feat: restore minimal Docker Space

.dockerignore

@@ -0,0 +1,6 @@
+.git
+node_modules
+dist
+.env*
+*.log
+*.tsbuildinfo

.gitignore

@@ -0,0 +1,36 @@
+# dependencies
+node_modules/
+
+# build
+dist/
+*.tsbuildinfo
+
+# env & secrets
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+id_rsa*
+
+# logs & local data
+*.log
+.data/
+coverage/
+.DS_Store
+tmp/
+/tmp/
+
+# editor / OS
+.idea/
+.vscode/
+*.swp
+
+# bossmode / internal workspace artifacts (never publish)
+.bossmode-attachments/
+.bossmode/
+*.bossmode*
+
+# HF
+.cache/
+*.sqlite

Dockerfile

@@ -0,0 +1,23 @@
+# syntax=docker/dockerfile:1
+FROM node:22-bookworm-slim AS builder
+WORKDIR /workspace
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
+
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
+
+COPY index.html postcss.config.js tailwind.config.js tsconfig.json vite.config.ts ./
+COPY src ./src
+ARG VITE_API_BASE_URL=https://openvuln.vulnhunter.pro
+ARG VITE_GITHUB_REPO_URL=https://github.com/Clouditera/OpenVuln
+ENV VITE_API_BASE_URL=$VITE_API_BASE_URL \
+    VITE_GITHUB_REPO_URL=$VITE_GITHUB_REPO_URL
+RUN pnpm build
+
+FROM nginx:1.27-alpine AS runtime
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=builder /workspace/dist/ /usr/share/nginx/html/
+EXPOSE 7860
+HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \
+  CMD wget -qO- http://127.0.0.1:7860/health >/dev/null || exit 1

LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Clouditera
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

README.md

@@ -1,10 +1,21 @@
 ---
 title: OpenVuln
-emoji: 📈
-colorFrom: pink
-colorTo: gray
+emoji: 🛡️
+colorFrom: gray
+colorTo: red
 sdk: docker
+app_port: 7860
 pinned: false
+short_description: Find bugs in your repository with GLM
 ---
+# OpenVuln
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+Public frontend for [OpenVuln](https://openvuln.vulnhunter.pro).
+
+This Space is built automatically from the root `Dockerfile` and serves the
+Vite application with nginx on port `7860`.
+
+Optional Space build variables:
+
+- `VITE_API_BASE_URL` — API origin; defaults to `https://openvuln.vulnhunter.pro`.
+- `VITE_GITHUB_REPO_URL` — source repository linked from the interface.

index.html

@@ -0,0 +1,16 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>OpenVuln — AI security for open source</title>
+    <meta
+      name="description"
+      content="AI-powered vulnerability discovery for the open-source world, by Z.ai."
+    />
+  </head>
+  <body class="bg-surface text-ink antialiased">
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

nginx.conf

@@ -0,0 +1,7 @@
+server {
+    listen 7860; server_name _; root /usr/share/nginx/html; index index.html;
+    location = /health { access_log off; default_type text/plain; return 200 "ok\n"; }
+    location /assets/ { try_files $uri =404; expires 30d; add_header Cache-Control "public, immutable"; }
+    location = /index.html { add_header Cache-Control "no-cache, no-store, must-revalidate"; }
+    location / { try_files $uri $uri/ /index.html; }
+}

package.json

@@ -0,0 +1,34 @@
+{
+  "name": "openvuln-web",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite --host 0.0.0.0 --port 5173",
+    "build": "tsc -b && vite build"
+  },
+  "dependencies": {
+    "@tanstack/react-query": "^5.62.7",
+    "js-yaml": "^5.2.3",
+    "lucide-react": "^0.469.0",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "react-router-dom": "^6.28.1"
+  },
+  "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
+    "@types/react": "^18.3.18",
+    "@types/react-dom": "^18.3.5",
+    "@vitejs/plugin-react": "^4.3.4",
+    "autoprefixer": "^10.4.20",
+    "postcss": "^8.4.49",
+    "tailwindcss": "^3.4.17",
+    "typescript": "^5.7.2",
+    "vite": "^6.0.7"
+  },
+  "engines": {
+    "node": ">=20",
+    "pnpm": ">=9"
+  },
+  "packageManager": "pnpm@9.15.4"
+}

pnpm-lock.yaml

@@ -0,0 +1,1763 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      '@tanstack/react-query':
+        specifier: ^5.62.7
+        version: 5.101.4(react@18.3.1)
+      js-yaml:
+        specifier: ^5.2.3
+        version: 5.2.3
+      lucide-react:
+        specifier: ^0.469.0
+        version: 0.469.0(react@18.3.1)
+      react:
+        specifier: ^18.3.1
+        version: 18.3.1
+      react-dom:
+        specifier: ^18.3.1
+        version: 18.3.1(react@18.3.1)
+      react-router-dom:
+        specifier: ^6.28.1
+        version: 6.30.4(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+    devDependencies:
+      '@types/js-yaml':
+        specifier: ^4.0.9
+        version: 4.0.9
+      '@types/react':
+        specifier: ^18.3.18
+        version: 18.3.31
+      '@types/react-dom':
+        specifier: ^18.3.5
+        version: 18.3.7(@types/react@18.3.31)
+      '@vitejs/plugin-react':
+        specifier: ^4.3.4
+        version: 4.7.0(vite@6.4.3(jiti@1.21.7))
+      autoprefixer:
+        specifier: ^10.4.20
+        version: 10.5.4(postcss@8.5.26)
+      postcss:
+        specifier: ^8.4.49
+        version: 8.5.26
+      tailwindcss:
+        specifier: ^3.4.17
+        version: 3.4.19
+      typescript:
+        specifier: ^5.7.2
+        version: 5.9.3
+      vite:
+        specifier: ^6.0.7
+        version: 6.4.3(jiti@1.21.7)
+
+packages:
+
+  '@alloc/quick-lru@5.2.0':
+    resolution: {integrity: sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==}
+    engines: {node: '>=10'}
+
+  '@babel/code-frame@7.29.7':
+    resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/compat-data@7.29.7':
+    resolution: {integrity: sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/core@7.29.7':
+    resolution: {integrity: sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/generator@7.29.8':
+    resolution: {integrity: sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-compilation-targets@7.29.7':
+    resolution: {integrity: sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-globals@7.29.7':
+    resolution: {integrity: sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-imports@7.29.7':
+    resolution: {integrity: sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-transforms@7.29.7':
+    resolution: {integrity: sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-plugin-utils@7.29.7':
+    resolution: {integrity: sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-string-parser@7.29.7':
+    resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-identifier@7.29.7':
+    resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-option@7.29.7':
+    resolution: {integrity: sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helpers@7.29.7':
+    resolution: {integrity: sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/parser@7.29.8':
+    resolution: {integrity: sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  '@babel/plugin-transform-react-jsx-self@7.29.7':
+    resolution: {integrity: sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-react-jsx-source@7.29.7':
+    resolution: {integrity: sha512-06IyK09H3wi4cGbhDBwp5gUGo0IKtnYa8tyTiephirPCK6fbobVGiXMMI5zLQ4aKEYP3wZ3ArU44o+8KMrSG/Q==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/template@7.29.7':
+    resolution: {integrity: sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/traverse@7.29.8':
+    resolution: {integrity: sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/types@7.29.8':
+    resolution: {integrity: sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@esbuild/aix-ppc64@0.25.12':
+    resolution: {integrity: sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/android-arm64@0.25.12':
+    resolution: {integrity: sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm@0.25.12':
+    resolution: {integrity: sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-x64@0.25.12':
+    resolution: {integrity: sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/darwin-arm64@0.25.12':
+    resolution: {integrity: sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.25.12':
+    resolution: {integrity: sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    resolution: {integrity: sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.25.12':
+    resolution: {integrity: sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/linux-arm64@0.25.12':
+    resolution: {integrity: sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.25.12':
+    resolution: {integrity: sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.25.12':
+    resolution: {integrity: sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.25.12':
+    resolution: {integrity: sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.25.12':
+    resolution: {integrity: sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.25.12':
+    resolution: {integrity: sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.25.12':
+    resolution: {integrity: sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.25.12':
+    resolution: {integrity: sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.25.12':
+    resolution: {integrity: sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.25.12':
+    resolution: {integrity: sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.25.12':
+    resolution: {integrity: sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    resolution: {integrity: sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/sunos-x64@0.25.12':
+    resolution: {integrity: sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/win32-arm64@0.25.12':
+    resolution: {integrity: sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.25.12':
+    resolution: {integrity: sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.25.12':
+    resolution: {integrity: sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@jridgewell/gen-mapping@0.3.13':
+    resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
+
+  '@jridgewell/remapping@2.3.5':
+    resolution: {integrity: sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==}
+
+  '@jridgewell/resolve-uri@3.1.2':
+    resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
+    engines: {node: '>=6.0.0'}
+
+  '@jridgewell/sourcemap-codec@1.5.5':
+    resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
+
+  '@napi-rs/lzma-linux-x64-gnu@1.5.1':
+    resolution: {integrity: sha512-oTXEIha4SsuXdTA4Iyskj0kpdx2yVXdhd75c2v3xGrHFfVMsbhTPZU/nMPL4sWKo4pBHm3aucLaqGlF696dTyQ==}
+    engines: {node: ^22.20 || ^24.12 || >=25}
+    cpu: [x64]
+    os: [linux]
+
+  '@nodelib/fs.scandir@2.1.5':
+    resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.stat@2.0.5':
+    resolution: {integrity: sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.walk@1.2.8':
+    resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
+    engines: {node: '>= 8'}
+
+  '@remix-run/router@1.23.3':
+    resolution: {integrity: sha512-4An71tdz9X8+3sI4Qqqd2LWd9vS39J7sqd9EU4Scw7TJE/qB10Flv/UuqbPVgfQV9XoK8Np6jNquZitnZq5i+Q==}
+    engines: {node: '>=14.0.0'}
+
+  '@rolldown/pluginutils@1.0.0-beta.27':
+    resolution: {integrity: sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA==}
+
+  '@rollup/rollup-android-arm-eabi@4.62.4':
+    resolution: {integrity: sha512-RrPokAb7dmbxFoeO3TloqHyOjgye8RkBhSqmp4aJMIex4c9r46ZstPnleDQOq1t46VOVjwIuwNogIqbodV1Vvg==}
+    cpu: [arm]
+    os: [android]
+
+  '@rollup/rollup-android-arm64@4.62.4':
+    resolution: {integrity: sha512-JKuJc+pnpks2pjy7L/N3v/cAkZxYlnmuZoD840ldbMI5KDbC4iO9NKwPKYdjYFCMAIIlBzYSFHxIJVYzRo2/8A==}
+    cpu: [arm64]
+    os: [android]
+
+  '@rollup/rollup-darwin-arm64@4.62.4':
+    resolution: {integrity: sha512-krw5uS2STmvJ02x0uTXHbqQNuz+9eZ1iw+qXk9dmW2gvV4jV7O2hEoOnuhFrpOPiel1mBFtqbxYZZtC46hXLOw==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@rollup/rollup-darwin-x64@4.62.4':
+    resolution: {integrity: sha512-wsTxtgApb4PrOsNJIm0FZ1h3WvCC+k9uxLJ4ad75hgoS4NiRes2SoJFlDAyMwiUY8IssDqGcHbXuN0sx1tfF1A==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@rollup/rollup-freebsd-arm64@4.62.4':
+    resolution: {integrity: sha512-GUOnQlyZe3yAXhWOtOMsn5Qkrv5E5mZXa0thbARWi5Ei2szlVXJFQhddZ4HbAzh8q92w5twp+CQvs/eFanz9YQ==}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@rollup/rollup-freebsd-x64@4.62.4':
+    resolution: {integrity: sha512-/Y7f3QuxjzPKsjA/rfEDa3+0vXqyjmJ50Ln8dPpCmWkKTrUoWHG1cWhTqaAMLob2m2nESWuC7yGrREz019Ztqg==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.62.4':
+    resolution: {integrity: sha512-81wiiX3v7aqy+T+bT61TJ78yJjRquqFFTTbAPt08imfQQzkPIW8t6aJbkTagtCCrXMNc9D66+geqlK7ydLPNqA==}
+    cpu: [arm]
+    os: [linux]
+
+  '@rollup/rollup-linux-arm-musleabihf@4.62.4':
+    resolution: {integrity: sha512-9kmDIvNZqdoHOBZgNtpTBeLWYO/LVipM3H/j62P8848/l/VPEQL6N3uxU9pvP1oZAsXyC2MEnFP3ovRjo7WYNQ==}
+    cpu: [arm]
+    os: [linux]
+
+  '@rollup/rollup-linux-arm64-gnu@4.62.4':
+    resolution: {integrity: sha512-CcnXHWnXg69g+DX5VWL3FHts3qMRN2uVEHX+BZvGLdd07/gXkn3ePjYtO1LDJvxkGKVHMclKBRa1QUTH+6toYQ==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@rollup/rollup-linux-arm64-musl@4.62.4':
+    resolution: {integrity: sha512-iFOibiHnTRuhrWLlRsOQFdZJJIa7S8OwkneJr4ocALP16u5yk6lWLINFwhHaEqBFMsKDUZofLkGos7+CPzGB3g==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@rollup/rollup-linux-loong64-gnu@4.62.4':
+    resolution: {integrity: sha512-XnWYMI7euHlb5a871xPja+Gm7DRCFU+FGRrtS2sMq9N8FvqtpagUy6gD4YOemC5MRk9xbh8+jYMEJbigFQwsgA==}
+    cpu: [loong64]
+    os: [linux]
+
+  '@rollup/rollup-linux-loong64-musl@4.62.4':
+    resolution: {integrity: sha512-qGDAlO0U8xedCcsdRm9oaoQY8DAx/QT7uIxJWhCdx0ceIWX783UC9QSYkdpzAe29wNiVfp24+bZdQmn49o45SQ==}
+    cpu: [loong64]
+    os: [linux]
+
+  '@rollup/rollup-linux-ppc64-gnu@4.62.4':
+    resolution: {integrity: sha512-ru4H6ezD7ysA5EiEK6qkkaEb4modH8CTej6kUy/gQi20u3kB3G7Zn8snXXkeJSCOFKG/rbPPtM/+9Wgas1961w==}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@rollup/rollup-linux-ppc64-musl@4.62.4':
+    resolution: {integrity: sha512-2W4MO5WQVJnbJaZdvDb9rhBDuFU1nKIepPFpJUBsTh2k1YY2g+ODViaWuyOAjQ5cOP7NvrvLzt3wvHOoiAvc7w==}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@rollup/rollup-linux-riscv64-gnu@4.62.4':
+    resolution: {integrity: sha512-+fxjfuoAmVMCYV5QyjoIpu0cp5DOiOTeqYFk1AVaxGr+/ravWLX89XfQmptsoWcaVy/TGf2hexzbUOrCQIL1CQ==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@rollup/rollup-linux-riscv64-musl@4.62.4':
+    resolution: {integrity: sha512-jTn8JfHGL4djjFxPuM06LmNUJDsst2jeVlsd9OmIH6zc5sC9K6rIuO4YajXatLUpBmBKl6b35ro1QZocLi+tcA==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@rollup/rollup-linux-s390x-gnu@4.62.4':
+    resolution: {integrity: sha512-oCJCJL4pXsoDcP2QZ+JVlPTIRc6266zsIaeJJsWImmF7HO0W8nb6HuSgZlMWxJwaPf8ehbSw8yo0EUw925hKsA==}
+    cpu: [s390x]
+    os: [linux]
+
+  '@rollup/rollup-linux-x64-gnu@4.62.4':
+    resolution: {integrity: sha512-W69hukhZ3KKNRCaMIEzKvcFye42hh0FE1+YoYaf5+Ikacuftoco6yO/xouz0hc5d5W/s3yBro5jRiuEE/Q5vUw==}
+    cpu: [x64]
+    os: [linux]
+
+  '@rollup/rollup-linux-x64-musl@4.62.4':
+    resolution: {integrity: sha512-qiXbGG2jkjXhzXpsFZSR2Xpb8DN/UaxYsbb/STbuR/6fpaDgRmmaq1B/LmtF2wQFOFOSsK2jdE0RZ3a0zHn4QA==}
+    cpu: [x64]
+    os: [linux]
+
+  '@rollup/rollup-openbsd-x64@4.62.4':
+    resolution: {integrity: sha512-nWeM//hxv8mIo6jD7Hu4o48DVmV9pbV6gsKaWU+4NFyqHoPKwrkRiZGLKUhOBk8qNmDmpwFtPKg80Bo/Tn4xiQ==}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@rollup/rollup-openharmony-arm64@4.62.4':
+    resolution: {integrity: sha512-s62SQ/vgsRSvMwDkOEfTqfgASF0f26ZNaQuTA6Aok5lrikf89yI2W0gFHvZb2Jpgc6N8JnOKZgCK2iciO3CsxQ==}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@rollup/rollup-win32-arm64-msvc@4.62.4':
+    resolution: {integrity: sha512-J6wGf8TVGbXJq+HH+ttTvrcfNKPbuZecV6KT1B8I18BC5IURUh5kl4Yl5OEP5eFIUoI5BWxCsyYMhFsDx8kekw==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@rollup/rollup-win32-ia32-msvc@4.62.4':
+    resolution: {integrity: sha512-zmfrQd/0wu6oJs8Vq8KwY/YtsKSsLtKe/HwAP4Wqy8LhWjeT55fHRAkOhYQ12wI3ayS4Tt12d5CDRD7N96SAYQ==}
+    cpu: [ia32]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-gnu@4.62.4':
+    resolution: {integrity: sha512-qPzHqdj9rfUD+w79dtE07zi/kFwKyCJqplp5K5ygeLTp7jLpAoc16OAH39HSmRC9UpozaecsleI8uAdEj6v2yw==}
+    cpu: [x64]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-msvc@4.62.4':
+    resolution: {integrity: sha512-zD6NdeWEByGE9QF9vCrlJ5YQB4oq9q91kPZS37Jwj5hOkvR1lTBSpsKhKDw4IJtbQ35LsTS1HD9DZYGKIshU1Q==}
+    cpu: [x64]
+    os: [win32]
+
+  '@tanstack/query-core@5.101.4':
+    resolution: {integrity: sha512-gNwcvOJcRbLWPOLG/2OBm+zM+Yv+MKsXKEOWC57USuZDEsI71hEErQsiEGx5wX9rzWWkfwM0fVSPoiIFSsxfiw==}
+
+  '@tanstack/react-query@5.101.4':
+    resolution: {integrity: sha512-yRg2pfOCxIs4ZJW3XYYHU/WgtD04FHSnfHlpRT7h7pR77hwkdRG4wxbKe4aq6P0RvXUTBSQpQeadS1SUYUe+KA==}
+    peerDependencies:
+      react: ^18 || ^19
+
+  '@types/babel__core@7.20.5':
+    resolution: {integrity: sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==}
+
+  '@types/babel__generator@7.27.0':
+    resolution: {integrity: sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==}
+
+  '@types/babel__template@7.4.4':
+    resolution: {integrity: sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==}
+
+  '@types/babel__traverse@7.28.0':
+    resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}
+
+  '@types/estree@1.0.9':
+    resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
+
+  '@types/js-yaml@4.0.9':
+    resolution: {integrity: sha512-k4MGaQl5TGo/iipqb2UDG2UwjXziSWkh0uysQelTlJpX1qGlpUZYm8PnO4DxG1qBomtJUdYJ6qR6xdIah10JLg==}
+
+  '@types/prop-types@15.7.15':
+    resolution: {integrity: sha512-F6bEyamV9jKGAFBEmlQnesRPGOQqS2+Uwi0Em15xenOxHaf2hv6L8YCVn3rPdPJOiJfPiCnLIRyvwVaqMY3MIw==}
+
+  '@types/react-dom@18.3.7':
+    resolution: {integrity: sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==}
+    peerDependencies:
+      '@types/react': ^18.0.0
+
+  '@types/react@18.3.31':
+    resolution: {integrity: sha512-vfEqpXTvwT91yhmwdfouStN2hSKwTvyRs8qpLfADyrq/kxDw0hZM7Wk9Ug1FELj8hIby+S/+kQCSRFF32nv2Qw==}
+
+  '@vitejs/plugin-react@4.7.0':
+    resolution: {integrity: sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCUbLe0HyqIpVaoA==}
+    engines: {node: ^14.18.0 || >=16.0.0}
+    peerDependencies:
+      vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
+
+  any-promise@1.3.0:
+    resolution: {integrity: sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==}
+
+  anymatch@3.1.3:
+    resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
+    engines: {node: '>= 8'}
+
+  arg@5.0.2:
+    resolution: {integrity: sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==}
+
+  argparse@2.0.1:
+    resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
+
+  autoprefixer@10.5.4:
+    resolution: {integrity: sha512-MaU0U/za7N3r6brxD4YB/l4NSrFzLPlANv6wEuQVaIPlD3L4W9rFcQPbL/EilY9BHhHvhfcz3gInDLrEtWT4EA==}
+    engines: {node: ^10 || ^12 || >=14}
+    hasBin: true
+    peerDependencies:
+      postcss: ^8.1.0
+
+  baseline-browser-mapping@2.11.13:
+    resolution: {integrity: sha512-k9HNuUVMlqVjQ9UHzfPjIqiDbWw7WqT1AoT7GL8VwvF3r0ZfArtgiSPAlmupyNquNgOJHTuH4CKYf8ttMTWBTQ==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  binary-extensions@2.3.0:
+    resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==}
+    engines: {node: '>=8'}
+
+  braces@3.0.3:
+    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
+    engines: {node: '>=8'}
+
+  browserslist@4.28.8:
+    resolution: {integrity: sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==}
+    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
+    hasBin: true
+
+  camelcase-css@2.0.1:
+    resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
+    engines: {node: '>= 6'}
+
+  caniuse-lite@1.0.30001809:
+    resolution: {integrity: sha512-xxWVywk6a6Arlk+hymeycyn/VgqEfLDxupvhH/xiY5SJ/18kmi9o6MiO320DCUzypORHLtvh0I4i04tUhCNHNQ==}
+
+  chokidar@3.6.0:
+    resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
+    engines: {node: '>= 8.10.0'}
+
+  commander@4.1.1:
+    resolution: {integrity: sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==}
+    engines: {node: '>= 6'}
+
+  convert-source-map@2.0.0:
+    resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
+
+  cssesc@3.0.0:
+    resolution: {integrity: sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  csstype@3.2.3:
+    resolution: {integrity: sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==}
+
+  debug@4.4.3:
+    resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
+    engines: {node: '>=6.0'}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
+  didyoumean@1.2.2:
+    resolution: {integrity: sha512-gxtyfqMg7GKyhQmb056K7M3xszy/myH8w+B4RT+QXBQsvAOdc3XymqDDPHx1BgPgsdAA5SIifona89YtRATDzw==}
+
+  dlv@1.1.3:
+    resolution: {integrity: sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==}
+
+  electron-to-chromium@1.5.405:
+    resolution: {integrity: sha512-bNglH7lPH5l+yHOes7Zr4VqxhOy4BQ9ZBUX4VdoFgxMpzJk7W1ZoO3Vgd9Pxa9PyjQ76sfm2aKH/nzEcCNRlew==}
+
+  es-errors@1.3.0:
+    resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
+    engines: {node: '>= 0.4'}
+
+  esbuild@0.25.12:
+    resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  escalade@3.2.0:
+    resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
+    engines: {node: '>=6'}
+
+  fast-glob@3.3.3:
+    resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
+    engines: {node: '>=8.6.0'}
+
+  fastq@1.20.1:
+    resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==}
+
+  fdir@6.5.0:
+    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      picomatch: ^3 || ^4
+    peerDependenciesMeta:
+      picomatch:
+        optional: true
+
+  fill-range@7.1.1:
+    resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
+    engines: {node: '>=8'}
+
+  fraction.js@5.3.4:
+    resolution: {integrity: sha512-1X1NTtiJphryn/uLQz3whtY6jK3fTqoE3ohKs0tT+Ujr1W59oopxmoEh7Lu5p6vBaPbgoM0bzveAW4Qi5RyWDQ==}
+
+  fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  function-bind@1.1.2:
+    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
+
+  gensync@1.0.0-beta.2:
+    resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
+    engines: {node: '>=6.9.0'}
+
+  glob-parent@5.1.2:
+    resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
+    engines: {node: '>= 6'}
+
+  glob-parent@6.0.2:
+    resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
+    engines: {node: '>=10.13.0'}
+
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+    engines: {node: '>= 0.4'}
+
+  is-binary-path@2.1.0:
+    resolution: {integrity: sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==}
+    engines: {node: '>=8'}
+
+  is-core-module@2.16.2:
+    resolution: {integrity: sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==}
+    engines: {node: '>= 0.4'}
+
+  is-extglob@2.1.1:
+    resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
+    engines: {node: '>=0.10.0'}
+
+  is-glob@4.0.3:
+    resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
+    engines: {node: '>=0.10.0'}
+
+  is-number@7.0.0:
+    resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
+    engines: {node: '>=0.12.0'}
+
+  jiti@1.21.7:
+    resolution: {integrity: sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==}
+    hasBin: true
+
+  js-tokens@4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+
+  js-yaml@5.2.3:
+    resolution: {integrity: sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==}
+    hasBin: true
+
+  jsesc@3.1.0:
+    resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  json5@2.2.3:
+    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  lilconfig@3.1.3:
+    resolution: {integrity: sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==}
+    engines: {node: '>=14'}
+
+  lines-and-columns@1.2.4:
+    resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
+
+  loose-envify@1.4.0:
+    resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
+    hasBin: true
+
+  lru-cache@5.1.1:
+    resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
+
+  lucide-react@0.469.0:
+    resolution: {integrity: sha512-28vvUnnKQ/dBwiCQtwJw7QauYnE7yd2Cyp4tTTJpvglX4EMpbflcdBgrgToX2j71B3YvugK/NH3BGUk+E/p/Fw==}
+    peerDependencies:
+      react: ^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  merge2@1.4.1:
+    resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
+    engines: {node: '>= 8'}
+
+  micromatch@4.0.8:
+    resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
+    engines: {node: '>=8.6'}
+
+  ms@2.1.3:
+    resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
+
+  mz@2.7.0:
+    resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
+
+  nanoid@3.3.18:
+    resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
+  node-releases@2.0.53:
+    resolution: {integrity: sha512-D9UOmYG3UH1V+ENW56t5QXBwJw1YEY18ruVeus89Rw+SyIgjPkCO84bRzO3uNIYosJbNwiabWVn48o3uJLjxFQ==}
+    engines: {node: '>=18'}
+
+  normalize-path@3.0.0:
+    resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
+    engines: {node: '>=0.10.0'}
+
+  object-assign@4.1.1:
+    resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
+    engines: {node: '>=0.10.0'}
+
+  object-hash@3.0.0:
+    resolution: {integrity: sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==}
+    engines: {node: '>= 6'}
+
+  path-parse@1.0.7:
+    resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
+
+  picocolors@1.1.1:
+    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+  picomatch@2.3.2:
+    resolution: {integrity: sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==}
+    engines: {node: '>=8.6'}
+
+  picomatch@4.0.5:
+    resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
+    engines: {node: '>=12'}
+
+  pify@2.3.0:
+    resolution: {integrity: sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==}
+    engines: {node: '>=0.10.0'}
+
+  pirates@4.0.7:
+    resolution: {integrity: sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==}
+    engines: {node: '>= 6'}
+
+  postcss-import@15.1.0:
+    resolution: {integrity: sha512-hpr+J05B2FVYUAXHeK1YyI267J/dDDhMU6B6civm8hSY1jYJnBXxzKDKDswzJmtLHryrjhnDjqqp/49t8FALew==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      postcss: ^8.0.0
+
+  postcss-js@4.1.0:
+    resolution: {integrity: sha512-oIAOTqgIo7q2EOwbhb8UalYePMvYoIeRY2YKntdpFQXNosSu3vLrniGgmH9OKs/qAkfoj5oB3le/7mINW1LCfw==}
+    engines: {node: ^12 || ^14 || >= 16}
+    peerDependencies:
+      postcss: ^8.4.21
+
+  postcss-load-config@6.0.1:
+    resolution: {integrity: sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==}
+    engines: {node: '>= 18'}
+    peerDependencies:
+      jiti: '>=1.21.0'
+      postcss: '>=8.0.9'
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      jiti:
+        optional: true
+      postcss:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  postcss-nested@6.2.0:
+    resolution: {integrity: sha512-HQbt28KulC5AJzG+cZtj9kvKB93CFCdLvog1WFLf1D+xmMvPGlBstkpTEZfK5+AN9hfJocyBFCNiqyS48bpgzQ==}
+    engines: {node: '>=12.0'}
+    peerDependencies:
+      postcss: ^8.2.14
+
+  postcss-selector-parser@6.1.4:
+    resolution: {integrity: sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==}
+    engines: {node: '>=4'}
+
+  postcss-value-parser@4.2.0:
+    resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
+
+  postcss@8.5.26:
+    resolution: {integrity: sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  queue-microtask@1.2.3:
+    resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
+
+  react-dom@18.3.1:
+    resolution: {integrity: sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==}
+    peerDependencies:
+      react: ^18.3.1
+
+  react-refresh@0.17.0:
+    resolution: {integrity: sha512-z6F7K9bV85EfseRCp2bzrpyQ0Gkw1uLoCel9XBVWPg/TjRj94SkJzUTGfOa4bs7iJvBWtQG0Wq7wnI0syw3EBQ==}
+    engines: {node: '>=0.10.0'}
+
+  react-router-dom@6.30.4:
+    resolution: {integrity: sha512-q4HvNl+mmDdkS0g+MqiBZNteQJCuimWoOyHMy4T/RQLAn9Z29+E91QXRaxOujeMl2HTzRSS0KFPd7lxX3PjV0Q==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      react: '>=16.8'
+      react-dom: '>=16.8'
+
+  react-router@6.30.4:
+    resolution: {integrity: sha512-SVUsDe+DybHM/WmYKIVYhZh1o5Dcuf16yM6WjG02Q9XVFMZIJyHYhwrr6bFBXZkVP6z69kNkMyBCujt8FaFLJA==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      react: '>=16.8'
+
+  react@18.3.1:
+    resolution: {integrity: sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==}
+    engines: {node: '>=0.10.0'}
+
+  read-cache@1.0.0:
+    resolution: {integrity: sha512-Owdv/Ft7IjOgm/i0xvNDZ1LrRANRfew4b2prF3OWMQLxLfu3bS8FVhCsrSCMK4lR56Y9ya+AThoTpDCTxCmpRA==}
+
+  readdirp@3.6.0:
+    resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
+    engines: {node: '>=8.10.0'}
+
+  resolve@1.22.12:
+    resolution: {integrity: sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==}
+    engines: {node: '>= 0.4'}
+    hasBin: true
+
+  reusify@1.1.0:
+    resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
+    engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
+
+  rollup@4.62.4:
+    resolution: {integrity: sha512-RXOqwaPsBGjMNMa4sQjDjHieHEZDFoj/Rdr46l2MU5DfEs16wHJPC2RPTPHWhNl+M3aI472LLqFkFKut4SblOg==}
+    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
+    hasBin: true
+
+  run-parallel@1.2.0:
+    resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
+
+  scheduler@0.23.2:
+    resolution: {integrity: sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==}
+
+  semver@6.3.1:
+    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
+    hasBin: true
+
+  source-map-js@1.2.1:
+    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+    engines: {node: '>=0.10.0'}
+
+  sucrase@3.35.1:
+    resolution: {integrity: sha512-DhuTmvZWux4H1UOnWMB3sk0sbaCVOoQZjv8u1rDoTV0HTdGem9hkAZtl4JZy8P2z4Bg0nT+YMeOFyVr4zcG5Tw==}
+    engines: {node: '>=16 || 14 >=14.17'}
+    hasBin: true
+
+  supports-preserve-symlinks-flag@1.0.0:
+    resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
+    engines: {node: '>= 0.4'}
+
+  tailwindcss@3.4.19:
+    resolution: {integrity: sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ==}
+    engines: {node: '>=14.0.0'}
+    hasBin: true
+
+  thenify-all@1.6.0:
+    resolution: {integrity: sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==}
+    engines: {node: '>=0.8'}
+
+  thenify@3.3.1:
+    resolution: {integrity: sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==}
+
+  tinyglobby@0.2.17:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+    engines: {node: '>=12.0.0'}
+
+  to-regex-range@5.0.1:
+    resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
+    engines: {node: '>=8.0'}
+
+  ts-interface-checker@0.1.13:
+    resolution: {integrity: sha512-Y/arvbn+rrz3JCKl9C4kVNfTfSm2/mEp5FSz5EsZSANGPSlQrpRI5M4PKF+mJnE52jOO90PnPSc3Ur3bTQw0gA==}
+
+  typescript@5.9.3:
+    resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  update-browserslist-db@1.3.1:
+    resolution: {integrity: sha512-ZZ61DsRsOnakl74HAmp3oSN4aXUmEWXf+i/yv0h7tIBfICc3VdrFErQKUUKPgu3AMsTUMbcongALEN4l6GSUrQ==}
+    hasBin: true
+    peerDependencies:
+      browserslist: '>= 4.21.0'
+
+  util-deprecate@1.0.2:
+    resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
+
+  vite@6.4.3:
+    resolution: {integrity: sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
+      jiti: '>=1.21.0'
+      less: '*'
+      lightningcss: ^1.21.0
+      sass: '*'
+      sass-embedded: '*'
+      stylus: '*'
+      sugarss: '*'
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      lightningcss:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  yallist@3.1.1:
+    resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
+
+snapshots:
+
+  '@alloc/quick-lru@5.2.0': {}
+
+  '@babel/code-frame@7.29.7':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.29.7
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/compat-data@7.29.7': {}
+
+  '@babel/core@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.8
+      '@babel/helper-compilation-targets': 7.29.7
+      '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7)
+      '@babel/helpers': 7.29.7
+      '@babel/parser': 7.29.8
+      '@babel/template': 7.29.7
+      '@babel/traverse': 7.29.8
+      '@babel/types': 7.29.8
+      '@jridgewell/remapping': 2.3.5
+      convert-source-map: 2.0.0
+      debug: 4.4.3
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/generator@7.29.8':
+    dependencies:
+      '@babel/parser': 7.29.8
+      '@babel/types': 7.29.8
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+      jsesc: 3.1.0
+
+  '@babel/helper-compilation-targets@7.29.7':
+    dependencies:
+      '@babel/compat-data': 7.29.7
+      '@babel/helper-validator-option': 7.29.7
+      browserslist: 4.28.8
+      lru-cache: 5.1.1
+      semver: 6.3.1
+
+  '@babel/helper-globals@7.29.7': {}
+
+  '@babel/helper-module-imports@7.29.7':
+    dependencies:
+      '@babel/traverse': 7.29.8
+      '@babel/types': 7.29.8
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-module-transforms@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-module-imports': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
+      '@babel/traverse': 7.29.8
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-plugin-utils@7.29.7': {}
+
+  '@babel/helper-string-parser@7.29.7': {}
+
+  '@babel/helper-validator-identifier@7.29.7': {}
+
+  '@babel/helper-validator-option@7.29.7': {}
+
+  '@babel/helpers@7.29.7':
+    dependencies:
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.8
+
+  '@babel/parser@7.29.8':
+    dependencies:
+      '@babel/types': 7.29.8
+
+  '@babel/plugin-transform-react-jsx-self@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+
+  '@babel/plugin-transform-react-jsx-source@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+
+  '@babel/template@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/parser': 7.29.8
+      '@babel/types': 7.29.8
+
+  '@babel/traverse@7.29.8':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.8
+      '@babel/helper-globals': 7.29.7
+      '@babel/parser': 7.29.8
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.8
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/types@7.29.8':
+    dependencies:
+      '@babel/helper-string-parser': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
+
+  '@esbuild/aix-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm@0.25.12':
+    optional: true
+
+  '@esbuild/android-x64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-x64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/linux-loong64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-s390x@0.25.12':
+    optional: true
+
+  '@esbuild/linux-x64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/sunos-x64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/win32-x64@0.25.12':
+    optional: true
+
+  '@jridgewell/gen-mapping@0.3.13':
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/remapping@2.3.5':
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/resolve-uri@3.1.2': {}
+
+  '@jridgewell/sourcemap-codec@1.5.5': {}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.2
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  '@napi-rs/lzma-linux-x64-gnu@1.5.1':
+    optional: true
+
+  '@nodelib/fs.scandir@2.1.5':
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      run-parallel: 1.2.0
+
+  '@nodelib/fs.stat@2.0.5': {}
+
+  '@nodelib/fs.walk@1.2.8':
+    dependencies:
+      '@nodelib/fs.scandir': 2.1.5
+      fastq: 1.20.1
+
+  '@remix-run/router@1.23.3': {}
+
+  '@rolldown/pluginutils@1.0.0-beta.27': {}
+
+  '@rollup/rollup-android-arm-eabi@4.62.4':
+    optional: true
+
+  '@rollup/rollup-android-arm64@4.62.4':
+    optional: true
+
+  '@rollup/rollup-darwin-arm64@4.62.4':
+    optional: true
+
+  '@rollup/rollup-darwin-x64@4.62.4':
+    optional: true
+
+  '@rollup/rollup-freebsd-arm64@4.62.4':
+    optional: true
+
+  '@rollup/rollup-freebsd-x64@4.62.4':
+    optional: true
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.62.4':
+    optional: true
+
+  '@rollup/rollup-linux-arm-musleabihf@4.62.4':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-gnu@4.62.4':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-musl@4.62.4':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-gnu@4.62.4':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-musl@4.62.4':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-gnu@4.62.4':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-musl@4.62.4':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-gnu@4.62.4':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-musl@4.62.4':
+    optional: true
+
+  '@rollup/rollup-linux-s390x-gnu@4.62.4':
+    optional: true
+
+  '@rollup/rollup-linux-x64-gnu@4.62.4':
+    optional: true
+
+  '@rollup/rollup-linux-x64-musl@4.62.4':
+    optional: true
+
+  '@rollup/rollup-openbsd-x64@4.62.4':
+    optional: true
+
+  '@rollup/rollup-openharmony-arm64@4.62.4':
+    optional: true
+
+  '@rollup/rollup-win32-arm64-msvc@4.62.4':
+    optional: true
+
+  '@rollup/rollup-win32-ia32-msvc@4.62.4':
+    optional: true
+
+  '@rollup/rollup-win32-x64-gnu@4.62.4':
+    optional: true
+
+  '@rollup/rollup-win32-x64-msvc@4.62.4':
+    optional: true
+
+  '@tanstack/query-core@5.101.4': {}
+
+  '@tanstack/react-query@5.101.4(react@18.3.1)':
+    dependencies:
+      '@tanstack/query-core': 5.101.4
+      react: 18.3.1
+
+  '@types/babel__core@7.20.5':
+    dependencies:
+      '@babel/parser': 7.29.8
+      '@babel/types': 7.29.8
+      '@types/babel__generator': 7.27.0
+      '@types/babel__template': 7.4.4
+      '@types/babel__traverse': 7.28.0
+
+  '@types/babel__generator@7.27.0':
+    dependencies:
+      '@babel/types': 7.29.8
+
+  '@types/babel__template@7.4.4':
+    dependencies:
+      '@babel/parser': 7.29.8
+      '@babel/types': 7.29.8
+
+  '@types/babel__traverse@7.28.0':
+    dependencies:
+      '@babel/types': 7.29.8
+
+  '@types/estree@1.0.9': {}
+
+  '@types/js-yaml@4.0.9': {}
+
+  '@types/prop-types@15.7.15': {}
+
+  '@types/react-dom@18.3.7(@types/react@18.3.31)':
+    dependencies:
+      '@types/react': 18.3.31
+
+  '@types/react@18.3.31':
+    dependencies:
+      '@types/prop-types': 15.7.15
+      csstype: 3.2.3
+
+  '@vitejs/plugin-react@4.7.0(vite@6.4.3(jiti@1.21.7))':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/plugin-transform-react-jsx-self': 7.29.7(@babel/core@7.29.7)
+      '@babel/plugin-transform-react-jsx-source': 7.29.7(@babel/core@7.29.7)
+      '@rolldown/pluginutils': 1.0.0-beta.27
+      '@types/babel__core': 7.20.5
+      react-refresh: 0.17.0
+      vite: 6.4.3(jiti@1.21.7)
+    transitivePeerDependencies:
+      - supports-color
+
+  any-promise@1.3.0: {}
+
+  anymatch@3.1.3:
+    dependencies:
+      normalize-path: 3.0.0
+      picomatch: 2.3.2
+
+  arg@5.0.2: {}
+
+  argparse@2.0.1: {}
+
+  autoprefixer@10.5.4(postcss@8.5.26):
+    dependencies:
+      browserslist: 4.28.8
+      caniuse-lite: 1.0.30001809
+      fraction.js: 5.3.4
+      picocolors: 1.1.1
+      postcss: 8.5.26
+      postcss-value-parser: 4.2.0
+
+  baseline-browser-mapping@2.11.13: {}
+
+  binary-extensions@2.3.0: {}
+
+  braces@3.0.3:
+    dependencies:
+      fill-range: 7.1.1
+
+  browserslist@4.28.8:
+    dependencies:
+      baseline-browser-mapping: 2.11.13
+      caniuse-lite: 1.0.30001809
+      electron-to-chromium: 1.5.405
+      node-releases: 2.0.53
+      update-browserslist-db: 1.3.1(browserslist@4.28.8)
+
+  camelcase-css@2.0.1: {}
+
+  caniuse-lite@1.0.30001809: {}
+
+  chokidar@3.6.0:
+    dependencies:
+      anymatch: 3.1.3
+      braces: 3.0.3
+      glob-parent: 5.1.2
+      is-binary-path: 2.1.0
+      is-glob: 4.0.3
+      normalize-path: 3.0.0
+      readdirp: 3.6.0
+    optionalDependencies:
+      fsevents: 2.3.3
+
+  commander@4.1.1: {}
+
+  convert-source-map@2.0.0: {}
+
+  cssesc@3.0.0: {}
+
+  csstype@3.2.3: {}
+
+  debug@4.4.3:
+    dependencies:
+      ms: 2.1.3
+
+  didyoumean@1.2.2: {}
+
+  dlv@1.1.3: {}
+
+  electron-to-chromium@1.5.405: {}
+
+  es-errors@1.3.0: {}
+
+  esbuild@0.25.12:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.25.12
+      '@esbuild/android-arm': 0.25.12
+      '@esbuild/android-arm64': 0.25.12
+      '@esbuild/android-x64': 0.25.12
+      '@esbuild/darwin-arm64': 0.25.12
+      '@esbuild/darwin-x64': 0.25.12
+      '@esbuild/freebsd-arm64': 0.25.12
+      '@esbuild/freebsd-x64': 0.25.12
+      '@esbuild/linux-arm': 0.25.12
+      '@esbuild/linux-arm64': 0.25.12
+      '@esbuild/linux-ia32': 0.25.12
+      '@esbuild/linux-loong64': 0.25.12
+      '@esbuild/linux-mips64el': 0.25.12
+      '@esbuild/linux-ppc64': 0.25.12
+      '@esbuild/linux-riscv64': 0.25.12
+      '@esbuild/linux-s390x': 0.25.12
+      '@esbuild/linux-x64': 0.25.12
+      '@esbuild/netbsd-arm64': 0.25.12
+      '@esbuild/netbsd-x64': 0.25.12
+      '@esbuild/openbsd-arm64': 0.25.12
+      '@esbuild/openbsd-x64': 0.25.12
+      '@esbuild/openharmony-arm64': 0.25.12
+      '@esbuild/sunos-x64': 0.25.12
+      '@esbuild/win32-arm64': 0.25.12
+      '@esbuild/win32-ia32': 0.25.12
+      '@esbuild/win32-x64': 0.25.12
+
+  escalade@3.2.0: {}
+
+  fast-glob@3.3.3:
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      '@nodelib/fs.walk': 1.2.8
+      glob-parent: 5.1.2
+      merge2: 1.4.1
+      micromatch: 4.0.8
+
+  fastq@1.20.1:
+    dependencies:
+      reusify: 1.1.0
+
+  fdir@6.5.0(picomatch@4.0.5):
+    optionalDependencies:
+      picomatch: 4.0.5
+
+  fill-range@7.1.1:
+    dependencies:
+      to-regex-range: 5.0.1
+
+  fraction.js@5.3.4: {}
+
+  fsevents@2.3.3:
+    optional: true
+
+  function-bind@1.1.2: {}
+
+  gensync@1.0.0-beta.2: {}
+
+  glob-parent@5.1.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  glob-parent@6.0.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  hasown@2.0.4:
+    dependencies:
+      function-bind: 1.1.2
+
+  is-binary-path@2.1.0:
+    dependencies:
+      binary-extensions: 2.3.0
+
+  is-core-module@2.16.2:
+    dependencies:
+      hasown: 2.0.4
+
+  is-extglob@2.1.1: {}
+
+  is-glob@4.0.3:
+    dependencies:
+      is-extglob: 2.1.1
+
+  is-number@7.0.0: {}
+
+  jiti@1.21.7: {}
+
+  js-tokens@4.0.0: {}
+
+  js-yaml@5.2.3:
+    dependencies:
+      argparse: 2.0.1
+
+  jsesc@3.1.0: {}
+
+  json5@2.2.3: {}
+
+  lilconfig@3.1.3: {}
+
+  lines-and-columns@1.2.4: {}
+
+  loose-envify@1.4.0:
+    dependencies:
+      js-tokens: 4.0.0
+
+  lru-cache@5.1.1:
+    dependencies:
+      yallist: 3.1.1
+
+  lucide-react@0.469.0(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+
+  merge2@1.4.1: {}
+
+  micromatch@4.0.8:
+    dependencies:
+      braces: 3.0.3
+      picomatch: 2.3.2
+
+  ms@2.1.3: {}
+
+  mz@2.7.0:
+    dependencies:
+      any-promise: 1.3.0
+      object-assign: 4.1.1
+      thenify-all: 1.6.0
+
+  nanoid@3.3.18: {}
+
+  node-releases@2.0.53: {}
+
+  normalize-path@3.0.0: {}
+
+  object-assign@4.1.1: {}
+
+  object-hash@3.0.0: {}
+
+  path-parse@1.0.7: {}
+
+  picocolors@1.1.1: {}
+
+  picomatch@2.3.2: {}
+
+  picomatch@4.0.5: {}
+
+  pify@2.3.0: {}
+
+  pirates@4.0.7: {}
+
+  postcss-import@15.1.0(postcss@8.5.26):
+    dependencies:
+      postcss: 8.5.26
+      postcss-value-parser: 4.2.0
+      read-cache: 1.0.0
+      resolve: 1.22.12
+
+  postcss-js@4.1.0(postcss@8.5.26):
+    dependencies:
+      camelcase-css: 2.0.1
+      postcss: 8.5.26
+
+  postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.26):
+    dependencies:
+      lilconfig: 3.1.3
+    optionalDependencies:
+      jiti: 1.21.7
+      postcss: 8.5.26
+
+  postcss-nested@6.2.0(postcss@8.5.26):
+    dependencies:
+      postcss: 8.5.26
+      postcss-selector-parser: 6.1.4
+
+  postcss-selector-parser@6.1.4:
+    dependencies:
+      cssesc: 3.0.0
+      util-deprecate: 1.0.2
+
+  postcss-value-parser@4.2.0: {}
+
+  postcss@8.5.26:
+    dependencies:
+      nanoid: 3.3.18
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  queue-microtask@1.2.3: {}
+
+  react-dom@18.3.1(react@18.3.1):
+    dependencies:
+      loose-envify: 1.4.0
+      react: 18.3.1
+      scheduler: 0.23.2
+
+  react-refresh@0.17.0: {}
+
+  react-router-dom@6.30.4(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      '@remix-run/router': 1.23.3
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+      react-router: 6.30.4(react@18.3.1)
+
+  react-router@6.30.4(react@18.3.1):
+    dependencies:
+      '@remix-run/router': 1.23.3
+      react: 18.3.1
+
+  react@18.3.1:
+    dependencies:
+      loose-envify: 1.4.0
+
+  read-cache@1.0.0:
+    dependencies:
+      pify: 2.3.0
+
+  readdirp@3.6.0:
+    dependencies:
+      picomatch: 2.3.2
+
+  resolve@1.22.12:
+    dependencies:
+      es-errors: 1.3.0
+      is-core-module: 2.16.2
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+
+  reusify@1.1.0: {}
+
+  rollup@4.62.4:
+    dependencies:
+      '@types/estree': 1.0.9
+    optionalDependencies:
+      '@napi-rs/lzma-linux-x64-gnu': 1.5.1
+      '@rollup/rollup-android-arm-eabi': 4.62.4
+      '@rollup/rollup-android-arm64': 4.62.4
+      '@rollup/rollup-darwin-arm64': 4.62.4
+      '@rollup/rollup-darwin-x64': 4.62.4
+      '@rollup/rollup-freebsd-arm64': 4.62.4
+      '@rollup/rollup-freebsd-x64': 4.62.4
+      '@rollup/rollup-linux-arm-gnueabihf': 4.62.4
+      '@rollup/rollup-linux-arm-musleabihf': 4.62.4
+      '@rollup/rollup-linux-arm64-gnu': 4.62.4
+      '@rollup/rollup-linux-arm64-musl': 4.62.4
+      '@rollup/rollup-linux-loong64-gnu': 4.62.4
+      '@rollup/rollup-linux-loong64-musl': 4.62.4
+      '@rollup/rollup-linux-ppc64-gnu': 4.62.4
+      '@rollup/rollup-linux-ppc64-musl': 4.62.4
+      '@rollup/rollup-linux-riscv64-gnu': 4.62.4
+      '@rollup/rollup-linux-riscv64-musl': 4.62.4
+      '@rollup/rollup-linux-s390x-gnu': 4.62.4
+      '@rollup/rollup-linux-x64-gnu': 4.62.4
+      '@rollup/rollup-linux-x64-musl': 4.62.4
+      '@rollup/rollup-openbsd-x64': 4.62.4
+      '@rollup/rollup-openharmony-arm64': 4.62.4
+      '@rollup/rollup-win32-arm64-msvc': 4.62.4
+      '@rollup/rollup-win32-ia32-msvc': 4.62.4
+      '@rollup/rollup-win32-x64-gnu': 4.62.4
+      '@rollup/rollup-win32-x64-msvc': 4.62.4
+      fsevents: 2.3.3
+
+  run-parallel@1.2.0:
+    dependencies:
+      queue-microtask: 1.2.3
+
+  scheduler@0.23.2:
+    dependencies:
+      loose-envify: 1.4.0
+
+  semver@6.3.1: {}
+
+  source-map-js@1.2.1: {}
+
+  sucrase@3.35.1:
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      commander: 4.1.1
+      lines-and-columns: 1.2.4
+      mz: 2.7.0
+      pirates: 4.0.7
+      tinyglobby: 0.2.17
+      ts-interface-checker: 0.1.13
+
+  supports-preserve-symlinks-flag@1.0.0: {}
+
+  tailwindcss@3.4.19:
+    dependencies:
+      '@alloc/quick-lru': 5.2.0
+      arg: 5.0.2
+      chokidar: 3.6.0
+      didyoumean: 1.2.2
+      dlv: 1.1.3
+      fast-glob: 3.3.3
+      glob-parent: 6.0.2
+      is-glob: 4.0.3
+      jiti: 1.21.7
+      lilconfig: 3.1.3
+      micromatch: 4.0.8
+      normalize-path: 3.0.0
+      object-hash: 3.0.0
+      picocolors: 1.1.1
+      postcss: 8.5.26
+      postcss-import: 15.1.0(postcss@8.5.26)
+      postcss-js: 4.1.0(postcss@8.5.26)
+      postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.26)
+      postcss-nested: 6.2.0(postcss@8.5.26)
+      postcss-selector-parser: 6.1.4
+      resolve: 1.22.12
+      sucrase: 3.35.1
+    transitivePeerDependencies:
+      - tsx
+      - yaml
+
+  thenify-all@1.6.0:
+    dependencies:
+      thenify: 3.3.1
+
+  thenify@3.3.1:
+    dependencies:
+      any-promise: 1.3.0
+
+  tinyglobby@0.2.17:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.5)
+      picomatch: 4.0.5
+
+  to-regex-range@5.0.1:
+    dependencies:
+      is-number: 7.0.0
+
+  ts-interface-checker@0.1.13: {}
+
+  typescript@5.9.3: {}
+
+  update-browserslist-db@1.3.1(browserslist@4.28.8):
+    dependencies:
+      browserslist: 4.28.8
+      escalade: 3.2.0
+      picocolors: 1.1.1
+
+  util-deprecate@1.0.2: {}
+
+  vite@6.4.3(jiti@1.21.7):
+    dependencies:
+      esbuild: 0.25.12
+      fdir: 6.5.0(picomatch@4.0.5)
+      picomatch: 4.0.5
+      postcss: 8.5.26
+      rollup: 4.62.4
+      tinyglobby: 0.2.17
+    optionalDependencies:
+      fsevents: 2.3.3
+      jiti: 1.21.7
+
+  yallist@3.1.1: {}

postcss.config.js

@@ -0,0 +1,6 @@
+export default {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+};

src/App.tsx

@@ -0,0 +1,43 @@
+import { BrowserRouter, Navigate, Route, Routes } from "react-router-dom";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { Layout } from "./components/Layout";
+import { ProductHomePage } from "./features/home/ProductHomePage";
+import { SubmitPage } from "./features/submit/SubmitPage";
+import { ProjectPage } from "./features/project/ProjectPage";
+import { AboutPage } from "./features/about/AboutPage";
+import { MyProjectsPage } from "./features/my/MyProjectsPage";
+import { PopupCallbackPage } from "./features/auth/PopupCallbackPage";
+
+const qc = new QueryClient({
+  defaultOptions: {
+    queries: {
+      retry: 1,
+      refetchOnWindowFocus: false,
+    },
+  },
+});
+
+/** 单着陆页：深色 deck（task-5ee34751 融合定稿）。 */
+const Landing = ProductHomePage;
+
+export function App() {
+  return (
+    <QueryClientProvider client={qc}>
+      <BrowserRouter future={{ v7_startTransition: true, v7_relativeSplatPath: true }}>
+        <Routes>
+          <Route element={<Layout />}>
+            <Route index element={<Landing />} />
+            <Route path="pulse" element={<Navigate to="/" replace />} />
+            <Route path="submit" element={<SubmitPage />} />
+            <Route path="p/:owner/:repo" element={<ProjectPage />} />
+            <Route path="my" element={<MyProjectsPage />} />
+            <Route path="about" element={<AboutPage />} />
+            <Route path="*" element={<Navigate to="/" replace />} />
+          </Route>
+          {/* Popup OAuth callback — standalone (no Layout) */}
+          <Route path="/auth/popup-callback" element={<PopupCallbackPage />} />
+        </Routes>
+      </BrowserRouter>
+    </QueryClientProvider>
+  );
+}

src/components/AuthButton.tsx

@@ -0,0 +1,149 @@
+import { useEffect, useRef, useState } from "react";
+import { useLocation, useNavigate } from "react-router-dom";
+import { Github, LogOut, ChevronDown, FolderGit2 } from "lucide-react";
+import { navigateToLogin, navigateToLoginPopup, isEmbedded, currentReturnTo } from "../shared/api/client";
+import { useLogout, useMe } from "../features/auth/useAuth";
+
+/**
+ * 顶栏登录态：未登录 = Sign in with GitHub；已登录 = 头像 + 下拉（Logout）。
+ * appearance="dark" 用于 zai 深色着陆页头部（与 GitHub pill 同族样式）。
+ */
+export function AuthButton({ appearance = "light" }: { appearance?: "light" | "dark" }) {
+  const meQ = useMe();
+  const logoutM = useLogout();
+  const { pathname, search } = useLocation();
+  const nav = useNavigate();
+  const [open, setOpen] = useState(false);
+  const rootRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    if (!open) return;
+    const onDocDown = (e: MouseEvent) => {
+      if (rootRef.current && !rootRef.current.contains(e.target as Node)) setOpen(false);
+    };
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === "Escape") setOpen(false);
+    };
+    document.addEventListener("mousedown", onDocDown);
+    document.addEventListener("keydown", onKey);
+    return () => {
+      document.removeEventListener("mousedown", onDocDown);
+      document.removeEventListener("keydown", onKey);
+    };
+  }, [open]);
+
+  // 加载中/后端未接入 auth：按未登录渲染（不阻塞页面）
+  const user = meQ.data?.authenticated ? meQ.data.user : null;
+  const dark = appearance === "dark";
+  // loginUrl for href fallback (non-iframe); navigateToLogin for onClick
+  void pathname; void search;
+
+  if (!user) {
+    return (
+      <button
+        type="button"
+        onClick={() => {
+          if (isEmbedded()) {
+            navigateToLoginPopup();
+            window.dispatchEvent(new Event("ov-oauth-popup-opened"));
+          } else {
+            navigateToLogin(currentReturnTo());
+          }
+        }}
+        className={
+          dark
+            ? "inline-flex h-9 items-center gap-2 rounded-full border border-[#333] bg-[#030303] px-3.5 text-xs font-medium text-[#acacb0] transition hover:border-[#484a58] hover:bg-[#111216] hover:text-white focus-ring-dark"
+            : "inline-flex h-9 items-center gap-1.5 rounded-md border border-line bg-surface px-3 text-[13px] font-medium text-ink transition-colors hover:bg-surface-sunken focus-ring"
+        }
+      >
+        <Github size={dark ? 14 : 15} />
+        Sign in
+      </button>
+    );
+  }
+
+  return (
+    <div ref={rootRef} className="relative">
+      <button
+        type="button"
+        onClick={() => setOpen((v) => !v)}
+        aria-expanded={open}
+        aria-haspopup="menu"
+        aria-label={`Signed in as ${user.login}`}
+        className={
+          dark
+            ? "flex h-9 items-center gap-1.5 rounded-full border border-[#333] bg-[#030303] p-1 pr-2 transition hover:border-[#484a58] hover:bg-[#111216] focus-ring-dark"
+            : "flex h-9 items-center gap-1 rounded-md border border-line bg-surface p-1 pr-1.5 transition-colors hover:bg-surface-sunken focus-ring"
+        }
+      >
+        {user.avatar_url ? (
+          <img
+            src={user.avatar_url}
+            alt=""
+            className="h-7 w-7 rounded-full object-cover"
+            referrerPolicy="no-referrer"
+          />
+        ) : (
+          <span className="flex h-7 w-7 items-center justify-center rounded-full bg-accent-100 text-xs font-semibold text-accent-700">
+            {user.login.slice(0, 1).toUpperCase()}
+          </span>
+        )}
+        <ChevronDown
+          size={13}
+          className={`transition-transform ${dark ? "text-[#77787e]" : "text-ink-tertiary"} ${open ? "rotate-180" : ""}`}
+        />
+      </button>
+
+      {open && (
+        <div
+          role="menu"
+          className={
+            dark
+              ? "absolute right-0 top-full z-40 mt-2 w-44 overflow-hidden rounded-xl border border-[#333] bg-[#111216] shadow-[0_16px_50px_rgba(0,0,0,0.5)]"
+              : "absolute right-0 top-full z-40 mt-1.5 w-44 overflow-hidden rounded-lg border border-line bg-surface shadow-lg"
+          }
+        >
+          <div
+            className={`border-b px-3.5 py-2.5 text-[13px] font-medium ${dark ? "border-[#26272c] text-[#f0f2f6]" : "border-line text-ink"}`}
+          >
+            {user.login}
+          </div>
+          <a
+            role="menuitem"
+            href="/my"
+            onClick={(e) => {
+              e.preventDefault();
+              setOpen(false);
+              nav("/my");
+            }}
+            className={`flex w-full items-center gap-2 px-3.5 py-2.5 text-left text-[13px] transition-colors ${
+              dark
+                ? "text-[#acacb0] hover:bg-[#1a1b20] hover:text-white"
+                : "text-ink-secondary hover:bg-surface-sunken hover:text-ink"
+            }`}
+          >
+            <FolderGit2 size={14} />
+            My submissions
+          </a>
+          <button
+            type="button"
+            role="menuitem"
+            onClick={() => {
+              setOpen(false);
+              logoutM.mutate();
+            }}
+            disabled={logoutM.isPending}
+            className={`flex w-full items-center gap-2 px-3.5 py-2.5 text-left text-[13px] transition-colors ${
+              dark
+                ? "text-[#acacb0] hover:bg-[#1a1b20] hover:text-white"
+                : "text-ink-secondary hover:bg-surface-sunken hover:text-ink"
+            }`}
+          >
+            <LogOut size={14} />
+            {logoutM.isPending ? "Signing out…" : "Sign out"}
+          </button>
+        </div>
+      )}
+    </div>
+  );
+}

src/components/Button.tsx

@@ -0,0 +1,40 @@
+import type { ButtonHTMLAttributes, ReactNode } from "react";
+
+type Variant = "primary" | "secondary" | "ghost" | "danger";
+type Size = "md" | "lg";
+
+const styles: Record<Variant, string> = {
+  // 协作者深色体系：主按钮 = 白底黑字（composer submit 同族）
+  primary: "bg-[#ebecf0] text-[#0d0d0f] hover:bg-white border border-transparent",
+  secondary: "bg-surface-raised text-ink border border-[#333] hover:border-[#484a58] hover:bg-surface-sunken",
+  ghost: "bg-transparent text-ink-secondary border border-transparent hover:bg-surface-sunken hover:text-ink",
+  danger: "bg-danger text-white hover:bg-[#d63f3f] border border-transparent",
+};
+
+// 高度集中在 size prop，禁止 className 覆盖高度（Tailwind 同源类冲突靠 CSS 顺序，不可靠）
+const sizes: Record<Size, string> = {
+  md: "h-9 px-3.5",
+  lg: "h-12 px-5",
+};
+
+export function Button({
+  variant = "primary",
+  size = "md",
+  className = "",
+  children,
+  ...props
+}: ButtonHTMLAttributes<HTMLButtonElement> & {
+  variant?: Variant;
+  size?: Size;
+  children: ReactNode;
+}) {
+  return (
+    <button
+      type="button"
+      className={`inline-flex items-center justify-center gap-1.5 rounded-md text-sm font-medium transition-colors focus-ring disabled:opacity-50 disabled:pointer-events-none ${sizes[size]} ${styles[variant]} ${className}`}
+      {...props}
+    >
+      {children}
+    </button>
+  );
+}

src/components/ConfirmDialog.tsx

@@ -0,0 +1,69 @@
+import { useEffect, useRef } from "react";
+import { Button } from "./Button";
+
+export function ConfirmDialog({
+  open,
+  title,
+  body,
+  confirmLabel = "Confirm",
+  danger = false,
+  busy = false,
+  onConfirm,
+  onCancel,
+}: {
+  open: boolean;
+  title: string;
+  body: string;
+  confirmLabel?: string;
+  danger?: boolean;
+  busy?: boolean;
+  onConfirm: () => void;
+  onCancel: () => void;
+}) {
+  const cancelRef = useRef<HTMLButtonElement>(null);
+
+  useEffect(() => {
+    if (!open) return;
+    cancelRef.current?.focus();
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === "Escape") onCancel();
+    };
+    window.addEventListener("keydown", onKey);
+    return () => window.removeEventListener("keydown", onKey);
+  }, [open, onCancel]);
+
+  if (!open) return null;
+
+  return (
+    <div
+      className="fixed inset-0 z-50 flex items-center justify-center bg-ink/40 p-4"
+      role="dialog"
+      aria-modal="true"
+      aria-labelledby="confirm-title"
+      onMouseDown={(e) => {
+        if (e.target === e.currentTarget) onCancel();
+      }}
+    >
+      <div className="w-full max-w-md rounded-md border border-line bg-surface-raised p-5 shadow-lg">
+        <h2 id="confirm-title" className="text-base font-semibold text-ink">
+          {title}
+        </h2>
+        <p className="mt-2 text-sm leading-relaxed text-ink-secondary">{body}</p>
+        <div className="mt-5 flex justify-end gap-2">
+          <button
+            ref={cancelRef}
+            type="button"
+            onClick={onCancel}
+            disabled={busy}
+            className="inline-flex h-9 items-center justify-center rounded-md border border-line bg-surface-raised px-3.5 text-sm font-medium text-ink hover:bg-surface-sunken focus-ring disabled:opacity-50"
+          >
+            Cancel
+          </button>
+          <Button variant={danger ? "danger" : "primary"} onClick={onConfirm} disabled={busy}>
+            {busy ? "Working…" : confirmLabel}
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+}

src/components/EmptyState.tsx

@@ -0,0 +1,27 @@
+import type { LucideIcon } from "lucide-react";
+import type { ReactNode } from "react";
+
+export function EmptyState({
+  icon: Icon,
+  title,
+  description,
+  action,
+}: {
+  icon: LucideIcon;
+  title: string;
+  description?: string;
+  action?: ReactNode;
+}) {
+  return (
+    <div className="flex flex-col items-center justify-center gap-3 px-6 py-16 text-center">
+      <Icon size={32} className="text-ink-tertiary" strokeWidth={1.5} />
+      <div>
+        <p className="text-sm font-medium text-ink">{title}</p>
+        {description && (
+          <p className="mt-1 max-w-sm text-[13px] text-ink-secondary">{description}</p>
+        )}
+      </div>
+      {action}
+    </div>
+  );
+}

src/components/EventTicker.tsx

@@ -0,0 +1,74 @@
+import type { RecentActivityItem } from "@/shared/types";
+import { formatRelativeTime } from "../shared/lib/format";
+
+const ROW_H = 28; // px，无缝滚动依赖统一行高
+const VISIBLE = 3;
+
+function badge(r: RecentActivityItem) {
+  if (r.type === "project_submitted") {
+    return (
+      <span className="shrink-0 rounded bg-accent-50 px-1.5 py-px font-mono text-[10px] font-semibold uppercase tracking-wide text-accent-700">
+        New project
+      </span>
+    );
+  }
+  if (r.type === "disclosed") {
+    return (
+      <span className="shrink-0 rounded bg-ai-bg px-1.5 py-px font-mono text-[10px] font-semibold uppercase tracking-wide text-ai-ink">
+        Disclosed · {r.meta}
+      </span>
+    );
+  }
+  // scan_completed with findings
+  return (
+    <span className="shrink-0 rounded bg-sev-high-bg px-1.5 py-px font-mono text-[10px] font-semibold text-sev-high-ink">
+      {(r.meta ?? "").replace(" findings", "")} findings
+    </span>
+  );
+}
+
+/** 欢迎页滚动信息流（无边框、左右透明渐变）：new project / new finding 摘要，无缝纵滚，hover 暂停 */
+export function EventTicker({ events }: { events: RecentActivityItem[] | undefined }) {
+  const items = (events ?? [])
+    .filter(
+      (r) =>
+        r.type === "project_submitted" ||
+        r.type === "disclosed" ||
+        (r.type === "scan_completed" && r.meta && !r.meta.startsWith("+0")),
+    )
+    .slice(0, 8);
+
+  if (items.length === 0) return null;
+
+  const row = (r: RecentActivityItem, key: string) => (
+    <li key={key} className="flex items-center gap-2.5 text-[13px]" style={{ height: ROW_H }}>
+      {badge(r)}
+      <span className="min-w-0 truncate text-ink">{r.full_name ?? r.text}</span>
+      <span className="ml-auto shrink-0 font-mono text-[11px] text-ink-tertiary">
+        {formatRelativeTime(r.ts)}
+      </span>
+    </li>
+  );
+
+  return (
+    <div data-ticker aria-label="Live activity feed">
+      <div
+        className="overflow-hidden [mask-image:linear-gradient(to_right,transparent,black_10%,black_90%,transparent)]"
+        style={{ height: ROW_H * VISIBLE }}
+      >
+        <ul
+          className="ticker-track px-8"
+          style={{ animation: `ticker-y ${Math.max(8, items.length * 2.4)}s linear infinite` }}
+        >
+          {items.map((r, i) => row(r, `a-${i}`))}
+          {items.map((r, i) => row(r, `b-${i}`))}
+        </ul>
+      </div>
+      <style>{`
+        @keyframes ticker-y { to { transform: translateY(-50%); } }
+        [data-ticker]:hover .ticker-track { animation-play-state: paused; }
+        @media (prefers-reduced-motion: reduce) { .ticker-track { animation: none !important; } }
+      `}</style>
+    </div>
+  );
+}

src/components/HeroStats.tsx

@@ -0,0 +1,115 @@
+import { useEffect, useState } from "react";
+import { AlertTriangle, Bug, FolderGit2 } from "lucide-react";
+import type { OverviewStats } from "@/shared/types";
+
+function usePrefersReducedMotion(): boolean {
+  const [reduced, setReduced] = useState(false);
+  useEffect(() => {
+    const media = window.matchMedia("(prefers-reduced-motion: reduce)");
+    setReduced(media.matches);
+    const update = () => setReduced(media.matches);
+    media.addEventListener("change", update);
+    return () => media.removeEventListener("change", update);
+  }, []);
+  return reduced;
+}
+
+function useCountUp(target: number, duration = 650): number {
+  const reduced = usePrefersReducedMotion();
+  const [value, setValue] = useState(reduced ? target : 0);
+  useEffect(() => {
+    if (reduced) {
+      setValue(target);
+      return;
+    }
+    let frame = 0;
+    const start = performance.now();
+    const tick = (time: number) => {
+      const progress = Math.min(1, (time - start) / duration);
+      setValue(Math.round(target * (1 - (1 - progress) ** 3)));
+      if (progress < 1) frame = requestAnimationFrame(tick);
+    };
+    frame = requestAnimationFrame(tick);
+    return () => cancelAnimationFrame(frame);
+  }, [duration, reduced, target]);
+  return value;
+}
+
+function AnimatedNumber({ value }: { value: number }) {
+  return <>{useCountUp(value).toLocaleString()}</>;
+}
+
+export function HeroStats({
+  stats,
+  loading = false,
+  failed = false,
+}: {
+  stats: OverviewStats | undefined;
+  loading?: boolean;
+  failed?: boolean;
+}) {
+  const unavailable = loading || failed || !stats;
+  const scannedRepositories = stats
+    ? stats.scanned_project_count ?? Math.min(stats.project_count, stats.scan_completed_count)
+    : 0;
+  const findingTotal = stats?.finding_total ?? 0;
+  const highRiskTotal = stats?.severity_counts?.high ?? 0;
+
+  const metrics = [
+    {
+      label: "Findings",
+      detail: "Discovered issues",
+      value: findingTotal,
+      icon: Bug,
+      color: "text-white",
+      iconClass: "border-white/[0.08] bg-white/[0.05] text-[#b5b6bd]",
+    },
+    {
+      label: "High risk",
+      detail: "High severity findings",
+      value: highRiskTotal,
+      icon: AlertTriangle,
+      color: "text-white",
+      iconClass: "border-white/[0.08] bg-white/[0.05] text-[#b5b6bd]",
+    },
+    {
+      label: "Repositories",
+      detail: "Scanned projects",
+      value: scannedRepositories,
+      icon: FolderGit2,
+      color: "text-white",
+      iconClass: "border-white/[0.08] bg-white/[0.05] text-[#b5b6bd]",
+    },
+  ];
+
+  return (
+    <section aria-labelledby="overview-title" className="openvuln-panel min-w-0 p-5 sm:p-6">
+      <div className="flex items-end justify-between gap-4">
+        <div>
+          <p className="font-mono text-[9px] font-semibold uppercase tracking-[0.18em] text-ink-tertiary">
+            Security overview
+          </p>
+          <h2 id="overview-title" className="mt-2 font-display text-lg font-semibold tracking-tight text-white">
+            Findings at a glance
+          </h2>
+        </div>
+        <span className="mb-1 h-2 w-2 rounded-full bg-white/60" aria-hidden />
+      </div>
+
+      <div className="mt-5 grid grid-cols-3 divide-x divide-white/[0.07]">
+        {metrics.map(({ label, detail, value, icon: Icon, color, iconClass }) => (
+          <div key={label} className="min-w-0 px-3 first:pl-0 last:pr-0 sm:px-5">
+            <div className={`flex h-8 w-8 items-center justify-center rounded-lg border ${iconClass}`} aria-hidden>
+              <Icon size={15} />
+            </div>
+            <p className={`mt-4 font-display text-3xl font-semibold tabular-nums tracking-[-0.04em] sm:text-4xl ${color}`}>
+              {unavailable ? "—" : <AnimatedNumber value={value} />}
+            </p>
+            <p className="mt-2 truncate text-[11px] font-medium text-[#d0d1d5] sm:text-xs">{label}</p>
+            <p className="mt-0.5 hidden text-[10px] leading-4 text-ink-tertiary sm:block">{detail}</p>
+          </div>
+        ))}
+      </div>
+    </section>
+  );
+}

src/components/Layout.tsx

@@ -0,0 +1,63 @@
+import { Link, Outlet, useLocation } from "react-router-dom";
+import { Github } from "lucide-react";
+import { AuthButton } from "./AuthButton";
+import { NotificationBell } from "./NotificationBell";
+
+/** OpenVuln public repo; override at build time via VITE_GITHUB_REPO_URL. */
+const OWN_REPO =
+  (import.meta.env.VITE_GITHUB_REPO_URL as string | undefined) ||
+  "https://github.com/Clouditera/OpenVuln";
+
+export function Layout() {
+  const { pathname } = useLocation();
+  const isDeck = pathname === "/";
+  return (
+    <div className="flex min-h-screen flex-col">
+      {!isDeck && <header className="app-shell-chrome sticky top-0 z-30 h-14 border-b border-line bg-surface-header/95 backdrop-blur">
+        <div className="flex h-full items-center justify-between gap-4 px-5">
+          <div className="flex items-center">
+            <Link
+              to="/"
+              className="font-display text-[17px] font-bold tracking-tight focus-ring rounded-md text-ink"
+            >
+              OpenVuln
+            </Link>
+          </div>
+
+          <div className="flex items-center gap-2">
+            <NotificationBell appearance="light" />
+            <AuthButton appearance="light" />
+            <a
+              href={OWN_REPO}
+              target="_blank"
+              rel="noreferrer"
+              className="rounded-md p-2 text-ink-secondary hover:bg-surface-sunken hover:text-ink focus-ring"
+              title="OpenVuln on GitHub"
+            >
+              <Github size={18} />
+            </a>
+          </div>
+        </div>
+      </header>}
+
+      <main className="flex-1">
+        <Outlet />
+      </main>
+
+      {!isDeck && (
+      <footer className="app-shell-chrome mt-auto border-t border-line">
+        <div className="flex justify-end px-5 py-6 text-[13px] text-ink-secondary">
+          <div className="flex flex-wrap gap-x-5 gap-y-1">
+            <a href={OWN_REPO} target="_blank" rel="noreferrer" className="hover:text-ink">
+              GitHub
+            </a>
+            <Link to="/about" className="hover:text-ink">
+              About
+            </Link>
+          </div>
+        </div>
+      </footer>
+      )}
+    </div>
+  );
+}

src/components/NotificationBell.tsx

@@ -0,0 +1,170 @@
+import { useEffect, useRef, useState } from "react";
+import { useNavigate } from "react-router-dom";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { Bell, CheckCheck } from "lucide-react";
+import { api, type NotificationItem } from "../shared/api/client";
+import { useMe } from "../features/auth/useAuth";
+import { formatRelativeTime } from "../shared/lib/format";
+
+function summary(n: NotificationItem): string {
+  const c = n.payload.counts;
+  const total = c.critical + c.high + c.medium + c.low;
+  if (n.payload.no_value) return "Scan completed — no auditable content found";
+  if (total === 0) return "Scan completed — no findings";
+  const parts: string[] = [];
+  if (c.critical) parts.push(`${c.critical} critical`);
+  if (c.high) parts.push(`${c.high} high`);
+  if (c.medium) parts.push(`${c.medium} medium`);
+  if (c.low) parts.push(`${c.low} low`);
+  return `Scan completed — ${parts.join(" · ")}`;
+}
+
+/** 站内通知铃铛（task-78c9fb3a）：未读红点 + 下拉列表，点击跳项目页并标已读。60s 轮询。 */
+export function NotificationBell({ appearance = "light" }: { appearance?: "light" | "dark" }) {
+  const meQ = useMe();
+  const authed = meQ.data?.authenticated === true;
+  const nav = useNavigate();
+  const qc = useQueryClient();
+  const [open, setOpen] = useState(false);
+  const rootRef = useRef<HTMLDivElement>(null);
+
+  const listQ = useQuery({
+    queryKey: ["notifications"],
+    queryFn: () => api.notifications(20),
+    enabled: authed,
+    refetchInterval: 60_000,
+    refetchOnWindowFocus: true,
+    retry: false,
+  });
+
+  const invalidate = () => qc.invalidateQueries({ queryKey: ["notifications"] });
+  const readM = useMutation({ mutationFn: api.markNotificationsRead, onSettled: invalidate });
+  const readAllM = useMutation({ mutationFn: api.markAllNotificationsRead, onSettled: invalidate });
+
+  useEffect(() => {
+    if (!open) return;
+    const onDocDown = (e: MouseEvent) => {
+      if (rootRef.current && !rootRef.current.contains(e.target as Node)) setOpen(false);
+    };
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === "Escape") setOpen(false);
+    };
+    document.addEventListener("mousedown", onDocDown);
+    document.addEventListener("keydown", onKey);
+    return () => {
+      document.removeEventListener("mousedown", onDocDown);
+      document.removeEventListener("keydown", onKey);
+    };
+  }, [open]);
+
+  if (!authed) return null;
+
+  const dark = appearance === "dark";
+  const items = listQ.data?.notifications ?? [];
+  const unread = listQ.data?.unread_count ?? 0;
+
+  const openItem = (n: NotificationItem) => {
+    setOpen(false);
+    if (!n.read_at) readM.mutate([n.id]);
+    const [owner, repo] = n.payload.full_name.split("/");
+    if (owner && repo) nav(`/p/${owner}/${repo}`);
+  };
+
+  return (
+    <div ref={rootRef} className="relative">
+      <button
+        type="button"
+        onClick={() => setOpen((v) => !v)}
+        aria-expanded={open}
+        aria-haspopup="menu"
+        aria-label={unread > 0 ? `Notifications (${unread} unread)` : "Notifications"}
+        className={
+          dark
+            ? "relative flex h-9 w-9 items-center justify-center rounded-full border border-[#333] bg-[#030303] text-[#acacb0] transition hover:border-[#484a58] hover:bg-[#111216] hover:text-white focus-ring-dark"
+            : "relative flex h-9 w-9 items-center justify-center rounded-md border border-line bg-surface text-ink-secondary transition-colors hover:bg-surface-sunken hover:text-ink focus-ring"
+        }
+      >
+        <Bell size={dark ? 14 : 16} />
+        {unread > 0 && (
+          <span className="absolute -right-1 -top-1 flex h-4 min-w-4 items-center justify-center rounded-full bg-danger px-1 text-[10px] font-semibold leading-none text-white">
+            {unread > 9 ? "9+" : unread}
+          </span>
+        )}
+      </button>
+
+      {open && (
+        <div
+          role="menu"
+          className={
+            dark
+              ? "absolute right-0 top-full z-40 mt-2 w-80 overflow-hidden rounded-xl border border-[#333] bg-[#111216] shadow-[0_16px_50px_rgba(0,0,0,0.5)]"
+              : "absolute right-0 top-full z-40 mt-1.5 w-80 overflow-hidden rounded-lg border border-line bg-surface shadow-lg"
+          }
+        >
+          <div
+            className={`flex items-center justify-between border-b px-3.5 py-2.5 ${dark ? "border-[#26272c]" : "border-line"}`}
+          >
+            <span className={`text-[13px] font-medium ${dark ? "text-[#f0f2f6]" : "text-ink"}`}>
+              Notifications
+            </span>
+            {unread > 0 && (
+              <button
+                type="button"
+                onClick={() => readAllM.mutate()}
+                disabled={readAllM.isPending}
+                className={`inline-flex items-center gap-1 text-[12px] ${dark ? "text-[#acacb0] hover:text-white" : "text-ink-secondary hover:text-ink"}`}
+              >
+                <CheckCheck size={13} />
+                Mark all read
+              </button>
+            )}
+          </div>
+
+          <ul className="max-h-80 overflow-y-auto">
+            {listQ.isPending ? (
+              <li className={`px-3.5 py-6 text-center text-[13px] ${dark ? "text-[#77787e]" : "text-ink-tertiary"}`}>
+                Loading…
+              </li>
+            ) : items.length === 0 ? (
+              <li className={`px-3.5 py-6 text-center text-[13px] ${dark ? "text-[#77787e]" : "text-ink-tertiary"}`}>
+                No notifications yet
+              </li>
+            ) : (
+              items.map((n) => {
+                const isUnread = !n.read_at;
+                return (
+                  <li key={n.id}>
+                    <button
+                      type="button"
+                      role="menuitem"
+                      onClick={() => openItem(n)}
+                      className={`flex w-full items-start gap-2.5 px-3.5 py-2.5 text-left transition-colors ${
+                        dark ? "hover:bg-[#1a1b20]" : "hover:bg-surface-sunken"
+                      }`}
+                    >
+                      <span
+                        className={`mt-1.5 h-1.5 w-1.5 shrink-0 rounded-full ${isUnread ? "bg-accent-600" : "bg-transparent"}`}
+                        aria-hidden
+                      />
+                      <span className="min-w-0 flex-1">
+                        <span className={`block truncate text-[13px] font-medium ${dark ? "text-[#f0f2f6]" : "text-ink"}`}>
+                          {n.payload.full_name}
+                        </span>
+                        <span className={`mt-0.5 block text-[12px] leading-snug ${dark ? "text-[#acacb0]" : "text-ink-secondary"}`}>
+                          {summary(n)}
+                        </span>
+                        <span className={`mt-0.5 block font-mono text-[11px] ${dark ? "text-[#696a70]" : "text-ink-tertiary"}`}>
+                          {formatRelativeTime(n.created_at)}
+                        </span>
+                      </span>
+                    </button>
+                  </li>
+                );
+              })
+            )}
+          </ul>
+        </div>
+      )}
+    </div>
+  );
+}

src/components/PlatformPulse.tsx

@@ -0,0 +1,300 @@
+import { useEffect, useMemo, useRef, useState } from "react";
+import { Link } from "react-router-dom";
+import type { OverviewStats, TrendDay } from "@/shared/types";
+import { SEV_ORDER, severityLabel } from "../shared/lib/format";
+
+const SEV = {
+  high: "#F24F4F",
+  medium: "#FF733C",
+  low: "#F7C530",
+  critical: "#C22828",
+} as const;
+
+type Pt = TrendDay;
+
+function stackedAreas(data: Pt[], w = 560, h = 180) {
+  const keys = ["critical", "high", "medium", "low"] as const;
+  const max = Math.max(...data.map((d) =>  (d.critical??0)+d.high+d.medium+d.low ), 1);
+  const x = (i: number) => (data.length <= 1 ? 0 : (i / (data.length - 1)) * w);
+  const y = (v: number) => h - (v / max) * (h - 16);
+  const acc = data.map(() => 0);
+  return keys.map((k) => {
+    const top = data.map((d, i) => {
+      acc[i] += d[k];
+      return [x(i), y(acc[i])] as const;
+    });
+    const base = data.map((d, i) => [x(i), y(acc[i] - d[k])] as const).reverse();
+    const line = top
+      .map((p, i) => `${i ? "L" : "M"}${p[0].toFixed(1)},${p[1].toFixed(1)}`)
+      .join("");
+    const area = `${line}${base.map((p) => `L${p[0].toFixed(1)},${p[1].toFixed(1)}`).join("")}Z`;
+    return { key: k, area, line };
+  });
+}
+
+function usePrefersReducedMotion(): boolean {
+  const [reduced, setReduced] = useState(false);
+  useEffect(() => {
+    const mq = window.matchMedia("(prefers-reduced-motion: reduce)");
+    setReduced(mq.matches);
+    const fn = () => setReduced(mq.matches);
+    mq.addEventListener("change", fn);
+    return () => mq.removeEventListener("change", fn);
+  }, []);
+  return reduced;
+}
+
+function formatElapsed(sec: number): string {
+  if (sec < 60) return `${sec}s`;
+  const m = Math.floor(sec / 60);
+  if (m < 60) return `${m}m`;
+  return `${Math.floor(m / 60)}h ${m % 60}m`;
+}
+
+const PANEL = "rounded-lg border border-line bg-surface-raised p-4";
+const EYEBROW = "font-mono text-[11px] uppercase tracking-wider text-ink-tertiary";
+
+/** 首页第二页（浅色）：趋势图 / LIVE / 新增漏洞事件卡 / TOP CWE */
+export function PlatformPulse({ stats }: { stats: OverviewStats | undefined }) {
+  const reduced = usePrefersReducedMotion();
+  const trend = stats?.trend ?? [];
+  const layers = useMemo(() => (trend.length ? stackedAreas(trend) : []), [trend]);
+  const pathRefs = useRef<(SVGPathElement | null)[]>([]);
+
+  useEffect(() => {
+    if (reduced) return;
+    for (const el of pathRefs.current) {
+      if (!el) continue;
+      const len = el.getTotalLength();
+      el.style.strokeDasharray = `${len}`;
+      el.style.strokeDashoffset = `${len}`;
+      el.getBoundingClientRect();
+      el.style.transition = "stroke-dashoffset 900ms ease-out";
+      el.style.strokeDashoffset = "0";
+    }
+  }, [layers, reduced]);
+
+  const sevTotals = stats?.severity_counts ?? { critical: 0, high: 0, medium: 0, low: 0 };
+  const live = stats?.live;
+  const scanningCount = live?.scanning.length ?? 0;
+  const queuedCount = live?.queued_count ?? 0;
+  const cweTop = stats?.cwe_top ?? [];
+  const cweMax = Math.max(1, ...cweTop.map((c) => c.count));
+  const hasFindings =
+    (stats?.finding_total ?? 0) > 0 || trend.some((d) =>  (d.critical??0)+d.high+d.medium+d.low  > 0);
+
+  const xTicks = useMemo(() => {
+    if (trend.length < 2) return [];
+    const idxs = [0, 7, 14, 21, 29].filter((i) => i < trend.length);
+    return idxs.map((i) => ({
+      i,
+      label: trend[i].date.slice(5),
+      x: (i / (trend.length - 1)) * 560,
+    }));
+  }, [trend]);
+
+  return (
+    <div className="mx-auto max-w-6xl px-6 py-6">
+      <p className={`mb-4 ${EYEBROW}`}>
+        Platform Pulse
+        <span className="mx-2 text-line">·</span>
+        <span className="inline-flex items-center gap-1.5 text-success-ink">
+          <span className="relative flex h-1.5 w-1.5">
+            <span className="absolute inline-flex h-full w-full animate-ping rounded-full bg-success opacity-60 motion-reduce:animate-none" />
+            <span className="relative inline-flex h-1.5 w-1.5 rounded-full bg-success" />
+          </span>
+          Live
+        </span>
+      </p>
+
+      <div className="grid grid-cols-1 gap-4 lg:grid-cols-12">
+        {/* Findings 趋势 */}
+        <div className={`${PANEL} lg:col-span-7`}>
+          <div className="flex items-baseline justify-between gap-2">
+            <p className={EYEBROW}>Findings · last 30 days</p>
+            <p className="font-display text-sm font-semibold text-ink">
+              {(stats?.finding_total ?? 0).toLocaleString()}
+            </p>
+          </div>
+          <div className="relative mt-3">
+            {!hasFindings && (
+              <div className="pointer-events-none absolute inset-0 z-10 flex items-center justify-center">
+                <span className="text-sm text-ink-tertiary">Awaiting first scans</span>
+              </div>
+            )}
+            <svg
+              viewBox="0 0 560 180"
+              className="h-auto w-full"
+              role="img"
+              aria-label="Stacked area chart of findings by severity over the last 30 days"
+            >
+              {[0.25, 0.5, 0.75].map((g) => (
+                <line
+                  key={g}
+                  x1={0}
+                  x2={560}
+                  y1={16 + (180 - 16) * (1 - g)}
+                  y2={16 + (180 - 16) * (1 - g)}
+                  stroke="#E7E8EB"
+                  strokeWidth={1}
+                />
+              ))}
+              {[...layers].reverse().map((layer) => (
+                <path
+                  key={`a-${layer.key}`}
+                  d={layer.area}
+                  fill={SEV[layer.key]}
+                  fillOpacity={reduced ? 0.25 : 0}
+                  style={
+                    reduced
+                      ? undefined
+                      : { animation: "pulse-fade-in 400ms ease-out forwards", animationDelay: "200ms" }
+                  }
+                />
+              ))}
+              {layers.map((layer, idx) => (
+                <path
+                  key={`l-${layer.key}`}
+                  ref={(el) => {
+                    pathRefs.current[idx] = el;
+                  }}
+                  d={layer.line}
+                  fill="none"
+                  stroke={SEV[layer.key]}
+                  strokeWidth={1.5}
+                />
+              ))}
+              {xTicks.map((t) => (
+                <text
+                  key={t.i}
+                  x={t.x}
+                  y={176}
+                  textAnchor={t.i === 0 ? "start" : t.i >= 28 ? "end" : "middle"}
+                  className="fill-ink-tertiary"
+                  style={{ fontSize: 10, fontFamily: "ui-monospace, monospace" }}
+                >
+                  {t.label}
+                </text>
+              ))}
+            </svg>
+          </div>
+          <div className="mt-2 flex flex-wrap gap-x-4 gap-y-1 font-mono text-[12px] text-ink-secondary">
+            {SEV_ORDER.map((s) => (
+              <span key={s} className="inline-flex items-center gap-1.5">
+                <span
+                  className="inline-block h-1.5 w-1.5 rounded-full"
+                  style={{ backgroundColor: SEV[s] }}
+                />
+                {severityLabel(s)} {sevTotals[s]}
+              </span>
+            ))}
+          </div>
+        </div>
+
+        {/* LIVE NOW */}
+        <div className={`${PANEL} lg:col-span-5`}>
+          <p className={EYEBROW}>Live now</p>
+          <p className="mt-2 flex items-center gap-2 text-sm text-ink">
+            <span className="relative flex h-2 w-2">
+              {(scanningCount > 0 || queuedCount > 0) && (
+                <span className="absolute inline-flex h-full w-full animate-ping rounded-full bg-success opacity-50 motion-reduce:hidden" />
+              )}
+              <span
+                className={`relative inline-flex h-2 w-2 rounded-full ${
+                  scanningCount > 0 ? "bg-success" : "bg-ink-tertiary"
+                }`}
+              />
+            </span>
+            <span className="font-mono text-[13px]">
+              {scanningCount > 0 || queuedCount > 0 ? (
+                <>
+                  {scanningCount} scanning · {queuedCount} queued
+                </>
+              ) : (
+                <span className="text-ink-tertiary">Idle · queue empty</span>
+              )}
+            </span>
+          </p>
+          <ul className="mt-3 space-y-2.5">
+            {(live?.scanning ?? []).map((s) => (
+              <li key={s.project_id} className="flex items-center gap-2 text-sm">
+                <LiveDot />
+                <Link
+                  to={`/p/${s.full_name}`}
+                  className="min-w-0 flex-1 truncate text-ink hover:text-accent-600"
+                >
+                  {s.full_name}
+                </Link>
+                <span className="shrink-0 font-mono text-[12px] text-ink-tertiary">
+                  {formatElapsed(s.elapsed_sec)}
+                </span>
+              </li>
+            ))}
+          </ul>
+        </div>
+
+        {/* TOP CWE */}
+        <div className={`${PANEL} lg:col-span-12`}>
+          <p className={EYEBROW}>Top CWE</p>
+          {cweTop.length === 0 ? (
+            <p className="mt-3 text-sm text-ink-tertiary">No CWE data yet.</p>
+          ) : (
+            <ul className="mt-3 grid grid-cols-1 gap-x-8 gap-y-2 sm:grid-cols-2 lg:grid-cols-4">
+              {cweTop.map((c) => (
+                <li key={c.cwe} className="flex items-center gap-2 text-sm">
+                  <a
+                    href={
+                      c.cwe.startsWith("CWE-")
+                        ? `https://cwe.mitre.org/data/definitions/${c.cwe.replace("CWE-", "")}.html`
+                        : undefined
+                    }
+                    target="_blank"
+                    rel="noreferrer"
+                    className="w-[4.5rem] shrink-0 font-mono text-[12px] text-accent-600 hover:underline"
+                  >
+                    {c.cwe}
+                  </a>
+                  <span className="w-16 shrink-0 truncate text-[12px] text-ink-secondary">
+                    {c.name ?? "—"}
+                  </span>
+                  <div className="h-1 flex-1 overflow-hidden rounded-full bg-surface-sunken">
+                    <div
+                      className="h-full rounded-full bg-accent-600"
+                      style={{ width: `${(c.count / cweMax) * 100}%` }}
+                    />
+                  </div>
+                  <span className="w-8 text-right font-mono text-[12px] text-ink-secondary">
+                    {c.count}
+                  </span>
+                </li>
+              ))}
+            </ul>
+          )}
+        </div>
+      </div>
+
+      <style>{`
+        @keyframes pulse-fade-in {
+          from { fill-opacity: 0; }
+          to { fill-opacity: 0.25; }
+        }
+        @keyframes live-ring {
+          0% { transform: scale(0.6); opacity: 0.7; }
+          100% { transform: scale(2.2); opacity: 0; }
+        }
+      `}</style>
+    </div>
+  );
+}
+
+function LiveDot() {
+  return (
+    <span className="relative flex h-2.5 w-2.5 shrink-0 items-center justify-center">
+      <span
+        className="absolute h-2.5 w-2.5 rounded-full bg-success/40 motion-reduce:hidden"
+        style={{ animation: "live-ring 1.6s ease-out infinite" }}
+      />
+      <span className="relative h-1.5 w-1.5 rounded-full bg-success" />
+    </span>
+  );
+}

src/components/ProjectRow.tsx

@@ -0,0 +1,121 @@
+import { useState } from "react";
+import { useNavigate } from "react-router-dom";
+import type { ProjectCard } from "@/shared/types";
+import { formatRelativeTime, formatStars, totalFindings } from "../shared/lib/format";
+import { SeverityBar } from "./SeverityBar";
+import { StatusBadge } from "./StatusBadge";
+
+function OwnerAvatar({ owner, compact = false }: { owner: string; compact?: boolean }) {
+  const [failed, setFailed] = useState(false);
+  const sizeClass = compact ? "h-7 w-7" : "h-8 w-8";
+  if (failed) {
+    return (
+      <div
+        className={`flex shrink-0 items-center justify-center rounded-full bg-white/[0.06] font-semibold text-ink-secondary ${sizeClass} ${compact ? "text-[10px]" : "text-xs"}`}
+        aria-hidden
+      >
+        {owner.slice(0, 1).toUpperCase()}
+      </div>
+    );
+  }
+  return (
+    <img
+      src={`https://github.com/${owner}.png?size=64`}
+      alt=""
+      width={32}
+      height={32}
+      className={`${sizeClass} shrink-0 rounded-full border border-line bg-surface-sunken`}
+      onError={() => setFailed(true)}
+    />
+  );
+}
+
+export function ProjectRow({ project, compact = false }: { project: ProjectCard; compact?: boolean }) {
+  const nav = useNavigate();
+  const state = project.latest_scan?.state;
+  const scanning = state === "scanning" || state === "dispatching";
+  const waiting = state !== "completed" && !scanning;
+  const soFar = project.latest_scan?.findings_so_far ?? 0;
+  const findings = totalFindings(project.severity_counts);
+
+  return (
+    <div
+      role="link"
+      tabIndex={0}
+      onClick={() => nav(`/p/${project.owner_login}/${project.name}`)}
+      onKeyDown={(e) => {
+        if (e.key === "Enter") nav(`/p/${project.owner_login}/${project.name}`);
+      }}
+      className={`group block cursor-pointer overflow-hidden border-b border-line px-1 transition-colors hover:bg-white/[0.025] focus-ring rounded-sm ${
+        compact ? "h-[104px] py-3" : "py-4"
+      }`}
+    >
+      <div className={`flex items-start ${compact ? "gap-2.5" : "gap-3"}`}>
+        <OwnerAvatar owner={project.owner_login} compact={compact} />
+        <div className="min-w-0 flex-1">
+          <div className="flex items-start justify-between gap-4">
+            <div className="min-w-0 flex-1">
+              <div className="flex flex-wrap items-center gap-x-2 gap-y-1">
+                <span className={`truncate font-medium text-ink ${compact ? "text-[12px]" : "text-sm"}`}>
+                  {project.full_name}
+                </span>
+              </div>
+              {project.description && (
+                <p className={`mt-0.5 line-clamp-1 text-ink-secondary ${compact ? "text-[11px] leading-4" : "text-[13px]"}`}>
+                  {project.description}
+                </p>
+              )}
+              <div className={`flex flex-wrap items-center gap-x-2 gap-y-1 text-ink-tertiary ${compact ? "mt-1 text-[10px]" : "mt-1.5 text-[13px]"}`}>
+                {project.language && (
+                  <span className="inline-flex items-center gap-1">
+                    <span className="h-1.5 w-1.5 rounded-full bg-accent-600/70" />
+                    {project.language}
+                  </span>
+                )}
+                <span>·</span>
+                <span>★ {formatStars(project.stars)}</span>
+                {project.latest_scan?.finished_at && (
+                  <>
+                    <span>·</span>
+                    <span>scanned {formatRelativeTime(project.latest_scan.finished_at)}</span>
+                  </>
+                )}
+                {!waiting && findings > 0 && (
+                  <>
+                    <span>·</span>
+                    <span className="font-mono">{findings} findings</span>
+                  </>
+                )}
+              </div>
+              <div className={compact ? "mt-1.5" : "mt-2.5"}>
+                {scanning ? (
+                  <span className={`${compact ? "text-[10px]" : "text-[13px]"} font-medium text-running-ink`}>
+                    {soFar > 0 ? `Scanning · ${soFar} findings so far` : "Scanning…"}
+                  </span>
+                ) : waiting ? (
+                  <span className={`${compact ? "text-[10px]" : "text-[13px]"} text-ink-tertiary`}>In scan queue</span>
+                ) : compact && findings === 0 ? (
+                  <span className="text-[10px] text-ink-tertiary">No findings</span>
+                ) : (
+                  <SeverityBar
+                    counts={project.severity_counts}
+                    showLegend
+                    widthClass={compact ? "w-32" : "w-40"}
+                    heightClass={compact ? "h-1" : "h-1.5"}
+                    legendClass={compact ? "text-[9px]" : "text-[11px]"}
+                  />
+                )}
+              </div>
+            </div>
+            {/* completed 的扫描时间已在 meta 行，右侧 badge 只留给需要注意的状态（去重，fish v1.11） */}
+            {state !== "completed" && (
+              <div className={`shrink-0 pt-0.5 ${compact ? "scale-90 origin-top-right" : ""}`}>
+                <StatusBadge state={state} finishedAt={project.latest_scan?.finished_at} />
+              </div>
+            )}
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}

src/components/RepoSubmitForm.tsx

@@ -0,0 +1,230 @@
+import { useState } from "react";
+import { useNavigate } from "react-router-dom";
+import { ArrowUp, CircleAlert, Github, LoaderCircle } from "lucide-react";
+import { ApiError, api, navigateToLogin } from "../shared/api/client";
+import { useMe } from "../features/auth/useAuth";
+import { Button } from "./Button";
+
+function mapError(err: unknown): string {
+  if (!(err instanceof ApiError)) {
+    return "Something went wrong. Please try again.";
+  }
+  const reason = String(err.context?.reason ?? "");
+  const message = String(err.context?.message ?? "");
+  if (err.status === 401) {
+    return "Please sign in with GitHub to submit a repository.";
+  }
+  if (err.status === 403) {
+    return (
+      message ||
+      "Only accounts with admin or maintain permission on this repository can submit it."
+    );
+  }
+  if (reason === "ref_not_found" || reason === "invalid_ref") {
+    return "That branch/tag/commit was not found in this repository.";
+  }
+  if (reason === "invalid_github_url") {
+    return "That doesn't look like a GitHub repository URL. Expected: https://github.com/owner/repo";
+  }
+  if (reason === "private_repo") {
+    return "This repository is private or does not exist. OpenVuln scans public projects only.";
+  }
+  if (reason === "cooldown") {
+    const days = err.context?.retry_after_days;
+    return `This project was scanned recently. You can resubmit after ${days ?? "a few"} day(s).`;
+  }
+  if (reason === "duplicate" || err.status === 409) {
+    return message || "This project is already on OpenVuln.";
+  }
+  if (err.status === 404) {
+    return "This repository is private or does not exist. OpenVuln scans public projects only.";
+  }
+  if (err.status >= 500) {
+    return "OpenVuln is temporarily unavailable. Please try again in a moment.";
+  }
+  return message || err.message || "Submission failed.";
+}
+
+export function RepoSubmitForm({
+  size = "default",
+  appearance = "default",
+  className = "",
+}: {
+  size?: "default" | "hero";
+  appearance?: "default" | "dark";
+  className?: string;
+}) {
+  const nav = useNavigate();
+  const meQ = useMe();
+  const [url, setUrl] = useState("");
+  const [ref, setRef] = useState("");
+  const [showRef, setShowRef] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState(false);
+
+  const hero = size === "hero";
+  const dark = appearance === "dark";
+
+  const onSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    setError(null);
+    const git_url = url.trim();
+    if (!git_url) {
+      setError("Please paste a GitHub repository URL.");
+      return;
+    }
+    // 未登录 → 整页跳 GitHub OAuth，登录后回到部署首页
+    if (meQ.data && !meQ.data.authenticated) {
+      navigateToLogin();
+      window.dispatchEvent(new Event("ov-oauth-popup-opened"));
+      return;
+    }
+    setPending(true);
+    try {
+      const res = await api.submitProject({ git_url, ...(ref.trim() ? { ref: ref.trim() } : {}) });
+      nav(`/p/${res.project.owner_login}/${res.project.name}`, {
+        state: { justSubmitted: true },
+      });
+    } catch (err) {
+      setError(mapError(err));
+    } finally {
+      setPending(false);
+    }
+  };
+
+  if (dark) {
+    return (
+      <form
+        onSubmit={(e) => void onSubmit(e)}
+        className={className}
+        aria-label="Submit a GitHub repository"
+        aria-busy={pending}
+      >
+        <div
+          className={`openvuln-composer group flex min-h-[62px] items-center gap-3 rounded-[18px] border bg-[#141519] p-2 pl-5 shadow-[0_18px_60px_rgba(0,0,0,0.32)] transition focus-within:bg-[#17181d] focus-within:shadow-[0_22px_70px_rgba(68,70,88,0.16)] ${
+            error ? "border-[#a94d55]" : "border-[#35363c] focus-within:border-[#5b5e6a]"
+          }`}
+        >
+          <Github
+            size={20}
+            className="shrink-0 text-[#6d6f78] transition group-focus-within:text-[#acacb0]"
+          />
+          <input
+            type="url"
+            value={url}
+            onChange={(e) => {
+              setUrl(e.target.value);
+              setError(null);
+            }}
+            placeholder="Paste a public GitHub repository URL"
+            spellCheck={false}
+            className="min-w-0 flex-1 bg-transparent py-3 text-[14px] text-[#f0f2f6] outline-none placeholder:text-[#696a70] sm:text-[15px]"
+            aria-label="GitHub repository URL"
+            aria-invalid={!!error}
+          />
+          <button
+            type="submit"
+            aria-label={pending ? "Submitting repository" : "Analyze repository"}
+            className="flex h-11 w-11 shrink-0 items-center justify-center rounded-[14px] border border-[#0d0d0f] bg-[#ebecf0] text-[#0d0d0f] shadow-sm transition hover:scale-[1.03] hover:bg-white active:scale-95 focus-ring-dark disabled:cursor-not-allowed disabled:bg-[#484a58] disabled:text-[#989aa5] disabled:opacity-100"
+            disabled={!url.trim() || pending}
+          >
+            {pending ? (
+              <LoaderCircle size={20} className="animate-spin motion-reduce:animate-none" />
+            ) : (
+              <ArrowUp size={21} strokeWidth={2.2} />
+            )}
+          </button>
+        </div>
+
+        <div className="mt-2.5 flex justify-center">
+          {showRef ? (
+            <input
+              type="text"
+              value={ref}
+              onChange={(e) => setRef(e.target.value)}
+              placeholder="Branch, tag, or commit SHA (optional)"
+              spellCheck={false}
+              className="h-8 w-72 rounded-full border border-[#333] bg-[#030303] px-3.5 font-mono text-xs text-[#f0f2f6] outline-none placeholder:text-[#696a70] focus:border-[#484a58]"
+              aria-label="Version to scan (branch, tag, or commit SHA)"
+            />
+          ) : (
+            <button
+              type="button"
+              onClick={() => setShowRef(true)}
+              className="text-[11px] text-[#696a70] underline decoration-[#333] underline-offset-2 transition hover:text-[#acacb0]"
+            >
+              Scan a specific version
+            </button>
+          )}
+        </div>
+
+        <div className="mt-3 flex min-h-5 items-start justify-center gap-1.5 text-center text-xs text-[#77787e]">
+          {error ? (
+            <span className="inline-flex items-start gap-1.5 text-[#ff9ca5]" role="alert">
+              <CircleAlert size={14} className="mt-px shrink-0" />
+              <span>{error}</span>
+            </span>
+          ) : pending ? (
+            <span className="text-[#b9bfd2]" role="status">Submitting repository…</span>
+          ) : (
+            <span className="inline-flex items-center gap-1.5">
+              <CircleAlert size={13} strokeWidth={1.8} className="shrink-0" aria-hidden />
+              <span>Public repositories · Repository maintainers only</span>
+            </span>
+          )}
+        </div>
+      </form>
+    );
+  }
+
+  return (
+    <form onSubmit={(e) => void onSubmit(e)} className={className}>
+      <div className="flex flex-col gap-2 sm:flex-row">
+        <input
+          type="text"
+          value={url}
+          onChange={(e) => setUrl(e.target.value)}
+          placeholder="https://github.com/owner/repo"
+          spellCheck={false}
+          className={`h-12 flex-1 rounded-lg border bg-surface-raised px-3.5 font-mono text-sm text-ink placeholder:text-ink-tertiary focus-ring ${
+            error ? "border-danger" : "border-line"
+          }`}
+          aria-invalid={!!error}
+        />
+        <Button type="submit" size="lg" disabled={pending} className="rounded-lg shrink-0">
+          {pending ? "Submitting…" : "Submit"}
+        </Button>
+      </div>
+      <div className="mt-2">
+        {showRef ? (
+          <input
+            type="text"
+            value={ref}
+            onChange={(e) => setRef(e.target.value)}
+            placeholder="Branch, tag, or commit SHA (optional — default: default branch HEAD)"
+            spellCheck={false}
+            className="h-9 w-full rounded-md border border-line bg-surface-raised px-3 font-mono text-xs text-ink placeholder:text-ink-tertiary focus-ring"
+            aria-label="Version to scan (branch, tag, or commit SHA)"
+          />
+        ) : (
+          <button
+            type="button"
+            onClick={() => setShowRef(true)}
+            className="text-[12px] text-ink-tertiary underline decoration-line underline-offset-2 transition-colors hover:text-ink-secondary"
+          >
+            Scan a specific version
+          </button>
+        )}
+      </div>
+      {error && (
+        <p
+          className={`mt-2 flex items-start gap-1.5 text-sm text-danger ${hero ? "justify-center text-left" : ""}`}
+          role="alert"
+        >
+          <CircleAlert size={16} className="mt-0.5 shrink-0" />
+          <span>{error}</span>
+        </p>
+      )}
+    </form>
+  );
+}

src/components/ReportBody.tsx

@@ -0,0 +1,300 @@
+/**
+ * Structured HTML render of a disclosed VH/VulnForge report
+ * (parsed report object preferred; raw yaml fallback).
+ */
+import { useMemo } from "react";
+import { load as parseYaml } from "js-yaml";
+
+type Anchor = { file_path?: string; line?: number | string; function?: string };
+type FlowStep = { step?: number | string; location?: string; description?: string };
+type ReportDoc = {
+  metadata?: {
+    title?: string;
+    vuln_type?: string;
+    cwe?: string;
+    cvss_vector?: string;
+    cvss_score?: number | string;
+    ev_priority?: string;
+    ev_score?: number | string;
+    ev_rationale?: string;
+    poc_status?: string;
+    exp_status?: string;
+    affected_versions?: string;
+    anchors?: Anchor[];
+  };
+  description?: {
+    background?: string;
+    detailed_description?: string;
+    summary?: string;
+    attack_payload_description?: string;
+    attack_description?: string;
+    impact?: string;
+    combined_impact?: string;
+    remediation?: string;
+    fix_suggestion?: string;
+  };
+  code?: {
+    dataflow?: FlowStep[];
+    data_flow?: FlowStep[];
+    fix_patch?: string;
+    patch?: string;
+  };
+  references?: unknown;
+};
+
+function asRecord(v: unknown): Record<string, unknown> {
+  if (v && typeof v === "object" && !Array.isArray(v)) return v as Record<string, unknown>;
+  return {};
+}
+
+function str(v: unknown): string {
+  if (v == null) return "";
+  if (typeof v === "string") return v.trim();
+  if (typeof v === "number" || typeof v === "boolean") return String(v);
+  return "";
+}
+
+function Section({ label, children }: { label: string; children: React.ReactNode }) {
+  if (!children) return null;
+  return (
+    <section>
+      <p className="flex items-center gap-1.5 font-mono text-[11px] uppercase tracking-wider text-ink-tertiary">
+        <span className="h-3 w-[3px] rounded-full bg-accent-600" aria-hidden />
+        {label}
+      </p>
+      <div className="mt-1.5">{children}</div>
+    </section>
+  );
+}
+
+function Prose({ text }: { text: string }) {
+  if (!text) return null;
+  return (
+    <p className="whitespace-pre-wrap break-words text-sm leading-relaxed text-ink-secondary">
+      {text}
+    </p>
+  );
+}
+
+function normalizeDoc(input: unknown): ReportDoc | null {
+  if (!input || typeof input !== "object") return null;
+  const r = input as Record<string, unknown>;
+  return {
+    metadata: asRecord(r.metadata) as ReportDoc["metadata"],
+    description: asRecord(r.description) as ReportDoc["description"],
+    code: asRecord(r.code) as ReportDoc["code"],
+    references: r.references,
+  };
+}
+
+export type StructuredReport = {
+  metadata: Record<string, unknown>;
+  description: Record<string, unknown>;
+  code: Record<string, unknown>;
+  references: unknown;
+};
+
+/** Prefer structured `report`; raw yaml only as fallback. */
+export function ReportBody({
+  report,
+  yaml,
+}: {
+  report?: StructuredReport | null;
+  yaml?: string | null;
+}) {
+  const doc = useMemo<ReportDoc | null>(() => {
+    if (report) return normalizeDoc(report);
+    if (yaml?.trim()) {
+      try {
+        return normalizeDoc(parseYaml(yaml));
+      } catch {
+        return null;
+      }
+    }
+    return null;
+  }, [report, yaml]);
+
+  if (!doc) {
+    if (yaml?.trim()) {
+      return (
+        <pre className="mt-4 max-h-[32rem] overflow-auto whitespace-pre-wrap break-words rounded-md border border-line bg-surface px-4 py-3 font-mono text-[12px] leading-relaxed text-ink">
+          {yaml}
+        </pre>
+      );
+    }
+    return (
+      <p className="mt-4 text-sm text-ink-tertiary">
+        Structured report is not available for this disclosure.
+      </p>
+    );
+  }
+
+  const meta = doc.metadata ?? {};
+  const fullTitle = typeof meta === "object" && "title" in meta ? (meta as { title?: string }).title : undefined;
+  const desc = doc.description ?? {};
+  const anchors = (meta.anchors ?? []).filter((a) => a && (a.file_path || a.function));
+  const dataflow = (doc.code?.dataflow ?? doc.code?.data_flow ?? []).filter(Boolean);
+  const refList = Array.isArray(doc.references)
+    ? doc.references.filter((r) => typeof r === "string" && (r as string).trim())
+    : [];
+
+  return (
+    <div className="mt-4 space-y-5">
+      {fullTitle && (
+        <h4 className="font-display text-[15px] font-semibold leading-snug text-ink">{fullTitle}</h4>
+      )}
+      <dl className="grid grid-cols-2 gap-x-6 gap-y-2 text-[13px] sm:grid-cols-4">
+        {meta.vuln_type && (
+          <div>
+            <dt className="text-ink-tertiary">Type</dt>
+            <dd className="mt-0.5 font-medium text-ink">{meta.vuln_type}</dd>
+          </div>
+        )}
+        {meta.cvss_score != null && (
+          <div>
+            <dt className="text-ink-tertiary">CVSS</dt>
+            <dd className="mt-0.5 font-medium text-ink">{meta.cvss_score}</dd>
+          </div>
+        )}
+        {meta.ev_priority && (
+          <div>
+            <dt className="text-ink-tertiary">EV priority</dt>
+            <dd className="mt-0.5 font-medium text-ink">{meta.ev_priority}</dd>
+          </div>
+        )}
+        {meta.poc_status && (
+          <div>
+            <dt className="text-ink-tertiary">PoC status</dt>
+            <dd className="mt-0.5 font-medium text-ink">{meta.poc_status}</dd>
+          </div>
+        )}
+        {meta.exp_status && (
+          <div>
+            <dt className="text-ink-tertiary">EXP status</dt>
+            <dd className="mt-0.5 font-medium text-ink">{meta.exp_status}</dd>
+          </div>
+        )}
+        {meta.affected_versions && (
+          <div className="col-span-2 sm:col-span-2">
+            <dt className="text-ink-tertiary">Affected</dt>
+            <dd className="mt-0.5 font-medium text-ink">{meta.affected_versions}</dd>
+          </div>
+        )}
+        {meta.cvss_vector && (
+          <div className="col-span-2 sm:col-span-4">
+            <dt className="text-ink-tertiary">Vector</dt>
+            <dd className="mt-0.5 font-mono text-[12px] text-ink-secondary">{meta.cvss_vector}</dd>
+          </div>
+        )}
+      </dl>
+
+      {str(meta.ev_rationale) && (
+        <Section label="Exploitability">
+          <Prose text={str(meta.ev_rationale)} />
+        </Section>
+      )}
+
+      {anchors.length > 0 && (
+        <Section label="Anchors">
+          <ul className="space-y-1.5">
+            {anchors.map((a, i) => (
+              <li key={i} className="flex flex-wrap items-baseline gap-x-2.5 text-[13px]">
+                <span className="shrink-0 font-mono font-medium text-ink">
+                  {a.file_path}
+                  {a.line != null && `:${a.line}`}
+                </span>
+                {a.function && <span className="text-ink-secondary">{a.function}</span>}
+              </li>
+            ))}
+          </ul>
+        </Section>
+      )}
+
+      {str(desc.background) && (
+        <Section label="Background">
+          <Prose text={str(desc.background)} />
+        </Section>
+      )}
+      {(str(desc.detailed_description) || str(desc.summary)) && (
+        <Section label="Detailed analysis">
+          <Prose text={str(desc.detailed_description) || str(desc.summary)} />
+        </Section>
+      )}
+      {(str(desc.attack_payload_description) || str(desc.attack_description)) && (
+        <Section label="Attack">
+          {str(desc.attack_description) && <Prose text={str(desc.attack_description)} />}
+          {str(desc.attack_payload_description) && (
+            <Prose text={str(desc.attack_payload_description)} />
+          )}
+        </Section>
+      )}
+      {(str(desc.impact) || str(desc.combined_impact)) && (
+        <Section label="Impact">
+          <Prose text={str(desc.impact) || str(desc.combined_impact)} />
+        </Section>
+      )}
+      {(str(desc.remediation) || str(desc.fix_suggestion)) && (
+        <Section label="Remediation">
+          <Prose text={str(desc.remediation) || str(desc.fix_suggestion)} />
+        </Section>
+      )}
+
+      {dataflow.length > 0 && (
+        <Section label="Dataflow">
+          <ol className="space-y-2.5">
+            {dataflow.map((st, i) => (
+              <li key={i} className="flex gap-3 text-[13px]">
+                <span className="flex h-5 w-5 shrink-0 items-center justify-center rounded-full bg-surface-sunken font-mono text-[11px] text-ink-secondary">
+                  {st.step ?? i + 1}
+                </span>
+                <div className="min-w-0">
+                  {st.location && (
+                    <p className="font-mono text-[12px] font-medium text-ink">{st.location}</p>
+                  )}
+                  {st.description && (
+                    <p className="mt-0.5 whitespace-pre-wrap break-words leading-relaxed text-ink-secondary">
+                      {st.description}
+                    </p>
+                  )}
+                </div>
+              </li>
+            ))}
+          </ol>
+        </Section>
+      )}
+
+      {(str(doc.code?.fix_patch) || str(doc.code?.patch)) && (
+        <Section label="Fix patch">
+          <pre className="overflow-x-auto whitespace-pre-wrap break-words rounded-md border border-line bg-surface-sunken px-4 py-3 font-mono text-[12px] leading-relaxed text-ink">
+            {str(doc.code?.fix_patch) || str(doc.code?.patch)}
+          </pre>
+        </Section>
+      )}
+
+      {refList.length > 0 && (
+        <Section label="References">
+          <ul className="space-y-1 text-[13px]">
+            {(refList as string[]).map((r, i) =>
+              /^https?:\/\//.test(r) ? (
+                <li key={i}>
+                  <a
+                    href={r}
+                    target="_blank"
+                    rel="noreferrer"
+                    className="break-all font-mono text-[12px] text-accent-600 hover:underline"
+                  >
+                    {r}
+                  </a>
+                </li>
+              ) : (
+                <li key={i} className="text-ink-secondary">
+                  {r}
+                </li>
+              ),
+            )}
+          </ul>
+        </Section>
+      )}
+    </div>
+  );
+}

src/components/ScanDurationNotice.tsx

@@ -0,0 +1,14 @@
+import { Clock3 } from "lucide-react";
+
+/** 扫描时长提示：小 note 样式（fish No.916）—— 时钟小图标 + 一行小字，无卡片无边框。 */
+export function ScanDurationNotice({ className = "" }: { className?: string }) {
+  return (
+    <p
+      className={`flex items-center justify-center gap-1.5 text-xs text-[#77787e] ${className}`}
+      role="note"
+    >
+      <Clock3 size={13} strokeWidth={1.8} className="shrink-0" />
+      <span>A full scan usually takes 12+ hours.</span>
+    </p>
+  );
+}

src/components/SeverityBar.tsx

@@ -0,0 +1,69 @@
+import type { Severity, SeverityCounts } from "@/shared/types";
+import { SEV_ORDER, severityLabel, totalFindings } from "../shared/lib/format";
+
+/** NVD four tiers — Critical uses R4 #C22828. */
+const BAR: Record<Severity, string> = {
+  critical: "#C22828",
+  high: "#F24F4F",
+  medium: "#FF733C",
+  low: "#F7C530",
+};
+
+const DOT: Record<Severity, string> = {
+  critical: "bg-[#C22828]",
+  high: "bg-[#F24F4F]",
+  medium: "bg-sev-medium-bar",
+  low: "bg-sev-low-bar",
+};
+
+export function SeverityBar({
+  counts,
+  widthClass = "w-40",
+  heightClass = "h-1.5",
+  showLegend = true,
+  legendClass = "text-[12px]",
+}: {
+  counts: SeverityCounts;
+  widthClass?: string;
+  heightClass?: string;
+  showLegend?: boolean;
+  legendClass?: string;
+}) {
+  const total = totalFindings(counts);
+  const segs = SEV_ORDER.filter((s) => (counts[s] ?? 0) > 0).map((s) => ({
+    level: s,
+    pct: total === 0 ? 0 : (counts[s] / total) * 100,
+    count: counts[s],
+  }));
+
+  return (
+    <div className="flex flex-col gap-1.5">
+      <div
+        className={`flex ${heightClass} ${widthClass} overflow-hidden rounded-full bg-surface-sunken`}
+        role="img"
+        aria-label={`Severity distribution, ${total} findings`}
+      >
+        {segs.map((s) => (
+          <div
+            key={s.level}
+            className="h-full"
+            style={{ width: `${s.pct}%`, backgroundColor: BAR[s.level] }}
+            title={`${severityLabel(s.level)}: ${s.count}`}
+          />
+        ))}
+      </div>
+      {showLegend && (
+        <div
+          className={`flex flex-wrap items-center gap-x-3 gap-y-1 font-mono text-ink-secondary ${legendClass}`}
+        >
+          {SEV_ORDER.map((s) => (
+            <span key={s} className="inline-flex items-center gap-1">
+              <span className={`inline-block h-1.5 w-1.5 rounded-full ${DOT[s]}`} />
+              {counts[s] ?? 0} {severityLabel(s)}
+            </span>
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}

src/components/SeverityChip.tsx

@@ -0,0 +1,30 @@
+import { CircleAlert, OctagonAlert, Siren, TriangleAlert } from "lucide-react";
+import type { Severity } from "@/shared/types";
+import { severityLabel } from "../shared/lib/format";
+
+const icon = {
+  critical: Siren,
+  high: OctagonAlert,
+  medium: TriangleAlert,
+  low: CircleAlert,
+} as const;
+
+const cls = {
+  critical: "bg-sev-critical-bg text-sev-critical-ink",
+  high: "bg-sev-high-bg text-sev-high-ink",
+  medium: "bg-sev-medium-bg text-sev-medium-ink",
+  low: "bg-sev-low-bg text-sev-low-ink",
+} as const;
+
+export function SeverityChip({ severity }: { severity: Severity }) {
+  const Icon = icon[severity] ?? CircleAlert;
+  const style = cls[severity] ?? cls.low;
+  return (
+    <span
+      className={`inline-flex items-center gap-1 rounded-full px-2 py-0.5 text-xs font-medium ${style}`}
+    >
+      <Icon size={12} strokeWidth={2} />
+      {severityLabel(severity)}
+    </span>
+  );
+}

src/components/StatusBadge.tsx

@@ -0,0 +1,46 @@
+import { CheckCircle2, Clock, Loader2 } from "lucide-react";
+import type { ScanJobState } from "@/shared/types";
+import { formatRelativeTime } from "../shared/lib/format";
+
+export function StatusBadge({
+  state,
+  finishedAt,
+}: {
+  state: ScanJobState | null | undefined;
+  finishedAt?: string | null;
+}) {
+  if (state === "completed") {
+    return (
+      <span className="inline-flex items-center gap-1 rounded-full bg-success-bg px-2 py-0.5 text-xs font-medium text-success-ink">
+        <CheckCircle2 size={12} />
+        {finishedAt ? `Scanned ${formatRelativeTime(finishedAt)}` : "Completed"}
+      </span>
+    );
+  }
+  if (state === "scanning" || state === "dispatching") {
+    return (
+      <span className="inline-flex items-center gap-1.5 rounded-full bg-running-bg px-2 py-0.5 text-xs font-medium text-running-ink">
+        <span className="relative flex h-1.5 w-1.5">
+          <span className="absolute inline-flex h-full w-full animate-ping rounded-full bg-running opacity-60 motion-reduce:animate-none" />
+          <span className="relative inline-flex h-1.5 w-1.5 rounded-full bg-running" />
+        </span>
+        Scanning
+      </span>
+    );
+  }
+  // queued / failed / null → Waiting（fish No.491：scanning 独立展示，failed 仍归 waiting）
+  return (
+    <span className="inline-flex items-center gap-1.5 rounded-full bg-surface-sunken px-2 py-0.5 text-xs font-medium text-ink-secondary">
+      <Clock size={12} /> Waiting to be scanned
+    </span>
+  );
+}
+
+export function ScanningSpinner({ label = "Loading…" }: { label?: string }) {
+  return (
+    <div className="flex items-center gap-2 text-sm text-ink-secondary" role="status">
+      <Loader2 size={16} className="animate-spin text-accent-600" />
+      {label}
+    </div>
+  );
+}

src/features/about/AboutPage.tsx

@@ -0,0 +1,34 @@
+import { Link } from "react-router-dom";
+import { ArrowLeft } from "lucide-react";
+
+export function AboutPage() {
+  return (
+    <div className="mx-auto max-w-6xl px-6 py-8">
+      <Link
+        to="/"
+        className="inline-flex items-center gap-1.5 text-[13px] text-ink-secondary hover:text-ink"
+      >
+        <ArrowLeft size={14} /> Projects
+      </Link>
+      <h1 className="mt-4 font-display text-xl font-bold text-ink">About OpenVuln</h1>
+      <div className="mt-4 max-w-prose space-y-4 text-sm leading-relaxed text-ink-secondary">
+        <p>
+          OpenVuln is a public vulnerability intelligence platform for open-source software.
+          Repository maintainers sign in with GitHub to submit their own projects for scanning by
+          the <strong className="font-medium text-ink">VulnHunter</strong> AI engine — only
+          accounts with admin or maintain permission on a repository can submit it.
+        </p>
+        <p>
+          Aggregate statistics — severity distribution, CWE categories, scan status — are public.
+          Detailed findings (titles, paths, code) are visible only to the repository's signed-in
+          maintainers, who choose what to disclose. Disclosed findings become fully public, like a
+          GitHub Security Advisory.
+        </p>
+        <p>
+          OpenVuln is a lightweight front door to VulnHunter: the heavy analysis runs on a dedicated
+          VulnHunter instance; this site focuses on disclosure and discovery.
+        </p>
+      </div>
+    </div>
+  );
+}

src/features/auth/PopupCallbackPage.tsx

@@ -0,0 +1,79 @@
+import { useEffect, useState } from "react";
+import { CircleCheck, Loader2 } from "lucide-react";
+import { apiUrl, type MeResponse } from "../../shared/api/client";
+
+/**
+ * Popup OAuth completion page: after GitHub redirect, this page runs in the
+ * popup window (top-level, not iframe). It fetches /api/me from the API origin
+ * (cookie works here since it's a top-level request), then postMessages the
+ * result to the opener (iframe on huggingface.co where third-party cookies
+ * are blocked).
+ */
+export function PopupCallbackPage() {
+  const [status, setStatus] = useState<"loading" | "done" | "error">("loading");
+
+  useEffect(() => {
+    let closed = false;
+
+    async function complete() {
+      try {
+        // This is a top-level window request — SameSite=None cookie IS sent
+        const res = await fetch(apiUrl("/api/me"), { credentials: "include" });
+        const data: MeResponse = await res.json();
+
+        if (!closed && window.opener) {
+          window.opener.postMessage(
+            { type: "ov-oauth-complete", user: data },
+            "*",
+          );
+        }
+        setStatus("done");
+      } catch {
+        setStatus("error");
+        // Still signal opener to try polling as fallback
+        if (!closed && window.opener) {
+          window.opener.postMessage({ type: "ov-oauth-complete" }, "*");
+        }
+      }
+
+      // Auto-close after showing success
+      window.setTimeout(() => {
+        if (!closed) {
+          try { window.close(); } catch { /* noop */ }
+        }
+      }, 2000);
+    }
+
+    complete();
+    return () => { closed = true; };
+  }, []);
+
+  if (status === "loading") {
+    return (
+      <div className="flex min-h-screen flex-col items-center justify-center bg-surface px-8 text-center">
+        <Loader2 size={40} className="animate-spin text-accent-600" strokeWidth={1.6} />
+        <p className="mt-4 text-sm text-ink-secondary">Completing sign-in…</p>
+      </div>
+    );
+  }
+
+  if (status === "error") {
+    return (
+      <div className="flex min-h-screen flex-col items-center justify-center bg-surface px-8 text-center">
+        <p className="text-sm text-ink-secondary">
+          Sign-in may not have completed. You can close this tab.
+        </p>
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex min-h-screen flex-col items-center justify-center bg-surface px-8 text-center">
+      <CircleCheck size={44} className="text-success" strokeWidth={1.6} />
+      <h1 className="mt-4 font-display text-xl font-semibold text-ink">Sign-in complete</h1>
+      <p className="mt-2 text-sm text-ink-secondary">
+        You can close this tab and return to OpenVuln.
+      </p>
+    </div>
+  );
+}

src/features/auth/useAuth.ts

@@ -0,0 +1,70 @@
+import { useEffect } from "react";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { api, type MeResponse } from "../../shared/api/client";
+
+/** 当前登录态。未配置后端的旧部署会 404 → 按未登录降级。 */
+export function useMe() {
+  const qc = useQueryClient();
+  const q = useQuery({
+    queryKey: ["me"],
+    queryFn: api.me,
+    staleTime: 60_000,
+    retry: false,
+  });
+
+  // Listen for popup OAuth completion signal — popup sends user data directly
+  useEffect(() => {
+    const handler = (e: MessageEvent) => {
+      if (e.data?.type === "ov-oauth-complete" && e.data.user) {
+        // Popup fetched /api/me in top-level context (cookie works there)
+        qc.setQueryData(["me"], e.data.user as MeResponse);
+        qc.invalidateQueries({ queryKey: ["owner-findings"] });
+      } else if (e.data?.type === "ov-oauth-complete") {
+        // Fallback: no user data, try refetch
+        qc.invalidateQueries({ queryKey: ["me"] });
+      }
+    };
+    window.addEventListener("message", handler);
+    return () => window.removeEventListener("message", handler);
+  }, [qc]);
+
+  // When popup is open, poll /api/me every 1.5s for up to 2 min
+  useEffect(() => {
+    let interval: ReturnType<typeof setInterval> | null = null;
+    let timeout: ReturnType<typeof setTimeout> | null = null;
+    const startPolling = () => {
+      if (interval) return;
+      interval = setInterval(() => {
+        qc.invalidateQueries({ queryKey: ["me"] });
+      }, 1500);
+      timeout = setTimeout(() => {
+        if (interval) clearInterval(interval);
+        interval = null;
+      }, 120_000);
+    };
+    const onFocus = () => qc.invalidateQueries({ queryKey: ["me"] });
+    window.addEventListener("focus", onFocus);
+    window.addEventListener("ov-oauth-popup-opened", startPolling);
+    return () => {
+      window.removeEventListener("focus", onFocus);
+      window.removeEventListener("ov-oauth-popup-opened", startPolling);
+      if (interval) clearInterval(interval);
+      if (timeout) clearTimeout(timeout);
+    };
+  }, [qc]);
+
+  return q;
+}
+
+export function useLogout() {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: api.logout,
+    onSettled: () => {
+      const anon: MeResponse = { authenticated: false, user: null };
+      qc.setQueryData(["me"], anon);
+      // owner 视图数据全部作废
+      qc.invalidateQueries({ queryKey: ["owner-findings"] });
+    },
+  });
+}

src/features/home/ProductHomePage.tsx

@@ -0,0 +1,459 @@
+import { useEffect, useMemo, useRef, useState } from "react";
+import { Link } from "react-router-dom";
+import { useInfiniteQuery, useQuery } from "@tanstack/react-query";
+import {
+  Activity,
+  ArrowRight,
+  CheckCircle2,
+  ChevronDown,
+  ChevronUp,
+  Clock3,
+  Github,
+  Radar,
+  Search,
+  Shield,
+} from "lucide-react";
+import type { LiveScanItem } from "@/shared/types";
+import { api } from "../../shared/api/client";
+import { Button } from "../../components/Button";
+import { EmptyState } from "../../components/EmptyState";
+import { ProjectRow } from "../../components/ProjectRow";
+import { RepoSubmitForm } from "../../components/RepoSubmitForm";
+import { HeroStats } from "../../components/HeroStats";
+import { ScanDurationNotice } from "../../components/ScanDurationNotice";
+import { AuthButton } from "../../components/AuthButton";
+import { NotificationBell } from "../../components/NotificationBell";
+
+const OWN_REPO =
+  (import.meta.env.VITE_GITHUB_REPO_URL as string | undefined) ||
+  "https://github.com/Clouditera/OpenVuln";
+const ZAI_HF_AVATAR = "https://huggingface.co/api/avatars/zai-org";
+
+/** List state survives project-detail navigation. */
+const listCache = { sort: "stars" as "newest" | "stars", q: "" };
+
+function formatElapsed(seconds: number): string {
+  if (seconds < 60) return `${seconds}s`;
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60) return `${minutes}m`;
+  return `${Math.floor(minutes / 60)}h ${minutes % 60}m`;
+}
+
+function BrandMark({ compact = false }: { compact?: boolean }) {
+  return (
+    <div
+      className={`relative flex shrink-0 items-center justify-center overflow-hidden rounded-xl border border-white/15 bg-white font-display font-bold text-black shadow-[0_8px_24px_rgba(0,0,0,0.24)] ${
+        compact ? "h-8 w-8" : "h-9 w-9"
+      }`}
+      aria-hidden
+    >
+      <span className={compact ? "text-sm" : "text-base"}>Z</span>
+      <img
+        src={ZAI_HF_AVATAR}
+        alt=""
+        className="absolute inset-0 h-full w-full object-cover"
+        onError={(event) => {
+          event.currentTarget.style.display = "none";
+        }}
+      />
+    </div>
+  );
+}
+
+function ScanRow({ scan }: { scan: LiveScanItem }) {
+  const dispatching = scan.state === "dispatching";
+
+  return (
+    <Link
+      to={`/p/${scan.full_name}`}
+      className="group flex min-h-[72px] items-center gap-3 rounded-2xl border border-white/[0.07] bg-black/20 p-3.5 transition hover:border-white/[0.14] hover:bg-white/[0.045] focus-ring-dark"
+    >
+      <div className="relative flex h-10 w-10 shrink-0 items-center justify-center rounded-xl border border-white/[0.1] bg-white/[0.05] text-[#b8bac2]">
+        <Radar size={18} className="motion-safe:animate-pulse" />
+        <span className="absolute -right-0.5 -top-0.5 h-2.5 w-2.5 rounded-full border-2 border-[#15161a] bg-success" />
+      </div>
+      <div className="min-w-0 flex-1">
+        <p className="truncate text-sm font-semibold text-white">
+          {scan.full_name}
+        </p>
+        <div className="mt-1 flex flex-wrap items-center gap-x-3 gap-y-1 font-mono text-[10px] text-ink-tertiary">
+          <span className="inline-flex items-center gap-1.5 text-[#b8bac2]">
+            <Activity size={10} />
+            {dispatching ? "Preparing scan" : "Scanning now"}
+          </span>
+          <span className="inline-flex items-center gap-1.5">
+            <Clock3 size={10} />
+            {formatElapsed(scan.elapsed_sec)}
+          </span>
+        </div>
+      </div>
+      <div className="shrink-0 text-right">
+        <p className="font-display text-lg font-semibold tabular-nums text-white">
+          {scan.findings_so_far}
+        </p>
+        <p className="font-mono text-[8px] uppercase tracking-[0.12em] text-ink-tertiary">
+          found
+        </p>
+      </div>
+      <ArrowRight
+        size={14}
+        className="shrink-0 text-ink-tertiary transition group-hover:translate-x-0.5 group-hover:text-white"
+      />
+    </Link>
+  );
+}
+
+function LiveScanPanel({
+  scans,
+  queued,
+  loading,
+  failed,
+}: {
+  scans: LiveScanItem[];
+  queued: number;
+  loading: boolean;
+  failed: boolean;
+}) {
+  const active = scans.length;
+
+  return (
+    <section
+      id="live-scans"
+      aria-labelledby="live-scan-title"
+      className="openvuln-panel relative min-w-0 overflow-hidden p-5 sm:p-6"
+    >
+      <div className="pointer-events-none absolute inset-x-8 top-0 h-px bg-gradient-to-r from-transparent via-white/35 to-transparent" />
+      <div className="flex items-start justify-between gap-4">
+        <div>
+          <div className="flex items-center gap-2 font-mono text-[9px] font-semibold uppercase tracking-[0.18em] text-[#a8aab1]">
+            <span className="relative flex h-2 w-2">
+              {active > 0 && (
+                <span className="absolute inline-flex h-full w-full animate-ping rounded-full bg-success opacity-50 motion-reduce:hidden" />
+              )}
+              <span
+                className={`relative inline-flex h-2 w-2 rounded-full ${active > 0 ? "bg-success" : "bg-ink-tertiary"}`}
+              />
+            </span>
+            Live scanner
+          </div>
+          <h2 id="live-scan-title" className="mt-2 font-display text-lg font-semibold tracking-tight text-white">
+            Scanning now
+          </h2>
+        </div>
+        {!loading && !failed && (
+          <div className="rounded-full border border-white/[0.08] bg-black/25 px-3 py-1.5 font-mono text-[9px] text-ink-secondary">
+            {active} active · {queued} queued
+          </div>
+        )}
+      </div>
+
+      <div className="mt-4 min-h-[130px] max-h-[228px] overflow-y-auto pr-0.5">
+        {loading ? (
+          <div className="space-y-2.5" aria-label="Loading live scans">
+            {[0, 1].map((item) => (
+              <div key={item} className="h-[72px] animate-pulse rounded-2xl bg-white/[0.04]" />
+            ))}
+          </div>
+        ) : failed ? (
+          <div className="flex min-h-[130px] items-center justify-center rounded-2xl border border-dashed border-white/[0.08] bg-black/15 px-5 text-center">
+            <div>
+              <Activity size={20} className="mx-auto text-ink-tertiary" />
+              <p className="mt-2 text-sm font-medium text-ink-secondary">Live data is unavailable</p>
+              <p className="mt-1 text-xs text-ink-tertiary">Scanner status will reconnect automatically.</p>
+            </div>
+          </div>
+        ) : scans.length > 0 ? (
+          <div className="space-y-2.5">
+            {scans.map((scan) => (
+              <ScanRow key={scan.project_id} scan={scan} />
+            ))}
+          </div>
+        ) : (
+          <div className="flex min-h-[130px] items-center justify-center rounded-2xl border border-dashed border-white/[0.08] bg-black/15 px-5 text-center">
+            <div>
+              <CheckCircle2 size={21} className="mx-auto text-success-ink" />
+              <p className="mt-2 text-sm font-medium text-white">Scanner is ready</p>
+              <p className="mt-1 text-xs leading-5 text-ink-tertiary">
+                No repository is being scanned right now{queued > 0 ? ` · ${queued} waiting` : ""}.
+              </p>
+            </div>
+          </div>
+        )}
+      </div>
+
+      <div className="mt-4 h-0.5 overflow-hidden rounded-full bg-white/[0.045]" aria-hidden>
+        <div
+          className={`h-full rounded-full bg-white/60 ${
+            active > 0 ? "live-scan-sweep w-1/3" : "w-0"
+          }`}
+        />
+      </div>
+    </section>
+  );
+}
+
+export function ProductHomePage() {
+  const [q, setQState] = useState(listCache.q);
+  const [sort, setSortState] = useState<"newest" | "stars">(listCache.sort);
+  const [repositoriesOpen, setRepositoriesOpen] = useState(false);
+  const setQ = (value: string) => {
+    listCache.q = value;
+    setQState(value);
+  };
+  const setSort = (value: "newest" | "stars") => {
+    listCache.sort = value;
+    setSortState(value);
+  };
+
+  const overview = useQuery({
+    queryKey: ["public", "overview"],
+    queryFn: api.overview,
+    refetchInterval: 15_000,
+  });
+
+  const pageSize = 20;
+  const projects = useInfiniteQuery({
+    queryKey: ["public", "projects", sort],
+    queryFn: ({ pageParam }) => api.listProjects({ sort, page: pageParam, page_size: pageSize }),
+    initialPageParam: 1,
+    getNextPageParam: (last, _pages, lastParam) =>
+      lastParam * pageSize < (last.total ?? 0) ? lastParam + 1 : undefined,
+  });
+  const allItems = useMemo(() => projects.data?.pages.flatMap((page) => page.items) ?? [], [projects.data]);
+  const sentinelRef = useRef<HTMLDivElement>(null);
+  const repositoryScrollRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    const sentinel = sentinelRef.current;
+    const scrollContainer = repositoryScrollRef.current;
+    if (!repositoriesOpen || !sentinel || !scrollContainer) return;
+    const observer = new IntersectionObserver(
+      (entries) => {
+        if (entries.some((entry) => entry.isIntersecting) && projects.hasNextPage && !projects.isFetchingNextPage) {
+          void projects.fetchNextPage();
+        }
+      },
+      { root: scrollContainer, rootMargin: "240px" },
+    );
+    observer.observe(sentinel);
+    return () => observer.disconnect();
+  }, [repositoriesOpen, projects.hasNextPage, projects.isFetchingNextPage, projects.fetchNextPage]);
+
+  const filtered = useMemo(() => {
+    const needle = q.trim().toLowerCase();
+    if (!needle) return allItems;
+    return allItems.filter(
+      (project) =>
+        project.full_name.toLowerCase().includes(needle) ||
+        (project.description ?? "").toLowerCase().includes(needle),
+    );
+  }, [allItems, q]);
+
+  const scans = overview.data?.live?.scanning ?? [];
+  const queued = overview.data?.live?.queued_count ?? 0;
+
+  return (
+    <div id="top" className="openvuln-home relative isolate min-h-screen overflow-hidden bg-[#08090b] text-white">
+      <div className="openvuln-glow pointer-events-none fixed inset-0 -z-10" />
+
+      <div className="min-h-screen">
+        <header className="sticky top-0 z-30 border-b border-white/[0.06] bg-[#08090b]/80 backdrop-blur-xl">
+          <div className="mx-auto flex h-[68px] w-full max-w-[1280px] items-center justify-between px-4 sm:px-7 lg:px-9 xl:px-12">
+            <div className="flex items-center gap-3">
+              <Link to="/" className="flex items-center gap-2.5 rounded-lg focus-ring-dark">
+                <BrandMark compact />
+                <span className="font-display text-sm font-semibold text-white">OpenVuln</span>
+              </Link>
+            </div>
+            <div className="flex items-center gap-2">
+              <NotificationBell appearance="dark" />
+              <AuthButton appearance="dark" />
+              <a
+                href={OWN_REPO}
+                target="_blank"
+                rel="noreferrer"
+                aria-label="OpenVuln on GitHub"
+                className="hidden h-9 items-center gap-2 rounded-full border border-[#2a2b30] bg-[#101114] px-3.5 text-xs font-medium text-[#9c9da4] transition hover:border-[#41434b] hover:bg-[#17181d] hover:text-white focus-ring-dark sm:inline-flex"
+              >
+                <Github size={14} />
+                GitHub
+              </a>
+            </div>
+          </div>
+        </header>
+
+        <main className="mx-auto w-full max-w-[1280px] px-4 pb-16 pt-8 sm:px-7 sm:pt-11 lg:px-9 lg:pb-20 lg:pt-14 xl:px-12">
+          <section id="submit" className="mx-auto flex max-w-[920px] scroll-mt-24 flex-col items-center text-center">
+            <div className="openvuln-brand flex flex-col items-center">
+              <div className="mb-4 flex items-center gap-2 font-mono text-[9px] font-semibold uppercase tracking-[0.2em] text-[#96989f]">
+                <span className="h-1.5 w-1.5 rounded-full bg-white/60" />
+                Open-source security scanner
+              </div>
+              <div className="flex items-center justify-center gap-4 sm:gap-5">
+                <div className="relative flex h-14 w-14 shrink-0 items-center justify-center overflow-hidden rounded-2xl border border-white/20 bg-white font-display text-2xl font-bold text-black shadow-[0_14px_44px_rgba(0,0,0,0.4)] sm:h-16 sm:w-16">
+                  <span aria-hidden>Z</span>
+                  <img
+                    src={ZAI_HF_AVATAR}
+                    alt="Z.ai"
+                    className="absolute inset-0 h-full w-full object-cover"
+                    onError={(event) => {
+                      event.currentTarget.style.display = "none";
+                    }}
+                  />
+                </div>
+                <h1 className="openvuln-title font-display text-[40px] font-[450] leading-none tracking-normal sm:text-[56px]">
+                  OpenVuln
+                </h1>
+              </div>
+              <p className="mt-4 max-w-2xl text-sm leading-6 text-ink-secondary sm:text-[15px]">
+                GLM-powered vulnerability discovery for the open-source world.
+              </p>
+            </div>
+
+            <RepoSubmitForm size="hero" appearance="dark" className="mt-7 w-full max-w-[820px]" />
+            <div className="mt-1 w-full max-w-[820px] text-center">
+              <p className="text-xs leading-5 text-[#777981]" role="note">
+                Submitted repositories may require manual review before they are approved for scanning.
+              </p>
+              <ScanDurationNotice className="mt-1.5 w-full" />
+            </div>
+          </section>
+
+          <div className="mt-9 grid items-stretch gap-4 xl:grid-cols-[0.88fr_1.12fr]">
+            <HeroStats stats={overview.data} loading={overview.isLoading} failed={overview.isError} />
+            <LiveScanPanel
+              scans={scans}
+              queued={queued}
+              loading={overview.isLoading}
+              failed={overview.isError}
+            />
+          </div>
+
+          <section
+            id="repositories"
+            aria-labelledby="projects-title"
+            className="mt-8 scroll-mt-24 rounded-[26px] border border-white/[0.08] bg-[#101115]/80 p-4 shadow-[0_24px_80px_rgba(0,0,0,0.22)] sm:p-6"
+          >
+            <div className="flex items-start justify-between gap-4">
+              <div>
+                <p className="font-mono text-[9px] font-semibold uppercase tracking-[0.18em] text-[#96989f]">
+                  Repository index
+                </p>
+                <h2 id="projects-title" className="mt-2 font-display text-xl font-semibold tracking-tight text-white sm:text-2xl">
+                  Scanned repositories
+                </h2>
+                <p className="mt-1.5 text-xs text-ink-tertiary">Browse public scan status and disclosed results.</p>
+              </div>
+              <button
+                type="button"
+                onClick={() => setRepositoriesOpen((open) => !open)}
+                aria-expanded={repositoriesOpen}
+                aria-controls="repository-list-content"
+                className="inline-flex h-9 shrink-0 items-center gap-2 rounded-xl border border-white/[0.09] bg-black/20 px-3 text-[11px] font-medium text-[#b9bac0] transition hover:border-white/[0.16] hover:bg-white/[0.05] hover:text-white focus-ring-dark"
+              >
+                {repositoriesOpen ? (
+                  <>
+                    Collapse
+                    <ChevronUp size={14} />
+                  </>
+                ) : (
+                  <>
+                    Expand
+                    <ChevronDown size={14} />
+                  </>
+                )}
+              </button>
+            </div>
+
+            {repositoriesOpen && (
+              <div id="repository-list-content">
+                <div className="mt-5 flex flex-col gap-2.5 sm:flex-row sm:items-end sm:justify-end">
+                  <div className="relative">
+                    <Search size={14} className="pointer-events-none absolute left-3.5 top-1/2 -translate-y-1/2 text-ink-tertiary" />
+                    <input
+                      type="search"
+                      value={q}
+                      onChange={(event) => setQ(event.target.value)}
+                      placeholder="Search repositories"
+                      aria-label="Search repositories"
+                      className="h-10 w-full rounded-xl border border-white/[0.09] bg-black/20 pl-10 pr-3 text-sm text-white placeholder:text-ink-tertiary focus-ring-dark sm:w-72"
+                    />
+                  </div>
+                  <div
+                    className="inline-flex self-start rounded-lg border border-white/[0.08] bg-black/20 p-1 sm:self-auto"
+                    aria-label="Sort repositories"
+                  >
+                    <button
+                      type="button"
+                      aria-pressed={sort === "stars"}
+                      onClick={() => setSort("stars")}
+                      className={`rounded-md px-3 py-1.5 text-[11px] font-medium transition focus-ring-dark ${
+                        sort === "stars" ? "bg-white text-black" : "text-ink-tertiary hover:text-white"
+                      }`}
+                    >
+                      Most starred
+                    </button>
+                    <button
+                      type="button"
+                      aria-pressed={sort === "newest"}
+                      onClick={() => setSort("newest")}
+                      className={`rounded-md px-3 py-1.5 text-[11px] font-medium transition focus-ring-dark ${
+                        sort === "newest" ? "bg-white text-black" : "text-ink-tertiary hover:text-white"
+                      }`}
+                    >
+                      Recently added
+                    </button>
+                  </div>
+                </div>
+
+                <div
+                  ref={repositoryScrollRef}
+                  className="openvuln-scrollbar mt-5 max-h-[520px] overflow-y-auto overscroll-contain border-y border-white/[0.07] pr-2"
+                  tabIndex={0}
+                  aria-label="Scanned repository list"
+                >
+              {projects.isLoading ? (
+                <div className="space-y-3 py-6">
+                  {Array.from({ length: 5 }).map((_, index) => (
+                    <div key={index} className="h-24 animate-pulse rounded-xl bg-white/[0.035]" />
+                  ))}
+                </div>
+              ) : projects.isError ? (
+                <EmptyState icon={Shield} title="Could not load repositories" description="The OpenVuln API may be unavailable." />
+              ) : filtered.length === 0 ? (
+                <EmptyState
+                  icon={Shield}
+                  title={q ? "No matching repositories" : "No repositories yet"}
+                  description={
+                    q
+                      ? "Try a different repository name."
+                      : "Submit the first open-source repository to be scanned by VulnHunter."
+                  }
+                  action={!q ? <Link to="/submit"><Button>Submit a repository</Button></Link> : undefined}
+                />
+              ) : (
+                <>
+                  {filtered.map((project) => (
+                    <ProjectRow key={project.id} project={project} compact />
+                  ))}
+                  <div ref={sentinelRef} className="h-px" />
+                  {projects.isFetchingNextPage && (
+                    <div className="py-5 text-center font-mono text-xs text-ink-tertiary">Loading more…</div>
+                  )}
+                </>
+              )}
+                </div>
+
+                <div className="mt-4 flex items-center justify-between gap-3 font-mono text-[10px] text-ink-tertiary">
+                  <span>{(projects.data?.pages[0]?.total ?? 0).toLocaleString()} repositories indexed</span>
+                  <a href="#top" className="hover:text-white">Back to top ↑</a>
+                </div>
+              </div>
+            )}
+          </section>
+
+        </main>
+      </div>
+    </div>
+  );
+}

src/features/my/MyProjectsPage.tsx

@@ -0,0 +1,71 @@
+import { Link, useNavigate } from "react-router-dom";
+import { useQuery } from "@tanstack/react-query";
+import { ArrowLeft, FolderGit2 } from "lucide-react";
+import { api } from "../../shared/api/client";
+import { useMe } from "../auth/useAuth";
+import { ProjectRow } from "../../components/ProjectRow";
+import { EmptyState } from "../../components/EmptyState";
+
+/** 我的提交（fish No.929）：登录用户看自己提交过的项目。 */
+export function MyProjectsPage() {
+  const meQ = useMe();
+  const nav = useNavigate();
+  const authed = meQ.data?.authenticated === true;
+
+  const listQ = useQuery({
+    queryKey: ["my", "projects"],
+    queryFn: api.myProjects,
+    enabled: authed,
+    retry: false,
+  });
+
+  if (meQ.isSuccess && !authed) {
+    // 未登录：回首页登录
+    nav("/", { replace: true });
+    return null;
+  }
+
+  const projects = listQ.data?.projects ?? [];
+
+  return (
+    <div className="mx-auto max-w-6xl px-6 py-8">
+      <Link
+        to="/"
+        className="inline-flex items-center gap-1.5 text-[13px] text-ink-secondary hover:text-ink"
+      >
+        <ArrowLeft size={14} /> Projects
+      </Link>
+      <h1 className="mt-4 font-display text-xl font-bold text-ink">My submissions</h1>
+      <p className="mt-2 text-sm text-ink-secondary">
+        Projects you submitted for scanning. Sign in with the same GitHub account to see scan
+        results and manage disclosures.
+      </p>
+
+      <div className="mt-6 border-t border-line">
+        {listQ.isPending ? (
+          <div className="space-y-3 py-6">
+            {Array.from({ length: 3 }).map((_, i) => (
+              <div key={i} className="h-20 animate-pulse rounded-xl bg-surface-raised" />
+            ))}
+          </div>
+        ) : projects.length === 0 ? (
+          <EmptyState
+            icon={FolderGit2}
+            title="No submissions yet"
+            description="Submit a public GitHub repository you maintain — it shows up here."
+            action={
+              <Link
+                to="/submit"
+                className="inline-flex h-9 items-center rounded-md bg-[#ebecf0] px-3.5 text-sm font-medium text-[#0d0d0f] hover:bg-white"
+              >
+                Submit a project
+              </Link>
+            }
+          />
+        ) : (
+          projects.map((p) => <ProjectRow key={p.id} project={p} />)
+        )}
+      </div>
+    </div>
+  );
+}

src/features/project/OwnerFindings.tsx

@@ -0,0 +1,336 @@
+import { useMemo, useState } from "react";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import {
+  CheckCircle2,
+  ChevronDown,
+  Download,
+  FileCode2,
+  LoaderCircle,
+  Lock,
+  ShieldCheck,
+} from "lucide-react";
+import {
+  api,
+  apiUrl,
+  type OwnerFindingSummary,
+} from "../../shared/api/client";
+import { Button } from "../../components/Button";
+import { ConfirmDialog } from "../../components/ConfirmDialog";
+import { ReportBody, type StructuredReport } from "../../components/ReportBody";
+import { SeverityChip } from "../../components/SeverityChip";
+import type { ViewJob } from "./VersionBar";
+
+/**
+ * Owner 专属「Manage findings」：全部 findings（含未披露）+ 勾选披露 + 全量报告下载。
+ * 仅在后端鉴权通过（父组件 owner 查询成功）时渲染。
+ */
+export function OwnerFindings({
+  projectId,
+  currentFindings,
+  viewJob,
+  onViewJob,
+}: {
+  projectId: string;
+  /** 父级 access probe 已拉的当前版本 findings（兼作 current 的 initialData）。 */
+  currentFindings: OwnerFindingSummary[];
+  /** 版本查看状态（页面级，头部 VersionBar 控制）。 */
+  viewJob: ViewJob | null;
+  onViewJob: (v: ViewJob | null) => void;
+}) {
+  const qc = useQueryClient();
+  const setViewJob = onViewJob;
+  const [selected, setSelected] = useState<ReadonlySet<string>>(new Set());
+  const [openKey, setOpenKey] = useState<string | null>(null);
+  const [confirmOpen, setConfirmOpen] = useState(false);
+  const [flash, setFlash] = useState<string | null>(null);
+
+  // 版本化查询：viewJob=null → 当前版本
+  const findingsQ = useQuery({
+    queryKey: ["owner-findings", projectId, viewJob?.id ?? "current"],
+    queryFn: () => api.ownerFindings(projectId, viewJob?.id),
+    initialData: viewJob === null ? { project_id: projectId, findings: currentFindings } : undefined,
+    retry: false,
+  });
+  const findings = findingsQ.data?.findings ?? currentFindings;
+  const viewingHistorical = viewJob !== null;
+
+  const disclosable = useMemo(
+    () => findings.filter((f) => f.disclosure_state !== "disclosed"),
+    [findings],
+  );
+  const allChecked = disclosable.length > 0 && disclosable.every((f) => selected.has(f.id));
+
+  const toggle = (id: string) => {
+    setSelected((prev) => {
+      const next = new Set(prev);
+      if (next.has(id)) next.delete(id);
+      else next.add(id);
+      return next;
+    });
+  };
+  const toggleAll = () => {
+    setSelected(allChecked ? new Set() : new Set(disclosable.map((f) => f.id)));
+  };
+
+  const discloseM = useMutation({
+    mutationFn: (ids: string[]) => api.ownerDisclose(projectId, ids),
+    onSuccess: (res) => {
+      setConfirmOpen(false);
+      setSelected(new Set());
+      setFlash(
+        `${res.disclosed_count} finding${res.disclosed_count === 1 ? "" : "s"} disclosed — now publicly visible with full report content.`,
+      );
+      void qc.invalidateQueries({ queryKey: ["owner-findings", projectId] });
+      void qc.invalidateQueries({ queryKey: ["public", "project"] });
+      void qc.invalidateQueries({ queryKey: ["public", "overview"] });
+    },
+  });
+
+  return (
+    <div className="space-y-4">
+      {/* 工具行 */}
+      <div className="flex flex-wrap items-center justify-between gap-3">
+        <h2 className="font-display text-base font-semibold text-ink">
+          All findings ({findings.length})
+        </h2>
+        <a
+          href={apiUrl(`/api/projects/${projectId}/report-full?format=md${viewJob ? `&scan_job_id=${viewJob.id}` : ""}`)}
+          className="inline-flex h-9 items-center gap-1.5 rounded-md border border-line bg-surface-raised px-3.5 text-sm font-medium text-ink transition-colors hover:bg-surface-sunken focus-ring"
+          title="Download the complete report for all findings (markdown)"
+        >
+          <Download size={14} /> Full report (.md)
+        </a>
+      </div>
+
+      {viewingHistorical && (
+        <div className="flex items-center justify-between gap-3 rounded-lg border border-accent-200 bg-accent-50 px-4 py-2.5 text-[13px] text-accent-600">
+          <span>
+            Viewing version <span className="font-mono font-medium">{viewJob.label}</span> — disclosure is
+            only available on the current version.
+          </span>
+          <button
+            type="button"
+            onClick={() => {
+              setViewJob(null);
+              setSelected(new Set());
+              setOpenKey(null);
+            }}
+            className="shrink-0 font-medium underline underline-offset-2 hover:text-accent-700"
+          >
+            Back to current
+          </button>
+        </div>
+      )}
+
+      {/* 披露操作条（历史版本只读，披露仅当前版本） */}
+      {!viewingHistorical && disclosable.length > 0 && (
+        <div className="flex flex-wrap items-center gap-3 rounded-lg border border-line bg-surface-sunken/50 px-4 py-2.5">
+          <label className="flex cursor-pointer items-center gap-2 text-[13px] text-ink-secondary">
+            <input
+              type="checkbox"
+              checked={allChecked}
+              onChange={toggleAll}
+              className="h-4 w-4 rounded border-line accent-[#28D1FF]"
+            />
+            Select undisclosed ({disclosable.length})
+          </label>
+          <span className="text-[13px] text-ink-tertiary" aria-live="polite">
+            {selected.size > 0 ? `${selected.size} selected` : ""}
+          </span>
+          <div className="ml-auto flex items-center gap-3">
+            <Button
+              size="md"
+              disabled={selected.size === 0}
+              onClick={() => setConfirmOpen(true)}
+            >
+              <ShieldCheck size={15} />
+              Disclose{selected.size > 0 ? ` (${selected.size})` : ""}
+            </Button>
+          </div>
+        </div>
+      )}
+
+      {flash && (
+        <p
+          className="flex items-start gap-1.5 rounded-lg border border-success/30 bg-success-bg px-4 py-2.5 text-[13px] text-success-ink"
+          role="status"
+        >
+          <CheckCircle2 size={15} className="mt-0.5 shrink-0" />
+          {flash}
+        </p>
+      )}
+
+      {discloseM.isError && (
+        <p className="rounded-lg border border-danger/30 bg-danger/5 px-4 py-2.5 text-[13px] text-danger" role="alert">
+          Disclosure failed. Please try again — if it persists, contact an operator.
+        </p>
+      )}
+
+      {/* findings 卡片 */}
+      {findings.length === 0 ? (
+        <div className="rounded-xl border border-dashed border-line px-6 py-10 text-center text-sm text-ink-secondary">
+          No findings on the current scan.
+        </div>
+      ) : (
+        <div className="space-y-3">
+          {findings.map((f) => {
+            const disclosed = f.disclosure_state === "disclosed";
+            const open = openKey === f.finding_key;
+            return (
+              <article
+                key={f.id}
+                className="overflow-hidden rounded-xl border border-line bg-surface"
+              >
+                <div
+                  role="button"
+                  tabIndex={0}
+                  onClick={() => setOpenKey(open ? null : f.finding_key)}
+                  onKeyDown={(e) => {
+                    if (e.key === "Enter" || e.key === " ") {
+                      e.preventDefault();
+                      setOpenKey(open ? null : f.finding_key);
+                    }
+                  }}
+                  aria-expanded={open}
+                  className="flex w-full cursor-pointer items-start gap-3 px-5 py-3 text-left transition-colors hover:bg-surface-sunken/50 focus-ring"
+                >
+                  <input
+                    type="checkbox"
+                    checked={selected.has(f.id)}
+                    disabled={disclosed || viewingHistorical}
+                    onClick={(e) => e.stopPropagation()}
+                    onChange={() => toggle(f.id)}
+                    aria-label={disclosed ? `${f.finding_key} already disclosed` : `Select ${f.finding_key}`}
+                    className="mt-1 h-4 w-4 shrink-0 rounded border-line accent-[#28D1FF] disabled:opacity-40"
+                  />
+                  <div className="min-w-0 flex-1">
+                    <div className="flex flex-wrap items-center gap-x-2 gap-y-1">
+                      <SeverityChip severity={f.severity} />
+                      {f.cwe && (
+                        <span className="rounded bg-surface-sunken px-1.5 py-0.5 font-mono text-[11px] text-ink-secondary">
+                          {f.cwe}
+                        </span>
+                      )}
+                      {f.cvss_score != null && (
+                        <span className="font-mono text-[11px] text-ink-tertiary">
+                          CVSS {f.cvss_score.toFixed(1)}
+                        </span>
+                      )}
+                    </div>
+                    <h3
+                      className="mt-1 line-clamp-2 font-display text-[15px] font-semibold leading-snug text-ink"
+                      title={f.title}
+                    >
+                      {f.title}
+                    </h3>
+                    <p className="mt-0.5 truncate font-mono text-[11px] text-ink-tertiary">
+                      {f.finding_key}
+                    </p>
+                  </div>
+                  <span className="flex shrink-0 items-center gap-2 self-center">
+                    {disclosed ? (
+                      <span className="inline-flex items-center gap-1 text-[12px] font-medium text-success-ink">
+                        <CheckCircle2 size={13} /> Disclosed
+                      </span>
+                    ) : (
+                      <span className="inline-flex items-center gap-1 text-[12px] text-ink-tertiary">
+                        <Lock size={12} /> Owner only
+                      </span>
+                    )}
+                    <ChevronDown
+                      size={16}
+                      className={`text-ink-tertiary transition-transform ${open ? "rotate-180" : ""}`}
+                    />
+                  </span>
+                </div>
+
+                {open && <OwnerFindingDetailBody projectId={projectId} findingKey={f.finding_key} />}
+              </article>
+            );
+          })}
+        </div>
+      )}
+
+      <ConfirmDialog
+        open={confirmOpen}
+        title={`Disclose ${selected.size} finding${selected.size === 1 ? "" : "s"}?`}
+        body="The full report content of the selected findings — description, file paths, code and analysis — becomes publicly visible on OpenVuln. This cannot be undone from the site; an operator can reverse an accidental disclosure."
+        confirmLabel="Disclose permanently"
+        busy={discloseM.isPending}
+        onConfirm={() => discloseM.mutate([...selected])}
+        onCancel={() => setConfirmOpen(false)}
+      />
+    </div>
+  );
+}
+
+/** 展开后按需取单条全文（report + artifacts）。 */
+function OwnerFindingDetailBody({
+  projectId,
+  findingKey,
+}: {
+  projectId: string;
+  findingKey: string;
+}) {
+  const detailQ = useQuery({
+    queryKey: ["owner-finding", projectId, findingKey],
+    queryFn: () => api.ownerFinding(projectId, findingKey),
+    staleTime: 60_000,
+    retry: false,
+  });
+
+  if (detailQ.isPending) {
+    return (
+      <div className="flex items-center gap-2 border-t border-line px-5 py-6 text-[13px] text-ink-secondary">
+        <LoaderCircle size={15} className="animate-spin" /> Loading full report…
+      </div>
+    );
+  }
+  if (detailQ.isError || !detailQ.data) {
+    return (
+      <div className="border-t border-line px-5 py-6 text-[13px] text-danger" role="alert">
+        Failed to load the full report.
+      </div>
+    );
+  }
+
+  const f = detailQ.data.finding;
+  const arts = (f.artifacts ?? []).filter((a) => a.has_content || a.size_bytes > 0);
+
+  return (
+    <div className="border-t border-line px-5 py-4">
+      <ReportBody report={(f.report as StructuredReport | null) ?? undefined} yaml={f.report_yaml ?? undefined} />
+      {arts.length > 0 && (
+        <div className="mt-5 border-t border-line pt-4">
+          <h4 className="text-[11px] font-semibold uppercase tracking-wide text-ink-tertiary">
+            Artifacts ({arts.length})
+          </h4>
+          <ul className="mt-2 space-y-1">
+            {arts.slice(0, 20).map((a) => (
+              <li
+                key={a.rel_path}
+                className="flex items-center gap-2 font-mono text-[12px] text-ink-secondary"
+                title={a.rel_path}
+              >
+                <FileCode2 size={13} className="shrink-0 text-ink-tertiary" />
+                <span className="truncate">{a.file_name}</span>
+                <span className="shrink-0 text-ink-tertiary">
+                  {a.kind} · {formatSize(a.size_bytes)}
+                </span>
+              </li>
+            ))}
+            {arts.length > 20 && (
+              <li className="text-[12px] text-ink-tertiary">…and {arts.length - 20} more</li>
+            )}
+          </ul>
+        </div>
+      )}
+    </div>
+  );
+}
+
+function formatSize(n: number): string {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  return `${(n / 1024 / 1024).toFixed(1)} MB`;
+}

src/features/project/ProjectPage.tsx

@@ -0,0 +1,632 @@
+import { useQuery } from "@tanstack/react-query";
+import {
+  ArrowLeft,
+  ArrowUpRight,
+  Check,
+  ChevronDown,
+  Download,
+  ExternalLink,
+  Github,
+  LoaderCircle,
+  Shield,
+} from "lucide-react";
+import { useEffect, useMemo, useState } from "react";
+import { Link, useLocation, useParams, useSearchParams } from "react-router-dom";
+import { EmptyState } from "../../components/EmptyState";
+import { ReportBody } from "../../components/ReportBody";
+import { ScanDurationNotice } from "../../components/ScanDurationNotice";
+import { SeverityBar } from "../../components/SeverityBar";
+import { SeverityChip } from "../../components/SeverityChip";
+import { ScanningSpinner, StatusBadge } from "../../components/StatusBadge";
+import { api, apiUrl } from "../../shared/api/client";
+import { useMe } from "../auth/useAuth";
+import { OwnerFindings } from "./OwnerFindings";
+import { VersionBar, type ViewJob } from "./VersionBar";
+import { formatDate, formatStars, shortSha, totalFindings } from "../../shared/lib/format";
+
+export function ProjectPage() {
+  const [openKey, setOpenKey] = useState<string | null>(null);
+  const { owner = "", repo = "" } = useParams();
+  const [params, setParams] = useSearchParams();
+  const tabParam = params.get("tab");
+  const location = useLocation();
+  const justSubmitted = Boolean(
+    (location.state as { justSubmitted?: boolean } | null)?.justSubmitted,
+  );
+
+  const projectQ = useQuery({
+    queryKey: ["public", "project", owner, repo],
+    queryFn: () => api.getProject(owner, repo),
+    enabled: Boolean(owner && repo),
+    refetchInterval: (q) => {
+      const s = q.state.data?.latest_scan?.state;
+      if (s === "queued" || s === "dispatching" || s === "scanning") return 5000;
+      return false;
+    },
+  });
+
+  const project = projectQ.data;
+  const meQ = useMe();
+  // owner 探测：登录后尝试拉取全量 findings；200=有权限（显示 Manage findings tab），401/403=公众视图
+  const ownerQ = useQuery({
+    queryKey: ["owner-findings", project?.id],
+    queryFn: () => api.ownerFindings(project!.id),
+    enabled: Boolean(project?.id) && meQ.data?.authenticated === true,
+    retry: false,
+    staleTime: 30_000,
+  });
+  const isOwner = ownerQ.isSuccess;
+  // 版本查看状态（fish No.1253：切换操作上移到头部）
+  const [viewJob, setViewJob] = useState<ViewJob | null>(null);
+  // Details 与 Manage findings 合并为 Findings（fish No.1252）；tab=details 兼容旧链接
+  const tab = tabParam === "findings" || tabParam === "details" ? "findings" : "overview";
+  const cweMax = useMemo(() => {
+    const list = project?.cwe_distribution ?? [];
+    return Math.max(1, ...list.map((c) => c.count));
+  }, [project]);
+
+  if (projectQ.isLoading) {
+    return <ScanProgressPage owner={owner} repo={repo} state="loading" />;
+  }
+
+  if (projectQ.isError || !project) {
+    return (
+      <div className="mx-auto max-w-6xl px-6 py-16">
+        <EmptyState
+          icon={Shield}
+          title="Project not found"
+          description="This project is not on OpenVuln yet."
+          action={
+            <Link to="/#projects" className="text-sm text-accent-600 hover:underline">
+              Back to projects
+            </Link>
+          }
+        />
+      </div>
+    );
+  }
+
+  const state = project.latest_scan?.state;
+  const scanning = state === "scanning" || state === "dispatching";
+  const soFar = project.latest_scan?.findings_so_far ?? 0;
+  const findingsTotal = totalFindings(project.severity_counts);
+
+  if (state === "queued" || scanning) {
+    return (
+      <ScanProgressPage
+        owner={project.owner_login}
+        repo={project.name}
+        htmlUrl={project.html_url}
+        branch={project.default_branch}
+        state={state}
+        findingsSoFar={soFar}
+        justSubmitted={justSubmitted}
+      />
+    );
+  }
+
+  return (
+    <div className="mx-auto max-w-6xl px-6 py-8">
+      <Link
+        to="/#projects"
+        className="inline-flex items-center gap-1.5 text-[13px] text-ink-secondary hover:text-ink"
+      >
+        <ArrowLeft size={14} /> Projects
+      </Link>
+
+      {justSubmitted && (
+        <div
+          className="mt-4 rounded-md border border-accent-100 bg-accent-50 px-4 py-3 text-sm text-accent-700"
+          role="status"
+        >
+          Added to the scan queue.
+        </div>
+      )}
+
+      {/* Header */}
+      <div className="mt-4 border-b border-line pb-6">
+        <div className="flex flex-wrap items-center gap-2">
+          <h1 className="font-display text-xl font-semibold tracking-tight">
+            <span className="text-ink-secondary">{project.owner_login}</span>
+            <span className="text-ink-tertiary"> / </span>
+            <span className="text-ink">{project.name}</span>
+          </h1>
+          <a
+            href={project.html_url}
+            target="_blank"
+            rel="noreferrer"
+            className="inline-flex items-center text-ink-secondary hover:text-accent-600"
+            title="View on GitHub"
+          >
+            <ExternalLink size={14} />
+          </a>
+        </div>
+        {project.description && (
+          <p className="mt-2 max-w-prose text-sm text-ink-secondary">{project.description}</p>
+        )}
+        <div className="mt-2 flex flex-wrap items-center gap-x-2 gap-y-1 text-[13px] text-ink-tertiary">
+          {project.language && (
+            <span className="inline-flex items-center gap-1">
+              <span className="h-1.5 w-1.5 rounded-full bg-accent-600/70" />
+              {project.language}
+            </span>
+          )}
+          <span>·</span>
+          <span>★ {formatStars(project.stars)}</span>
+          <span>·</span>
+          <span>Added {formatDate(project.created_at)}</span>
+        </div>
+        {isOwner && (
+          <div className="mt-3">
+            <VersionBar projectId={project.id} viewJob={viewJob} onViewJob={setViewJob} />
+          </div>
+        )}
+      </div>
+
+      {/* Tabs */}
+      <div className="mt-4 flex gap-1 border-b border-line">
+        <TabButton active={tab === "overview"} onClick={() => setParams({})}>
+          Overview
+        </TabButton>
+        <TabButton active={tab === "findings"} onClick={() => setParams({ tab: "findings" })}>
+          Findings
+        </TabButton>
+      </div>
+
+      {tab === "overview" && (
+        <div className="py-6">
+          <div className="flex flex-wrap items-center gap-x-3 gap-y-2 text-sm">
+            <StatusBadge state={state} finishedAt={project.latest_scan?.finished_at} />
+            {project.latest_scan?.finished_at && (
+              <span className="text-ink-secondary">
+                {formatDate(project.latest_scan.finished_at)}
+              </span>
+            )}
+            {project.latest_scan?.commit_sha && (
+              <a
+                href={`${project.html_url}/commit/${project.latest_scan.commit_sha}`}
+                target="_blank"
+                rel="noreferrer"
+                className="inline-flex items-center gap-0.5 font-mono text-[13px] text-ink-secondary hover:text-accent-600"
+              >
+                {shortSha(project.latest_scan.commit_sha)}
+                <ArrowUpRight size={12} />
+              </a>
+            )}
+          </div>
+          <p className="mt-2 text-[13px] text-ink-secondary">
+            {state === "completed" ? "Scanned" : scanning ? "Scanning" : "To be scanned"} by{" "}
+            <span className="font-medium text-ink">VulnHunter AI engine</span>
+            {project.default_branch ? ` · default branch (${project.default_branch})` : null}
+          </p>
+
+          {scanning && (
+            <div className="mt-8 space-y-3">
+              <ScanningSpinner
+                label={
+                  soFar > 0
+                    ? `Scan in progress — ${soFar} finding${soFar === 1 ? "" : "s"} so far`
+                    : "Scan in progress — stats will appear when complete."
+                }
+              />
+              <div className="h-2 w-full max-w-xl animate-pulse rounded-full bg-surface-sunken" />
+            </div>
+          )}
+
+          {state !== "completed" && !scanning && (
+            <p className="mt-8 text-sm text-ink-secondary">This project is in the scan queue.</p>
+          )}
+
+          {state === "completed" && (
+            <>
+              <section className="mt-8">
+                <p className="font-mono text-[11px] uppercase tracking-wider text-ink-tertiary">
+                  Scan results
+                </p>
+                <h2 className="mt-1 font-display text-base font-semibold text-ink">
+                  Findings overview
+                </h2>
+                {findingsTotal === 0 ? (
+                  <p className="mt-3 max-w-prose text-sm text-ink-secondary">
+                    No findings were confirmed in this scan. A clean scan does not prove a project is
+                    free of vulnerabilities.
+                  </p>
+                ) : (
+                  <>
+                    <p className="mt-3 text-sm font-medium text-ink">
+                      {findingsTotal} finding{findingsTotal === 1 ? "" : "s"} found
+                    </p>
+                    <div className="mt-4">
+                      <SeverityBar
+                        counts={project.severity_counts}
+                        widthClass="w-full max-w-[80%]"
+                        heightClass="h-2"
+                      />
+                    </div>
+                  </>
+                )}
+              </section>
+
+              {project.cwe_distribution.length > 0 && (
+                <section className="mt-10">
+                  <h2 className="font-display text-base font-semibold text-ink">
+                    Top CWE categories
+                  </h2>
+                  <ul className="mt-4 max-w-[80%] space-y-2.5">
+                    {project.cwe_distribution.slice(0, 5).map((c) => (
+                      <li key={c.cwe} className="flex items-center gap-3 text-sm">
+                        <a
+                          href={`https://cwe.mitre.org/data/definitions/${c.cwe.replace(/^CWE-/i, "")}.html`}
+                          target="_blank"
+                          rel="noreferrer"
+                          className="w-24 shrink-0 font-mono text-[13px] text-accent-700 hover:underline"
+                        >
+                          {c.cwe}
+                        </a>
+                        <div className="h-1.5 flex-1 overflow-hidden rounded-full bg-surface-sunken">
+                          <div
+                            className="h-full rounded-full bg-ink/40"
+                            style={{ width: `${(c.count / cweMax) * 100}%` }}
+                          />
+                        </div>
+                        <span className="w-8 text-right font-mono text-[13px] text-ink-secondary">
+                          {c.count}
+                        </span>
+                      </li>
+                    ))}
+                  </ul>
+                </section>
+              )}
+
+              <div className="mt-10 rounded-md border border-line bg-surface-raised p-5">
+                <p className="text-sm leading-relaxed text-ink-secondary">
+                  Detailed findings are visible to signed-in repository maintainers. Maintainers
+                  review the full reports and choose what to disclose publicly.
+                </p>
+              </div>
+
+              {project.disclosed_findings.length > 0 && (
+                <section className="mt-10">
+                  <div className="flex flex-wrap items-center justify-between gap-2">
+                    <h2 className="font-display text-base font-semibold text-ink">
+                      Disclosed findings
+                    </h2>
+                    <div className="flex items-center gap-3 text-[13px]">
+                      <a
+                        href={apiUrl(`/api/projects/${project.id}/report?format=zip`)}
+                        className="inline-flex items-center gap-1 text-ink-secondary hover:text-accent-600"
+                      >
+                        <Download size={14} /> Download all (zip)
+                      </a>
+                    </div>
+                  </div>
+                  <div className="mt-3 overflow-hidden rounded-md border border-line">
+                    <table className="w-full table-fixed text-left text-sm">
+                      <thead className="border-b border-line bg-surface-sunken/50 text-xs uppercase tracking-wide text-ink-secondary">
+                        <tr>
+                          <th className="w-[92px] px-3 py-2.5 font-medium">Sev</th>
+                          <th className="px-3 py-2.5 font-medium">Title</th>
+                          <th className="w-[112px] px-3 py-2.5 font-medium">CWE</th>
+                          <th className="w-[120px] px-3 py-2.5 font-medium">Status</th>
+                          <th className="w-[52px] px-3 py-2.5 font-medium" />
+                        </tr>
+                      </thead>
+                      <tbody>
+                        {project.disclosed_findings.map((f) => (
+                          <tr key={f.id} className="border-b border-line last:border-0">
+                            <td className="px-3 py-3">
+                              <SeverityChip severity={f.severity} />
+                            </td>
+                            <td className="max-w-0 truncate px-3 py-3 font-medium text-ink" title={f.title}>
+                              {f.title}
+                            </td>
+                            <td className="px-3 py-3 font-mono text-[13px] text-ink-secondary">
+                              {f.cwe ?? "—"}
+                            </td>
+                            <td className="px-3 py-3 text-[13px] text-success">Disclosed</td>
+                            <td className="px-3 py-3 text-right">
+                              <a
+                                href={apiUrl(`/api/projects/${project.id}/report/${encodeURIComponent(f.finding_key)}`)}
+                                className="text-ink-tertiary hover:text-accent-600"
+                                title="Download full report (markdown)"
+                                download
+                              >
+                                <Download size={14} className="inline" />
+                              </a>
+                            </td>
+                          </tr>
+                        ))}
+                      </tbody>
+                    </table>
+                  </div>
+                </section>
+              )}
+            </>
+          )}
+        </div>
+      )}
+
+      {tab === "findings" && !isOwner && (
+        <div className="space-y-4 py-6">
+          {project.disclosed_findings.length === 0 ? (
+            <div className="rounded-md border border-line bg-surface-raised p-6">
+              <h2 className="font-display text-base font-semibold text-ink">
+                No disclosures yet
+              </h2>
+              <p className="mt-2 w-full text-sm leading-relaxed text-ink-secondary">
+                Full finding details are visible to repository maintainers after sign-in. Disclosed
+                findings appear here with the full report content, and on the Overview tab.
+              </p>
+            </div>
+          ) : (
+            project.disclosed_findings.map((f) => {
+              const open = openKey === f.id;
+              return (
+                <article
+                  key={f.id}
+                  className="overflow-hidden rounded-md border border-line bg-surface-raised"
+                >
+                  <div
+                    role="button"
+                    tabIndex={0}
+                    onClick={() => setOpenKey(open ? null : f.id)}
+                    onKeyDown={(e) => {
+                      if (e.key === "Enter" || e.key === " ") {
+                        e.preventDefault();
+                        setOpenKey(open ? null : f.id);
+                      }
+                    }}
+                    aria-expanded={open}
+                    className="flex w-full cursor-pointer items-start gap-3 px-5 py-4 text-left transition-colors hover:bg-surface-sunken/50 focus-ring sm:px-6"
+                  >
+                    <div className="min-w-0 flex-1 space-y-2">
+                      <div className="flex flex-wrap items-center gap-2">
+                        <SeverityChip severity={f.severity} />
+                        {f.cwe && (
+                          <span className="font-mono text-[12px] text-ink-secondary">{f.cwe}</span>
+                        )}
+                        <span className="text-[12px] text-success">Disclosed</span>
+                      </div>
+                      <h3
+                        className="line-clamp-2 font-display text-[15px] font-semibold leading-snug text-ink"
+                        title={f.title}
+                      >
+                        {f.title}
+                      </h3>
+                      <p className="font-mono text-[11px] text-ink-tertiary">{f.finding_key}</p>
+                    </div>
+                    <span className="flex shrink-0 items-center gap-2 self-center">
+                      <a
+                        href={apiUrl(`/api/projects/${project.id}/report/${encodeURIComponent(f.finding_key)}`)}
+                        className="inline-flex items-center gap-1.5 rounded-md border border-line px-2.5 py-1.5 text-xs font-medium text-ink-secondary hover:border-accent-300 hover:text-accent-700"
+                        download
+                        onClick={(e) => e.stopPropagation()}
+                        title="Download full report (markdown)"
+                      >
+                        <Download size={14} />
+                        .md
+                      </a>
+                      <ChevronDown
+                        size={16}
+                        className={`text-ink-tertiary transition-transform ${open ? "rotate-180" : ""}`}
+                      />
+                    </span>
+                  </div>
+                  {open && (
+                    <div className="border-t border-line px-5 pb-5 sm:px-6 sm:pb-6">
+                      {f.report ? (
+                        <ReportBody report={f.report} />
+                      ) : (
+                        <p className="mt-4 text-sm text-ink-tertiary">
+                          Structured report is not available for this disclosure (older
+                          summary-only disclose). Use the download button if a fidelity pack was
+                          attached later.
+                        </p>
+                      )}
+                    </div>
+                  )}
+                </article>
+              );
+            })
+          )}
+        </div>
+      )}
+
+      {tab === "findings" && isOwner && (
+        <div className="py-6">
+          <OwnerFindings
+            projectId={project.id}
+            currentFindings={ownerQ.data?.findings ?? []}
+            viewJob={viewJob}
+            onViewJob={setViewJob}
+          />
+        </div>
+      )}
+    </div>
+  );
+}
+
+function ScanProgressPage({
+  owner,
+  repo,
+  htmlUrl,
+  branch,
+  state,
+  findingsSoFar = 0,
+  justSubmitted = false,
+}: {
+  owner: string;
+  repo: string;
+  htmlUrl?: string;
+  branch?: string | null;
+  state: "loading" | "queued" | "dispatching" | "scanning";
+  findingsSoFar?: number;
+  justSubmitted?: boolean;
+}) {
+  useEffect(() => {
+    document.body.classList.add("openvuln-running");
+    return () => document.body.classList.remove("openvuln-running");
+  }, []);
+
+  const queued = state === "queued";
+  const loading = state === "loading";
+  const dispatching = state === "dispatching";
+  const currentStage = queued ? 0 : dispatching ? 1 : 2;
+  const stages = ["Queued", "Preparing", "Scanning", "Results"];
+  const statusLabel = loading
+    ? "Loading scan status"
+    : queued
+      ? "Waiting in scan queue"
+      : dispatching
+        ? "Preparing the scan"
+        : "AI security analysis in progress";
+  const detail = loading
+    ? "Retrieving the latest status…"
+    : queued
+      ? "The repository is queued and will start automatically when a scanner is available."
+      : dispatching
+        ? "OpenVuln is packaging the repository and handing it to an available scanner."
+        : findingsSoFar > 0
+          ? `${findingsSoFar} confirmed finding${findingsSoFar === 1 ? "" : "s"} so far. Analysis is still running.`
+          : "VulnHunter is analyzing the repository. Results will appear after the scan completes.";
+
+  return (
+    <div className="openvuln-home fixed inset-0 z-50 overflow-y-auto bg-black text-white">
+      <div className="openvuln-glow pointer-events-none absolute inset-0 -z-10" />
+
+      <header className="flex items-center justify-between px-5 py-5 sm:px-8 sm:py-7">
+        <Link
+          to="/"
+          className="inline-flex items-center gap-2 rounded-full border border-[#333] bg-[#030303] px-3.5 py-2 text-xs font-medium text-[#acacb0] transition hover:border-[#484a58] hover:bg-[#111216] hover:text-white focus-ring-dark"
+        >
+          <ArrowLeft size={14} />
+          OpenVuln
+        </Link>
+        {htmlUrl && (
+          <a
+            href={htmlUrl}
+            target="_blank"
+            rel="noreferrer"
+            className="inline-flex items-center gap-2 rounded-full border border-[#333] bg-[#030303] px-3.5 py-2 text-xs font-medium text-[#acacb0] transition hover:border-[#484a58] hover:bg-[#111216] hover:text-white focus-ring-dark"
+          >
+            <Github size={14} />
+            GitHub
+          </a>
+        )}
+      </header>
+
+      <main className="mx-auto flex min-h-[calc(100vh-88px)] w-full max-w-4xl flex-col items-center justify-center px-5 pb-16 pt-8 text-center sm:px-8">
+        <div className="openvuln-brand flex h-16 w-16 items-center justify-center rounded-2xl border border-white/15 bg-[#151619] shadow-[0_18px_64px_rgba(0,0,0,0.5)]">
+          <LoaderCircle
+            size={28}
+            className="animate-spin text-[#c9ccd6] motion-reduce:animate-none"
+            strokeWidth={1.7}
+          />
+        </div>
+
+        <p className="mt-7 font-mono text-[11px] uppercase tracking-[0.22em] text-[#85868d]">
+          {justSubmitted ? "Repository added" : "Live scan status"}
+        </p>
+        <h1 className="openvuln-title mt-3 text-balance text-3xl font-medium leading-tight sm:text-5xl">
+          {statusLabel}
+        </h1>
+
+        <div className="mt-5 flex flex-wrap items-center justify-center gap-2 text-sm text-[#acacb0]">
+          <span className="text-[#f0f2f6]">{owner}</span>
+          <span className="text-[#5f6067]">/</span>
+          <span className="text-[#f0f2f6]">{repo}</span>
+          {branch && (
+            <>
+              <span className="text-[#5f6067]">·</span>
+              <span className="font-mono text-xs text-[#85868d]">{branch}</span>
+            </>
+          )}
+        </div>
+
+        <div className="openvuln-composer mt-9 w-full max-w-2xl rounded-[22px] border border-[#333] bg-[#111216] px-5 py-5 text-left shadow-[0_24px_90px_rgba(0,0,0,0.52)] sm:px-6">
+          <div className="flex items-center gap-3">
+            <span className="relative flex h-2.5 w-2.5 shrink-0">
+              <span className="absolute inline-flex h-full w-full animate-ping rounded-full bg-[#aeb0ba] opacity-50 motion-reduce:animate-none" />
+              <span className="relative inline-flex h-2.5 w-2.5 rounded-full bg-[#d5d7df]" />
+            </span>
+            <p className="text-sm font-medium text-[#f0f2f6]">{statusLabel}</p>
+          </div>
+          <p className="mt-3 text-sm leading-6 text-[#85868d]">{detail}</p>
+          {!loading && (
+            <div className="mt-5 border-t border-[#27282e] pt-4">
+              <div className="flex items-center justify-between text-xs text-[#66676e]">
+                <span>Current stage</span>
+                <span>
+                  {currentStage + 1} of {stages.length}
+                </span>
+              </div>
+              <ol className="mt-3 grid grid-cols-4 gap-2" aria-label="Scan stages">
+                {stages.map((stageLabel, index) => {
+                  const complete = index < currentStage;
+                  const current = index === currentStage;
+                  return (
+                    <li
+                      key={stageLabel}
+                      className={`flex min-w-0 flex-col items-center gap-2 rounded-xl border px-2 py-3 text-center ${
+                        current
+                          ? "border-[#4b4d58] bg-[#1a1b20] text-[#f0f2f6]"
+                          : complete
+                            ? "border-[#303139] bg-[#151619] text-[#acacb0]"
+                            : "border-[#24252a] bg-[#121317] text-[#5f6067]"
+                      }`}
+                      aria-current={current ? "step" : undefined}
+                    >
+                      <span
+                        className={`flex h-6 w-6 items-center justify-center rounded-full border text-[11px] ${
+                          current
+                            ? "border-[#b7bac5] bg-[#d5d7df] text-[#111216]"
+                            : complete
+                              ? "border-[#555762] bg-[#26272d] text-[#d5d7df]"
+                              : "border-[#303139] text-[#5f6067]"
+                        }`}
+                      >
+                        {complete ? <Check size={13} strokeWidth={2.2} /> : index + 1}
+                      </span>
+                      <span className="truncate text-[11px] font-medium sm:text-xs">
+                        {stageLabel}
+                      </span>
+                    </li>
+                  );
+                })}
+              </ol>
+              <p className="mt-3 text-xs text-[#66676e]">
+                This shows status stages, not elapsed-time progress. Refreshes every 5 seconds.
+              </p>
+            </div>
+          )}
+        </div>
+
+        <ScanDurationNotice className="mt-4 w-full max-w-2xl" />
+      </main>
+    </div>
+  );
+}
+
+function TabButton({
+  active,
+  onClick,
+  children,
+}: {
+  active: boolean;
+  onClick: () => void;
+  children: React.ReactNode;
+}) {
+  return (
+    <button
+      type="button"
+      onClick={onClick}
+      className={`-mb-px inline-flex items-center border-b-2 px-3 py-2.5 text-sm font-medium transition-colors focus-ring ${
+        active
+          ? "border-accent-600 text-accent-700"
+          : "border-transparent text-ink-secondary hover:text-ink"
+      }`}
+    >
+      {children}
+    </button>
+  );
+}

src/features/project/VersionBar.tsx

@@ -0,0 +1,167 @@
+import { useEffect, useRef, useState } from "react";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { Ban, ChevronDown, CircleCheck, LoaderCircle } from "lucide-react";
+import { api, type ScanJobSummary } from "../../shared/api/client";
+import { ConfirmDialog } from "../../components/ConfirmDialog";
+import { formatRelativeTime, shortSha } from "../../shared/lib/format";
+
+export interface ViewJob {
+  id: string;
+  label: string;
+}
+
+/**
+ * 项目头部版本条（owner 专属，fish No.1253）：版本切换从 tab 内容区上移到标题区。
+ * 紧凑单行：当前版本下拉（切换查看历史版本）+ 进行中状态（可取消）+ Rescan。
+ */
+export function VersionBar({
+  projectId,
+  viewJob,
+  onViewJob,
+}: {
+  projectId: string;
+  viewJob: ViewJob | null;
+  onViewJob: (v: ViewJob | null) => void;
+}) {
+  const qc = useQueryClient();
+  const [open, setOpen] = useState(false);
+  const [cancelTarget, setCancelTarget] = useState<ScanJobSummary | null>(null);
+  const rootRef = useRef<HTMLDivElement>(null);
+
+  const scansQ = useQuery({
+    queryKey: ["project-scans", projectId],
+    queryFn: () => api.projectScans(projectId),
+    refetchInterval: (q) =>
+      (q.state.data?.scans ?? []).some((s) => ["queued", "dispatching", "scanning"].includes(s.state))
+        ? 5000
+        : false,
+    retry: false,
+  });
+
+  useEffect(() => {
+    if (!open) return;
+    const onDoc = (e: MouseEvent) => {
+      if (rootRef.current && !rootRef.current.contains(e.target as Node)) setOpen(false);
+    };
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === "Escape") setOpen(false);
+    };
+    document.addEventListener("mousedown", onDoc);
+    document.addEventListener("keydown", onKey);
+    return () => {
+      document.removeEventListener("mousedown", onDoc);
+      document.removeEventListener("keydown", onKey);
+    };
+  }, [open]);
+
+  const invalidateAll = () => {
+    void qc.invalidateQueries({ queryKey: ["project-scans", projectId] });
+    void qc.invalidateQueries({ queryKey: ["public", "project"] });
+    void qc.invalidateQueries({ queryKey: ["owner-findings", projectId] });
+  };
+
+  const cancelM = useMutation({
+    mutationFn: (jobId: string) => api.cancelScanJob(projectId, jobId),
+    onSettled: () => {
+      setCancelTarget(null);
+      invalidateAll();
+    },
+  });
+
+  const scans = scansQ.data?.scans ?? [];
+  const inflight = scans.find((s) => ["queued", "dispatching", "scanning"].includes(s.state));
+  const completed = scans.filter((s) => s.state === "completed");
+  const current = completed[0] ?? null; // 列表按创建时间倒序
+  const viewing = viewJob ?? (current ? { id: current.id, label: current.commit_sha?.slice(0, 7) ?? "current" } : null);
+
+  return (
+    <div ref={rootRef} className="flex flex-wrap items-center gap-2 text-[13px]">
+      {/* 版本切换下拉 */}
+      <div className="relative">
+        <button
+          type="button"
+          onClick={() => setOpen((v) => !v)}
+          aria-expanded={open}
+          aria-haspopup="menu"
+          className="inline-flex h-8 items-center gap-1.5 rounded-full border border-line bg-surface-raised px-3 text-ink transition-colors hover:border-[#484a58] hover:bg-surface-sunken focus-ring"
+        >
+          <CircleCheck size={13} className="text-success" />
+          <span className="font-mono text-[12px]">{viewing?.label ?? "—"}</span>
+          <ChevronDown size={13} className={`text-ink-tertiary transition-transform ${open ? "rotate-180" : ""}`} />
+        </button>
+
+        {open && (
+          <div
+            role="menu"
+            className="absolute left-0 top-full z-40 mt-1.5 w-72 overflow-hidden rounded-lg border border-line bg-surface shadow-lg"
+          >
+            <ul className="max-h-72 overflow-y-auto py-1">
+              {completed.map((s) => {
+                const isCurrent = current?.id === s.id;
+                const isSelected = viewing?.id === s.id;
+                return (
+                  <li key={s.id}>
+                    <button
+                      type="button"
+                      role="menuitem"
+                      onClick={() => {
+                        setOpen(false);
+                        onViewJob(isCurrent ? null : { id: s.id, label: s.commit_sha?.slice(0, 7) ?? s.id.slice(0, 8) });
+                      }}
+                      className={`flex w-full items-center gap-2 px-3 py-2 text-left transition-colors hover:bg-surface-sunken ${
+                        isSelected ? "bg-surface-sunken" : ""
+                      }`}
+                    >
+                      <span className="font-mono text-[12px] text-ink">
+                        {s.commit_sha ? shortSha(s.commit_sha) : "—"}
+                      </span>
+                      <span className="text-[12px] text-ink-tertiary">{s.findings_so_far} findings</span>
+                      <span className="ml-auto font-mono text-[11px] text-ink-tertiary">
+                        {formatRelativeTime(s.created_at)}
+                      </span>
+                    </button>
+                  </li>
+                );
+              })}
+              {completed.length === 0 && (
+                <li className="px-3 py-3 text-center text-[12px] text-ink-tertiary">No completed scans yet</li>
+              )}
+            </ul>
+          </div>
+        )}
+      </div>
+
+      {/* 进行中状态 + Cancel */}
+      {inflight && (
+        <span className="inline-flex h-8 items-center gap-1.5 rounded-full border border-running/30 bg-running-bg px-3 text-running-ink">
+          <LoaderCircle size={13} className="animate-spin" />
+          <span className="text-[12px] font-medium capitalize">{inflight.state}</span>
+          {inflight.state === "scanning" && (
+            <span className="text-[12px]">{inflight.findings_so_far} so far</span>
+          )}
+          {(inflight.state === "queued" || inflight.state === "scanning") && (
+            <button
+              type="button"
+              onClick={() => setCancelTarget(inflight)}
+              className="ml-0.5 inline-flex items-center gap-0.5 rounded-full px-1.5 py-0.5 text-[11px] text-ink-secondary transition-colors hover:text-danger"
+              title="Cancel this scan"
+            >
+              <Ban size={11} /> Cancel
+            </button>
+          )}
+        </span>
+      )}
+
+      <ConfirmDialog
+        open={cancelTarget !== null}
+        title="Cancel this scan?"
+        body={`The ${cancelTarget?.state === "scanning" ? "running" : "queued"} scan will be stopped and its VulnHunter slot released. This version can be resubmitted later.`}
+        confirmLabel="Cancel scan"
+        danger
+        busy={cancelM.isPending}
+        onConfirm={() => cancelTarget && cancelM.mutate(cancelTarget.id)}
+        onCancel={() => setCancelTarget(null)}
+      />
+    </div>
+  );
+}

src/features/submit/SubmitPage.tsx

@@ -0,0 +1,78 @@
+import { Link } from "react-router-dom";
+import { ArrowLeft, Github } from "lucide-react";
+import { RepoSubmitForm } from "../../components/RepoSubmitForm";
+import { loginUrl, navigateToLogin } from "../../shared/api/client";
+import { useMe } from "../../features/auth/useAuth";
+
+export function SubmitPage() {
+  const meQ = useMe();
+  const authed = meQ.data?.authenticated === true;
+
+  return (
+    <div className="mx-auto max-w-6xl px-6 py-8">
+      <Link
+        to="/"
+        className="inline-flex items-center gap-1.5 text-[13px] text-ink-secondary hover:text-ink"
+      >
+        <ArrowLeft size={14} /> Projects
+      </Link>
+      <div className="max-w-xl">
+      <h1 className="mt-4 font-display text-xl font-bold text-ink">Submit a project</h1>
+      <p className="mt-2 text-sm text-ink-secondary">
+        Paste a public GitHub repository URL. We scan the default branch and publish aggregate
+        statistics. Submitting requires a GitHub account with <strong className="font-medium text-ink">admin or maintain</strong> permission
+        on the repository.
+      </p>
+
+      <div className="mt-8">
+        {meQ.isLoading ? (
+          <div className="h-12 animate-pulse rounded-lg bg-surface-sunken" aria-label="Loading" />
+        ) : authed ? (
+          <RepoSubmitForm />
+        ) : (
+          <div className="rounded-xl border border-line bg-surface-sunken/50 p-6 text-center">
+            <p className="font-display text-base font-semibold text-ink">
+              Sign in to submit your repository
+            </p>
+            <p className="mx-auto mt-2 max-w-md text-sm leading-relaxed text-ink-secondary">
+              OpenVuln scans are available to repository owners. We verify your GitHub role on
+              every submission — only maintainers and admins can start a scan.
+            </p>
+            <a
+              href={loginUrl("/submit")}
+              onClick={(e) => {
+                if (window.top && window.top !== window.self) {
+                  e.preventDefault();
+                  navigateToLogin("/submit");
+                  window.dispatchEvent(new Event("ov-oauth-popup-opened"));
+                }
+              }}
+              className="mt-5 inline-flex h-10 items-center gap-2 rounded-md bg-[#ebecf0] px-4 text-sm font-medium text-[#0d0d0f] transition-colors hover:bg-white focus-ring"
+            >
+              <Github size={16} />
+              Sign in with GitHub
+            </a>
+          </div>
+        )}
+      </div>
+
+      <section className="mt-12 border-t border-line pt-8">
+        <h2 className="font-display text-base font-semibold text-ink">What happens next</h2>
+        <ol className="mt-4 space-y-3 text-sm text-ink-secondary">
+          {[
+            "We verify your GitHub role on the repository (admin or maintain)",
+            "It enters the scan queue",
+            "VulnHunter scans the default branch",
+            "You review full findings and choose what to disclose publicly",
+          ].map((step, i) => (
+            <li key={step} className="flex gap-3">
+              <span className="font-mono text-ink-tertiary">{i + 1}</span>
+              <span>{step}</span>
+            </li>
+          ))}
+        </ol>
+      </section>
+      </div>
+    </div>
+  );
+}

src/index.css

@@ -0,0 +1,161 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+@layer base {
+  /* 深色体系：原生控件（select 弹层/滚动条/checkbox）跟随深色 */
+  :root {
+    color-scheme: dark;
+  }
+
+  html,
+  body,
+  #root {
+    min-height: 100%;
+  }
+
+  select option {
+    background-color: #111216;
+    color: #f0f2f6;
+  }
+
+  body {
+    @apply bg-surface text-ink font-sans;
+  }
+
+  ::selection {
+    background: rgba(40, 209, 255, 0.24);
+    color: #f0f2f6;
+  }
+}
+
+@layer utilities {
+  .focus-ring {
+    @apply focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-white/50 focus-visible:ring-offset-2 focus-visible:ring-offset-black;
+  }
+
+  .focus-ring-dark {
+    @apply focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-black;
+  }
+
+  .text-balance {
+    text-wrap: balance;
+  }
+}
+
+@layer components {
+  .openvuln-home {
+    font-family:
+      -apple-system,
+      BlinkMacSystemFont,
+      "Segoe UI",
+      Roboto,
+      "Helvetica Neue",
+      Arial,
+      "Noto Sans",
+      sans-serif,
+      "Apple Color Emoji",
+      "Segoe UI Emoji",
+      "Segoe UI Symbol",
+      "Noto Color Emoji";
+  }
+
+  .openvuln-title {
+    color: #f1f1f3;
+  }
+
+  .openvuln-glow {
+    background: radial-gradient(ellipse 48% 38% at 50% 18%, rgba(255, 255, 255, 0.055), transparent 72%);
+  }
+
+  .openvuln-home::after {
+    position: absolute;
+    inset: 0;
+    z-index: -1;
+    content: "";
+    pointer-events: none;
+    opacity: 0.04;
+    background-image: url("data:image/svg+xml,%3Csvg viewBox='0 0 180 180' xmlns='http://www.w3.org/2000/svg'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' baseFrequency='.8' numOctaves='3' stitchTiles='stitch'/%3E%3C/filter%3E%3Crect width='100%25' height='100%25' filter='url(%23n)' opacity='.12'/%3E%3C/svg%3E");
+  }
+
+  .openvuln-brand {
+    animation: openvuln-enter 700ms cubic-bezier(0.22, 1, 0.36, 1) both;
+  }
+
+  .openvuln-composer {
+    animation: openvuln-enter 760ms 90ms cubic-bezier(0.22, 1, 0.36, 1) both;
+  }
+
+  .openvuln-panel {
+    border: 1px solid rgba(255, 255, 255, 0.08);
+    border-radius: 26px;
+    background:
+      linear-gradient(145deg, rgba(255, 255, 255, 0.035), rgba(255, 255, 255, 0.012)),
+      rgba(16, 17, 21, 0.82);
+    box-shadow: 0 24px 80px rgba(0, 0, 0, 0.22);
+    backdrop-filter: blur(18px);
+  }
+
+  .openvuln-scrollbar {
+    scrollbar-width: thin;
+    scrollbar-color: rgba(255, 255, 255, 0.2) transparent;
+  }
+
+  .openvuln-scrollbar::-webkit-scrollbar {
+    width: 6px;
+  }
+
+  .openvuln-scrollbar::-webkit-scrollbar-track {
+    background: transparent;
+  }
+
+  .openvuln-scrollbar::-webkit-scrollbar-thumb {
+    border-radius: 999px;
+    background: rgba(255, 255, 255, 0.2);
+  }
+}
+
+@keyframes openvuln-enter {
+  from {
+    opacity: 0;
+    transform: translateY(12px) scale(0.99);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0) scale(1);
+  }
+}
+
+@keyframes live-scan-sweep {
+  from {
+    transform: translateX(-105%);
+  }
+  to {
+    transform: translateX(305%);
+  }
+}
+
+.live-scan-sweep {
+  animation: live-scan-sweep 2.4s ease-in-out infinite;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .openvuln-brand,
+  .openvuln-composer {
+    animation: none;
+  }
+
+  .live-scan-sweep {
+    animation: none;
+    transform: translateX(200%);
+  }
+}
+
+body.openvuln-running {
+  overflow: hidden;
+  background: #000;
+}
+
+body.openvuln-running .app-shell-chrome {
+  display: none;
+}

src/main.tsx

@@ -0,0 +1,10 @@
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+import "./index.css";
+import { App } from "./App";
+
+createRoot(document.getElementById("root")!).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+);

src/shared/api/client.ts

@@ -0,0 +1,255 @@
+import type {
+  DisclosureState,
+  ProjectCard,
+  ScanJobState,
+  OverviewStats,
+  ProjectListResponse,
+  ProjectPublicView,
+  Severity,
+  SubmitProjectRequest,
+  SubmitProjectResponse,
+} from "@/shared/types";
+
+export class ApiError extends Error {
+  constructor(
+    public status: number,
+    public code: string,
+    message: string,
+    public context?: Record<string, unknown>,
+  ) {
+    super(message);
+    this.name = "ApiError";
+  }
+}
+
+/**
+ * Build-time API origin via `VITE_API_BASE_URL` (no trailing slash).
+ * Default empty → same-origin relative `/api/...`.
+ * Cross-origin deploy example:
+ *   VITE_API_BASE_URL=https://openvuln.clouditera.com pnpm --filter @openvuln/web build
+ */
+const API_BASE = (import.meta.env.VITE_API_BASE_URL ?? "").replace(/\/$/, "");
+
+/** Absolute or root-relative URL for API paths and download links. */
+export function apiUrl(path: string): string {
+  const p = path.startsWith("/") ? path : `/${path}`;
+  return `${API_BASE}${p}`;
+}
+
+async function request<T>(path: string, init?: RequestInit): Promise<T> {
+  const res = await fetch(apiUrl(path), {
+    credentials: "include",
+    ...init,
+    headers: {
+      ...(init?.body ? { "content-type": "application/json" } : {}),
+      ...init?.headers,
+    },
+  });
+
+  if (!res.ok) {
+    let code = "ERR_UNKNOWN";
+    let summary = res.statusText;
+    let context: Record<string, unknown> | undefined;
+    try {
+      const body = (await res.json()) as {
+        error?: { code?: string; summary?: string; context?: Record<string, unknown> };
+      };
+      code = body.error?.code ?? code;
+      summary = body.error?.summary ?? summary;
+      context = body.error?.context;
+    } catch {
+      /* ignore */
+    }
+    throw new ApiError(res.status, code, summary, context);
+  }
+
+  if (res.status === 204) return undefined as T;
+  return (await res.json()) as T;
+}
+
+
+/* ── Auth + owner self-service (design: docs/auth-owner-selfservice-design.md) ── */
+
+export interface MeResponse {
+  authenticated: boolean;
+  user: { id: number; login: string; avatar_url: string | null } | null;
+}
+
+/** GitHub OAuth login URL (full-page redirect). */
+export function loginUrl(returnTo: string): string {
+  // 站内相对路径与白名单绝对地址（HF 部署回跳）都放行 —— 白名单校验在后端；
+  // 仅协议相对 "//…" 一律拒绝（开放重定向的唯一真风险）。
+  const safe = returnTo.startsWith("//") ? "/" : returnTo;
+  return apiUrl(`/api/auth/github/login?return_to=${encodeURIComponent(safe)}`);
+}
+
+/** 是否在 iframe 嵌套环境（HF Space 嵌入页；GitHub x-frame-options:deny，iframe 内跳 OAuth 必死）。 */
+export function isEmbedded(): boolean {
+  try {
+    return window.self !== window.top;
+  } catch {
+    return true;
+  }
+}
+
+/**
+ * 当前页作为 OAuth return_to：跨域部署（HF 静态站，API_BASE 与页面不同源）必须给
+ * 本站绝对地址（后端白名单已放行），授权完才回得来；同源部署（clouditera）用相对路径。
+ */
+export function currentReturnTo(): string {
+  const rel = window.location.pathname + window.location.search;
+  if (API_BASE && new URL(API_BASE).origin !== window.location.origin) {
+    return window.location.origin + rel;
+  }
+  return rel;
+}
+
+/**
+ * Navigate to OAuth login.
+ * - iframe (HF Space hub): open popup window (sandbox blocks top navigation)
+ * - direct access (clouditera / HF subdomain): redirect current page
+ */
+export function navigateToLogin(returnTo: string = currentReturnTo()): void {
+  const url = loginUrl(returnTo);
+  if (isEmbedded()) {
+    // Must call window.open synchronously in click handler to avoid popup blocker
+    const popup = window.open(url, "ov-oauth", "width=600,height=700");
+    if (!popup) {
+      // Popup blocked — fall back to top navigation (may work on some platforms)
+      if (window.top) window.top.location.href = url;
+    }
+  } else {
+    window.location.href = url;
+  }
+}
+
+/** Popup OAuth callback return_to path. */
+export const POPUP_CALLBACK_PATH = "/auth/popup-callback";
+
+/** return_to for popup flow: always the API origin + callback path.
+ *  The callback page MUST run on the API domain (clouditera), not the HF Space domain,
+ *  so that /api/me fetch is first-party (cookie works) rather than third-party (blocked).
+ */
+export function popupReturnTo(): string {
+  return `${API_BASE}${POPUP_CALLBACK_PATH}`;
+}
+
+/** Navigate to OAuth login in popup (for embedded/iframe context). */
+export function navigateToLoginPopup(): void {
+  const url = loginUrl(popupReturnTo());
+  window.open(url, "ov-oauth", "width=600,height=700");
+}
+
+export interface OwnerFindingSummary {
+  id: string;
+  finding_key: string;
+  severity: Severity;
+  title: string;
+  cwe: string | null;
+  primary_file: string | null;
+  disclosure_state: DisclosureState;
+  detail_json: unknown;
+  report_yaml: string | null;
+  cvss_score: number | null;
+  poc_status: string | null;
+}
+
+export interface OwnerArtifact {
+  kind: string;
+  rel_path: string;
+  file_name: string;
+  mime: string | null;
+  size_bytes: number;
+  truncated: boolean;
+  is_binary: boolean;
+  has_content: boolean;
+}
+
+export interface OwnerFindingDetail extends OwnerFindingSummary {
+  report: {
+    metadata?: Record<string, unknown>;
+    description?: Record<string, unknown>;
+    code?: Record<string, unknown>;
+    references?: unknown;
+  } | null;
+  artifacts: OwnerArtifact[];
+}
+
+
+/* ── 站内通知（task-78c9fb3a，契约以 architect 简案为准） ── */
+
+export interface NotificationItem {
+  id: string;
+  type: string; // v1: "scan_completed"
+  payload: {
+    project_id: string;
+    full_name: string;
+    scan_job_id: string;
+    counts: { critical: number; high: number; medium: number; low: number };
+    no_value: boolean;
+  };
+  read_at: string | null;
+  created_at: string;
+}
+
+export interface ScanJobSummary {
+  id: string;
+  state: ScanJobState;
+  commit_sha: string | null;
+  git_ref: string | null;
+  findings_so_far: number;
+  created_at: string;
+  finished_at: string | null;
+}
+
+export const api = {
+  overview: () => request<OverviewStats>("/api/stats/overview"),
+  listProjects: (params?: { sort?: string; page?: number; page_size?: number }) => {
+    const q = new URLSearchParams();
+    if (params?.sort) q.set("sort", params.sort);
+    if (params?.page) q.set("page", String(params.page));
+    if (params?.page_size) q.set("page_size", String(params.page_size));
+    const qs = q.toString();
+    return request<ProjectListResponse>(`/api/projects${qs ? `?${qs}` : ""}`);
+  },
+  getProject: (owner: string, repo: string) =>
+    request<ProjectPublicView>(
+      `/api/projects/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`,
+    ),
+  submitProject: (body: SubmitProjectRequest) =>
+    request<SubmitProjectResponse>("/api/projects", {
+      method: "POST",
+      body: JSON.stringify(body),
+    }),
+  me: () => request<MeResponse>("/api/me"),
+  logout: () => request<void>("/api/auth/logout", { method: "POST" }),
+  ownerFindings: (projectId: string, scanJobId?: string) =>
+    request<{ project_id: string; findings: OwnerFindingSummary[] }>(
+      `/api/projects/${projectId}/findings${scanJobId ? `?scan_job_id=${scanJobId}` : ""}`,
+    ),
+  ownerFinding: (projectId: string, key: string, scanJobId?: string) =>
+    request<{ finding: OwnerFindingDetail }>(
+      `/api/projects/${projectId}/findings/${encodeURIComponent(key)}${scanJobId ? `?scan_job_id=${scanJobId}` : ""}`,
+    ),
+  ownerDisclose: (projectId: string, findingIds: string[]) =>
+    request<{ disclosed_count: number }>(`/api/projects/${projectId}/disclose`, {
+      method: "POST",
+      body: JSON.stringify({ finding_ids: findingIds }),
+    }),
+  notifications: (limit = 20) =>
+    request<{ notifications: NotificationItem[]; unread_count: number }>(
+      `/api/notifications?limit=${limit}`,
+    ),
+  markNotificationsRead: (ids: string[]) =>
+    request<void>("/api/notifications/read", { method: "POST", body: JSON.stringify({ ids }) }),
+  markAllNotificationsRead: () =>
+    request<void>("/api/notifications/read-all", { method: "POST" }),
+  myProjects: () => request<{ projects: ProjectCard[] }>("/api/my/projects"),
+  projectScans: (projectId: string) =>
+    request<{ scans: ScanJobSummary[] }>(`/api/projects/${projectId}/scans`),
+  cancelScanJob: (projectId: string, jobId: string) =>
+    request<{ ok: true; state: string }>(
+      `/api/projects/${projectId}/scan-jobs/${jobId}/cancel`,
+      { method: "POST" },
+    ),
+};

src/shared/lib/format.ts

@@ -0,0 +1,49 @@
+import type { Severity, SeverityCounts } from "@/shared/types";
+
+export function formatStars(n: number): string {
+  if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(1).replace(/\.0$/, "")}M`;
+  if (n >= 1_000) return `${(n / 1_000).toFixed(1).replace(/\.0$/, "")}k`;
+  return String(n);
+}
+
+export function formatRelativeTime(iso: string | null | undefined): string {
+  if (!iso) return "—";
+  const then = new Date(iso).getTime();
+  if (Number.isNaN(then)) return "—";
+  const diffSec = Math.round((then - Date.now()) / 1000);
+  const rtf = new Intl.RelativeTimeFormat("en", { numeric: "auto" });
+  const abs = Math.abs(diffSec);
+  if (abs < 60) return rtf.format(diffSec, "second");
+  const diffMin = Math.round(diffSec / 60);
+  if (Math.abs(diffMin) < 60) return rtf.format(diffMin, "minute");
+  const diffHr = Math.round(diffMin / 60);
+  if (Math.abs(diffHr) < 48) return rtf.format(diffHr, "hour");
+  const diffDay = Math.round(diffHr / 24);
+  if (Math.abs(diffDay) < 60) return rtf.format(diffDay, "day");
+  const diffMo = Math.round(diffDay / 30);
+  return rtf.format(diffMo, "month");
+}
+
+export function formatDate(iso: string | null | undefined): string {
+  if (!iso) return "—";
+  return new Date(iso).toLocaleDateString("en-US", {
+    year: "numeric",
+    month: "short",
+    day: "numeric",
+  });
+}
+
+export function shortSha(sha: string | null | undefined): string {
+  if (!sha) return "—";
+  return sha.slice(0, 7);
+}
+
+export function totalFindings(c: SeverityCounts): number {
+  return c.critical + c.high + c.medium + c.low;
+}
+
+export const SEV_ORDER: Severity[] = ["critical", "high", "medium", "low"];
+
+export function severityLabel(s: Severity): string {
+  return s.charAt(0).toUpperCase() + s.slice(1);
+}

src/shared/types.ts

@@ -0,0 +1,145 @@
+export type Severity = "critical" | "high" | "medium" | "low";
+
+export type SeverityCounts = Record<Severity, number>;
+
+export type ScanJobState =
+  | "queued"
+  | "dispatching"
+  | "scanning"
+  | "completed"
+  | "failed"
+  | "cancelled";
+
+export type DisclosureState = "owner_only" | "disclosed";
+
+export interface ProjectCard {
+  id: string;
+  owner_login: string;
+  name: string;
+  full_name: string;
+  html_url: string;
+  description: string | null;
+  language: string | null;
+  stars: number;
+  default_branch: string;
+  latest_scan: {
+    id: string;
+    state: ScanJobState;
+    commit_sha: string | null;
+    created_at: string;
+    finished_at: string | null;
+    findings_so_far?: number;
+  } | null;
+  severity_counts: SeverityCounts;
+  created_at: string;
+}
+
+export interface ProjectListResponse {
+  items: ProjectCard[];
+  page: number;
+  page_size: number;
+  total: number;
+}
+
+export interface CweCount {
+  cwe: string;
+  count: number;
+}
+
+export interface DisclosedFindingSummary {
+  id: string;
+  finding_key: string;
+  severity: Severity;
+  title: string;
+  cwe: string | null;
+  disclosed_at: string | null;
+  summary?: string | null;
+  report?: {
+    metadata: Record<string, unknown>;
+    description: Record<string, unknown>;
+    code: Record<string, unknown>;
+    references: unknown;
+  } | null;
+}
+
+export interface ProjectPublicView {
+  id: string;
+  owner_login: string;
+  name: string;
+  full_name: string;
+  html_url: string;
+  description: string | null;
+  language: string | null;
+  stars: number;
+  default_branch: string;
+  latest_scan: {
+    id: string;
+    state: ScanJobState;
+    commit_sha: string | null;
+    created_at: string;
+    started_at: string | null;
+    finished_at: string | null;
+    findings_so_far?: number;
+  } | null;
+  severity_counts: SeverityCounts;
+  cwe_distribution: CweCount[];
+  disclosed_findings: DisclosedFindingSummary[];
+  created_at: string;
+}
+
+export interface SubmitProjectRequest {
+  git_url: string;
+  ref?: string;
+}
+
+export interface SubmitProjectResponse {
+  project: ProjectCard;
+}
+
+export interface TrendDay {
+  date: string;
+  critical: number;
+  high: number;
+  medium: number;
+  low: number;
+}
+
+export interface CweTopItem {
+  cwe: string;
+  name: string | null;
+  count: number;
+}
+
+export interface LiveScanItem {
+  project_id: string;
+  full_name: string;
+  state: "scanning" | "dispatching";
+  elapsed_sec: number;
+  findings_so_far: number;
+}
+
+export interface RecentActivityItem {
+  ts: string;
+  type: "scan_completed" | "project_submitted" | "scan_failed" | "disclosed";
+  text: string;
+  full_name?: string;
+  meta?: string;
+}
+
+export interface OverviewStats {
+  project_count: number;
+  scanned_project_count?: number;
+  scan_completed_count: number;
+  scan_failed_count: number;
+  scan_in_progress_count: number;
+  finding_total: number;
+  finding_disclosed_count: number;
+  severity_counts: SeverityCounts;
+  trend?: TrendDay[];
+  cwe_top?: CweTopItem[];
+  live?: {
+    scanning: LiveScanItem[];
+    queued_count: number;
+  };
+  recent?: RecentActivityItem[];
+}

src/vite-env.d.ts

@@ -0,0 +1,14 @@
+/// <reference types="vite/client" />
+
+interface ImportMetaEnv {
+  /** API origin, no trailing slash. Empty/unset = same-origin `/api`. */
+  readonly VITE_API_BASE_URL?: string;
+  /** Local Vite development proxy target. */
+  readonly VITE_API_PROXY?: string;
+  /** Source repository linked from the interface. */
+  readonly VITE_GITHUB_REPO_URL?: string;
+}
+
+interface ImportMeta {
+  readonly env: ImportMetaEnv;
+}

tailwind.config.js

@@ -0,0 +1,56 @@
+/** @type {import('tailwindcss').Config} */
+export default {
+  content: ["./index.html", "./src/**/*.{js,ts,jsx,tsx}"],
+  theme: {
+    extend: {
+      colors: {
+        // ── 深色视觉语言（对齐协作者着陆页，task-5ee34751 fish 定稿）──
+        surface: {
+          DEFAULT: "#000000",   // 页面底（openvuln-home bg-black）
+          raised: "#111216",    // 卡片（composer bg）
+          sunken: "#15161b",    // 井/hover（focus-within bg）
+          header: "#030303",    // 顶栏（pill bg）
+        },
+        line: "#26272c",        // 分隔线/边框（#26272c ~ #2f3037）
+        ink: {
+          DEFAULT: "#f0f2f6",   // 主文字
+          secondary: "#acacb0", // 次文字
+          tertiary: "#696a70",  // 辅助/placeholder
+        },
+        // 交互蓝：深色底链接/聚焦/进行中（Clouditera 规范深底 accent）
+        accent: {
+          50: "rgba(40, 209, 255, 0.10)",
+          100: "rgba(40, 209, 255, 0.16)",
+          200: "rgba(40, 209, 255, 0.28)",
+          600: "#28D1FF",  // 深底主色（原 accent-dark）
+          700: "#5CDDFF",  // hover 亮一档
+          800: "#8AE6FF",
+        },
+        // 功能色深底版：亮 ink + 半透明 bg，bar 用亮色
+        sev: {
+          critical: { ink: "#FF6B6B", bg: "rgba(242, 79, 79, 0.16)", bar: "#F24F4F" },
+          high:     { ink: "#F24F4F", bg: "rgba(242, 79, 79, 0.12)", bar: "#F24F4F" },
+          medium:   { ink: "#FF8A5C", bg: "rgba(255, 115, 60, 0.13)", bar: "#FF733C" },
+          low:      { ink: "#F7C530", bg: "rgba(247, 197, 48, 0.12)", bar: "#F7C530" },
+          // info：VH 兜底档，公众 UI 不展示，仅防御保留
+          info:     { ink: "#acacb0", bg: "rgba(172, 172, 176, 0.10)", bar: "#696a70" },
+        },
+        ai: { DEFAULT: "#9285FF", bg: "rgba(146, 133, 255, 0.13)", ink: "#A79DFF" }, // AI 紫（深底）
+        success: { DEFAULT: "#3AD186", bg: "rgba(58, 209, 134, 0.12)", ink: "#3AD186" },
+        danger: "#F24F4F",
+        warning: "#FF733C",
+        running: { DEFAULT: "#28D1FF", bg: "rgba(40, 209, 255, 0.12)", ink: "#28D1FF" },
+      },
+      fontFamily: {
+        // 协作者体系：系统字栈（着陆页 openvuln-home 同族）
+        display: ['-apple-system', 'BlinkMacSystemFont', '"Segoe UI"', 'Roboto', '"Helvetica Neue"', 'Arial', '"Noto Sans"', '"PingFang SC"', '"Microsoft YaHei"', 'sans-serif'],
+        sans: ['-apple-system', 'BlinkMacSystemFont', '"Segoe UI"', 'Roboto', '"Helvetica Neue"', 'Arial', '"Noto Sans"', '"PingFang SC"', '"Microsoft YaHei"', 'sans-serif'],
+        mono: ["ui-monospace", "SFMono-Regular", "Menlo", "Consolas", "monospace"],
+      },
+      maxWidth: {
+        "6xl": "72rem",
+      },
+    },
+  },
+  plugins: [],
+};

tsconfig.json

@@ -0,0 +1,25 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "isolatedModules": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedSideEffectImports": true,
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["src/*"]
+    }
+  },
+  "include": ["src"]
+}

vite.config.ts

@@ -0,0 +1,31 @@
+import { resolve } from "node:path";
+import react from "@vitejs/plugin-react";
+import { defineConfig, loadEnv } from "vite";
+
+export default defineConfig(({ mode }) => {
+  const env = loadEnv(mode, process.cwd(), "");
+  const apiProxy = env.VITE_API_PROXY || "http://127.0.0.1:7860";
+
+  return {
+    plugins: [react()],
+    resolve: {
+      alias: {
+        "@": resolve(__dirname, "src"),
+      },
+    },
+    server: {
+      host: "0.0.0.0",
+      port: 5173,
+      proxy: {
+        "/api": {
+          target: apiProxy,
+          changeOrigin: true,
+        },
+        "/health": {
+          target: apiProxy,
+          changeOrigin: true,
+        },
+      },
+    },
+  };
+});