPages'
+export type { TextPage, TextPageInfo } from './textPages'
+export { PluginIdeSnapshotSchema, emptyPluginIdeSnapshot } from './pluginIdeSnapshot'
+export type { PluginIdeSnapshot } from './pluginIdeSnapshot'
 export {
   describeAgentDocuments,
   documentRefEquals,
diff --git a/src/core/ai/pluginIdeSnapshot.ts b/src/core/ai/pluginIdeSnapshot.ts
new file mode 100644
index 000000000..29664a4bf
--- /dev/null
+++ b/src/core/ai/pluginIdeSnapshot.ts
@@ -0,0 +1,61 @@
+/**
+ * PluginIdeSnapshot — what the Plugin IDE sends with every chat message and
+ * what the server's plugin-scope tools and system prompt read back.
+ *
+ * The browser builds it from the live IDE state (open plugin, CRDT file
+ * list, active buffer, runtime summary); the server validates it at the
+ * chat boundary and falls back to `emptyPluginIdeSnapshot()` on a malformed
+ * payload. Over MCP the snapshot is null: file tools are browser-bridged to
+ * the open IDE anyway, and the server tools take an explicit `localId`.
+ *
+ * One schema for both sides so the two can never drift.
+ */
+import { Type, type Static } from '@core/utils/typeboxHelpers'
+
+export const PluginIdeSnapshotSchema = Type.Object({
+  /** The plugin open in the IDE. */
+  localId: Type.String(),
+  /** Runtime id (`site.<localId>`). */
+  pluginId: Type.String(),
+  /** Paths RELATIVE to the plugin folder (`plugin.json`, `server/index.ts`). */
+  files: Type.Array(
+    Type.Object({
+      id: Type.String(),
+      path: Type.String(),
+    }),
+  ),
+  /** The buffer currently visible in the editor, if any. */
+  activeFile: Type.Union([
+    Type.Object({ id: Type.String(), path: Type.String() }),
+    Type.Null(),
+  ]),
+  /** `computeSitePluginState` vocabulary — 'active', 'draft-changed', …. */
+  state: Type.String(),
+  activeVersion: Type.Union([Type.String(), Type.Null()]),
+  declaredPermissions: Type.Array(Type.String()),
+  grantedPermissions: Type.Array(Type.String()),
+  /** The diagnostics strip's latest result; null = not validated yet. */
+  latestDiagnostics: Type.Union([Type.Array(Type.String()), Type.Null()]),
+  currentUser: Type.Object({
+    id: Type.String(),
+    displayName: Type.String(),
+    email: Type.String(),
+  }),
+})
+
+export type PluginIdeSnapshot = Static<typeof PluginIdeSnapshotSchema>
+
+export function emptyPluginIdeSnapshot(): PluginIdeSnapshot {
+  return {
+    localId: '',
+    pluginId: '',
+    files: [],
+    activeFile: null,
+    state: 'draft-changed',
+    activeVersion: null,
+    declaredPermissions: [],
+    grantedPermissions: [],
+    latestDiagnostics: null,
+    currentUser: { id: '', displayName: '', email: '' },
+  }
+}
diff --git a/src/core/ai/textPages.ts b/src/core/ai/textPages.ts
new file mode 100644
index 000000000..9073439b7
--- /dev/null
+++ b/src/core/ai/textPages.ts
@@ -0,0 +1,67 @@
+/**
+ * Content hashing and pagination shared by every "read this file" agent
+ * tool (site code assets, plugin IDE files). One hash function means the
+ * `expectedHash` an agent reads back from one tool is the hash another tool
+ * checks against; one paginator means every read reports the same
+ * `pageInfo` shape.
+ */
+
+const encoder = new TextEncoder()
+
+/** SHA-256 of the UTF-8 encoding, lowercase hex. */
+export async function hashText(content: string): Promise<string> {
+  const digest = await crypto.subtle.digest('SHA-256', encoder.encode(content))
+  return Array.from(new Uint8Array(digest))
+    .map((byte) => byte.toString(16).padStart(2, '0'))
+    .join('')
+}
+
+export function utf8ByteLength(content: string): number {
+  return encoder.encode(content).byteLength
+}
+
+export interface TextPageInfo {
+  part: number
+  totalParts: number
+  nextPart: number | null
+  maxChars: number
+  start: number
+  end: number
+  totalChars: number
+}
+
+export type TextPage =
+  | { ok: true; content: string; pageInfo: TextPageInfo }
+  | { ok: false; error: string }
+
+/**
+ * Slice `content` into `maxChars` pages and return page `part` (1-based).
+ * A file shorter than one page is a single part; an out-of-range part is an
+ * error the tool surfaces verbatim.
+ */
+export function paginateText(
+  content: string,
+  options: { part?: number; maxChars?: number; defaultMaxChars: number },
+): TextPage {
+  const maxChars = options.maxChars ?? options.defaultMaxChars
+  const totalParts = Math.max(1, Math.ceil(content.length / maxChars))
+  const part = options.part ?? 1
+  if (part > totalParts) {
+    return { ok: false, error: `Part ${part} is out of range; totalParts is ${totalParts}.` }
+  }
+  const start = (part - 1) * maxChars
+  const end = Math.min(content.length, start + maxChars)
+  return {
+    ok: true,
+    content: content.slice(start, end),
+    pageInfo: {
+      part,
+      totalParts,
+      nextPart: part < totalParts ? part + 1 : null,
+      maxChars,
+      start,
+      end,
+      totalChars: content.length,
+    },
+  }
+}
diff --git a/src/core/ai/toolSchemas.ts b/src/core/ai/toolSchemas.ts
index 606d024b8..59cb4dc3f 100644
--- a/src/core/ai/toolSchemas.ts
+++ b/src/core/ai/toolSchemas.ts
@@ -429,7 +429,6 @@ const PluginFileRefInputSchema = Type.Object({
 })
 
 export const PluginListFilesInputSchema = Type.Object({})
-export type PluginListFilesInput = Static<typeof PluginListFilesInputSchema>
 
 export const PluginReadFileInputSchema = Type.Composite([
   PluginFileRefInputSchema,
@@ -438,13 +437,11 @@ export const PluginReadFileInputSchema = Type.Composite([
     maxChars: Type.Optional(Type.Integer({ minimum: 1, maximum: 100000 })),
   }),
 ])
-export type PluginReadFileInput = Static<typeof PluginReadFileInputSchema>
 
 export const PluginWriteFileInputSchema = Type.Object({
   path: Type.String({ minLength: 1 }),
   content: Type.String(),
 })
-export type PluginWriteFileInput = Static<typeof PluginWriteFileInputSchema>
 
 export const PluginPatchFileInputSchema = Type.Composite([
   PluginFileRefInputSchema,
@@ -460,7 +457,6 @@ export const PluginPatchFileInputSchema = Type.Composite([
     ),
   }),
 ])
-export type PluginPatchFileInput = Static<typeof PluginPatchFileInputSchema>
 
 export const PluginRenameFileInputSchema = Type.Composite([
   PluginFileRefInputSchema,
@@ -468,10 +464,7 @@ export const PluginRenameFileInputSchema = Type.Composite([
     newPath: Type.String({ minLength: 1 }),
   }),
 ])
-export type PluginRenameFileInput = Static<typeof PluginRenameFileInputSchema>
 
 export const PluginDeleteFileInputSchema = PluginFileRefInputSchema
-export type PluginDeleteFileInput = Static<typeof PluginDeleteFileInputSchema>
 
 export const PluginOpenFileInputSchema = PluginFileRefInputSchema
-export type PluginOpenFileInput = Static<typeof PluginOpenFileInputSchema>
diff --git a/src/core/site-plugins/index.ts b/src/core/site-plugins/index.ts
index dc29df870..037fd6e3e 100644
--- a/src/core/site-plugins/index.ts
+++ b/src/core/site-plugins/index.ts
@@ -14,6 +14,7 @@ export {
   localIdFromSitePluginId,
   sitePluginFolder,
   sitePluginIdFromLocalId,
+  sitePluginLocalIdFromName,
   type SitePluginDraftManifest,
 } from './schemas'
 export { discoverSitePlugins, type DiscoveredSitePlugin } from './discover'
diff --git a/src/core/site-plugins/schemas.ts b/src/core/site-plugins/schemas.ts
index 9e1c4b7da..4e95f8b67 100644
--- a/src/core/site-plugins/schemas.ts
+++ b/src/core/site-plugins/schemas.ts
@@ -21,6 +21,20 @@ export function sitePluginIdFromLocalId(localId: string): string {
   return `${SITE_PLUGIN_ID_PREFIX}${localId}`
 }
 
+/**
+ * The local id suggested from a display name ("Hello Banner" → "hello-banner").
+ * May come back empty or still invalid for names without a letter; callers
+ * validate the result against `SITE_PLUGIN_LOCAL_ID_PATTERN`.
+ */
+export function sitePluginLocalIdFromName(name: string): string {
+  return name
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .replace(/^[^a-z]+/, '')
+    .slice(0, 40)
+}
+
 /** Strip the `site.` prefix; null when the id is not a site plugin id. */
 export function localIdFromSitePluginId(pluginId: string): string | null {
   if (!pluginId.startsWith(SITE_PLUGIN_ID_PREFIX)) return null

From 04769c32db0b89c15c8f5b43113132585afa4c2a Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Thu, 3 Sep 2026 09:31:52 +0200
Subject: [PATCH 27/36] feat(plugin-ide): name the files panel after the plugin
 and show state like the site toolbar

The IDE never said which plugin was open; the left panel is now titled with
the plugin's name. The runtime state chip was its own pill; it now renders
through ToolbarStatus, the dot-and-label indicator extracted from the site
toolbar's publish group, so "Draft changed" in the IDE looks like "Draft
synced" in the site editor. Tones: active is success, permission review is
warning, build and runtime failures are danger, everything else neutral.
---
 src/admin/pages/plugins/ide/FileTreePane.tsx  |  7 ++--
 .../pages/plugins/ide/IdeActions.module.css   | 24 -------------
 src/admin/pages/plugins/ide/IdeActions.tsx    | 28 +++++++++++++--
 .../pages/plugins/ide/SitePluginIdePage.tsx   |  1 +
 .../pages/site/toolbar/PublishActionGroup.tsx | 14 ++------
 .../pages/site/toolbar/ToolbarStatus.tsx      | 36 +++++++++++++++++++
 6 files changed, 70 insertions(+), 40 deletions(-)
 create mode 100644 src/admin/pages/site/toolbar/ToolbarStatus.tsx

diff --git a/src/admin/pages/plugins/ide/FileTreePane.tsx b/src/admin/pages/plugins/ide/FileTreePane.tsx
index 0e5c03419..6887c47cc 100644
--- a/src/admin/pages/plugins/ide/FileTreePane.tsx
+++ b/src/admin/pages/plugins/ide/FileTreePane.tsx
@@ -93,6 +93,8 @@ function buildRows(
 
 interface FileTreePaneProps {
   localId: string
+  /** The plugin's display name — the panel is titled with it so the IDE always says which plugin is open. */
+  pluginName: string
   files: IdeFileMeta[]
   activeFileId: string | null
   peers: IdePeer[]
@@ -112,6 +114,7 @@ interface FileTreePaneProps {
 
 export function FileTreePane({
   localId,
+  pluginName,
   files,
   activeFileId,
   peers,
@@ -193,8 +196,8 @@ export function FileTreePane({
   return (
     <Panel
       panelId="ide-files"
-      title="Files"
-      ariaLabel="Site plugin files"
+      title={pluginName}
+      ariaLabel={`${pluginName} files`}
       testId="ide-file-tree"
       body="bare"
       bodyClassName={styles.body}
diff --git a/src/admin/pages/plugins/ide/IdeActions.module.css b/src/admin/pages/plugins/ide/IdeActions.module.css
index 520b14f63..022cdee09 100644
--- a/src/admin/pages/plugins/ide/IdeActions.module.css
+++ b/src/admin/pages/plugins/ide/IdeActions.module.css
@@ -18,27 +18,3 @@
   margin-left: 0;
 }
 
-.stateChip {
-  padding: var(--space-px) var(--space-s);
-  border-radius: var(--radius-sm);
-  font-size: var(--text-2xs);
-  font-weight: 600;
-  letter-spacing: 0.02em;
-  white-space: nowrap;
-  color: var(--text-subtle);
-  background: var(--bg-surface-3);
-}
-
-.stateChip[data-state='active'] {
-  color: var(--success-text);
-}
-
-.stateChip[data-state='build-failed'],
-.stateChip[data-state='runtime-error'],
-.stateChip[data-state='source-missing'] {
-  color: var(--danger);
-}
-
-.stateChip[data-state='permission-review'] {
-  color: var(--warning);
-}
diff --git a/src/admin/pages/plugins/ide/IdeActions.tsx b/src/admin/pages/plugins/ide/IdeActions.tsx
index 555acda86..8d3c603a1 100644
--- a/src/admin/pages/plugins/ide/IdeActions.tsx
+++ b/src/admin/pages/plugins/ide/IdeActions.tsx
@@ -8,15 +8,34 @@ import { useEffect, useRef, useState } from 'react'
 import {
   sitePluginPrimaryAction,
   sitePluginStateLabel,
+  type SitePluginRuntimeState,
   type SitePluginSummary,
 } from '@core/site-plugins'
 import { Button } from '@ui/components/Button'
 import { ContextMenu, ContextMenuItem, ContextMenuSeparator } from '@ui/components/ContextMenu'
 import { MoreHorizontalSolidIcon } from 'pixel-art-icons/icons/more-horizontal-solid'
 import { PeerAvatar } from '@site/collab/PeerAvatar'
+import { ToolbarStatus, type ToolbarStatusTone } from '@site/toolbar/ToolbarStatus'
 import type { IdePeer } from './idePresence'
 import styles from './IdeActions.module.css'
 
+/** The site toolbar's tone vocabulary, applied to the plugin's runtime state. */
+function stateTone(state: SitePluginRuntimeState): ToolbarStatusTone {
+  switch (state) {
+    case 'active':
+      return 'success'
+    case 'permission-review':
+      return 'warning'
+    case 'build-failed':
+    case 'runtime-error':
+    case 'source-missing':
+      return 'danger'
+    case 'draft-changed':
+    case 'disabled':
+      return 'neutral'
+  }
+}
+
 interface IdeActionsProps {
   summary: SitePluginSummary | null
   peers: IdePeer[]
@@ -124,9 +143,12 @@ export function IdeActions({
       )}
 
       {state && (
-        <span className={styles.stateChip} data-state={state} data-testid="ide-state-chip">
-          {sitePluginStateLabel(state)}
-        </span>
+        <ToolbarStatus
+          label={sitePluginStateLabel(state)}
+          tone={stateTone(state)}
+          state={state}
+          testId="ide-state-chip"
+        />
       )}
 
       {summary?.hasModules && summary.hasDraftSource && (
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
index d0f89db62..f0e34929f 100644
--- a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
@@ -146,6 +146,7 @@ function SitePluginIde({ localId }: { localId: string }) {
             <FileTreePane
               onClose={() => setActivePanel(null)}
               localId={localId}
+              pluginName={vm.summary?.name ?? localId}
               files={files}
               activeFileId={activeFileId}
               peers={peers}
diff --git a/src/admin/pages/site/toolbar/PublishActionGroup.tsx b/src/admin/pages/site/toolbar/PublishActionGroup.tsx
index fde528d56..c817f9619 100644
--- a/src/admin/pages/site/toolbar/PublishActionGroup.tsx
+++ b/src/admin/pages/site/toolbar/PublishActionGroup.tsx
@@ -1,8 +1,9 @@
 import { SplitButton, type SplitButtonMenuItem } from '@ui/components/SplitButton'
 import type { IconComponent } from 'pixel-art-icons/types'
+import { ToolbarStatus, type ToolbarStatusTone } from './ToolbarStatus'
 import styles from './Toolbar.module.css'
 
-export type PublishActionStatusTone = 'neutral' | 'success' | 'warning' | 'danger'
+export type PublishActionStatusTone = ToolbarStatusTone
 type PublishActionState = 'idle' | 'busy' | 'success' | 'error'
 
 export type PublishActionMenuItem = SplitButtonMenuItem
@@ -43,16 +44,7 @@ export function PublishActionGroup({
   return (
     <div className={styles.publishActionGroup}>
       {statusLabel && (
-        <span
-          role="status"
-          aria-live="polite"
-          aria-label={statusAriaLabel ?? statusLabel}
-          className={styles.publishActionStatus}
-          data-tone={statusTone}
-        >
-          <span className={styles.publishActionStatusDot} aria-hidden="true" />
-          {statusLabel}
-        </span>
+        <ToolbarStatus label={statusLabel} tone={statusTone} ariaLabel={statusAriaLabel} />
       )}
 
       <SplitButton
diff --git a/src/admin/pages/site/toolbar/ToolbarStatus.tsx b/src/admin/pages/site/toolbar/ToolbarStatus.tsx
new file mode 100644
index 000000000..6010cb1c4
--- /dev/null
+++ b/src/admin/pages/site/toolbar/ToolbarStatus.tsx
@@ -0,0 +1,36 @@
+/**
+ * ToolbarStatus — the toolbar's small live-status indicator: a tone dot and
+ * a short label ("Draft synced", "Draft changed", "Runtime error"). One
+ * component so every workspace toolbar (Site, Content, Plugin IDE) shows
+ * state the same way; the tone is the only thing that varies.
+ */
+import styles from './Toolbar.module.css'
+
+export type ToolbarStatusTone = 'neutral' | 'success' | 'warning' | 'danger'
+
+interface ToolbarStatusProps {
+  label: string
+  tone: ToolbarStatusTone
+  /** Screen-reader text when the visible label is not enough on its own. */
+  ariaLabel?: string
+  testId?: string
+  /** Extra hook for callers that key styles or tests off the state. */
+  state?: string
+}
+
+export function ToolbarStatus({ label, tone, ariaLabel, testId, state }: ToolbarStatusProps) {
+  return (
+    <span
+      role="status"
+      aria-live="polite"
+      aria-label={ariaLabel ?? label}
+      className={styles.publishActionStatus}
+      data-tone={tone}
+      data-state={state}
+      data-testid={testId}
+    >
+      <span className={styles.publishActionStatusDot} aria-hidden="true" />
+      {label}
+    </span>
+  )
+}

From 36dbfd0469b4b2269329a502d6474e0bcdc30774 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Thu, 3 Sep 2026 09:43:28 +0200
Subject: [PATCH 28/36] feat(plugin-ide): one split button for every action,
 version beside the name, no panel footer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The toolbar carried three separate controls (Preview in canvas, the smart
primary action, an overflow menu). They are now one SplitButton, the same
control the site toolbar's Publish uses: the state-appropriate action on
the left, everything else grouped in the menu with inline reasons when
unavailable. For an active plugin the left half stays "Build & activate"
and says the draft already matches the active revision.

SplitButton menu rows gain tooltip, danger and separatorBefore, mapped onto
the ContextMenu features they already had; and the chevron now takes focus
after opening and closes on Escape, which also fixes the site Publish menu
after a mouse click.

The files panel shows the active version muted beside the plugin name (the
semver part; the content hash stays in the title attribute) and drops the
"Files live in plugins/…" footer.
---
 .../pages/plugins/ide/FileTreePane.module.css |  24 +-
 src/admin/pages/plugins/ide/FileTreePane.tsx  |  22 +-
 src/admin/pages/plugins/ide/IdeActions.tsx    | 252 +++++++-----------
 .../pages/plugins/ide/SitePluginIdePage.tsx   |   1 +
 src/ui/components/SplitButton/SplitButton.tsx |  53 ++--
 5 files changed, 167 insertions(+), 185 deletions(-)

diff --git a/src/admin/pages/plugins/ide/FileTreePane.module.css b/src/admin/pages/plugins/ide/FileTreePane.module.css
index 9cc04f5d8..7434ac78d 100644
--- a/src/admin/pages/plugins/ide/FileTreePane.module.css
+++ b/src/admin/pages/plugins/ide/FileTreePane.module.css
@@ -44,21 +44,23 @@
   padding-right: var(--space-xs);
 }
 
-.footer {
-  flex-shrink: 0;
-  border-top: 1px solid var(--border-muted);
-  padding: var(--space-s) var(--space-m);
+.titleContent {
+  display: inline-flex;
+  align-items: baseline;
+  gap: var(--space-xs);
+  min-width: 0;
 }
 
-.hint {
-  margin: 0;
-  font-size: var(--text-xs);
-  line-height: 1.5;
-  color: var(--text-subtle);
+.titleName {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
 }
 
-.hint code {
+.titleVersion {
+  opacity: 0.5;
   font-family: var(--font-mono);
   font-size: var(--text-2xs);
-  color: var(--text);
+  font-weight: 400;
+  white-space: nowrap;
 }
diff --git a/src/admin/pages/plugins/ide/FileTreePane.tsx b/src/admin/pages/plugins/ide/FileTreePane.tsx
index 6887c47cc..61abfed5c 100644
--- a/src/admin/pages/plugins/ide/FileTreePane.tsx
+++ b/src/admin/pages/plugins/ide/FileTreePane.tsx
@@ -95,6 +95,8 @@ interface FileTreePaneProps {
   localId: string
   /** The plugin's display name — the panel is titled with it so the IDE always says which plugin is open. */
   pluginName: string
+  /** Active generated version (`1.0.<n>+<hash>`), shown muted beside the name; null before the first build. */
+  activeVersion: string | null
   files: IdeFileMeta[]
   activeFileId: string | null
   peers: IdePeer[]
@@ -115,6 +117,7 @@ interface FileTreePaneProps {
 export function FileTreePane({
   localId,
   pluginName,
+  activeVersion,
   files,
   activeFileId,
   peers,
@@ -197,6 +200,18 @@ export function FileTreePane({
     <Panel
       panelId="ide-files"
       title={pluginName}
+      titleContent={(
+        <span className={styles.titleContent}>
+          <span className={styles.titleName}>{pluginName}</span>
+          {activeVersion && (
+            // The generated version is `1.0.<n>+<content hash>`; the hash is
+            // for the build's skip check, not for people.
+            <span className={styles.titleVersion} title={activeVersion}>
+              v{activeVersion.replace(/\+.*$/, '')}
+            </span>
+          )}
+        </span>
+      )}
       ariaLabel={`${pluginName} files`}
       testId="ide-file-tree"
       body="bare"
@@ -312,13 +327,6 @@ export function FileTreePane({
         </TreeContainer>
       </div>
 
-      <footer className={styles.footer}>
-        <p className={styles.hint}>
-          Files live in <code>{folder}</code> and save live — every open
-          editor co-edits the same draft.
-        </p>
-      </footer>
-
       {menu && (
         <ContextMenu
           x={menu.x}
diff --git a/src/admin/pages/plugins/ide/IdeActions.tsx b/src/admin/pages/plugins/ide/IdeActions.tsx
index 8d3c603a1..15ae80814 100644
--- a/src/admin/pages/plugins/ide/IdeActions.tsx
+++ b/src/admin/pages/plugins/ide/IdeActions.tsx
@@ -1,19 +1,17 @@
 /**
- * IdeActions — the IDE toolbar's right slot: peer avatar stack, runtime
- * state chip, ONE state-appropriate smart primary action, an optional
- * `Preview in canvas` secondary (module drafts), and the overflow menu.
- * Unavailable actions are disabled with an inline reason, never hidden.
+ * IdeActions — the IDE toolbar's right slot: peer avatar stack, the runtime
+ * state indicator, and ONE split button (the same control the site
+ * toolbar's Publish uses): the state-appropriate primary action on the
+ * left, every other action in the menu. Unavailable actions are disabled
+ * with an inline reason, never hidden.
  */
-import { useEffect, useRef, useState } from 'react'
 import {
   sitePluginPrimaryAction,
   sitePluginStateLabel,
   type SitePluginRuntimeState,
   type SitePluginSummary,
 } from '@core/site-plugins'
-import { Button } from '@ui/components/Button'
-import { ContextMenu, ContextMenuItem, ContextMenuSeparator } from '@ui/components/ContextMenu'
-import { MoreHorizontalSolidIcon } from 'pixel-art-icons/icons/more-horizontal-solid'
+import { SplitButton, type SplitButtonMenuItem } from '@ui/components/SplitButton'
 import { PeerAvatar } from '@site/collab/PeerAvatar'
 import { ToolbarStatus, type ToolbarStatusTone } from '@site/toolbar/ToolbarStatus'
 import type { IdePeer } from './idePresence'
@@ -36,6 +34,9 @@ function stateTone(state: SitePluginRuntimeState): ToolbarStatusTone {
   }
 }
 
+const INSTALL_REASON = 'Requires the plugins.install permission'
+const LIFECYCLE_REASON = 'Requires the plugins.lifecycle permission'
+
 interface IdeActionsProps {
   summary: SitePluginSummary | null
   peers: IdePeer[]
@@ -70,28 +71,31 @@ export function IdeActions({
   onOpenPluginsPage,
   onDelete,
 }: IdeActionsProps) {
-  const [menuOpen, setMenuOpen] = useState(false)
-  const overflowRef = useRef<HTMLButtonElement | null>(null)
-
-  // The menu is not focusable and a mouse click does not leave focus on
-  // the trigger (the Button's tooltip wrapper re-renders it once
-  // aria-expanded flips), so put focus on the trigger after the open
-  // commits: Escape then closes what the click opened.
-  useEffect(() => {
-    if (menuOpen) overflowRef.current?.focus()
-  }, [menuOpen])
-
   const state = summary?.state ?? null
   const primary = state ? sitePluginPrimaryAction(state) : null
-
   const uniquePeers = new Map(peers.map((peer) => [peer.user.id, peer]))
 
+  // Same split as the server: install-class actions need plugins.install,
+  // enable/disable/restart need plugins.lifecycle.
+  const needsInstallCap =
+    primary?.action === 'activate' || primary?.action === 'review' || primary?.action === 'delete'
+  const needsLifecycleCap = primary?.action === 'enable'
+  // `active` has no state action of its own: the left half keeps reading
+  // "Build & activate" and says why there is nothing to build.
+  const primaryLabel = primary && primary.action !== null ? primary.label : 'Build & activate'
+  const primaryBlockedReason = !summary
+    ? 'Loading the plugin state…'
+    : primary?.action === null
+      ? 'The active revision already matches the draft'
+      : needsInstallCap && !canInstall
+        ? INSTALL_REASON
+        : needsLifecycleCap && !canManageLifecycle
+          ? LIFECYCLE_REASON
+          : null
+
   const runPrimary = (): void => {
-    if (!primary) return
-    switch (primary.action) {
+    switch (primary?.action) {
       case 'activate':
-        onActivate()
-        return
       case 'review':
         // The review moment IS activation — the server enforces step-up and
         // the dialog shows the grant diff before anything changes.
@@ -110,27 +114,71 @@ export function IdeActions({
         onSetEnabled(true)
         return
       case null:
+      case undefined:
         return
     }
   }
 
-  // Same split as the server: install-class actions need plugins.install,
-  // enable/disable/restart need plugins.lifecycle.
-  const needsInstallCap =
-    primary?.action === 'activate' || primary?.action === 'review' || primary?.action === 'delete'
-  const needsLifecycleCap = primary?.action === 'enable'
-  const primaryBlockedReason =
-    needsInstallCap && !canInstall
-      ? 'Requires the plugins.install permission'
-      : needsLifecycleCap && !canManageLifecycle
-        ? 'Requires the plugins.lifecycle permission'
-        : null
-  const primaryDisabled = activating || primaryBlockedReason !== null
   const lifecycleBlockedReason = !canManageLifecycle
-    ? 'Requires the plugins.lifecycle permission'
+    ? LIFECYCLE_REASON
     : !summary?.activeVersion
       ? 'Nothing is activated yet'
       : null
+  const previewBlockedReason = !summary?.hasDraftSource
+    ? 'The draft source is missing'
+    : !summary.hasModules
+      ? 'The draft declares no module pack'
+      : null
+
+  const menuItems: SplitButtonMenuItem[] = [
+    {
+      id: 'preview',
+      label: 'Preview in canvas',
+      disabled: previewBlockedReason !== null,
+      tooltip: previewBlockedReason ?? undefined,
+      onSelect: onPreview,
+      testId: 'ide-preview',
+    },
+    { id: 'diagnostics', label: 'Re-run diagnostics', onSelect: onRunDiagnostics },
+    {
+      id: 'rollback',
+      label: 'Rollback to previous revision',
+      separatorBefore: true,
+      disabled: !canInstall || !summary?.activeVersion,
+      tooltip: !canInstall
+        ? INSTALL_REASON
+        : !summary?.activeVersion
+          ? 'Nothing is activated yet'
+          : undefined,
+      onSelect: onRollback,
+    },
+    {
+      id: 'deactivate',
+      label: 'Deactivate',
+      disabled: lifecycleBlockedReason !== null || summary?.state === 'disabled',
+      tooltip:
+        lifecycleBlockedReason ??
+        (summary?.state === 'disabled' ? 'Already deactivated' : undefined),
+      onSelect: () => onSetEnabled(false),
+    },
+    {
+      id: 'restart',
+      label: 'Restart',
+      disabled: lifecycleBlockedReason !== null,
+      tooltip: lifecycleBlockedReason ?? undefined,
+      onSelect: onRestart,
+    },
+    { id: 'plugins-page', label: 'Open on Plugins page', onSelect: onOpenPluginsPage },
+    {
+      id: 'delete',
+      label: 'Delete site plugin',
+      separatorBefore: true,
+      danger: true,
+      disabled: !canInstall,
+      tooltip: !canInstall ? INSTALL_REASON : undefined,
+      onSelect: onDelete,
+    },
+  ]
 
   return (
     <div className={styles.actions}>
@@ -151,122 +199,22 @@ export function IdeActions({
         />
       )}
 
-      {summary?.hasModules && summary.hasDraftSource && (
-        <Button variant="secondary" size="sm" onClick={onPreview} data-testid="ide-preview">
-          Preview in canvas
-        </Button>
-      )}
-
-      {primary && primary.action !== null && (
-        <Button
-          variant="primary"
-          size="sm"
-          disabled={primaryDisabled}
-          tooltip={primaryBlockedReason ?? undefined}
-          onClick={runPrimary}
-          data-testid="ide-primary-action"
-        >
-          {activating && primary.action === 'activate' ? 'Building…' : primary.label}
-        </Button>
-      )}
-
-      <Button
-        ref={overflowRef}
-        variant="ghost"
+      <SplitButton
+        variant="primary"
         size="sm"
-        iconOnly
-        aria-label="More actions"
-        tooltip="More actions"
-        aria-expanded={menuOpen}
-        onClick={() => setMenuOpen((open) => !open)}
-        onKeyDown={(event) => {
-          if (event.key === 'Escape' && menuOpen) {
-            event.preventDefault()
-            setMenuOpen(false)
-          }
-        }}
-        data-testid="ide-overflow"
-      >
-        <MoreHorizontalSolidIcon size={14} aria-hidden="true" />
-      </Button>
-
-      {menuOpen && (
-        <ContextMenu
-          anchorRef={overflowRef}
-          ariaLabel="Site plugin actions"
-          onClose={() => setMenuOpen(false)}
-          minWidth={230}
-        >
-          <ContextMenuItem
-            onClick={() => {
-              onRunDiagnostics()
-              setMenuOpen(false)
-            }}
-          >
-            Re-run diagnostics
-          </ContextMenuItem>
-          <ContextMenuSeparator />
-          <ContextMenuItem
-            disabled={!canInstall || !summary?.activeVersion}
-            tooltip={
-              !canInstall
-                ? 'Requires the plugins.install permission'
-                : !summary?.activeVersion
-                  ? 'Nothing is activated yet'
-                  : undefined
-            }
-            onClick={() => {
-              onRollback()
-              setMenuOpen(false)
-            }}
-          >
-            Rollback to previous revision
-          </ContextMenuItem>
-          <ContextMenuItem
-            disabled={lifecycleBlockedReason !== null || summary?.state === 'disabled'}
-            tooltip={
-              lifecycleBlockedReason ??
-              (summary?.state === 'disabled' ? 'Already deactivated' : undefined)
-            }
-            onClick={() => {
-              onSetEnabled(false)
-              setMenuOpen(false)
-            }}
-          >
-            Deactivate
-          </ContextMenuItem>
-          <ContextMenuItem
-            disabled={lifecycleBlockedReason !== null}
-            tooltip={lifecycleBlockedReason ?? undefined}
-            onClick={() => {
-              onRestart()
-              setMenuOpen(false)
-            }}
-          >
-            Restart
-          </ContextMenuItem>
-          <ContextMenuItem
-            onClick={() => {
-              onOpenPluginsPage()
-              setMenuOpen(false)
-            }}
-          >
-            Open on Plugins page
-          </ContextMenuItem>
-          <ContextMenuSeparator />
-          <ContextMenuItem
-            danger
-            disabled={!canInstall}
-            tooltip={!canInstall ? 'Requires the plugins.install permission' : undefined}
-            onClick={() => {
-              onDelete()
-              setMenuOpen(false)
-            }}
-          >
-            Delete site plugin
-          </ContextMenuItem>
-        </ContextMenu>
-      )}
+        label={activating && primary?.action === 'activate' ? 'Building…' : primaryLabel}
+        onClick={runPrimary}
+        disabled={activating || primaryBlockedReason !== null}
+        busy={activating}
+        primaryTooltip={primaryBlockedReason ?? undefined}
+        menuItems={menuItems}
+        menuTriggerLabel="More plugin actions"
+        menuLabel="Site plugin actions"
+        menuWidth={240}
+        primaryTestId="ide-primary-action"
+        menuTriggerTestId="ide-overflow"
+        menuTestId="ide-actions-menu"
+      />
     </div>
   )
 }
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
index f0e34929f..2c46fbb73 100644
--- a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
@@ -147,6 +147,7 @@ function SitePluginIde({ localId }: { localId: string }) {
               onClose={() => setActivePanel(null)}
               localId={localId}
               pluginName={vm.summary?.name ?? localId}
+              activeVersion={vm.summary?.activeVersion ?? null}
               files={files}
               activeFileId={activeFileId}
               peers={peers}
diff --git a/src/ui/components/SplitButton/SplitButton.tsx b/src/ui/components/SplitButton/SplitButton.tsx
index 785676ec9..3c9f45ae5 100644
--- a/src/ui/components/SplitButton/SplitButton.tsx
+++ b/src/ui/components/SplitButton/SplitButton.tsx
@@ -10,11 +10,11 @@
  * Used by the editor's Publish control (PublishActionGroup) and the Typography
  * panel's add-font control (FontsSection).
  */
-import { useId, useRef, useState, type ReactNode } from 'react'
+import { Fragment, useEffect, useId, useRef, useState, type ReactNode } from 'react'
 import { createPortal } from 'react-dom'
 import { cn } from '@ui/cn'
 import { Button, type ButtonProps } from '@ui/components/Button'
-import { ContextMenu, ContextMenuItem } from '@ui/components/ContextMenu'
+import { ContextMenu, ContextMenuItem, ContextMenuSeparator } from '@ui/components/ContextMenu'
 import { ChevronDown2Icon } from 'pixel-art-icons/icons/chevron-down-2'
 import { LoaderIcon } from 'pixel-art-icons/icons/loader'
 import type { IconComponent } from 'pixel-art-icons/types'
@@ -26,6 +26,12 @@ export interface SplitButtonMenuItem {
   /** Optional leading icon for the menu row. */
   icon?: IconComponent
   disabled?: boolean
+  /** Shown on hover — pass the reason whenever the row is disabled. */
+  tooltip?: string
+  /** Destructive styling for delete / remove rows. */
+  danger?: boolean
+  /** Draw a divider above this row to start a new group. */
+  separatorBefore?: boolean
   onSelect: () => void | Promise<void>
   testId?: string
 }
@@ -109,6 +115,13 @@ export function SplitButton({
     triggerRef.current?.focus()
   }
 
+  // The menu is not focusable and a mouse click does not leave focus on the
+  // chevron, so after the open commits put focus on the trigger: Escape
+  // (handled on the trigger below) then closes what the click opened.
+  useEffect(() => {
+    if (menuOpen) triggerRef.current?.focus()
+  }, [menuOpen])
+
   function handleSelect(item: SplitButtonMenuItem) {
     if (item.disabled) return
     setMenuOpen(false)
@@ -163,6 +176,12 @@ export function SplitButton({
         aria-controls={menuOpen ? menuId : undefined}
         tooltip={menuTriggerLabel}
         onClick={() => setMenuOpen((open) => !open)}
+        onKeyDown={(event) => {
+          if (event.key === 'Escape' && menuOpen) {
+            event.preventDefault()
+            closeMenu()
+          }
+        }}
         disabled={menuItems.length === 0}
         data-testid={menuTriggerTestId}
       >
@@ -186,19 +205,23 @@ export function SplitButton({
           {menuItems.map((item) => {
             const ItemIcon = item.icon
             return (
-              <ContextMenuItem
-                key={item.id}
-                disabled={item.disabled}
-                onClick={() => handleSelect(item)}
-                data-testid={item.testId}
-              >
-                {ItemIcon && (
-                  <span aria-hidden="true">
-                    <ItemIcon size={14} />
-                  </span>
-                )}
-                <span>{item.label}</span>
-              </ContextMenuItem>
+              <Fragment key={item.id}>
+                {item.separatorBefore && <ContextMenuSeparator />}
+                <ContextMenuItem
+                  disabled={item.disabled}
+                  tooltip={item.tooltip}
+                  danger={item.danger}
+                  onClick={() => handleSelect(item)}
+                  data-testid={item.testId}
+                >
+                  {ItemIcon && (
+                    <span aria-hidden="true">
+                      <ItemIcon size={14} />
+                    </span>
+                  )}
+                  <span>{item.label}</span>
+                </ContextMenuItem>
+              </Fragment>
             )
           })}
         </ContextMenu>,

From a78379d297aacac34a8ad7a5e9043bdf56c5013c Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Thu, 3 Sep 2026 10:01:25 +0200
Subject: [PATCH 29/36] feat(site-plugins): keep five builds and pick the
 rollback target
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Retention kept the active build plus the one below it, so "Rollback to
previous revision" had exactly one possible target and rolling back swept
the build you had just left. The sweep now keeps the five highest builds
plus whatever is active (a deep rollback keeps its target), and every
retained build is a rollback target: the summary lists them newest first
with the build time, the rollback route takes a version and validates it
against the retained directories before touching a path, a target with a
different grant set still steps up, and rolling back no longer discards
the newer build, so rolling forward is the same action.

The IDE menu's single rollback row becomes a "Roll back to…" submenu
(v1.0.3 · 48m · active, v1.0.2 · 16h, …); SplitButton rows gain nested
children for that, rendered through the shared ContextMenuSubmenu.
---
 docs/features/site-plugins.md                 |  16 ++-
 server/ai/tools/plugin/lifecycleTools.ts      |   2 +-
 server/handlers/cms/sitePlugins/index.ts      |  42 ++++---
 server/handlers/cms/sitePlugins/service.ts    |  30 +++--
 server/plugins/sitePlugins/retention.ts       | 105 ++++++++++--------
 .../server/sitePluginLifecycle.test.ts        |  77 ++++++++++++-
 .../server/sitePluginRetention.test.ts        |  57 ++++++----
 src/__tests__/toolbar/toolbar.test.ts         |   5 +-
 src/admin/pages/plugins/ide/FileTreePane.tsx  |   6 +-
 src/admin/pages/plugins/ide/IdeActions.tsx    |  38 +++++--
 .../pages/plugins/ide/SitePluginIdePage.tsx   |   2 +-
 .../pages/plugins/ide/useSitePluginIde.ts     |  18 ++-
 src/core/site-plugins/derive.ts               |   8 ++
 src/core/site-plugins/index.ts                |   3 +
 src/core/site-plugins/state.ts                |  11 ++
 src/ui/components/SplitButton/SplitButton.tsx | 100 ++++++++++++-----
 16 files changed, 380 insertions(+), 140 deletions(-)

diff --git a/docs/features/site-plugins.md b/docs/features/site-plugins.md
index e64c9d2b0..c12e29798 100644
--- a/docs/features/site-plugins.md
+++ b/docs/features/site-plugins.md
@@ -247,10 +247,18 @@ permission treatment lives where it matters: the activation review dialog.
   (`republishAllPages`) and entry-template data rows such as `/posts/hello`
   (`republishAllDataRows`), stamped with the version that becomes current
   at the bump that follows. Backend-only plugins skip the republish.
-- Retention keeps the active revision + the immediately previous one (the
-  `Rollback to previous revision` target — source rolls forward only, so
-  the artifact is the only rollback). Uninstall sweeps the whole
-  `uploads/plugins/site.<id>/` tree via the existing teardown.
+- Retention keeps the five highest builds plus the active one
+  (`RETAINED_REVISIONS` in `server/plugins/sitePlugins/retention.ts`); the
+  sweep runs after activation and the coupled republish succeed. Every
+  retained build is a rollback target: the summary lists them
+  (`revisions`, newest first, with the build time), the IDE's `Roll back
+  to…` submenu offers them, and `POST …/rollback { version }` re-activates
+  one — the version is validated against the retained directories, never
+  joined into a path unchecked, and a target with a different grant set
+  steps up like any grant change. Source rolls forward only, so the
+  artifact is the only rollback; after one the draft reads `Draft changed`
+  and `Build & activate` redeploys the newest code. Uninstall sweeps the
+  whole `uploads/plugins/site.<id>/` tree via the existing teardown.
 - `Preview in canvas` (module drafts): the IDE opens
   `/admin/site?previewSitePlugin=<local-id>`; the editor fetches the
   validate-only bundle from `GET .../preview-pack.js` (no-store), activates
diff --git a/server/ai/tools/plugin/lifecycleTools.ts b/server/ai/tools/plugin/lifecycleTools.ts
index c72e4dfb1..0214eeb36 100644
--- a/server/ai/tools/plugin/lifecycleTools.ts
+++ b/server/ai/tools/plugin/lifecycleTools.ts
@@ -55,7 +55,7 @@ const listPluginsTool: AiTool = {
     'List every site plugin (draft folders ∪ runtime rows) with its computed state, active version, declared vs granted permissions, and last runtime error. Use to orient before working on a plugin, or to find the localId for plugin_validate / plugin_activate.',
   inputSchema: Type.Object({}),
   handler: async (_input, ctx) => {
-    return aiToolOk({ sitePlugins: await listSitePlugins(ctx.db) })
+    return aiToolOk({ sitePlugins: await listSitePlugins(ctx.db, ctx.uploadsDir) })
   },
 }
 
diff --git a/server/handlers/cms/sitePlugins/index.ts b/server/handlers/cms/sitePlugins/index.ts
index ec37c1a9e..66d62cd7b 100644
--- a/server/handlers/cms/sitePlugins/index.ts
+++ b/server/handlers/cms/sitePlugins/index.ts
@@ -49,7 +49,7 @@ import {
 import { getDraftSite, saveDraftSite } from '../../../repositories/site'
 import { getInstalledPlugin } from '../../../repositories/plugins'
 import { runPublishFlush } from '../../../publish/publishFlush'
-import { previousSitePluginRevision } from '../../../plugins/sitePlugins/retention'
+import { listSitePluginRevisions } from '../../../plugins/sitePlugins/retention'
 import { badRequest, jsonResponse, methodNotAllowed, readValidatedBody } from '../../../http'
 import { type CmsHandlerOptions } from '../shared'
 import { activatePluginPackageFromDisk } from '../plugins/install'
@@ -220,7 +220,7 @@ async function handleActivate(
         ...(result.upgrade ? { upgrade: result.upgrade } : {}),
         ...(result.skipped ? { skipped: true } : {}),
         ...(result.warning ? { warning: result.warning } : {}),
-        sitePlugins: await listSitePlugins(db),
+        sitePlugins: await listSitePlugins(db, options.uploadsDir ?? null),
       })
     case 'not-found':
       return jsonResponse({ error: result.message }, { status: 404 })
@@ -237,7 +237,7 @@ async function handleActivate(
       )
     case 'upgrade-error':
       return jsonResponse(
-        { error: result.message, sitePlugins: await listSitePlugins(db) },
+        { error: result.message, sitePlugins: await listSitePlugins(db, options.uploadsDir ?? null) },
         { status: 400 },
       )
     case 'grants-changed':
@@ -247,9 +247,14 @@ async function handleActivate(
 }
 
 // ---------------------------------------------------------------------------
-// POST /site-plugins/:localId/rollback — re-activate the previous revision
+// POST /site-plugins/:localId/rollback — re-activate a retained revision
 // ---------------------------------------------------------------------------
 
+const RollbackBodySchema = Type.Object({
+  /** A retained generated version (see the summary's `revisions`). */
+  version: Type.String({ minLength: 1, maxLength: 80 }),
+})
+
 async function handleRollback(
   req: Request,
   db: DbClient,
@@ -260,6 +265,9 @@ async function handleRollback(
   if (!options.uploadsDir) {
     return jsonResponse({ error: 'Uploads directory is not configured' }, { status: 500 })
   }
+  const body = await readValidatedBody(req, RollbackBodySchema)
+  if (!body) return badRequest('Pass the retained revision to roll back to as `version`')
+
   const pluginId = sitePluginIdFromLocalId(localId)
   const rowResult = await getInstalledPlugin(db, pluginId)
   const row = rowResult?.kind === 'ok' ? rowResult.plugin : null
@@ -267,9 +275,15 @@ async function handleRollback(
     return jsonResponse({ error: `Site plugin "${localId}" has no runtime record` }, { status: 404 })
   }
 
-  const previousVersion = await previousSitePluginRevision(options.uploadsDir, pluginId, row.version)
-  if (!previousVersion) {
-    return badRequest(`No previous revision of "${localId}" is retained to roll back to`)
+  // Only a retained directory is a valid target — the version is user
+  // input and must never be joined into a path unchecked.
+  const retained = await listSitePluginRevisions(options.uploadsDir, pluginId)
+  const target = retained.find((revision) => revision.version === body.version)
+  if (!target) {
+    return badRequest(`Revision ${body.version} of "${localId}" is not retained`)
+  }
+  if (target.version === row.version) {
+    return badRequest(`Revision ${body.version} of "${localId}" is already active`)
   }
 
   let manifest: PluginManifest
@@ -278,13 +292,13 @@ async function handleRollback(
       options.uploadsDir,
       'plugins',
       pluginId,
-      previousVersion,
+      target.version,
       'plugin.json',
     )
     manifest = parsePluginManifest(JSON.parse(await readFile(manifestPath, 'utf8')))
   } catch (err) {
     return badRequest(
-      `Previous revision ${previousVersion} is unreadable: ${getErrorMessage(err, 'corrupt package')}`,
+      `Revision ${target.version} is unreadable: ${getErrorMessage(err, 'corrupt package')}`,
     )
   }
 
@@ -306,7 +320,7 @@ async function handleRollback(
   })
   if (outcome.upgradeError) {
     return jsonResponse(
-      { error: outcome.upgradeError, sitePlugins: await listSitePlugins(db) },
+      { error: outcome.upgradeError, sitePlugins: await listSitePlugins(db, options.uploadsDir ?? null) },
       { status: 400 },
     )
   }
@@ -315,9 +329,9 @@ async function handleRollback(
 
   return jsonResponse({
     plugin: await presentPluginSecrets(db, outcome.plugin),
-    rolledBackTo: previousVersion,
+    rolledBackTo: target.version,
     ...(warning ? { warning } : {}),
-    sitePlugins: await listSitePlugins(db),
+    sitePlugins: await listSitePlugins(db, options.uploadsDir ?? null),
   })
 }
 
@@ -355,7 +369,7 @@ async function handleDelete(
     }
   }
 
-  return jsonResponse({ ok: true, sitePlugins: await listSitePlugins(db) })
+  return jsonResponse({ ok: true, sitePlugins: await listSitePlugins(db, options.uploadsDir ?? null) })
 }
 
 // ---------------------------------------------------------------------------
@@ -376,7 +390,7 @@ export async function handleSitePluginsRoutes(
       // for pure site developers via site.read.
       const user = await requireAnyCapability(req, db, ['plugins.read', 'site.read'])
       if (user instanceof Response) return user
-      return jsonResponse({ sitePlugins: await listSitePlugins(db) })
+      return jsonResponse({ sitePlugins: await listSitePlugins(db, options.uploadsDir ?? null) })
     }
     if (req.method === 'POST') {
       // Scaffolding writes plugin source into the draft — the authoring
diff --git a/server/handlers/cms/sitePlugins/service.ts b/server/handlers/cms/sitePlugins/service.ts
index 14b76102a..52821528f 100644
--- a/server/handlers/cms/sitePlugins/service.ts
+++ b/server/handlers/cms/sitePlugins/service.ts
@@ -40,7 +40,10 @@ import {
   buildSitePlugin,
   type SitePluginBuildResult,
 } from '../../../plugins/sitePlugins/build'
-import { sweepSitePluginRevisions } from '../../../plugins/sitePlugins/retention'
+import {
+  listSitePluginRevisions,
+  sweepSitePluginRevisions,
+} from '../../../plugins/sitePlugins/retention'
 import { createKeyedSerializer } from '../../../util/keyedSerial'
 import type { CmsHandlerOptions } from '../shared'
 import { activatePluginPackageFromDisk } from '../plugins/install'
@@ -110,7 +113,14 @@ export function sameStringSet(a: readonly string[], b: readonly string[]): boole
 // GET /site-plugins — the list
 // ---------------------------------------------------------------------------
 
-export async function listSitePlugins(db: DbClient): Promise<SitePluginSummary[]> {
+/**
+ * @param uploadsDir Where built revisions live; null (no uploads configured)
+ *   lists every plugin with an empty `revisions` array.
+ */
+export async function listSitePlugins(
+  db: DbClient,
+  uploadsDir: string | null,
+): Promise<SitePluginSummary[]> {
   const draftFiles = await readDraftPluginFiles(db)
   let discovered: ReturnType<typeof discoverSitePlugins>
   try {
@@ -133,9 +143,13 @@ export async function listSitePlugins(db: DbClient): Promise<SitePluginSummary[]
   // Union — a deleted folder must never hide a still-running backend.
   const localIds = [...new Set([...draftByLocalId.keys(), ...rowByLocalId.keys()])].sort()
 
-  return localIds.map((localId) => {
+  const summaries: SitePluginSummary[] = []
+  for (const localId of localIds) {
     const draft = draftByLocalId.get(localId) ?? null
     const row = rowByLocalId.get(localId) ?? null
+    const pluginId = sitePluginIdFromLocalId(localId)
+    const revisions =
+      row && uploadsDir ? await listSitePluginRevisions(uploadsDir, pluginId) : []
 
     let manifest: PluginManifest | null = null
     let manifestError: string | null = null
@@ -174,12 +188,13 @@ export async function listSitePlugins(db: DbClient): Promise<SitePluginSummary[]
       grantsChanged,
     })
 
-    return {
+    summaries.push({
       localId,
-      pluginId: sitePluginIdFromLocalId(localId),
+      pluginId,
       name: manifest?.name ?? row?.name ?? localId,
       state,
       activeVersion: row?.version ?? null,
+      revisions,
       hasDraftSource: draft !== null,
       hasModules: Boolean(manifest?.entrypoints?.modules),
       declaredPermissions: declared,
@@ -188,8 +203,9 @@ export async function listSitePlugins(db: DbClient): Promise<SitePluginSummary[]
       removedPermissions: granted.filter((permission) => !declared.includes(permission)),
       manifestError,
       lastError: row?.lastError ?? null,
-    }
-  })
+    })
+  }
+  return summaries
 }
 
 // ---------------------------------------------------------------------------
diff --git a/server/plugins/sitePlugins/retention.ts b/server/plugins/sitePlugins/retention.ts
index 56b209011..f226210c1 100644
--- a/server/plugins/sitePlugins/retention.ts
+++ b/server/plugins/sitePlugins/retention.ts
@@ -3,47 +3,82 @@
  * `uploads/plugins/site.<id>/<version>/` accumulate one dir per build.
  * Policy (design: docs/features/site-plugins.md → "Cleanup And Retention"):
  *
- *   - keep the active revision;
- *   - keep the immediately previous revision (the `Rollback to previous
- *     revision` target — source-level rollback is impossible once the
- *     draft has moved on, so the artifact is the only rollback);
- *   - delete older revisions AFTER activation and the coupled republish
- *     (when required) succeed — callers sequence that; this module only
- *     sweeps.
+ *   - keep the RETAINED_REVISIONS highest builds, plus whatever is active
+ *     (a rollback can make an older build the active one);
+ *   - every retained build is a rollback target — the IDE's version picker
+ *     lists them. Source rolls forward only, so the artifact is the only
+ *     rollback;
+ *   - delete the rest AFTER activation and the coupled republish (when
+ *     required) succeed — callers sequence that; this module only sweeps.
  *
  * Whole-plugin teardown (uninstall) rides the existing
  * `removeAllPluginAssets` sweep, not this module.
  */
-import { readdir, rm } from 'node:fs/promises'
+import { readdir, rm, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { assertPathWithin } from '../../util/pathWithin'
 
+export const RETAINED_REVISIONS = 5
+
 const VERSION_COUNTER = /^1\.0\.(\d+)\+/
 
-/** Keep the active version + the immediately previous one; delete the rest. */
-export async function sweepSitePluginRevisions(
+export interface SitePluginRevision {
+  version: string
+  /** Build time, epoch ms — the package directory's mtime. */
+  builtAt: number
+}
+
+function counterOf(version: string): number {
+  const match = VERSION_COUNTER.exec(version)
+  return match ? Number(match[1]) : -1
+}
+
+/** Directory entries of the plugin's revision tree; versions newest first. */
+async function revisionEntries(
   uploadsDir: string,
   pluginId: string,
-  activeVersion: string,
-): Promise<string[]> {
+): Promise<{ pluginDir: string; entries: string[]; versions: string[] }> {
   const pluginDir = join(uploadsDir, 'plugins', pluginId)
   assertPathWithin(uploadsDir, pluginDir)
   let entries: string[]
   try {
     entries = await readdir(pluginDir)
   } catch {
-    return [] // nothing built yet
+    entries = [] // nothing built yet
   }
-  const counter = (version: string): number => {
-    const match = VERSION_COUNTER.exec(version)
-    return match ? Number(match[1]) : -1
+  const versions = entries
+    .filter((entry) => counterOf(entry) >= 0)
+    .sort((a, b) => counterOf(b) - counterOf(a))
+  return { pluginDir, entries, versions }
+}
+
+/** Retained builds, newest first — the rollback targets. */
+export async function listSitePluginRevisions(
+  uploadsDir: string,
+  pluginId: string,
+): Promise<SitePluginRevision[]> {
+  const { pluginDir, versions } = await revisionEntries(uploadsDir, pluginId)
+  const revisions: SitePluginRevision[] = []
+  for (const version of versions) {
+    const dir = join(pluginDir, version)
+    assertPathWithin(uploadsDir, dir)
+    const info = await stat(dir)
+    revisions.push({ version, builtAt: Math.round(info.mtimeMs) })
   }
-  const activeCounter = counter(activeVersion)
-  const keep = new Set([activeVersion])
-  const previous = entries
-    .filter((v) => v !== activeVersion && counter(v) >= 0 && counter(v) < activeCounter)
-    .sort((a, b) => counter(b) - counter(a))[0]
-  if (previous) keep.add(previous)
+  return revisions
+}
+
+/**
+ * Keep the RETAINED_REVISIONS highest builds plus the active one; delete
+ * everything else (including entries that are not version-shaped).
+ */
+export async function sweepSitePluginRevisions(
+  uploadsDir: string,
+  pluginId: string,
+  activeVersion: string,
+): Promise<string[]> {
+  const { pluginDir, entries, versions } = await revisionEntries(uploadsDir, pluginId)
+  const keep = new Set([activeVersion, ...versions.slice(0, RETAINED_REVISIONS)])
 
   const removed: string[] = []
   for (const entry of entries) {
@@ -55,29 +90,3 @@ export async function sweepSitePluginRevisions(
   }
   return removed
 }
-
-/** The rollback target — the retained revision immediately below `activeVersion`. */
-export async function previousSitePluginRevision(
-  uploadsDir: string,
-  pluginId: string,
-  activeVersion: string,
-): Promise<string | null> {
-  const pluginDir = join(uploadsDir, 'plugins', pluginId)
-  assertPathWithin(uploadsDir, pluginDir)
-  let entries: string[]
-  try {
-    entries = await readdir(pluginDir)
-  } catch {
-    return null
-  }
-  const counter = (version: string): number => {
-    const match = VERSION_COUNTER.exec(version)
-    return match ? Number(match[1]) : -1
-  }
-  const activeCounter = counter(activeVersion)
-  return (
-    entries
-      .filter((v) => v !== activeVersion && counter(v) >= 0 && counter(v) < activeCounter)
-      .sort((a, b) => counter(b) - counter(a))[0] ?? null
-  )
-}
diff --git a/src/__tests__/server/sitePluginLifecycle.test.ts b/src/__tests__/server/sitePluginLifecycle.test.ts
index 7ad353bfe..ac5570f6b 100644
--- a/src/__tests__/server/sitePluginLifecycle.test.ts
+++ b/src/__tests__/server/sitePluginLifecycle.test.ts
@@ -265,12 +265,87 @@ describe('site plugin activation authority', () => {
     }
   })
 
-  test('the list reports active after activation', async () => {
+  test('the list reports active after activation, with every retained build', async () => {
     const res = await harness.cms('/admin/api/cms/site-plugins', { cookie: ownerCookie })
     const body = await readJson<{ sitePlugins: SitePluginSummary[] }>(res)
     const entry = body.sitePlugins.find((plugin) => plugin.localId === 'newsletter')
     expect(entry?.state).toBe('active')
     expect(entry?.activeVersion).toStartWith('1.0.3+')
+    // Three builds so far, all retained (the policy keeps five), newest first.
+    expect(entry?.revisions.map((revision) => revision.version.split('+')[0])).toEqual([
+      '1.0.3',
+      '1.0.2',
+      '1.0.1',
+    ])
+    for (const revision of entry?.revisions ?? []) {
+      expect(revision.builtAt).toBeGreaterThan(0)
+    }
+  })
+
+  test('rollback targets a retained build; a different grant set steps up', async () => {
+    const list = await readJson<{ sitePlugins: SitePluginSummary[] }>(
+      await harness.cms('/admin/api/cms/site-plugins', { cookie: ownerCookie }),
+    )
+    const entry = list.sitePlugins.find((plugin) => plugin.localId === 'newsletter')!
+    const target = entry.revisions.find((revision) => revision.version.startsWith('1.0.2+'))!
+
+    const installer = await harness.createRoleUser({
+      name: 'Installer 4',
+      slug: 'installer-4',
+      capabilities: ['plugins.read', 'plugins.install', 'site.read'],
+    })
+
+    // An unknown version is refused before anything is touched.
+    const bogus = await harness.cms('/admin/api/cms/site-plugins/newsletter/rollback', {
+      method: 'POST',
+      cookie: installer.cookie,
+      json: { version: '1.0.99+deadbeef' },
+    })
+    expect(bogus.status).toBe(400)
+
+    // 1.0.2 was granted [cms.routes]; the active 1.0.3 holds [cms.routes,
+    // cms.routes.public] — a grant change, so the consent moment applies.
+    const noStepUp = await harness.cms('/admin/api/cms/site-plugins/newsletter/rollback', {
+      method: 'POST',
+      cookie: installer.cookie,
+      json: { version: target.version },
+    })
+    await expectStepUpRequired(noStepUp)
+
+    const stepped = await harness.stepUp(installer.cookie)
+    const res = await harness.cms('/admin/api/cms/site-plugins/newsletter/rollback', {
+      method: 'POST',
+      cookie: stepped,
+      json: { version: target.version },
+    })
+    expect(res.status).toBe(200)
+    const body = await readJson<{ rolledBackTo: string; plugin: { version: string } }>(res)
+    expect(body.rolledBackTo).toBe(target.version)
+    expect(body.plugin.version).toBe(target.version)
+
+    const row = await getInstalledPlugin(harness.db, 'site.newsletter')
+    expect(row?.kind).toBe('ok')
+    if (row?.kind === 'ok') {
+      expect(row.plugin.version).toBe(target.version)
+      expect(row.plugin.grantedPermissions).toEqual(['cms.routes'])
+    }
+
+    // The newer build stays retained: rolling forward is a rollback too.
+    const after = await readJson<{ sitePlugins: SitePluginSummary[] }>(
+      await harness.cms('/admin/api/cms/site-plugins', { cookie: ownerCookie }),
+    )
+    const afterEntry = after.sitePlugins.find((plugin) => plugin.localId === 'newsletter')
+    expect(afterEntry?.revisions.some((revision) => revision.version.startsWith('1.0.3+'))).toBe(true)
+    // The draft still declares cms.routes.public, which the rolled-back
+    // grant set lacks — that outranks "draft changed" in the state machine.
+    expect(afterEntry?.state).toBe('permission-review')
+
+    const alreadyActive = await harness.cms('/admin/api/cms/site-plugins/newsletter/rollback', {
+      method: 'POST',
+      cookie: stepped,
+      json: { version: target.version },
+    })
+    expect(alreadyActive.status).toBe(400)
   })
 })
 
diff --git a/src/__tests__/server/sitePluginRetention.test.ts b/src/__tests__/server/sitePluginRetention.test.ts
index 64e72f28b..0bf45ad92 100644
--- a/src/__tests__/server/sitePluginRetention.test.ts
+++ b/src/__tests__/server/sitePluginRetention.test.ts
@@ -1,13 +1,14 @@
 /**
- * Site plugin revision retention — keep the active revision plus the
- * immediately previous one (the rollback target); delete the rest.
+ * Site plugin revision retention — keep the five highest builds plus the
+ * active one, list the retained builds newest first, delete the rest.
  */
 import { describe, expect, test } from 'bun:test'
 import { mkdtemp, mkdir, readdir, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import {
-  previousSitePluginRevision,
+  RETAINED_REVISIONS,
+  listSitePluginRevisions,
   sweepSitePluginRevisions,
 } from '../../../server/plugins/sitePlugins/retention'
 
@@ -21,34 +22,48 @@ async function uploadsWithRevisions(versions: string[]): Promise<string> {
   return uploadsDir
 }
 
+const SEVEN = ['1.0.1+a', '1.0.2+b', '1.0.3+c', '1.0.4+d', '1.0.5+e', '1.0.6+f', '1.0.7+g']
+
 describe('sweepSitePluginRevisions', () => {
-  test('keeps active + immediately previous, deletes older', async () => {
-    const uploadsDir = await uploadsWithRevisions(['1.0.1+a', '1.0.2+b', '1.0.3+c'])
+  test(`keeps the ${RETAINED_REVISIONS} highest builds when the newest is active`, async () => {
+    const uploadsDir = await uploadsWithRevisions(SEVEN)
+    try {
+      const removed = await sweepSitePluginRevisions(uploadsDir, 'site.demo', '1.0.7+g')
+      expect(removed.sort()).toEqual(['1.0.1+a', '1.0.2+b'])
+      const remaining = (await readdir(join(uploadsDir, 'plugins', 'site.demo'))).sort()
+      expect(remaining).toEqual(['1.0.3+c', '1.0.4+d', '1.0.5+e', '1.0.6+f', '1.0.7+g'])
+    } finally {
+      await rm(uploadsDir, { recursive: true, force: true })
+    }
+  })
+
+  test('an active build outside the top five is kept too (deep rollback)', async () => {
+    const uploadsDir = await uploadsWithRevisions(SEVEN)
     try {
-      const removed = await sweepSitePluginRevisions(uploadsDir, 'site.demo', '1.0.3+c')
-      expect(removed).toEqual(['1.0.1+a'])
+      const removed = await sweepSitePluginRevisions(uploadsDir, 'site.demo', '1.0.1+a')
+      expect(removed).toEqual(['1.0.2+b'])
       const remaining = (await readdir(join(uploadsDir, 'plugins', 'site.demo'))).sort()
-      expect(remaining).toEqual(['1.0.2+b', '1.0.3+c'])
+      expect(remaining).toEqual(['1.0.1+a', '1.0.3+c', '1.0.4+d', '1.0.5+e', '1.0.6+f', '1.0.7+g'])
     } finally {
       await rm(uploadsDir, { recursive: true, force: true })
     }
   })
 
-  test('after a rollback, revisions newer than the active one are swept', async () => {
+  test('after a rollback the newer builds stay retained (roll forward is possible)', async () => {
     const uploadsDir = await uploadsWithRevisions(['1.0.1+a', '1.0.2+b', '1.0.3+c'])
     try {
-      const removed = await sweepSitePluginRevisions(uploadsDir, 'site.demo', '1.0.2+b')
-      expect(removed.sort()).toEqual(['1.0.3+c'])
+      expect(await sweepSitePluginRevisions(uploadsDir, 'site.demo', '1.0.2+b')).toEqual([])
       const remaining = (await readdir(join(uploadsDir, 'plugins', 'site.demo'))).sort()
-      expect(remaining).toEqual(['1.0.1+a', '1.0.2+b'])
+      expect(remaining).toEqual(['1.0.1+a', '1.0.2+b', '1.0.3+c'])
     } finally {
       await rm(uploadsDir, { recursive: true, force: true })
     }
   })
 
-  test('missing plugin dir is a no-op', async () => {
-    const uploadsDir = await mkdtemp(join(tmpdir(), 'retention-'))
+  test('entries that are not version-shaped are swept; a missing plugin dir is a no-op', async () => {
+    const uploadsDir = await uploadsWithRevisions(['1.0.1+a', 'stray'])
     try {
+      expect(await sweepSitePluginRevisions(uploadsDir, 'site.demo', '1.0.1+a')).toEqual(['stray'])
       expect(await sweepSitePluginRevisions(uploadsDir, 'site.ghost', '1.0.1+a')).toEqual([])
     } finally {
       await rm(uploadsDir, { recursive: true, force: true })
@@ -56,12 +71,16 @@ describe('sweepSitePluginRevisions', () => {
   })
 })
 
-describe('previousSitePluginRevision', () => {
-  test('returns the retained revision immediately below the active one', async () => {
-    const uploadsDir = await uploadsWithRevisions(['1.0.2+b', '1.0.5+e'])
+describe('listSitePluginRevisions', () => {
+  test('lists retained builds newest first with a build time', async () => {
+    const uploadsDir = await uploadsWithRevisions(['1.0.2+b', '1.0.10+j', '1.0.5+e'])
     try {
-      expect(await previousSitePluginRevision(uploadsDir, 'site.demo', '1.0.5+e')).toBe('1.0.2+b')
-      expect(await previousSitePluginRevision(uploadsDir, 'site.demo', '1.0.2+b')).toBeNull()
+      const revisions = await listSitePluginRevisions(uploadsDir, 'site.demo')
+      expect(revisions.map((revision) => revision.version)).toEqual(['1.0.10+j', '1.0.5+e', '1.0.2+b'])
+      for (const revision of revisions) {
+        expect(revision.builtAt).toBeGreaterThan(Date.now() - 60_000)
+      }
+      expect(await listSitePluginRevisions(uploadsDir, 'site.ghost')).toEqual([])
     } finally {
       await rm(uploadsDir, { recursive: true, force: true })
     }
diff --git a/src/__tests__/toolbar/toolbar.test.ts b/src/__tests__/toolbar/toolbar.test.ts
index cececd737..e02f41b85 100644
--- a/src/__tests__/toolbar/toolbar.test.ts
+++ b/src/__tests__/toolbar/toolbar.test.ts
@@ -592,7 +592,10 @@ describe('Toolbar — structural requirements', () => {
     expect(src).toContain('<ContextMenu')
     expect(src).toContain('<ContextMenuItem')
     expect(src).toContain('createPortal')
-    expect(src).toContain('zIndex={10000}')
+    // The menu (and any submenu, which stacks above it) sits above every
+    // editor panel: one named constant, applied to both.
+    expect(src).toContain('const MENU_Z_INDEX = 10000')
+    expect(src).toContain('zIndex={MENU_Z_INDEX}')
   })
 
   it('AdminCanvasLayout imports and renders Toolbar', () => {
diff --git a/src/admin/pages/plugins/ide/FileTreePane.tsx b/src/admin/pages/plugins/ide/FileTreePane.tsx
index 61abfed5c..8a3846f24 100644
--- a/src/admin/pages/plugins/ide/FileTreePane.tsx
+++ b/src/admin/pages/plugins/ide/FileTreePane.tsx
@@ -23,7 +23,7 @@ import { Button } from '@ui/components/Button'
 import { Input } from '@ui/components/Input'
 import { pushToast } from '@ui/components/Toast'
 import { getErrorMessage } from '@core/utils/errorMessage'
-import { sitePluginFolder } from '@core/site-plugins'
+import { sitePluginDisplayVersion, sitePluginFolder } from '@core/site-plugins'
 import { FilePlusSolidIcon } from 'pixel-art-icons/icons/file-plus-solid'
 import { FileTextSolidIcon } from 'pixel-art-icons/icons/file-text-solid'
 import { FolderGlyphIcon } from 'pixel-art-icons/icons/folder-glyph'
@@ -204,10 +204,8 @@ export function FileTreePane({
         <span className={styles.titleContent}>
           <span className={styles.titleName}>{pluginName}</span>
           {activeVersion && (
-            // The generated version is `1.0.<n>+<content hash>`; the hash is
-            // for the build's skip check, not for people.
             <span className={styles.titleVersion} title={activeVersion}>
-              v{activeVersion.replace(/\+.*$/, '')}
+              v{sitePluginDisplayVersion(activeVersion)}
             </span>
           )}
         </span>
diff --git a/src/admin/pages/plugins/ide/IdeActions.tsx b/src/admin/pages/plugins/ide/IdeActions.tsx
index 15ae80814..b3e6b56be 100644
--- a/src/admin/pages/plugins/ide/IdeActions.tsx
+++ b/src/admin/pages/plugins/ide/IdeActions.tsx
@@ -6,6 +6,7 @@
  * with an inline reason, never hidden.
  */
 import {
+  sitePluginDisplayVersion,
   sitePluginPrimaryAction,
   sitePluginStateLabel,
   type SitePluginRuntimeState,
@@ -13,6 +14,7 @@ import {
 } from '@core/site-plugins'
 import { SplitButton, type SplitButtonMenuItem } from '@ui/components/SplitButton'
 import { PeerAvatar } from '@site/collab/PeerAvatar'
+import { formatRelativeTime } from '@site/panels/AgentPanel/relativeTime'
 import { ToolbarStatus, type ToolbarStatusTone } from '@site/toolbar/ToolbarStatus'
 import type { IdePeer } from './idePresence'
 import styles from './IdeActions.module.css'
@@ -47,7 +49,8 @@ interface IdeActionsProps {
   activating: boolean
   onActivate: () => void
   onPreview: () => void
-  onRollback: () => void
+  /** Re-activate one retained build (a version from `summary.revisions`). */
+  onRollback: (version: string) => void
   onSetEnabled: (enabled: boolean) => void
   onRestart: () => void
   onRunDiagnostics: () => void
@@ -130,6 +133,26 @@ export function IdeActions({
       ? 'The draft declares no module pack'
       : null
 
+  // Every retained build is a rollback target; the active one is listed
+  // so the picker reads as a history, but cannot be re-activated.
+  const revisions = summary?.revisions ?? []
+  const rollbackTargets: SplitButtonMenuItem[] = revisions.map((revision) => {
+    const active = revision.version === summary?.activeVersion
+    return {
+      id: `rollback:${revision.version}`,
+      label: `v${sitePluginDisplayVersion(revision.version)} · ${formatRelativeTime(revision.builtAt)}${active ? ' · active' : ''}`,
+      disabled: active,
+      tooltip: active ? 'This build is the active one' : undefined,
+      onSelect: () => onRollback(revision.version),
+      testId: `ide-rollback-${sitePluginDisplayVersion(revision.version)}`,
+    }
+  })
+  const rollbackBlockedReason = !canInstall
+    ? INSTALL_REASON
+    : revisions.length < 2
+      ? 'No other build is retained yet'
+      : null
+
   const menuItems: SplitButtonMenuItem[] = [
     {
       id: 'preview',
@@ -142,15 +165,12 @@ export function IdeActions({
     { id: 'diagnostics', label: 'Re-run diagnostics', onSelect: onRunDiagnostics },
     {
       id: 'rollback',
-      label: 'Rollback to previous revision',
+      label: 'Roll back to…',
       separatorBefore: true,
-      disabled: !canInstall || !summary?.activeVersion,
-      tooltip: !canInstall
-        ? INSTALL_REASON
-        : !summary?.activeVersion
-          ? 'Nothing is activated yet'
-          : undefined,
-      onSelect: onRollback,
+      disabled: rollbackBlockedReason !== null,
+      tooltip: rollbackBlockedReason ?? undefined,
+      children: rollbackTargets,
+      testId: 'ide-rollback',
     },
     {
       id: 'deactivate',
diff --git a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
index 2c46fbb73..9e2eaf673 100644
--- a/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
+++ b/src/admin/pages/plugins/ide/SitePluginIdePage.tsx
@@ -228,7 +228,7 @@ function SitePluginIde({ localId }: { localId: string }) {
               else void vm.activate()
             }}
             onPreview={vm.openPreview}
-            onRollback={() => void vm.rollback()}
+            onRollback={(version) => void vm.rollback(version)}
             onSetEnabled={(enabled) => void vm.setEnabled(enabled)}
             onRestart={() => void vm.restart()}
             onRunDiagnostics={vm.runValidation}
diff --git a/src/admin/pages/plugins/ide/useSitePluginIde.ts b/src/admin/pages/plugins/ide/useSitePluginIde.ts
index 935d262ff..389279f4c 100644
--- a/src/admin/pages/plugins/ide/useSitePluginIde.ts
+++ b/src/admin/pages/plugins/ide/useSitePluginIde.ts
@@ -11,7 +11,11 @@ import { useCallback, useEffect, useRef, useState, useSyncExternalStore } from '
 import { apiRequest } from '@core/http'
 import { Type } from '@core/utils/typeboxHelpers'
 import { getErrorMessage } from '@core/utils/errorMessage'
-import { SitePluginsPayloadSchema, type SitePluginSummary } from '@core/site-plugins'
+import {
+  SitePluginsPayloadSchema,
+  sitePluginDisplayVersion,
+  type SitePluginSummary,
+} from '@core/site-plugins'
 import { pushToast } from '@ui/components/Toast'
 import { StepUpCancelledMessage, useStepUp } from '@admin/shared/StepUp'
 import { useAsyncResource } from '@admin/lib/useAsyncResource'
@@ -48,7 +52,8 @@ interface SitePluginIdeVm {
   runValidation: () => void
   activating: boolean
   activate: () => Promise<void>
-  rollback: () => Promise<void>
+  /** Re-activate one of the retained builds (`summary.revisions`). */
+  rollback: (version: string) => Promise<void>
   setEnabled: (enabled: boolean) => Promise<void>
   restart: () => Promise<void>
   deletePlugin: () => Promise<void>
@@ -227,10 +232,13 @@ export function useSitePluginIde(localId: string): SitePluginIdeVm {
     }
   }
 
-  const rollback = (): Promise<void> =>
+  const rollback = (version: string): Promise<void> =>
     runLifecycle(
-      lifecycleRequest(`/admin/api/cms/site-plugins/${localId}/rollback`, { method: 'POST' }),
-      { success: 'Rolled back to the previous revision', failure: 'Rollback failed' },
+      lifecycleRequest(`/admin/api/cms/site-plugins/${localId}/rollback`, {
+        method: 'POST',
+        body: { version },
+      }),
+      { success: `Rolled back to v${sitePluginDisplayVersion(version)}`, failure: 'Rollback failed' },
     )
 
   const setEnabled = (enabled: boolean): Promise<void> =>
diff --git a/src/core/site-plugins/derive.ts b/src/core/site-plugins/derive.ts
index e6df6b9f1..5a382035e 100644
--- a/src/core/site-plugins/derive.ts
+++ b/src/core/site-plugins/derive.ts
@@ -75,6 +75,14 @@ export function contentHashOfVersion(version: string | null | undefined): string
   return match?.[1] ?? null
 }
 
+/**
+ * The version as people read it: `1.0.<n>` without the `+<hash>` build
+ * metadata, which exists for the skip-rebuild check, not for display.
+ */
+export function sitePluginDisplayVersion(version: string): string {
+  return version.replace(/\+.*$/, '')
+}
+
 export interface DeriveSitePluginManifestInput {
   localId: string
   draftManifestJson: string
diff --git a/src/core/site-plugins/index.ts b/src/core/site-plugins/index.ts
index 037fd6e3e..d725d05f2 100644
--- a/src/core/site-plugins/index.ts
+++ b/src/core/site-plugins/index.ts
@@ -23,6 +23,7 @@ export {
   contentHashOfVersion,
   deriveSitePluginManifest,
   nextSitePluginVersion,
+  sitePluginDisplayVersion,
   type DeriveSitePluginManifestInput,
 } from './derive'
 export {
@@ -35,6 +36,7 @@ export {
 } from './templates'
 export {
   SITE_PLUGIN_RUNTIME_STATES,
+  SitePluginRevisionSchema,
   SitePluginRuntimeStateSchema,
   SitePluginSummarySchema,
   SitePluginsPayloadSchema,
@@ -43,6 +45,7 @@ export {
   sitePluginStateLabel,
   type SitePluginPrimaryAction,
   type SitePluginPrimaryActionKind,
+  type SitePluginRevision,
   type SitePluginRuntimeState,
   type SitePluginStateInput,
   type SitePluginSummary,
diff --git a/src/core/site-plugins/state.ts b/src/core/site-plugins/state.ts
index 2d5ca0a5b..e3289aaba 100644
--- a/src/core/site-plugins/state.ts
+++ b/src/core/site-plugins/state.ts
@@ -22,6 +22,15 @@ export const SitePluginRuntimeStateSchema = Type.Union(
   SITE_PLUGIN_RUNTIME_STATES.map((state) => Type.Literal(state)),
 )
 
+/** One retained build — a rollback target. */
+export const SitePluginRevisionSchema = Type.Object({
+  /** Generated version (`1.0.<n>+<hash>`). */
+  version: Type.String(),
+  /** Build time, epoch ms. */
+  builtAt: Type.Number(),
+})
+export type SitePluginRevision = Static<typeof SitePluginRevisionSchema>
+
 /** Wire shape of one site plugin in the list payload. */
 export const SitePluginSummarySchema = Type.Object({
   localId: Type.String(),
@@ -31,6 +40,8 @@ export const SitePluginSummarySchema = Type.Object({
   state: SitePluginRuntimeStateSchema,
   /** Active generated version (1.0.<n>+<hash>), or null before first build. */
   activeVersion: Type.Union([Type.String(), Type.Null()]),
+  /** Retained builds, newest first — every entry is a rollback target. Empty until the first build. */
+  revisions: Type.Array(SitePluginRevisionSchema),
   /** False when the runtime row survives a deleted plugins/<id>/ folder. */
   hasDraftSource: Type.Boolean(),
   /** Draft declares a module pack — enables `Preview in canvas`. */
diff --git a/src/ui/components/SplitButton/SplitButton.tsx b/src/ui/components/SplitButton/SplitButton.tsx
index 3c9f45ae5..d7df1034d 100644
--- a/src/ui/components/SplitButton/SplitButton.tsx
+++ b/src/ui/components/SplitButton/SplitButton.tsx
@@ -14,7 +14,12 @@ import { Fragment, useEffect, useId, useRef, useState, type ReactNode } from 're
 import { createPortal } from 'react-dom'
 import { cn } from '@ui/cn'
 import { Button, type ButtonProps } from '@ui/components/Button'
-import { ContextMenu, ContextMenuItem, ContextMenuSeparator } from '@ui/components/ContextMenu'
+import {
+  ContextMenu,
+  ContextMenuItem,
+  ContextMenuSeparator,
+  ContextMenuSubmenu,
+} from '@ui/components/ContextMenu'
 import { ChevronDown2Icon } from 'pixel-art-icons/icons/chevron-down-2'
 import { LoaderIcon } from 'pixel-art-icons/icons/loader'
 import type { IconComponent } from 'pixel-art-icons/types'
@@ -32,7 +37,13 @@ export interface SplitButtonMenuItem {
   danger?: boolean
   /** Draw a divider above this row to start a new group. */
   separatorBefore?: boolean
-  onSelect: () => void | Promise<void>
+  /**
+   * Nested rows — the row becomes a submenu trigger and `onSelect` is not
+   * called. A disabled row with children renders as a plain disabled row
+   * (with its tooltip) so the reason stays visible.
+   */
+  children?: SplitButtonMenuItem[]
+  onSelect?: () => void | Promise<void>
   testId?: string
 }
 
@@ -83,6 +94,8 @@ export interface SplitButtonProps {
 
 const DEFAULT_MENU_WIDTH = 184
 const MENU_GAP = 6
+/** Above editor panels; a submenu stacks itself just above this. */
+const MENU_Z_INDEX = 10000
 
 export function SplitButton({
   label,
@@ -123,11 +136,62 @@ export function SplitButton({
   }, [menuOpen])
 
   function handleSelect(item: SplitButtonMenuItem) {
-    if (item.disabled) return
+    if (item.disabled || !item.onSelect) return
     setMenuOpen(false)
     void item.onSelect()
   }
 
+  function renderRow(item: SplitButtonMenuItem) {
+    const ItemIcon = item.icon
+    const content = (
+      <>
+        {ItemIcon && (
+          <span aria-hidden="true">
+            <ItemIcon size={14} />
+          </span>
+        )}
+        <span>{item.label}</span>
+      </>
+    )
+    if (item.children && !item.disabled) {
+      return (
+        <ContextMenuSubmenu
+          label={item.label}
+          icon={ItemIcon ? <ItemIcon size={14} /> : undefined}
+          zIndex={MENU_Z_INDEX}
+          width={menuWidth}
+          onClose={() => setMenuOpen(false)}
+        >
+          {item.children.map((child) => (
+            <Fragment key={child.id}>
+              {child.separatorBefore && <ContextMenuSeparator />}
+              <ContextMenuItem
+                disabled={child.disabled}
+                tooltip={child.tooltip}
+                danger={child.danger}
+                onClick={() => handleSelect(child)}
+                data-testid={child.testId}
+              >
+                {child.label}
+              </ContextMenuItem>
+            </Fragment>
+          ))}
+        </ContextMenuSubmenu>
+      )
+    }
+    return (
+      <ContextMenuItem
+        disabled={item.disabled}
+        tooltip={item.tooltip}
+        danger={item.danger}
+        onClick={() => handleSelect(item)}
+        data-testid={item.testId}
+      >
+        {content}
+      </ContextMenuItem>
+    )
+  }
+
   const resolvedAriaLabel =
     primaryAriaLabel ?? (typeof label === 'string' ? label : undefined)
 
@@ -197,33 +261,17 @@ export function SplitButton({
           offset={MENU_GAP}
           width={menuWidth}
           minWidth={menuWidth}
-          zIndex={10000}
+          zIndex={MENU_Z_INDEX}
           ariaLabel={menuLabel ?? menuTriggerLabel}
           onClose={closeMenu}
           data-testid={menuTestId}
         >
-          {menuItems.map((item) => {
-            const ItemIcon = item.icon
-            return (
-              <Fragment key={item.id}>
-                {item.separatorBefore && <ContextMenuSeparator />}
-                <ContextMenuItem
-                  disabled={item.disabled}
-                  tooltip={item.tooltip}
-                  danger={item.danger}
-                  onClick={() => handleSelect(item)}
-                  data-testid={item.testId}
-                >
-                  {ItemIcon && (
-                    <span aria-hidden="true">
-                      <ItemIcon size={14} />
-                    </span>
-                  )}
-                  <span>{item.label}</span>
-                </ContextMenuItem>
-              </Fragment>
-            )
-          })}
+          {menuItems.map((item) => (
+            <Fragment key={item.id}>
+              {item.separatorBefore && <ContextMenuSeparator />}
+              {renderRow(item)}
+            </Fragment>
+          ))}
         </ContextMenu>,
         document.body,
       )}

From 17dcc883b0dc9e2588d2717447177c6c46d27677 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Thu, 3 Sep 2026 10:10:17 +0200
Subject: [PATCH 30/36] refactor(site-plugins): fold the permission review into
 the activation click

A changed grant set was its own runtime state, "Permission review needed",
with its own primary action. Grants live in plugin.json, so every grant
change is a draft change, and the review dialog already opens from the
Build & activate click when the declared and granted sets differ. The state
is gone: the chip reads Draft changed, the click reviews then builds, and
the summary keeps newPermissions / removedPermissions for the dialog. The
state machine test, the lifecycle rollback test, and the docs follow.
---
 docs/features/site-plugins.md                    | 10 ++++++++--
 server/ai/tools/plugin/docs.ts                   | 16 +++++++++-------
 server/handlers/cms/sitePlugins/service.ts       |  2 --
 src/__tests__/server/sitePluginLifecycle.test.ts |  6 ++++--
 src/__tests__/sitePlugins/sourceModel.test.ts    |  4 +---
 src/admin/pages/plugins/ide/IdeActions.tsx       | 10 +++-------
 src/core/site-plugins/state.ts                   | 15 ++++++---------
 7 files changed, 31 insertions(+), 32 deletions(-)

diff --git a/docs/features/site-plugins.md b/docs/features/site-plugins.md
index c12e29798..3b146d2c9 100644
--- a/docs/features/site-plugins.md
+++ b/docs/features/site-plugins.md
@@ -148,8 +148,14 @@ the **union** of draft folders and site-local rows — deleting the folder
 never hides a running backend (`Source missing` still lists, offering
 deactivate/delete):
 
-`active` · `draft-changed` · `build-failed` · `permission-review` ·
-`runtime-error` · `disabled` · `source-missing`
+`active` · `draft-changed` · `build-failed` · `runtime-error` · `disabled`
+· `source-missing`
+
+A changed grant set is not a state of its own: grants live in
+`plugin.json`, so any grant change is a draft change, and the consent step
+(the permission review dialog, then step-up) belongs to the `Build &
+activate` click. The summary still carries `newPermissions` /
+`removedPermissions` so the dialog can show the diff.
 
 Each state maps to ONE smart primary action (`sitePluginPrimaryAction`),
 rendered in the IDE header; the Plugins-page draft card only offers `Open
diff --git a/server/ai/tools/plugin/docs.ts b/server/ai/tools/plugin/docs.ts
index 4476a365f..2756106b1 100644
--- a/server/ai/tools/plugin/docs.ts
+++ b/server/ai/tools/plugin/docs.ts
@@ -250,13 +250,15 @@ sitePluginRoute('<localId>', '/path') from '@instatic/plugin-sdk'
 3. Visitor-facing surfaces (modules pack, frontend assets) trigger an
    automatic republish of baked pages on activation.
 
-States: active · draft-changed (source differs from active revision) ·
-build-failed · permission-review (grants differ) · runtime-error · disabled ·
-source-missing. plugin_list_plugins reports them.
-
-Settings + secrets survive rebuilds. Rollback re-activates the retained
-previous revision (IDE header menu). Deleting the plugin removes the runtime
-row AND the draft folder.
+States: active · draft-changed (source differs from the active revision; a
+changed permission set is a draft change too — the review happens on the
+activation click) · build-failed · runtime-error · disabled · source-missing.
+plugin_list_plugins reports them, plus newPermissions / removedPermissions.
+
+Settings + secrets survive rebuilds. The five most recent builds are
+retained; the IDE header menu can roll back to any of them (the user does
+this, there is no tool for it). Deleting the plugin removes the runtime row
+AND the draft folder.
 
 Gotchas:
 - diagnostics are build/containment/manifest errors, NOT TypeScript type checks;
diff --git a/server/handlers/cms/sitePlugins/service.ts b/server/handlers/cms/sitePlugins/service.ts
index 52821528f..60427a17f 100644
--- a/server/handlers/cms/sitePlugins/service.ts
+++ b/server/handlers/cms/sitePlugins/service.ts
@@ -175,7 +175,6 @@ export async function listSitePlugins(
 
     const declared = manifest?.permissions ?? []
     const granted = row?.grantedPermissions ?? []
-    const grantsChanged = manifest !== null && row !== null && !sameStringSet(declared, granted)
 
     const state = computeSitePluginState({
       hasDraftSource: draft !== null,
@@ -185,7 +184,6 @@ export async function listSitePlugins(
       manifestError,
       draftContentHash,
       activeContentHash: contentHashOfVersion(row?.version),
-      grantsChanged,
     })
 
     summaries.push({
diff --git a/src/__tests__/server/sitePluginLifecycle.test.ts b/src/__tests__/server/sitePluginLifecycle.test.ts
index ac5570f6b..d2b74f9e0 100644
--- a/src/__tests__/server/sitePluginLifecycle.test.ts
+++ b/src/__tests__/server/sitePluginLifecycle.test.ts
@@ -337,8 +337,10 @@ describe('site plugin activation authority', () => {
     const afterEntry = after.sitePlugins.find((plugin) => plugin.localId === 'newsletter')
     expect(afterEntry?.revisions.some((revision) => revision.version.startsWith('1.0.3+'))).toBe(true)
     // The draft still declares cms.routes.public, which the rolled-back
-    // grant set lacks — that outranks "draft changed" in the state machine.
-    expect(afterEntry?.state).toBe('permission-review')
+    // grant set lacks: that is a draft change like any other, and the
+    // review happens on the next activation click.
+    expect(afterEntry?.state).toBe('draft-changed')
+    expect(afterEntry?.newPermissions).toEqual(['cms.routes.public'])
 
     const alreadyActive = await harness.cms('/admin/api/cms/site-plugins/newsletter/rollback', {
       method: 'POST',
diff --git a/src/__tests__/sitePlugins/sourceModel.test.ts b/src/__tests__/sitePlugins/sourceModel.test.ts
index 514dc41a4..d92448377 100644
--- a/src/__tests__/sitePlugins/sourceModel.test.ts
+++ b/src/__tests__/sitePlugins/sourceModel.test.ts
@@ -200,13 +200,11 @@ describe('runtime state machine', () => {
     manifestError: null,
     draftContentHash: 'abc',
     activeContentHash: 'abc',
-    grantsChanged: false,
   }
 
-  test('precedence: source-missing > runtime-error > disabled > build-failed > review > draft-changed > active', () => {
+  test('precedence: source-missing > runtime-error > disabled > build-failed > draft-changed > active', () => {
     expect(computeSitePluginState(base)).toBe('active')
     expect(computeSitePluginState({ ...base, draftContentHash: 'zzz' })).toBe('draft-changed')
-    expect(computeSitePluginState({ ...base, grantsChanged: true })).toBe('permission-review')
     expect(computeSitePluginState({ ...base, manifestError: 'bad json' })).toBe('build-failed')
     expect(
       computeSitePluginState({
diff --git a/src/admin/pages/plugins/ide/IdeActions.tsx b/src/admin/pages/plugins/ide/IdeActions.tsx
index b3e6b56be..6252ffbd2 100644
--- a/src/admin/pages/plugins/ide/IdeActions.tsx
+++ b/src/admin/pages/plugins/ide/IdeActions.tsx
@@ -24,8 +24,6 @@ function stateTone(state: SitePluginRuntimeState): ToolbarStatusTone {
   switch (state) {
     case 'active':
       return 'success'
-    case 'permission-review':
-      return 'warning'
     case 'build-failed':
     case 'runtime-error':
     case 'source-missing':
@@ -80,8 +78,7 @@ export function IdeActions({
 
   // Same split as the server: install-class actions need plugins.install,
   // enable/disable/restart need plugins.lifecycle.
-  const needsInstallCap =
-    primary?.action === 'activate' || primary?.action === 'review' || primary?.action === 'delete'
+  const needsInstallCap = primary?.action === 'activate' || primary?.action === 'delete'
   const needsLifecycleCap = primary?.action === 'enable'
   // `active` has no state action of its own: the left half keeps reading
   // "Build & activate" and says why there is nothing to build.
@@ -99,9 +96,8 @@ export function IdeActions({
   const runPrimary = (): void => {
     switch (primary?.action) {
       case 'activate':
-      case 'review':
-        // The review moment IS activation — the server enforces step-up and
-        // the dialog shows the grant diff before anything changes.
+        // The page opens the permission review first when the grant set
+        // changed; the server enforces step-up either way.
         onActivate()
         return
       case 'diagnostics':
diff --git a/src/core/site-plugins/state.ts b/src/core/site-plugins/state.ts
index e3289aaba..19161ec5a 100644
--- a/src/core/site-plugins/state.ts
+++ b/src/core/site-plugins/state.ts
@@ -10,7 +10,6 @@ export const SITE_PLUGIN_RUNTIME_STATES = [
   'active',
   'draft-changed',
   'build-failed',
-  'permission-review',
   'runtime-error',
   'disabled',
   'source-missing',
@@ -77,8 +76,6 @@ export interface SitePluginStateInput {
   draftContentHash: string | null
   /** Hash carried by the active row's version (`+<hash>`), or null. */
   activeContentHash: string | null
-  /** Grant diff between the derived draft manifest and the row. */
-  grantsChanged: boolean
 }
 
 /**
@@ -86,6 +83,10 @@ export interface SitePluginStateInput {
  * table implies: missing source beats everything (an invisible-but-running
  * backend must surface), then runtime errors, then disabled, then draft
  * problems, then the hash comparison.
+ *
+ * A changed grant set is not a state of its own: grants live in
+ * `plugin.json`, so any grant change is a draft change, and the consent
+ * step (permission review + step-up) belongs to the activation click.
  */
 export function computeSitePluginState(input: SitePluginStateInput): SitePluginRuntimeState {
   if (!input.hasDraftSource) return 'source-missing'
@@ -94,7 +95,6 @@ export function computeSitePluginState(input: SitePluginStateInput): SitePluginR
     return 'disabled'
   }
   if (input.manifestError) return 'build-failed'
-  if (input.grantsChanged) return 'permission-review'
   if (!input.row) return 'draft-changed' // never built — the first Build & activate
   if (input.draftContentHash !== input.activeContentHash) return 'draft-changed'
   return 'active'
@@ -102,7 +102,6 @@ export function computeSitePluginState(input: SitePluginStateInput): SitePluginR
 
 export type SitePluginPrimaryActionKind =
   | 'activate'
-  | 'review'
   | 'diagnostics'
   | 'open-plugins-page'
   | 'delete'
@@ -119,9 +118,9 @@ export interface SitePluginPrimaryAction {
 export function sitePluginPrimaryAction(state: SitePluginRuntimeState): SitePluginPrimaryAction {
   switch (state) {
     case 'draft-changed':
+      // When the declared grants differ from the granted ones, the IDE opens
+      // the permission review before building — same click, one more step.
       return { label: 'Build & activate', action: 'activate' }
-    case 'permission-review':
-      return { label: 'Review permissions', action: 'review' }
     case 'build-failed':
       return { label: 'View diagnostics', action: 'diagnostics' }
     case 'runtime-error':
@@ -146,8 +145,6 @@ export function sitePluginStateLabel(state: SitePluginRuntimeState): string {
       return 'Draft changed'
     case 'build-failed':
       return 'Build failed'
-    case 'permission-review':
-      return 'Permission review needed'
     case 'runtime-error':
       return 'Runtime error'
     case 'disabled':

From 073304e72f767fe3229f101430e160f84d7bd121 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Thu, 3 Sep 2026 22:33:14 +0200
Subject: [PATCH 31/36] fix(plugin-ide): nest the file tree like the Layers
 panel

- TreeGroup joins the shared tree primitives: a row plus its children, painted
  as one surface while the parent is selected and expanded. The Layers panel
  uses it instead of its own group styling.
- The IDE file tree renders folders recursively, folders first, with the
  chevron at the end of the row so files and folders share a left edge, and
  keeps the same right inset as the Layers tree so row paint stays rounded.
- New file from a file's context menu lands beside it.
---
 docs/features/site-plugins.md                 |   7 +-
 src/__tests__/panels/domPanel.test.tsx        |  29 +-
 .../pages/plugins/ide/FileTreePane.module.css |  11 +-
 src/admin/pages/plugins/ide/FileTreePane.tsx  | 361 +++++++++++-------
 .../site/panels/DomPanel/TreeNode.module.css  |  10 -
 .../pages/site/panels/DomPanel/TreeNode.tsx   |   8 +-
 .../pages/site/ui/Tree/TreeRow.module.css     |  11 +
 src/admin/pages/site/ui/Tree/TreeRow.tsx      |  18 +
 src/admin/pages/site/ui/Tree/index.ts         |  10 +-
 9 files changed, 290 insertions(+), 175 deletions(-)

diff --git a/docs/features/site-plugins.md b/docs/features/site-plugins.md
index 3b146d2c9..01f3b6e45 100644
--- a/docs/features/site-plugins.md
+++ b/docs/features/site-plugins.md
@@ -167,7 +167,12 @@ Unavailable actions are disabled with an inline reason, never hidden.
 `/admin/plugins/develop/<local-id>` — a full-screen workspace-canvas route
 (`AdminWorkspace: 'pluginIde'`, layout persistence like every canvas):
 file tree (left, resizable) and the co-edited CodeMirror buffer with the
-diagnostics strip beneath it. There is deliberately no right panel:
+diagnostics strip beneath it. The tree is built from the same primitives as
+the Layers panel (`@site/ui/Tree`): folders sort first, a folder's chevron
+sits at the end of its row so files and folders at one depth share a left
+edge, and a clicked, expanded folder paints its subtree as one `TreeGroup`
+surface — the same nesting the Layers panel gives a selected container.
+There is deliberately no right panel:
 `plugin.json` is edited as raw JSON in the buffer (auto-selected on open),
 and every manifest mistake surfaces as a named diagnostic.
 
diff --git a/src/__tests__/panels/domPanel.test.tsx b/src/__tests__/panels/domPanel.test.tsx
index b15d63310..d12b65983 100644
--- a/src/__tests__/panels/domPanel.test.tsx
+++ b/src/__tests__/panels/domPanel.test.tsx
@@ -527,28 +527,29 @@ describe('DomPanel — open container group highlight', () => {
     fireEvent.click(rootItem)
 
     const containerWrapper = document.querySelector('[data-node-id="container-1"]')
-    expect(containerWrapper?.getAttribute('data-open-container-group')).toBeNull()
+    expect(containerWrapper?.getAttribute('data-tree-group-open')).toBeNull()
 
     const containerItem = screen.getByRole('treeitem', { name: /container/i })
     fireEvent.click(containerItem)
 
-    expect(containerWrapper?.getAttribute('data-open-container-group')).toBe('true')
+    expect(containerWrapper?.getAttribute('data-tree-group-open')).toBe('true')
   })
 
-  it('styles open container groups with a rounded background on the wrapper', () => {
+  it('paints open container groups through the shared TreeGroup primitive', () => {
     const source = readFileSync(TREE_NODE_SOURCE_PATH, 'utf8')
     const rowCss = readFileSync(TREE_ROW_CSS_PATH, 'utf8')
-    const css = readFileSync(TREE_NODE_CSS_PATH, 'utf8')
 
-    expect(source).toContain('styles.openContainerGroup')
-    expect(css).toContain('.openContainerGroup')
+    // The wrapper IS the primitive: no panel-local group styling.
+    expect(source).toContain('<TreeGroup')
+    expect(source).toContain('open={isOpenContainerGroup}')
+    expect(source).not.toContain('styles.openContainerGroup')
 
     const rowBlock = rowCss.match(/\.row\s*\{[^}]*\}/s)?.[0] ?? ''
-    const block = css.match(/\.openContainerGroup\s*\{[^}]*\}/s)?.[0] ?? ''
-    expect(block).toContain('background:')
+    const groupBlock = rowCss.match(/\.group\s*\{[^}]*\}/s)?.[0] ?? ''
+    const openBlock = rowCss.match(/\.groupOpen\s*\{[^}]*\}/s)?.[0] ?? ''
     expect(rowBlock).toMatch(/border-radius:\s*8px/)
-    expect(block).toMatch(/border-radius:\s*8px/)
-    expect(block).not.toContain('18px')
+    expect(groupBlock).toMatch(/border-radius:\s*8px/)
+    expect(openBlock).toContain('background:')
   })
 
   it('moves the open group highlight when selecting a different expanded container', () => {
@@ -563,13 +564,13 @@ describe('DomPanel — open container group highlight', () => {
     const containerItems = screen.getAllByRole('treeitem', { name: /container/i })
     fireEvent.click(containerItems[0])
 
-    expect(firstWrapper?.getAttribute('data-open-container-group')).toBe('true')
-    expect(secondWrapper?.getAttribute('data-open-container-group')).toBeNull()
+    expect(firstWrapper?.getAttribute('data-tree-group-open')).toBe('true')
+    expect(secondWrapper?.getAttribute('data-tree-group-open')).toBeNull()
 
     fireEvent.click(containerItems[1])
 
-    expect(firstWrapper?.getAttribute('data-open-container-group')).toBeNull()
-    expect(secondWrapper?.getAttribute('data-open-container-group')).toBe('true')
+    expect(firstWrapper?.getAttribute('data-tree-group-open')).toBeNull()
+    expect(secondWrapper?.getAttribute('data-tree-group-open')).toBe('true')
   })
 })
 
diff --git a/src/admin/pages/plugins/ide/FileTreePane.module.css b/src/admin/pages/plugins/ide/FileTreePane.module.css
index 7434ac78d..1b9a6078a 100644
--- a/src/admin/pages/plugins/ide/FileTreePane.module.css
+++ b/src/admin/pages/plugins/ide/FileTreePane.module.css
@@ -7,11 +7,14 @@
   min-height: 0;
 }
 
+/* Same inset as the Layers panel's tree area: rows keep a gap from the
+   panel's right edge so their hover and selection paint stays rounded. */
 .tree {
   flex: 1;
   min-height: 0;
   overflow-y: auto;
-  padding: var(--space-xs) 0;
+  overflow-x: hidden;
+  padding: var(--space-xs) var(--space-s) var(--space-xs) 0;
 }
 
 /* Same reset the Site Explorer applies to its row buttons — the TreeRow
@@ -36,6 +39,12 @@
   background: transparent;
 }
 
+/* Folder chevrons sit at the end of the row: files and folders at one depth
+   then share the same left edge (icon, then name). */
+.chevronEnd {
+  margin-left: auto;
+}
+
 .rowPeers {
   display: inline-flex;
   align-items: center;
diff --git a/src/admin/pages/plugins/ide/FileTreePane.tsx b/src/admin/pages/plugins/ide/FileTreePane.tsx
index 8a3846f24..01db206e7 100644
--- a/src/admin/pages/plugins/ide/FileTreePane.tsx
+++ b/src/admin/pages/plugins/ide/FileTreePane.tsx
@@ -1,17 +1,20 @@
 /**
  * FileTreePane — the Plugin IDE's file explorer.
  *
- * Composed from the SAME primitives as the Site Explorer / DOM panel trees:
- * the shared `Panel` shell (chrome, header, close) with `TreeRow` rows whose
- * interactive surface is a ghost Button (`TreeChevron` + `TreeIconSlot` +
- * `TreeLabelGroup`), F2/double-click inline rename, and the standard
- * point-anchored context menu. Peers editing a file show as identity
- * avatars on its row.
+ * Composed from the SAME primitives as the Layers panel and the Site
+ * Explorer: the shared `Panel` shell (chrome, header, close), `TreeGroup`
+ * subtrees (a folder row plus its children — one raised surface while the
+ * folder is the selection), `TreeRow` rows whose interactive surface is a
+ * ghost Button, F2/double-click inline rename, and the standard
+ * point-anchored context menu. Folders carry their chevron at the end of
+ * the row so files and folders at one depth share the same left edge. Peers
+ * editing a file show as identity avatars on its row.
  */
-import { useEffect, useRef, useState, type KeyboardEvent, type MouseEvent } from 'react'
+import { useEffect, useRef, useState, type KeyboardEvent, type MouseEvent, type ReactNode } from 'react'
 import {
   TreeChevron,
   TreeContainer,
+  TreeGroup,
   TreeIconSlot,
   TreeLabel,
   TreeLabelGroup,
@@ -32,63 +35,69 @@ import type { IdeFileMeta } from './ideCollab'
 import type { IdePeer } from './idePresence'
 import styles from './FileTreePane.module.css'
 
-interface TreeEntry {
-  key: string
-  kind: 'folder' | 'file'
+interface FolderEntry {
+  kind: 'folder'
   label: string
-  depth: number
-  fileId?: string
   /** Plugin-folder-relative path. */
   path: string
+  children: TreeEntry[]
 }
 
+interface FileEntry {
+  kind: 'file'
+  label: string
+  path: string
+  fileId: string
+}
+
+type TreeEntry = FolderEntry | FileEntry
+
 interface MenuState {
   x: number
   y: number
   entry: TreeEntry
 }
 
-/** Flatten paths into depth-annotated rows; folders derive from prefixes. */
-function buildRows(
-  files: IdeFileMeta[],
-  folder: string,
-  collapsed: ReadonlySet<string>,
-): TreeEntry[] {
-  const rows: TreeEntry[] = []
-  const seenFolders = new Set<string>()
+const ROOT = ''
+
+function compareLabels(a: TreeEntry, b: TreeEntry): number {
+  if (a.kind !== b.kind) return a.kind === 'folder' ? -1 : 1
+  return a.label.localeCompare(b.label, undefined, { sensitivity: 'base' })
+}
+
+/** Nest plugin-relative paths into folders; folders first, then files, by name. */
+function buildTree(files: IdeFileMeta[], folder: string): TreeEntry[] {
+  const root: FolderEntry = { kind: 'folder', label: ROOT, path: ROOT, children: [] }
+  const folders = new Map<string, FolderEntry>([[ROOT, root]])
   for (const file of files) {
     const relative = file.path.slice(folder.length)
     const segments = relative.split('/')
-    let prefix = ''
-    let hidden = false
+    let parent = root
     for (let depth = 0; depth < segments.length - 1; depth++) {
       const segment = segments[depth]!
-      const folderPath = prefix ? `${prefix}/${segment}` : segment
-      if (!hidden && !seenFolders.has(folderPath)) {
-        seenFolders.add(folderPath)
-        rows.push({
-          key: `folder:${folderPath}`,
-          kind: 'folder',
-          label: segment,
-          depth,
-          path: folderPath,
-        })
+      const path = parent.path ? `${parent.path}/${segment}` : segment
+      let next = folders.get(path)
+      if (!next) {
+        next = { kind: 'folder', label: segment, path, children: [] }
+        folders.set(path, next)
+        parent.children.push(next)
       }
-      if (collapsed.has(folderPath)) hidden = true
-      prefix = folderPath
-    }
-    if (!hidden) {
-      rows.push({
-        key: `file:${file.id}`,
-        kind: 'file',
-        label: segments[segments.length - 1] ?? relative,
-        depth: segments.length - 1,
-        fileId: file.id,
-        path: relative,
-      })
+      parent = next
     }
+    parent.children.push({
+      kind: 'file',
+      label: segments[segments.length - 1] ?? relative,
+      path: relative,
+      fileId: file.id,
+    })
   }
-  return rows
+  for (const entry of folders.values()) entry.children.sort(compareLabels)
+  return root.children
+}
+
+function parentFolderOf(relativePath: string): string {
+  const cut = relativePath.lastIndexOf('/')
+  return cut === -1 ? ROOT : relativePath.slice(0, cut)
 }
 
 interface FileTreePaneProps {
@@ -137,11 +146,15 @@ export function FileTreePane({
       ? 'Connecting to the live draft…'
       : null
   const [collapsed, setCollapsed] = useState<ReadonlySet<string>>(new Set())
+  // The folder the user last clicked. Like a selected container in the
+  // Layers panel, its expanded subtree paints as one surface. Selecting a
+  // file hands the selection back to the file.
+  const [selectedFolder, setSelectedFolder] = useState<string | null>(null)
   const [pendingNew, setPendingNew] = useState<string | null>(null) // parent folder ('' = root)
   const [renamingFileId, setRenamingFileId] = useState<string | null>(null)
   const [menu, setMenu] = useState<MenuState | null>(null)
 
-  const rows = buildRows(files, folder, collapsed)
+  const tree = buildTree(files, folder)
   const peersByFileId = new Map<string, IdePeer[]>()
   for (const peer of peers) {
     if (!peer.ideFile) continue
@@ -150,6 +163,15 @@ export function FileTreePane({
     peersByFileId.set(peer.ideFile.fileId, bucket)
   }
 
+  const expand = (path: string): void => {
+    setCollapsed((current) => {
+      if (!current.has(path)) return current
+      const next = new Set(current)
+      next.delete(path)
+      return next
+    })
+  }
+
   const toggleFolder = (path: string): void => {
     setCollapsed((current) => {
       const next = new Set(current)
@@ -166,6 +188,11 @@ export function FileTreePane({
     setMenu({ x: event.clientX, y: event.clientY, entry })
   }
 
+  const startNewFile = (parentFolder: string): void => {
+    expand(parentFolder)
+    setPendingNew(parentFolder)
+  }
+
   const submitNew = (relativePath: string): void => {
     setPendingNew(null)
     const trimmed = relativePath.trim()
@@ -196,6 +223,140 @@ export function FileTreePane({
     }
   }
 
+  const renderRowButton = (entry: TreeEntry, expanded: boolean, children: ReactNode) => (
+    <Button
+      variant="ghost"
+      size="sm"
+      align="start"
+      className={styles.treeRowButton}
+      aria-label={entry.label}
+      onClick={() => {
+        if (entry.kind === 'folder') {
+          setSelectedFolder(entry.path)
+          toggleFolder(entry.path)
+        } else {
+          setSelectedFolder(null)
+          onSelect(entry.fileId)
+        }
+      }}
+      onContextMenu={(event) => openMenu(event, entry)}
+      onDoubleClick={(event) => {
+        if (entry.kind !== 'file' || !canMutate) return
+        event.preventDefault()
+        event.stopPropagation()
+        setRenamingFileId(entry.fileId)
+      }}
+      onKeyDown={(event) => {
+        if (event.key === 'F2' && entry.kind === 'file' && canMutate) {
+          event.preventDefault()
+          event.stopPropagation()
+          setRenamingFileId(entry.fileId)
+        }
+      }}
+    >
+      {children}
+      {entry.kind === 'folder' && <TreeChevron expanded={expanded} className={styles.chevronEnd} />}
+    </Button>
+  )
+
+  const renderPendingNew = (parentFolder: string, depth: number) => (
+    <TreeRow depth={depth} data-testid="ide-new-file-row">
+      <TreeIconSlot icon={FilePlusSolidIcon} iconSize={12} />
+      <InlineRenameInput
+        value={parentFolder === ROOT ? '' : `${parentFolder}/`}
+        placeholder="path/to/file.ts"
+        ariaLabel="New file path"
+        onCommit={submitNew}
+        onCancel={() => setPendingNew(null)}
+      />
+    </TreeRow>
+  )
+
+  const renderFile = (entry: FileEntry, depth: number) => {
+    const filePeers = peersByFileId.get(entry.fileId) ?? []
+    const isRenaming = renamingFileId === entry.fileId
+    return (
+      <TreeRow
+        key={`file:${entry.fileId}`}
+        depth={depth}
+        selected={entry.fileId === activeFileId}
+        role="treeitem"
+        aria-label={entry.label}
+        aria-level={depth + 1}
+        data-testid="ide-file-row"
+        data-path={entry.path}
+      >
+        {isRenaming ? (
+          <>
+            <TreeIconSlot icon={FileTextSolidIcon} iconSize={12} />
+            <InlineRenameInput
+              value={entry.path}
+              ariaLabel={`Rename ${entry.label}`}
+              onCommit={(value) => submitRename(entry.fileId, value)}
+              onCancel={() => setRenamingFileId(null)}
+            />
+          </>
+        ) : (
+          renderRowButton(entry, false, (
+            <>
+              <TreeIconSlot icon={FileTextSolidIcon} iconSize={12} />
+              <TreeLabelGroup>
+                <TreeLabel>{entry.label}</TreeLabel>
+              </TreeLabelGroup>
+              {filePeers.length > 0 && (
+                <span
+                  className={styles.rowPeers}
+                  aria-label={`${filePeers.length} peer(s) editing this file`}
+                >
+                  {filePeers.slice(0, 3).map((peer) => (
+                    <PeerAvatar key={peer.clientId} user={peer.user} size={14} />
+                  ))}
+                </span>
+              )}
+            </>
+          ))
+        )}
+      </TreeRow>
+    )
+  }
+
+  const renderFolder = (entry: FolderEntry, depth: number) => {
+    const expanded = !collapsed.has(entry.path)
+    const selected = selectedFolder === entry.path
+    return (
+      <TreeGroup key={`folder:${entry.path}`} open={selected && expanded} data-path={entry.path}>
+        <TreeRow
+          depth={depth}
+          selected={selected}
+          role="treeitem"
+          aria-label={entry.label}
+          aria-level={depth + 1}
+          aria-expanded={expanded}
+          data-testid="ide-folder-row"
+          data-path={entry.path}
+        >
+          {renderRowButton(entry, expanded, (
+            <>
+              <TreeIconSlot icon={FolderGlyphIcon} iconSize={12} />
+              <TreeLabelGroup>
+                <TreeLabel>{entry.label}</TreeLabel>
+              </TreeLabelGroup>
+            </>
+          ))}
+        </TreeRow>
+        {expanded && (
+          <div role="group">
+            {renderEntries(entry.children, depth + 1)}
+            {pendingNew === entry.path && renderPendingNew(entry.path, depth + 1)}
+          </div>
+        )}
+      </TreeGroup>
+    )
+  }
+
+  const renderEntries = (entries: TreeEntry[], depth: number) =>
+    entries.map((entry) => (entry.kind === 'folder' ? renderFolder(entry, depth) : renderFile(entry, depth)))
+
   return (
     <Panel
       panelId="ide-files"
@@ -223,7 +384,7 @@ export function FileTreePane({
           aria-label="New file"
           tooltip={mutateBlockedReason ?? 'New file'}
           disabled={!canMutate}
-          onClick={() => setPendingNew('')}
+          onClick={() => startNewFile(ROOT)}
           data-testid="ide-new-file"
         >
           <FilePlusSolidIcon size={14} aria-hidden="true" />
@@ -232,96 +393,8 @@ export function FileTreePane({
     >
       <div className={styles.tree}>
         <TreeContainer ariaLabel="Site plugin files">
-          {rows.map((entry) => {
-            const filePeers = entry.fileId ? (peersByFileId.get(entry.fileId) ?? []) : []
-            const isRenaming = entry.kind === 'file' && renamingFileId === entry.fileId
-            return (
-              <TreeRow
-                key={entry.key}
-                depth={entry.depth}
-                selected={entry.kind === 'file' && entry.fileId === activeFileId}
-                role="treeitem"
-                aria-label={entry.label}
-                aria-level={entry.depth + 1}
-                aria-expanded={entry.kind === 'folder' ? !collapsed.has(entry.path) : undefined}
-                data-testid={entry.kind === 'file' ? 'ide-file-row' : 'ide-folder-row'}
-                data-path={entry.path}
-              >
-                {isRenaming ? (
-                  <>
-                    <TreeIconSlot icon={FileTextSolidIcon} iconSize={12} />
-                    <InlineRenameInput
-                      value={entry.path}
-                      ariaLabel={`Rename ${entry.label}`}
-                      onCommit={(value) => submitRename(entry.fileId!, value)}
-                      onCancel={() => setRenamingFileId(null)}
-                    />
-                  </>
-                ) : (
-                  <Button
-                    variant="ghost"
-                    size="sm"
-                    align="start"
-                    className={styles.treeRowButton}
-                    aria-label={entry.label}
-                    onClick={() => {
-                      if (entry.kind === 'folder') toggleFolder(entry.path)
-                      else if (entry.fileId) onSelect(entry.fileId)
-                    }}
-                    onContextMenu={(event) => openMenu(event, entry)}
-                    onDoubleClick={(event) => {
-                      if (entry.kind !== 'file' || !canMutate) return
-                      event.preventDefault()
-                      event.stopPropagation()
-                      setRenamingFileId(entry.fileId ?? null)
-                    }}
-                    onKeyDown={(event) => {
-                      if (event.key === 'F2' && entry.kind === 'file' && canMutate) {
-                        event.preventDefault()
-                        event.stopPropagation()
-                        setRenamingFileId(entry.fileId ?? null)
-                      }
-                    }}
-                  >
-                    {entry.kind === 'folder' ? (
-                      <>
-                        <TreeChevron expanded={!collapsed.has(entry.path)} />
-                        <TreeIconSlot icon={FolderGlyphIcon} iconSize={12} />
-                      </>
-                    ) : (
-                      <TreeIconSlot icon={FileTextSolidIcon} iconSize={12} />
-                    )}
-                    <TreeLabelGroup>
-                      <TreeLabel>{entry.label}</TreeLabel>
-                    </TreeLabelGroup>
-                    {filePeers.length > 0 && (
-                      <span
-                        className={styles.rowPeers}
-                        aria-label={`${filePeers.length} peer(s) editing this file`}
-                      >
-                        {filePeers.slice(0, 3).map((peer) => (
-                          <PeerAvatar key={peer.clientId} user={peer.user} size={14} />
-                        ))}
-                      </span>
-                    )}
-                  </Button>
-                )}
-              </TreeRow>
-            )
-          })}
-
-          {pendingNew !== null && (
-            <TreeRow depth={pendingNew === '' ? 0 : pendingNew.split('/').length}>
-              <TreeIconSlot icon={FilePlusSolidIcon} iconSize={12} />
-              <InlineRenameInput
-                value={pendingNew === '' ? '' : `${pendingNew}/`}
-                placeholder="path/to/file.ts"
-                ariaLabel="New file path"
-                onCommit={submitNew}
-                onCancel={() => setPendingNew(null)}
-              />
-            </TreeRow>
-          )}
+          {renderEntries(tree, 0)}
+          {pendingNew === ROOT && renderPendingNew(ROOT, 0)}
         </TreeContainer>
       </div>
 
@@ -335,7 +408,7 @@ export function FileTreePane({
           {menu.entry.kind === 'folder' ? (
             <ContextMenuItem
               onClick={() => {
-                setPendingNew(menu.entry.path)
+                startNewFile(menu.entry.path)
                 setMenu(null)
               }}
             >
@@ -345,7 +418,15 @@ export function FileTreePane({
             <>
               <ContextMenuItem
                 onClick={() => {
-                  setRenamingFileId(menu.entry.fileId ?? null)
+                  startNewFile(parentFolderOf(menu.entry.path))
+                  setMenu(null)
+                }}
+              >
+                New file here…
+              </ContextMenuItem>
+              <ContextMenuItem
+                onClick={() => {
+                  setRenamingFileId(menu.entry.kind === 'file' ? menu.entry.fileId : null)
                   setMenu(null)
                 }}
               >
@@ -360,7 +441,7 @@ export function FileTreePane({
                     : undefined
                 }
                 onClick={() => {
-                  if (menu.entry.fileId) onDelete(menu.entry.fileId)
+                  if (menu.entry.kind === 'file') onDelete(menu.entry.fileId)
                   setMenu(null)
                 }}
               >
diff --git a/src/admin/pages/site/panels/DomPanel/TreeNode.module.css b/src/admin/pages/site/panels/DomPanel/TreeNode.module.css
index 2cfc30ca2..b74a3af7e 100644
--- a/src/admin/pages/site/panels/DomPanel/TreeNode.module.css
+++ b/src/admin/pages/site/panels/DomPanel/TreeNode.module.css
@@ -40,16 +40,6 @@
     background: var(--bg-surface-2);
 }
 
-/* ── Open container group highlight ─────────────────────────────────────── */
-.openContainerGroup {
-    border-radius: 8px;
-    background: var(--bg-surface);
-}
-
-.openContainerGroup > [role="treeitem"] {
-    border-radius: 8px;
-}
-
 /* ── Drag/drop state ─────────────────────────────────────────────────────── */
 .dragSource {
     opacity: 0.46;
diff --git a/src/admin/pages/site/panels/DomPanel/TreeNode.tsx b/src/admin/pages/site/panels/DomPanel/TreeNode.tsx
index becc15bd0..c1aa626ac 100644
--- a/src/admin/pages/site/panels/DomPanel/TreeNode.tsx
+++ b/src/admin/pages/site/panels/DomPanel/TreeNode.tsx
@@ -36,6 +36,7 @@ import { LayerNodeContextMenu } from './LayerNodeContextMenu'
 import { Input } from '@ui/components/Input'
 import { cn } from '@ui/cn'
 import {
+  TreeGroup,
   TreeRow,
   treeDropStyles,
 } from '@site/ui/Tree'
@@ -278,12 +279,11 @@ export const TreeNode = memo(function TreeNode({ nodeId, depth, editable = true
   return (
     // Wrapper preserves the recursive tree shape. DnD refs live on TreeRow so
     // hit-testing uses the actual visible row height.
-    <div
+    <TreeGroup
       data-node-id={nodeId}
-      data-open-container-group={isOpenContainerGroup ? 'true' : undefined}
+      open={isOpenContainerGroup}
       className={cn(
         node.moduleId === 'base.slot-instance' && styles.slotInstanceRow,
-        isOpenContainerGroup && styles.openContainerGroup,
         activeId === nodeId && styles.dragSource,
       )}
     >
@@ -449,7 +449,7 @@ export const TreeNode = memo(function TreeNode({ nodeId, depth, editable = true
         />,
         document.body,
       )}
-    </div>
+    </TreeGroup>
   )
 })
 
diff --git a/src/admin/pages/site/ui/Tree/TreeRow.module.css b/src/admin/pages/site/ui/Tree/TreeRow.module.css
index 629defe47..3920df77e 100644
--- a/src/admin/pages/site/ui/Tree/TreeRow.module.css
+++ b/src/admin/pages/site/ui/Tree/TreeRow.module.css
@@ -77,6 +77,17 @@
     opacity: 0.5;
 }
 
+/* A subtree — one row plus the group of its children. While the parent is
+   the selection and expanded, the block reads as one raised surface: the
+   parent row's paint sits on it and the children belong to it visibly. */
+.group {
+    border-radius: 8px;
+}
+
+.groupOpen {
+    background: var(--bg-surface);
+}
+
 .chevron {
     width: 14px;
     height: 14px;
diff --git a/src/admin/pages/site/ui/Tree/TreeRow.tsx b/src/admin/pages/site/ui/Tree/TreeRow.tsx
index 6c14698f5..47e9323d6 100644
--- a/src/admin/pages/site/ui/Tree/TreeRow.tsx
+++ b/src/admin/pages/site/ui/Tree/TreeRow.tsx
@@ -70,6 +70,24 @@ export function TreeRow({
   )
 }
 
+interface TreeGroupProps extends HTMLAttributes<HTMLDivElement> {
+  /** The parent row is selected and expanded: paint the subtree as one surface. */
+  open?: boolean
+  ref?: Ref<HTMLDivElement>
+}
+
+/** Wrapper for a row and its children — the unit that nests. */
+export function TreeGroup({ open = false, className, ref, ...props }: TreeGroupProps) {
+  return (
+    <div
+      ref={ref}
+      data-tree-group-open={open ? 'true' : undefined}
+      className={cn(styles.group, open && styles.groupOpen, className)}
+      {...props}
+    />
+  )
+}
+
 interface TreeChevronProps extends HTMLAttributes<HTMLSpanElement> {
   expanded?: boolean
   visible?: boolean
diff --git a/src/admin/pages/site/ui/Tree/index.ts b/src/admin/pages/site/ui/Tree/index.ts
index d2833db1a..1c68ca863 100644
--- a/src/admin/pages/site/ui/Tree/index.ts
+++ b/src/admin/pages/site/ui/Tree/index.ts
@@ -1,13 +1,13 @@
 /**
- * Tree — generic WAI-ARIA tree UI primitive (Task #455).
+ * Tree — generic WAI-ARIA tree UI primitive.
  *
- * Canonical export path: src/editor/ui/Tree
+ * Canonical export path: @site/ui/Tree
  *
- * Two exports:
- *   TreeContainer   — role="tree" wrapper only (DomPanel lightweight migration)
+ *   TreeContainer   — role="tree" wrapper
+ *   TreeGroup       — a row plus its children; `open` paints the subtree as one surface
  *   TreeRow         — shared visual row contract for all editor trees
  */
 
 export { TreeContainer } from './Tree'
-export { TreeRow, TreeChevron, TreeIconSlot, TreeLabelGroup, TreeLabel, TreeMeta } from './TreeRow'
+export { TreeRow, TreeGroup, TreeChevron, TreeIconSlot, TreeLabelGroup, TreeLabel, TreeMeta } from './TreeRow'
 export { default as treeDropStyles } from './TreeDrop.module.css'

From 34777abb43de98673a66290e9d1494eb6968dd3e Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Fri, 4 Sep 2026 16:24:30 +0200
Subject: [PATCH 32/36] fix(site-plugins): adapt the Plugin IDE to site
 branches after the rebase

The branch was based on a pre-branches, pre-language-service main. Landing it
on feat/site-branches needed:

- site-plugin handlers pass MAIN_SCOPE to the now branch-scoped site
  repositories; plugin sources live on main until branch instances land.
- the IDE binds MAIN_SITE_DOC_ID, the branch-aware name for the site doc.
- the MCP editor bridge gains the plugin scope, with its own precondition.
- the shared CodeMirror module carries main's TypeScript hover and lint
  theme rules and its jsx/javascript language cases, and the buffer's update
  listener keeps main's diagnostics alongside the IDE's optional onChange.
- the collab relay keeps main's write-capability gate, widened with
  plugins.edit; the superseded dev-socket helper and its define are gone.
- migration 022 becomes 028, after the branches migrations.
---
 bun.lock                                      | 850 ++++++++----------
 server/ai/mcp/server.ts                       |   1 +
 server/handlers/cms/sitePlugins/index.ts      |   9 +-
 server/handlers/cms/sitePlugins/service.ts    |   3 +-
 src/__tests__/collab/filesGranular.test.ts    |   4 +-
 src/admin/pages/plugins/ide/IdeActions.tsx    |   2 +-
 src/admin/pages/plugins/ide/ideCollab.ts      |   2 +-
 src/admin/pages/site/collab/collabProvider.ts |  11 -
 vite.config.ts                                |   6 -
 9 files changed, 407 insertions(+), 481 deletions(-)

diff --git a/bun.lock b/bun.lock
index 3547be558..5527ec9b5 100644
--- a/bun.lock
+++ b/bun.lock
@@ -107,83 +107,83 @@
 
     "@azu/style-format": ["@azu/style-format@1.0.1", "", { "dependencies": { "@azu/format-text": "^1.0.1" } }, "sha512-AHcTojlNBdD/3/KxIKlg8sxIWHfOtQszLvOpagLTO+bjC3u7SAszu1lf//u7JJC50aUSH+BVWDD/KvaA6Gfn5g=="],
 
-    "@babel/code-frame": ["@babel/code-frame@7.29.7", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.29.7", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw=="],
+    "@babel/code-frame": ["@babel/code-frame@7.29.0", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.28.5", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw=="],
 
-    "@babel/compat-data": ["@babel/compat-data@7.29.7", "", {}, "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg=="],
+    "@babel/compat-data": ["@babel/compat-data@7.29.3", "", {}, "sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg=="],
 
-    "@babel/core": ["@babel/core@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.7", "@babel/helper-compilation-targets": "^7.29.7", "@babel/helper-module-transforms": "^7.29.7", "@babel/helpers": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/template": "^7.29.7", "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA=="],
+    "@babel/core": ["@babel/core@7.29.0", "", { "dependencies": { "@babel/code-frame": "^7.29.0", "@babel/generator": "^7.29.0", "@babel/helper-compilation-targets": "^7.28.6", "@babel/helper-module-transforms": "^7.28.6", "@babel/helpers": "^7.28.6", "@babel/parser": "^7.29.0", "@babel/template": "^7.28.6", "@babel/traverse": "^7.29.0", "@babel/types": "^7.29.0", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA=="],
 
-    "@babel/generator": ["@babel/generator@7.29.8", "", { "dependencies": { "@babel/parser": "^7.29.8", "@babel/types": "^7.29.8", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg=="],
+    "@babel/generator": ["@babel/generator@7.29.1", "", { "dependencies": { "@babel/parser": "^7.29.0", "@babel/types": "^7.29.0", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw=="],
 
-    "@babel/helper-annotate-as-pure": ["@babel/helper-annotate-as-pure@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" } }, "sha512-OoK6239jHPuSQOoS0kfTVKn0b/rVTk0seKq4Gd2UMLtmOVLjDC0ki3e+c90Trqv2gMfvJFqkiljrr568+qddiw=="],
+    "@babel/helper-annotate-as-pure": ["@babel/helper-annotate-as-pure@7.27.3", "", { "dependencies": { "@babel/types": "^7.27.3" } }, "sha512-fXSwMQqitTGeHLBC08Eq5yXz2m37E4pJX1qAU1+2cNedz/ifv/bVXft90VeSav5nFO61EcNgwr0aJxbyPaWBPg=="],
 
-    "@babel/helper-compilation-targets": ["@babel/helper-compilation-targets@7.29.7", "", { "dependencies": { "@babel/compat-data": "^7.29.7", "@babel/helper-validator-option": "^7.29.7", "browserslist": "^4.24.0", "lru-cache": "^5.1.1", "semver": "^6.3.1" } }, "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g=="],
+    "@babel/helper-compilation-targets": ["@babel/helper-compilation-targets@7.28.6", "", { "dependencies": { "@babel/compat-data": "^7.28.6", "@babel/helper-validator-option": "^7.27.1", "browserslist": "^4.24.0", "lru-cache": "^5.1.1", "semver": "^6.3.1" } }, "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA=="],
 
-    "@babel/helper-create-class-features-plugin": ["@babel/helper-create-class-features-plugin@7.29.7", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.29.7", "@babel/helper-member-expression-to-functions": "^7.29.7", "@babel/helper-optimise-call-expression": "^7.29.7", "@babel/helper-replace-supers": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7", "@babel/traverse": "^7.29.7", "semver": "^6.3.1" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-IY3ZD9Tmooqr3TUhc3DUWxiuo8xx1DWLhd5M7hQ+ZWJamqM2BbalrBJb2MisSLoYorOj75U03qULCxQTY9r3hg=="],
+    "@babel/helper-create-class-features-plugin": ["@babel/helper-create-class-features-plugin@7.29.3", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.27.3", "@babel/helper-member-expression-to-functions": "^7.28.5", "@babel/helper-optimise-call-expression": "^7.27.1", "@babel/helper-replace-supers": "^7.28.6", "@babel/helper-skip-transparent-expression-wrappers": "^7.27.1", "@babel/traverse": "^7.29.0", "semver": "^6.3.1" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-RpLYy2sb51oNLjuu1iD3bwBqCBWUzjO0ocp+iaCP/lJtb2CPLcnC2Fftw+4sAzaMELGeWTgExSKADbdo0GFVzA=="],
 
-    "@babel/helper-globals": ["@babel/helper-globals@7.29.7", "", {}, "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA=="],
+    "@babel/helper-globals": ["@babel/helper-globals@7.28.0", "", {}, "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw=="],
 
-    "@babel/helper-member-expression-to-functions": ["@babel/helper-member-expression-to-functions@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-j+7JYmk1JYDtACIGj0QJqqWZjoUpMoEikQGADMaHgCMCSDqd2+P32rfcibUNrGOMWrlzK1WJBdxrB3JJQZwWtg=="],
+    "@babel/helper-member-expression-to-functions": ["@babel/helper-member-expression-to-functions@7.28.5", "", { "dependencies": { "@babel/traverse": "^7.28.5", "@babel/types": "^7.28.5" } }, "sha512-cwM7SBRZcPCLgl8a7cY0soT1SptSzAlMH39vwiRpOQkJlh53r5hdHwLSCZpQdVLT39sZt+CRpNwYG4Y2v77atg=="],
 
-    "@babel/helper-module-imports": ["@babel/helper-module-imports@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g=="],
+    "@babel/helper-module-imports": ["@babel/helper-module-imports@7.28.6", "", { "dependencies": { "@babel/traverse": "^7.28.6", "@babel/types": "^7.28.6" } }, "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw=="],
 
-    "@babel/helper-module-transforms": ["@babel/helper-module-transforms@7.29.7", "", { "dependencies": { "@babel/helper-module-imports": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg=="],
+    "@babel/helper-module-transforms": ["@babel/helper-module-transforms@7.28.6", "", { "dependencies": { "@babel/helper-module-imports": "^7.28.6", "@babel/helper-validator-identifier": "^7.28.5", "@babel/traverse": "^7.28.6" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA=="],
 
-    "@babel/helper-optimise-call-expression": ["@babel/helper-optimise-call-expression@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" } }, "sha512-+kmGVjcT9RGYzoDwdwEqEvGgKe3BYq+O1iGzjFubaNgZHwYHP6lsF2Yghf4kEuv9BV7tYDZ913aBW9am6YKong=="],
+    "@babel/helper-optimise-call-expression": ["@babel/helper-optimise-call-expression@7.27.1", "", { "dependencies": { "@babel/types": "^7.27.1" } }, "sha512-URMGH08NzYFhubNSGJrpUEphGKQwMQYBySzat5cAByY1/YgIRkULnIy3tAMeszlL/so2HbeilYloUmSpd7GdVw=="],
 
-    "@babel/helper-plugin-utils": ["@babel/helper-plugin-utils@7.29.7", "", {}, "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw=="],
+    "@babel/helper-plugin-utils": ["@babel/helper-plugin-utils@7.28.6", "", {}, "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug=="],
 
-    "@babel/helper-replace-supers": ["@babel/helper-replace-supers@7.29.7", "", { "dependencies": { "@babel/helper-member-expression-to-functions": "^7.29.7", "@babel/helper-optimise-call-expression": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-atfGXWSeCiF4DnKZIfmJfQRkSw9b9gNNXR1kqKjbhG4pGYCOnkp8OcTB8E3NXjBu8NpheSnOeNKz8KT7UNFTmQ=="],
+    "@babel/helper-replace-supers": ["@babel/helper-replace-supers@7.28.6", "", { "dependencies": { "@babel/helper-member-expression-to-functions": "^7.28.5", "@babel/helper-optimise-call-expression": "^7.27.1", "@babel/traverse": "^7.28.6" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-mq8e+laIk94/yFec3DxSjCRD2Z0TAjhVbEJY3UQrlwVo15Lmt7C2wAUbK4bjnTs4APkwsYLTahXRraQXhb1WCg=="],
 
-    "@babel/helper-skip-transparent-expression-wrappers": ["@babel/helper-skip-transparent-expression-wrappers@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-brcMGQaVzIeUb+6/bs1Av0f8YuNNjKY2JyvfRCsFuFsdKccEQ5Ges2y74D74NZ1Rz8lKJ9ksJkfqwQFJ/iNEyQ=="],
+    "@babel/helper-skip-transparent-expression-wrappers": ["@babel/helper-skip-transparent-expression-wrappers@7.27.1", "", { "dependencies": { "@babel/traverse": "^7.27.1", "@babel/types": "^7.27.1" } }, "sha512-Tub4ZKEXqbPjXgWLl2+3JpQAYBJ8+ikpQ2Ocj/q/r0LwE3UhENh7EUabyHjz2kCEsrRY83ew2DQdHluuiDQFzg=="],
 
-    "@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+    "@babel/helper-string-parser": ["@babel/helper-string-parser@7.27.1", "", {}, "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA=="],
 
-    "@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+    "@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.28.5", "", {}, "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q=="],
 
-    "@babel/helper-validator-option": ["@babel/helper-validator-option@7.29.7", "", {}, "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw=="],
+    "@babel/helper-validator-option": ["@babel/helper-validator-option@7.27.1", "", {}, "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg=="],
 
-    "@babel/helpers": ["@babel/helpers@7.29.7", "", { "dependencies": { "@babel/template": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg=="],
+    "@babel/helpers": ["@babel/helpers@7.29.2", "", { "dependencies": { "@babel/template": "^7.28.6", "@babel/types": "^7.29.0" } }, "sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw=="],
 
-    "@babel/parser": ["@babel/parser@7.29.8", "", { "dependencies": { "@babel/types": "^7.29.8" }, "bin": "./bin/babel-parser.js" }, "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA=="],
+    "@babel/parser": ["@babel/parser@7.29.3", "", { "dependencies": { "@babel/types": "^7.29.0" }, "bin": "./bin/babel-parser.js" }, "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA=="],
 
     "@babel/plugin-proposal-private-methods": ["@babel/plugin-proposal-private-methods@7.18.6", "", { "dependencies": { "@babel/helper-create-class-features-plugin": "^7.18.6", "@babel/helper-plugin-utils": "^7.18.6" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-nutsvktDItsNn4rpGItSNV2sz1XwS+nfU0Rg8aCx3W3NOKVzdMjJRu0O5OkgDp3ZGICSTbgRpxZoWsxoKRvbeA=="],
 
-    "@babel/runtime": ["@babel/runtime@7.29.7", "", {}, "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw=="],
+    "@babel/runtime": ["@babel/runtime@7.29.2", "", {}, "sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g=="],
 
-    "@babel/template": ["@babel/template@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg=="],
+    "@babel/template": ["@babel/template@7.28.6", "", { "dependencies": { "@babel/code-frame": "^7.28.6", "@babel/parser": "^7.28.6", "@babel/types": "^7.28.6" } }, "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ=="],
 
-    "@babel/traverse": ["@babel/traverse@7.29.8", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.8", "@babel/helper-globals": "^7.29.7", "@babel/parser": "^7.29.8", "@babel/template": "^7.29.7", "@babel/types": "^7.29.8", "debug": "^4.3.1" } }, "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg=="],
+    "@babel/traverse": ["@babel/traverse@7.29.0", "", { "dependencies": { "@babel/code-frame": "^7.29.0", "@babel/generator": "^7.29.0", "@babel/helper-globals": "^7.28.0", "@babel/parser": "^7.29.0", "@babel/template": "^7.28.6", "@babel/types": "^7.29.0", "debug": "^4.3.1" } }, "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA=="],
 
-    "@babel/types": ["@babel/types@7.29.8", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg=="],
+    "@babel/types": ["@babel/types@7.29.0", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.28.5" } }, "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A=="],
 
     "@bramus/specificity": ["@bramus/specificity@2.4.2", "", { "dependencies": { "css-tree": "^3.0.0" }, "bin": { "specificity": "bin/cli.js" } }, "sha512-ctxtJ/eA+t+6q2++vj5j7FYX3nRu311q1wfYH3xjlLOsczhlhxAg2FWNUXhpGvAw3BWo1xBcvOV6/YLc2r5FJw=="],
 
-    "@codemirror/autocomplete": ["@codemirror/autocomplete@6.20.3", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/common": "^1.0.0" } }, "sha512-tlosUqb+3BbxCxZdu4tKeRghPFC+QM7q4X5YhKV2eCmPG+1r2F3f4AaSz5sCrFqUtX4Jh20VFTKecl16MgiV9g=="],
+    "@codemirror/autocomplete": ["@codemirror/autocomplete@6.20.1", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/common": "^1.0.0" } }, "sha512-1cvg3Vz1dSSToCNlJfRA2WSI4ht3K+WplO0UMOgmUYPivCyy2oueZY6Lx7M9wThm7SDUBViRmuT+OG/i8+ON9A=="],
 
-    "@codemirror/commands": ["@codemirror/commands@6.11.0", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.7.0", "@codemirror/view": "^6.27.0", "@lezer/common": "^1.1.0" } }, "sha512-/K4Rl5BN0OtTiPWmJCdqODu38XnDMsDxKY5rgrPnCkutPTJf2wVbkoixLfealF5Kwse/s8P8M5jAiURiwSwnFA=="],
+    "@codemirror/commands": ["@codemirror/commands@6.10.3", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.6.0", "@codemirror/view": "^6.27.0", "@lezer/common": "^1.1.0" } }, "sha512-JFRiqhKu+bvSkDLI+rUhJwSxQxYb759W5GBezE8Uc8mHLqC9aV/9aTC7yJSqCtB3F00pylrLCwnyS91Ap5ej4Q=="],
 
     "@codemirror/lang-css": ["@codemirror/lang-css@6.3.1", "", { "dependencies": { "@codemirror/autocomplete": "^6.0.0", "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.0.0", "@lezer/common": "^1.0.2", "@lezer/css": "^1.1.7" } }, "sha512-kr5fwBGiGtmz6l0LSJIbno9QrifNMUusivHbnA1H6Dmqy4HZFte3UAICix1VuKo0lMPKQr2rqB+0BkKi/S3Ejg=="],
 
-    "@codemirror/lang-html": ["@codemirror/lang-html@6.4.12", "", { "dependencies": { "@codemirror/autocomplete": "^6.0.0", "@codemirror/lang-css": "^6.0.0", "@codemirror/lang-javascript": "^6.0.0", "@codemirror/language": "^6.4.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/common": "^1.0.0", "@lezer/css": "^1.1.0", "@lezer/html": "^1.3.12" } }, "sha512-pw2ReWKUqSkbvh76RAT4NYxiogRu+PWkR2ukAwO9uOgrm8uipkzjtKKtNpyeAQwHOqxEeSvAXZ6vr3AfyB9y/w=="],
+    "@codemirror/lang-html": ["@codemirror/lang-html@6.4.11", "", { "dependencies": { "@codemirror/autocomplete": "^6.0.0", "@codemirror/lang-css": "^6.0.0", "@codemirror/lang-javascript": "^6.0.0", "@codemirror/language": "^6.4.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/common": "^1.0.0", "@lezer/css": "^1.1.0", "@lezer/html": "^1.3.12" } }, "sha512-9NsXp7Nwp891pQchI7gPdTwBuSuT3K65NGTHWHNJ55HjYcHLllr0rbIZNdOzas9ztc1EUVBlHou85FFZS4BNnw=="],
 
     "@codemirror/lang-javascript": ["@codemirror/lang-javascript@6.2.5", "", { "dependencies": { "@codemirror/autocomplete": "^6.0.0", "@codemirror/language": "^6.6.0", "@codemirror/lint": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/common": "^1.0.0", "@lezer/javascript": "^1.0.0" } }, "sha512-zD4e5mS+50htS7F+TYjBPsiIFGanfVqg4HyUz6WNFikgOPf2BgKlx+TQedI1w6n/IqRBVBbBWmGFdLB/7uxO4A=="],
 
     "@codemirror/lang-json": ["@codemirror/lang-json@6.0.2", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@lezer/json": "^1.0.0" } }, "sha512-x2OtO+AvwEHrEwR0FyyPtfDUiloG3rnVTSZV1W8UteaLL8/MajQd8DpvUb2YVzC+/T18aSDv0H9mu+xw0EStoQ=="],
 
-    "@codemirror/lang-markdown": ["@codemirror/lang-markdown@6.5.2", "", { "dependencies": { "@codemirror/autocomplete": "^6.7.1", "@codemirror/lang-html": "^6.0.0", "@codemirror/language": "^6.3.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.0.0", "@lezer/common": "^1.2.1", "@lezer/markdown": "^1.0.0" } }, "sha512-AwBOdkWYuA//WcM0xO5PfHPUcmz/O2i5o0Nsg1U69SII/loCJlFI1Romd9xp2HYb1kYJRGZotyqRghuHH5n8Kw=="],
+    "@codemirror/lang-markdown": ["@codemirror/lang-markdown@6.5.0", "", { "dependencies": { "@codemirror/autocomplete": "^6.7.1", "@codemirror/lang-html": "^6.0.0", "@codemirror/language": "^6.3.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.0.0", "@lezer/common": "^1.2.1", "@lezer/markdown": "^1.0.0" } }, "sha512-0K40bZ35jpHya6FriukbgaleaqzBLZfOh7HuzqbMxBXkbYMJDxfF39c23xOgxFezR+3G+tR2/Mup+Xk865OMvw=="],
 
-    "@codemirror/language": ["@codemirror/language@6.12.4", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.23.0", "@lezer/common": "^1.5.0", "@lezer/highlight": "^1.0.0", "@lezer/lr": "^1.0.0", "style-mod": "^4.0.0" } }, "sha512-1q4PaT+o6PbgpkJt4Q8Fv5XJxTy4FUZ4MWETtyiDw3J0Pyr9E2vqcKL+k9wcvjNTIsauxvE7OfmWj3FRPHQ76A=="],
+    "@codemirror/language": ["@codemirror/language@6.12.3", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.23.0", "@lezer/common": "^1.5.0", "@lezer/highlight": "^1.0.0", "@lezer/lr": "^1.0.0", "style-mod": "^4.0.0" } }, "sha512-QwCZW6Tt1siP37Jet9Tb02Zs81TQt6qQrZR2H+eGMcFsL1zMrk2/b9CLC7/9ieP1fjIUMgviLWMmgiHoJrj+ZA=="],
 
-    "@codemirror/lint": ["@codemirror/lint@6.9.7", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.42.0", "crelt": "^1.0.5" } }, "sha512-28/+iWLYxKxsvGYhSYL7zaCZqLz5+FFFDq9tVsvGv9kv8RY4fFAchJ5WX9M3YrrRlTIsECjsXPqeNgnSmNP2dg=="],
+    "@codemirror/lint": ["@codemirror/lint@6.9.5", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.35.0", "crelt": "^1.0.5" } }, "sha512-GElsbU9G7QT9xXhpUg1zWGmftA/7jamh+7+ydKRuT0ORpWS3wOSP0yT1FOlIZa7mIJjpVPipErsyvVqB9cfTFA=="],
 
     "@codemirror/merge": ["@codemirror/merge@6.12.2", "", { "dependencies": { "@codemirror/language": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.17.0", "@lezer/highlight": "^1.0.0", "style-mod": "^4.1.0" } }, "sha512-V8JvyAPjHbPupqP7BeMcsdsYCbyPij74jxIbaIJDORI+VZzW44zFmon8bF+oxGWvOKhcRmkiUMXd8MxHr3YA2w=="],
 
-    "@codemirror/search": ["@codemirror/search@6.7.2", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.37.0", "crelt": "^1.0.5" } }, "sha512-gUYkYhT2+n/+VGZ+8EzE5WFkYZUZYm1VOKDudIsNqh42uRVQJ0a6Yss9sdKT3MeOYfuL1N6AZA57oza0Oyr0LA=="],
+    "@codemirror/search": ["@codemirror/search@6.7.0", "", { "dependencies": { "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.37.0", "crelt": "^1.0.5" } }, "sha512-ZvGm99wc/s2cITtMT15LFdn8aH/aS+V+DqyGq/N5ZlV5vWtH+nILvC2nw0zX7ByNoHHDZ2IxxdW38O0tc5nVHg=="],
 
-    "@codemirror/state": ["@codemirror/state@6.7.3", "", { "dependencies": { "@marijn/find-cluster-break": "^1.0.0" } }, "sha512-9aCZCzB5okKHVnUXivo+BXVzZz9b0SA4LAmGX60LuCXT7QjNCEHcD/kdmfYg7vAX3g1O+fy4Cpl6xFsWX2H/lQ=="],
+    "@codemirror/state": ["@codemirror/state@6.6.0", "", { "dependencies": { "@marijn/find-cluster-break": "^1.0.0" } }, "sha512-4nbvra5R5EtiCzr9BTHiTLc+MLXK2QGiAVYMyi8PkQd3SR+6ixar/Q/01Fa21TBIDOZXgeWV4WppsQolSreAPQ=="],
 
-    "@codemirror/view": ["@codemirror/view@6.43.11", "", { "dependencies": { "@codemirror/state": "^6.7.0", "crelt": "^1.0.6", "style-mod": "^4.1.0", "w3c-keyname": "^2.2.4" } }, "sha512-2+esucbQX6wB2JYi1eDvdCPFTA31BN8oSy6xCmk3G6CloV11yOvEjYk+gH7kLrP0MuHG94E8WDhjs5oMiu3+Wg=="],
+    "@codemirror/view": ["@codemirror/view@6.41.1", "", { "dependencies": { "@codemirror/state": "^6.6.0", "crelt": "^1.0.6", "style-mod": "^4.1.0", "w3c-keyname": "^2.2.4" } }, "sha512-ToDnWKbBnke+ZLrP6vgTTDScGi5H37YYuZGniQaBzxMVdtCxMrslsmtnOvbPZk4RX9bvkQqnWR/WS/35tJA0qg=="],
 
     "@colors/colors": ["@colors/colors@1.5.0", "", {}, "sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ=="],
 
@@ -195,14 +195,12 @@
 
     "@csstools/css-parser-algorithms": ["@csstools/css-parser-algorithms@4.0.0", "", { "peerDependencies": { "@csstools/css-tokenizer": "^4.0.0" } }, "sha512-+B87qS7fIG3L5h3qwJ/IFbjoVoOe/bpOdh9hAjXbvx0o8ImEmUsGXN0inFOnk2ChCFgqkkGFQ+TpM5rbhkKe4w=="],
 
-    "@csstools/css-syntax-patches-for-csstree": ["@csstools/css-syntax-patches-for-csstree@1.1.12", "", { "peerDependencies": { "css-tree": "^3.2.1" }, "optionalPeers": ["css-tree"] }, "sha512-3vLQK+dXxhBMR2Wx99PTCifE+vHtW2ndZWyla8yK813ev6oGhyn8Lja8jCyGAWTJ+LEYZK7EVtJxrDj8ztevJw=="],
+    "@csstools/css-syntax-patches-for-csstree": ["@csstools/css-syntax-patches-for-csstree@1.1.10", "", { "peerDependencies": { "css-tree": "^3.2.1" }, "optionalPeers": ["css-tree"] }, "sha512-xBja6gaAaH2R2c7eNyl0TY4dhnnZ2uhj+KXpLdEQ6M/wuk9bYFZM8wY0ykw3VO4TgEJ56KGlerXS/9KBKVR/Cg=="],
 
     "@csstools/css-tokenizer": ["@csstools/css-tokenizer@4.0.0", "", {}, "sha512-QxULHAm7cNu72w97JUNCBFODFaXpbDg+dP8b/oWFAZ2MTRppA3U00Y2L1HqaS4J6yBqxwa/Y3nMBaxVKbB/NsA=="],
 
     "@dependents/detective-less": ["@dependents/detective-less@5.0.3", "", { "dependencies": { "gonzales-pe": "^4.3.0", "node-source-walk": "^7.0.1" } }, "sha512-v6oD9Ukp+N7V4n6p5I/+mM5fIohSfkrDSGlFm5w/pYmchvbk+sMIHsLxrFJ5Lnujewj1BzWL0K84d88lwZAMQA=="],
 
-    "@discoveryjs/json-ext": ["@discoveryjs/json-ext@1.1.0", "", {}, "sha512-Xc3VhU02wqZ1HvHRJUwL09HkZSTvidqY5Ya0NXBSYOxAp+Ln9dcJr9fySI+CkONzP3PekQo9WdzCv0PGER/mOA=="],
-
     "@dnd-kit/accessibility": ["@dnd-kit/accessibility@3.1.1", "", { "dependencies": { "tslib": "^2.0.0" }, "peerDependencies": { "react": ">=16.8.0" } }, "sha512-2P+YgaXF+gRsIihwwY1gCsQSYnu9Zyj2py8kY5fFvUM1qm2WA2u639R6YNVfU4GWr+ZM5mqEsfHZZLoRONbemw=="],
 
     "@dnd-kit/core": ["@dnd-kit/core@6.3.1", "", { "dependencies": { "@dnd-kit/accessibility": "^3.1.1", "@dnd-kit/utilities": "^3.2.2", "tslib": "^2.0.0" }, "peerDependencies": { "react": ">=16.8.0", "react-dom": ">=16.8.0" } }, "sha512-xkGBRQQab4RLwgXxoqETICr6S5JlogafbhNsidmrkVv2YRs5MLwpjoF2qpiGjQt8S9AoxtIV603s0GIUpY5eYQ=="],
@@ -211,71 +209,71 @@
 
     "@effect/platform-node-shared": ["@effect/platform-node-shared@4.0.0-beta.70", "", { "dependencies": { "@types/ws": "^8.18.1", "ws": "^8.20.0" }, "peerDependencies": { "effect": "^4.0.0-beta.70" } }, "sha512-3VXuL63IDmq13We+ApRKn2JW3Rb9g5gj1YEmfb8u2b73norur1VsIJ/pRE4qjShevg19dQYi2JsLawSZ6gApug=="],
 
-    "@emnapi/core": ["@emnapi/core@1.11.2", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.2", "tslib": "^2.4.0" } }, "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA=="],
+    "@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
 
-    "@emnapi/runtime": ["@emnapi/runtime@1.11.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA=="],
+    "@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
 
-    "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA=="],
+    "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
 
-    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.2", "", { "os": "aix", "cpu": "ppc64" }, "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ=="],
+    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.0", "", { "os": "aix", "cpu": "ppc64" }, "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA=="],
 
-    "@esbuild/android-arm": ["@esbuild/android-arm@0.28.2", "", { "os": "android", "cpu": "arm" }, "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg=="],
+    "@esbuild/android-arm": ["@esbuild/android-arm@0.28.0", "", { "os": "android", "cpu": "arm" }, "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ=="],
 
-    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.2", "", { "os": "android", "cpu": "arm64" }, "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A=="],
+    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.0", "", { "os": "android", "cpu": "arm64" }, "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw=="],
 
-    "@esbuild/android-x64": ["@esbuild/android-x64@0.28.2", "", { "os": "android", "cpu": "x64" }, "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q=="],
+    "@esbuild/android-x64": ["@esbuild/android-x64@0.28.0", "", { "os": "android", "cpu": "x64" }, "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA=="],
 
-    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw=="],
+    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q=="],
 
-    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw=="],
+    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ=="],
 
-    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw=="],
+    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.0", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q=="],
 
-    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg=="],
+    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw=="],
 
-    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.2", "", { "os": "linux", "cpu": "arm" }, "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w=="],
+    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.0", "", { "os": "linux", "cpu": "arm" }, "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw=="],
 
-    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug=="],
+    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A=="],
 
-    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.2", "", { "os": "linux", "cpu": "ia32" }, "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ=="],
+    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.0", "", { "os": "linux", "cpu": "ia32" }, "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ=="],
 
-    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ=="],
+    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg=="],
 
-    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA=="],
+    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w=="],
 
-    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ=="],
+    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg=="],
 
-    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA=="],
+    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ=="],
 
-    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg=="],
+    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q=="],
 
-    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.2", "", { "os": "linux", "cpu": "x64" }, "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ=="],
+    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.0", "", { "os": "linux", "cpu": "x64" }, "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ=="],
 
-    "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw=="],
+    "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw=="],
 
-    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.2", "", { "os": "none", "cpu": "x64" }, "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw=="],
+    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.0", "", { "os": "none", "cpu": "x64" }, "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw=="],
 
-    "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.2", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ=="],
+    "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.0", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g=="],
 
-    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw=="],
+    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.0", "", { "os": "openbsd", "cpu": "x64" }, "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA=="],
 
-    "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q=="],
+    "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w=="],
 
-    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.2", "", { "os": "sunos", "cpu": "x64" }, "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g=="],
+    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.0", "", { "os": "sunos", "cpu": "x64" }, "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw=="],
 
-    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ=="],
+    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA=="],
 
-    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.2", "", { "os": "win32", "cpu": "ia32" }, "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA=="],
+    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA=="],
 
-    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.2", "", { "os": "win32", "cpu": "x64" }, "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g=="],
+    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.0", "", { "os": "win32", "cpu": "x64" }, "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw=="],
 
-    "@eslint-community/eslint-utils": ["@eslint-community/eslint-utils@4.10.1", "", { "dependencies": { "eslint-visitor-keys": "^3.4.3" }, "peerDependencies": { "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0" } }, "sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg=="],
+    "@eslint-community/eslint-utils": ["@eslint-community/eslint-utils@4.9.1", "", { "dependencies": { "eslint-visitor-keys": "^3.4.3" }, "peerDependencies": { "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0" } }, "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ=="],
 
     "@eslint-community/regexpp": ["@eslint-community/regexpp@4.12.2", "", {}, "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew=="],
 
     "@eslint/config-array": ["@eslint/config-array@0.23.5", "", { "dependencies": { "@eslint/object-schema": "^3.0.5", "debug": "^4.3.1", "minimatch": "^10.2.4" } }, "sha512-Y3kKLvC1dvTOT+oGlqNQ1XLqK6D1HU2YXPc52NmAlJZbMMWDzGYXMiPRJ8TYD39muD/OTjlZmNJ4ib7dvSrMBA=="],
 
-    "@eslint/config-helpers": ["@eslint/config-helpers@0.7.0", "", { "dependencies": { "@eslint/core": "^1.2.1" } }, "sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw=="],
+    "@eslint/config-helpers": ["@eslint/config-helpers@0.5.5", "", { "dependencies": { "@eslint/core": "^1.2.1" } }, "sha512-eIJYKTCECbP/nsKaaruF6LW967mtbQbsw4JTtSVkUQc9MneSkbrgPJAbKl9nWr0ZeowV8BfsarBmPpBzGelA2w=="],
 
     "@eslint/core": ["@eslint/core@1.2.1", "", { "dependencies": { "@types/json-schema": "^7.0.15" } }, "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ=="],
 
@@ -283,17 +281,17 @@
 
     "@eslint/object-schema": ["@eslint/object-schema@3.0.5", "", {}, "sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw=="],
 
-    "@eslint/plugin-kit": ["@eslint/plugin-kit@0.7.3", "", { "dependencies": { "@eslint/core": "^1.2.1", "levn": "^0.4.1" } }, "sha512-IkO+/KEUvwbVpiURZg+P7zF74z5Jxe0UgJxVni+RtoHQ6IZieXaO02kmadomap/q+l6bc/jdPGGqTjhuZnuz1Q=="],
+    "@eslint/plugin-kit": ["@eslint/plugin-kit@0.7.1", "", { "dependencies": { "@eslint/core": "^1.2.1", "levn": "^0.4.1" } }, "sha512-rZAP3aVgB9ds9KOeUSL+zZ21hPmo8dh6fnIFwRQj5EAZl9gzR7wxYbYXYysAM8CTqGmUGyp2S4kUdV17MnGuWQ=="],
 
     "@exodus/bytes": ["@exodus/bytes@1.15.1", "", { "peerDependencies": { "@noble/hashes": "^1.8.0 || ^2.0.0" }, "optionalPeers": ["@noble/hashes"] }, "sha512-S6mL0yNB/Abt9Ei4tq8gDhcczc4S3+vQ4ra7vxnAf+YHC02srtqxKKZghx2Dq6p0e66THKwR6r8N6P95wEty7Q=="],
 
-    "@floating-ui/core": ["@floating-ui/core@1.8.0", "", { "dependencies": { "@floating-ui/utils": "^0.2.12" } }, "sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ=="],
+    "@floating-ui/core": ["@floating-ui/core@1.7.5", "", { "dependencies": { "@floating-ui/utils": "^0.2.11" } }, "sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ=="],
 
-    "@floating-ui/dom": ["@floating-ui/dom@1.8.0", "", { "dependencies": { "@floating-ui/core": "^1.8.0", "@floating-ui/utils": "^0.2.12" } }, "sha512-yXSrzeHZBTZadLOlfyhCkJHNeLJnHRnRInwdZ40L7ZiaAtrBwoYlsDrX3v5zB1Utk7CLfzcOVnVVWoXEky7Ceg=="],
+    "@floating-ui/dom": ["@floating-ui/dom@1.7.6", "", { "dependencies": { "@floating-ui/core": "^1.7.5", "@floating-ui/utils": "^0.2.11" } }, "sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ=="],
 
-    "@floating-ui/utils": ["@floating-ui/utils@0.2.12", "", {}, "sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww=="],
+    "@floating-ui/utils": ["@floating-ui/utils@0.2.11", "", {}, "sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg=="],
 
-    "@fontsource-variable/inter": ["@fontsource-variable/inter@5.3.0", "", {}, "sha512-OupL48va4JNofb97w6NYeF9S7W/kHNKM0Er8Dem5nqi4jeOLrVJDoE8tZEpnMJmtkvNbB1EIPPwHcdkF6b1oUA=="],
+    "@fontsource-variable/inter": ["@fontsource-variable/inter@5.2.8", "", {}, "sha512-kOfP2D+ykbcX/P3IFnokOhVRNoTozo5/JxhAIVYLpea/UBmCQ/YWPBfWIDuBImXX/15KH+eKh4xpEUyS2sQQGQ=="],
 
     "@humanfs/core": ["@humanfs/core@0.19.2", "", { "dependencies": { "@humanfs/types": "^0.15.0" } }, "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA=="],
 
@@ -309,57 +307,57 @@
 
     "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="],
 
-    "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.3" }, "os": "darwin", "cpu": "arm64" }, "sha512-Uhfl4V4lhP2nbUVF9+hyH1+luj86f1gUFeo8ALYxFoULoU+G87D43BfeMP8XHsk9boxAnCY/bf2EHwhA7MuGsA=="],
+    "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.2" }, "os": "darwin", "cpu": "arm64" }, "sha512-RMnFX7YQsMoh7lWfcM4NEHHymBX/rLuKNPVM84XE9ONPcaSCDgE7CHIHpSgPcO2xcRthgBy1HfNO319mwhIAkg=="],
 
-    "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.3" }, "os": "darwin", "cpu": "x64" }, "sha512-hWniXY3bG5qKpkKrAwPe4y+VTPmf086YQAnkxWh7uA1YrlRouWGa0M0Mxj3ZjnXFkv7/TD1bTy9lGUK26vRvWw=="],
+    "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.2" }, "os": "darwin", "cpu": "x64" }, "sha512-Xo+5uFBtLN0BKqieTxiFzFPQAUlBbbH5iBKyRX/z1JrbnYsHTfKJnUfL8+p2TPXr1pXqao4eeL4Rl144uDpK9w=="],
 
-    "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.4", "", { "dependencies": { "@img/sharp-wasm32": "0.35.4" }, "os": "freebsd" }, "sha512-lIsKw/BU+kjB4eZjxrYrZmwOJYi3Ajrv66iAlBmUPyKc3HpnloevB1g3wxGD9P/5BbQ1brBGl65VRRrCvQDEqA=="],
+    "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.3", "", { "dependencies": { "@img/sharp-wasm32": "0.35.3" }, "os": "freebsd" }, "sha512-lUxcqWIj2wMQ9BrwNjngcr1gWUr5xgaGThBRqPPalIC2n67Cqj1uPh8NnA/ZhAg8hUbKl+kVHKwgUIwe6ZYPrg=="],
 
-    "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-suTBPTDGrI9WodccaDdwZItTSaBYASlBk1NSfElSHrUfzu3szG6lvIF58+WiFvnfzuK8ZBFS5zE00PxqxnRiPg=="],
+    "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-9J6ypZFpQBj4YnePGoq/S38w6nz+vqg5WZLrLGY4YuSemdMq47GMLBPO42MzwdGwpg/agZ7xzZcFHa48xlywfg=="],
 
-    "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-FVJZ5mITMobmXIz/hPDTw0EintTW5H3WfrxwLqEqjiIihlu+hVRyGrFQ60xl0Lxn7Bt3zdpevPaQi0HEzqz9fw=="],
+    "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-m2pW1n6cns9VaubNwsZ+c3CRYjxNQWgJ5gPlnL1nbBcpkBvFm6SCFN5o0psFHI8w9n11NKhFkeEDns98tiqbEw=="],
 
-    "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.3", "", { "os": "linux", "cpu": "arm" }, "sha512-3rbU4vqXXc3hY/OiXdl52xZvT0F1yEngWfvqudtPJg/KkyiaQw2DRsFrNzpmLvfavbwOq3qXn36GP8obHRULQA=="],
+    "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.2", "", { "os": "linux", "cpu": "arm" }, "sha512-1eMLzy92I4J6rmi4mAT8yC3HxOtniyGELlzGbNMLLeqe052ahFQ0h6LFq+lh5DsDIdYViIDst08abvSbcEdLXQ=="],
 
-    "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A=="],
+    "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-dqVSFynCox4C/J8kT16V7SIFAns0IjgLwkvYT7p8LQVmJ5OS5b6tI9IGflxTeuBS//zXeFIUbwt5dwxyZ17cnA=="],
 
-    "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.3", "", { "os": "linux", "cpu": "ppc64" }, "sha512-cdn1OvUBwsXhbC0zSzJnNzf5MZ/mTrobawDvNXBTxe8VtqKAm0sRuEY2Evzovb/w9JMk4TvRxqt1mekSuJz64w=="],
+    "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-3z0NHDxD6n5I9gc05U1eW1AyRm+Gznzq3naMrthPNqE6oYykcogW0l/jfpJdjYnuNl8R7yI9pNbE1XiUeyq0Aw=="],
 
-    "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.3", "", { "os": "linux", "cpu": "none" }, "sha512-HjPVx7yKz+0lqdhDlTw1tt90wamBoxhiXpvl1XZpJLiHH4RCJ5yDTqH+VlYPv2fwFs89JFw4c1IexYOcQUi4IQ=="],
+    "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.2", "", { "os": "linux", "cpu": "none" }, "sha512-bsb4rI+NldGOsXuej2r8OdSS8+zXDVaCWxyWrcv6kneTOlgAHtZABRzBBCwdsPiD90J4myNJuHpg6kA20ImW/w=="],
 
-    "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.3", "", { "os": "linux", "cpu": "s390x" }, "sha512-neWLh+3yCNThxnfy3c4BbVBeGgt9aftno+XbT56iK28RgeDs3UOFWviLWlUu0bArYVYJaFDK+RRohbicUNCm8Q=="],
+    "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-/ABshyj8gCpyIrNXnHn4LorDJ0HHm1VhXPBlxZ8zAtfVPAaSafXPGn+sUSIRiwaSBy0mmFjSjiXI5mkcwdChKQ=="],
 
-    "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA=="],
+    "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.2", "", { "os": "linux", "cpu": "x64" }, "sha512-ITPEtgffGJ0S6G9dRyw/366tJQqFRcHWPHhC+Stpg3Z8AEMrDrTr2lhdz4f/Y/HMbRh//7Z5mBzEpVdi62Oc3w=="],
 
-    "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-Y9kQaLMuNoB0bPYOOdcZMaseNrFpPodIWWMrx+CZyydf2xn68j9WYc6sWWRrDwNkzCQjKYfc68L7jKjGlHMibw=="],
+    "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-zE9EdiUzUmg5mDT5a1rk5fYJ6GWPloTwWBYDS14naqHsL+EaMpDj1AWnpLgh3u0YCORv2Tt50wrcrpYqkP97Kw=="],
 
-    "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-fj8Mv0HHfD1Rr+4I68+3agJynxDWtBFgicTbSOb9Bke6pIwzGcJ+RX/yHjmiEGFMCavY/dxvem7MyNaJF+wDiw=="],
+    "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.2", "", { "os": "linux", "cpu": "x64" }, "sha512-m0lrLiUt+lBYnCFr8qV/65yMR4E/c7/wf78I5eKTdkEakFAlZ9QlzEM3QIhhAwVeUhLAHLcCq7a7Vszq/oFNZQ=="],
 
-    "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.3" }, "os": "linux", "cpu": "arm" }, "sha512-7OAS8gI0EReKGVN2HssHlM6umJgxF5VI3xN0p9FA91p/YO+ou5hiNghLdZ5BEHztwaaK5+bLKRf8x/o2L2nk9A=="],
+    "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.2" }, "os": "linux", "cpu": "arm" }, "sha512-affVWCTLooy8TSxbDx2qkzuDeaWLNVBA+P//FNBirHsXpP2fuBhk5AuboYUnrDnzoXes8GFjpTx0SBFOCRg+FA=="],
 
-    "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.3" }, "os": "linux", "cpu": "arm64" }, "sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ=="],
+    "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.2" }, "os": "linux", "cpu": "arm64" }, "sha512-QgKDspHPnrU+GQ55XPhGwyhC8acLVOOSyAvo1oVfFmrIXLkDNmGWzAfDZ4xK8oSA1qBQrALcHX0G5UZni/SuFQ=="],
 
-    "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.3" }, "os": "linux", "cpu": "ppc64" }, "sha512-2oYZJeIl4kCcMGk4ouZVjnkCtFrpQFlNEtJ6GbxzhHQchwH0NH/qEb9ykmOl29dqwMq+JhFdZn+1ak2FKhI9fQ=="],
+    "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.2" }, "os": "linux", "cpu": "ppc64" }, "sha512-sMd8rDxmpLOwv/7N44klFjOD5DUO7FLdjiXDI0hoxYaf7Ar262dQIEkosE98bps+5HPLtp/EvNqeqQtOycP/IA=="],
 
-    "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.3" }, "os": "linux", "cpu": "none" }, "sha512-cPbNChoRURAWdebDIHSenxRpgEdy7JkPydSnUxRm9VvKD7m0/xVaR/8Fzlu81pk5nHEvHH87UZUA7cTtwnbJSA=="],
+    "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.2" }, "os": "linux", "cpu": "none" }, "sha512-0Eob78yjlYPfL5vMNWAW55l3R9Y6BQS/gOfe0ZcP9mEz9ohhKSt4im1hayiknXgf8AWrFqMvJcKIdmLmEe7yeQ=="],
 
-    "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.3" }, "os": "linux", "cpu": "s390x" }, "sha512-RY0JFY8Fd6RonCBtHz+DvadaPkXDSI1AUn6yWL9TipqkZ1vY8w8evqdgyDFnkm4/K1ve1TvZiaePP5oSd4+WVQ=="],
+    "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.2" }, "os": "linux", "cpu": "s390x" }, "sha512-KgAxQ0DxpNOq1rG2t5cgTgShJFGSuU7XO45cqC+1NVOuZnP6tlgZRuSYOfNupGkHID0o3cJOsw4DVeJpMovcGw=="],
 
-    "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.3" }, "os": "linux", "cpu": "x64" }, "sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA=="],
+    "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.2" }, "os": "linux", "cpu": "x64" }, "sha512-8pqvxubL2PGdhlPy6GLqzDYMUjyRmKAwKHYKixpdJYBUK7PJ0C029XdsnpFIdgRZG68fZiGdHVWcKPvtiPB4cA=="],
 
-    "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.3" }, "os": "linux", "cpu": "arm64" }, "sha512-KB5jxpfWQTr0nc3xdHtWChdbifHrBGsd2SM62Eyxrl8afikm+f5qGBU75SJIZBT/S1MC8XyacdlXBMSWq6OURA=="],
+    "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.2" }, "os": "linux", "cpu": "arm64" }, "sha512-Vz0iQjzzcSX3HCbfwFfCSG/9SCIqyO0mH2sXyiHaAYfBk0cRsCWXRyQYX0ovCK/PAQBbTzQ0dsPQHh5MAFL59w=="],
 
-    "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.3" }, "os": "linux", "cpu": "x64" }, "sha512-f+eZJZIQNEEd26RPSW+76chwOf1XtA2Y/O+5ocVyLliHkeih3e+jhLVBdNTd2rS3IbNXK8+ug93Vf5ZXtF5Lxg=="],
+    "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.2" }, "os": "linux", "cpu": "x64" }, "sha512-6O1NPKcDVj9QEdg7Hx549EX8U0rp6yXQERqru6yRN7fGBn32UvIRJUlWnk+8xDCiG76hXVBbX82NZ/ZKr0euIg=="],
 
-    "@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.4", "", { "dependencies": { "@emnapi/runtime": "^1.11.3" } }, "sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA=="],
+    "@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.3", "", { "dependencies": { "@emnapi/runtime": "^1.11.1" } }, "sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w=="],
 
-    "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.4", "", { "dependencies": { "@img/sharp-wasm32": "0.35.4" }, "cpu": "none" }, "sha512-ESfNkywmCfPNyaZjxooddJQiQ+l/nTpGEOGthxiLnIHXC/CmcBixnfwUleX9mCz9ovrUUvKMap/pm8RYbzfwaA=="],
+    "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.3", "", { "dependencies": { "@img/sharp-wasm32": "0.35.3" }, "cpu": "none" }, "sha512-2rnq7bX3NzeR2T4YWgz8qiG4h3TSdMe+vN1iQXpJleSJ3SM5zQ8Fy2SyyXAWlbxpEZ2Y+Z4u1BePgJEYbSy80Q=="],
 
-    "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.4", "", { "os": "win32", "cpu": "arm64" }, "sha512-iNdlBX9gLVvqe2I3uIJSIKTq6wckP/DYxZtcqxm09x5Gi24DnFBmPAWZmr60ZyYMG0xlzo6goG3670ar+RXvRw=="],
+    "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.3", "", { "os": "win32", "cpu": "arm64" }, "sha512-4bPwFdMbeC4JQ8L8LOyWp6nsHcboP5fxkp6iPOXz2Vg49R42TuMs2whkJ5OAP4/Ul035qOzy0AecOF9VOscn4w=="],
 
-    "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.4", "", { "os": "win32", "cpu": "ia32" }, "sha512-kqRsbaa5CS6KHlpxnN7WhE6vAAugXyZButpRdvDWetlv6Qv4N9WTcrWzF7tXfB9T7MsoadqdI8hmwLq6UlLvtw=="],
+    "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.3", "", { "os": "win32", "cpu": "ia32" }, "sha512-r53mXsBN6lFUDiST764SvgwUdHAqM4rPAiDzAmf4fLoB6X/rkfyTrLCg6+g17wJJiCmB3JYgHuUldCWUIRFSXw=="],
 
-    "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.4", "", { "os": "win32", "cpu": "x64" }, "sha512-XtmnYhBcrORsJ4XJngyzr/EWP0hRZLAZRFaApdKuviyqF78+ylxh2y06ZmtULAMOnObJ3ucpN0AcwSWnMowTRg=="],
+    "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.3", "", { "os": "win32", "cpu": "x64" }, "sha512-D4y1vNeZrIIJCN+uHaWVtH86B+aCrdMYYjicy9pXHvbGZeGYLLSd3wdVuC37FxVXlU1ARsk84eKWfWMXGYEqvA=="],
 
     "@jitl/quickjs-ffi-types": ["@jitl/quickjs-ffi-types@0.32.0", "", {}, "sha512-v9T+GQpmk43VDJ7d72sf0Nexhk+ArvtUihW27dy7lqAl0zBObFKtSBBIm5RBjwIhE8VwsPPm9PNuvPvNqLWUEg=="],
 
@@ -377,23 +375,23 @@
 
     "@jridgewell/resolve-uri": ["@jridgewell/resolve-uri@3.1.2", "", {}, "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw=="],
 
-    "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.6.0", "", {}, "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw=="],
+    "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.5", "", {}, "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og=="],
 
     "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
 
-    "@jscpd/badge-reporter": ["@jscpd/badge-reporter@4.2.5", "", { "dependencies": { "badgen": "^3.2.3", "colors": "^1.4.0", "fs-extra": "^11.2.0" } }, "sha512-ktXrjPeRaRyUDktxTroSA2/w5sshXpQplWkUuq/e6XqEpKBSbGEnwZLIaegSijOrMwIcCXPQ9k4feXIz5eVJNA=="],
+    "@jscpd/badge-reporter": ["@jscpd/badge-reporter@4.0.5", "", { "dependencies": { "badgen": "^3.2.3", "colors": "^1.4.0", "fs-extra": "^11.2.0" } }, "sha512-SLVhP00R9lkQ//Ivaanfm7k0L9sewpBven670kk1uGec2SWUOa7MVQcuad/TV59KEZ73UIC1lXvi6O9hAnbpUw=="],
 
-    "@jscpd/core": ["@jscpd/core@4.2.5", "", { "dependencies": { "eventemitter3": "^5.0.1" } }, "sha512-Esf2deHxaoNEjePwf2jqP6Urzj+BAOsJVPFLbnnSsV+q7rLNMcn0UEEoKBXIOOt4qMkrkhl9DfwpMyPPOr6GkQ=="],
+    "@jscpd/core": ["@jscpd/core@4.0.5", "", { "dependencies": { "eventemitter3": "^5.0.1" } }, "sha512-Udvym21nWzxjYRVXwwpYNBqZ6b50QV2zHN3fFNzOPPg4cfQVYOZerILB7xNDUsXHC1PCr/N52Tq3q7AElvjWWA=="],
 
-    "@jscpd/finder": ["@jscpd/finder@4.3.0", "", { "dependencies": { "@jscpd/core": "4.2.5", "@jscpd/tokenizer": "4.2.6", "blamer": "^1.0.6", "bytes": "^3.1.2", "cli-table3": "^0.6.5", "colors": "^1.4.0", "fast-glob": "^3.3.2", "fs-extra": "^11.3.6", "markdown-table": "^2.0.0", "pug": "^3.0.4" } }, "sha512-MnEUyier0D6P9zRIhAlBoyJUV8BYT6d5FDZuhR7X23FdZAgdMV8yaRRO1Q1EveK9/ReA6WVHT1HE8F15rij71A=="],
+    "@jscpd/finder": ["@jscpd/finder@4.0.5", "", { "dependencies": { "@jscpd/core": "4.0.5", "@jscpd/tokenizer": "4.0.5", "blamer": "^1.0.6", "bytes": "^3.1.2", "cli-table3": "^0.6.5", "colors": "^1.4.0", "fast-glob": "^3.3.2", "fs-extra": "^11.2.0", "markdown-table": "^2.0.0", "pug": "^3.0.3" } }, "sha512-/2VkRoVrrfya+51sitZo5I9MdwsRaPKB8X3L3khAYoHFXk4L/mUuG81RmGazDHjUIGg22ItlkQtwzorNZ2+aPw=="],
 
-    "@jscpd/html-reporter": ["@jscpd/html-reporter@4.2.5", "", { "dependencies": { "colors": "1.4.0", "fs-extra": "^11.2.0", "pug": "^3.0.4" } }, "sha512-zMMIKbvi43dMgeNeHXlHQy1ovf+KJrzNlUubaBvCAVatqP23ksW8d3fmsevIQG9mMMTH0D1xOz+SxUn1FREOPg=="],
+    "@jscpd/html-reporter": ["@jscpd/html-reporter@4.0.5", "", { "dependencies": { "colors": "1.4.0", "fs-extra": "^11.2.0", "pug": "^3.0.3" } }, "sha512-drK2J8KyPIW9wvaElSIobZFp4dBO9GA++JW4gx3oihvLdDSp8qSo/CNqH47Dw0XkjQTxND3j/+Wz5JWvYRBgFQ=="],
 
-    "@jscpd/tokenizer": ["@jscpd/tokenizer@4.2.6", "", { "dependencies": { "@jscpd/core": "4.2.5", "spark-md5": "^3.0.2" } }, "sha512-/eyFjINWLs2mrBTU4H681bs855r5oRyl1O3mZxcd7TpL1JIG85a7pps0RkRPAe9c/2KcjVCc82HbhOz86M0n5g=="],
+    "@jscpd/tokenizer": ["@jscpd/tokenizer@4.0.5", "", { "dependencies": { "@jscpd/core": "4.0.5", "reprism": "^0.0.11", "spark-md5": "^3.0.2" } }, "sha512-WzRujQtN5WedxZVDKuoanxmKAFrxcLrHpcA6kaM4z8AhGtWXZ325yseqgL5TZ8OK7Auwu7kQLlqhfk05fGYG7A=="],
 
     "@lezer/common": ["@lezer/common@1.5.2", "", {}, "sha512-sxQE460fPZyU3sdc8lafxiPwJHBzZRy/udNFynGQky1SePYBdhkBl1kOagA9uT3pxR8K09bOrmTUqA9wb/PjSQ=="],
 
-    "@lezer/css": ["@lezer/css@1.3.6", "", { "dependencies": { "@lezer/common": "^1.2.0", "@lezer/highlight": "^1.0.0", "@lezer/lr": "^1.3.0" } }, "sha512-YJE78Wcg+zX8f10hiHWQ4Az48Qr/c13eId0VtRQYLBpxHDmDeSrXIlkbl+fJGW42rWC/uoUco9mhBZeVWP/A1g=="],
+    "@lezer/css": ["@lezer/css@1.3.3", "", { "dependencies": { "@lezer/common": "^1.2.0", "@lezer/highlight": "^1.0.0", "@lezer/lr": "^1.3.0" } }, "sha512-RzBo8r+/6QJeow7aPHIpGVIH59xTcJXp399820gZoMo9noQDRVpJLheIBUicYwKcsbOYoBRoLZlf2720dG/4Tg=="],
 
     "@lezer/highlight": ["@lezer/highlight@1.2.3", "", { "dependencies": { "@lezer/common": "^1.3.0" } }, "sha512-qXdH7UqTvGfdVBINrgKhDsVTJTxactNNxLk7+UMwZhU13lMHaOBlJe9Vqp907ya56Y3+ed2tlqzys7jDkTmW0g=="],
 
@@ -405,9 +403,9 @@
 
     "@lezer/lr": ["@lezer/lr@1.4.10", "", { "dependencies": { "@lezer/common": "^1.0.0" } }, "sha512-rnCpTIBafOx4mRp43xOxDJbFipJm/c0cia/V5TiGlhmMa+wsSdoGmUN3w5Bqrks/09Q/D4tNAmWaT8p6NRi77A=="],
 
-    "@lezer/markdown": ["@lezer/markdown@1.7.2", "", { "dependencies": { "@lezer/common": "^1.5.0", "@lezer/highlight": "^1.0.0" } }, "sha512-iTkYvoVcKt3WkeL7qUDyXHONZEwLio4wj8KTNi2dnjQEXBZKMV63BpQrPqfsM+OkvuRbiSTAcycYAsQzLhRNoQ=="],
+    "@lezer/markdown": ["@lezer/markdown@1.6.3", "", { "dependencies": { "@lezer/common": "^1.5.0", "@lezer/highlight": "^1.0.0" } }, "sha512-jpGm5Ps+XErS+xA4urw7ogEGkeZOahVQF21Z6oECF0sj+2liwZopd2+I8uH5I/vZsRuuze3OxBREIANLf6KKUw=="],
 
-    "@marijn/find-cluster-break": ["@marijn/find-cluster-break@1.0.4", "", {}, "sha512-Wy0V7+SGUjnF9/TkiM1hKVDPj7jKXduPNboMVtHTA8dySMURWqfg/JZ9E2Sq8JgSJmkl7k7Qe9FLeMSrSraWmQ=="],
+    "@marijn/find-cluster-break": ["@marijn/find-cluster-break@1.0.2", "", {}, "sha512-l0h88YhZFyKdXIFNfSWpyjStDjGHwZ/U7iobcK1cQQD8sejsONdQtTVU+1wVN1PBw40PiiHB1vA5S7VTfQiP9g=="],
 
     "@modelcontextprotocol/client": ["@modelcontextprotocol/client@2.0.0", "", { "dependencies": { "@modelcontextprotocol/core": "2.0.0", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "jose": "^6.1.3", "pkce-challenge": "^5.0.0", "zod": "^4.2.0" } }, "sha512-8f1OghQ2rjzIOfqgUCP+8GiUWqRs89njoWLNqAe8kWmDePv3s1fZXseej+QXemssEuuOvLLmLO/kqM3IQHtISw=="],
 
@@ -427,7 +425,7 @@
 
     "@msgpackr-extract/msgpackr-extract-win32-x64": ["@msgpackr-extract/msgpackr-extract-win32-x64@3.0.4", "", { "os": "win32", "cpu": "x64" }, "sha512-CmCXPQrkbwExx3j946/PtHWHbYJiCRBRDl4BlkRQcJB/YOwQxJRTpoo7aTsortjgoJ1x7opzTSxn7C+ASSLVjQ=="],
 
-    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.2.3", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.4", "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.4" } }, "sha512-UMduMbqO5s5zF2NkNacMT/yK5Y5QiKvWr2+50bzIIxFDwVJ2h49b+oyjaCGPhJxd2/gC2x39EHv/gHVuu36x2Q=="],
+    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.4", "", { "dependencies": { "@tybys/wasm-util": "^0.10.1" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow=="],
 
     "@nodelib/fs.scandir": ["@nodelib/fs.scandir@2.1.5", "", { "dependencies": { "@nodelib/fs.stat": "2.0.5", "run-parallel": "^1.1.9" } }, "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g=="],
 
@@ -435,175 +433,161 @@
 
     "@nodelib/fs.walk": ["@nodelib/fs.walk@1.2.8", "", { "dependencies": { "@nodelib/fs.scandir": "2.1.5", "fastq": "^1.6.0" } }, "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg=="],
 
-    "@opentelemetry/api": ["@opentelemetry/api@1.9.1", "", {}, "sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q=="],
-
-    "@opentelemetry/api-logs": ["@opentelemetry/api-logs@0.220.0", "", { "dependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-CmVa4ImJ+ynfrPMNaAXHET6Bhb44SwzmfyVJFq9ni2jgXJR/l7C6gfVFddNmHP+ZOkP9cf4f9DBe68qVLTHc9w=="],
-
-    "@opentelemetry/core": ["@opentelemetry/core@2.11.0", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.0.0 <1.10.0" } }, "sha512-7YP44XH0tV6+Mb54x2YGf84i7yi+31MBZlE8JwvozkxyTvXbSp10X7cI7YE49ChJ3shMJoBmCJF3+1QFBJctGA=="],
-
-    "@opentelemetry/instrumentation": ["@opentelemetry/instrumentation@0.220.0", "", { "dependencies": { "@opentelemetry/api-logs": "0.220.0", "import-in-the-middle": "^3.0.0", "require-in-the-middle": "^8.0.0" }, "peerDependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-xQx3E2WxP1mDvKzxLxX+CTCtNLa560YJZ3087qYHerl2YmiKpv7AH+dAy7vmx+eVrZ5BwhfWUAVoKOoxCNHcpw=="],
-
-    "@opentelemetry/resources": ["@opentelemetry/resources@2.11.0", "", { "dependencies": { "@opentelemetry/core": "2.11.0", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-Ie7+8q8MDF4FAEQCKVMTx3ReUvxiIAgIiiW3c9JdmP8+HMcDy20puT+AHjexnExgnbvBxjQ9fjkFDWrikJ2jQA=="],
+    "@oxc-parser/binding-android-arm-eabi": ["@oxc-parser/binding-android-arm-eabi@0.128.0", "", { "os": "android", "cpu": "arm" }, "sha512-aca6ZvzmCBUGOANQRiRQRZuRKYI3ENhcit6GisnknOOmcezfQc7xJ4dxlPU7MV7mOvrC7RNR1u3LAD7xyaiCxA=="],
 
-    "@opentelemetry/sdk-trace": ["@opentelemetry/sdk-trace@2.11.0", "", { "dependencies": { "@opentelemetry/core": "2.11.0", "@opentelemetry/resources": "2.11.0", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-fFnTqGm8/G73GQVnxYi7LXa1ZVYEUvgL6XI1LpvV0bPC7WQ/ZGgKxCSl8FnlZBKto9JHHEFTO6s6CUpvvtwFrA=="],
+    "@oxc-parser/binding-android-arm64": ["@oxc-parser/binding-android-arm64@0.128.0", "", { "os": "android", "cpu": "arm64" }, "sha512-BbeDmuohoJ7Rz/it5wnkj69i/OsCPS3Z51nLEzwO/Y6YshtC4JU+15oNwhY8v4LRKRYclRc7ggOikwrsJ/eOEQ=="],
 
-    "@opentelemetry/sdk-trace-base": ["@opentelemetry/sdk-trace-base@2.11.0", "", { "dependencies": { "@opentelemetry/core": "2.11.0", "@opentelemetry/resources": "2.11.0", "@opentelemetry/sdk-trace": "2.11.0", "@opentelemetry/semantic-conventions": "^1.29.0" }, "peerDependencies": { "@opentelemetry/api": ">=1.3.0 <1.10.0" } }, "sha512-H19x/TX/LZdqiYOjM7fqtSxwlplC5pgelavqbQdHbhdq0q/AI/TGkM2dfGuuynTXmJPeF2HoZVoPDu+TGoW78A=="],
+    "@oxc-parser/binding-darwin-arm64": ["@oxc-parser/binding-darwin-arm64@0.128.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-tRUHPt80417QmvNpoSslJT1VY8NUbWdrWR+L14Zn+RbOTcaqB8E6PYE/ZGN8jjWBzqporiA/H4MfO50ew/NCNA=="],
 
-    "@opentelemetry/semantic-conventions": ["@opentelemetry/semantic-conventions@1.43.0", "", {}, "sha512-eSYWTm620tTk45EKSedaUL8MFYI8hW164hIXsgIHyxu3VobUB3fFCu5t0hQby6OoWRPsG1KkKUG2M5UadiLiVg=="],
+    "@oxc-parser/binding-darwin-x64": ["@oxc-parser/binding-darwin-x64@0.128.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-rWI2Hb1Nt3U/vKsjyNvZzDC8i/l144U20DKjhzaTmwIhIiSRGeroPWWiImwypmKLqrw8GuIixbWJkpGWLbkzrQ=="],
 
-    "@oxc-parser/binding-android-arm-eabi": ["@oxc-parser/binding-android-arm-eabi@0.147.0", "", { "os": "android", "cpu": "arm" }, "sha512-fOtoGvIoirkvxQVw9J1WJPxz571XPgLsPf9uhRD+PJteUnvrJHMDmK9pw2yZEGGyismtRoEsp+JcXUdF/JDMDw=="],
+    "@oxc-parser/binding-freebsd-x64": ["@oxc-parser/binding-freebsd-x64@0.128.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-hhpdVMaNCLgQxjgNPeeFzSeJMmZPc5lKfv0NGSI3egZq9EdnEGqeC8JsYsQjK7PoQgbvZ17xlj0SO5ziH5Obkg=="],
 
-    "@oxc-parser/binding-android-arm64": ["@oxc-parser/binding-android-arm64@0.147.0", "", { "os": "android", "cpu": "arm64" }, "sha512-emjQHOYJaomo4ykaXQ1EItunr/I94Nk01oqBmU4dSkKSTupIDx6OysVDf2e8Eytm77rb+4ZxzgElyWP7rcEX7A=="],
+    "@oxc-parser/binding-linux-arm-gnueabihf": ["@oxc-parser/binding-linux-arm-gnueabihf@0.128.0", "", { "os": "linux", "cpu": "arm" }, "sha512-093zNw0zZ/e/obML+rhlSdmnzR0mVZluPcAkxunEc5E3F0yBVsFn24Y1ILfsEte11Ud041qn/gp2OJ1jxNqUng=="],
 
-    "@oxc-parser/binding-darwin-arm64": ["@oxc-parser/binding-darwin-arm64@0.147.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-kXvBPJL7RmDPJ2mze/vXPPVQimCDtFr9OFLjf7dyhV5Dx64cgcXh9KKrA1sMWvCObvJll9CZZUO0FBlFwD0l6A=="],
+    "@oxc-parser/binding-linux-arm-musleabihf": ["@oxc-parser/binding-linux-arm-musleabihf@0.128.0", "", { "os": "linux", "cpu": "arm" }, "sha512-fq7DmKmfC+dvD97IXrgbph6Jzwe0EDu+PYMofmzZ6fv5X1k9vtaqLpDGMuICO9MmUnyKAQmVl+wIv2RNy4Dz8g=="],
 
-    "@oxc-parser/binding-darwin-x64": ["@oxc-parser/binding-darwin-x64@0.147.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-mgFF8pLU6R64LbT27lSrtVRspVC/3IcZ0qyIikzmi78Y3Ik2OPnlAHHI0UEBRcC3qmNgtjaef7zkFt7/uPxIcw=="],
+    "@oxc-parser/binding-linux-arm64-gnu": ["@oxc-parser/binding-linux-arm64-gnu@0.128.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-Xvm48jJah8TlIrURIjNOP/gNiGe6aKvCB+r06VliflFo8Kq7VOLE8PxtgShJzZIqubrgdMdYfvuPPozn7F6MbQ=="],
 
-    "@oxc-parser/binding-freebsd-x64": ["@oxc-parser/binding-freebsd-x64@0.147.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-v38aiF11qufOTBcCAKL4skgQf0zJ4NEvRlivq7B5kHrlyvjCLjvNrMtNWDTz1SDUL6/xVsJRmLDxv2e+Cp4oWw=="],
+    "@oxc-parser/binding-linux-arm64-musl": ["@oxc-parser/binding-linux-arm64-musl@0.128.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-M7iwBGmYJTx+pKOYFjI0buop4gJvlmcVzFGaXPt21DKpQkbQZG1f63Yg7LloIYT/t9yLxCw0Lhfx/RFlAlMSjA=="],
 
-    "@oxc-parser/binding-linux-arm-gnueabihf": ["@oxc-parser/binding-linux-arm-gnueabihf@0.147.0", "", { "os": "linux", "cpu": "arm" }, "sha512-AeIiBbwUaP0H1+4/qGW9l5qHecS/+XA5iMuieVcGb1T+tyc2dVGspFW13BWk/XrLsiGP/CiDJTJqAPLLCzZHkw=="],
+    "@oxc-parser/binding-linux-ppc64-gnu": ["@oxc-parser/binding-linux-ppc64-gnu@0.128.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-21LGNIZb1Pcfk5/EGsqabrxv4yqQOWis1407JJrClS7XpFCrbvr74YAB1V+m54cYbwvO6UWwQqS4WecxiyfCRg=="],
 
-    "@oxc-parser/binding-linux-arm-musleabihf": ["@oxc-parser/binding-linux-arm-musleabihf@0.147.0", "", { "os": "linux", "cpu": "arm" }, "sha512-/41MKPW4RgPY4DJco0NCF0RYX3IMZaVlRNMNzvhaxRavc7tN3Txm+qllZbh0aMRs0VHdgUlbI8TcAOiTai4TKg=="],
+    "@oxc-parser/binding-linux-riscv64-gnu": ["@oxc-parser/binding-linux-riscv64-gnu@0.128.0", "", { "os": "linux", "cpu": "none" }, "sha512-gyHjOTFpg9bTTYjxPmQirvufb89+VdZwVfcMtAUyPr6F5H8ZswvCQshK4qOW+Q+2Xyb33hduRgY/eFHJQjU/vQ=="],
 
-    "@oxc-parser/binding-linux-arm64-gnu": ["@oxc-parser/binding-linux-arm64-gnu@0.147.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-bmpw/RPhVXgZbtb3xBDuwW5s8+LvZYdqcDSX/sP2ltL77aTio3DP/B5ZTwwgoJ6Mr9vJs4RrmgEKW9XkLNUU1g=="],
+    "@oxc-parser/binding-linux-riscv64-musl": ["@oxc-parser/binding-linux-riscv64-musl@0.128.0", "", { "os": "linux", "cpu": "none" }, "sha512-X6Q2oKUrP5GyDd2xniuEBLk6aFQCZ97W2+aVXGgJXdjx5t4/oFuA9ri0wLOUrBIX+qdSuK581snMBio4z910eA=="],
 
-    "@oxc-parser/binding-linux-arm64-musl": ["@oxc-parser/binding-linux-arm64-musl@0.147.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-gd7VX/FDVOw6mjQcu45iIcp4QkgybgJwh3a0OFG2NxmPCj628mQWD96QGu1kK8+mZF9qK4b/gIEyC63vQoB7+Q=="],
+    "@oxc-parser/binding-linux-s390x-gnu": ["@oxc-parser/binding-linux-s390x-gnu@0.128.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-BdzTmqxfxoYkpgokoLaSnOX6T+R3/goL42klre2tnG+kHbG2TXS0VN+P5BPofH1axdKOHy5ei4ENZrjmCOt2lA=="],
 
-    "@oxc-parser/binding-linux-ppc64-gnu": ["@oxc-parser/binding-linux-ppc64-gnu@0.147.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-HnAzcfki7dSUNHf510Q2NmbJlz8Ys7rn8l9l588Pkx0tYe1BHLZnmELIgqizJ4WPhHGSwN8Ce+B/menVxS3odA=="],
+    "@oxc-parser/binding-linux-x64-gnu": ["@oxc-parser/binding-linux-x64-gnu@0.128.0", "", { "os": "linux", "cpu": "x64" }, "sha512-OO1nW2Q7sSYYvJZpDHdvyFSdRaVcQqRijZSSmWVMqFxPYy8cEF45zJ9fcdIYuzIT3jYq6YRhEFm/VMWNWhE22Q=="],
 
-    "@oxc-parser/binding-linux-riscv64-gnu": ["@oxc-parser/binding-linux-riscv64-gnu@0.147.0", "", { "os": "linux", "cpu": "none" }, "sha512-qlkOL6wT44U+fT5s/+sR6Shx0OdwvQF83JyIPZUxG/ovqZF5/7atOtjH+JPZ5/7ATQLbFBBSmghcy/+2NVB/ew=="],
+    "@oxc-parser/binding-linux-x64-musl": ["@oxc-parser/binding-linux-x64-musl@0.128.0", "", { "os": "linux", "cpu": "x64" }, "sha512-4NehAe404MRdoZVS9DW8C5XbJwbXIc/KfVlYdpi5vE4081zc9Y0YzKVqyOYj/Puye7/Do+ohaONBFWlEHYl9hw=="],
 
-    "@oxc-parser/binding-linux-riscv64-musl": ["@oxc-parser/binding-linux-riscv64-musl@0.147.0", "", { "os": "linux", "cpu": "none" }, "sha512-DlefD7L7sMXs/3hIBH23Egk0phj8kG0SA81dVGOQ3S1ekjOlmTLH2E+F2Thwfh1slKx6aH+lNc5fQYAw0GU7/g=="],
+    "@oxc-parser/binding-openharmony-arm64": ["@oxc-parser/binding-openharmony-arm64@0.128.0", "", { "os": "none", "cpu": "arm64" }, "sha512-kVbqgW9xLL8bh8oc7aYOJilRKXE5G33+tE0jan+duo/9OriaFRpijcCwT2waWs2oqYROYq0GlE7/p3ywoshVeg=="],
 
-    "@oxc-parser/binding-linux-s390x-gnu": ["@oxc-parser/binding-linux-s390x-gnu@0.147.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-Xqpagk/031IvZ4svrk2FF01YEqM/iN3MJV3SVZadKg/CsGlDCGoREqKHXYnoV5+8SfGe/m6RM1szXFLusTu/Uw=="],
+    "@oxc-parser/binding-wasm32-wasi": ["@oxc-parser/binding-wasm32-wasi@0.128.0", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-L38ojghJYHmgiz6fJd7jwLB/ESDBpB02NdFxh+smqVM6P2anCEvHn0jhaSrt5eVNR1Ak8+moOeftUlofeyvniA=="],
 
-    "@oxc-parser/binding-linux-x64-gnu": ["@oxc-parser/binding-linux-x64-gnu@0.147.0", "", { "os": "linux", "cpu": "x64" }, "sha512-QioQOeUbI4ATUr0S2z88uA3Cds2R3Mm5Ge7U8XNYtlTb2GJF3rWlcj70z0AJhhOlbdm0YgVjqPBldUNbFylDIg=="],
+    "@oxc-parser/binding-win32-arm64-msvc": ["@oxc-parser/binding-win32-arm64-msvc@0.128.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-xgvO35GyHBtjlQ5AEpaYr7Rll1rvY7zqIhT6ty8E3ezBW2J1SFLjIDEvI/tcgDg6oaseDAqVcM+jU1HuCekgZw=="],
 
-    "@oxc-parser/binding-linux-x64-musl": ["@oxc-parser/binding-linux-x64-musl@0.147.0", "", { "os": "linux", "cpu": "x64" }, "sha512-NXy1tv/OdC+pPTwf9RiCZWPK53V/Xq/2cjSnjOSyKopajdaDqMIkgtDY+jXZemp2e8px5FeWfY2L2LwhKZQovg=="],
+    "@oxc-parser/binding-win32-ia32-msvc": ["@oxc-parser/binding-win32-ia32-msvc@0.128.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-OY+3eM2SN72prHKRB22mPz8o5A/7dJ+f5DFLBVvggyZhEaNDAH9IB+ElMjmOkOIwf5MDCUAowCK7pAncNxzpBA=="],
 
-    "@oxc-parser/binding-openharmony-arm64": ["@oxc-parser/binding-openharmony-arm64@0.147.0", "", { "os": "none", "cpu": "arm64" }, "sha512-GpGWZ6oKz4bjCWW9Mz5pCaGPyk2Aaze6zEoaslIQqpSLtpx5pXj/ap5gUNb5Jn2LIbqWyjkGLX9yv3NMuNcBVQ=="],
+    "@oxc-parser/binding-win32-x64-msvc": ["@oxc-parser/binding-win32-x64-msvc@0.128.0", "", { "os": "win32", "cpu": "x64" }, "sha512-NE9ny+cPUCCObXa0IKLfj0tCdPd7pe/dz9ZpkxpUOymB3miNeMPybdlYYTBSGJUalMWeBM85/4JcCErCNTqOXw=="],
 
-    "@oxc-parser/binding-wasm32-wasi": ["@oxc-parser/binding-wasm32-wasi@0.132.0", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-TlbMppxJI5CjWDes0QaP6G3aneVg1yikBu5QYI+DUShF9WDL66ccgKFNNGmi/Wybtszw6hxwAvv76T4DaPKnHw=="],
+    "@oxc-project/types": ["@oxc-project/types@0.127.0", "", {}, "sha512-aIYXQBo4lCbO4z0R3FHeucQHpF46l2LbMdxRvqvuRuW2OxdnSkcng5B8+K12spgLDj93rtN3+J2Vac/TIO+ciQ=="],
 
-    "@oxc-parser/binding-win32-arm64-msvc": ["@oxc-parser/binding-win32-arm64-msvc@0.147.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-a8mlt7CC8z7LUdCfaxhff4kCd+vSjE+NEFL0cxA8ukfuSnvAto/pWTjytW4BuVLnQGcCVdHJwcRKOfs++H+tjw=="],
+    "@oxc-resolver/binding-android-arm-eabi": ["@oxc-resolver/binding-android-arm-eabi@11.19.1", "", { "os": "android", "cpu": "arm" }, "sha512-aUs47y+xyXHUKlbhqHUjBABjvycq6YSD7bpxSW7vplUmdzAlJ93yXY6ZR0c1o1x5A/QKbENCvs3+NlY8IpIVzg=="],
 
-    "@oxc-parser/binding-win32-ia32-msvc": ["@oxc-parser/binding-win32-ia32-msvc@0.147.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-M5ViVDBcFLnl2632AuuWuP35zEL5oikK1jTx8r3+902VEDeSNHxFZAB6RZyfZ7MU6Oi5QTOG8MmMkIeHsudSaw=="],
+    "@oxc-resolver/binding-android-arm64": ["@oxc-resolver/binding-android-arm64@11.19.1", "", { "os": "android", "cpu": "arm64" }, "sha512-oolbkRX+m7Pq2LNjr/kKgYeC7bRDMVTWPgxBGMjSpZi/+UskVo4jsMU3MLheZV55jL6c3rNelPl4oD60ggYmqA=="],
 
-    "@oxc-parser/binding-win32-x64-msvc": ["@oxc-parser/binding-win32-x64-msvc@0.147.0", "", { "os": "win32", "cpu": "x64" }, "sha512-DUaE13OwnUSlHpLZNcC/nuT10ivlWqc5EZgsfgXuAmWYw0r3nDxGeLD1zlGwYwIgVk1/ZMAxoXpV+05stvbHaA=="],
+    "@oxc-resolver/binding-darwin-arm64": ["@oxc-resolver/binding-darwin-arm64@11.19.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-nUC6d2i3R5B12sUW4O646qD5cnMXf2oBGPLIIeaRfU9doJRORAbE2SGv4eW6rMqhD+G7nf2Y8TTJTLiiO3Q/dQ=="],
 
-    "@oxc-project/types": ["@oxc-project/types@0.148.0", "", {}, "sha512-Nm4s/jB+4FpFsPhWGEC4h7rzksesmtnMXomo6rCMcg/b8zLQuOziRgkCS1fxDCXOlJB/6Q8oABOZ/OP6RIPj9A=="],
+    "@oxc-resolver/binding-darwin-x64": ["@oxc-resolver/binding-darwin-x64@11.19.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-cV50vE5+uAgNcFa3QY1JOeKDSkM/9ReIcc/9wn4TavhW/itkDGrXhw9jaKnkQnGbjJ198Yh5nbX/Gr2mr4Z5jQ=="],
 
-    "@oxc-resolver/binding-android-arm-eabi": ["@oxc-resolver/binding-android-arm-eabi@11.24.2", "", { "os": "android", "cpu": "arm" }, "sha512-y09e0L0SRI2OA2tUIrjBgoV3eH5hvUKXNkJqXmNo5V2WxIjyC7I7aJfRLMEVpA8yi95f90gFDvO0VMgrDw+vwA=="],
+    "@oxc-resolver/binding-freebsd-x64": ["@oxc-resolver/binding-freebsd-x64@11.19.1", "", { "os": "freebsd", "cpu": "x64" }, "sha512-xZOQiYGFxtk48PBKff+Zwoym7ScPAIVp4c14lfLxizO2LTTTJe5sx9vQNGrBymrf/vatSPNMD4FgsaaRigPkqw=="],
 
-    "@oxc-resolver/binding-android-arm64": ["@oxc-resolver/binding-android-arm64@11.24.2", "", { "os": "android", "cpu": "arm64" }, "sha512-cl4icWaZFnLdg8m6qtnh5rBMuGbxc/ptStFHLeCNwr+2cZjkjNwQu/jYRS0CHlnPecOJMpuS5M6/BH+0J/YkEg=="],
+    "@oxc-resolver/binding-linux-arm-gnueabihf": ["@oxc-resolver/binding-linux-arm-gnueabihf@11.19.1", "", { "os": "linux", "cpu": "arm" }, "sha512-lXZYWAC6kaGe/ky2su94e9jN9t6M0/6c+GrSlCqL//XO1cxi5lpAhnJYdyrKfm0ZEr/c7RNyAx3P7FSBcBd5+A=="],
 
-    "@oxc-resolver/binding-darwin-arm64": ["@oxc-resolver/binding-darwin-arm64@11.24.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-At29QEMF6HajbQvgY8K6OXnHD1x9rad74xBEfmCB6ZqCGsdq75aK7tOYcTbOanMy8qdIBrfL3SMr3p/lfSlb9w=="],
+    "@oxc-resolver/binding-linux-arm-musleabihf": ["@oxc-resolver/binding-linux-arm-musleabihf@11.19.1", "", { "os": "linux", "cpu": "arm" }, "sha512-veG1kKsuK5+t2IsO9q0DErYVSw2azvCVvWHnfTOS73WE0STdLLB7Q1bB9WR+yHPQM76ASkFyRbogWo1GR1+WbQ=="],
 
-    "@oxc-resolver/binding-darwin-x64": ["@oxc-resolver/binding-darwin-x64@11.24.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-A5Kqr1EUj4oIL5CF4WRssq/o5P0Y11cwoFouMRmQ7YnC/A8V93nv1nb7aSU8HwcgmXropjLNkVTl4MN87cu28Q=="],
+    "@oxc-resolver/binding-linux-arm64-gnu": ["@oxc-resolver/binding-linux-arm64-gnu@11.19.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-heV2+jmXyYnUrpUXSPugqWDRpnsQcDm2AX4wzTuvgdlZfoNYO0O3W2AVpJYaDn9AG4JdM6Kxom8+foE7/BcSig=="],
 
-    "@oxc-resolver/binding-freebsd-x64": ["@oxc-resolver/binding-freebsd-x64@11.24.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-R5xkRBRRz7ceH/P5Jrc6G7FmdUdgpLYyESFAUDVTNQ9K0sGPxcp4ljiwEwEqsvNcQ4sYbMRrWcHHBCu7ksAJVw=="],
+    "@oxc-resolver/binding-linux-arm64-musl": ["@oxc-resolver/binding-linux-arm64-musl@11.19.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-jvo2Pjs1c9KPxMuMPIeQsgu0mOJF9rEb3y3TdpsrqwxRM+AN6/nDDwv45n5ZrUnQMsdBy5gIabioMKnQfWo9ew=="],
 
-    "@oxc-resolver/binding-linux-arm-gnueabihf": ["@oxc-resolver/binding-linux-arm-gnueabihf@11.24.2", "", { "os": "linux", "cpu": "arm" }, "sha512-k/RuYL4L/R58IBn3wT5ma3Wh4k62bp1eYCFRWCmMsasUOqL+H6sW0VGFadEzKWXFFlz+2uIMoeMk9ySSZJHgbg=="],
+    "@oxc-resolver/binding-linux-ppc64-gnu": ["@oxc-resolver/binding-linux-ppc64-gnu@11.19.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-vLmdNxWCdN7Uo5suays6A/+ywBby2PWBBPXctWPg5V0+eVuzsJxgAn6MMB4mPlshskYbppjpN2Zg83ArHze9gQ=="],
 
-    "@oxc-resolver/binding-linux-arm-musleabihf": ["@oxc-resolver/binding-linux-arm-musleabihf@11.24.2", "", { "os": "linux", "cpu": "arm" }, "sha512-bnHAak3ujYfH5pKk4NieFNbvYvernfoQDgwLddbZ3OtMYrem87/qjlA+u+aKG0oZcqSLGCful/6/CEA+aeAgaA=="],
+    "@oxc-resolver/binding-linux-riscv64-gnu": ["@oxc-resolver/binding-linux-riscv64-gnu@11.19.1", "", { "os": "linux", "cpu": "none" }, "sha512-/b+WgR+VTSBxzgOhDO7TlMXC1ufPIMR6Vj1zN+/x+MnyXGW7prTLzU9eW85Aj7Th7CCEG9ArCbTeqxCzFWdg2w=="],
 
-    "@oxc-resolver/binding-linux-arm64-gnu": ["@oxc-resolver/binding-linux-arm64-gnu@11.24.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-vDT3KHgzYp47gmtNOqL2VNhCyl5Zv643eyxm//A68J8DeUGXrvD1pZFiaT4jSfe+RInfnn1R2yVHye4enx6RnA=="],
+    "@oxc-resolver/binding-linux-riscv64-musl": ["@oxc-resolver/binding-linux-riscv64-musl@11.19.1", "", { "os": "linux", "cpu": "none" }, "sha512-YlRdeWb9j42p29ROh+h4eg/OQ3dTJlpHSa+84pUM9+p6i3djtPz1q55yLJhgW9XfDch7FN1pQ/Vd6YP+xfRIuw=="],
 
-    "@oxc-resolver/binding-linux-arm64-musl": ["@oxc-resolver/binding-linux-arm64-musl@11.24.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-+kMlQvbzfyEYtu5FcjE4p+ttBLpKW4d/AsAsuE69BxV6V4twZJeIQZFfD8gh/wqglY0MkPSezWXQH0jBV13MUw=="],
+    "@oxc-resolver/binding-linux-s390x-gnu": ["@oxc-resolver/binding-linux-s390x-gnu@11.19.1", "", { "os": "linux", "cpu": "s390x" }, "sha512-EDpafVOQWF8/MJynsjOGFThcqhRHy417sRyLfQmeiamJ8qVhSKAn2Dn2VVKUGCjVB9C46VGjhNo7nOPUi1x6uA=="],
 
-    "@oxc-resolver/binding-linux-ppc64-gnu": ["@oxc-resolver/binding-linux-ppc64-gnu@11.24.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-shjfMhmZ3gq9fv/w7bi3PnZlgOPG+2QAOFf0BJF0EgBSIGZ6PMLN2zbGEblTUYB/NKVDRyYhE2ff3dJ1QqNPkA=="],
+    "@oxc-resolver/binding-linux-x64-gnu": ["@oxc-resolver/binding-linux-x64-gnu@11.19.1", "", { "os": "linux", "cpu": "x64" }, "sha512-NxjZe+rqWhr+RT8/Ik+5ptA3oz7tUw361Wa5RWQXKnfqwSSHdHyrw6IdcTfYuml9dM856AlKWZIUXDmA9kkiBQ=="],
 
-    "@oxc-resolver/binding-linux-riscv64-gnu": ["@oxc-resolver/binding-linux-riscv64-gnu@11.24.2", "", { "os": "linux", "cpu": "none" }, "sha512-zGelwFR5oRo+b69k8Lrzun86DyUHzfKN6cnjbR9l7Z7NIRznOE/2ZvPa1IUKqAL2PzAXOdwkfVqNvO1H2RlpAw=="],
+    "@oxc-resolver/binding-linux-x64-musl": ["@oxc-resolver/binding-linux-x64-musl@11.19.1", "", { "os": "linux", "cpu": "x64" }, "sha512-cM/hQwsO3ReJg5kR+SpI69DMfvNCp+A/eVR4b4YClE5bVZwz8rh2Nh05InhwI5HR/9cArbEkzMjcKgTHS6UaNw=="],
 
-    "@oxc-resolver/binding-linux-riscv64-musl": ["@oxc-resolver/binding-linux-riscv64-musl@11.24.2", "", { "os": "linux", "cpu": "none" }, "sha512-qxZ1SWCXJY0eyhAlP6Lmo9F2Nrtx7EkYj9oCgL8apDPCwXwCEDA2U697bbT81JIc2IrVjxO4KX6WU2N+oN9Z4w=="],
+    "@oxc-resolver/binding-openharmony-arm64": ["@oxc-resolver/binding-openharmony-arm64@11.19.1", "", { "os": "none", "cpu": "arm64" }, "sha512-QF080IowFB0+9Rh6RcD19bdgh49BpQHUW5TajG1qvWHvmrQznTZZjYlgE2ltLXyKY+qs4F/v5xuX1XS7Is+3qA=="],
 
-    "@oxc-resolver/binding-linux-s390x-gnu": ["@oxc-resolver/binding-linux-s390x-gnu@11.24.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-sGCecF3cx2DFlH4t/z7ApnOnXqN48p5p5mlHDEnHTAukQa2P+qMVE4CwyWE9W+q/m3QJ7kKfGrIjax31f44oFQ=="],
+    "@oxc-resolver/binding-wasm32-wasi": ["@oxc-resolver/binding-wasm32-wasi@11.19.1", "", { "dependencies": { "@napi-rs/wasm-runtime": "^1.1.1" }, "cpu": "none" }, "sha512-w8UCKhX826cP/ZLokXDS6+milN8y4X7zidsAttEdWlVoamTNf6lhBJldaWr3ukTDiye7s4HRcuPEPOXNC432Vg=="],
 
-    "@oxc-resolver/binding-linux-x64-gnu": ["@oxc-resolver/binding-linux-x64-gnu@11.24.2", "", { "os": "linux", "cpu": "x64" }, "sha512-k/VlMMcSzMlahb3/fENM4rTlsJ0s3fFROA0KXPBmKggqmTSaE383sl8F3KCOXPLmVsYfW6hCitMhXCEtNeZxxg=="],
+    "@oxc-resolver/binding-win32-arm64-msvc": ["@oxc-resolver/binding-win32-arm64-msvc@11.19.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-nJ4AsUVZrVKwnU/QRdzPCCrO0TrabBqgJ8pJhXITdZGYOV28TIYystV1VFLbQ7DtAcaBHpocT5/ZJnF78YJPtQ=="],
 
-    "@oxc-resolver/binding-linux-x64-musl": ["@oxc-resolver/binding-linux-x64-musl@11.24.2", "", { "os": "linux", "cpu": "x64" }, "sha512-8hbnZyNi97b/8wapYaIF9+t9GmZKBW2vunaOc3h9HGJptH7b7XpvZqOTBSm/MpTjr7H497BlgOaSfLUdhmy2bw=="],
+    "@oxc-resolver/binding-win32-ia32-msvc": ["@oxc-resolver/binding-win32-ia32-msvc@11.19.1", "", { "os": "win32", "cpu": "ia32" }, "sha512-EW+ND5q2Tl+a3pH81l1QbfgbF3HmqgwLfDfVithRFheac8OTcnbXt/JxqD2GbDkb7xYEqy1zNaVFRr3oeG8npA=="],
 
-    "@oxc-resolver/binding-openharmony-arm64": ["@oxc-resolver/binding-openharmony-arm64@11.24.2", "", { "os": "none", "cpu": "arm64" }, "sha512-MvyGik3a6pVgZ0t/kWlbmFxFLmXQJwgLsY2eYFHLpy0wGwRbfzeIGgDwQ3kXqE30z+kSXennRkCrT7TUvkptNg=="],
+    "@oxc-resolver/binding-win32-x64-msvc": ["@oxc-resolver/binding-win32-x64-msvc@11.19.1", "", { "os": "win32", "cpu": "x64" }, "sha512-6hIU3RQu45B+VNTY4Ru8ppFwjVS/S5qwYyGhBotmjxfEKk41I2DlGtRfGJndZ5+6lneE2pwloqunlOyZuX/XAw=="],
 
-    "@oxc-resolver/binding-wasm32-wasi": ["@oxc-resolver/binding-wasm32-wasi@11.24.2", "", { "dependencies": { "@emnapi/core": "1.11.2", "@emnapi/runtime": "1.11.2", "@napi-rs/wasm-runtime": "^1.1.6" }, "cpu": "none" }, "sha512-vHcssMPwO08RTvj/c0iOBz90attxyG3wQJ0dTcyEQK43LRpcdLWZlV5feBhv6Isn6ahbQIzHbCgfa81+RiML0Q=="],
+    "@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.67.0", "", { "os": "android", "cpu": "arm" }, "sha512-VrSi571rDv1N8HaEDM+DEX8nmT0y9jJo8tzzW13vsOWTx59xQczCIJx68n2zWOXRT5YKZsOZXp4qkHN/10x4mw=="],
 
-    "@oxc-resolver/binding-win32-arm64-msvc": ["@oxc-resolver/binding-win32-arm64-msvc@11.24.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-uokJqro2iBqkFvJdKQLP7d8/BUmFwESQFVmIJUQKj1Xn1a/LysJoe1vmeECLF5b3jsV8CAL5sEMJXX6SdK9Nhg=="],
+    "@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.67.0", "", { "os": "android", "cpu": "arm64" }, "sha512-l6+NdYxMoRohix5r5bbigW16LPicceCwGcQ6LKKuE1kUdjgFfQolJjrJsQYPFetIs78Gxj/G/f5TEGoTCwj9nQ=="],
 
-    "@oxc-resolver/binding-win32-x64-msvc": ["@oxc-resolver/binding-win32-x64-msvc@11.24.2", "", { "os": "win32", "cpu": "x64" }, "sha512-UqGPmo56KDfLlfXFAFIrNflHT8tFxWGEivWg3Zeyp4Uy2NlKN1FGPr6/BxcLGG3+kZ6Wp14g5Uj+n71boqZfiw=="],
+    "@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.67.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-jOzXxS1AxFxhImLIRbtGIMrEwaXcgMw3gR57WB1cRk8ai+vpr6726kxXqVvlNsrXtJ/FrmOm8RxlC0m8SW24Qg=="],
 
-    "@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.81.0", "", { "os": "android", "cpu": "arm" }, "sha512-IcCRsXiedJoJopY6mpZUBEeVFsUrutmrG7dZ87zMuKJlhg70Ora9bBl1WcCxZQtyI10YpnVdEso5oCg7YcfSHw=="],
+    "@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.67.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-3DFAVY94OqjIZHXIPz37yGRSWwOFTAqChQ64/M69GYLawzP0KiwdhDNfqdKKYT0bTR/DNxmMnQsj3ns+8+X/Lg=="],
 
-    "@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.81.0", "", { "os": "android", "cpu": "arm64" }, "sha512-GRrIPyTGVhx3L3h+0T5xT2A0jFAcdPv4+IfuXpGDLIdl6XeYhgg/zw72A5ILZoUgRqZuM8F1y+V/gfDriXSxzQ=="],
+    "@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.67.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-e4dDKZuLu8TR9DEBssWSDahlPgZBwojTTHZUvnjBRJfJJbpxYCjfjKfi0Z1+CSLMiJBwI2yCDtRM1XJQaARjmg=="],
 
-    "@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.81.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-qNQ9tXRgLuKbqSV1S2h9h4KPHjbovO7RRR2/enUOtHzTkFZ7B9X5zqqHJua8dRyc7dBy7Aoyq5pqTSLFVcAzGQ=="],
+    "@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.67.0", "", { "os": "linux", "cpu": "arm" }, "sha512-BKytFdcQzbITV3xlnzDUDTEDtbUMCCiC4EaNTDZ4FyT8gdNvBC4gfiLucXp/sQl0XU3p7syTlorUWVVVBZab2g=="],
 
-    "@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.81.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-q0QTm32jWga2Gv4j7IaVZN0jYMi9UV73sWVgFtDA4iIfqwMCLLZ3ve+9KwfYtsaKZSgQhmPaogeZWqDZpcY1Pw=="],
+    "@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.67.0", "", { "os": "linux", "cpu": "arm" }, "sha512-XYAv0esBDX7BpTzRDjVX2Vdj+zndd8ll2dFQiaeQ6zTZr7A8GRDTN7fH3FP3jU+O0vCDx85oH/EtG7BzPgAXuw=="],
 
-    "@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.81.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-/+8wVWDXEC7wHVAhOc59Fw/SkMc1arLkFD8iQCaSsmzenK1X4doFqquL9H1wrtGUzaiycVqkf/sSpcILK6W1UA=="],
+    "@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.67.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-zizRMjA0i6u/2B0evgda04iycu+MoNuf1pBy6Eh+1CjC5wMEG7qN5zdDKTCvFc0KSYSDM9QTG3gjZHirgtQuKg=="],
 
-    "@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.81.0", "", { "os": "linux", "cpu": "arm" }, "sha512-4xt422FEgioRq9hAL4Tq7fujGUWnc8z1BJ+Oi8RN8vB8axaP+sdK6a2xdlcQCCYnJg9QMuMFS0AucuIFx/EacA=="],
+    "@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.67.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-zB/Tf6sUjmmvvbva9Gj3JTJ8rJ9t4I8/U0o6vSRtd0DRIsIuyegBwJAzhSUFQHdMijIRJkW0exs/yBhpw2S20w=="],
 
-    "@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.81.0", "", { "os": "linux", "cpu": "arm" }, "sha512-u3vna8KdGplH4DRCW9K54D68fcMo7IxVrkCJWwXnIhwtBdnDnYrmzOUA/XjmBlPpcLsgw9Z5BNdY4za9+Dj+MQ=="],
+    "@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.67.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-kgU40Gt74CK0TCsF51KZymkIwN9U0BajKsMijB52zPqOeZU9NAHkA/NSQkZDHEaCakx42DxhXkODiAqf2b4Gug=="],
 
-    "@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.81.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-3j9k+gsYsE7nv71GWotXsqsa2l9/aJenD7dVHNt/CBvsb0SgRjSMnHFeP59IXUAl1wvVFhqGl2wJNMwWU3UBlA=="],
+    "@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.67.0", "", { "os": "linux", "cpu": "none" }, "sha512-tOYhkk/iaG9aD3FvGpBFd1Lrw0x0RaVoJBxjUkfNzS50rC5NS5BteNCwgr8A2zCdADrIIoze6D7u6U5Ic++/iQ=="],
 
-    "@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.81.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-k5iAp3dNxW0/uDCBY+WSm8jKB2szu7SkEQZdgRRpDXvuDd69vvDcqhB3A/pWCfCwXyenjNjFn9Td1fVoyAc+Yg=="],
+    "@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.67.0", "", { "os": "linux", "cpu": "none" }, "sha512-sEtywrPb+0b+tHYl1SDCrw903fiC4eyKoNqzP3v+f2JT3Xcv4NEYG+P8rj+eEnX7IWhqV/xj8/JmcmVj21CXaA=="],
 
-    "@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.81.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-TFqLja3uYmVSte6nof9GWrex9Z8WgdZrNiLC6Te5rXGDqXB2y4j/26iFhwosXiAFqDhE9JJVuuCkDKLwptTn1g=="],
+    "@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.67.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-BvR8Moa0zCLxroOx4vZaZN9nUfwAUpSTwjZdxZyKy4bv3PrzrXrxKR/ZQ0L9wNSvlPhnMJeZfa3q5w6ZCTuN6Q=="],
 
-    "@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.81.0", "", { "os": "linux", "cpu": "none" }, "sha512-UEcySvGS0NOVo7h7n7CYyJL9+6gFAh7Zc/ToDXVScFvzHSTIxtzkMVU30rmQ6+nQ1LF+UdiRDdJajpDu+OylLg=="],
+    "@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.67.0", "", { "os": "linux", "cpu": "x64" }, "sha512-mm2cxM6fksOpq6l0uFws8BUGKAR4dNa/cZCn37Npq7PFbhD5HDJqWfnoIvTaeRKMy5XdS2tO0MA0qbHDrnXAAA=="],
 
-    "@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.81.0", "", { "os": "linux", "cpu": "none" }, "sha512-H+diDbhD00+wI1IRP8Kz88x/lat+DgtoBJzoTthS16xkTJGNaEkfb8gzmd1rzc/2uDQQMl7GNl+JFUacVeWxIA=="],
+    "@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.67.0", "", { "os": "linux", "cpu": "x64" }, "sha512-WmbMuLapKyDlobMkXAaAL0Y+Uczh4LETfIfQsUpbId4Ip8Ai82/jqeYTOoUCkuuhBFapgqP253+d83tLKOksJg=="],
 
-    "@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.81.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-8znJ/5TekjOKg1j1Acho4PJMdiAHLtlcXuWEiipOhAMV6rQcXdmDdXCbheyDczN6TjBwiNfjcP81k4AthrKRzw=="],
+    "@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.67.0", "", { "os": "none", "cpu": "arm64" }, "sha512-9g/PqxYJelzzTAOR5Y+RiRqdeydhEuXv2KxNeFcAKQ7UsvnWSY1OP4MsuPMbTO2Pf70tz7mFhl1j13H3fyh+8g=="],
 
-    "@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.81.0", "", { "os": "linux", "cpu": "x64" }, "sha512-Q2Wj70yFsvn5QjlmifFzbj4H+kJy53bwqc41o1fzoM7MpLV1NIbhg/LpWXRfC6KOkSAdUx1Wd8VJsdPmhp/HRA=="],
+    "@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.67.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-2VhwE6Gatb0vJGnN0TBuQMbKCOiZlSQ/zJvVWYLK4a9d4iDiJOen/yVQkGpmsJ90MuH66fzi0kEKI0jRQMDxGA=="],
 
-    "@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.81.0", "", { "os": "linux", "cpu": "x64" }, "sha512-cPInHp/ddEe5qkyK2IiyQ8Q3Mp2oLLEhhsGgTK2oZx4L6+llGam1H1yBvJZ7qHfOXj8N3hxBS8sj4tO+gtFlIg=="],
+    "@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.67.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-EQ3VExXfeM1InbE5+JjufhZZTWy+kHUwgt3yZR7gQ47Je/mE0WspQPan0OJznh493L5anM210YNJtH1PXjTSFg=="],
 
-    "@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.81.0", "", { "os": "none", "cpu": "arm64" }, "sha512-0CQxSX4ajqm07AHBf5U33qQzXKdd7wtq/oTL/7vpY6RNNuxrRi8W4bqUV1Jyu/vj+9KmxQyDhxfeVX1nQL6kfg=="],
+    "@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.67.0", "", { "os": "win32", "cpu": "x64" }, "sha512-bw24y+/1MHS4QDkons3YyHkPT9uCMoLHHgQhb+mb8NOjTYwub1CZ+K9Ngr8aO5DMrDrkqHwTzlTwFP2vS8Y/ZQ=="],
 
-    "@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.81.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-l0hbeISm9673hVrrQU8j/p2M7YH9Ouoj7p7E/QM55NTrKVLP+P3PF8hLu+OY+x0VtGRW+ggiQKZqmdYps9H+TA=="],
+    "@playwright/test": ["@playwright/test@1.60.0", "", { "dependencies": { "playwright": "1.60.0" }, "bin": { "playwright": "cli.js" } }, "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag=="],
 
-    "@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.81.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-ksqPP5jbFXcYreEQ7zdJh06rJQBymCTyGRCdaXjfcf2aG4f8KxUWY5wcgYHmaTK+FJ4bPG5sUAdOX+6trnH1JA=="],
+    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.0-rc.17", "", { "os": "android", "cpu": "arm64" }, "sha512-s70pVGhw4zqGeFnXWvAzJDlvxhlRollagdCCKRgOsgUOH3N1l0LIxf83AtGzmb5SiVM4Hjl5HyarMRfdfj3DaQ=="],
 
-    "@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.81.0", "", { "os": "win32", "cpu": "x64" }, "sha512-IZuUCwGw9emG5JtCp+fYGB+Z4OWEoeEcM8R5BA1pYw63/ieYFVdcU2ylxTpHbVHSenZnsYE+ZZ20uHAJszQ4cA=="],
+    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.0-rc.17", "", { "os": "darwin", "cpu": "arm64" }, "sha512-4ksWc9n0mhlZpZ9PMZgTGjeOPRu8MB1Z3Tz0Mo02eWfWCHMW1zN82Qz/pL/rC+yQa+8ZnutMF0JjJe7PjwasYw=="],
 
-    "@playwright/test": ["@playwright/test@1.62.1", "", { "dependencies": { "playwright": "1.62.1" }, "bin": { "playwright": "cli.js" } }, "sha512-DTcUc8qii+cpHvtOwggMtBRMjKZHXYWdw8syRYu2vtzuq4Wxphqq4NfCs5Zt44L6mA8rfDfj+PHnxFc/FeK6mQ=="],
+    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.0.0-rc.17", "", { "os": "darwin", "cpu": "x64" }, "sha512-SUSDOI6WwUVNcWxd02QEBjLdY1VPHvlEkw6T/8nYG322iYWCTxRb1vzk4E+mWWYehTp7ERibq54LSJGjmouOsw=="],
 
-    "@rolldown/binding-android-arm-eabi": ["@rolldown/binding-android-arm-eabi@1.2.7", "", { "os": "android", "cpu": "arm" }, "sha512-EypzgnYCwyVY4NDHKzGmNJT5b+XaQEBniHxsMdeIQLB/tcCzZnhqrzHpZFbX9iaxx+5RiB8caATBtfvZP7zVxQ=="],
+    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.0.0-rc.17", "", { "os": "freebsd", "cpu": "x64" }, "sha512-hwnz3nw9dbJ05EDO/PvcjaaewqqDy7Y1rn1UO81l8iIK1GjenME75dl16ajbvSSMfv66WXSRCYKIqfgq2KCfxw=="],
 
-    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.2.7", "", { "os": "android", "cpu": "arm64" }, "sha512-l17HE9EweWaqJZhuUuNBN/FzM62xw+DECVnJyvMsxn8vJFAGLy5QfLDoYAcronkAN8VxKZHezDpulHDPx95vFw=="],
+    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.0.0-rc.17", "", { "os": "linux", "cpu": "arm" }, "sha512-IS+W7epTcwANmFSQFrS1SivEXHtl1JtuQA9wlxrZTcNi6mx+FDOYrakGevvvTwgj2JvWiK8B29/qD9BELZPyXQ=="],
 
-    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.2.7", "", { "os": "darwin", "cpu": "arm64" }, "sha512-8ED8ELFvHXc6OCETIn4gXObPiaR6bckM/ipXtbzlPVDRMBfEGjCKgO90F9YtfdpDatVx/ZQw7aZ1vUMf/+T3Mw=="],
+    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.0.0-rc.17", "", { "os": "linux", "cpu": "arm64" }, "sha512-e6usGaHKW5BMNZOymS1UcEYGowQMWcgZ71Z17Sl/h2+ZziNJ1a9n3Zvcz6LdRyIW5572wBCTH/Z+bKuZouGk9Q=="],
 
-    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.2.7", "", { "os": "darwin", "cpu": "x64" }, "sha512-/WPripjtiAIZ2tWY7ddijORT0Ujg87wxWW/qcoFVCKAWVDPhtY0xr7Dj0M3GyNGz60jGwTElhro/mkF9dT7dDQ=="],
+    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.0.0-rc.17", "", { "os": "linux", "cpu": "arm64" }, "sha512-b/CgbwAJpmrRLp02RPfhbudf5tZnN9nsPWK82znefso832etkem8H7FSZwxrOI9djcdTP7U6YfNhbRnh7djErg=="],
 
-    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.2.7", "", { "os": "freebsd", "cpu": "x64" }, "sha512-14DI4NcqpvbICxSnGLx3PmtDaWqRP/KGSGb6C+JLLVPeZRl6dKdHba3pGsqT3vpdTqhEYIPG0MMQ8c0xYqoJxA=="],
+    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.0.0-rc.17", "", { "os": "linux", "cpu": "ppc64" }, "sha512-4EII1iNGRUN5WwGbF/kOh/EIkoDN9HsupgLQoXfY+D1oyJm7/F4t5PYU5n8SWZgG0FEwakyM8pGgwcBYruGTlA=="],
 
-    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.2.7", "", { "os": "linux", "cpu": "arm" }, "sha512-bxrWIRvHWQvbJwi+VIie/kDJmQxcNE6xxWwZdqF/ExVAigtHkv54WTLQPb+QsZdnFy18fg7JPfWGL0RH6vwIlQ=="],
+    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.0.0-rc.17", "", { "os": "linux", "cpu": "s390x" }, "sha512-AH8oq3XqQo4IibpVXvPeLDI5pzkpYn0WiZAfT05kFzoJ6tQNzwRdDYQ45M8I/gslbodRZwW8uxLhbSBbkv96rA=="],
 
-    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.2.7", "", { "os": "linux", "cpu": "arm64" }, "sha512-toOY2BChBZyuxU7OYX6Tn389di4IzAqPTycVcci0O7FSfBqzRB3RZn+K5Is6ANf4tmgRd/K1yZTsNTXbkXsnLg=="],
+    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.0.0-rc.17", "", { "os": "linux", "cpu": "x64" }, "sha512-cLnjV3xfo7KslbU41Z7z8BH/E1y5mzUYzAqih1d1MDaIGZRCMqTijqLv76/P7fyHuvUcfGsIpqCdddbxLLK9rA=="],
 
-    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.2.7", "", { "os": "linux", "cpu": "arm64" }, "sha512-lAIXTH/aiLRLxsTgQvfhjo4K1ydWIp00+V0voOr9beb/9ZmkUFrSIb03dXNFRgMNvkE6oGsF10ioQ6UsI+vS5Q=="],
+    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.0.0-rc.17", "", { "os": "linux", "cpu": "x64" }, "sha512-0phclDw1spsL7dUB37sIARuis2tAgomCJXAHZlpt8PXZ4Ba0dRP1e+66lsRqrfhISeN9bEGNjQs+T/Fbd7oYGw=="],
 
-    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.2.7", "", { "os": "linux", "cpu": "ppc64" }, "sha512-kdnwS28Pkenp/mZMRwjXXXwxQ7pIsm+bF919LUK93BOyhcLsrVKdP2p9fxpiPNPAbNuch8ypQt0pm2P2LYCAGg=="],
+    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.0.0-rc.17", "", { "os": "none", "cpu": "arm64" }, "sha512-0ag/hEgXOwgw4t8QyQvUCxvEg+V0KBcA6YuOx9g0r02MprutRF5dyljgm3EmR02O292UX7UeS6HzWHAl6KgyhA=="],
 
-    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.2.7", "", { "os": "linux", "cpu": "s390x" }, "sha512-516OdsyLdr5E65paF3yBF55t8mfm9+gmtCsK3xI7XKXIT7EfRlHhxL8K/NR6Hu8BWSgF5+1w74lTL0+nxcc8Qw=="],
+    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.0.0-rc.17", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-LEXei6vo0E5wTGwpkJ4KoT3OZJRnglwldt5ziLzOlc6qqb55z4tWNq2A+PFqCJuvWWdP53CVhG1Z9NtToDPJrA=="],
 
-    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.2.7", "", { "os": "linux", "cpu": "x64" }, "sha512-r8/z8n7GFaYRln3xmP1Cxy0HH/HLM0uBUPkEuSVEfKGDA89M0FsZRZJRSwe/tJjRx+fpH/gjorfhB8tmEbSFLA=="],
+    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.0.0-rc.17", "", { "os": "win32", "cpu": "arm64" }, "sha512-gUmyzBl3SPMa6hrqFUth9sVfcLBlYsbMzBx5PlexMroZStgzGqlZ26pYG89rBb45Mnia+oil6YAIFeEWGWhoZA=="],
 
-    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.2.7", "", { "os": "linux", "cpu": "x64" }, "sha512-pAsE8iiDxUg1xBqdhrTfg45AVDVpirjz00sblEYClGNNcMnDb+e8beQgqIAw6LvauX/APvgxUnwrgun/YYGBhw=="],
-
-    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.2.7", "", { "os": "none", "cpu": "arm64" }, "sha512-lTcIYmmnQQA8Or/2DatS6oSqcdLHvendjS+zLu+FwgToynWMRSmQdpM65fTANJgIS4mjbMOo5KT2lnT9SAb96w=="],
-
-    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.2.7", "", { "os": "win32", "cpu": "arm64" }, "sha512-e3Gu3WxbNk/UqQhxqU7YIYO+9ZBvWNz3U+h/qRFosscMFzdRPbXYSaSWgSnklv2fz1TgzBTcti2z35c/7irsHw=="],
-
-    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.2.7", "", { "os": "win32", "cpu": "x64" }, "sha512-W/jg5qoRSqjsEv0+dZi4e687mcHqmVuU0P4fK6qS/xjetW2Gmc1W8j//z5nAeNcC8Ttm0hV46IjcYeuVwYhuiw=="],
+    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.0.0-rc.17", "", { "os": "win32", "cpu": "x64" }, "sha512-3hkiolcUAvPB9FLb3UZdfjVVNWherN1f/skkGWJP/fgSQhYUZpSIRr0/I8ZK9TkF3F7kxvJAk0+IcKvPHk9qQg=="],
 
     "@rolldown/plugin-babel": ["@rolldown/plugin-babel@0.2.3", "", { "dependencies": { "picomatch": "^4.0.4" }, "peerDependencies": { "@babel/core": "^7.29.0 || ^8.0.0-rc.1", "@babel/plugin-transform-runtime": "^7.29.0 || ^8.0.0-rc.1", "@babel/runtime": "^7.27.0 || ^8.0.0-rc.1", "rolldown": "^1.0.0-rc.5", "vite": "^8.0.0" }, "optionalPeers": ["@babel/plugin-transform-runtime", "@babel/runtime", "vite"] }, "sha512-+zEk16yGlz1F9STiRr6uG9hmIXb6nprjLczV/htGptYuLoCuxb+itZ03RKCEeOhBpDDd1NU7qF6x1VLMUp62bw=="],
 
-    "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.1", "", {}, "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw=="],
+    "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.7", "", {}, "sha512-qujRfC8sFVInYSPPMLQByRh7zhwkGFS4+tyMQ83srV1qrxL4g8E2tyxVVyxd0+8QeBM1mIk9KbWxkegRr76XzA=="],
 
     "@secretlint/config-creator": ["@secretlint/config-creator@12.3.1", "", { "dependencies": { "@secretlint/types": "12.3.1" } }, "sha512-CCRvPfrQLt2fPg3eWTIDGXNcVFQd6ZnvQCZ5lzclV9OF7iRqXQ4l5lfGO8NS68tIZx7YvBKhcO8/eVxdqm89HA=="],
 
@@ -625,19 +609,7 @@
 
     "@secretlint/types": ["@secretlint/types@12.3.1", "", {}, "sha512-Qv3fKvPkzUJpS9Ps6m2EPjC0RdxS2ZZrRfZAhIdl2u0zSjgf+Z0+AaCngmHRR+3Vtbw6s2FrCf4T6mLirm8Hgg=="],
 
-    "@sentry/conventions": ["@sentry/conventions@0.16.0", "", {}, "sha512-fO9PLmHdVURcSPUpWCItWAtgKiMwGdJHbovoSEyLplX5sxs2ugvI4CBPTrkkgqhObnZOD0CnWBKDzSVQYBKEyQ=="],
-
-    "@sentry/core": ["@sentry/core@10.73.0", "", { "dependencies": { "@sentry/conventions": "^0.16.0" } }, "sha512-FLO1UgH19RyasVpofu612WCOgb2nEH0dZy+R72d7p65XU9i0wxlMKm3+sgfwKmiSJp1Qhilaaxs4Jg6BbiM5HA=="],
-
-    "@sentry/node": ["@sentry/node@10.73.0", "", { "dependencies": { "@opentelemetry/api": "^1.9.1", "@opentelemetry/instrumentation": "^0.220.0", "@opentelemetry/sdk-trace-base": "^2.9.0", "@sentry/conventions": "^0.16.0", "@sentry/core": "10.73.0", "@sentry/node-core": "10.73.0", "@sentry/opentelemetry": "10.73.0", "@sentry/server-utils": "10.73.0", "import-in-the-middle": "^3.0.0" } }, "sha512-jiMJ6GgXDw6UMGzJY+o0c8OoeA9OfHqZ/xEpHfDqy75hn+9CEkRkbNGCIdMvsc7wW/Se1Os394hHfTpU+YEskg=="],
-
-    "@sentry/node-core": ["@sentry/node-core@10.73.0", "", { "dependencies": { "@sentry/conventions": "^0.16.0", "@sentry/core": "10.73.0", "@sentry/opentelemetry": "10.73.0", "import-in-the-middle": "^3.0.0" }, "peerDependencies": { "@opentelemetry/api": "^1.9.0", "@opentelemetry/core": "^1.30.1 || ^2.1.0", "@opentelemetry/exporter-trace-otlp-http": ">=0.57.0 <1", "@opentelemetry/instrumentation": ">=0.57.1 <1", "@opentelemetry/sdk-trace-base": "^1.30.1 || ^2.1.0" }, "optionalPeers": ["@opentelemetry/api", "@opentelemetry/core", "@opentelemetry/exporter-trace-otlp-http", "@opentelemetry/instrumentation", "@opentelemetry/sdk-trace-base"] }, "sha512-GHAGUmZPmm6FKfxfv2maVVJ/A99YAmd7oFOuKMDmITI6O/Msl6JB3vPTEpopVAHLW0LYJQBOjddL9C7o+Jt44g=="],
-
-    "@sentry/opentelemetry": ["@sentry/opentelemetry@10.73.0", "", { "dependencies": { "@sentry/conventions": "^0.16.0", "@sentry/core": "10.73.0" }, "peerDependencies": { "@opentelemetry/api": "^1.9.0", "@opentelemetry/core": "^1.30.1 || ^2.1.0", "@opentelemetry/sdk-trace-base": "^1.30.1 || ^2.1.0" } }, "sha512-fQouPQKsH0CQrw6oAn1k0Z2I+tgyochCovifr5qNS69i0OzjknLa03WJyiZ/IuzXc4AVa5jAKfOeE9slABz8Qw=="],
-
-    "@sentry/server-utils": ["@sentry/server-utils@10.73.0", "", { "dependencies": { "@sentry/conventions": "^0.16.0", "@sentry/core": "10.73.0" } }, "sha512-QskripdKFbM/+gipC6mpa2crLwL7+VbkX84IpHg2z9UlYQ1kNKd3aMT+Qk9NLRSw/zu1rSIAvlbWfx4D3rgNAA=="],
-
-    "@sinclair/typebox": ["@sinclair/typebox@0.34.52", "", {}, "sha512-XiMQh7qqVlxZzcVD+kkGMNGMzcTrDMLWI7S4x7z1MkCkbDPrekpZXEUK0eZqZFMuHQg2a2DZOcDIh9o5v3Gonw=="],
+    "@sinclair/typebox": ["@sinclair/typebox@0.34.49", "", {}, "sha512-brySQQs7Jtn0joV8Xh9ZV/hZb9Ozb0pmazDIASBkYKCjXrXU3mpcFahmK/z4YDhGkQvP9mWJbVyahdtU5wQA+A=="],
 
     "@sindresorhus/merge-streams": ["@sindresorhus/merge-streams@4.0.0", "", {}, "sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ=="],
 
@@ -645,87 +617,87 @@
 
     "@testing-library/dom": ["@testing-library/dom@10.4.1", "", { "dependencies": { "@babel/code-frame": "^7.10.4", "@babel/runtime": "^7.12.5", "@types/aria-query": "^5.0.1", "aria-query": "5.3.0", "dom-accessibility-api": "^0.5.9", "lz-string": "^1.5.0", "picocolors": "1.1.1", "pretty-format": "^27.0.2" } }, "sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg=="],
 
-    "@testing-library/react": ["@testing-library/react@16.3.3", "", { "dependencies": { "@babel/runtime": "^7.12.5" }, "peerDependencies": { "@testing-library/dom": "^10.0.0", "@types/react": "^18.0.0 || ^19.0.0", "@types/react-dom": "^18.0.0 || ^19.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-Uo193NgQbPMz6lrrhtRQQFcMC6Re/ELLFbbuVL30WDlZxlpZf9/lMHTAVxPRLw1q1iu9OJmR1c2BLiENRstdBg=="],
+    "@testing-library/react": ["@testing-library/react@16.3.2", "", { "dependencies": { "@babel/runtime": "^7.12.5" }, "peerDependencies": { "@testing-library/dom": "^10.0.0", "@types/react": "^18.0.0 || ^19.0.0", "@types/react-dom": "^18.0.0 || ^19.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-XU5/SytQM+ykqMnAnvB2umaJNIOsLF3PVv//1Ew4CTcpz0/BRyy/af40qqrt7SjKpDdT1saBMc42CUok5gaw+g=="],
 
-    "@testing-library/user-event": ["@testing-library/user-event@14.6.7", "", { "peerDependencies": { "@testing-library/dom": ">=7.21.4" } }, "sha512-MPCpX8bxe8zS+JmmTwLp8jd0dy1rAm60Te/SL8JrQM3qvQJcBOs1d7IefJMyZzqM3EWBrDn/LWDt1BCGu4ASfg=="],
+    "@testing-library/user-event": ["@testing-library/user-event@14.6.1", "", { "peerDependencies": { "@testing-library/dom": ">=7.21.4" } }, "sha512-vq7fv0rnt+QTXgPxr5Hjc210p6YKq2kmdziLgnsZGgLJ9e6VAShx1pACLuRjd/AS/sr7phAR58OIIpf0LlmQNw=="],
 
-    "@textlint/ast-node-types": ["@textlint/ast-node-types@15.8.0", "", {}, "sha512-5CiH9COYmovWmExQgs7763DzX6Gy9zjkjJ7JxCC95wyTcjwQn/8poNF6fv3qzRlmx8CRRde8DHr9FcgAAiPzgw=="],
+    "@textlint/ast-node-types": ["@textlint/ast-node-types@15.6.0", "", {}, "sha512-CxZHFbYAU7J0A4izz31wV2ZZfySR6aVj2OSR6/3tppZm7VV6hM7nA7sutsLwIiBL/v4lsB1RM79l4Dc/VrH4qw=="],
 
-    "@textlint/linter-formatter": ["@textlint/linter-formatter@15.8.0", "", { "dependencies": { "@azu/format-text": "^1.0.2", "@azu/style-format": "^1.0.1", "@textlint/module-interop": "15.8.0", "@textlint/resolver": "15.8.0", "@textlint/types": "15.8.0", "debug": "^4.4.3", "js-yaml": "^4.3.0", "lodash": "^4.18.1", "pluralize": "^2.0.0", "string-width": "^4.2.3", "strip-ansi": "^6.0.1", "table": "^6.9.0", "text-table": "^0.2.0" } }, "sha512-+oU3A235NATv6Lzi4xa4kJ65PuNJlIxesaO4AvDhDWA9FWm7y4XKWaoQCW1esgaQQ6dwnUiFKArQ8TcJ86mC4w=="],
+    "@textlint/linter-formatter": ["@textlint/linter-formatter@15.6.0", "", { "dependencies": { "@azu/format-text": "^1.0.2", "@azu/style-format": "^1.0.1", "@textlint/module-interop": "15.6.0", "@textlint/resolver": "15.6.0", "@textlint/types": "15.6.0", "chalk": "^4.1.2", "debug": "^4.4.3", "js-yaml": "^4.1.1", "lodash": "^4.18.1", "pluralize": "^2.0.0", "string-width": "^4.2.3", "strip-ansi": "^6.0.1", "table": "^6.9.0", "text-table": "^0.2.0" } }, "sha512-IwHRhjwxs0a5t1eNAoKAdV224CDca38LyopPofXpwO/d0J75wBvzf/cBHXNl4TMsLKhYGtR83UprcLEKj/gZsA=="],
 
-    "@textlint/module-interop": ["@textlint/module-interop@15.8.0", "", {}, "sha512-rt+OR1WYGoLOY8HkA/aBPrqufF6yUUEsKEAh7XohTsT3lp9IyZFT6zOIbjul9P4FAzsmSPkcrYjVx3Bz/IUfkg=="],
+    "@textlint/module-interop": ["@textlint/module-interop@15.6.0", "", {}, "sha512-MHY6pJx9i5kOlrvUSK51887tYZjHAV2qnr6unBm7LtBLGDFo93utdYqHyWep8r9QLsilQdeijWtufJI46z4v4w=="],
 
-    "@textlint/resolver": ["@textlint/resolver@15.8.0", "", {}, "sha512-E88tzfX3K8Jykk+38aJ9cy8RquD8ABVOPTO2rFEESq0wcg8x6/ypdAS8ZgR7OKiGqlRF0hkO/m5PbQwVfKM3VA=="],
+    "@textlint/resolver": ["@textlint/resolver@15.6.0", "", {}, "sha512-T1l2Gd3455pwtm0cTewhX/LLy3bL9z6/Fu/am+jj+jjGfXVoknYkjfkZEKrjHlA7xzay0EfUKnu//teYemLeZw=="],
 
-    "@textlint/types": ["@textlint/types@15.8.0", "", { "dependencies": { "@textlint/ast-node-types": "15.8.0" } }, "sha512-Anhc6y5736YIsvqae0U6k0YmB2M/QVHkEeOv2aydAn/WIkdI69dCOiDbe3/+RagS3qstFTSFWJzNRA2lUjv19w=="],
+    "@textlint/types": ["@textlint/types@15.6.0", "", { "dependencies": { "@textlint/ast-node-types": "15.6.0" } }, "sha512-CvgYb1PiqF4BGyoZebGWzAJCZ4ChJAZ9gtWjpQIMKE4Xe2KlSwDA8m8MsiZIV321f5Ibx38BMjC1Z/2ZYP2GQg=="],
 
-    "@tiptap/core": ["@tiptap/core@3.31.3", "", { "peerDependencies": { "@tiptap/pm": "3.31.3" } }, "sha512-Cz50pvciQrxdSxgTkHOVz0uD0Yl/8Xt0QatGD6ILm47jW8EzyHR9RkUGs/D5IqzXKuVPntfw1ttaT926vXfiRg=="],
+    "@tiptap/core": ["@tiptap/core@3.23.6", "", { "peerDependencies": { "@tiptap/pm": "3.23.6" } }, "sha512-MRB3pHz4Oxqmcawh0cQ5iOGdY5xtNYp/1CoK7hdTLzw5K0C6/gTC2VvanB1R4INaB6EpBkxG/GiWkVirDRnuXw=="],
 
-    "@tiptap/extension-blockquote": ["@tiptap/extension-blockquote@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-fyY2XMbyDDDfOTQ1Qdrnqa1qwC9DWE4n7AfE0EKQI0G8MfLV8RaDlLDcOZDJ9JbMPY7/Gx7EjyK4NKxSW9n2hQ=="],
+    "@tiptap/extension-blockquote": ["@tiptap/extension-blockquote@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-2RmnqNqTltZ2k1F7IfjoDNs935Uq4rRDR7d98mqkg3OlDktcQIyBpv0t9dTay6H5bkQeZUuS8ogK2S1E8Edjug=="],
 
-    "@tiptap/extension-bold": ["@tiptap/extension-bold@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-dIuYhKk8TitKU/FeDpoTeWZhU42YgDN5npgWNjAmMmRktPdoxnH3/wGSiwXlqZgJWjehN7kPWDePWpJeAImGpQ=="],
+    "@tiptap/extension-bold": ["@tiptap/extension-bold@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-1LMhjnytdbbhWHSoOwnLxZAOQZWPkKyXVCNmaIk0Mhi4tLPUXptG4qKS5sVYTCveE5H6IBPFrbgBFi5dMI6krA=="],
 
-    "@tiptap/extension-bubble-menu": ["@tiptap/extension-bubble-menu@3.31.3", "", { "dependencies": { "@floating-ui/dom": "^1.0.0" }, "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-EV6ZnwKc++2OM/OcD54n8s1B7C9LP7GKAtdEPwu0t3BYJf3sG8Ueoinf7SgGPO9oMPg96GneOkDNm1urMV167g=="],
+    "@tiptap/extension-bubble-menu": ["@tiptap/extension-bubble-menu@3.23.6", "", { "dependencies": { "@floating-ui/dom": "^1.0.0" }, "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-Mwkyp9LkDHFbqmWRIkp63FinRxFu3ajC4qSb9t4mnHsb4kAdbNLLsGtbFg+le0SWk4CxGwAOwM7SzeJ+6UGqCA=="],
 
-    "@tiptap/extension-bullet-list": ["@tiptap/extension-bullet-list@3.31.3", "", { "peerDependencies": { "@tiptap/extension-list": "3.31.3" } }, "sha512-qEyyoPapPef4LO8XKaN83bxtaNzkJ4kFn/IxLnEKd4BJ3Mvi4MH2yJYlyDqwFnMoev4pMA1zBHRAt/C0THRmZw=="],
+    "@tiptap/extension-bullet-list": ["@tiptap/extension-bullet-list@3.23.6", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.6" } }, "sha512-RMRgfXZykr/13X8UBOwvpgysVOo9KchwqMoEbvqQSj4YFfU56iIn59C8sbxiQ1sKfeltUf0wH4fPc0I4iwKqAA=="],
 
-    "@tiptap/extension-code": ["@tiptap/extension-code@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-SzxOqchrD2AcN3uT67PjKmRFEMOU3vNNiwNaamZJUbZrI6Hmy+bvdHJrc3jrIddyyCrAtsnAfRI0cmorW1jGfg=="],
+    "@tiptap/extension-code": ["@tiptap/extension-code@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-KG8KXFYyLrtYvT7AZ1WGV61ofx8pDe5g9pH658MERxqQGii+Pyfc6xkz04l7XeBts/7+571UQp/0O7i/z560TA=="],
 
-    "@tiptap/extension-code-block": ["@tiptap/extension-code-block@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-nvknt4FhyJQjYcvxptmeUlFsIAc8ibua3E5BN4Pim374/9RWepH4cdE9X0/qUTtguHElLx0iKtSIY3rW2qGTFA=="],
+    "@tiptap/extension-code-block": ["@tiptap/extension-code-block@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-4kccgcn5yHThxrzsIhJny3EwfEZYIk+BjUCL4uIuzOyWvExtGhZ6JMHVCZeMhI8D1/bX1LNkkAKN5DXPzH4lXQ=="],
 
-    "@tiptap/extension-document": ["@tiptap/extension-document@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-EexgmqnyDNyGlISxo7SMrp5MygpJYmqD+0cY5jB6L1U6L4CpKKRWUt8OO1sWzEHDE1+TTvwt+WIFoIWAziOtEA=="],
+    "@tiptap/extension-document": ["@tiptap/extension-document@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-XDAIgG9KcKumFM9KJWUEUhXPbFIhhl47bfy5GknareWTRKke85rcoj/oxKKO9ihLZr8JfpbXjqnS4SCm5yhYPw=="],
 
-    "@tiptap/extension-dropcursor": ["@tiptap/extension-dropcursor@3.31.3", "", { "peerDependencies": { "@tiptap/extensions": "3.31.3" } }, "sha512-NWomSfu5CSC7VacnMSDzKT8qm66SzMfZwVPEtwY5bPpRTJgTiT1rNK0neDrrzfMN27MfylGyKWWf7Q5Qf8w/fg=="],
+    "@tiptap/extension-dropcursor": ["@tiptap/extension-dropcursor@3.23.6", "", { "peerDependencies": { "@tiptap/extensions": "3.23.6" } }, "sha512-+XWEoRKf3lXxi7Le1aOM2xU1XHwxICGpXjT3m4QaYqUgIpsq8gQEuso6kVg8DnTD7biKQs6+oIQ0o2b/gTW9WA=="],
 
-    "@tiptap/extension-floating-menu": ["@tiptap/extension-floating-menu@3.31.3", "", { "peerDependencies": { "@floating-ui/dom": "^1.0.0", "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-rd4VJ9PGSP9Eop8ZTEwaLZcMzMXLuJKe3hUNf58rq+zANpwM+9fI+vB7g9MAc3eXwUNDxNDVACFIL2oeBqpQ3A=="],
+    "@tiptap/extension-floating-menu": ["@tiptap/extension-floating-menu@3.23.6", "", { "peerDependencies": { "@floating-ui/dom": "^1.0.0", "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-2kjuDcEq69lEcECl75xqY5MyzUSh2zcC5aLrpwP1WwhJz5bxsIFHiaps5AP6h9R4A+ZBj5b2haay2Y1wDUU3VA=="],
 
-    "@tiptap/extension-gapcursor": ["@tiptap/extension-gapcursor@3.31.3", "", { "peerDependencies": { "@tiptap/extensions": "3.31.3" } }, "sha512-EBXKb1FrVStsNYCcRGtd9jmzveCvR+eqgg1rVqoONrqFK6U7bga6LN+1dMKroP1kliDVgveYkP3vRYxqw+rFqg=="],
+    "@tiptap/extension-gapcursor": ["@tiptap/extension-gapcursor@3.23.6", "", { "peerDependencies": { "@tiptap/extensions": "3.23.6" } }, "sha512-wbKmxXsszxWacEkrHucRpSQbiKjz4fmOebD6OVyL9AcrmlbxNk8vcM3iyh/8cVeRy09XY+morM165t/u7/z4IQ=="],
 
-    "@tiptap/extension-hard-break": ["@tiptap/extension-hard-break@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-QAdCvNO4+yW9ATwsrej11NTkDYFqPLIEQr3ARNrKOK1qaiS7A0fia2SEukb/hrkP3A6mbozhoQt2r2RGUf/DpQ=="],
+    "@tiptap/extension-hard-break": ["@tiptap/extension-hard-break@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-KeUm+tkUfIVSX9QM9XOIhaay0Fn36sLKUo5NVYjN3uJaxFvaZXZmTlxdO85OTdgF2P5sqh9LomrIgliaFRGk4w=="],
 
-    "@tiptap/extension-heading": ["@tiptap/extension-heading@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-rk5VHMAeQcg06SLauN6EGdD2jc0O2qY8QkZYPd0LxNvLblw2BxBx+lxUQSYwLAT9Ie5914gKIK2YbRyO2Ts3ig=="],
+    "@tiptap/extension-heading": ["@tiptap/extension-heading@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-A/0jPhxnUh9THSZymlu0OGPZe1wdFdwHAXnRCmqvYUCwJjrG7LCC/ahzmcj1tcNzI9hgHyuYPSfev8RXYrNu/w=="],
 
-    "@tiptap/extension-horizontal-rule": ["@tiptap/extension-horizontal-rule@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-YnHGy2KShRwvCseAmmxl9VP7R0qaj8QMp3DA6DJWZqp7r5gLGvDkAqhedxqqefqsE4Y43hjkBdjtB9Ce78LkIw=="],
+    "@tiptap/extension-horizontal-rule": ["@tiptap/extension-horizontal-rule@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-hEUlz4H+I64r+TH6LCuNCRgO7JTHncXGmx9+WbU69EOfY8O0ZurcgeJc8HeiAKL+r9YuC1e5YHfFxgCaaC0jlg=="],
 
-    "@tiptap/extension-italic": ["@tiptap/extension-italic@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-ibGvdvAPyfxBMUVNRI43eb9h2/Jka1MRG5GtnGqbcCX/2+Y/y0EOfFrPQPkuYphiWQYyu9+FzPKMB/pjuaLuKQ=="],
+    "@tiptap/extension-italic": ["@tiptap/extension-italic@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-wol5KdwCPAvpiYhH9PLlvO8ZnJHwZtIboVevrfOGgBcKlXRA3dedR4OAMXHnUtkkzu9KtliLg1+TYzEx4JZG9Q=="],
 
-    "@tiptap/extension-link": ["@tiptap/extension-link@3.31.3", "", { "dependencies": { "linkifyjs": "^4.3.3" }, "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-986wOQzTL9Zr5lf84LCLpm+YOms8A0K39/8DVoqRfebqcOe0/eq4bnztmAlfabOd+kJY92g3AgZERFUx/w+dcw=="],
+    "@tiptap/extension-link": ["@tiptap/extension-link@3.23.6", "", { "dependencies": { "linkifyjs": "^4.3.3" }, "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-KNZz7z7P2/qbQsx5bPAbSPjrKDg1VHsedGlLHJCr8U2VRD5VgmDLkMpkouP1CsDg15qgyUKv/nDib5KgPpLNWA=="],
 
-    "@tiptap/extension-list": ["@tiptap/extension-list@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-LoveGnC0FVdCV4jUNBaG1ZA+KWE07+adzV3kGy6uUYFcJEjbVUHTnPDrBOob3IwOSO3sCwIkvQb6EVYeXn/4yg=="],
+    "@tiptap/extension-list": ["@tiptap/extension-list@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-z6vj9+Qht2sjdQkyyHcUpsC/yCIZqTrQiyHDhs/HGKrfvoANyAZGpqdNeKf1wSyjIso+27tQuIH5NDfk8ygyNw=="],
 
-    "@tiptap/extension-list-item": ["@tiptap/extension-list-item@3.31.3", "", { "peerDependencies": { "@tiptap/extension-list": "3.31.3" } }, "sha512-4QlKOriJJMvg95QJTEsy9BUYPBQ6UvJyb8WURRwdUtQUkkqb8h32lg/eyQUv2FzW9IT1AdUyNZfVaxH64kRfQA=="],
+    "@tiptap/extension-list-item": ["@tiptap/extension-list-item@3.23.6", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.6" } }, "sha512-3zzyhdkUWcHVpXuvy6KiIwjh29rbH6gEDEqPQqHLrl1XGnO9pnShC7pSHctlCDjmcx3O4n9cd4QMtVBlUerbiA=="],
 
-    "@tiptap/extension-list-keymap": ["@tiptap/extension-list-keymap@3.31.3", "", { "peerDependencies": { "@tiptap/extension-list": "3.31.3" } }, "sha512-If8UOEdDZbPJU6iYTvLtH6DOp2KBy6BKxg9UELL1AevVetGHEF/7lW8hP50Gn1tHMVpPRqmhSzVrJRpEJJgb/Q=="],
+    "@tiptap/extension-list-keymap": ["@tiptap/extension-list-keymap@3.23.6", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.6" } }, "sha512-x8bPcLViGzg/RAmQM/XtmfqIwQ/Pv9Q8mkd+OgfUiTqjeJqKwVQmiqbLFNa7zw81+H61M+HDU+qGAaQ3vRIMjw=="],
 
-    "@tiptap/extension-ordered-list": ["@tiptap/extension-ordered-list@3.31.3", "", { "peerDependencies": { "@tiptap/extension-list": "3.31.3" } }, "sha512-mp3g11NgA/PYu8rj7J7Ez3l4qBy6WfTSmHIG4PZvEGG5w2oUAIkgb9DU7nPPzjmeme27oazFYZw+AtZA0+u4tw=="],
+    "@tiptap/extension-ordered-list": ["@tiptap/extension-ordered-list@3.23.6", "", { "peerDependencies": { "@tiptap/extension-list": "3.23.6" } }, "sha512-1m/wWB/ZtXcmG2vNdiUkCqsOgqv5vBjCv/mVaHhF9OvV+zQS8YDjoWE7zEuT/GgELdT77Xq8lHrn4nCDudB3/A=="],
 
-    "@tiptap/extension-paragraph": ["@tiptap/extension-paragraph@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-+iPku7wJfy5hbNDNLX8dveFtYVsZMmh7vztjuq8hT3mipSC4IByDehDbU8fzUCjfXiEzmI7mQn7c8LGmHULuzA=="],
+    "@tiptap/extension-paragraph": ["@tiptap/extension-paragraph@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-+7m58LUSncodjrIyXks4RZ3tLNYrvgT77wRR4l3HnM5OABY3GDsDTqi7c1t1yI29NVOSk/DUacqy6UwYAj1DGg=="],
 
-    "@tiptap/extension-strike": ["@tiptap/extension-strike@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-G29bhKttYwcKHT+BI6emWVFol3RO/gUXxQVcmr/iT8LXXy7j8J6HFUnsKM+Kg5YlP1rxMRgsa65dbrQVahZi0A=="],
+    "@tiptap/extension-strike": ["@tiptap/extension-strike@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-oF7FEZ37f15aCe5kPgzGDYf/m+hr7VdQ/Ko/Hds/UM9pX7AG1fdtmRrl6wqkRqDM/incZaC/AQR2/Dpo2VCNGQ=="],
 
-    "@tiptap/extension-table": ["@tiptap/extension-table@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-7cnVPHhdiGGeauYqca6JVyPLTqZbqFEEk9nn2e2E8+fBo6zVtV07AktJBqth/XEzjZxcUmGxjoeuWYAisWjUHg=="],
+    "@tiptap/extension-table": ["@tiptap/extension-table@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-XbhZXjhsS6AP7ThoZxjAnNs+NiR81YRori25l6E+ORqB7quiPkIXOAi5h4AIpkn/CYIqze6ere11lWsYpDjtaQ=="],
 
-    "@tiptap/extension-table-cell": ["@tiptap/extension-table-cell@3.31.3", "", { "peerDependencies": { "@tiptap/extension-table": "3.31.3" } }, "sha512-5nueKR/p/IX6B4etWqHjyRsjNfDf6dJZaRgfw1/1l90CJe2h3tTZk4JbUKWN3Mo4FzZuYKzmU3fxcZ8pSVOeJQ=="],
+    "@tiptap/extension-table-cell": ["@tiptap/extension-table-cell@3.23.6", "", { "peerDependencies": { "@tiptap/extension-table": "3.23.6" } }, "sha512-hS9TmmvRlT9/ikT+0ukACS+hmJuii4zQaH47cg3oJkz/Fv7O7tL7GZniKtK6l2OUZGPhY+4SV2RkDB6bD7DXfw=="],
 
-    "@tiptap/extension-table-header": ["@tiptap/extension-table-header@3.31.3", "", { "peerDependencies": { "@tiptap/extension-table": "3.31.3" } }, "sha512-sstVtNQiBYX4P16vlhwBYPsthxDnodHWQfGq0EUQM40Z7H796Lgh9t1qYtu8yARQuHKzvINRwJCSy6DZ8YTDtQ=="],
+    "@tiptap/extension-table-header": ["@tiptap/extension-table-header@3.23.6", "", { "peerDependencies": { "@tiptap/extension-table": "3.23.6" } }, "sha512-D6o0a1cJXUU0xWakainBFGPnGHinQkPcdu1YqGd/PoFANY38lnuZt/NW2O/OLfLXu5LXDRfpqF1+dsKww27dUA=="],
 
-    "@tiptap/extension-table-row": ["@tiptap/extension-table-row@3.31.3", "", { "peerDependencies": { "@tiptap/extension-table": "3.31.3" } }, "sha512-up6tDK+hYVTFDeJ3XqKO0WJqBzyXNfGxMoimo5h83jrq9dcNh0oPCOzglZ7rdo8GH9I3VJ2fNKxxU2Eg2HcMoQ=="],
+    "@tiptap/extension-table-row": ["@tiptap/extension-table-row@3.23.6", "", { "peerDependencies": { "@tiptap/extension-table": "3.23.6" } }, "sha512-OauWVzkyRQg0rKOqM/a3PuKPc1S7YXMb1LRN7Nh8Ytvglvd7GFRTbl1lVqdZRaz4Jzopag4PQnriIZfMPUpxWw=="],
 
-    "@tiptap/extension-text": ["@tiptap/extension-text@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-gdsWtF+taeaCu6V+5Ct10fGo0ACUy1GnYtbb+mcathBt8OqbT+Ws60p/yEmKesBDz2Hn+B5IcWy6+2BBZl5ZTg=="],
+    "@tiptap/extension-text": ["@tiptap/extension-text@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-ipoC2TkIAIOTiF5ByiGgvQB1DqDyfP90wrUB3mohBcgvp7lQnwHszCDGv8dNnmcUek8uXV/uoLu2VXeVQlxjPA=="],
 
-    "@tiptap/extension-text-align": ["@tiptap/extension-text-align@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-26BJ7c28EyvHzJovNpuenKiIgfRI4KsT/OjBB00y58MyZ0kRXc6dwZVclw8y66clupKTLTWYCDUsy0P/xHj+cA=="],
+    "@tiptap/extension-text-align": ["@tiptap/extension-text-align@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-pE+gDmvnrSMWHADDnDSzaO7YUi9kOywQkyrqZ9bEPLddZred7ICoJ4NtD2DqLjDSur+HijaJuByResWb78c6FA=="],
 
-    "@tiptap/extension-underline": ["@tiptap/extension-underline@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3" } }, "sha512-HghdJaOwRqYzsAxqSyNyb+IWyOMcdCl8IoiBETA9BZCJAqdXzFLcuWp7CqCqJPam9dgkWosSoHqTCAO4nTBfpw=="],
+    "@tiptap/extension-underline": ["@tiptap/extension-underline@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6" } }, "sha512-P55wGIZGYTVH92Fq0cgI4/O9AhLCaJC3hhxg15RSERP5/YegM9eJHDK/GQ1EE/DvYA+xpYGOV6agKwAUqfA/Iw=="],
 
-    "@tiptap/extensions": ["@tiptap/extensions@3.31.3", "", { "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-8sJNPGGUe8f3aDojcOW5cfVL7I5NrBbE0UWxG08qoi9Tea6qWbvQJsCR9tsrOapr/DaLr3kpbGZ9s1gEEfcNcA=="],
+    "@tiptap/extensions": ["@tiptap/extensions@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-X09/Db1teB+ifXzDGVVFmOeQRx7wTAayE9/280spxpsHkHZvJ5bHRvWIzUzviMIjbBz+NPDIKYPK7gMfh9iaig=="],
 
-    "@tiptap/pm": ["@tiptap/pm@3.31.3", "", { "dependencies": { "prosemirror-changeset": "^2.4.1", "prosemirror-commands": "^1.7.1", "prosemirror-dropcursor": "^1.8.2", "prosemirror-gapcursor": "^1.4.1", "prosemirror-history": "^1.5.0", "prosemirror-inputrules": "^1.5.1", "prosemirror-keymap": "^1.2.3", "prosemirror-model": "^1.25.11", "prosemirror-schema-list": "^1.5.1", "prosemirror-state": "^1.4.4", "prosemirror-tables": "^1.8.5", "prosemirror-transform": "^1.12.0", "prosemirror-view": "^1.42.3" } }, "sha512-sZime0SWsz/k62W2WvHx5Ig7G2h7kVhrrmnqy+wEgIHfDwEfOlelRjaWCiBCFlF7dxGUntJusCh9FxlLhni0Ag=="],
+    "@tiptap/pm": ["@tiptap/pm@3.23.6", "", { "dependencies": { "prosemirror-changeset": "^2.3.0", "prosemirror-commands": "^1.6.2", "prosemirror-dropcursor": "^1.8.1", "prosemirror-gapcursor": "^1.3.2", "prosemirror-history": "^1.4.1", "prosemirror-keymap": "^1.2.2", "prosemirror-model": "^1.24.1", "prosemirror-schema-list": "^1.5.0", "prosemirror-state": "^1.4.3", "prosemirror-tables": "^1.6.4", "prosemirror-transform": "^1.10.2", "prosemirror-view": "^1.38.1" } }, "sha512-in5CaMaWlJcH2A1q6GJKFtrodE8WLS3M9tIi/f89jPmIVHJShpodC0KZDNyJkrVBQomYk0DEh86Utm6ASXzQww=="],
 
-    "@tiptap/react": ["@tiptap/react@3.31.3", "", { "dependencies": { "@types/use-sync-external-store": "^0.0.6", "fast-equals": "^5.3.3", "use-sync-external-store": "^1.4.0" }, "optionalDependencies": { "@tiptap/extension-bubble-menu": "^3.31.3", "@tiptap/extension-floating-menu": "^3.31.3" }, "peerDependencies": { "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3", "@types/react": "^17.0.0 || ^18.0.0 || ^19.0.0", "@types/react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0", "react": "^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-QiwQqvaLFLm5EMFu5tg7nAgXJxCUiUTLD8EsK+TqVV5P4bqOoMOCM39khbhXTJyahCuYpiFWx5YOSDtC/JiPtg=="],
+    "@tiptap/react": ["@tiptap/react@3.23.6", "", { "dependencies": { "@types/use-sync-external-store": "^0.0.6", "fast-equals": "^5.3.3", "use-sync-external-store": "^1.4.0" }, "optionalDependencies": { "@tiptap/extension-bubble-menu": "^3.23.6", "@tiptap/extension-floating-menu": "^3.23.6" }, "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6", "@types/react": "^17.0.0 || ^18.0.0 || ^19.0.0", "@types/react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0", "react": "^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-Tw9KZkYqFMk3vaJAEQKqEYIO/iq3cSJe7OUEGBul4k4GaMQeLItLf5EYhUd0GIPXci1WVVPNntKJsHfX25M37w=="],
 
-    "@tiptap/starter-kit": ["@tiptap/starter-kit@3.31.3", "", { "dependencies": { "@tiptap/core": "3.31.3", "@tiptap/extension-blockquote": "3.31.3", "@tiptap/extension-bold": "3.31.3", "@tiptap/extension-bullet-list": "3.31.3", "@tiptap/extension-code": "3.31.3", "@tiptap/extension-code-block": "3.31.3", "@tiptap/extension-document": "3.31.3", "@tiptap/extension-dropcursor": "3.31.3", "@tiptap/extension-gapcursor": "3.31.3", "@tiptap/extension-hard-break": "3.31.3", "@tiptap/extension-heading": "3.31.3", "@tiptap/extension-horizontal-rule": "3.31.3", "@tiptap/extension-italic": "3.31.3", "@tiptap/extension-link": "3.31.3", "@tiptap/extension-list": "3.31.3", "@tiptap/extension-list-item": "3.31.3", "@tiptap/extension-list-keymap": "3.31.3", "@tiptap/extension-ordered-list": "3.31.3", "@tiptap/extension-paragraph": "3.31.3", "@tiptap/extension-strike": "3.31.3", "@tiptap/extension-text": "3.31.3", "@tiptap/extension-underline": "3.31.3", "@tiptap/extensions": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-WKof9RewdmGHvWJ1wn0/HVNG2mV+HOgVRyJkKekuM9fgr6BZAAH/xZsWE1eon+94JnQ+KtK2ThydXQM/qc6b2A=="],
+    "@tiptap/starter-kit": ["@tiptap/starter-kit@3.23.6", "", { "dependencies": { "@tiptap/core": "^3.23.6", "@tiptap/extension-blockquote": "^3.23.6", "@tiptap/extension-bold": "^3.23.6", "@tiptap/extension-bullet-list": "^3.23.6", "@tiptap/extension-code": "^3.23.6", "@tiptap/extension-code-block": "^3.23.6", "@tiptap/extension-document": "^3.23.6", "@tiptap/extension-dropcursor": "^3.23.6", "@tiptap/extension-gapcursor": "^3.23.6", "@tiptap/extension-hard-break": "^3.23.6", "@tiptap/extension-heading": "^3.23.6", "@tiptap/extension-horizontal-rule": "^3.23.6", "@tiptap/extension-italic": "^3.23.6", "@tiptap/extension-link": "^3.23.6", "@tiptap/extension-list": "^3.23.6", "@tiptap/extension-list-item": "^3.23.6", "@tiptap/extension-list-keymap": "^3.23.6", "@tiptap/extension-ordered-list": "^3.23.6", "@tiptap/extension-paragraph": "^3.23.6", "@tiptap/extension-strike": "^3.23.6", "@tiptap/extension-text": "^3.23.6", "@tiptap/extension-underline": "^3.23.6", "@tiptap/extensions": "^3.23.6", "@tiptap/pm": "^3.23.6" } }, "sha512-gykwtGWrnWCmtql1hid3opac/KV8zQvOAnu3bTqIqcHrn1FusbUwKmNzavSbfGvcktHM3hFjb35W48JyVLyu/A=="],
 
-    "@tiptap/suggestion": ["@tiptap/suggestion@3.31.3", "", { "peerDependencies": { "@floating-ui/dom": "^1.0.0", "@tiptap/core": "3.31.3", "@tiptap/pm": "3.31.3" } }, "sha512-z1OQ/Yx6seMZehi1AcmNkyJ8qkHQzybArmCyRdmreS4YL9C4bPMBe5lbMfFsArYs+KD5JyHwps5j7J/YE5BIuw=="],
+    "@tiptap/suggestion": ["@tiptap/suggestion@3.23.6", "", { "peerDependencies": { "@tiptap/core": "3.23.6", "@tiptap/pm": "3.23.6" } }, "sha512-YAoI2jctPClcyUhIcpxb1QlrUFG2a1Xsv1gS4tIfgh5KoOuEfGfCoeCq89TKgz/rHeP+ktRhzg1E2E4EY68HEA=="],
 
     "@ts-graphviz/adapter": ["@ts-graphviz/adapter@2.0.6", "", { "dependencies": { "@ts-graphviz/common": "^2.1.5" } }, "sha512-kJ10lIMSWMJkLkkCG5gt927SnGZcBuG0s0HHswGzcHTgvtUe7yk5/3zTEr0bafzsodsOq5Gi6FhQeV775nC35Q=="],
 
@@ -735,31 +707,31 @@
 
     "@ts-graphviz/core": ["@ts-graphviz/core@2.0.7", "", { "dependencies": { "@ts-graphviz/ast": "^2.0.7", "@ts-graphviz/common": "^2.1.5" } }, "sha512-w071DSzP94YfN6XiWhOxnLpYT3uqtxJBDYdh6Jdjzt+Ce6DNspJsPQgpC7rbts/B8tEkq0LHoYuIF/O5Jh5rPg=="],
 
-    "@tybys/wasm-util": ["@tybys/wasm-util@0.10.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg=="],
+    "@tybys/wasm-util": ["@tybys/wasm-util@0.10.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg=="],
 
     "@types/aria-query": ["@types/aria-query@5.0.4", "", {}, "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw=="],
 
-    "@types/bun": ["@types/bun@1.4.0", "", { "dependencies": { "bun-types": "1.4.0" } }, "sha512-K+lZULY23vRgK/CfTjFIV+tyifaNdSMlPh9j+6mQ/cLfpOznLyAuzgV/JQysyECpkBQLVMSyvjlr2fBUSA9wFQ=="],
+    "@types/bun": ["@types/bun@1.3.13", "", { "dependencies": { "bun-types": "1.3.13" } }, "sha512-9fqXWk5YIHGGnUau9TEi+qdlTYDAnOj+xLCmSTwXfAIqXr2x4tytJb43E9uCvt09zJURKXwAtkoH4nLQfzeTXw=="],
 
     "@types/esrecurse": ["@types/esrecurse@4.3.1", "", {}, "sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw=="],
 
-    "@types/estree": ["@types/estree@1.0.9", "", {}, "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg=="],
+    "@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="],
 
     "@types/jsdom": ["@types/jsdom@30.0.0", "", { "dependencies": { "@types/node": "*", "@types/tough-cookie": "*", "parse5": "^8.0.0", "undici-types": "^8.9.0" } }, "sha512-uAHGxujGE0cDaKGdK28zgDotFtNA7MKq5DXl8LrfdxdCI8VHcg15oJz+amHTChPNI5JpgEPQWc2xFdrw3em/nQ=="],
 
     "@types/json-schema": ["@types/json-schema@7.0.15", "", {}, "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="],
 
-    "@types/node": ["@types/node@24.13.3", "", { "dependencies": { "undici-types": "~7.18.0" } }, "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q=="],
+    "@types/node": ["@types/node@24.12.2", "", { "dependencies": { "undici-types": "~7.16.0" } }, "sha512-A1sre26ke7HDIuY/M23nd9gfB+nrmhtYyMINbjI1zHJxYteKR6qSMX56FsmjMcDb3SMcjJg5BiRRgOCC/yBD0g=="],
 
     "@types/normalize-package-data": ["@types/normalize-package-data@2.4.4", "", {}, "sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA=="],
 
-    "@types/react": ["@types/react@19.2.18", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-AnzbBERsrLKtk2XSfTbYRLjQPdy116Sty4q+T+Bp3IC4l6jNBvreVPAHmpq9qhXQM7CXZPjLVmGMw9sy+hxQ3w=="],
+    "@types/react": ["@types/react@19.2.14", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w=="],
 
-    "@types/react-dom": ["@types/react-dom@19.2.7", "", { "peerDependencies": { "@types/react": "^19.2.0" } }, "sha512-I8bPpDLcHBv1qiIiXDCy71Rt8eQDKJP0sMSWJphDdAcdqiJ1sGpZamavoEIRZmYzjia9LuEb2HlYdDpmoENpvQ=="],
+    "@types/react-dom": ["@types/react-dom@19.2.3", "", { "peerDependencies": { "@types/react": "^19.2.0" } }, "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ=="],
 
     "@types/sarif": ["@types/sarif@2.1.7", "", {}, "sha512-kRz0VEkJqWLf1LLVN4pT1cg1Z9wAuvI6L97V3m2f5B76Tg8d413ddvLBPTEHAZJlnn4XSvu0FkZtViCQGVyrXQ=="],
 
-    "@types/semver": ["@types/semver@7.8.0", "", {}, "sha512-1mAINjtQCXXeLkJ9ehXkwOcBpqtLxiVtKhpUf83DdRNdQKV0iXZpaHYqRr7nj+wvxuJzoAmAwXI+sCNMv1CzLQ=="],
+    "@types/semver": ["@types/semver@7.7.1", "", {}, "sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA=="],
 
     "@types/tough-cookie": ["@types/tough-cookie@4.0.5", "", {}, "sha512-/Ad8+nIOV7Rl++6f1BdKxFSMgmoqEoYbHRpPcx3JEfv8VRsQe9Z4mCXeJBzxs7mbHY/XOZZuXlRNfhpVPbs6ZA=="],
 
@@ -771,41 +743,41 @@
 
     "@types/ws": ["@types/ws@8.18.1", "", { "dependencies": { "@types/node": "*" } }, "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg=="],
 
-    "@typescript-eslint/eslint-plugin": ["@typescript-eslint/eslint-plugin@8.69.0", "", { "dependencies": { "@eslint-community/regexpp": "^4.12.2", "@typescript-eslint/scope-manager": "8.69.0", "@typescript-eslint/type-utils": "8.69.0", "@typescript-eslint/utils": "8.69.0", "@typescript-eslint/visitor-keys": "8.69.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "@typescript-eslint/parser": "^8.69.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-t5jQTKPIgVW1PE6dR6H6Qz5gm8zjMlX5/2gRaOGd9eO6V7J+tQc6iWKukEe7dY8u9HyYasQ0yfF0/FSSTEO2gA=="],
+    "@typescript-eslint/eslint-plugin": ["@typescript-eslint/eslint-plugin@8.59.1", "", { "dependencies": { "@eslint-community/regexpp": "^4.12.2", "@typescript-eslint/scope-manager": "8.59.1", "@typescript-eslint/type-utils": "8.59.1", "@typescript-eslint/utils": "8.59.1", "@typescript-eslint/visitor-keys": "8.59.1", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "@typescript-eslint/parser": "^8.59.1", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-BOziFIfE+6osHO9FoJG4zjoHUcvI7fTNBSpdAwrNH0/TLvzjsk2oo8XSSOT2HhqUyhZPfHv4UOffoJ9oEEQ7Ag=="],
 
-    "@typescript-eslint/parser": ["@typescript-eslint/parser@8.69.0", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.69.0", "@typescript-eslint/types": "8.69.0", "@typescript-eslint/typescript-estree": "8.69.0", "@typescript-eslint/visitor-keys": "8.69.0", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-l4b0DhWioGg6Gt2ebGlvfkFMOjRsauxtsnDRwUSRX1qHq3HdTfQHV8wW9zEXeciai6HfeaKOedQn2Zoofx3WBw=="],
+    "@typescript-eslint/parser": ["@typescript-eslint/parser@8.59.1", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.59.1", "@typescript-eslint/types": "8.59.1", "@typescript-eslint/typescript-estree": "8.59.1", "@typescript-eslint/visitor-keys": "8.59.1", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-HDQH9O/47Dxi1ceDhBXdaldtf/WV9yRYMjbjCuNk3qnaTD564qwv61Y7+gTxwxRKzSrgO5uhtw584igXVuuZkA=="],
 
-    "@typescript-eslint/project-service": ["@typescript-eslint/project-service@8.69.0", "", { "dependencies": { "@typescript-eslint/tsconfig-utils": "^8.69.0", "@typescript-eslint/types": "^8.69.0", "debug": "^4.4.3" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-yi4obFrHMmnsesWehHbkg9zMA7Jt8cXT+mKM08G999pH1yT6nqgsHx7MYm0uY1wAj8CqiBXYRJ7WAT0QdQHQXg=="],
+    "@typescript-eslint/project-service": ["@typescript-eslint/project-service@8.59.1", "", { "dependencies": { "@typescript-eslint/tsconfig-utils": "^8.59.1", "@typescript-eslint/types": "^8.59.1", "debug": "^4.4.3" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-+MuHQlHiEr00Of/IQbE/MmEoi44znZHbR/Pz7Opq4HryUOlRi+/44dro9Ycy8Fyo+/024IWtw8m4JUMCGTYxDg=="],
 
-    "@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.69.0", "", { "dependencies": { "@typescript-eslint/types": "8.69.0", "@typescript-eslint/visitor-keys": "8.69.0" } }, "sha512-ewfspqWvSxKSOaplqAUNbaSFO0eB6w1EtQ+esfYFRm3614Ty4uNtExkcbgd6nWsXphbqKyf9ZYdbZdv2xEoWEQ=="],
+    "@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.59.1", "", { "dependencies": { "@typescript-eslint/types": "8.59.1", "@typescript-eslint/visitor-keys": "8.59.1" } }, "sha512-LwuHQI4pDOYVKvmH2dkaJo6YZCSgouVgnS/z7yBPKBMvgtBvyLqiLy9Z6b7+m/TRcX1NFYUqZetI5Y+aT4GEfg=="],
 
-    "@typescript-eslint/tsconfig-utils": ["@typescript-eslint/tsconfig-utils@8.69.0", "", { "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-xNqK7YTDZsLniQMV/4rpFR8Z5JlqeRvVjuG1YgF/mdPVH84HSD19L8CczMA0qg2RfwEV231GHH3VnToJDo4MfQ=="],
+    "@typescript-eslint/tsconfig-utils": ["@typescript-eslint/tsconfig-utils@8.59.1", "", { "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-/0nEyPbX7gRsk0Uwfe4ALwwgxuA66d/l2mhRDNlAvaj4U3juhUtJNq0DsY8M2AYwwb9rEq2hrC3IcIcEt++iJA=="],
 
-    "@typescript-eslint/type-utils": ["@typescript-eslint/type-utils@8.69.0", "", { "dependencies": { "@typescript-eslint/types": "8.69.0", "@typescript-eslint/typescript-estree": "8.69.0", "@typescript-eslint/utils": "8.69.0", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-ZfoJAVg3JZndQEpEl9petVlxau3lRuElc4HRMuAlLCf8to04/iHz692RUSNmXKDjEuJmIL+KZ2/BsOcBc16dsA=="],
+    "@typescript-eslint/type-utils": ["@typescript-eslint/type-utils@8.59.1", "", { "dependencies": { "@typescript-eslint/types": "8.59.1", "@typescript-eslint/typescript-estree": "8.59.1", "@typescript-eslint/utils": "8.59.1", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-klWPBR2ciQHS3f++ug/mVnWKPjBUo7icEL3FAO1lhAR1Z1i5NQYZ1EannMSRYcq5qCv5wNALlXr6fksRHyYl7w=="],
 
-    "@typescript-eslint/types": ["@typescript-eslint/types@8.69.0", "", {}, "sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA=="],
+    "@typescript-eslint/types": ["@typescript-eslint/types@8.60.0", "", {}, "sha512-AsE7x2XaAK+CVbeih0Fvbn+r1qHxtpLDJ3XUuFcIinT318T90yHMJC+Zgv+jUuDjQQd06HKwxnDu6sz1IcTilA=="],
 
-    "@typescript-eslint/typescript-estree": ["@typescript-eslint/typescript-estree@8.69.0", "", { "dependencies": { "@typescript-eslint/project-service": "8.69.0", "@typescript-eslint/tsconfig-utils": "8.69.0", "@typescript-eslint/types": "8.69.0", "@typescript-eslint/visitor-keys": "8.69.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", "tinyglobby": "^0.2.15", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-AdFkgqck3Vudb/kWnxlyafU/4aBhHrbQ9locP2N4psXTy5mOBg0SHJumnLvx7r6g1gV4DKvUFwV2nJZBoqOD8w=="],
+    "@typescript-eslint/typescript-estree": ["@typescript-eslint/typescript-estree@8.59.1", "", { "dependencies": { "@typescript-eslint/project-service": "8.59.1", "@typescript-eslint/tsconfig-utils": "8.59.1", "@typescript-eslint/types": "8.59.1", "@typescript-eslint/visitor-keys": "8.59.1", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", "tinyglobby": "^0.2.15", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-OUd+vJS05sSkOip+BkZ/2NS8RMxrAAJemsC6vU3kmfLyeaJT0TftHkV9mcx2107MmsBVXXexhVu4F0TZXyMl4g=="],
 
-    "@typescript-eslint/utils": ["@typescript-eslint/utils@8.69.0", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", "@typescript-eslint/scope-manager": "8.69.0", "@typescript-eslint/types": "8.69.0", "@typescript-eslint/typescript-estree": "8.69.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-tUbx60BBqQa31kXF5MCsOOLL5E/WzUuxIn7YpAvq+eaUlqvk8/NXnXMBNAdLCr0icjkzem7iUA5QqWHe/hJ1aw=="],
+    "@typescript-eslint/utils": ["@typescript-eslint/utils@8.59.1", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", "@typescript-eslint/scope-manager": "8.59.1", "@typescript-eslint/types": "8.59.1", "@typescript-eslint/typescript-estree": "8.59.1" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-3pIeoXhCeYH9FSCBI8P3iNwJlGuzPlYKkTlen2O9T1DSeeg8UG8jstq6BLk+Mda0qup7mgk4z4XL4OzRaxZ8LA=="],
 
-    "@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.69.0", "", { "dependencies": { "@typescript-eslint/types": "8.69.0", "eslint-visitor-keys": "^5.0.0" } }, "sha512-+rmdgPA+EXkNgKYvHvFfhrs35utXbwaC5PGpDquSXcoXQDKUA5UjV0LmTucG/4JXkM31BTu4TilHtrN8IVBe8w=="],
+    "@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.59.1", "", { "dependencies": { "@typescript-eslint/types": "8.59.1", "eslint-visitor-keys": "^5.0.0" } }, "sha512-LdDNl6C5iJExcM0Yh0PwAIBb9PrSiCsWamF/JyEZawm3kFDnRoaq3LGE4bpyRao/fWeGKKyw7icx0YxrLFC5Cg=="],
 
     "@use-gesture/core": ["@use-gesture/core@10.3.1", "", {}, "sha512-WcINiDt8WjqBdUXye25anHiNxPc0VOrlT8F6LLkU6cycrOGUDyY/yyFmsg3k8i5OLvv25llc0QC45GhR/C8llw=="],
 
     "@use-gesture/react": ["@use-gesture/react@10.3.1", "", { "dependencies": { "@use-gesture/core": "10.3.1" }, "peerDependencies": { "react": ">= 16.8.0" } }, "sha512-Yy19y6O2GJq8f7CHf7L0nxL8bf4PZCPaVOCgJrusOeFHY1LvHgYXnmnXg6N5iwAnbgbZCDjo60SiM6IPJi9C5g=="],
 
-    "@vitejs/plugin-react": ["@vitejs/plugin-react@6.1.1", "", { "dependencies": { "@rolldown/pluginutils": "^1.0.1" }, "peerDependencies": { "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0", "babel-plugin-react-compiler": "^1.0.0", "oxc-transform-react": "^0.145.0", "vite": "^8.0.0" }, "optionalPeers": ["@rolldown/plugin-babel", "babel-plugin-react-compiler", "oxc-transform-react"] }, "sha512-yxLaQV9gkhS8ezJqCM6+ndU7mDY6gqAg75NQ+0IjwEI8IYOmQCgkRwHKVSfWXW076DsqMo0Dk+0FK1U+M5RgFw=="],
+    "@vitejs/plugin-react": ["@vitejs/plugin-react@6.0.1", "", { "dependencies": { "@rolldown/pluginutils": "1.0.0-rc.7" }, "peerDependencies": { "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0", "babel-plugin-react-compiler": "^1.0.0", "vite": "^8.0.0" }, "optionalPeers": ["@rolldown/plugin-babel", "babel-plugin-react-compiler"] }, "sha512-l9X/E3cDb+xY3SWzlG1MOGt2usfEHGMNIaegaUGFsLkb3RCn/k8/TOXBcab+OndDI4TBtktT8/9BwwW8Vi9KUQ=="],
 
-    "@vue/compiler-core": ["@vue/compiler-core@3.5.42", "", { "dependencies": { "@babel/parser": "^7.29.8", "@vue/shared": "3.5.42", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-2Ye1ilMtKXxl8qZUrQ5j0CdgenFp/HFQmta6rfRyfEsTG69L6Wk+tWuNoHYHMx9E8tF2Slvdg1FuwDvAXdy1LQ=="],
+    "@vue/compiler-core": ["@vue/compiler-core@3.5.33", "", { "dependencies": { "@babel/parser": "^7.29.2", "@vue/shared": "3.5.33", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-3PZLQwFw4Za3TC8t0FvTy3wI16Kt+pmwcgNZca4Pj9iWL2E72a/gZlpBtAJvEdDMdCxdG/qq0C7PN0bsJuv0Rw=="],
 
-    "@vue/compiler-dom": ["@vue/compiler-dom@3.5.42", "", { "dependencies": { "@vue/compiler-core": "3.5.42", "@vue/shared": "3.5.42" } }, "sha512-qbhQZEFmycr+ni/qyuccS4sucNN7VAbDfbkvNxWOX2VfgFm90MNs3/UhRNKoPMEIVn0F8gdlYjLPvqxHwHeQOA=="],
+    "@vue/compiler-dom": ["@vue/compiler-dom@3.5.33", "", { "dependencies": { "@vue/compiler-core": "3.5.33", "@vue/shared": "3.5.33" } }, "sha512-PXq0yrfCLzzL07rbXO4awtXY1Z06LG2eu6Adg3RJFa/j3Cii217XxxLXG22N330gw7GmALCY0Z8RgXEviwgpjA=="],
 
-    "@vue/compiler-sfc": ["@vue/compiler-sfc@3.5.42", "", { "dependencies": { "@babel/parser": "^7.29.8", "@vue/compiler-core": "3.5.42", "@vue/compiler-dom": "3.5.42", "@vue/compiler-ssr": "3.5.42", "@vue/shared": "3.5.42", "estree-walker": "^2.0.2", "magic-string": "^0.30.21", "postcss": "^8.5.19", "source-map-js": "^1.2.1" } }, "sha512-fkCAFB4okcAANGMThboWnScp/gzWjU0ZSkVnjTIiplmMDq2uq0tIB3j+xVu4rhv5rvOgBySCysudmbMd6xRRqw=="],
+    "@vue/compiler-sfc": ["@vue/compiler-sfc@3.5.33", "", { "dependencies": { "@babel/parser": "^7.29.2", "@vue/compiler-core": "3.5.33", "@vue/compiler-dom": "3.5.33", "@vue/compiler-ssr": "3.5.33", "@vue/shared": "3.5.33", "estree-walker": "^2.0.2", "magic-string": "^0.30.21", "postcss": "^8.5.10", "source-map-js": "^1.2.1" } }, "sha512-UTUvRO9cY+rROrx/pvN9P5Z7FgA6QGfokUCfhQE4EnmUj3rVnK+CHI0LsEO1pg+I7//iRYMUfcNcCPe7tg0CoA=="],
 
-    "@vue/compiler-ssr": ["@vue/compiler-ssr@3.5.42", "", { "dependencies": { "@vue/compiler-dom": "3.5.42", "@vue/shared": "3.5.42" } }, "sha512-xmLk3wLkbizPAiLyomjgFFosf2ys9b5Ghb+oh/k2tnvipNz8OFrQOiTcWCzyK7MpBp9KkyGtfvgfLUivbmuGYA=="],
+    "@vue/compiler-ssr": ["@vue/compiler-ssr@3.5.33", "", { "dependencies": { "@vue/compiler-dom": "3.5.33", "@vue/shared": "3.5.33" } }, "sha512-IErjYdnj1qIupG5xxiVIYiiRvDhGWV4zuh/RCrwfYpuL+HWQzeU6lCk/nF9r7olWMnjKxCAkOctT2qFWFkzb1A=="],
 
-    "@vue/shared": ["@vue/shared@3.5.42", "", {}, "sha512-2rPxex1jQf4jvl9MOHl6YaXCPcrNqz/FstMOEh3QWY+/OME9nQTvl9WYeCwhW7AFjaR0SnngZGlp/wkR6rkI6g=="],
+    "@vue/shared": ["@vue/shared@3.5.33", "", {}, "sha512-5vR2QIlmaLG77Ygd4pMP6+SGQ5yox9VhtnbDWTy9DzMzdmeLxZ1QqxrywEZ9sa1AVubfIJyaCG3ytyWU81ufcQ=="],
 
     "acorn": ["acorn@8.16.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw=="],
 
@@ -841,21 +813,23 @@
 
     "assert-never": ["assert-never@1.4.0", "", {}, "sha512-5oJg84os6NMQNl27T9LnZkvvqzvAnHu03ShCnoj6bsJwS7L8AO4lf+C/XjK/nvzEqQB744moC6V128RucQd1jA=="],
 
-    "ast-module-types": ["ast-module-types@6.0.2", "", {}, "sha512-6KuK/7nZ/2Qh7sGuVEiwxjCxzTY2Pdb5mTo5z1e6/J8BA0tvjR7G8vQJKrQMTqwmnA3UPEyKIFX4YUS1DO1Hvw=="],
+    "ast-module-types": ["ast-module-types@6.0.1", "", {}, "sha512-WHw67kLXYbZuHTmcdbIrVArCq5wxo6NEuj3hiYAWr8mwJeC+C2mMCIBIWCiDoCye/OF/xelc+teJ1ERoWmnEIA=="],
 
     "astral-regex": ["astral-regex@2.0.0", "", {}, "sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ=="],
 
     "atomically": ["atomically@2.1.1", "", { "dependencies": { "stubborn-fs": "^2.0.0", "when-exit": "^2.1.4" } }, "sha512-P4w9o2dqARji6P7MHprklbfiArZAWvo07yW7qs3pdljb3BWr12FIB7W+p0zJiuiVsUpRO0iZn1kFFcpPegg0tQ=="],
 
+    "babel-plugin-react-compiler": ["babel-plugin-react-compiler@1.0.0", "", { "dependencies": { "@babel/types": "^7.26.0" } }, "sha512-Ixm8tFfoKKIPYdCCKYTsqv+Fd4IJ0DQqMyEimo+pxUOMUR9cVPlwTrFt9Avu+3cb6Zp3mAzl+t1MrG2fxxKsxw=="],
+
     "babel-walk": ["babel-walk@3.0.0-canary-5", "", { "dependencies": { "@babel/types": "^7.9.6" } }, "sha512-GAwkz0AihzY5bkwIY5QDR+LvsRQgB/B+1foMPvi0FZPMl5fjD7ICiznUiBdLYMH1QYe6vqu4gWYytZOccLouFw=="],
 
-    "badgen": ["badgen@3.3.2", "", {}, "sha512-fbQwK9norfdzbdsoPwbLIAmgBXDGEme3jeIyqPAH7o6vp9lmuLHS7uXULvOiQ6XnMLkYNG4gDjILf74hgtTAug=="],
+    "badgen": ["badgen@3.2.3", "", {}, "sha512-svDuwkc63E/z0ky3drpUppB83s/nlgDciH9m+STwwQoWyq7yCgew1qEfJ+9axkKdNq7MskByptWUN9j1PGMwFA=="],
 
     "balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
 
     "base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="],
 
-    "baseline-browser-mapping": ["baseline-browser-mapping@2.11.21", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-uh8vpY/1/YyFkunIDFH/12p7/7VdPKA1hejMVEbdkEaWnUz0Hesvx5EbiU6XxjyHZIOju+ZMbQJkRh+es3/spQ=="],
+    "baseline-browser-mapping": ["baseline-browser-mapping@2.10.27", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-zEs/ufmZoUd7WftKpKyXaT6RFxpQ5Qm9xytKRHvJfxFV9DFJkZph9RvJ1LcOUi0Z1ZVijMte65JbILeV+8QQEA=="],
 
     "bidi-js": ["bidi-js@1.0.3", "", { "dependencies": { "require-from-string": "^2.0.2" } }, "sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw=="],
 
@@ -869,17 +843,15 @@
 
     "boundary": ["boundary@2.0.0", "", {}, "sha512-rJKn5ooC9u8q13IMCrW0RSp31pxBCHE3y9V/tp3TdWSLf8Em3p6Di4NBpfzbJge9YjjFEsD0RtFEjtvHL5VyEA=="],
 
-    "brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
+    "brace-expansion": ["brace-expansion@5.0.5", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ=="],
 
     "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
 
-    "browserslist": ["browserslist@4.28.9", "", { "dependencies": { "baseline-browser-mapping": "^2.11.20", "caniuse-lite": "^1.0.30001810", "electron-to-chromium": "^1.5.420", "node-releases": "^2.0.54", "update-browserslist-db": "^1.3.2" }, "bin": { "browserslist": "cli.js" } }, "sha512-EWazOblFYUvlGZcfGhPUPmYh3nikUxBVb+y9MJun5f3hBi812X+8MSQTujLBtgK3cf51fJWbWfOjyeO954d+Eg=="],
+    "browserslist": ["browserslist@4.28.2", "", { "dependencies": { "baseline-browser-mapping": "^2.10.12", "caniuse-lite": "^1.0.30001782", "electron-to-chromium": "^1.5.328", "node-releases": "^2.0.36", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg=="],
 
     "buffer": ["buffer@5.7.1", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.1.13" } }, "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ=="],
 
-    "buffer-image-size": ["buffer-image-size@0.6.4", "", { "dependencies": { "@types/node": "*" } }, "sha512-nEh+kZOPY1w+gcCMobZ6ETUp9WfibndnosbpwB1iJk/8Gt5ZF2bhS6+B6bPYz424KtwsR6Rflc3tCz1/ghX2dQ=="],
-
-    "bun-types": ["bun-types@1.4.0", "", { "dependencies": { "@types/node": "*" } }, "sha512-iIKw23BspnQQYd3prITOBxeUsxBHnwzX6YJfGMuNOZzeNcMmVqzIIVGRm1l69ogaPQmb4wB6BN8mA5bE9YuC5Q=="],
+    "bun-types": ["bun-types@1.3.13", "", { "dependencies": { "@types/node": "*" } }, "sha512-QXKeHLlOLqQX9LgYaHJfzdBaV21T63HhFJnvuRCcjZiaUDpbs5ED1MgxbMra71CsryN/1dAoXuJJJwIv/2drVA=="],
 
     "bytes": ["bytes@3.1.2", "", {}, "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="],
 
@@ -887,14 +859,12 @@
 
     "call-bound": ["call-bound@1.0.4", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "get-intrinsic": "^1.3.0" } }, "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg=="],
 
-    "caniuse-lite": ["caniuse-lite@1.0.30001810", "", {}, "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg=="],
+    "caniuse-lite": ["caniuse-lite@1.0.30001791", "", {}, "sha512-yk0l/YSrOnFZk3UROpDLQD9+kC1l4meK/wed583AXrzoarMGJcbRi2Q4RaUYbKxYAsZ8sWmaSa/DsLmdBeI1vQ=="],
 
     "chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
 
     "character-parser": ["character-parser@2.2.0", "", { "dependencies": { "is-regex": "^1.0.3" } }, "sha512-+UqJQjFEFaTAs3bNsF2j2kEN1baG/zghZbdqoYEDxGZtJo9LBzl1A+m0D4n3qKx8N2FNv8/Xp6yV9mQmBuptaw=="],
 
-    "cjs-module-lexer": ["cjs-module-lexer@2.2.1", "", {}, "sha512-Ca8swihM+/4yKecYHY52kgJd300hi2lADU/a1RxNTRe+RJ9jvqQlESpbz9DnG9mowez8qwXHB8qYdIUw9e+F5Q=="],
-
     "cli-cursor": ["cli-cursor@3.1.0", "", { "dependencies": { "restore-cursor": "^3.1.0" } }, "sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw=="],
 
     "cli-spinners": ["cli-spinners@2.9.2", "", {}, "sha512-ywqV+5MmyL4E7ybXgKys4DugZbX0FC6LnwrhjuykIjnK9k8OQacQ7axGKnjDXWNhns0xot3bZI5h55H8yo9cJg=="],
@@ -915,13 +885,11 @@
 
     "conf": ["conf@15.1.0", "", { "dependencies": { "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "atomically": "^2.0.3", "debounce-fn": "^6.0.0", "dot-prop": "^10.0.0", "env-paths": "^3.0.0", "json-schema-typed": "^8.0.1", "semver": "^7.7.2", "uint8array-extras": "^1.5.0" } }, "sha512-Uy5YN9KEu0WWDaZAVJ5FAmZoaJt9rdK6kH+utItPyGsCqCgaTKkrmZx3zoE0/3q6S3bcp3Ihkk+ZqPxWxFK5og=="],
 
-    "confbox": ["confbox@0.2.4", "", {}, "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ=="],
-
     "constantinople": ["constantinople@4.0.1", "", { "dependencies": { "@babel/parser": "^7.6.0", "@babel/types": "^7.6.1" } }, "sha512-vCrqcSIq4//Gx74TXXCGnHpulY1dskqLTFGDmhrGxzeXL8lF8kvXv6mpNWlJj1uD4DW23D4ljAqbY4RRaaUZIw=="],
 
     "convert-source-map": ["convert-source-map@2.0.0", "", {}, "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg=="],
 
-    "crelt": ["crelt@1.0.7", "", {}, "sha512-aK6BbWfhf4U/wCcLHKPJl/xa6VkVstRaPywWtMKGwuOLc/wZTyQYuoxgvZnNsBvv7Kg3YTBQYYBCggcviQczuA=="],
+    "crelt": ["crelt@1.0.6", "", {}, "sha512-VQ2MBenTq1fWZUH9DJNGti7kKv6EeAuYr3cLwxUWhIu1baTaXh4Ib5W2CqHVqib4/MqbYGJqiL3Zb8GJZr3l4g=="],
 
     "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
 
@@ -943,13 +911,13 @@
 
     "defaults": ["defaults@1.0.4", "", { "dependencies": { "clone": "^1.0.2" } }, "sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A=="],
 
-    "dependency-cruiser": ["dependency-cruiser@17.4.3", "", { "dependencies": { "acorn": "8.16.0", "acorn-jsx": "5.3.2", "acorn-jsx-walk": "2.0.0", "acorn-loose": "8.5.2", "acorn-walk": "8.3.5", "commander": "14.0.3", "enhanced-resolve": "5.22.1", "ignore": "7.0.5", "interpret": "3.1.1", "is-installed-globally": "1.0.0", "json5": "2.2.3", "picomatch": "4.0.4", "prompts": "2.4.2", "rechoir": "0.8.0", "safe-regex": "2.1.1", "semver": "7.8.1", "tsconfig-paths-webpack-plugin": "4.2.0", "watskeburt": "5.0.3" }, "bin": { "depcruise": "bin/dependency-cruise.mjs", "depcruise-fmt": "bin/depcruise-fmt.mjs", "dependency-cruise": "bin/dependency-cruise.mjs", "depcruise-baseline": "bin/depcruise-baseline.mjs", "dependency-cruiser": "bin/dependency-cruise.mjs", "depcruise-wrap-stream-in-html": "bin/wrap-stream-in-html.mjs" } }, "sha512-L4GLuAvmXevWnPCIaFfOz6eD92c+yY+pDgVqgufrLDnW3xYA799CSZQlly2r2N13nhAlnZY6VzY7Rx5pHNvk2w=="],
+    "dependency-cruiser": ["dependency-cruiser@17.4.0", "", { "dependencies": { "acorn": "8.16.0", "acorn-jsx": "5.3.2", "acorn-jsx-walk": "2.0.0", "acorn-loose": "8.5.2", "acorn-walk": "8.3.5", "commander": "14.0.3", "enhanced-resolve": "5.21.0", "ignore": "7.0.5", "interpret": "3.1.1", "is-installed-globally": "1.0.0", "json5": "2.2.3", "picomatch": "4.0.4", "prompts": "2.4.2", "rechoir": "0.8.0", "safe-regex": "2.1.1", "semver": "7.7.4", "tsconfig-paths-webpack-plugin": "4.2.0", "watskeburt": "5.0.3" }, "bin": { "dependency-cruiser": "bin/dependency-cruise.mjs", "dependency-cruise": "bin/dependency-cruise.mjs", "depcruise": "bin/dependency-cruise.mjs", "depcruise-baseline": "bin/depcruise-baseline.mjs", "depcruise-fmt": "bin/depcruise-fmt.mjs", "depcruise-wrap-stream-in-html": "bin/wrap-stream-in-html.mjs" } }, "sha512-+WdFoOb+fT1XNC0iPqOyLpfhLd8xVh7eLXJxPAtiXCS+YmXzGrjqVTte7+L8SZIsnJj0aFhb8LxECIBJY5TTIA=="],
 
-    "dependency-tree": ["dependency-tree@11.5.0", "", { "dependencies": { "@discoveryjs/json-ext": "^1.1.0", "commander": "^12.1.0", "filing-cabinet": "^5.5.1", "precinct": "^12.3.2", "typescript": "^5.9.3" }, "bin": { "dependency-tree": "bin/cli.js" } }, "sha512-K9zBwKDZrot3RkxizugpVSdImxULAg4Ycp3+ydy2r561k96oiiw6nfsOR15fwNDQ5BF2UXe+2JFM/H5Xz4MGQg=="],
+    "dependency-tree": ["dependency-tree@11.4.3", "", { "dependencies": { "commander": "^12.1.0", "filing-cabinet": "^5.3.0", "precinct": "^12.3.1", "typescript": "^5.9.3" }, "bin": { "dependency-tree": "bin/cli.js" } }, "sha512-Y2gzOJ2Rb2X7MN6pT9llWpXxl5J5s5/11CBpJ5b85DjEqZH7jv3T9RO6HRV/PI/3MDmaKn/g7uoYdYmSb9vLlw=="],
 
     "dequal": ["dequal@2.0.3", "", {}, "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA=="],
 
-    "deslop-js": ["deslop-js@0.0.14", "", { "dependencies": { "@oxc-project/types": "^0.132.0", "fast-glob": "^3.3.3", "minimatch": "^10.2.5", "oxc-parser": "^0.132.0", "oxc-resolver": "^11.19.1", "typescript": "^6.0.3" } }, "sha512-FY0rNK+mdTozXwNmcJAt5tD9hVOkXEX5ac+Mg77KJvnnsoAh3qIUW64PMnofutjeYz7g1vENMbOcrBmD1v4FlA=="],
+    "deslop-js": ["deslop-js@0.0.13", "", { "dependencies": { "@oxc-project/types": "^0.132.0", "fast-glob": "^3.3.3", "minimatch": "^10.2.5", "oxc-parser": "^0.132.0", "oxc-resolver": "^11.19.1", "typescript": "^6.0.3" } }, "sha512-gIXD+wY2/NHkZHpNrb8MWS6NJs3ee0XunAenBCvwHJlWnedDbIrg70hdNR7bDzYZLe9LGJZMLEI1w2CC72Gk5A=="],
 
     "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
 
@@ -959,7 +927,7 @@
 
     "detective-es6": ["detective-es6@5.0.2", "", { "dependencies": { "node-source-walk": "^7.0.1" } }, "sha512-+qHHGYhjupiVs4rnIpI9nZ5B130A4AmE35ZX1w33hb46vcZ7T3jfDbvmPw0FhWtMHn5BS5HHu7ZtnZ53bMcXZA=="],
 
-    "detective-postcss": ["detective-postcss@8.0.4", "", { "dependencies": { "is-url-superb": "^4.0.0", "postcss-values-parser": "^6.0.2" }, "peerDependencies": { "postcss": "^8.4.47" } }, "sha512-DZ7M/hWPZyr17ZUdoQ+TVXaPj70mYr4XXrAE+GeJbca44haCvZgb191L/jLJmFYewhxRJuBd4lUtNSu986TXag=="],
+    "detective-postcss": ["detective-postcss@7.0.1", "", { "dependencies": { "is-url": "^1.2.4", "postcss-values-parser": "^6.0.2" }, "peerDependencies": { "postcss": "^8.4.47" } }, "sha512-bEOVpHU9picRZux5XnwGsmCN4+8oZo7vSW0O0/Enq/TO5R2pIAP2279NsszpJR7ocnQt4WXU0+nnh/0JuK4KHQ=="],
 
     "detective-sass": ["detective-sass@6.0.2", "", { "dependencies": { "gonzales-pe": "^4.3.0", "node-source-walk": "^7.0.1" } }, "sha512-i3xpXHDKS0qI2aFW4asQ7fqlPK00ndOVZELvQapFJCaF0VxYmsNWtd0AmvXbTLMk7bfO5VdIeorhY9KfmHVoVA=="],
 
@@ -975,9 +943,9 @@
 
     "dom-accessibility-api": ["dom-accessibility-api@0.5.16", "", {}, "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg=="],
 
-    "dompurify": ["dompurify@3.4.14", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-dVoH9z+MY+C9IilgGCk3YfFqjLi3fChm2OiKJMzh6axrJ5qwxqWaZamgmHrpv22CN/KdbZJuGEGgfQoL00LTdg=="],
+    "dompurify": ["dompurify@3.4.2", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-lHeS9SA/IKeIFFyYciHBr2n0v1VMPlSj843HdLOwjb2OxNwdq9Xykxqhk+FE42MzAdHvInbAolSE4mhahPpjXA=="],
 
-    "dot-prop": ["dot-prop@10.2.0", "", { "dependencies": { "type-fest": "^5.0.0" } }, "sha512-BTJ9aZYL3vCfZlZOBLy9v8TUqWGQ0pzFnygKwFZt5udj6viBoFIBviKPUoZLDCPn1FoXffv6McQFDenrm5Krfw=="],
+    "dot-prop": ["dot-prop@10.1.0", "", { "dependencies": { "type-fest": "^5.0.0" } }, "sha512-MVUtAugQMOff5RnBy2d9N31iG0lNwg1qAoAOn7pOK5wf94WIaE3My2p3uwTQuvS2AcqchkcR3bHByjaM0mmi7Q=="],
 
     "dunder-proto": ["dunder-proto@1.0.1", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.1", "es-errors": "^1.3.0", "gopd": "^1.2.0" } }, "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A=="],
 
@@ -985,13 +953,13 @@
 
     "effect": ["effect@4.0.0-beta.70", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "fast-check": "^4.8.0", "find-my-way-ts": "^0.1.6", "ini": "^7.0.0", "kubernetes-types": "^1.30.0", "msgpackr": "^2.0.1", "multipasta": "^0.2.7", "toml": "^4.1.1", "uuid": "^14.0.0", "yaml": "^2.9.0" } }, "sha512-8AwGTRiNriirHGEYHrOS0E9fzdhIqCdZjiHP1YXmNo2UyPGS43ILsymsSHT7V0DJS+8dvlKq2RxnrDBUhDNZHg=="],
 
-    "electron-to-chromium": ["electron-to-chromium@1.5.422", "", {}, "sha512-UvA/32XqrLDdZSn7Jllo1AYNcWji/G0d5M0GTViE7KoGBiMunw3a34Sb2KO4ZZyrSEhqsxFoVhWWJshdyfKqJA=="],
+    "electron-to-chromium": ["electron-to-chromium@1.5.349", "", {}, "sha512-QsWVGyRuY07Aqb234QytTfwd5d9AJlfNIQ5wIOl1L+PZDzI9d9+Fn0FRale/QYlFxt/bUnB0/nLd1jFPGxGK1A=="],
 
     "emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
 
     "end-of-stream": ["end-of-stream@1.4.5", "", { "dependencies": { "once": "^1.4.0" } }, "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg=="],
 
-    "enhanced-resolve": ["enhanced-resolve@5.22.1", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.3" } }, "sha512-6QEuw3zoX1SJQc7b87aBXke/no+mG2bTBgw29gWMQonLmpEkWoCAVkl+M49e48AZlWzxiDzDZzYdp6kobcyLww=="],
+    "enhanced-resolve": ["enhanced-resolve@5.21.0", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.3" } }, "sha512-otxSQPw4lkOZWkHpB3zaEQs6gWYEsmX4xQF68ElXC/TWvGxGMSGOvoNbaLXm6/cS/fSfHtsEdw90y20PCd+sCA=="],
 
     "entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
 
@@ -1003,11 +971,9 @@
 
     "es-errors": ["es-errors@1.3.0", "", {}, "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="],
 
-    "es-module-lexer": ["es-module-lexer@2.3.2", "", {}, "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw=="],
-
-    "es-object-atoms": ["es-object-atoms@1.1.2", "", { "dependencies": { "es-errors": "^1.3.0" } }, "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw=="],
+    "es-object-atoms": ["es-object-atoms@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0" } }, "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA=="],
 
-    "esbuild": ["esbuild@0.28.2", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.2", "@esbuild/android-arm": "0.28.2", "@esbuild/android-arm64": "0.28.2", "@esbuild/android-x64": "0.28.2", "@esbuild/darwin-arm64": "0.28.2", "@esbuild/darwin-x64": "0.28.2", "@esbuild/freebsd-arm64": "0.28.2", "@esbuild/freebsd-x64": "0.28.2", "@esbuild/linux-arm": "0.28.2", "@esbuild/linux-arm64": "0.28.2", "@esbuild/linux-ia32": "0.28.2", "@esbuild/linux-loong64": "0.28.2", "@esbuild/linux-mips64el": "0.28.2", "@esbuild/linux-ppc64": "0.28.2", "@esbuild/linux-riscv64": "0.28.2", "@esbuild/linux-s390x": "0.28.2", "@esbuild/linux-x64": "0.28.2", "@esbuild/netbsd-arm64": "0.28.2", "@esbuild/netbsd-x64": "0.28.2", "@esbuild/openbsd-arm64": "0.28.2", "@esbuild/openbsd-x64": "0.28.2", "@esbuild/openharmony-arm64": "0.28.2", "@esbuild/sunos-x64": "0.28.2", "@esbuild/win32-arm64": "0.28.2", "@esbuild/win32-ia32": "0.28.2", "@esbuild/win32-x64": "0.28.2" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA=="],
+    "esbuild": ["esbuild@0.28.0", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.0", "@esbuild/android-arm": "0.28.0", "@esbuild/android-arm64": "0.28.0", "@esbuild/android-x64": "0.28.0", "@esbuild/darwin-arm64": "0.28.0", "@esbuild/darwin-x64": "0.28.0", "@esbuild/freebsd-arm64": "0.28.0", "@esbuild/freebsd-x64": "0.28.0", "@esbuild/linux-arm": "0.28.0", "@esbuild/linux-arm64": "0.28.0", "@esbuild/linux-ia32": "0.28.0", "@esbuild/linux-loong64": "0.28.0", "@esbuild/linux-mips64el": "0.28.0", "@esbuild/linux-ppc64": "0.28.0", "@esbuild/linux-riscv64": "0.28.0", "@esbuild/linux-s390x": "0.28.0", "@esbuild/linux-x64": "0.28.0", "@esbuild/netbsd-arm64": "0.28.0", "@esbuild/netbsd-x64": "0.28.0", "@esbuild/openbsd-arm64": "0.28.0", "@esbuild/openbsd-x64": "0.28.0", "@esbuild/openharmony-arm64": "0.28.0", "@esbuild/sunos-x64": "0.28.0", "@esbuild/win32-arm64": "0.28.0", "@esbuild/win32-ia32": "0.28.0", "@esbuild/win32-x64": "0.28.0" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw=="],
 
     "escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="],
 
@@ -1015,13 +981,13 @@
 
     "escodegen": ["escodegen@2.1.0", "", { "dependencies": { "esprima": "^4.0.1", "estraverse": "^5.2.0", "esutils": "^2.0.2" }, "optionalDependencies": { "source-map": "~0.6.1" }, "bin": { "esgenerate": "bin/esgenerate.js", "escodegen": "bin/escodegen.js" } }, "sha512-2NlIDTwUWJN0mRPQOdtQBzbUHvdGY2P1VXSyU83Q3xKxM7WHX2Ql8dKq782Q9TgQUNOLEzEYu9bzLNj1q88I5w=="],
 
-    "eslint": ["eslint@10.9.1", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.8.0", "@eslint-community/regexpp": "^4.12.2", "@eslint/config-array": "^0.23.5", "@eslint/config-helpers": "^0.7.0", "@eslint/core": "^1.2.1", "@eslint/plugin-kit": "^0.7.2", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", "@humanwhocodes/retry": "^0.4.2", "@types/estree": "^1.0.6", "ajv": "^6.14.0", "cross-spawn": "^7.0.6", "debug": "^4.3.2", "escape-string-regexp": "^4.0.0", "eslint-scope": "^9.1.2", "eslint-visitor-keys": "^5.0.1", "espree": "^11.2.0", "esquery": "^1.7.0", "esutils": "^2.0.2", "fast-deep-equal": "^3.1.3", "file-entry-cache": "^8.0.0", "find-up": "^5.0.0", "glob-parent": "^6.0.2", "ignore": "^5.2.0", "imurmurhash": "^0.1.4", "is-glob": "^4.0.0", "json-stable-stringify-without-jsonify": "^1.0.1", "minimatch": "^10.2.5", "natural-compare": "^1.4.0", "optionator": "^0.9.3" }, "peerDependencies": { "jiti": "*" }, "optionalPeers": ["jiti"], "bin": { "eslint": "bin/eslint.js" } }, "sha512-9VaAkDURekixUQJy0oJYl2DcN6oKMfxay7XzaGYAWQwsb6qfKf+x76R2k1L8kb1boc+FyCAaTA9GmiKaaiaF+A=="],
+    "eslint": ["eslint@10.3.0", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.8.0", "@eslint-community/regexpp": "^4.12.2", "@eslint/config-array": "^0.23.5", "@eslint/config-helpers": "^0.5.5", "@eslint/core": "^1.2.1", "@eslint/plugin-kit": "^0.7.1", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", "@humanwhocodes/retry": "^0.4.2", "@types/estree": "^1.0.6", "ajv": "^6.14.0", "cross-spawn": "^7.0.6", "debug": "^4.3.2", "escape-string-regexp": "^4.0.0", "eslint-scope": "^9.1.2", "eslint-visitor-keys": "^5.0.1", "espree": "^11.2.0", "esquery": "^1.7.0", "esutils": "^2.0.2", "fast-deep-equal": "^3.1.3", "file-entry-cache": "^8.0.0", "find-up": "^5.0.0", "glob-parent": "^6.0.2", "ignore": "^5.2.0", "imurmurhash": "^0.1.4", "is-glob": "^4.0.0", "json-stable-stringify-without-jsonify": "^1.0.1", "minimatch": "^10.2.4", "natural-compare": "^1.4.0", "optionator": "^0.9.3" }, "peerDependencies": { "jiti": "*" }, "optionalPeers": ["jiti"], "bin": { "eslint": "bin/eslint.js" } }, "sha512-XbEXaRva5cF0ZQB8w6MluHA0kZZfV2DuCMJ3ozyEOHLwDpZX2Lmm/7Pp0xdJmI0GL1W05VH5VwIFHEm1Vcw2gw=="],
 
     "eslint-plugin-react-compiler": ["eslint-plugin-react-compiler@19.1.0-rc.2", "", { "dependencies": { "@babel/core": "^7.24.4", "@babel/parser": "^7.24.4", "@babel/plugin-proposal-private-methods": "^7.18.6", "hermes-parser": "^0.25.1", "zod": "^3.22.4", "zod-validation-error": "^3.0.3" }, "peerDependencies": { "eslint": ">=7" } }, "sha512-oKalwDGcD+RX9mf3NEO4zOoUMeLvjSvcbbEOpquzmzqEEM2MQdp7/FY/Hx9NzmUwFzH1W9SKTz5fihfMldpEYw=="],
 
     "eslint-plugin-react-hooks": ["eslint-plugin-react-hooks@7.1.1", "", { "dependencies": { "@babel/core": "^7.24.4", "@babel/parser": "^7.24.4", "hermes-parser": "^0.25.1", "zod": "^3.25.0 || ^4.0.0", "zod-validation-error": "^3.5.0 || ^4.0.0" }, "peerDependencies": { "eslint": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0 || ^10.0.0" } }, "sha512-f2I7Gw6JbvCexzIInuSbZpfdQ44D7iqdWX01FKLvrPgqxoE7oMj8clOfto8U6vYiz4yd5oKu39rRSVOe1zRu0g=="],
 
-    "eslint-plugin-react-refresh": ["eslint-plugin-react-refresh@0.5.6", "", { "peerDependencies": { "eslint": "^9 || ^10" } }, "sha512-uZnh24On2bk478AkaDAKcpRiYhS3qFSaSNvpXxV6/Ek/BBDICkWGG7MnBSfjnIlCVBei5vsLlIeQYxbF22+Udg=="],
+    "eslint-plugin-react-refresh": ["eslint-plugin-react-refresh@0.5.2", "", { "peerDependencies": { "eslint": "^9 || ^10" } }, "sha512-hmgTH57GfzoTFjVN0yBwTggnsVUF2tcqi7RJZHqi9lIezSs4eFyAMktA68YD4r5kNw1mxyY4dmkyoFDb3FIqrA=="],
 
     "eslint-scope": ["eslint-scope@9.1.2", "", { "dependencies": { "@types/esrecurse": "^4.3.1", "@types/estree": "^1.0.8", "esrecurse": "^4.3.0", "estraverse": "^5.2.0" } }, "sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ=="],
 
@@ -1045,15 +1011,15 @@
 
     "eventsource": ["eventsource@3.0.7", "", { "dependencies": { "eventsource-parser": "^3.0.1" } }, "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA=="],
 
-    "eventsource-parser": ["eventsource-parser@3.1.1", "", {}, "sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ=="],
+    "eventsource-parser": ["eventsource-parser@3.1.0", "", {}, "sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg=="],
 
     "execa": ["execa@4.1.0", "", { "dependencies": { "cross-spawn": "^7.0.0", "get-stream": "^5.0.0", "human-signals": "^1.1.1", "is-stream": "^2.0.0", "merge-stream": "^2.0.0", "npm-run-path": "^4.0.0", "onetime": "^5.1.0", "signal-exit": "^3.0.2", "strip-final-newline": "^2.0.0" } }, "sha512-j5W0//W7f8UxAn8hXVnwG8tLwdiUy4FJLcSupCg6maBYZDpyBvTApK7KyuI4bKj8KOh1r2YH+6ucuYtJv1bTZA=="],
 
-    "fast-check": ["fast-check@4.9.0", "", { "dependencies": { "pure-rand": "^8.0.0" } }, "sha512-7ms6T7SybUev/PQITciI0yLM2pOSFy5zpG8Ty7tQofcVaQUvrMXp6CBwqF6fThLCLOrfBtuHAtwq6Yu4XPCllg=="],
+    "fast-check": ["fast-check@4.8.0", "", { "dependencies": { "pure-rand": "^8.0.0" } }, "sha512-GOJ158CUMnN6cSahsv4+ExARvIDuzzinFjkp0E9WtiBa5zcVeLozVkWaE4IzFcc+Y48Wp1EDlUZsXRyAztQcSg=="],
 
     "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="],
 
-    "fast-equals": ["fast-equals@5.4.2", "", {}, "sha512-Ywe6jodPTWOTL9/k0bV7gdfP8twKL5Y8I8CZ933fAY5gBekICZSUQTbyH6ut2NZCNyB05mSUwAuEqdEIaOOlDQ=="],
+    "fast-equals": ["fast-equals@5.4.0", "", {}, "sha512-jt2DW/aNFNwke7AUd+Z+e6pz39KO5rzdbbFCg2sGafS4mk13MI7Z8O5z9cADNn5lhGODIgLwug6TZO2ctf7kcw=="],
 
     "fast-glob": ["fast-glob@3.3.3", "", { "dependencies": { "@nodelib/fs.stat": "^2.0.2", "@nodelib/fs.walk": "^1.2.3", "glob-parent": "^5.1.2", "merge2": "^1.3.0", "micromatch": "^4.0.8" } }, "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg=="],
 
@@ -1061,19 +1027,19 @@
 
     "fast-levenshtein": ["fast-levenshtein@2.0.6", "", {}, "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw=="],
 
-    "fast-uri": ["fast-uri@3.1.7", "", {}, "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg=="],
+    "fast-uri": ["fast-uri@3.1.1", "", {}, "sha512-h2r7rcm6Ee/J8o0LD5djLuFVcfbZxhvho4vvsbeV0aMvXjUgqv4YpxpkEx0d68l6+IleVfLAdVEfhR7QNMkGHQ=="],
 
-    "fastq": ["fastq@1.20.3", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw=="],
+    "fastq": ["fastq@1.20.1", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw=="],
 
     "fd-package-json": ["fd-package-json@2.0.0", "", { "dependencies": { "walk-up-path": "^4.0.0" } }, "sha512-jKmm9YtsNXN789RS/0mSzOC1NUq9mkVd65vbSSVsKdjGvYXBuE4oWe2QOEoFeRmJg+lPuZxpmrfFclNhoRMneQ=="],
 
     "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="],
 
-    "fflate": ["fflate@0.8.3", "", {}, "sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA=="],
+    "fflate": ["fflate@0.8.2", "", {}, "sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A=="],
 
     "file-entry-cache": ["file-entry-cache@8.0.0", "", { "dependencies": { "flat-cache": "^4.0.0" } }, "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ=="],
 
-    "filing-cabinet": ["filing-cabinet@5.5.1", "", { "dependencies": { "app-module-path": "^2.2.0", "commander": "^12.1.0", "enhanced-resolve": "^5.21.0", "module-definition": "^6.0.2", "module-lookup-amd": "^9.1.3", "resolve": "^1.22.12", "resolve-dependency-path": "^4.0.1", "sass-lookup": "^6.1.2", "stylus-lookup": "^6.1.2", "tsconfig-paths": "^4.2.0", "typescript": "^5.9.3" }, "bin": { "filing-cabinet": "bin/cli.js" } }, "sha512-PzLBTChlVPn6LnNxF0KWs+XqPziVh3Sfmz/3TXOymHxu6a9yhrDcQn7YwgpcRM6mqhR2WHVGPR8RU4fmcF1IVA=="],
+    "filing-cabinet": ["filing-cabinet@5.4.1", "", { "dependencies": { "app-module-path": "^2.2.0", "commander": "^12.1.0", "enhanced-resolve": "^5.21.0", "module-definition": "^6.0.2", "module-lookup-amd": "^9.1.3", "resolve": "^1.22.12", "resolve-dependency-path": "^4.0.1", "sass-lookup": "^6.1.2", "stylus-lookup": "^6.1.2", "tsconfig-paths": "^4.2.0", "typescript": "^5.9.3" }, "bin": { "filing-cabinet": "bin/cli.js" } }, "sha512-XSZKDRYZ7ijMsr6aTD5rUy5nh4Dsg4+N74bufCHzdhFAh4argabH8CBGcus1ha+hGbJf7OQmbtTVVNnb1uDpmw=="],
 
     "fill-range": ["fill-range@7.1.1", "", { "dependencies": { "to-regex-range": "^5.0.1" } }, "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg=="],
 
@@ -1083,11 +1049,11 @@
 
     "flat-cache": ["flat-cache@4.0.1", "", { "dependencies": { "flatted": "^3.2.9", "keyv": "^4.5.4" } }, "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw=="],
 
-    "flatted": ["flatted@3.4.4", "", {}, "sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q=="],
+    "flatted": ["flatted@3.4.2", "", {}, "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA=="],
 
-    "formatly": ["formatly@0.7.0", "", { "dependencies": { "fd-package-json": "^2.0.0", "package-manager-detector": "^1.8.0" }, "bin": { "formatly": "bin/index.mjs" } }, "sha512-7CXJtIIA0zy/u12StsYk25qVKxvdLA2ep2sTNxK3ov0mGNIIDqIvAXDSgTnAfDJFsPfWjuz0WjfYSdpvnLA5Tg=="],
+    "formatly": ["formatly@0.3.0", "", { "dependencies": { "fd-package-json": "^2.0.0" }, "bin": { "formatly": "bin/index.mjs" } }, "sha512-9XNj/o4wrRFyhSMJOvsuyMwy8aUfBaZ1VrqHVfohyXf0Sw0e+yfKG+xZaY3arGCOMdwFsqObtzVOc1gU9KiT9w=="],
 
-    "fs-extra": ["fs-extra@11.4.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-EQsFzMUJkCKGr1ePqlYADkIUmHW1s3ZXr5Yqy6wbGrfUCphpl2maM/kyOIRA2HpP3AaFQTZXD4ldjek+nccddA=="],
+    "fs-extra": ["fs-extra@11.3.4", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-CTXd6rk/M3/ULNQj8FBqBWHYBVYybQ3VPBw0xGKFe3tuH7ytT6ACnvzpIQ3UZtB8yvUKC2cXn1a+x+5EVQLovA=="],
 
     "fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="],
 
@@ -1105,15 +1071,15 @@
 
     "get-stream": ["get-stream@5.2.0", "", { "dependencies": { "pump": "^3.0.0" } }, "sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA=="],
 
-    "get-tsconfig": ["get-tsconfig@4.14.3", "", { "dependencies": { "resolve-pkg-maps": "^1.0.0" } }, "sha512-++QEw4DIY7WGoukz+/+A/8dGYPT9l9yIadnmSgZ8Rjr3YVSVDipQSO9CdnJo9ePqFqUUqh+wk9uIaoiAwsiPkA=="],
+    "get-tsconfig": ["get-tsconfig@4.14.0", "", { "dependencies": { "resolve-pkg-maps": "^1.0.0" } }, "sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA=="],
 
     "glob-parent": ["glob-parent@6.0.2", "", { "dependencies": { "is-glob": "^4.0.3" } }, "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A=="],
 
     "global-directory": ["global-directory@4.0.1", "", { "dependencies": { "ini": "4.1.1" } }, "sha512-wHTUcDUoZ1H5/0iVqEudYW4/kAlN5cZ3j/bXn0Dpbizl9iaUVeWSHqiOjsgk6OW2bkLclbBjzewBz6weQ1zA2Q=="],
 
-    "globals": ["globals@17.12.0", "", {}, "sha512-cezEd/DTyyht9cvSSURyygXPfy04GtWO/5e6ZPvH7fCtjKz9PYOmuawphw1Ctd1f6C+5JypXfGD7ahNMXvevBA=="],
+    "globals": ["globals@17.6.0", "", {}, "sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA=="],
 
-    "globby": ["globby@16.2.4", "", { "dependencies": { "@sindresorhus/merge-streams": "^4.0.0", "fast-glob": "^3.3.3", "ignore": "^7.0.5", "is-path-inside": "^4.0.0", "micromatch": "^4.0.8", "slash": "^5.1.0", "unicorn-magic": "^0.4.0" } }, "sha512-c8B/VNLmxRcmqqenRA9t+9IyOjf9+V6lTxPaUJLqOCONdQkWZ0ETYgX0qbtJqPsgCNusT9MZ5Jeidw8Eb9tn2g=="],
+    "globby": ["globby@16.2.0", "", { "dependencies": { "@sindresorhus/merge-streams": "^4.0.0", "fast-glob": "^3.3.3", "ignore": "^7.0.5", "is-path-inside": "^4.0.0", "slash": "^5.1.0", "unicorn-magic": "^0.4.0" } }, "sha512-QrJia2qDf5BB/V6HYlDTs0I0lBahyjLzpGQg3KT7FnCdTonAyPy2RtY802m2k4ALx6Dp752f82WsOczEVr3l6Q=="],
 
     "gonzales-pe": ["gonzales-pe@4.3.0", "", { "dependencies": { "minimist": "^1.2.5" }, "bin": { "gonzales": "bin/gonzales.js" } }, "sha512-otgSPpUmdWJ43VXyiNgEYE4luzHCL2pz4wQ0OnDluC6Eg4Ko3Vexy/SrSynglw/eR+OhkzmqFCZa/OFa/RgAOQ=="],
 
@@ -1121,7 +1087,7 @@
 
     "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],
 
-    "happy-dom": ["happy-dom@20.14.0", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "buffer-image-size": "^0.6.4", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.21.0" } }, "sha512-4bRh1KzRvKDnFNTlLhzT1RZTpkKhQbQDl9j+7GXszWsvuspYdo29k6OHRf4PwiM6oLb8r/pMWeYiJjkfod5AvQ=="],
+    "happy-dom": ["happy-dom@20.9.0", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.18.3" } }, "sha512-GZZ9mKe8r646NUAf/zemnGbjYh4Bt8/MqASJY+pSm5ZDtc3YQox+4gsLI7yi1hba6o+eCsGxpHn5+iEVn31/FQ=="],
 
     "has-flag": ["has-flag@4.0.0", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
 
@@ -1129,7 +1095,7 @@
 
     "has-tostringtag": ["has-tostringtag@1.0.2", "", { "dependencies": { "has-symbols": "^1.0.3" } }, "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw=="],
 
-    "hasown": ["hasown@2.0.4", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A=="],
+    "hasown": ["hasown@2.0.3", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg=="],
 
     "hermes-estree": ["hermes-estree@0.25.1", "", {}, "sha512-0wUoCcLp+5Ev5pDW2OriHC2MJCbwLwuRx+gAqMTOkGKJJiBCLjtrvy4PWUGn6MIVefecRpzoOZ/UV6iGdOr+Cw=="],
 
@@ -1147,7 +1113,7 @@
 
     "ignore": ["ignore@7.0.5", "", {}, "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg=="],
 
-    "import-in-the-middle": ["import-in-the-middle@3.4.0", "", { "dependencies": { "cjs-module-lexer": "^2.2.0", "es-module-lexer": "^2.2.0", "module-details-from-path": "^1.0.4" } }, "sha512-Xfjwfarhe+LGmoaof+sexeNo3sGRysb5x56WrZLwHtmqT0OilSKtVWkv0lrCcMgSKyKP9oBogBAisHZvtJH0aw=="],
+    "immer": ["immer@11.1.5", "", {}, "sha512-3fsh0NseNqMdOT8Qn4yv+JQRPpROG9xB6h3dnfqpktU9sHBuUYHfRHA0Uxk5ctqi7CdpR7Lv0DBr90pzv9jpBg=="],
 
     "imurmurhash": ["imurmurhash@0.1.4", "", {}, "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA=="],
 
@@ -1161,7 +1127,7 @@
 
     "ipaddr.js": ["ipaddr.js@2.5.0", "", {}, "sha512-aq+t5NAc+cS6rZQQVWC2x98CPqGtKKTMDd4Gaodv0wShnItdKg/51djkGJ1hqH+Oy0ivDftCbSLCQob8zso01w=="],
 
-    "is-core-module": ["is-core-module@2.16.2", "", { "dependencies": { "hasown": "^2.0.3" } }, "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA=="],
+    "is-core-module": ["is-core-module@2.16.1", "", { "dependencies": { "hasown": "^2.0.2" } }, "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w=="],
 
     "is-expression": ["is-expression@4.0.0", "", { "dependencies": { "acorn": "^7.1.1", "object-assign": "^4.1.1" } }, "sha512-zMIXX63sxzG3XrkHkrAPvm/OVZVSCPNkwMHU8oTX7/U3AL78I0QXCEICXUM13BIa8TYGZ68PiTKfQz3yaTNr4A=="],
 
@@ -1193,6 +1159,8 @@
 
     "is-unicode-supported": ["is-unicode-supported@0.1.0", "", {}, "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw=="],
 
+    "is-url": ["is-url@1.2.4", "", {}, "sha512-ITvGim8FhRiYe4IQ5uHSkj7pVaPDrCTkNd3yq3cV7iZAcJdHTUMPMEHcqSOy9xZ9qFenQCvi+2wjH9a1nXqHww=="],
+
     "is-url-superb": ["is-url-superb@4.0.0", "", {}, "sha512-GI+WjezhPPcbM+tqE9LnmsY5qqjwHzTvjJ36wxYX5ujNXefSUJ/T17r5bqDV8yLhcgB59KTPNOc9O9cmHTPWsA=="],
 
     "isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
@@ -1201,19 +1169,19 @@
 
     "istextorbinary": ["istextorbinary@9.5.0", "", { "dependencies": { "binaryextensions": "^6.11.0", "editions": "^6.21.0", "textextensions": "^6.11.0" } }, "sha512-5mbUj3SiZXCuRf9fT3ibzbSSEWiy63gFfksmGfdOzujPjW3k+z8WvIBxcJHBoQNlaZaiyB25deviif2+osLmLw=="],
 
-    "jiti": ["jiti@2.7.0", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ=="],
+    "jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
 
-    "jose": ["jose@6.2.11", "", {}, "sha512-A5NPn7g8EAzGU3IzRs+Yiq8K5n3ypYS75M5+KKiVHdUexfpWK1kP4ZMq7QnTGDoMj6TJ1dtcEJjW60yZDXS4hg=="],
+    "jose": ["jose@6.2.3", "", {}, "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw=="],
 
     "js-stringify": ["js-stringify@1.0.2", "", {}, "sha512-rtS5ATOo2Q5k1G+DADISilDA6lv79zIiwFd6CcjuIxGKLFm5C+RLImRscVap9k55i+MOZwgliw+NejvkLuGD5g=="],
 
     "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
 
-    "js-yaml": ["js-yaml@4.3.2", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA=="],
+    "js-yaml": ["js-yaml@4.1.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA=="],
 
-    "jscpd": ["jscpd@4.3.0", "", { "dependencies": { "@jscpd/badge-reporter": "4.2.5", "@jscpd/core": "4.2.5", "@jscpd/finder": "4.3.0", "@jscpd/html-reporter": "4.2.5", "@jscpd/tokenizer": "4.2.6", "colors": "^1.4.0", "commander": "^15.0.0", "fs-extra": "^11.3.6", "jscpd-sarif-reporter": "4.2.5" }, "bin": { "jscpd": "bin/jscpd" } }, "sha512-yUqcHy/USHvzFamS6Loo49MCSW0Dc+4RL6ELH+Un9o2/jRSQbs9+a5hjfFceV2d3Zgv1opv5PXJ0eZ3fEQdjkg=="],
+    "jscpd": ["jscpd@4.0.9", "", { "dependencies": { "@jscpd/badge-reporter": "4.0.5", "@jscpd/core": "4.0.5", "@jscpd/finder": "4.0.5", "@jscpd/html-reporter": "4.0.5", "@jscpd/tokenizer": "4.0.5", "colors": "^1.4.0", "commander": "^5.0.0", "fs-extra": "^11.2.0", "jscpd-sarif-reporter": "4.0.7" }, "bin": { "jscpd": "bin/jscpd" } }, "sha512-fp6Sh42W3mIPoQgZmgYmKDLQzEDnnX2vaGlTN4haILkB2vsi+ewcCHEtWR/2CR/QbsBvAvsNo8U5Sa+p9aHiGw=="],
 
-    "jscpd-sarif-reporter": ["jscpd-sarif-reporter@4.2.5", "", { "dependencies": { "colors": "^1.4.0", "fs-extra": "^11.2.0", "node-sarif-builder": "^4.1.0" } }, "sha512-O8LcM9grAS5yO5x1Q0yegYaYcUX//IEBEyvzGFSYCeo1YzHbMnAI6EK7oTrwD+7Csjvfg9m8B8G7OOxzcSlr9w=="],
+    "jscpd-sarif-reporter": ["jscpd-sarif-reporter@4.0.7", "", { "dependencies": { "colors": "^1.4.0", "fs-extra": "^11.2.0", "node-sarif-builder": "^3.4.0" } }, "sha512-Q/VlfTI/Nbjc8dZ/2pDVIf1aRi2bM2CTYujcAoeYr7brRnS4o5ZeW86W8q7MM7cQu40gezlNckl+E9wKFSMFiA=="],
 
     "jsdom": ["jsdom@30.0.1", "", { "dependencies": { "@asamuzakjp/css-color": "^6.0.5", "@asamuzakjp/dom-selector": "^8.3.0", "@bramus/specificity": "^2.4.2", "@csstools/css-syntax-patches-for-csstree": "^1.1.7", "@exodus/bytes": "^1.15.1", "css-tree": "^3.2.1", "data-urls": "^7.0.0", "decimal.js": "^10.6.0", "html-encoding-sniffer": "^6.0.0", "is-potential-custom-element-name": "^1.0.1", "lru-cache": "^11.5.2", "parse5": "^8.0.1", "saxes": "^6.0.0", "symbol-tree": "^3.2.4", "tough-cookie": "^6.0.2", "undici": "^8.9.0", "w3c-xmlserializer": "^5.0.0", "webidl-conversions": "^8.0.1", "whatwg-mimetype": "^5.0.0", "whatwg-url": "^17.1.0", "xml-name-validator": "^5.0.0" }, "peerDependencies": { "canvas": "^3.2.3" }, "optionalPeers": ["canvas"] }, "sha512-52v7mUVUfNQVYYqE1lcdaymWL0njO7lTLUog6ZvW2U5KsbiLk/GnZlVJ+qx0xfNJZ6Gn+KSpPNE52vurbxZwrA=="],
 
@@ -1239,7 +1207,7 @@
 
     "kleur": ["kleur@3.0.3", "", {}, "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w=="],
 
-    "knip": ["knip@6.34.0", "", { "dependencies": { "fdir": "^6.5.0", "formatly": "^0.7.0", "get-tsconfig": "4.14.3", "jiti": "^2.7.0", "oxc-parser": "^0.147.0", "oxc-resolver": "11.24.2", "picomatch": "^4.0.7", "smol-toml": "^1.8.0", "strip-json-comments": "5.0.3", "tinyglobby": "^0.2.17", "unbash": "^4.0.10", "yaml": "^2.9.0", "zod": "^4.4.3" }, "bin": { "knip": "bin/knip.js", "knip-bun": "bin/knip-bun.js" } }, "sha512-bbHIrnGspYwe4EBPjjx+lvkUor0F2qfKQc5BPzPI4SOAImYA+k2ueVpIcF7d/W1LEVT7XoJUPt6zELeGZhXBgA=="],
+    "knip": ["knip@6.11.0", "", { "dependencies": { "fdir": "^6.5.0", "formatly": "^0.3.0", "get-tsconfig": "4.14.0", "jiti": "^2.6.0", "minimist": "^1.2.8", "oxc-parser": "^0.128.0", "oxc-resolver": "^11.19.1", "picomatch": "^4.0.4", "smol-toml": "^1.6.1", "strip-json-comments": "5.0.3", "tinyglobby": "^0.2.16", "unbash": "^3.0.0", "yaml": "^2.8.2", "zod": "^4.1.11" }, "bin": { "knip": "bin/knip.js", "knip-bun": "bin/knip-bun.js" } }, "sha512-84PTlN8Q5smLpTbzs8smTVh8PMbTDXtw0tFksXq/m6auGFC/KSzJykKFmnYh3As38kiWDkoDBvdTTyKk5M1TAQ=="],
 
     "kubernetes-types": ["kubernetes-types@1.30.0", "", {}, "sha512-Dew1okvhM/SQcIa2rcgujNndZwU8VnSapDgdxlYoB84ZlpAD43U6KLAFqYo17ykSFGHNPrg0qry0bP+GJd9v7Q=="],
 
@@ -1247,29 +1215,29 @@
 
     "lib0": ["lib0@0.2.117", "", { "dependencies": { "isomorphic.js": "^0.2.4" }, "bin": { "0serve": "bin/0serve.js", "0gentesthtml": "bin/gentesthtml.js", "0ecdsa-generate-keypair": "bin/0ecdsa-generate-keypair.js" } }, "sha512-DeXj9X5xDCjgKLU/7RR+/HQEVzuuEUiwldwOGsHK/sfAfELGWEyTcf0x+uOvCvK3O2zPmZePXWL85vtia6GyZw=="],
 
-    "lightningcss": ["lightningcss@1.33.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.33.0", "lightningcss-darwin-arm64": "1.33.0", "lightningcss-darwin-x64": "1.33.0", "lightningcss-freebsd-x64": "1.33.0", "lightningcss-linux-arm-gnueabihf": "1.33.0", "lightningcss-linux-arm64-gnu": "1.33.0", "lightningcss-linux-arm64-musl": "1.33.0", "lightningcss-linux-x64-gnu": "1.33.0", "lightningcss-linux-x64-musl": "1.33.0", "lightningcss-win32-arm64-msvc": "1.33.0", "lightningcss-win32-x64-msvc": "1.33.0" } }, "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA=="],
+    "lightningcss": ["lightningcss@1.32.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.32.0", "lightningcss-darwin-arm64": "1.32.0", "lightningcss-darwin-x64": "1.32.0", "lightningcss-freebsd-x64": "1.32.0", "lightningcss-linux-arm-gnueabihf": "1.32.0", "lightningcss-linux-arm64-gnu": "1.32.0", "lightningcss-linux-arm64-musl": "1.32.0", "lightningcss-linux-x64-gnu": "1.32.0", "lightningcss-linux-x64-musl": "1.32.0", "lightningcss-win32-arm64-msvc": "1.32.0", "lightningcss-win32-x64-msvc": "1.32.0" } }, "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ=="],
 
-    "lightningcss-android-arm64": ["lightningcss-android-arm64@1.33.0", "", { "os": "android", "cpu": "arm64" }, "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg=="],
+    "lightningcss-android-arm64": ["lightningcss-android-arm64@1.32.0", "", { "os": "android", "cpu": "arm64" }, "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg=="],
 
-    "lightningcss-darwin-arm64": ["lightningcss-darwin-arm64@1.33.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg=="],
+    "lightningcss-darwin-arm64": ["lightningcss-darwin-arm64@1.32.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ=="],
 
-    "lightningcss-darwin-x64": ["lightningcss-darwin-x64@1.33.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ=="],
+    "lightningcss-darwin-x64": ["lightningcss-darwin-x64@1.32.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w=="],
 
-    "lightningcss-freebsd-x64": ["lightningcss-freebsd-x64@1.33.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg=="],
+    "lightningcss-freebsd-x64": ["lightningcss-freebsd-x64@1.32.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig=="],
 
-    "lightningcss-linux-arm-gnueabihf": ["lightningcss-linux-arm-gnueabihf@1.33.0", "", { "os": "linux", "cpu": "arm" }, "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ=="],
+    "lightningcss-linux-arm-gnueabihf": ["lightningcss-linux-arm-gnueabihf@1.32.0", "", { "os": "linux", "cpu": "arm" }, "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw=="],
 
-    "lightningcss-linux-arm64-gnu": ["lightningcss-linux-arm64-gnu@1.33.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg=="],
+    "lightningcss-linux-arm64-gnu": ["lightningcss-linux-arm64-gnu@1.32.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ=="],
 
-    "lightningcss-linux-arm64-musl": ["lightningcss-linux-arm64-musl@1.33.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ=="],
+    "lightningcss-linux-arm64-musl": ["lightningcss-linux-arm64-musl@1.32.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg=="],
 
-    "lightningcss-linux-x64-gnu": ["lightningcss-linux-x64-gnu@1.33.0", "", { "os": "linux", "cpu": "x64" }, "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg=="],
+    "lightningcss-linux-x64-gnu": ["lightningcss-linux-x64-gnu@1.32.0", "", { "os": "linux", "cpu": "x64" }, "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA=="],
 
-    "lightningcss-linux-x64-musl": ["lightningcss-linux-x64-musl@1.33.0", "", { "os": "linux", "cpu": "x64" }, "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw=="],
+    "lightningcss-linux-x64-musl": ["lightningcss-linux-x64-musl@1.32.0", "", { "os": "linux", "cpu": "x64" }, "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg=="],
 
-    "lightningcss-win32-arm64-msvc": ["lightningcss-win32-arm64-msvc@1.33.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA=="],
+    "lightningcss-win32-arm64-msvc": ["lightningcss-win32-arm64-msvc@1.32.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw=="],
 
-    "lightningcss-win32-x64-msvc": ["lightningcss-win32-x64-msvc@1.33.0", "", { "os": "win32", "cpu": "x64" }, "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA=="],
+    "lightningcss-win32-x64-msvc": ["lightningcss-win32-x64-msvc@1.32.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q=="],
 
     "linkifyjs": ["linkifyjs@4.3.3", "", {}, "sha512-P8aEP5U/D1/IlTY2OeYsErdwh9bGuLE30NcXtKEjgdHcahveQoQwM2yZNsioQHsWFz0P7KKudisbrzCgR0sDHg=="],
 
@@ -1281,7 +1249,7 @@
 
     "log-symbols": ["log-symbols@4.1.0", "", { "dependencies": { "chalk": "^4.1.0", "is-unicode-supported": "^0.1.0" } }, "sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg=="],
 
-    "lru-cache": ["lru-cache@11.5.2", "", {}, "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g=="],
+    "lru-cache": ["lru-cache@11.3.6", "", {}, "sha512-Gf/KoL3C/MlI7Bt0PGI9I+TeTC/I6r/csU58N4BSNc4lppLBeKsOdFYkK+dX0ABDUMJNfCHTyPpzwwO21Awd3A=="],
 
     "lz-string": ["lz-string@1.5.0", "", { "bin": { "lz-string": "bin/bin.js" } }, "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ=="],
 
@@ -1289,11 +1257,9 @@
 
     "magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="],
 
-    "magicast": ["magicast@0.5.4", "", { "dependencies": { "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7", "source-map-js": "^1.2.1" } }, "sha512-llBEhWm1SacoRwgHUoQJYtwp4PBLF4faQi5TCpIGyGs9n4y5+juI0tDgyKIfpqxckRHaHzouUEph3THklWh03w=="],
-
     "markdown-table": ["markdown-table@2.0.0", "", { "dependencies": { "repeat-string": "^1.0.0" } }, "sha512-Ezda85ToJUBhM6WGaG6veasyym+Tbs3cMAw/ZhOPqXiYsr0jgocBV3j3nx+4lk47plLlIqjwuTm/ywVI+zjJ/A=="],
 
-    "marked": ["marked@18.0.11", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-HnslJfsZkRPBDJRHvVtAaWlZHEpSu7u8LgQuJCELjRKuWR+hpq4A7sLq3p8HaI9ypVoXDXxV34CsQJEe1+J5Aw=="],
+    "marked": ["marked@18.0.3", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-7VT90JOkDeaRWpfjOReRGPEKn0ecdARBkDGL+tT1wZY0efPPqkUxLUSmzy/C7TIylQYJC9STISEsCHrqb/7VIA=="],
 
     "math-intrinsics": ["math-intrinsics@1.1.0", "", {}, "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g=="],
 
@@ -1309,35 +1275,33 @@
 
     "mimic-function": ["mimic-function@5.0.1", "", {}, "sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA=="],
 
-    "minimatch": ["minimatch@10.2.6", "", { "dependencies": { "brace-expansion": "^5.0.8" } }, "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A=="],
+    "minimatch": ["minimatch@10.2.5", "", { "dependencies": { "brace-expansion": "^5.0.5" } }, "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg=="],
 
     "minimist": ["minimist@1.2.8", "", {}, "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA=="],
 
     "module-definition": ["module-definition@6.0.2", "", { "dependencies": { "ast-module-types": "^6.0.1", "node-source-walk": "^7.0.1" }, "bin": { "module-definition": "bin/cli.js" } }, "sha512-SvAU3lB0+Yjbq55yHY3wkRZBOh+fhU1SnIF3IFbTewv6mtAh7yUT8ACHAJ2mGIJ7tCes2QuCL/cl6m0JSZ/ArA=="],
 
-    "module-details-from-path": ["module-details-from-path@1.0.4", "", {}, "sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w=="],
-
     "module-lookup-amd": ["module-lookup-amd@9.1.3", "", { "dependencies": { "commander": "^12.1.0", "requirejs": "^2.3.8", "requirejs-config-file": "^4.0.0" }, "bin": { "lookup-amd": "bin/cli.js" } }, "sha512-Jc3XmOaR9FdfMJSK8+vyLgsCkzm8z2L0NS6vrlRWi12DjS7MY7TMNE7E1yj8yXx837xtMDbKSSgcdXnFlJ2YLg=="],
 
     "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
 
-    "msgpackr": ["msgpackr@2.1.0", "", { "optionalDependencies": { "msgpackr-extract": "^3.0.4" } }, "sha512-p/pBCVO63CsvvpkomUnNNag6+n38rULuDA6HHe70o2gtC8ODI52foF/4ko2qQcp6OiErJXTmrZeXmsGGHsIQNQ=="],
+    "msgpackr": ["msgpackr@2.0.2", "", { "optionalDependencies": { "msgpackr-extract": "^3.0.4" } }, "sha512-c5hYOXFbP79Slh6Dzd2wzk+jnV7mX1UxfMYtilnY1NmalXPqG8DGb5cYCMBrW4AsH3zekBBZd4QrKz9NhtvYLQ=="],
 
     "msgpackr-extract": ["msgpackr-extract@3.0.4", "", { "dependencies": { "node-gyp-build-optional-packages": "5.2.2" }, "optionalDependencies": { "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.4", "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.4", "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.4" }, "bin": { "download-msgpackr-prebuilds": "bin/download-prebuilds.js" } }, "sha512-4kmO/MdyUIkLIvTPr8VHLil4AtoKIoniWPIEk5+CDy0xnWC84azhSFmuJ7PxZdsYtiP5kEeQsORAVIeMgxT+Hw=="],
 
-    "multipasta": ["multipasta@0.2.8", "", {}, "sha512-ZPWuMKyv0cSO29f7hozp+k6+crZbQijV8ipMvxNxRf2SwtYGTX1ZX89Kd20VV4H9Znonx+EQn+iy1wGQsJ+b+Q=="],
+    "multipasta": ["multipasta@0.2.7", "", {}, "sha512-KPA58d68KgGil15oDqXjkUBEBYc00XvbPj5/X+dyzeo/lWm9Nc25pQRlf1D+gv4OpK7NM0J1odrbu9JNNGvynA=="],
 
     "mutative": ["mutative@1.3.0", "", {}, "sha512-8MJj6URmOZAV70dpFe1YnSppRTKC4DsMkXQiBDFayLcDI4ljGokHxmpqaBQuDWa4iAxWaJJ1PS8vAmbntjjKmQ=="],
 
-    "nanoid": ["nanoid@5.1.16", "", { "bin": { "nanoid": "bin/nanoid.js" } }, "sha512-kVrnsrJqMR8+oLJnGEmSWw9BivK5mt7H3FZatVRjrc5wGqFYuBxX1yG7+A7Gi5AefkX6t/oCkizcQgpu0cY1dQ=="],
+    "nanoid": ["nanoid@5.1.11", "", { "bin": { "nanoid": "bin/nanoid.js" } }, "sha512-v+KEsUv2ps74PaSKv0gHTxTCgMXOIfBEbaqa6w6ISIGC7ZsvHN4N9oJ8d4cmf0n5oTzQz2SLmThbQWhjd/8eKg=="],
 
     "natural-compare": ["natural-compare@1.4.0", "", {}, "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw=="],
 
     "node-gyp-build-optional-packages": ["node-gyp-build-optional-packages@5.2.2", "", { "dependencies": { "detect-libc": "^2.0.1" }, "bin": { "node-gyp-build-optional-packages": "bin.js", "node-gyp-build-optional-packages-optional": "optional.js", "node-gyp-build-optional-packages-test": "build-test.js" } }, "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw=="],
 
-    "node-releases": ["node-releases@2.0.54", "", {}, "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ=="],
+    "node-releases": ["node-releases@2.0.38", "", {}, "sha512-3qT/88Y3FbH/Kx4szpQQ4HzUbVrHPKTLVpVocKiLfoYvw9XSGOX2FmD2d6DrXbVYyAQTF2HeF6My8jmzx7/CRw=="],
 
-    "node-sarif-builder": ["node-sarif-builder@4.1.0", "", { "dependencies": { "@types/sarif": "^2.1.7", "fs-extra": "^11.1.1" } }, "sha512-IWqZF6u0EI/07HTBm+zZ+MgXgWl09dnSJRGaDCPBSlOqilDcx6pj3Mpb3HvPN8V2Gr+ISw7ZrMsL7STWs1F++w=="],
+    "node-sarif-builder": ["node-sarif-builder@3.4.0", "", { "dependencies": { "@types/sarif": "^2.1.7", "fs-extra": "^11.1.1" } }, "sha512-tGnJW6OKRii9u/b2WiUViTJS+h7Apxx17qsMUjsUeNDiMMX5ZFf8F8Fcz7PAQ6omvOxHZtvDTmOYKJQwmfpjeg=="],
 
     "node-source-walk": ["node-source-walk@7.0.2", "", { "dependencies": { "@babel/parser": "^7.29.0" } }, "sha512-71kFFjYaSshDTA8/a2HiTYPLdASWjLJxUyJxGE+ffxU+KhxSBtM9kiLUX+R2yooFdSFKMFpi4n3PFtDy6qXv8A=="],
 
@@ -1357,21 +1321,19 @@
 
     "orderedmap": ["orderedmap@2.1.1", "", {}, "sha512-TvAWxi0nDe1j/rtMcWcIj94+Ffe6n7zhow33h40SKxmsmozs6dz/e+EajymfoFcHd7sxNn8yHM8839uixMOV6g=="],
 
-    "oxc-parser": ["oxc-parser@0.147.0", "", { "dependencies": { "@oxc-project/types": "^0.147.0" }, "optionalDependencies": { "@oxc-parser/binding-android-arm-eabi": "0.147.0", "@oxc-parser/binding-android-arm64": "0.147.0", "@oxc-parser/binding-darwin-arm64": "0.147.0", "@oxc-parser/binding-darwin-x64": "0.147.0", "@oxc-parser/binding-freebsd-x64": "0.147.0", "@oxc-parser/binding-linux-arm-gnueabihf": "0.147.0", "@oxc-parser/binding-linux-arm-musleabihf": "0.147.0", "@oxc-parser/binding-linux-arm64-gnu": "0.147.0", "@oxc-parser/binding-linux-arm64-musl": "0.147.0", "@oxc-parser/binding-linux-ppc64-gnu": "0.147.0", "@oxc-parser/binding-linux-riscv64-gnu": "0.147.0", "@oxc-parser/binding-linux-riscv64-musl": "0.147.0", "@oxc-parser/binding-linux-s390x-gnu": "0.147.0", "@oxc-parser/binding-linux-x64-gnu": "0.147.0", "@oxc-parser/binding-linux-x64-musl": "0.147.0", "@oxc-parser/binding-openharmony-arm64": "0.147.0", "@oxc-parser/binding-win32-arm64-msvc": "0.147.0", "@oxc-parser/binding-win32-ia32-msvc": "0.147.0", "@oxc-parser/binding-win32-x64-msvc": "0.147.0" } }, "sha512-5xaug6t7GfV3BO5Iv+xHW1rmQkDEQ3BEu3L8g3InsvWO5i8CYGc4tCZ2X985QcwWNycFJam+aOns6Nr2XAThTA=="],
+    "oxc-parser": ["oxc-parser@0.128.0", "", { "dependencies": { "@oxc-project/types": "^0.128.0" }, "optionalDependencies": { "@oxc-parser/binding-android-arm-eabi": "0.128.0", "@oxc-parser/binding-android-arm64": "0.128.0", "@oxc-parser/binding-darwin-arm64": "0.128.0", "@oxc-parser/binding-darwin-x64": "0.128.0", "@oxc-parser/binding-freebsd-x64": "0.128.0", "@oxc-parser/binding-linux-arm-gnueabihf": "0.128.0", "@oxc-parser/binding-linux-arm-musleabihf": "0.128.0", "@oxc-parser/binding-linux-arm64-gnu": "0.128.0", "@oxc-parser/binding-linux-arm64-musl": "0.128.0", "@oxc-parser/binding-linux-ppc64-gnu": "0.128.0", "@oxc-parser/binding-linux-riscv64-gnu": "0.128.0", "@oxc-parser/binding-linux-riscv64-musl": "0.128.0", "@oxc-parser/binding-linux-s390x-gnu": "0.128.0", "@oxc-parser/binding-linux-x64-gnu": "0.128.0", "@oxc-parser/binding-linux-x64-musl": "0.128.0", "@oxc-parser/binding-openharmony-arm64": "0.128.0", "@oxc-parser/binding-wasm32-wasi": "0.128.0", "@oxc-parser/binding-win32-arm64-msvc": "0.128.0", "@oxc-parser/binding-win32-ia32-msvc": "0.128.0", "@oxc-parser/binding-win32-x64-msvc": "0.128.0" } }, "sha512-XkOw3eiIxAgQ19WRew/Bq9wc5Ga/guaWIzDBzq80z1PyuDNGvWBpPby9k6YGwV8A8uMw+Nlq3xqlzuDYmUFYUw=="],
 
-    "oxc-resolver": ["oxc-resolver@11.24.2", "", { "optionalDependencies": { "@oxc-resolver/binding-android-arm-eabi": "11.24.2", "@oxc-resolver/binding-android-arm64": "11.24.2", "@oxc-resolver/binding-darwin-arm64": "11.24.2", "@oxc-resolver/binding-darwin-x64": "11.24.2", "@oxc-resolver/binding-freebsd-x64": "11.24.2", "@oxc-resolver/binding-linux-arm-gnueabihf": "11.24.2", "@oxc-resolver/binding-linux-arm-musleabihf": "11.24.2", "@oxc-resolver/binding-linux-arm64-gnu": "11.24.2", "@oxc-resolver/binding-linux-arm64-musl": "11.24.2", "@oxc-resolver/binding-linux-ppc64-gnu": "11.24.2", "@oxc-resolver/binding-linux-riscv64-gnu": "11.24.2", "@oxc-resolver/binding-linux-riscv64-musl": "11.24.2", "@oxc-resolver/binding-linux-s390x-gnu": "11.24.2", "@oxc-resolver/binding-linux-x64-gnu": "11.24.2", "@oxc-resolver/binding-linux-x64-musl": "11.24.2", "@oxc-resolver/binding-openharmony-arm64": "11.24.2", "@oxc-resolver/binding-wasm32-wasi": "11.24.2", "@oxc-resolver/binding-win32-arm64-msvc": "11.24.2", "@oxc-resolver/binding-win32-x64-msvc": "11.24.2" } }, "sha512-FY91FiDBj7ls5MsFS9jN3tjz2o0/zsdSsymlakySaBwVJZorHhkWyICLZMKxlu1R9vYo+sd3z1jwb4J8x7bNDw=="],
+    "oxc-resolver": ["oxc-resolver@11.19.1", "", { "optionalDependencies": { "@oxc-resolver/binding-android-arm-eabi": "11.19.1", "@oxc-resolver/binding-android-arm64": "11.19.1", "@oxc-resolver/binding-darwin-arm64": "11.19.1", "@oxc-resolver/binding-darwin-x64": "11.19.1", "@oxc-resolver/binding-freebsd-x64": "11.19.1", "@oxc-resolver/binding-linux-arm-gnueabihf": "11.19.1", "@oxc-resolver/binding-linux-arm-musleabihf": "11.19.1", "@oxc-resolver/binding-linux-arm64-gnu": "11.19.1", "@oxc-resolver/binding-linux-arm64-musl": "11.19.1", "@oxc-resolver/binding-linux-ppc64-gnu": "11.19.1", "@oxc-resolver/binding-linux-riscv64-gnu": "11.19.1", "@oxc-resolver/binding-linux-riscv64-musl": "11.19.1", "@oxc-resolver/binding-linux-s390x-gnu": "11.19.1", "@oxc-resolver/binding-linux-x64-gnu": "11.19.1", "@oxc-resolver/binding-linux-x64-musl": "11.19.1", "@oxc-resolver/binding-openharmony-arm64": "11.19.1", "@oxc-resolver/binding-wasm32-wasi": "11.19.1", "@oxc-resolver/binding-win32-arm64-msvc": "11.19.1", "@oxc-resolver/binding-win32-ia32-msvc": "11.19.1", "@oxc-resolver/binding-win32-x64-msvc": "11.19.1" } }, "sha512-qE/CIg/spwrTBFt5aKmwe3ifeDdLfA2NESN30E42X/lII5ClF8V7Wt6WIJhcGZjp0/Q+nQ+9vgxGk//xZNX2hg=="],
 
-    "oxlint": ["oxlint@1.81.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.81.0", "@oxlint/binding-android-arm64": "1.81.0", "@oxlint/binding-darwin-arm64": "1.81.0", "@oxlint/binding-darwin-x64": "1.81.0", "@oxlint/binding-freebsd-x64": "1.81.0", "@oxlint/binding-linux-arm-gnueabihf": "1.81.0", "@oxlint/binding-linux-arm-musleabihf": "1.81.0", "@oxlint/binding-linux-arm64-gnu": "1.81.0", "@oxlint/binding-linux-arm64-musl": "1.81.0", "@oxlint/binding-linux-ppc64-gnu": "1.81.0", "@oxlint/binding-linux-riscv64-gnu": "1.81.0", "@oxlint/binding-linux-riscv64-musl": "1.81.0", "@oxlint/binding-linux-s390x-gnu": "1.81.0", "@oxlint/binding-linux-x64-gnu": "1.81.0", "@oxlint/binding-linux-x64-musl": "1.81.0", "@oxlint/binding-openharmony-arm64": "1.81.0", "@oxlint/binding-win32-arm64-msvc": "1.81.0", "@oxlint/binding-win32-ia32-msvc": "1.81.0", "@oxlint/binding-win32-x64-msvc": "1.81.0" }, "peerDependencies": { "oxlint-tsgolint": ">=7.0.2001", "vite-plus": "*" }, "optionalPeers": ["oxlint-tsgolint", "vite-plus"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-HyrJYqeoOCL0iqaLEzGewGT48ZX99P3hxYh8udAF9RGGIghSamkXE4ClUyBpEDNqasamThgmlPbuMOe7SAZmHg=="],
+    "oxlint": ["oxlint@1.67.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.67.0", "@oxlint/binding-android-arm64": "1.67.0", "@oxlint/binding-darwin-arm64": "1.67.0", "@oxlint/binding-darwin-x64": "1.67.0", "@oxlint/binding-freebsd-x64": "1.67.0", "@oxlint/binding-linux-arm-gnueabihf": "1.67.0", "@oxlint/binding-linux-arm-musleabihf": "1.67.0", "@oxlint/binding-linux-arm64-gnu": "1.67.0", "@oxlint/binding-linux-arm64-musl": "1.67.0", "@oxlint/binding-linux-ppc64-gnu": "1.67.0", "@oxlint/binding-linux-riscv64-gnu": "1.67.0", "@oxlint/binding-linux-riscv64-musl": "1.67.0", "@oxlint/binding-linux-s390x-gnu": "1.67.0", "@oxlint/binding-linux-x64-gnu": "1.67.0", "@oxlint/binding-linux-x64-musl": "1.67.0", "@oxlint/binding-openharmony-arm64": "1.67.0", "@oxlint/binding-win32-arm64-msvc": "1.67.0", "@oxlint/binding-win32-ia32-msvc": "1.67.0", "@oxlint/binding-win32-x64-msvc": "1.67.0" }, "peerDependencies": { "oxlint-tsgolint": ">=0.22.1", "vite-plus": "*" }, "optionalPeers": ["oxlint-tsgolint", "vite-plus"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-blwwaHPdoH8piQ5/z0KHeoHFR7FZgl12WluKJfu4qFLPkZl6mK04PkLE45Fw1NxfBRSlh40Gu7MkxHUw++ociQ=="],
 
-    "oxlint-plugin-react-doctor": ["oxlint-plugin-react-doctor@0.2.16", "", { "dependencies": { "@typescript-eslint/types": "^8.59.3", "eslint-scope": "^9.1.2", "eslint-visitor-keys": "^5.0.1", "oxc-parser": "^0.132.0" } }, "sha512-Ul1UxcYfjBnt+HjgNaMnkvMJjyewS6rkSZl3LiD1g/QqSll1jiynYH/ZoNpUaGHp1pDQ/xLvCcXNQvqopN0tHA=="],
+    "oxlint-plugin-react-doctor": ["oxlint-plugin-react-doctor@0.2.14", "", { "dependencies": { "@typescript-eslint/types": "^8.59.3", "eslint-scope": "^9.1.2", "eslint-visitor-keys": "^5.0.1" } }, "sha512-E3Xb6NFycmmyJlLE7wNLN1kScunwsiHAwf1XCOUSgnSB7sV4dvQbcAVTVoOz2n1yGSPOmcMwBdLPTepVNBZ+OQ=="],
 
     "p-limit": ["p-limit@3.1.0", "", { "dependencies": { "yocto-queue": "^0.1.0" } }, "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ=="],
 
     "p-locate": ["p-locate@5.0.0", "", { "dependencies": { "p-limit": "^3.0.2" } }, "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw=="],
 
-    "p-map": ["p-map@7.0.7", "", {}, "sha512-VaWRu2i4FJNRtiRWCuuQRgfQ1B7a6+gMSrO+3j0EQi/k0ULfS9kosRxGoiqwzIjZTDI02tGfk5mXXltLg6QtfQ=="],
-
-    "package-manager-detector": ["package-manager-detector@1.8.0", "", {}, "sha512-yQA4H19AmPEoMUeavPMDIe1higySl/gH/yaQrkT/s07Qp+7pp2hYz30N3z2l5BkjVkF9Ow6o0wjJamm2y7Sn0A=="],
+    "p-map": ["p-map@7.0.4", "", {}, "sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ=="],
 
     "parse-json": ["parse-json@8.3.0", "", { "dependencies": { "@babel/code-frame": "^7.26.2", "index-to-position": "^1.1.0", "type-fest": "^4.39.1" } }, "sha512-ybiGyvspI+fAoRQbIPRddCcSTV9/LsJbf0e/S85VLowVGzRmokfneg2kwVW/KU5rOXrPSbF1qAKPMgNTqqROQQ=="],
 
@@ -1387,23 +1349,23 @@
 
     "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
 
-    "picomatch": ["picomatch@4.0.7", "", {}, "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA=="],
+    "picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="],
 
     "pixel-art-icons": ["pixel-art-icons@file:vendor/pixel-art-icons", { "peerDependencies": { "react": ">=18" } }],
 
     "pkce-challenge": ["pkce-challenge@5.0.1", "", {}, "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ=="],
 
-    "playwright": ["playwright@1.62.1", "", { "dependencies": { "playwright-core": "1.62.1" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg=="],
+    "playwright": ["playwright@1.60.0", "", { "dependencies": { "playwright-core": "1.60.0" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA=="],
 
-    "playwright-core": ["playwright-core@1.62.1", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw=="],
+    "playwright-core": ["playwright-core@1.60.0", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA=="],
 
     "pluralize": ["pluralize@8.0.0", "", {}, "sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA=="],
 
-    "postcss": ["postcss@8.5.28", "", { "dependencies": { "nanoid": "^3.3.18", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A=="],
+    "postcss": ["postcss@8.5.13", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-qif0+jGGZoLWdHey3UFHHWP0H7Gbmsk8T5VEqyYFbWqPr1XqvLGBbk/sl8V5exGmcYJklJOhOQq1pV9IcsiFag=="],
 
     "postcss-values-parser": ["postcss-values-parser@6.0.2", "", { "dependencies": { "color-name": "^1.1.4", "is-url-superb": "^4.0.0", "quote-unquote": "^1.0.0" }, "peerDependencies": { "postcss": "^8.2.9" } }, "sha512-YLJpK0N1brcNJrs9WatuJFtHaV9q5aAOj+S4DI5S7jgHlRfm0PIbDCAFRYMQD5SHq7Fy6xsDhyutgS0QOAs0qw=="],
 
-    "precinct": ["precinct@12.3.2", "", { "dependencies": { "@dependents/detective-less": "^5.0.3", "commander": "^12.1.0", "detective-amd": "^6.1.0", "detective-cjs": "^6.1.1", "detective-es6": "^5.0.2", "detective-postcss": "^8.0.3", "detective-sass": "^6.0.2", "detective-scss": "^5.0.2", "detective-stylus": "^5.0.1", "detective-typescript": "^14.1.2", "detective-vue2": "^2.3.0", "module-definition": "^6.0.2", "node-source-walk": "^7.0.2", "postcss": "^8.5.14", "typescript": "^5.9.3" }, "bin": { "precinct": "bin/cli.js" } }, "sha512-JbJevI1K80z8e/WIyDt/4vUN/4qcfBSKKqOjJA4mosPPPb7zODKRJQV7YN7apVWN3k58nZYm/vEsLgEGYmnxwg=="],
+    "precinct": ["precinct@12.3.1", "", { "dependencies": { "@dependents/detective-less": "^5.0.1", "commander": "^12.1.0", "detective-amd": "^6.0.1", "detective-cjs": "^6.1.0", "detective-es6": "^5.0.1", "detective-postcss": "^7.0.1", "detective-sass": "^6.0.1", "detective-scss": "^5.0.1", "detective-stylus": "^5.0.1", "detective-typescript": "^14.1.1", "detective-vue2": "^2.3.0", "module-definition": "^6.0.1", "node-source-walk": "^7.0.1", "postcss": "^8.5.10", "typescript": "^5.9.3" }, "bin": { "precinct": "bin/cli.js" } }, "sha512-wGyTIvtxh2S2NAHxTJj0YymxWOIcEDotu17yHoQUd2Bz2C07LrS28L1nvXDMxrCHvHmV6KTlaIQy5PzRm7Y8rg=="],
 
     "prelude-ls": ["prelude-ls@1.2.1", "", {}, "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g=="],
 
@@ -1415,21 +1377,19 @@
 
     "prompts": ["prompts@2.4.2", "", { "dependencies": { "kleur": "^3.0.3", "sisteransi": "^1.0.5" } }, "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q=="],
 
-    "prosemirror-changeset": ["prosemirror-changeset@2.4.2", "", { "dependencies": { "prosemirror-transform": "^1.0.0" } }, "sha512-ViYrjMSg3YFiXwIhKaluu+/mi3Yrxt6AR8ri14ulTaGcZtXO1CThl7A2gv79qx5fQnOw8woKwyBU2u+9PVCm3w=="],
+    "prosemirror-changeset": ["prosemirror-changeset@2.4.1", "", { "dependencies": { "prosemirror-transform": "^1.0.0" } }, "sha512-96WBLhOaYhJ+kPhLg3uW359Tz6I/MfcrQfL4EGv4SrcqKEMC1gmoGrXHecPE8eOwTVCJ4IwgfzM8fFad25wNfw=="],
 
-    "prosemirror-commands": ["prosemirror-commands@1.7.2", "", { "dependencies": { "prosemirror-model": "^1.0.0", "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.10.2" } }, "sha512-q6Q6szxqdu9Xd6EcdKsqXghu5nQdZTpB4Q9yd04WRc7/jt763e/rT60Owh0L1GYY+T46o5rD+9lEN36dZS43tw=="],
+    "prosemirror-commands": ["prosemirror-commands@1.7.1", "", { "dependencies": { "prosemirror-model": "^1.0.0", "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.10.2" } }, "sha512-rT7qZnQtx5c0/y/KlYaGvtG411S97UaL6gdp6RIZ23DLHanMYLyfGBV5DtSnZdthQql7W+lEVbpSfwtO8T+L2w=="],
 
-    "prosemirror-dropcursor": ["prosemirror-dropcursor@1.8.3", "", { "dependencies": { "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.1.0", "prosemirror-view": "^1.1.0" } }, "sha512-FoYbsJR8gK+DGlqhNoE29Loa38eIZPzQRIb1VMaDNBoo4OLP6vVof/jR8qFY/6XvUd6Dhug8MDCHl2a/h8RTfQ=="],
+    "prosemirror-dropcursor": ["prosemirror-dropcursor@1.8.2", "", { "dependencies": { "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.1.0", "prosemirror-view": "^1.1.0" } }, "sha512-CCk6Gyx9+Tt2sbYk5NK0nB1ukHi2ryaRgadV/LvyNuO3ena1payM2z6Cg0vO1ebK8cxbzo41ku2DE5Axj1Zuiw=="],
 
     "prosemirror-gapcursor": ["prosemirror-gapcursor@1.4.1", "", { "dependencies": { "prosemirror-keymap": "^1.0.0", "prosemirror-model": "^1.0.0", "prosemirror-state": "^1.0.0", "prosemirror-view": "^1.0.0" } }, "sha512-pMdYaEnjNMSwl11yjEGtgTmLkR08m/Vl+Jj443167p9eB3HVQKhYCc4gmHVDsLPODfZfjr/MmirsdyZziXbQKw=="],
 
     "prosemirror-history": ["prosemirror-history@1.5.0", "", { "dependencies": { "prosemirror-state": "^1.2.2", "prosemirror-transform": "^1.0.0", "prosemirror-view": "^1.31.0", "rope-sequence": "^1.3.0" } }, "sha512-zlzTiH01eKA55UAf1MEjtssJeHnGxO0j4K4Dpx+gnmX9n+SHNlDqI2oO1Kv1iPN5B1dm5fsljCfqKF9nFL6HRg=="],
 
-    "prosemirror-inputrules": ["prosemirror-inputrules@1.5.1", "", { "dependencies": { "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.0.0" } }, "sha512-7wj4uMjKaXWAQ1CDgxNzNtR9AlsuwzHfdFH1ygEHA2KHF2DOEaXl1CJfNPAKCg9qNEh4rum975QLaCiQPyY6Fw=="],
-
     "prosemirror-keymap": ["prosemirror-keymap@1.2.3", "", { "dependencies": { "prosemirror-state": "^1.0.0", "w3c-keyname": "^2.2.0" } }, "sha512-4HucRlpiLd1IPQQXNqeo81BGtkY8Ai5smHhKW9jjPKRc2wQIxksg7Hl1tTI2IfT2B/LgX6bfYvXxEpJl7aKYKw=="],
 
-    "prosemirror-model": ["prosemirror-model@1.25.11", "", { "dependencies": { "orderedmap": "^2.0.0" } }, "sha512-QWg9RhnpLlogAmp3p96uEFrE5txQpFynd4vhBAELkwgOCWQs/X0yCzB3/hrHqiPwf91RG5KyWq6553zs9JqIOQ=="],
+    "prosemirror-model": ["prosemirror-model@1.25.7", "", { "dependencies": { "orderedmap": "^2.0.0" } }, "sha512-A79aN8QEFUwI6cax8Yq4Rpcx1TJZ3Kagn+ii7qLo4/V8H3mMiHrhFyhTyHHvpSnOgMPpWiDGSwM3etwrxE50ug=="],
 
     "prosemirror-schema-list": ["prosemirror-schema-list@1.5.1", "", { "dependencies": { "prosemirror-model": "^1.0.0", "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.7.3" } }, "sha512-927lFx/uwyQaGwJxLWCZRkjXG0p48KpMj6ueoYiu4JX05GGuGcgzAy62dfiV8eFZftgyBUvLx76RsMe20fJl+Q=="],
 
@@ -1437,9 +1397,9 @@
 
     "prosemirror-tables": ["prosemirror-tables@1.8.5", "", { "dependencies": { "prosemirror-keymap": "^1.2.3", "prosemirror-model": "^1.25.4", "prosemirror-state": "^1.4.4", "prosemirror-transform": "^1.10.5", "prosemirror-view": "^1.41.4" } }, "sha512-V/0cDCsHKHe/tfWkeCmthNUcEp1IVO3p6vwN8XtwE9PZQLAZJigbw3QoraAdfJPir4NKJtNvOB8oYGKRl+t0Dw=="],
 
-    "prosemirror-transform": ["prosemirror-transform@1.12.1", "", { "dependencies": { "prosemirror-model": "^1.21.0" } }, "sha512-t4F5615FycnCqsX7ShTUs8+jfnwcf46kuFRvSl/3qFx2QTZ4DjgowesLHQXcFP7G//TjesqZG3WtgL7vdyVJyA=="],
+    "prosemirror-transform": ["prosemirror-transform@1.12.0", "", { "dependencies": { "prosemirror-model": "^1.21.0" } }, "sha512-GxboyN4AMIsoHNtz5uf2r2Ru551i5hWeCMD6E2Ib4Eogqoub0NflniaBPVQ4MrGE5yZ8JV9tUHg9qcZTTrcN4w=="],
 
-    "prosemirror-view": ["prosemirror-view@1.42.3", "", { "dependencies": { "prosemirror-model": "^1.25.8", "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.1.0" } }, "sha512-oTN7EtH+CpwxU9NrwEYWd0UZ4JUx7l048l5A2Xppm4p/60isZYLnth9QVQmC3VRIvdrIWCxwZSd+Uz791G31/w=="],
+    "prosemirror-view": ["prosemirror-view@1.41.8", "", { "dependencies": { "prosemirror-model": "^1.20.0", "prosemirror-state": "^1.0.0", "prosemirror-transform": "^1.1.0" } }, "sha512-TnKDdohEatgyZNGCDWIdccOHXhYloJwbwU+phw/a23KBvJIR9lWQWW7WHHK3vBdOLDNuF7TaX98GObUZOWkOnA=="],
 
     "pug": ["pug@3.0.4", "", { "dependencies": { "pug-code-gen": "^3.0.4", "pug-filters": "^4.0.0", "pug-lexer": "^5.0.1", "pug-linker": "^4.0.0", "pug-load": "^3.0.0", "pug-parser": "^6.0.0", "pug-runtime": "^3.0.1", "pug-strip-comments": "^2.0.0" } }, "sha512-kFfq5mMzrS7+wrl5pLJzZEzemx34OQ0w4SARfhy/3yxTlhbstsudDwJzhf1hP02yHzbjoVMSXUj/Sz6RNfMyXg=="],
 
@@ -1469,7 +1429,7 @@
 
     "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
 
-    "pure-rand": ["pure-rand@8.4.2", "", {}, "sha512-vvuOGgcuPJAirlHvuQw1TrOiw7ptaIXXmIbNuiNOY6lNGJJH49PQ1Kj4nd783nPdQhQdicgOjVI2yI/9BD6/Ng=="],
+    "pure-rand": ["pure-rand@8.4.0", "", {}, "sha512-IoM8YF/jY0hiugFo/wOWqfmarlE6J0wc6fDK1PhftMk7MGhVZl88sZimmqBBFomLOCSmcCCpsfj7wXASCpvK9A=="],
 
     "queue-microtask": ["queue-microtask@1.2.3", "", {}, "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A=="],
 
@@ -1483,11 +1443,11 @@
 
     "rc-config-loader": ["rc-config-loader@4.1.4", "", { "dependencies": { "debug": "^4.4.3", "js-yaml": "^4.1.1", "json5": "^2.2.3", "require-from-string": "^2.0.2" } }, "sha512-3GiwEzklkbXTDp52UR5nT8iXgYAx1V9ZG/kDZT7p60u2GCv2XTwQq4NzinMoMpNtXhmt3WkhYXcj6HH8HdwCEQ=="],
 
-    "react": ["react@19.2.8", "", {}, "sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw=="],
+    "react": ["react@19.2.5", "", {}, "sha512-llUJLzz1zTUBrskt2pwZgLq59AemifIftw4aB7JxOqf1HY2FDaGDxgwpAPVzHU1kdWabH7FauP4i1oEeer2WCA=="],
 
-    "react-doctor": ["react-doctor@0.2.16", "", { "dependencies": { "@babel/code-frame": "^7.29.0", "@effect/platform-node-shared": "4.0.0-beta.70", "@sentry/node": "^10.54.0", "agent-install": "0.0.5", "conf": "^15.1.0", "confbox": "^0.2.4", "deslop-js": "^0.0.14", "effect": "4.0.0-beta.70", "eslint-plugin-react-hooks": "^7.1.1", "jiti": "^2.7.0", "magicast": "^0.5.3", "oxlint": "^1.66.0", "oxlint-plugin-react-doctor": "0.2.16", "prompts": "^2.4.2", "typescript": ">=5.0.4 <7" }, "bin": { "react-doctor": "bin/react-doctor.js" } }, "sha512-o108QscqM/TlC1QmKgDORf/P53PeZ69nZbRsvy53rXkKvWdKZC1Y0u1JRPmThbTh6v+QpMispBwEnFHhlpZQ7w=="],
+    "react-doctor": ["react-doctor@0.2.14", "", { "dependencies": { "@effect/platform-node-shared": "4.0.0-beta.70", "agent-install": "0.0.5", "conf": "^15.1.0", "deslop-js": "^0.0.13", "effect": "4.0.0-beta.70", "eslint-plugin-react-hooks": "^7.1.1", "oxlint": "^1.66.0", "oxlint-plugin-react-doctor": "0.2.14", "prompts": "^2.4.2", "typescript": ">=5.0.4 <7" }, "bin": { "react-doctor": "bin/react-doctor.js" } }, "sha512-IsdCwvd9SFCnsvcS5mKzhEA2FauW0xc2yZlrHCjfRzUEleXeDzKXRhhLXXxg9cZHzjBQl49Rkqo/+t3XwPDR4A=="],
 
-    "react-dom": ["react-dom@19.2.8", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.8" } }, "sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ=="],
+    "react-dom": ["react-dom@19.2.5", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.5" } }, "sha512-J5bAZz+DXMMwW/wV3xzKke59Af6CHY7G4uYLN1OvBcKEsWOs4pQExj86BBKamxl/Ik5bx9whOrvBlSDfWzgSag=="],
 
     "react-is": ["react-is@17.0.2", "", {}, "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w=="],
 
@@ -1501,9 +1461,9 @@
 
     "repeat-string": ["repeat-string@1.6.1", "", {}, "sha512-PV0dzCYDNfRi1jCDbJzpW7jNNDRuCOG/jI5ctQcGKt/clZD+YcPS3yIlWuTJMmESC8aevCFmWJy5wjAFgNqN6w=="],
 
-    "require-from-string": ["require-from-string@2.0.2", "", {}, "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw=="],
+    "reprism": ["reprism@0.0.11", "", {}, "sha512-VsxDR5QxZo08M/3nRypNlScw5r3rKeSOPdU/QhDmu3Ai3BJxHn/qgfXGWQp/tAxUtzwYNo9W6997JZR0tPLZsA=="],
 
-    "require-in-the-middle": ["require-in-the-middle@8.0.1", "", { "dependencies": { "debug": "^4.3.5", "module-details-from-path": "^1.0.3" } }, "sha512-QT7FVMXfWOYFbeRBF6nu+I6tr2Tf3u0q8RIEjNob/heKY/nh7drD/k7eeMFmSQgnTtCzLDcCu/XEnpW2wk4xCQ=="],
+    "require-from-string": ["require-from-string@2.0.2", "", {}, "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw=="],
 
     "requirejs": ["requirejs@2.3.8", "", { "bin": { "r.js": "bin/r.js", "r_js": "bin/r.js" } }, "sha512-7/cTSLOdYkNBNJcDMWf+luFvMriVm7eYxp4BcFCsAX0wF421Vyce5SXP17c+Jd5otXKGNehIonFlyQXSowL6Mw=="],
 
@@ -1519,7 +1479,7 @@
 
     "reusify": ["reusify@1.1.0", "", {}, "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw=="],
 
-    "rolldown": ["rolldown@1.2.7", "", { "dependencies": { "@oxc-project/types": "=0.148.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm-eabi": "1.2.7", "@rolldown/binding-android-arm64": "1.2.7", "@rolldown/binding-darwin-arm64": "1.2.7", "@rolldown/binding-darwin-x64": "1.2.7", "@rolldown/binding-freebsd-x64": "1.2.7", "@rolldown/binding-linux-arm-gnueabihf": "1.2.7", "@rolldown/binding-linux-arm64-gnu": "1.2.7", "@rolldown/binding-linux-arm64-musl": "1.2.7", "@rolldown/binding-linux-ppc64-gnu": "1.2.7", "@rolldown/binding-linux-s390x-gnu": "1.2.7", "@rolldown/binding-linux-x64-gnu": "1.2.7", "@rolldown/binding-linux-x64-musl": "1.2.7", "@rolldown/binding-openharmony-arm64": "1.2.7", "@rolldown/binding-win32-arm64-msvc": "1.2.7", "@rolldown/binding-win32-x64-msvc": "1.2.7" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-g0EtLvBjTUB7jhyV0S/TCup3v/XSVl45vUIGbOGU4QPiyjTenCe4mKuFvW9fEgYmS2Fo42AUssRmNuMziXdrig=="],
+    "rolldown": ["rolldown@1.0.0-rc.17", "", { "dependencies": { "@oxc-project/types": "=0.127.0", "@rolldown/pluginutils": "1.0.0-rc.17" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.0-rc.17", "@rolldown/binding-darwin-arm64": "1.0.0-rc.17", "@rolldown/binding-darwin-x64": "1.0.0-rc.17", "@rolldown/binding-freebsd-x64": "1.0.0-rc.17", "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.17", "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.17", "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.17", "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.17", "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.17", "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.17", "@rolldown/binding-linux-x64-musl": "1.0.0-rc.17", "@rolldown/binding-openharmony-arm64": "1.0.0-rc.17", "@rolldown/binding-wasm32-wasi": "1.0.0-rc.17", "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.17", "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.17" }, "bin": { "rolldown": "bin/cli.mjs" } }, "sha512-ZrT53oAKrtA4+YtBWPQbtPOxIbVDbxT0orcYERKd63VJTF13zPcgXTvD4843L8pcsI7M6MErt8QtON6lrB9tyA=="],
 
     "rope-sequence": ["rope-sequence@1.3.4", "", {}, "sha512-UT5EDe2cu2E/6O4igUr5PSFs23nvvukicWHx6GnOPlHAiiYbzNuCRQCuiUdHJQcqKalLKlrYJnjY0ySGsXNQXQ=="],
 
@@ -1537,9 +1497,9 @@
 
     "secretlint": ["secretlint@12.3.1", "", { "dependencies": { "@secretlint/config-creator": "12.3.1", "@secretlint/formatter": "12.3.1", "@secretlint/node": "12.3.1", "@secretlint/profiler": "12.3.1", "@secretlint/resolver": "12.3.1", "debug": "^4.4.3", "globby": "^16.2.0", "read-pkg": "^10.1.0" }, "bin": { "secretlint": "bin/secretlint.js" } }, "sha512-wv8TKCjU5hbBxo5jKEX8wIE78VAoL0Ux7pu18+TxtbICMZ2OCbu6EmO3OJLbUbyfUXSPVryNLNmGVgvwY6Z0xw=="],
 
-    "semver": ["semver@7.8.5", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA=="],
+    "semver": ["semver@7.7.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA=="],
 
-    "sharp": ["sharp@0.35.4", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.5" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.4", "@img/sharp-darwin-x64": "0.35.4", "@img/sharp-freebsd-wasm32": "0.35.4", "@img/sharp-libvips-darwin-arm64": "1.3.3", "@img/sharp-libvips-darwin-x64": "1.3.3", "@img/sharp-libvips-linux-arm": "1.3.3", "@img/sharp-libvips-linux-arm64": "1.3.3", "@img/sharp-libvips-linux-ppc64": "1.3.3", "@img/sharp-libvips-linux-riscv64": "1.3.3", "@img/sharp-libvips-linux-s390x": "1.3.3", "@img/sharp-libvips-linux-x64": "1.3.3", "@img/sharp-libvips-linuxmusl-arm64": "1.3.3", "@img/sharp-libvips-linuxmusl-x64": "1.3.3", "@img/sharp-linux-arm": "0.35.4", "@img/sharp-linux-arm64": "0.35.4", "@img/sharp-linux-ppc64": "0.35.4", "@img/sharp-linux-riscv64": "0.35.4", "@img/sharp-linux-s390x": "0.35.4", "@img/sharp-linux-x64": "0.35.4", "@img/sharp-linuxmusl-arm64": "0.35.4", "@img/sharp-linuxmusl-x64": "0.35.4", "@img/sharp-webcontainers-wasm32": "0.35.4", "@img/sharp-win32-arm64": "0.35.4", "@img/sharp-win32-ia32": "0.35.4", "@img/sharp-win32-x64": "0.35.4" } }, "sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA=="],
+    "sharp": ["sharp@0.35.3", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.5" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.3", "@img/sharp-darwin-x64": "0.35.3", "@img/sharp-freebsd-wasm32": "0.35.3", "@img/sharp-libvips-darwin-arm64": "1.3.2", "@img/sharp-libvips-darwin-x64": "1.3.2", "@img/sharp-libvips-linux-arm": "1.3.2", "@img/sharp-libvips-linux-arm64": "1.3.2", "@img/sharp-libvips-linux-ppc64": "1.3.2", "@img/sharp-libvips-linux-riscv64": "1.3.2", "@img/sharp-libvips-linux-s390x": "1.3.2", "@img/sharp-libvips-linux-x64": "1.3.2", "@img/sharp-libvips-linuxmusl-arm64": "1.3.2", "@img/sharp-libvips-linuxmusl-x64": "1.3.2", "@img/sharp-linux-arm": "0.35.3", "@img/sharp-linux-arm64": "0.35.3", "@img/sharp-linux-ppc64": "0.35.3", "@img/sharp-linux-riscv64": "0.35.3", "@img/sharp-linux-s390x": "0.35.3", "@img/sharp-linux-x64": "0.35.3", "@img/sharp-linuxmusl-arm64": "0.35.3", "@img/sharp-linuxmusl-x64": "0.35.3", "@img/sharp-webcontainers-wasm32": "0.35.3", "@img/sharp-win32-arm64": "0.35.3", "@img/sharp-win32-ia32": "0.35.3", "@img/sharp-win32-x64": "0.35.3" } }, "sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q=="],
 
     "shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="],
 
@@ -1553,7 +1513,7 @@
 
     "slice-ansi": ["slice-ansi@4.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "astral-regex": "^2.0.0", "is-fullwidth-code-point": "^3.0.0" } }, "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ=="],
 
-    "smol-toml": ["smol-toml@1.8.0", "", {}, "sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ=="],
+    "smol-toml": ["smol-toml@1.6.1", "", {}, "sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg=="],
 
     "source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
 
@@ -1597,7 +1557,7 @@
 
     "supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
 
-    "supports-hyperlinks": ["supports-hyperlinks@4.5.0", "", { "dependencies": { "has-flag": "^5.0.1", "supports-color": "^10.2.2" } }, "sha512-ZW2OvfeCXrNTbLakPUzjQG922EeGCOteFSVoek5DKStTh898wf7zgtuFlzQN8HfZCxC3Eh02yJVrRW51hADf+w=="],
+    "supports-hyperlinks": ["supports-hyperlinks@4.4.0", "", { "dependencies": { "has-flag": "^5.0.1", "supports-color": "^10.2.2" } }, "sha512-UKbpT93hN5Nr9go5UY7bopIB9YQlMz9nm/ct4IXt/irb5YRkn9WaqrOBJGZ5Pwvsd5FQzSVeYlGdXoCAPQZrPg=="],
 
     "supports-preserve-symlinks-flag": ["supports-preserve-symlinks-flag@1.0.0", "", {}, "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w=="],
 
@@ -1615,7 +1575,7 @@
 
     "textextensions": ["textextensions@6.11.0", "", { "dependencies": { "editions": "^6.21.0" } }, "sha512-tXJwSr9355kFJI3lbCkPpUH5cP8/M0GGy2xLO34aZCjMXBaK3SoPnZwr/oWmo1FdCnELcs4npdCIOFtq9W3ruQ=="],
 
-    "tinyglobby": ["tinyglobby@0.2.17", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g=="],
+    "tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
 
     "tldts": ["tldts@7.4.11", "", { "dependencies": { "tldts-core": "^7.4.11" }, "bin": { "tldts": "bin/cli.js" } }, "sha512-aBiNayCfTQxuIJBm06M+xR14cYaYlDlSXZbgsnKzKNxDKUVq7KFwTjwBSsb7m9Y5xO8WfPnBc63WaYFMTGlvqw=="],
 
@@ -1625,7 +1585,7 @@
 
     "token-stream": ["token-stream@1.0.0", "", {}, "sha512-VSsyNPPW74RpHwR8Fc21uubwHY7wMDeJLys2IX5zJNih+OnAnaifKHo+1LHT7DAdloQ7apeaaWg8l7qnf/TnEg=="],
 
-    "toml": ["toml@4.3.0", "", {}, "sha512-lVb8X9BsPVuH0M4BKeS91tXAmJvCjQ5UIyAbQFaxkKGyUFK2RPkhwaFSQH8vbpl1d23eu/IBH+dwVMHWaq9A5A=="],
+    "toml": ["toml@4.1.1", "", {}, "sha512-EBJnVBr3dTXdA89WVFoAIPUqkBjxPMwRqsfuo1r240tKFHXv3zgca4+NJib/h6TyvGF7vOawz0jGuryJCdNHrw=="],
 
     "tough-cookie": ["tough-cookie@6.0.2", "", { "dependencies": { "tldts": "^7.0.5" } }, "sha512-exgYmnmL/sJpR3upZfXG5PoatXQii55xAiXGXzY+sROLZ/Y+SLcp9PgJNI9Vz37HpQ74WvDcLT8eqm+kV3FzrA=="],
 
@@ -1643,25 +1603,25 @@
 
     "type-check": ["type-check@0.4.0", "", { "dependencies": { "prelude-ls": "^1.2.1" } }, "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew=="],
 
-    "type-fest": ["type-fest@5.9.0", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-yANm3Jr3GiJ1qgJlxGAVxTOIcEOk1rhQHamlXtnrCK7EHP4HeM9OGxtMg/W7HFdrVzw/ZWJKGVIJusVH85sLtw=="],
+    "type-fest": ["type-fest@5.6.0", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-8ZiHFm91orbSAe2PSAiSVBVko18pbhbiB3U9GglSzF/zCGkR+rxpHx6sEMCUm4kxY4LjDIUGgCfUMtwfZfjfUA=="],
 
     "typescript": ["typescript@6.0.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw=="],
 
-    "typescript-eslint": ["typescript-eslint@8.69.0", "", { "dependencies": { "@typescript-eslint/eslint-plugin": "8.69.0", "@typescript-eslint/parser": "8.69.0", "@typescript-eslint/typescript-estree": "8.69.0", "@typescript-eslint/utils": "8.69.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-B3MltX0VqjUBNEe3b3sSuiRbfa6XrfHFtBiPamjT5AsW/dfq+y+bc0wyuS9DxAS1LyzCxRp2+rxzpLUvqM2BvA=="],
+    "typescript-eslint": ["typescript-eslint@8.59.1", "", { "dependencies": { "@typescript-eslint/eslint-plugin": "8.59.1", "@typescript-eslint/parser": "8.59.1", "@typescript-eslint/typescript-estree": "8.59.1", "@typescript-eslint/utils": "8.59.1" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-xqDcFVBmlrltH64lklOVp1wYxgJr6LVdg3NamBgH2OOQDLFdTKfIZXF5PfghrnXQKXZGTQs8tr1vL7fJvq8CTQ=="],
 
     "uint8array-extras": ["uint8array-extras@1.5.0", "", {}, "sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A=="],
 
-    "unbash": ["unbash@4.0.11", "", {}, "sha512-FoSOKV7NEofQSkAefMVHam4ZPKYMxjAydxiV72UFEDNV/YofxjGfiZ2A9pZjdL/lRJzTjcu4PABo1JYJX8N5iQ=="],
+    "unbash": ["unbash@3.0.0", "", {}, "sha512-FeFPZ/WFT0mbRCuydiZzpPFlrYN8ZUpphQKoq4EeElVIYjYyGzPMxQR/simUwCOJIyVhpFk4RbtyO7RuMpMnHA=="],
 
-    "undici": ["undici@8.10.2", "", {}, "sha512-/y4/bH9YNU5hi9NIrpOuvGXFcxrj3CMrV+/AYpowAYTpHn8gX/XPFjNy766FPoYY0miQhdW977JFWKGNhBdwyQ=="],
+    "undici": ["undici@8.10.0", "", {}, "sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ=="],
 
-    "undici-types": ["undici-types@8.10.2", "", {}, "sha512-7/+aSjzkUoLc92hV22bTW4aGanXf800zbwguhcICs0OAoCF9wDOE4wkopQ+SqfhXZm8mCK8gHpdTs7pZUWzK3w=="],
+    "undici-types": ["undici-types@8.10.0", "", {}, "sha512-ibvdovq3nCFs8Msrd95BW+zUOq+aOVbT+wpHUoPWhztbHEoPc6oof51iFDB6Es8lTKvNvVW9jNSAB8dwrKTMGg=="],
 
     "unicorn-magic": ["unicorn-magic@0.4.0", "", {}, "sha512-wH590V9VNgYH9g3lH9wWjTrUoKsjLF6sGLjhR4sH1LWpLmCOH0Zf7PukhDA8BiS7KHe4oPNkcTHqYkj7SOGUOw=="],
 
     "universalify": ["universalify@2.0.1", "", {}, "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw=="],
 
-    "update-browserslist-db": ["update-browserslist-db@1.3.2", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw=="],
+    "update-browserslist-db": ["update-browserslist-db@1.2.3", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w=="],
 
     "uqr": ["uqr@0.1.3", "", {}, "sha512-0rjE8iEJe4YmT9TOhwsZtqCMRLc5DXZUI2UEYUUg63ikBkqqE5EYWaI0etFe/5KUcmcYwLih2RND1kq+hrUJXA=="],
 
@@ -1671,13 +1631,13 @@
 
     "util-deprecate": ["util-deprecate@1.0.2", "", {}, "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw=="],
 
-    "uuid": ["uuid@14.0.2", "", { "bin": { "uuid": "dist-node/bin/uuid" } }, "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ=="],
+    "uuid": ["uuid@14.0.0", "", { "bin": { "uuid": "dist-node/bin/uuid" } }, "sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg=="],
 
     "validate-npm-package-license": ["validate-npm-package-license@3.0.4", "", { "dependencies": { "spdx-correct": "^3.0.0", "spdx-expression-parse": "^3.0.0" } }, "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew=="],
 
     "version-range": ["version-range@4.15.0", "", {}, "sha512-Ck0EJbAGxHwprkzFO966t4/5QkRuzh+/I1RxhLgUKKwEn+Cd8NwM60mE3AqBZg5gYODoXW0EFsQvbZjRlvdqbg=="],
 
-    "vite": ["vite@8.2.2", "", { "dependencies": { "lightningcss": "^1.33.0", "picomatch": "^4.0.5", "postcss": "^8.5.26", "rolldown": "~1.2.4", "tinyglobby": "^0.2.17" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.4.0 || ^0.5.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-cFKLV/PRgAUlIRm5WjMjJ86jrftzpqcgH+Us+DS8mI3CDNiH30Whrz8uHL3+MOLPAgqbMBAqWdAHAphOAM+z/Q=="],
+    "vite": ["vite@8.0.10", "", { "dependencies": { "lightningcss": "^1.32.0", "picomatch": "^4.0.4", "postcss": "^8.5.10", "rolldown": "1.0.0-rc.17", "tinyglobby": "^0.2.16" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.1.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-rZuUu9j6J5uotLDs+cAA4O5H4K1SfPliUlQwqa6YEwSrWDZzP4rhm00oJR5snMewjxF5V/K3D4kctsUTsIU9Mw=="],
 
     "void-elements": ["void-elements@3.1.0", "", {}, "sha512-Dhxzh5HZuiHQhbvTW9AMetFfBHDMYpo23Uo9btPXgdYP+3T5S+p+jgNy7spra+veYhBP2dCSgxR/i2Y02h5/6w=="],
 
@@ -1709,7 +1669,7 @@
 
     "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
 
-    "ws": ["ws@8.21.3", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw=="],
+    "ws": ["ws@8.20.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA=="],
 
     "xml-name-validator": ["xml-name-validator@5.0.0", "", {}, "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg=="],
 
@@ -1721,20 +1681,24 @@
 
     "yallist": ["yallist@3.1.1", "", {}, "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="],
 
-    "yaml": ["yaml@2.9.0", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA=="],
+    "yaml": ["yaml@2.8.4", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-ml/JPOj9fOQK8RNnWojA67GbZ0ApXAUlN2UQclwv2eVgTgn7O9gg9o7paZWKMp4g0H3nTLtS9LVzhkpOFIKzog=="],
 
-    "yjs": ["yjs@13.6.32", "", { "dependencies": { "lib0": "^0.2.99" } }, "sha512-lfiJIIC4Xayt5ItynE407ehlE03pCjeOc4hkR4yxxvvNJ4kuiN25B0g+Qp8XagYz361LLL7DCzR5bvFJ81QKtQ=="],
+    "yjs": ["yjs@13.6.31", "", { "dependencies": { "lib0": "^0.2.99" } }, "sha512-Eq+5BRfbeGyqGVrTJL3bEcr8gKkxPuyuoHmAwpk52fDb8kOVMrfVSTRPd6yiGgX5Fskb96qCRjzjbRjrL4YEnw=="],
 
     "yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
 
-    "zod": ["zod@4.5.4", "", {}, "sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA=="],
+    "zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
 
     "zod-validation-error": ["zod-validation-error@3.5.4", "", { "peerDependencies": { "zod": "^3.24.4" } }, "sha512-+hEiRIiPobgyuFlEojnqjJnhFvg4r/i3cqgcm67eehZf/WBaK3g6cD02YU9mtdVxZjv8CzCA9n/Rhrs3yAAvAw=="],
 
-    "zustand": ["zustand@5.0.15", "", { "peerDependencies": { "@types/react": ">=18.0.0", "immer": ">=9.0.6", "react": ">=18.0.0", "use-sync-external-store": ">=1.2.0" }, "optionalPeers": ["@types/react", "immer", "react", "use-sync-external-store"] }, "sha512-MpSEjRiBkA9crSYeOUH32rJC7SVqAbm0Fqcqge/bUi2PPoLcBWKOsG+C8mevmpr8TwXHBVkChbbJiyvkE+i/3A=="],
+    "zustand": ["zustand@5.0.12", "", { "peerDependencies": { "@types/react": ">=18.0.0", "immer": ">=9.0.6", "react": ">=18.0.0", "use-sync-external-store": ">=1.2.0" }, "optionalPeers": ["@types/react", "immer", "react", "use-sync-external-store"] }, "sha512-i77ae3aZq4dhMlRhJVCYgMLKuSiZAaUPAct2AksxQ+gOtimhGMdXljRT21P5BNpeT4kXlLIckvkPM029OljD7g=="],
 
     "zustand-mutative": ["zustand-mutative@1.3.1", "", { "peerDependencies": { "@types/react": "^18.0 || ^17.0 || ^19.0", "mutative": "^1.3.0", "react": "^18.0 || ^17.0 || ^19.0", "zustand": "^4.0 || ^5.0" } }, "sha512-UU6d/KFdn0f3vlr0EtQGA18yZVaz8E00e0WuuxCwkOCVdmwFwSKOCAdtWgmDdwtbDKjniHCJcxaIIjyymwSk/g=="],
 
+    "@asamuzakjp/css-color/lru-cache": ["lru-cache@11.5.2", "", {}, "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g=="],
+
+    "@asamuzakjp/dom-selector/lru-cache": ["lru-cache@11.5.2", "", {}, "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g=="],
+
     "@babel/core/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
     "@babel/helper-compilation-targets/lru-cache": ["lru-cache@5.1.1", "", { "dependencies": { "yallist": "^3.0.2" } }, "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w=="],
@@ -1745,11 +1709,7 @@
 
     "@eslint-community/eslint-utils/eslint-visitor-keys": ["eslint-visitor-keys@3.4.3", "", {}, "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag=="],
 
-    "@img/sharp-wasm32/@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="],
-
-    "@oxc-parser/binding-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
-
-    "@oxc-parser/binding-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
+    "@img/sharp-wasm32/@emnapi/runtime": ["@emnapi/runtime@1.11.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA=="],
 
     "@secretlint/config-loader/ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
 
@@ -1759,7 +1719,23 @@
 
     "@textlint/linter-formatter/pluralize": ["pluralize@2.0.0", "", {}, "sha512-TqNZzQCD4S42De9IfnnBvILN7HAW7riLqsCyp8lgjXeysyPlX5HhqKAcJHHHb9XskE4/a+7VGC9zzx8Ls0jOAw=="],
 
-    "@types/node/undici-types": ["undici-types@7.18.2", "", {}, "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w=="],
+    "@types/node/undici-types": ["undici-types@7.16.0", "", {}, "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw=="],
+
+    "@typescript-eslint/parser/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
+
+    "@typescript-eslint/project-service/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
+
+    "@typescript-eslint/scope-manager/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
+
+    "@typescript-eslint/type-utils/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
+
+    "@typescript-eslint/typescript-estree/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
+
+    "@typescript-eslint/utils/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
+
+    "@typescript-eslint/visitor-keys/@typescript-eslint/types": ["@typescript-eslint/types@8.59.1", "", {}, "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A=="],
+
+    "agent-install/yaml": ["yaml@2.9.0", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA=="],
 
     "ajv-formats/ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
 
@@ -1771,10 +1747,6 @@
 
     "data-urls/whatwg-url": ["whatwg-url@16.0.1", "", { "dependencies": { "@exodus/bytes": "^1.11.0", "tr46": "^6.0.0", "webidl-conversions": "^8.0.1" } }, "sha512-1to4zXBxmXHV3IiSSEInrreIlu02vUOvrhxJJH5vcxYTBDAx51cqZiKdyTxlecdKNSjj8EcxGBxNf6Vg+945gw=="],
 
-    "dependency-cruiser/picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="],
-
-    "dependency-cruiser/semver": ["semver@7.8.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg=="],
-
     "dependency-tree/commander": ["commander@12.1.0", "", {}, "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="],
 
     "dependency-tree/typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
@@ -1785,10 +1757,14 @@
 
     "effect/ini": ["ini@7.0.0", "", {}, "sha512-ifK0CgjALofS5bkrcTy4RaQ9Vx2Knf/eLeIO+NaswQEpH1UblrtTSCIvN71qQDMq0PeQ/SSPojvEJp9vvvfr+w=="],
 
+    "effect/yaml": ["yaml@2.9.0", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA=="],
+
     "eslint/ignore": ["ignore@5.3.2", "", {}, "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g=="],
 
     "eslint-plugin-react-compiler/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
+    "eslint-plugin-react-hooks/zod-validation-error": ["zod-validation-error@4.0.2", "", { "peerDependencies": { "zod": "^3.25.0 || ^4.0.0" } }, "sha512-Q6/nZLe6jxuU80qb/4uJ4t5v2VEZ44lzQjPDhYJNztRQ4wyWc6VF3D3Kb/fAuPetZQnhS3hnajCf9CsWesghLQ=="],
+
     "fast-glob/glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
 
     "filing-cabinet/commander": ["commander@12.1.0", "", {}, "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="],
@@ -1799,7 +1775,9 @@
 
     "is-expression/acorn": ["acorn@7.4.1", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A=="],
 
-    "jscpd/commander": ["commander@15.0.0", "", {}, "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg=="],
+    "jscpd/commander": ["commander@5.1.0", "", {}, "sha512-P0CysNDQ7rtVw4QIQtm+MRxV66vKFSvlsQvGYXZWR3qFU0jlMKHZZZgw8e+8DSah4UDKMqnknRDQz+xuQXQ/Zg=="],
+
+    "jsdom/lru-cache": ["lru-cache@11.5.2", "", {}, "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g=="],
 
     "jsdom/whatwg-mimetype": ["whatwg-mimetype@5.0.0", "", {}, "sha512-sXcNcHOC51uPGF0P/D4NVtrkjSU2fNsm9iog4ZvZJsL3rjoDAzXZhkm2MWt1y+PUdggKAYVoMAIYcs78wJ51Cw=="],
 
@@ -1809,9 +1787,7 @@
 
     "module-lookup-amd/commander": ["commander@12.1.0", "", {}, "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="],
 
-    "oxc-parser/@oxc-project/types": ["@oxc-project/types@0.147.0", "", {}, "sha512-IJ3s6ltHLp45S0bh7phkX+gJO7A1Wuz2EaqpAhb8WjqDwbzMiWKHhyyT42tskaWjEYXtHtVCPpnBJVT9+dcRLg=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser": ["oxc-parser@0.132.0", "", { "dependencies": { "@oxc-project/types": "^0.132.0" }, "optionalDependencies": { "@oxc-parser/binding-android-arm-eabi": "0.132.0", "@oxc-parser/binding-android-arm64": "0.132.0", "@oxc-parser/binding-darwin-arm64": "0.132.0", "@oxc-parser/binding-darwin-x64": "0.132.0", "@oxc-parser/binding-freebsd-x64": "0.132.0", "@oxc-parser/binding-linux-arm-gnueabihf": "0.132.0", "@oxc-parser/binding-linux-arm-musleabihf": "0.132.0", "@oxc-parser/binding-linux-arm64-gnu": "0.132.0", "@oxc-parser/binding-linux-arm64-musl": "0.132.0", "@oxc-parser/binding-linux-ppc64-gnu": "0.132.0", "@oxc-parser/binding-linux-riscv64-gnu": "0.132.0", "@oxc-parser/binding-linux-riscv64-musl": "0.132.0", "@oxc-parser/binding-linux-s390x-gnu": "0.132.0", "@oxc-parser/binding-linux-x64-gnu": "0.132.0", "@oxc-parser/binding-linux-x64-musl": "0.132.0", "@oxc-parser/binding-openharmony-arm64": "0.132.0", "@oxc-parser/binding-wasm32-wasi": "0.132.0", "@oxc-parser/binding-win32-arm64-msvc": "0.132.0", "@oxc-parser/binding-win32-ia32-msvc": "0.132.0", "@oxc-parser/binding-win32-x64-msvc": "0.132.0" } }, "sha512-+0LAPHaqtfQlvWdpaAa09SmOaZZgP8C552xosEkGJ4+ruEwP1Vgx+sqBgcBCNfR6KDCmagGOZTde8wmAvcI/Hg=="],
+    "oxc-parser/@oxc-project/types": ["@oxc-project/types@0.128.0", "", {}, "sha512-huv1Y/LzBJkBVHt3OlC7u0zHBW9qXf1FdD7sGmc1rXc2P1mTwHssYv7jyGx5KAACSCH+9B3Bhn6Z9luHRvf7pQ=="],
 
     "parse-json/type-fest": ["type-fest@4.41.0", "", {}, "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA=="],
 
@@ -1819,7 +1795,7 @@
 
     "playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
 
-    "postcss/nanoid": ["nanoid@3.3.18", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w=="],
+    "postcss/nanoid": ["nanoid@3.3.12", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ=="],
 
     "precinct/commander": ["commander@12.1.0", "", {}, "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="],
 
@@ -1827,8 +1803,12 @@
 
     "rc/strip-json-comments": ["strip-json-comments@2.0.1", "", {}, "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ=="],
 
+    "rolldown/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.17", "", {}, "sha512-n8iosDOt6Ig1UhJ2AYqoIhHWh/isz0xpicHTzpKBeotdVsTEcxsSA/i3EVM7gQAj0rU27OLAxCjzlj15IWY7bg=="],
+
     "sass-lookup/commander": ["commander@12.1.0", "", {}, "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="],
 
+    "sharp/semver": ["semver@7.8.5", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA=="],
+
     "slice-ansi/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
 
     "stylus-lookup/commander": ["commander@12.1.0", "", {}, "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="],
@@ -1841,11 +1821,9 @@
 
     "zod-validation-error/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
-    "@oxc-parser/binding-wasm32-wasi/@emnapi/core/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
-
     "@secretlint/config-loader/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
 
-    "@secretlint/formatter/strip-ansi/ansi-regex": ["ansi-regex@6.3.0", "", {}, "sha512-WpDfL7NO6j7tH88IDBNVdUJxDh9nmCteAVW9dsep846XdwF4naCBK+/tGLX3KJgcpgMRXCFlTM2hKGoK9FsdrQ=="],
+    "@secretlint/formatter/strip-ansi/ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
 
     "ajv-formats/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
 
@@ -1883,52 +1861,14 @@
 
     "deslop-js/oxc-parser/@oxc-parser/binding-openharmony-arm64": ["@oxc-parser/binding-openharmony-arm64@0.132.0", "", { "os": "none", "cpu": "arm64" }, "sha512-FWzmUGrZ6GUby4U7WIwcCtab6tdmlTO3xTRRKyb5kjIJVEiaUAT8animUG/nK8ZCA8gkRkPOTId4rl6uTqUmJQ=="],
 
+    "deslop-js/oxc-parser/@oxc-parser/binding-wasm32-wasi": ["@oxc-parser/binding-wasm32-wasi@0.132.0", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-TlbMppxJI5CjWDes0QaP6G3aneVg1yikBu5QYI+DUShF9WDL66ccgKFNNGmi/Wybtszw6hxwAvv76T4DaPKnHw=="],
+
     "deslop-js/oxc-parser/@oxc-parser/binding-win32-arm64-msvc": ["@oxc-parser/binding-win32-arm64-msvc@0.132.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-RH/NbFjGKqdUAUi7Oh3LQPxUk2hsWFEEQ38HSnbRQT8QjBZFKqL1fMbmsB3N4jy/KPh9iX94+9dmkEMBBbambw=="],
 
     "deslop-js/oxc-parser/@oxc-parser/binding-win32-ia32-msvc": ["@oxc-parser/binding-win32-ia32-msvc@0.132.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-JUr4jQY9jxoIB/YTLXr6XofSi5xikj6p5/Ns1h0VOBDT0j1jKU+kMsv2xxv51RwnETcXpA1Yw/9oUAfcqfaqEA=="],
 
     "deslop-js/oxc-parser/@oxc-parser/binding-win32-x64-msvc": ["@oxc-parser/binding-win32-x64-msvc@0.132.0", "", { "os": "win32", "cpu": "x64" }, "sha512-2dapgHpA5X8DSXF4AU36hJWYf6zP0tKjMXFRAZFBD62pkevW/uhFDXoFH9Y/3Fd2EtDrw5ByNnR1wVE9X9y0SQ=="],
 
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-android-arm-eabi": ["@oxc-parser/binding-android-arm-eabi@0.132.0", "", { "os": "android", "cpu": "arm" }, "sha512-KrLaPWa5c9Y7LkW+rKkaUE3y7DBDrQtaf7rlsSDfv6KAHUjgzAIRA761Lrrp6//Yd/Rlie/yEOt9YENCoJnOcw=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-android-arm64": ["@oxc-parser/binding-android-arm64@0.132.0", "", { "os": "android", "cpu": "arm64" }, "sha512-SThDrSeamB/kG2+NxcJ5/wSLcV6dUqDknrPLqFYQ0ST/55mtBP4M7Q/f3QbubH6aAd11wpzZn/nwbVRSdobOpg=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-darwin-arm64": ["@oxc-parser/binding-darwin-arm64@0.132.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-Lc0f/TYoKBghE5/2Gsv7bLXk+TJZunx2Tf61X8hG4ARXdc8UYI26dCGccFSd1AyFbK3jfaNXtMnupggDbjPXdQ=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-darwin-x64": ["@oxc-parser/binding-darwin-x64@0.132.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-RG2eJIpf7C21z9HSSXFw1bTArdpKe7Y4fwcJTwRq1yCSe1vSavaN9GA1sm9KqzemTLAGVktQ+7qBTGp0vQeUZg=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-freebsd-x64": ["@oxc-parser/binding-freebsd-x64@0.132.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-wQIPntPLtJ8NcBpvKPbEv3NqzV6k8eP8tP/jE9Rg8HTg/j7urZGFSsTCPCW5k77Qfw2DM4vRvc9p3I4yq/Shvw=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-arm-gnueabihf": ["@oxc-parser/binding-linux-arm-gnueabihf@0.132.0", "", { "os": "linux", "cpu": "arm" }, "sha512-PixKEpeSe3yxQWqNyOCBALRYc72+Tj7ILDofUl3iXo25cVOzLA6jHUhmOINRtWIPh7dbUie3QNeabwaQpZTw6w=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-arm-musleabihf": ["@oxc-parser/binding-linux-arm-musleabihf@0.132.0", "", { "os": "linux", "cpu": "arm" }, "sha512-sCR+DzGHlyHKnbA2z9zWjTUhIo8Sy0enJl4RDsBwPmkxYynPatpwOAWe8W5127SlW0boqUWHGtr1NWn5UwIhXQ=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-arm64-gnu": ["@oxc-parser/binding-linux-arm64-gnu@0.132.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-sQBix5P2cW+IpzTcCwYxnh9yALrKSIkKJThspBvMGcygSMnbzkSvhN7SfuX1hvBk8y1XEChsdkU3ET0V5DmzUw=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-arm64-musl": ["@oxc-parser/binding-linux-arm64-musl@0.132.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-WozHg3Kc//8Sk756HXXgMbEAvqtG+Lzb9JOojwQzIGDtN78Az2dLttkb71akWYUF/8IgYfDSlfKh4Uot8is5Vw=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-ppc64-gnu": ["@oxc-parser/binding-linux-ppc64-gnu@0.132.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-CmX/ulNBOEwWTyVRmcpYKAcAizW6+OjtLJgo7fXoL9OqQvjF4VER8tPomv44vwzfSCy1BHbsB0ZlZYzYJNj4cA=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-riscv64-gnu": ["@oxc-parser/binding-linux-riscv64-gnu@0.132.0", "", { "os": "linux", "cpu": "none" }, "sha512-j9oQS+hM90SdhviNGWbPgT4+Rlq+ac++q/zjgwPD1mVHgxHzATvoRGtDx0sXGmFOQ9J9YkwAhYGb5MAHL6TAsA=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-riscv64-musl": ["@oxc-parser/binding-linux-riscv64-musl@0.132.0", "", { "os": "linux", "cpu": "none" }, "sha512-bLz+Xi+Agnfmd7kWPEsSVwCn2k4EyIalZkNBcQ0OGIv9rqn8VgCPLNd03tM9mKX/5TdlvDXalz0q71BIrOPNqg=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-s390x-gnu": ["@oxc-parser/binding-linux-s390x-gnu@0.132.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-U6t2qbJU0ypTfyj9QV3W1Y6mITDTL8ai/OR6NUn85vyHthOvobKWgXzU4tu0EskSzlpuVFz1g0jFGulDIUKHxQ=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-x64-gnu": ["@oxc-parser/binding-linux-x64-gnu@0.132.0", "", { "os": "linux", "cpu": "x64" }, "sha512-WcEaSNHFk8yz5YFlQQAlhq6jOFmZBB/RKE7uzhyCIf+pF1Lmv9gUH4221mle2Gd9iHyWT3ySNph8yZgb1xYdWg=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-linux-x64-musl": ["@oxc-parser/binding-linux-x64-musl@0.132.0", "", { "os": "linux", "cpu": "x64" }, "sha512-iQrV4iJzQgRwK3BWRmQl1C3C6g3wYpXN2WLdQdyR+efoUnncdShZAVp9OgcojtlD3MDRbuOMGG3SjxF4fL4nlQ=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-openharmony-arm64": ["@oxc-parser/binding-openharmony-arm64@0.132.0", "", { "os": "none", "cpu": "arm64" }, "sha512-FWzmUGrZ6GUby4U7WIwcCtab6tdmlTO3xTRRKyb5kjIJVEiaUAT8animUG/nK8ZCA8gkRkPOTId4rl6uTqUmJQ=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-win32-arm64-msvc": ["@oxc-parser/binding-win32-arm64-msvc@0.132.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-RH/NbFjGKqdUAUi7Oh3LQPxUk2hsWFEEQ38HSnbRQT8QjBZFKqL1fMbmsB3N4jy/KPh9iX94+9dmkEMBBbambw=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-win32-ia32-msvc": ["@oxc-parser/binding-win32-ia32-msvc@0.132.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-JUr4jQY9jxoIB/YTLXr6XofSi5xikj6p5/Ns1h0VOBDT0j1jKU+kMsv2xxv51RwnETcXpA1Yw/9oUAfcqfaqEA=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-parser/binding-win32-x64-msvc": ["@oxc-parser/binding-win32-x64-msvc@0.132.0", "", { "os": "win32", "cpu": "x64" }, "sha512-2dapgHpA5X8DSXF4AU36hJWYf6zP0tKjMXFRAZFBD62pkevW/uhFDXoFH9Y/3Fd2EtDrw5ByNnR1wVE9X9y0SQ=="],
-
-    "oxlint-plugin-react-doctor/oxc-parser/@oxc-project/types": ["@oxc-project/types@0.132.0", "", {}, "sha512-FESMOxil5Se014ui/Eq8fT5uHJo6nIRwH0PfJrZJXs6Gek3ZVFOrpUv3YIZT20m+extU98Hg1Ym72U58rlsxUQ=="],
-
     "table/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
   }
 }
diff --git a/server/ai/mcp/server.ts b/server/ai/mcp/server.ts
index 9f0df9361..55aabca77 100644
--- a/server/ai/mcp/server.ts
+++ b/server/ai/mcp/server.ts
@@ -60,6 +60,7 @@ const NO_WORKSPACE_MESSAGE: Record<EditorBridgeScope, string> = {
 const BROWSER_WORKSPACE_REQUIREMENT: Record<EditorBridgeScope, string> = {
   site: 'Requires the Instatic Site editor to be open in a browser, signed in as the connector owner; this tool edits that live workspace and cannot run headlessly.',
   content: 'Requires the Instatic Content workspace to be open in a browser, signed in as the connector owner; this tool edits that live workspace and cannot run headlessly.',
+  plugin: 'Requires the Instatic Plugin IDE to be open in a browser on the plugin being edited, signed in as the connector owner; this tool edits that live workspace and cannot run headlessly.',
 }
 
 /** Tool description as advertised over MCP — browser tools carry their precondition. */
diff --git a/server/handlers/cms/sitePlugins/index.ts b/server/handlers/cms/sitePlugins/index.ts
index 66d62cd7b..ccf74f0cf 100644
--- a/server/handlers/cms/sitePlugins/index.ts
+++ b/server/handlers/cms/sitePlugins/index.ts
@@ -25,6 +25,7 @@
  * (`site.<localId>` is an ordinary installed_plugins row) — no duplicates.
  */
 import { readFile } from 'node:fs/promises'
+import { MAIN_SCOPE } from '../../../branches/scope'
 import { join } from 'node:path'
 import { nanoid } from 'nanoid'
 import type { SiteFile } from '@core/files/schemas'
@@ -99,7 +100,7 @@ async function handleScaffold(req: Request, db: DbClient): Promise<Response> {
   }
 
   await runPublishFlush()
-  const shell = await getDraftSite(db)
+  const shell = await getDraftSite(db, MAIN_SCOPE)
   if (!shell) return badRequest('No draft site exists yet')
 
   const folder = sitePluginFolder(body.localId)
@@ -133,7 +134,7 @@ async function handleScaffold(req: Request, db: DbClient): Promise<Response> {
   // relay resets the site doc, and connected editors rebind with the new
   // files. The scaffold is a rare, explicit action; the reset is the
   // designed path for external writers.
-  await saveDraftSite(db, {
+  await saveDraftSite(db, MAIN_SCOPE, {
     ...shell,
     files: [...shell.files, ...created],
     updatedAt: now,
@@ -360,12 +361,12 @@ async function handleDelete(
 
   // Then the draft source folder.
   await runPublishFlush()
-  const shell = await getDraftSite(db)
+  const shell = await getDraftSite(db, MAIN_SCOPE)
   if (shell) {
     const folder = sitePluginFolder(localId)
     const remaining = shell.files.filter((file) => !file.path.startsWith(folder))
     if (remaining.length !== shell.files.length) {
-      await saveDraftSite(db, { ...shell, files: remaining, updatedAt: Date.now() })
+      await saveDraftSite(db, MAIN_SCOPE, { ...shell, files: remaining, updatedAt: Date.now() })
     }
   }
 
diff --git a/server/handlers/cms/sitePlugins/service.ts b/server/handlers/cms/sitePlugins/service.ts
index 60427a17f..8d017da26 100644
--- a/server/handlers/cms/sitePlugins/service.ts
+++ b/server/handlers/cms/sitePlugins/service.ts
@@ -14,6 +14,7 @@
  *   - `republishAndSweep`       — the activation/rollback publish coupling
  */
 import type { SiteFile } from '@core/files/schemas'
+import { MAIN_SCOPE } from '../../../branches/scope'
 import type { InstalledPlugin, PluginManifest } from '@core/plugin-sdk'
 import {
   computeSitePluginContentHash,
@@ -76,7 +77,7 @@ export function withSitePluginLock<T>(localId: string, fn: () => Promise<T>): Pr
  */
 export async function readDraftPluginFiles(db: DbClient): Promise<SiteFile[]> {
   await runPublishFlush()
-  const shell = await getDraftSite(db)
+  const shell = await getDraftSite(db, MAIN_SCOPE)
   return shell?.files.filter((file) => file.type === 'plugin') ?? []
 }
 
diff --git a/src/__tests__/collab/filesGranular.test.ts b/src/__tests__/collab/filesGranular.test.ts
index b4e5bbd79..20182dea4 100644
--- a/src/__tests__/collab/filesGranular.test.ts
+++ b/src/__tests__/collab/filesGranular.test.ts
@@ -17,7 +17,7 @@ import {
   seedSiteDoc,
   shellMap,
   siteFileContentText,
-  SITE_DOC_ID,
+  MAIN_SITE_DOC_ID,
 } from '@core/collab'
 import type { SiteDocument } from '@core/page-tree'
 import type { SiteFile } from '@core/files/schemas'
@@ -62,7 +62,7 @@ function mutateThroughPatches(
 ): SiteDocument {
   const [next, patches] = create(site, recipe, { enablePatches: true })
   const docs = createCollabDocSet()
-  docs.set(SITE_DOC_ID, doc)
+  docs.set(MAIN_SITE_DOC_ID, doc)
   applySitePatchesToDocs(patches, site, next, docs, 'test-local')
   return next
 }
diff --git a/src/admin/pages/plugins/ide/IdeActions.tsx b/src/admin/pages/plugins/ide/IdeActions.tsx
index 6252ffbd2..529ba6d92 100644
--- a/src/admin/pages/plugins/ide/IdeActions.tsx
+++ b/src/admin/pages/plugins/ide/IdeActions.tsx
@@ -14,7 +14,7 @@ import {
 } from '@core/site-plugins'
 import { SplitButton, type SplitButtonMenuItem } from '@ui/components/SplitButton'
 import { PeerAvatar } from '@site/collab/PeerAvatar'
-import { formatRelativeTime } from '@site/panels/AgentPanel/relativeTime'
+import { formatRelativeTime } from '@core/utils/relativeTime'
 import { ToolbarStatus, type ToolbarStatusTone } from '@site/toolbar/ToolbarStatus'
 import type { IdePeer } from './idePresence'
 import styles from './IdeActions.module.css'
diff --git a/src/admin/pages/plugins/ide/ideCollab.ts b/src/admin/pages/plugins/ide/ideCollab.ts
index 70d26c657..0d174fbb0 100644
--- a/src/admin/pages/plugins/ide/ideCollab.ts
+++ b/src/admin/pages/plugins/ide/ideCollab.ts
@@ -139,7 +139,7 @@ export function createIdeCollabSession(localId: string): IdeCollabSession {
   attach()
 
   const detachReset = provider.onReset((docId) => {
-    if (docId !== SITE_DOC_ID || destroyed) return
+    if (docId !== MAIN_SITE_DOC_ID || destroyed) return
     // The provider already destroyed the old doc; the undo managers hold
     // its Y.Text instances and must not outlive it.
     for (const manager of undoManagers.values()) manager.destroy()
diff --git a/src/admin/pages/site/collab/collabProvider.ts b/src/admin/pages/site/collab/collabProvider.ts
index 166d750e1..5bca5a52b 100644
--- a/src/admin/pages/site/collab/collabProvider.ts
+++ b/src/admin/pages/site/collab/collabProvider.ts
@@ -71,17 +71,6 @@ const MAX_BACKLOG_BYTES = 512 * 1024
  */
 declare const __INSTATIC_CMS_DEV_ORIGIN__: string | undefined
 
-function socketBaseUrl(): string {
-  if (
-    import.meta.env.DEV &&
-    typeof __INSTATIC_CMS_DEV_ORIGIN__ === 'string' &&
-    __INSTATIC_CMS_DEV_ORIGIN__.length > 0
-  ) {
-    return __INSTATIC_CMS_DEV_ORIGIN__.replace(/^http/, 'ws')
-  }
-  const protocol = window.location.protocol === 'https:' ? 'wss' : 'ws'
-  return `${protocol}://${window.location.host}`
-}
 
 /** y-protocols/sync message types (payload's first varUint). */
 const SYNC_STEP_2 = 1
diff --git a/vite.config.ts b/vite.config.ts
index f8cbbb02b..4cd751441 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -172,12 +172,6 @@ export default defineConfig({
   // so upgrades die — and the proxy can crash Vite outright). In dev the
   // client therefore connects the site socket DIRECTLY to the CMS origin.
   // Cookies are host-scoped (port-agnostic on localhost) and the CMS's
-  // Origin allowlist admits the Vite dev origins, so the direct hop is
-  // fully authenticated. Production serves admin + API from one origin —
-  // this constant compiles to undefined there and the same-origin path runs.
-  define: {
-    __INSTATIC_CMS_DEV_ORIGIN__: JSON.stringify(CMS_DEV_SERVER_ORIGIN),
-  },
   plugins: [
     publicSiteDevProxyPlugin(),
     react(),

From 1d2b561dac4ea8767f61cece37a4e600ff817ff3 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Fri, 4 Sep 2026 16:34:11 +0200
Subject: [PATCH 33/36] test(site-plugins): adapt the suites to branch-scoped
 repositories

- site-plugin and collab tests pass MAIN_SCOPE / the branch id to the
  repositories and the patch translator, which now take them.
- The raw-SQL branch rule required a table name followed by SQL, so an
  English log line reading "from site plugin" tripped it; the pattern now
  needs a clause keyword or terminator and is checked both ways.
- SitePage's budget covers the plugins.edit gate and the IDE route entry;
  the editor body still lands in its own chunk.
---
 .../architecture/branch-scope-repositories.test.ts    |  7 ++++++-
 .../architecture/bundle-size-budgets.test.ts          |  7 +++++--
 src/__tests__/collab/filesGranular.test.ts            |  3 ++-
 src/__tests__/server/sitePluginAiTools.test.ts        |  5 +++--
 src/__tests__/server/sitePluginExport.test.ts         |  3 ++-
 src/__tests__/server/sitePluginLifecycle.test.ts      | 11 ++++++-----
 6 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/src/__tests__/architecture/branch-scope-repositories.test.ts b/src/__tests__/architecture/branch-scope-repositories.test.ts
index 6dfd21e02..3b76b5a5d 100644
--- a/src/__tests__/architecture/branch-scope-repositories.test.ts
+++ b/src/__tests__/architecture/branch-scope-repositories.test.ts
@@ -62,7 +62,12 @@ const RAW_SQL_EXEMPT_PREFIXES = [
   'server/db/',
 ]
 
-const BRANCHED_TABLE_SQL = /\b(from|into|update|join)\s+(data_rows|data_tables|site)\b/i
+// A SQL clause naming a branched table. The table must be followed by SQL —
+// a clause keyword, an alias-free terminator, or the end of the line — so an
+// English sentence like "uses a module from site plugin X" in a log message
+// is not mistaken for a query.
+const BRANCHED_TABLE_SQL =
+  /\b(from|into|update|join)\s+(data_rows|data_tables|site)\s*(?:[`;),(]|$|\b(?:where|set|values|on|using|join|left|inner|outer|cross|order|group|having|limit|offset|returning|select|as)\b)/im
 
 function read(path: string): string {
   return readFileSync(join(ROOT, path), 'utf8')
diff --git a/src/__tests__/architecture/bundle-size-budgets.test.ts b/src/__tests__/architecture/bundle-size-budgets.test.ts
index 22b0362a7..68c047783 100644
--- a/src/__tests__/architecture/bundle-size-budgets.test.ts
+++ b/src/__tests__/architecture/bundle-size-budgets.test.ts
@@ -126,9 +126,12 @@ const BUDGETS: ChunkBudget[] = [
     // Raised from 30 KB when site branches landed: the publish gate (disabled
     // with the inline reason on a branch), the version-history entry, and the
     // per-branch persistence hook are part of the shell by design (~+1 KB raw).
-    maxBytes: 32_000,
+    // Raised again for site plugins: the `plugins.edit` gate, the Plugin IDE
+    // route and workspace entry (~+0.8 KB raw). The editor body still lands in
+    // its own chunk — the shell carries no DnD, canvas, or module code.
+    maxBytes: 33_500,
     rationale:
-      'site route shell (current ~31 KB raw / ~10 KB gzipped). Must not ' +
+      'site route shell (current ~32 KB raw / ~10 KB gzipped). Must not ' +
       'pull the visual editor body, DnD, canvas, first-party modules, or ' +
       'PropertiesPanel back into the active route chunk.',
   },
diff --git a/src/__tests__/collab/filesGranular.test.ts b/src/__tests__/collab/filesGranular.test.ts
index 20182dea4..34d2245ef 100644
--- a/src/__tests__/collab/filesGranular.test.ts
+++ b/src/__tests__/collab/filesGranular.test.ts
@@ -19,6 +19,7 @@ import {
   siteFileContentText,
   MAIN_SITE_DOC_ID,
 } from '@core/collab'
+import { MAIN_BRANCH_ID } from '@core/branches'
 import type { SiteDocument } from '@core/page-tree'
 import type { SiteFile } from '@core/files/schemas'
 import { makeSite } from '../fixtures'
@@ -63,7 +64,7 @@ function mutateThroughPatches(
   const [next, patches] = create(site, recipe, { enablePatches: true })
   const docs = createCollabDocSet()
   docs.set(MAIN_SITE_DOC_ID, doc)
-  applySitePatchesToDocs(patches, site, next, docs, 'test-local')
+  applySitePatchesToDocs(patches, site, next, docs, 'test-local', MAIN_BRANCH_ID)
   return next
 }
 
diff --git a/src/__tests__/server/sitePluginAiTools.test.ts b/src/__tests__/server/sitePluginAiTools.test.ts
index c37a79482..6913840fa 100644
--- a/src/__tests__/server/sitePluginAiTools.test.ts
+++ b/src/__tests__/server/sitePluginAiTools.test.ts
@@ -20,6 +20,7 @@ import {
   type CapabilityTestHarness,
 } from '../helpers/capabilityHarness'
 import { getDraftSite, saveDraftSite } from '../../../server/repositories/site'
+import { MAIN_SCOPE } from '../../../server/branches/scope'
 import { selectToolsForScope } from '../../../server/ai/tools'
 import { pluginTools } from '../../../server/ai/tools/plugin'
 import type { AiTool, ToolContext } from '../../../server/ai/runtime/types'
@@ -157,14 +158,14 @@ describe('plugin lifecycle tool handlers', () => {
     expect(httpActivate.status).toBe(200)
 
     // Change the source (same grants), then the agent rebuilds autonomously.
-    const shell = await getDraftSite(harness.db)
+    const shell = await getDraftSite(harness.db, MAIN_SCOPE)
     if (!shell) throw new Error('no draft')
     const files = shell.files.map((file) =>
       file.path === 'plugins/agent-probe/server/index.ts'
         ? { ...file, content: `${file.content}\n// agent edit`, updatedAt: Date.now() }
         : file,
     )
-    await saveDraftSite(harness.db, { ...shell, files, updatedAt: Date.now() })
+    await saveDraftSite(harness.db, MAIN_SCOPE, { ...shell, files, updatedAt: Date.now() })
 
     const result = await run('plugin_activate', { localId: 'agent-probe' }, ctx(OWNER_CAPS))
     expect(result.ok).toBe(true)
diff --git a/src/__tests__/server/sitePluginExport.test.ts b/src/__tests__/server/sitePluginExport.test.ts
index 02f6cb9ee..7a9112fa4 100644
--- a/src/__tests__/server/sitePluginExport.test.ts
+++ b/src/__tests__/server/sitePluginExport.test.ts
@@ -12,6 +12,7 @@ import {
   type CapabilityTestHarness,
 } from '../helpers/capabilityHarness'
 import { getDraftSite } from '../../../server/repositories/site'
+import { MAIN_SCOPE } from '../../../server/branches/scope'
 import { getInstalledPlugin } from '../../../server/repositories/plugins'
 
 let source: CapabilityTestHarness
@@ -75,7 +76,7 @@ describe('site plugin export/import', () => {
     expect(importRes.status).toBe(200)
     await readJson(importRes)
 
-    const shell = await getDraftSite(target.db)
+    const shell = await getDraftSite(target.db, MAIN_SCOPE)
     const pluginFiles = shell?.files.filter((file) => file.type === 'plugin') ?? []
     expect(pluginFiles.map((file) => file.path).sort()).toEqual([
       'plugins/newsletter/plugin.json',
diff --git a/src/__tests__/server/sitePluginLifecycle.test.ts b/src/__tests__/server/sitePluginLifecycle.test.ts
index d2b74f9e0..1e979991a 100644
--- a/src/__tests__/server/sitePluginLifecycle.test.ts
+++ b/src/__tests__/server/sitePluginLifecycle.test.ts
@@ -16,6 +16,7 @@ import {
   type CapabilityTestHarness,
 } from '../helpers/capabilityHarness'
 import { getDraftSite, saveDraftSite } from '../../../server/repositories/site'
+import { MAIN_SCOPE } from '../../../server/branches/scope'
 import { getInstalledPlugin } from '../../../server/repositories/plugins'
 import type { SitePluginSummary } from '@core/site-plugins'
 
@@ -38,12 +39,12 @@ afterAll(async () => {
 })
 
 async function updateDraftFile(path: string, content: string): Promise<void> {
-  const shell = await getDraftSite(harness.db)
+  const shell = await getDraftSite(harness.db, MAIN_SCOPE)
   if (!shell) throw new Error('no draft site')
   const files = shell.files.map((file) =>
     file.path === path ? { ...file, content, updatedAt: Date.now() } : file,
   )
-  await saveDraftSite(harness.db, { ...shell, files, updatedAt: Date.now() })
+  await saveDraftSite(harness.db, MAIN_SCOPE, { ...shell, files, updatedAt: Date.now() })
 }
 
 describe('site plugin scaffold + validate', () => {
@@ -90,7 +91,7 @@ describe('site plugin scaffold + validate', () => {
       json: { name: 'Newsletter', localId: 'newsletter', template: 'routes' },
     })
     expect(res.status).toBe(201)
-    const shell = await getDraftSite(harness.db)
+    const shell = await getDraftSite(harness.db, MAIN_SCOPE)
     // Scope to this plugin's folder — the suite scaffolds other plugins too.
     const pluginFiles = (shell?.files ?? []).filter(
       (file) => file.type === 'plugin' && file.path.startsWith('plugins/newsletter/'),
@@ -229,7 +230,7 @@ describe('site plugin activation authority', () => {
   })
 
   test('adding a permission requires step-up again; grants follow declarations', async () => {
-    const shell = await getDraftSite(harness.db)
+    const shell = await getDraftSite(harness.db, MAIN_SCOPE)
     const manifestFile = shell?.files.find((file) => file.path === 'plugins/newsletter/plugin.json')
     expect(manifestFile).toBeDefined()
     await updateDraftFile(
@@ -367,7 +368,7 @@ describe('site plugin delete', () => {
 
     expect(await getInstalledPlugin(harness.db, 'site.newsletter')).toBeNull()
     expect(existsSync(join(uploadsDir, 'plugins', 'site.newsletter'))).toBe(false)
-    const shell = await getDraftSite(harness.db)
+    const shell = await getDraftSite(harness.db, MAIN_SCOPE)
     expect(shell?.files.some((file) => file.path.startsWith('plugins/newsletter/'))).toBe(false)
   })
 })

From 05d9ee4ea40cf177faf6574ffe6d2dd554777e18 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sat, 5 Sep 2026 09:38:04 +0200
Subject: [PATCH 34/36] test(site-plugins): cover the Plugin IDE end to end

SITEPLUGIN-001: scaffold a site plugin from the plugins workspace, confirm
it opens in the IDE with real source, build and activate it through the
permission review and step-up, see it in the merged plugin list, then edit
the server entry and watch the state fall back to Draft changed.

The IDE had no browser coverage at all, so nothing caught a regression in
the draft to build to activate coupling.
---
 docs/e2e/feature-matrix.md    |  1 +
 tests/e2e/site-plugins.e2e.ts | 99 +++++++++++++++++++++++++++++++++++
 2 files changed, 100 insertions(+)
 create mode 100644 tests/e2e/site-plugins.e2e.ts

diff --git a/docs/e2e/feature-matrix.md b/docs/e2e/feature-matrix.md
index 5074a000d..03f0b907d 100644
--- a/docs/e2e/feature-matrix.md
+++ b/docs/e2e/feature-matrix.md
@@ -329,6 +329,7 @@ AI-002 note: Data-scope default selection, save feedback, reload persistence, cl
 | PLUGIN-005 | P2 | partial | Plugins | Inspect and control plugin schedules | Active plugin with schedules | Plugin schedule dialog | Schedules list and mutating controls respect permissions | stale paused state, duplicate runs |
 | PLUGIN-006 | P2 | partial | Plugins | Install a plugin-provided site pack | Active plugin with pack | Plugins page | Pack content imports with clear feedback | conflicts, partial imports |
 | PLUGIN-008 | P2 | ✅ | Plugins | Upload invalid plugin package | Logged in | Plugins page | Error is specific and recoverable | generic failure, stuck upload |
+| SITEPLUGIN-001 | P1 | ✅ | Plugins | Author, build and activate a site plugin in the Plugin IDE | Logged in with plugins.edit | Plugins page, Plugin IDE | Scaffold opens in the IDE, builds cleanly, activates through the permission review, and an edit reads as Draft changed | stale build served after an edit, activation without consent |
 
 PLUGIN-001 note: JSON manifest review/install step-up is automated in `capabilities.e2e.ts`; ZIP package review/install and activation are exercised by the packaged lifecycle/surfaces fixtures in `plugins.e2e.ts`; malformed ZIP/path-traversal/package-edge coverage remains lower-level or future browser expansion.
 
diff --git a/tests/e2e/site-plugins.e2e.ts b/tests/e2e/site-plugins.e2e.ts
new file mode 100644
index 000000000..181a24c1a
--- /dev/null
+++ b/tests/e2e/site-plugins.e2e.ts
@@ -0,0 +1,99 @@
+import { expect, test } from '@playwright/test'
+import { ANONYMOUS_STATE, completeStepUp, login } from './helpers'
+
+/**
+ * SITEPLUGIN-001 — the Plugin IDE end to end: scaffold a site plugin from the
+ * plugins workspace, edit its source in the co-edited buffer, build and
+ * activate it through the permission review, and see the activated plugin in
+ * the merged list. Then edit again and watch the state fall back to
+ * "Draft changed" until the rebuild.
+ *
+ * Site plugins are authored in the site draft and activated through the same
+ * lifecycle as uploaded packages, so this is also the regression guard on the
+ * draft → build → activate coupling (docs/features/site-plugins.md).
+ */
+
+const PLUGIN_NAME = 'E2E Banner'
+const PLUGIN_ID = 'e2e-banner'
+
+test.describe.configure({ mode: 'serial' })
+
+// Activation is step-up gated, and a step-up rotates the shared owner session,
+// so every test signs in for itself from an anonymous context (the pattern the
+// branch specs use for their step-up flows).
+test.use({ storageState: ANONYMOUS_STATE })
+
+test('scaffolds a site plugin and opens it in the IDE (SITEPLUGIN-001)', async ({ page }) => {
+  await login(page)
+  await page.goto('/admin/plugins')
+  await expect(page.getByTestId('plugins-admin-canvas')).toBeVisible({ timeout: 20_000 })
+
+  await page.getByTestId('new-site-plugin').click()
+  await page.locator('#site-plugin-name').fill(PLUGIN_NAME)
+  // The id derives from the name; the routes template scaffolds server code
+  // that builds without a canvas, which keeps this spec headless-friendly.
+  await expect(page.locator('#site-plugin-id')).toHaveValue(PLUGIN_ID)
+  await page.getByRole('radio', { name: 'Backend routes' }).click()
+  await page.getByTestId('create-site-plugin').click()
+
+  // Creating lands in the full-screen IDE for the new plugin.
+  await expect(page).toHaveURL(new RegExp(`/admin/plugins/develop/${PLUGIN_ID}`), { timeout: 20_000 })
+  await expect(page.getByTestId('ide-file-tree')).toBeVisible({ timeout: 20_000 })
+
+  // The scaffold is real source, not an empty shell: plugin.json plus the
+  // template's server entry, and the buffer opens on the manifest.
+  const rows = page.getByTestId('ide-file-row')
+  await expect(rows.filter({ hasText: 'plugin.json' })).toHaveCount(1)
+  await expect(rows).not.toHaveCount(0)
+  await expect(page.getByTestId('ide-code-editor')).toBeVisible()
+  await expect(page.getByTestId('ide-code-editor')).toContainText(PLUGIN_NAME)
+
+  // A fresh scaffold has no built artefact yet, so it reads as draft.
+  await expect(page.getByTestId('ide-state-chip')).toContainText('Draft changed')
+})
+
+test('builds and activates through the permission review (SITEPLUGIN-001)', async ({ page }) => {
+  await login(page)
+  await page.goto(`/admin/plugins/develop/${PLUGIN_ID}`)
+  await expect(page.getByTestId('ide-file-tree')).toBeVisible({ timeout: 20_000 })
+  // The draft has to sync before the IDE will write or build.
+  await expect(page.getByTestId('ide-primary-action')).toBeEnabled({ timeout: 20_000 })
+
+  await page.getByTestId('ide-primary-action').click()
+
+  // Activation states the permissions the manifest declares; granting them is
+  // the explicit consent step, and it is step-up gated.
+  const review = page.getByRole('dialog', { name: new RegExp(`Activate ${PLUGIN_NAME}`) })
+  await expect(review).toBeVisible({ timeout: 20_000 })
+  await page.getByTestId('confirm-site-plugin-grants').click()
+  await completeStepUp(page)
+
+  await expect(page.getByTestId('ide-state-chip')).toContainText('Active', { timeout: 40_000 })
+  // A clean build reports no diagnostics.
+  await expect(page.getByTestId('ide-diagnostics')).not.toContainText(/error/i)
+
+  // The activated site plugin joins the one merged plugin list.
+  await page.goto('/admin/plugins')
+  await expect(page.getByTestId('plugins-admin-canvas')).toContainText(PLUGIN_NAME, { timeout: 20_000 })
+})
+
+test('an edit marks the draft changed until the next build (SITEPLUGIN-001)', async ({ page }) => {
+  await login(page)
+  await page.goto(`/admin/plugins/develop/${PLUGIN_ID}`)
+  await expect(page.getByTestId('ide-file-tree')).toBeVisible({ timeout: 20_000 })
+  await expect(page.getByTestId('ide-state-chip')).toContainText('Active', { timeout: 20_000 })
+
+  // Edit the server entry, not the manifest: a comment is valid there, so the
+  // state moves for the right reason (a changed draft, not a broken build).
+  await page.getByTestId('ide-file-row').filter({ hasText: 'index.ts' }).first().click()
+  const editor = page.getByTestId('ide-code-editor').locator('.cm-content')
+  await expect(editor).toContainText('Server entrypoint', { timeout: 20_000 })
+  // Type into the co-edited buffer; the relay persists it with no save action.
+  await editor.click()
+  await page.keyboard.press('ControlOrMeta+End')
+  await page.keyboard.type('\n// edited by the e2e run\n')
+
+  // The built artefact no longer matches the draft, and the IDE says so
+  // rather than silently serving stale code.
+  await expect(page.getByTestId('ide-state-chip')).toContainText('Draft changed', { timeout: 30_000 })
+})

From 5e363a42a1bf447738f51710e391ce3f11c257bf Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Sat, 5 Sep 2026 10:03:29 +0200
Subject: [PATCH 35/36] test(plugins): point the capability helper at the
 merged plugin list

Site plugins put uploaded packages and site-authored ones in one list, so
its region is labelled "Plugins" rather than "Installed plugins". The
capability spec's helper still looked for the old label and took the whole
plugin-boundaries block down with it.
---
 tests/e2e/capabilities.e2e.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/e2e/capabilities.e2e.ts b/tests/e2e/capabilities.e2e.ts
index 96e0a72de..ef11047dc 100644
--- a/tests/e2e/capabilities.e2e.ts
+++ b/tests/e2e/capabilities.e2e.ts
@@ -1403,7 +1403,7 @@ async function installReviewedPluginPackage(
 
 function installedPluginHeading(page: Page, pluginName: string) {
   return page
-    .locator('[aria-label="Installed plugins"]')
+    .locator('[aria-label="Plugins"]')
     .getByRole('heading', { name: pluginName })
 }
 

From 7c59b256855cbb9c8d3736e49594124b79c8e746 Mon Sep 17 00:00:00 2001
From: DavidBabinec <hello@davidbabinec.com>
Date: Fri, 11 Sep 2026 23:08:31 +0200
Subject: [PATCH 36/36] fix(site-plugins): settle the branch on main after the
 rebase

The plugin source migration moves to 031, behind the branches ones
(027 to 029) and the timestamp rewrite (030) main took since the fork.

activatePluginPackageFromDisk sends anything already installed through
the upgrade lifecycle, whatever its version, the way main's zip path
has since #498: a same-version rebuild and a rollback to an older build
must deactivate the running plugin before its files are replaced, and
the fresh path would run install on a live plugin with no rollback.
The semver comparison main removed is gone with it.

The dev-only direct socket hop that the branch added while Vite's
WebSocket proxy was broken under Bun 1.3 is dropped: main runs on Bun
1.4.2 and #503 deleted the workaround, so only its stray fragments had
survived the replay. The site-plugins doc names migration 031.
---
 docs/features/site-plugins.md                 |  2 +-
 server/handlers/cms/plugins/install.ts        | 12 +++++++-----
 src/admin/pages/site/collab/collabProvider.ts | 14 --------------
 vite.config.ts                                |  7 -------
 4 files changed, 8 insertions(+), 27 deletions(-)

diff --git a/docs/features/site-plugins.md b/docs/features/site-plugins.md
index 01f3b6e45..6c8f964ce 100644
--- a/docs/features/site-plugins.md
+++ b/docs/features/site-plugins.md
@@ -111,7 +111,7 @@ violations, and manifest errors — **not** TypeScript semantic errors
 ## Runtime model and lifecycle
 
 A site plugin IS an `installed_plugins` row (`source: 'site-local'`,
-migration `022_installed_plugins_source`, additive, both dialects). The
+migration `031_installed_plugins_source`, additive, both dialects). The
 worker, QuickJS VM, route registry, hooks, schedules, settings/secrets,
 event broadcaster, crash recovery, and frontend injection consume it with
 **zero provenance branches** (gated by `site-plugin-invariants.test.ts`).
diff --git a/server/handlers/cms/plugins/install.ts b/server/handlers/cms/plugins/install.ts
index 3f29fd425..4cd2ad0cb 100644
--- a/server/handlers/cms/plugins/install.ts
+++ b/server/handlers/cms/plugins/install.ts
@@ -244,17 +244,19 @@ export interface ActivatePackageOutcome {
  * full plugin lifecycle: fresh = `install` -> `activate`; upgrade = old
  * `deactivate` -> row swap -> `migrate({ fromVersion })` -> `activate`,
  * with rollback to the previous version on failure. Audit + event
- * broadcast included. Callers with version-ordering rules (the zip route
- * rejects downgrades) enforce them BEFORE calling.
+ * broadcast included. Anything already installed takes the upgrade path
+ * whatever its version: a same-version rebuild and a rollback to an older
+ * build must deactivate the running plugin before replacing its files, and
+ * the fresh path would run `install` on a live plugin with no rollback.
+ * Callers with version-ordering rules (the zip route rejects downgrades)
+ * enforce them BEFORE calling.
  */
 export async function activatePluginPackageFromDisk(
   input: ActivatePackageFromDiskInput,
 ): Promise<ActivatePackageOutcome> {
   const existingResult = await getInstalledPlugin(input.db, input.manifest.id)
   const existing = existingResult?.kind === 'ok' ? existingResult.plugin : null
-  if (existing && semverGt(input.manifest.version, existing.version)) {
-    return upgradeFromDisk(input, existing)
-  }
+  if (existing) return upgradeFromDisk(input, existing)
   return freshInstallFromDisk(input)
 }
 
diff --git a/src/admin/pages/site/collab/collabProvider.ts b/src/admin/pages/site/collab/collabProvider.ts
index 5bca5a52b..b22c8a705 100644
--- a/src/admin/pages/site/collab/collabProvider.ts
+++ b/src/admin/pages/site/collab/collabProvider.ts
@@ -58,20 +58,6 @@ const PING_INTERVAL_MS = 10_000
  */
 const MAX_BACKLOG_BYTES = 512 * 1024
 
-/**
- * Dev-only: the CMS server's own origin, injected by `vite.config.ts`
- * (`define`). Vite's WebSocket proxying is broken when Vite runs under Bun
- * (its bundled http-proxy calls `socket.destroySoon`, which Bun's
- * net.Socket lacks — upgrades die before establishing), so in dev the
- * socket connects DIRECTLY to the CMS instead of through the proxy.
- * Cookies are host-scoped (port-agnostic on localhost) and the CMS's
- * Origin allowlist admits the Vite dev origins, so the direct hop stays
- * fully authenticated. Production serves admin + API from one origin and
- * uses the same-origin path.
- */
-declare const __INSTATIC_CMS_DEV_ORIGIN__: string | undefined
-
-
 /** y-protocols/sync message types (payload's first varUint). */
 const SYNC_STEP_2 = 1
 
diff --git a/vite.config.ts b/vite.config.ts
index 4cd751441..4d9f589c4 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -165,13 +165,6 @@ function vendorChunkName(moduleId: string): string | null {
 
 // https://vite.dev/config/
 export default defineConfig({
-  // Dev-only constant consumed by the collab socket client
-  // (src/admin/pages/site/collab/collabProvider.ts): Vite's WebSocket
-  // proxying is broken when Vite runs under Bun (its bundled http-proxy
-  // calls `socket.destroySoon`, which Bun's net.Socket does not implement,
-  // so upgrades die — and the proxy can crash Vite outright). In dev the
-  // client therefore connects the site socket DIRECTLY to the CMS origin.
-  // Cookies are host-scoped (port-agnostic on localhost) and the CMS's
   plugins: [
     publicSiteDevProxyPlugin(),
     react(),