plotlink-ows 1.0.33 → 1.2.95

package/app/web/lib/upload-retry.ts

@@ -0,0 +1,130 @@
+// Retry/backoff for rate-limited cartoon cut image uploads (#288).
+//
+// The PlotLink upload endpoint rate-limits to 5 uploads/minute. A normal webtoon
+// episode commonly has more than five cuts, so the batch "Upload & Generate" flow
+// would otherwise fail mid-batch on the 6th+ cut with a "Rate limit exceeded"
+// response. These helpers retry a single upload with backoff while it is
+// rate-limited, while leaving genuine (non-rate-limit) failures to fail fast.
+
+// PlotLink allows 5 uploads/minute, so ~12s spacing clears the window for the
+// next cut. Backoff grows from here and is capped so a stuck batch still ends.
+export const RATE_LIMIT_BASE_DELAY_MS = 12_000;
+export const RATE_LIMIT_MAX_RETRIES = 5;
+const MAX_BACKOFF_MS = 60_000;
+
+// PlotLink's documented limit: 5 uploads per rolling 60s window. The proactive
+// throttle below paces the batch to stay under this, so a 7–10 cut episode never
+// blows the budget in a tight loop and then thrashes on reactive backoff (#413).
+export const RATE_LIMIT_WINDOW_MS = 60_000;
+export const RATE_LIMIT_BURST = 5;
+
+/**
+ * A rate-limit response. The OWS route currently forwards PlotLink's rate-limit
+ * as a 500 carrying the upstream message ("Rate limit exceeded. Max 5 uploads
+ * per minute."), so we detect by status 429 OR a rate-limit message — either is
+ * treated as retryable.
+ */
+export function isRateLimitError(status: number, errorMessage?: string | null): boolean {
+  if (status === 429) return true;
+  return !!errorMessage && /rate[\s-]?limit/i.test(errorMessage);
+}
+
+/** Backoff for the Nth retry (0-based): base, 2×base, 4×base, … capped. */
+export function backoffMs(retry: number, baseDelayMs = RATE_LIMIT_BASE_DELAY_MS): number {
+  return Math.min(baseDelayMs * 2 ** retry, MAX_BACKOFF_MS);
+}
+
+export interface AttemptResult {
+  ok: boolean;
+  status: number;
+  errorMessage?: string | null;
+}
+
+export interface RetryDeps {
+  /** Injectable for tests; defaults to a real setTimeout-based sleep. */
+  sleep?: (ms: number) => Promise<void>;
+  maxRetries?: number;
+  baseDelayMs?: number;
+  /** Called once before each backoff wait so the UI can show a waiting state. */
+  onWaiting?: (info: { attempt: number; maxRetries: number; waitMs: number }) => void;
+}
+
+const defaultSleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
+
+/**
+ * Run `attempt` and, while its result is rate-limited, wait with backoff and
+ * retry up to `maxRetries` times. Returns the first non-rate-limited result, or
+ * the last rate-limited result once retries are exhausted (so the caller still
+ * gets the affected status/message to report). Never retries a non-rate-limit
+ * failure or a success.
+ */
+export async function withRateLimitRetry<T extends AttemptResult>(
+  attempt: () => Promise<T>,
+  deps: RetryDeps = {},
+): Promise<T> {
+  const sleep = deps.sleep ?? defaultSleep;
+  const maxRetries = deps.maxRetries ?? RATE_LIMIT_MAX_RETRIES;
+  const baseDelayMs = deps.baseDelayMs ?? RATE_LIMIT_BASE_DELAY_MS;
+
+  let retries = 0;
+  for (;;) {
+    const result = await attempt();
+    if (result.ok || !isRateLimitError(result.status, result.errorMessage)) return result;
+    if (retries >= maxRetries) return result;
+    const waitMs = backoffMs(retries, baseDelayMs);
+    retries += 1;
+    deps.onWaiting?.({ attempt: retries, maxRetries, waitMs });
+    await sleep(waitMs);
+  }
+}
+
+export interface ThrottleDeps {
+  /** Max uploads allowed per window (default 5 = PlotLink's per-minute limit). */
+  limit?: number;
+  /** Rolling window length in ms (default 60_000). */
+  windowMs?: number;
+  /** Injectable for tests; defaults to a real setTimeout-based sleep. */
+  sleep?: (ms: number) => Promise<void>;
+  /** Injectable clock for tests; defaults to Date.now. */
+  now?: () => number;
+  /** Called once before each proactive wait so the UI can show a waiting state. */
+  onWaiting?: (info: { waitMs: number }) => void;
+}
+
+/**
+ * Build a proactive sliding-window throttle for a batch of uploads (#413).
+ *
+ * Returns an async `throttle()` to call immediately BEFORE each upload. It records
+ * each call's timestamp and, once `limit` uploads have happened inside the last
+ * `windowMs`, sleeps until the oldest of those falls out of the window before
+ * letting the next through — so a 7–10 cut batch paces itself under PlotLink's
+ * 5/min limit instead of firing all uploads at once and then thrashing on reactive
+ * 429 backoff. `withRateLimitRetry` stays as the safety net for any 429 that still
+ * slips through (e.g. budget consumed by another client). Pure aside from the
+ * injected clock/sleep, so it's deterministic in tests.
+ */
+export function createUploadThrottle(deps: ThrottleDeps = {}) {
+  const limit = deps.limit ?? RATE_LIMIT_BURST;
+  const windowMs = deps.windowMs ?? RATE_LIMIT_WINDOW_MS;
+  const sleep = deps.sleep ?? defaultSleep;
+  const now = deps.now ?? (() => Date.now());
+  const stamps: number[] = [];
+
+  const dropExpired = () => {
+    const cutoff = now() - windowMs;
+    while (stamps.length && stamps[0] <= cutoff) stamps.shift();
+  };
+
+  return async function throttle(): Promise<void> {
+    dropExpired();
+    if (stamps.length >= limit) {
+      const waitMs = stamps[0] + windowMs - now();
+      if (waitMs > 0) {
+        deps.onWaiting?.({ waitMs });
+        await sleep(waitMs);
+      }
+      dropExpired();
+    }
+    stamps.push(now());
+  };
+}

package/app/web/lib/verify-public-title.ts

@@ -0,0 +1,105 @@
+import { isRawFilenameTitle, isGenericEpisodeTitle } from "./publish-helpers";
+
+/**
+ * End-to-end public-title verification for cartoon publishes (#379).
+ *
+ * Local guards (#347/#358/#365/#368) ensure OWS *sends* a reader-facing title,
+ * but the real pilot (`plotlink.xyz/story/59/1` rendered `genesis` / `plot-01`)
+ * showed we must also prove the PUBLIC, indexed metadata is reader-facing — not
+ * just that local preview computed a good label. After indexing, OWS reads the
+ * indexed storyline detail and verifies the title here. Already-published bad
+ * titles are immutable, so this can only warn + keep the next publish honest.
+ */
+
+/** Subset of PlotLink's `GET /api/storyline/<id>` response we read for #379. */
+export interface PublicStorylineDetail {
+  title?: string;
+  name?: string;
+  // PlotLink may expose per-episode entries (plots/chapters) with their own
+  // title + index; we read whichever is present, matching by plot index.
+  plots?: Array<{ title?: string; name?: string; index?: number; plotIndex?: number }>;
+  chapters?: Array<{ title?: string; name?: string; index?: number; plotIndex?: number }>;
+}
+
+export interface PublicTitleVerdict {
+  /** false → the indexed public title is raw/generic (verification failed). */
+  ok: boolean;
+  /** false → the relevant public title field was absent (read inconclusive). */
+  checked: boolean;
+  /** the public title actually evaluated, when present. */
+  publicTitle?: string;
+  /** human-facing failure reason, when ok === false. */
+  reason?: string;
+}
+
+/** Find the public title for a plot index across whichever list PlotLink returns. */
+function pickPlotTitle(detail: PublicStorylineDetail, plotIndex: number | undefined): string | undefined {
+  const lists = [detail.plots, detail.chapters].filter(Boolean) as NonNullable<PublicStorylineDetail["plots"]>[];
+  for (const list of lists) {
+    const byIndex =
+      plotIndex != null ? list.find((p) => p.plotIndex === plotIndex || p.index === plotIndex) : undefined;
+    let entry = byIndex;
+    if (!entry && list.length === 1) {
+      // Fall back to the lone entry ONLY when it carries no index to match on
+      // (or the caller gave no index) — never when a known index simply differs,
+      // which would verify the wrong episode.
+      const only = list[0];
+      const hasIndex = only.plotIndex != null || only.index != null;
+      if (!hasIndex || plotIndex == null) entry = only;
+    }
+    const t = (entry?.title ?? entry?.name)?.trim();
+    if (t) return t;
+  }
+  return undefined;
+}
+
+/**
+ * Verify the indexed PlotLink title for a cartoon publish is reader-facing.
+ * Genesis (storyline) titles must not be the raw `genesis` fallback; plot titles
+ * must not be `plot-NN` or a generic `Episode NN` placeholder. Returns
+ * `checked: false` when the relevant public title is absent, so the caller never
+ * false-fails an inconclusive read (e.g. a transient indexer response).
+ */
+export function verifyPublicCartoonTitle(opts: {
+  fileName: string;
+  detail: PublicStorylineDetail | null | undefined;
+  plotIndex?: number;
+}): PublicTitleVerdict {
+  const { fileName, detail, plotIndex } = opts;
+  if (!detail) return { ok: true, checked: false };
+
+  if (fileName === "genesis.md") {
+    const publicTitle = (detail.title ?? detail.name)?.trim();
+    if (!publicTitle) return { ok: true, checked: false };
+    if (isRawFilenameTitle(publicTitle, "genesis.md")) {
+      return {
+        ok: false,
+        checked: true,
+        publicTitle,
+        reason: `PlotLink indexed the storyline title as “${publicTitle}”, a raw filename rather than the reader-facing title.`,
+      };
+    }
+    return { ok: true, checked: true, publicTitle };
+  }
+
+  const publicTitle = pickPlotTitle(detail, plotIndex);
+  if (!publicTitle) return { ok: true, checked: false };
+  if (isRawFilenameTitle(publicTitle, fileName) || isGenericEpisodeTitle(publicTitle)) {
+    return {
+      ok: false,
+      checked: true,
+      publicTitle,
+      reason: `PlotLink indexed the episode title as “${publicTitle}”, a generic placeholder rather than a reader-facing episode title.`,
+    };
+  }
+  return { ok: true, checked: true, publicTitle };
+}
+
+/** Durable, writer-facing warning shown when public-title verification fails (#379). */
+export function publicTitleWarning(verdict: PublicTitleVerdict): string {
+  return (
+    `${verdict.reason ?? "PlotLink indexed a raw/generic public title for this publish."} ` +
+    `Published metadata is immutable on-chain and cannot be edited — the next publish must use corrected, reader-facing metadata. ` +
+    `(The webtoon pilot stays blocked until a publish indexes a real public title.)`
+  );
+}

package/app/web/styles.css

@@ -62,6 +62,15 @@ code, pre {
   font-family: "Geist Mono", ui-monospace, monospace;
 }
 
+/* Cartoon awaiting-upload pending panel — calm, info-toned (NOT red). Shown
+   after Generate MD lays down the skeleton but before final images are
+   uploaded. Mirrors the planning-callout treatment so the two pending states
+   feel related rather than alarming. */
+.cartoon-awaiting-upload {
+  border-color: color-mix(in srgb, var(--accent) 30%, transparent);
+  background: color-mix(in srgb, var(--accent) 5%, transparent);
+}
+
 /* Ensure dim/faint terminal text (SGR 2) stays readable on cream bg */
 .xterm .xterm-dim {
   opacity: 1 !important;

package/bin/plotlink-ows.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 // PlotLink OWS — CLI Wizard
-// Zero external dependencies — Node builtins only
+// Zero external dependencies — Node builtins + one in-package helper only.
 
 const fs = require("fs");
 const path = require("path");
 const readline = require("readline");
 const { execSync, spawn } = require("child_process");
 const crypto = require("crypto");
+const { planStartup, shouldAutoOpen } = require("./startup-plan.cjs");
 
 const CONFIG_DIR = path.join(require("os").homedir(), ".plotlink-ows");
 const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
@@ -203,6 +204,19 @@ async function cmdInit() {
   process.exit(0);
 }
 
+// Are the runtime dependencies resolvable? Resolve a known runtime dep rather
+// than probing `PROJECT_DIR/node_modules` directly — under a global (`-g`)
+// install the package's deps are hoisted to a sibling `node_modules`, so that
+// directory may not exist even though the deps resolve fine up the tree.
+function runtimeDepsInstalled() {
+  try {
+    require.resolve("tsx", { paths: [PROJECT_DIR] });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function cmdStart() {
   const config = readConfig();
   if (!config) {
@@ -211,28 +225,51 @@ function cmdStart() {
     process.exit(1);
   }
 
-  // Ensure deps installed
-  if (!fs.existsSync(path.join(PROJECT_DIR, "node_modules"))) {
-    log("Installing dependencies...");
+  // Runtime/build-time boundary (#470, EPIC #465): an installed package ships
+  // prebuilt assets and only runtime deps, so the start path must NOT run a web
+  // build or `npm install` here — that would fetch the build toolchain from the
+  // network (an unexpected rebuild on a user's machine). Only a source checkout
+  // (detected by `src/`, which is never in the published tarball) may build.
+  // Missing assets in an installed package mean a corrupted install.
+  const plan = planStartup({
+    isSourceCheckout: fs.existsSync(path.join(PROJECT_DIR, "src")),
+    depsInstalled: runtimeDepsInstalled(),
+    distBuilt: fs.existsSync(path.join(PROJECT_DIR, "app", "web", "dist", "index.html")),
+  });
+
+  if (plan.error) {
+    const what = plan.error === "deps"
+      ? "Runtime dependencies are missing (node_modules)"
+      : "Prebuilt web assets are missing (app/web/dist)";
+    error(`${what} — this looks like a corrupted install.`);
+    log("Reinstall and try again:");
+    log("  \x1b[1mnpx plotlink-ows@latest\x1b[0m        (or)");
+    log("  \x1b[1mnpm install -g plotlink-ows@latest\x1b[0m");
+    process.exit(1);
+  }
+  if (plan.install) {
+    log("Installing dependencies (source checkout)...");
     execSync("npm install", { cwd: PROJECT_DIR, stdio: "inherit" });
   }
-
-  // Ensure frontend is built
-  const distDir = path.join(PROJECT_DIR, "app", "web", "dist");
-  if (!fs.existsSync(distDir)) {
-    log("Building frontend...");
+  if (plan.build) {
+    log("Building frontend (source checkout)...");
     execSync("npx vite build --config app/vite.config.ts", { cwd: PROJECT_DIR, stdio: "inherit" });
   }
 
   const port = config.port || 7777;
 
-  // Auto-open browser after a short delay
-  setTimeout(() => {
-    try {
-      const openCmd = process.platform === "darwin" ? "open" : "xdg-open";
-      execSync(`${openCmd} http://localhost:${port}`, { stdio: "ignore" });
-    } catch { /* ignore */ }
-  }, 2000);
+  // Auto-open browser after a short delay. Skipped for non-interactive runs
+  // (the release start smoke / preflight set PLOTLINK_OWS_NO_OPEN=1) so a publish
+  // check never pops a browser tab on the operator machine (#481). Normal
+  // `npx plotlink-ows` startup is unaffected.
+  if (shouldAutoOpen(process.env)) {
+    setTimeout(() => {
+      try {
+        const openCmd = process.platform === "darwin" ? "open" : "xdg-open";
+        execSync(`${openCmd} http://localhost:${port}`, { stdio: "ignore" });
+      } catch { /* ignore */ }
+    }, 2000);
+  }
 
   // Run server in foreground with visible logs
   const server = spawn("npx", ["tsx", "app/server.ts"], {

package/bin/startup-plan.cjs

@@ -0,0 +1,58 @@
+// Runtime/build-time boundary planner for the PlotLink OWS CLI (#470, EPIC #465).
+//
+// The published `plotlink-ows` package ships PREBUILT runtime assets
+// (`app/web/dist`) and installs only runtime `dependencies`. All build tooling
+// (vite, tailwind, react, …) lives in `devDependencies` (see #469) and is
+// therefore ABSENT from an installed package. Consequence: the `start` path must
+// NEVER run a web build or `npm install` on a user's machine — doing so would
+// fetch the build toolchain from the network (an unexpected rebuild). Missing
+// prebuilt assets in an installed package mean a CORRUPTED install, which we
+// surface loudly instead of silently trying to rebuild.
+//
+// A *source checkout* (the repo) is the only place a (re)build is allowed. It is
+// detected by the presence of `src/` (the Next.js web app), which is NOT part of
+// the published `files` allowlist and so never exists in an installed package.
+//
+// This module is intentionally PURE (no fs/process access) so the boundary
+// policy is unit-tested in isolation; `bin/plotlink-ows.js` probes the
+// environment and feeds the facts in.
+
+/**
+ * Decide what the `start` command must do before launching the server.
+ *
+ * @param {object} env
+ * @param {boolean} env.isSourceCheckout  running from the repo (has `src/`)
+ * @param {boolean} env.depsInstalled     runtime deps resolvable
+ * @param {boolean} env.distBuilt         prebuilt web UI present (app/web/dist/index.html)
+ * @returns {{ install: boolean, build: boolean, error: null | "deps" | "dist" }}
+ *   install/build are only ever `true` in a source checkout (dev convenience).
+ *   `error` is a fatal broken-install condition for an installed package.
+ */
+function planStartup({ isSourceCheckout, depsInstalled, distBuilt }) {
+  if (isSourceCheckout) {
+    // Dev convenience: bring a fresh checkout up without manual build steps.
+    return { install: !depsInstalled, build: !distBuilt, error: null };
+  }
+  // Installed package: never pull build tooling. Missing assets ⇒ broken install.
+  if (!depsInstalled) return { install: false, build: false, error: "deps" };
+  if (!distBuilt) return { install: false, build: false, error: "dist" };
+  return { install: false, build: false, error: null };
+}
+
+/**
+ * Decide whether `start` should auto-open the local app in a browser (#481).
+ *
+ * Normal `npx plotlink-ows` startup auto-opens for convenience. Non-interactive
+ * release checks (the packed start smoke / `npm run preflight`) set
+ * `PLOTLINK_OWS_NO_OPEN=1` so they never pop a browser tab on the operator
+ * machine. Only the exact string "1" disables it; any other value keeps the
+ * default open behavior.
+ *
+ * @param {Record<string, string | undefined>} env  a process.env-shaped object
+ * @returns {boolean}
+ */
+function shouldAutoOpen(env) {
+  return env.PLOTLINK_OWS_NO_OPEN !== "1";
+}
+
+module.exports = { planStartup, shouldAutoOpen };

package/lib/genres.ts

@@ -0,0 +1,92 @@
+export const GENRES = [
+  "Romance",
+  "Fantasy",
+  "Science Fiction",
+  "Mystery",
+  "Thriller",
+  "Horror",
+  "Adventure",
+  "Historical Fiction",
+  "Contemporary Lit",
+  "Humor",
+  "Poetry",
+  "Non-Fiction",
+  "Fanfiction",
+  "Short Story",
+  "Paranormal",
+  "Werewolf",
+  "LGBTQ+",
+  "New Adult",
+  "Teen Fiction",
+  "Diverse Lit",
+  "Others",
+] as const;
+
+export const LANGUAGES = [
+  "English",
+  "Chinese",
+  "Korean",
+  "Japanese",
+  "Spanish",
+  "French",
+  "Hindi",
+  "Arabic",
+  "Portuguese",
+  "Russian",
+  "Others",
+] as const;
+
+export const CONTENT_TYPES = ["fiction", "cartoon"] as const;
+
+export type Genre = (typeof GENRES)[number];
+export type Language = (typeof LANGUAGES)[number];
+export type ContentType = (typeof CONTENT_TYPES)[number];
+
+/**
+ * Punctuation/spacing/case-insensitive key for matching a free-form genre label
+ * to a canonical value. Strips everything but letters, digits and `+` (so
+ * `LGBTQ+` survives), which collapses `Sci-Fi`, `sci fi`, `SciFi` → `scifi` and
+ * `Science Fiction` / `science-fiction` → `sciencefiction`.
+ */
+function genreKey(input: string): string {
+  return input.toLowerCase().replace(/[^a-z0-9+]/g, "");
+}
+
+const CANONICAL_GENRE_BY_KEY: Record<string, Genre> = Object.fromEntries(
+  GENRES.map((g) => [genreKey(g), g]),
+) as Record<string, Genre>;
+
+/**
+ * Common natural-language genre aliases → canonical PlotLink value (#412). Keyed
+ * by `genreKey`, so each entry already covers punctuation/spacing/case variants
+ * (e.g. the `scifi` key matches `Sci-Fi`, `Sci Fi`, `SciFi`). Canonical labels and
+ * their punctuation variants (e.g. `non fiction` → `Non-Fiction`) are handled by
+ * `CANONICAL_GENRE_BY_KEY` and don't need an alias here.
+ */
+const GENRE_ALIAS_BY_KEY: Record<string, Genre> = {
+  scifi: "Science Fiction",
+  sf: "Science Fiction",
+  comedy: "Humor",
+  humour: "Humor",
+  ya: "Teen Fiction",
+  youngadult: "Teen Fiction",
+  lgbt: "LGBTQ+",
+  lgbtq: "LGBTQ+",
+  "lgbtqia+": "LGBTQ+",
+  historical: "Historical Fiction",
+  scary: "Horror",
+};
+
+/**
+ * Map a free-form genre label to its canonical PlotLink value, or `null` if it
+ * can't be resolved (#412). PlotLink's metadata update rejects non-canonical
+ * genres (e.g. `Sci-Fi` → `Invalid genre`), which once left a published pilot
+ * `UNCATEGORIZED`; callers normalize through this before sending metadata and
+ * surface a clear local error when it returns `null`. Empty/blank input → `null`.
+ */
+export function canonicalizeGenre(input: string | null | undefined): Genre | null {
+  if (!input) return null;
+  const key = genreKey(input.trim());
+  if (!key) return null;
+  return CANONICAL_GENRE_BY_KEY[key] ?? GENRE_ALIAS_BY_KEY[key] ?? null;
+}

package/package.json

@@ -1,16 +1,53 @@
 {
   "name": "plotlink-ows",
-  "version": "1.0.33",
+  "version": "1.2.95",
+  "packageManager": "npm@10.9.8",
+  "engines": {
+    "node": "20.x",
+    "npm": "10.x"
+  },
   "bin": {
-    "plotlink-ows": "./bin/plotlink-ows.js"
+    "plotlink-ows": "bin/plotlink-ows.js"
   },
   "files": [
     "bin/",
     "app/",
     "lib/ows/",
+    "lib/genres.ts",
     "packages/",
     "public/",
-    "scripts/"
+    "scripts/",
+    "!**/*.test.ts",
+    "!**/*.test.tsx",
+    "!**/*.test.js",
+    "!**/*.test.jsx",
+    "!**/*.test.mjs",
+    "!**/*.spec.ts",
+    "!**/*.spec.tsx",
+    "!**/*.spec.js",
+    "!**/__tests__/**",
+    "!**/node_modules/**",
+    "!**/*.tgz",
+    "!**/.next/cache/**",
+    "!**/.turbo/**",
+    "!**/.vite/**",
+    "!**/.cache/**",
+    "!**/*.tsbuildinfo",
+    "!**/coverage/**",
+    "!**/.nyc_output/**",
+    "!**/__fixtures__/**",
+    "!**/fixtures/**",
+    "!**/*.fixture.*",
+    "!**/*.snap",
+    "!**/screenshot-*",
+    "!**/screenshots/**",
+    "!**/e2e-verify.*",
+    "!**/tmp/**",
+    "!**/temp/**",
+    "!**/*.log",
+    "!**/*.tmp",
+    "!**/*.bak",
+    "!**/*.swp"
   ],
   "workspaces": [
     "packages/*"
@@ -26,39 +63,31 @@
     "app:dev": "concurrently \"tsx watch app/server.ts\" \"vite --config app/vite.config.ts\"",
     "app:build": "vite build --config app/vite.config.ts",
     "app:start": "tsx app/server.ts",
+    "preflight": "node scripts/preflight.mjs",
+    "smoke:start": "node scripts/start-smoke.mjs",
     "prepublishOnly": "npm run app:build",
     "postinstall": "prisma generate --schema app/prisma/schema.prisma",
     "prisma:local": "prisma generate --schema app/prisma/schema.prisma && prisma db push --schema app/prisma/schema.prisma",
+    "prisma:sql": "node scripts/gen-schema-sql.mjs",
     "release:patch": "npm version patch && git push origin main --follow-tags && VERSION=$(node -p 'require(\"./package.json\").version') && gh release create \"v$VERSION\" --generate-notes --latest && npm publish",
     "release:minor": "npm version minor && git push origin main --follow-tags && VERSION=$(node -p 'require(\"./package.json\").version') && gh release create \"v$VERSION\" --generate-notes --latest && npm publish",
     "release:major": "npm version major && git push origin main --follow-tags && VERSION=$(node -p 'require(\"./package.json\").version') && gh release create \"v$VERSION\" --generate-notes --latest && npm publish"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1009.0",
-    "@hono/node-server": "^1.19.12",
+    "@hono/node-server": "^1.19.14",
     "@open-wallet-standard/core": "^1.2.4",
     "@prisma/client": "^6.19.3",
     "@supabase/supabase-js": "^2.99.1",
-    "@xterm/addon-fit": "^0.11.0",
-    "@xterm/addon-serialize": "^0.14.0",
-    "@xterm/xterm": "^6.0.0",
     "dotenv": "^17.4.0",
-    "hono": "^4.12.10",
+    "hono": "^4.12.23",
     "node-pty": "^1.2.0-beta.12",
     "prisma": "^6.19.3",
-    "react": "19.2.3",
-    "react-dom": "19.2.3",
-    "react-markdown": "^10.1.0",
-    "rehype-sanitize": "^6.0.0",
-    "remark-breaks": "^4.0.0",
-    "remark-gfm": "^4.0.1",
-    "tailwindcss": "^4",
     "tsx": "^4.21.0",
     "viem": "^2.47.2",
-    "vite": "^6.4.1",
-    "ws": "^8.20.0"
+    "ws": "^8.20.1"
   },
   "devDependencies": {
+    "@aws-sdk/client-s3": "^3.1009.0",
     "@farcaster/miniapp-node": "^0.1.13",
     "@farcaster/miniapp-sdk": "^0.3.0",
     "@farcaster/miniapp-wagmi-connector": "^2.0.0",
@@ -77,13 +106,24 @@
     "@types/ws": "^8.18.1",
     "@vercel/analytics": "^2.0.1",
     "@vitejs/plugin-react": "^4.7.0",
+    "@xterm/addon-fit": "^0.11.0",
+    "@xterm/addon-serialize": "^0.14.0",
+    "@xterm/xterm": "^6.0.0",
     "concurrently": "^9.2.1",
     "eslint": "^9",
-    "eslint-config-next": "16.1.6",
+    "eslint-config-next": "16.2.6",
     "jsdom": "^27.0.1",
-    "next": "16.1.6",
+    "next": "16.2.6",
     "ox": "^0.14.8",
+    "react": "19.2.3",
+    "react-dom": "19.2.3",
+    "react-markdown": "^10.1.0",
+    "rehype-sanitize": "^6.0.0",
+    "remark-breaks": "^4.0.0",
+    "remark-gfm": "^4.0.1",
+    "tailwindcss": "^4",
     "typescript": "^5",
+    "vite": "^6.4.3",
     "vitest": "^3.2.4",
     "wagmi": "^2.19.5"
   }