feat: Full Clerk Google OAuth + user profiles + combined API/Worker deploy

- Pull remote hero page redesign with AutopilotSimulator
- Integrate Clerk auth into new wide layout (maxWidth: 1200)
- Add conditional hero CTAs: Get Started (sign in) vs Start Mission
- Create AuthTokenProvider for Clerk JWT in API requests
- Add email, avatarUrl, phone, fullName to users table (migration 0011)
- Create AuthModule with ClerkAuthGuard, CurrentUser decorator, AuthService
- Auto-create/link users on first API call via Google OAuth
- Scope all missions to authenticated user (no more demo user)
- Create UsersModule with /users/me, /users/me/missions endpoints
- Create Sarkari Calm profile page with editable phone/language
- Combine API + Inngest Worker in one HF Spaces container
- Update Dockerfile.hf for combined deployment
- Add DEMO_MODE env flag for local dev without Clerk keys
- Verify pnpm build + pnpm typecheck pass

.mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "shadcn": {
+      "command": "npx",
+      "args": [
+        "shadcn@latest",
+        "mcp"
+      ]
+    }
+  }
+}

.playwright-mcp/page-2026-05-29T16-34-02-219Z.yml

@@ -0,0 +1,35 @@
+- generic [active] [ref=e1]:
+  - banner [ref=e2]:
+    - generic [ref=e3]:
+      - link "CourtMitra MissionOS" [ref=e4] [cursor=pointer]:
+        - /url: /en
+        - generic [ref=e5]: CourtMitra
+        - generic [ref=e6]: MissionOS
+      - navigation [ref=e7]:
+        - link "Ledger" [ref=e8] [cursor=pointer]:
+          - /url: /en/ledger
+        - generic "Language switcher" [ref=e10]:
+          - button "EN" [ref=e11] [cursor=pointer]
+          - button "हिंदी" [ref=e12] [cursor=pointer]
+  - main [ref=e13]:
+    - generic [ref=e14]:
+      - generic [ref=e16]:
+        - generic [ref=e17]: CourtMitra · Phase 1
+        - heading "Fight for your rights — automatically" [level=1] [ref=e18]
+        - paragraph [ref=e19]: Describe your problem once. CourtMitra builds the evidence file, finds the right authority, drafts and sends the complaint, and follows up until you get a resolution.
+        - generic [ref=e20]:
+          - button "Start a new mission" [ref=e21] [cursor=pointer]
+          - link "See what others resolved" [ref=e22] [cursor=pointer]:
+            - /url: /en/ledger
+      - generic [ref=e23]:
+        - generic [ref=e24]:
+          - heading "My Missions" [level=2] [ref=e25]
+          - button "+ Start a Mission" [ref=e26] [cursor=pointer]
+        - generic [ref=e27]:
+          - textbox "Search missions…" [ref=e28]
+          - generic [ref=e29]:
+            - button "All" [ref=e30] [cursor=pointer]
+            - button "consumer" [ref=e31] [cursor=pointer]
+            - button "payment" [ref=e32] [cursor=pointer]
+            - button "cyber fraud" [ref=e33] [cursor=pointer]
+  - region "Notifications alt+T"

.playwright-mcp/page-2026-05-29T16-34-44-022Z.yml

@@ -0,0 +1,78 @@
+- generic [active] [ref=e1]:
+  - banner [ref=e2]:
+    - generic [ref=e3]:
+      - link "CourtMitra MissionOS" [ref=e4] [cursor=pointer]:
+        - /url: /en
+        - generic [ref=e5]: CourtMitra
+        - generic [ref=e6]: MissionOS
+      - navigation [ref=e7]:
+        - link "Ledger" [ref=e8] [cursor=pointer]:
+          - /url: /en/ledger
+        - generic "Language switcher" [ref=e10]:
+          - button "EN" [ref=e11] [cursor=pointer]
+          - button "हिंदी" [ref=e12] [cursor=pointer]
+  - main [ref=e13]:
+    - generic [ref=e14]:
+      - generic [ref=e15]:
+        - generic [ref=e16]:
+          - link "← All missions" [ref=e17] [cursor=pointer]:
+            - /url: /
+          - heading "Test smoke mission" [level=1] [ref=e18]
+          - generic [ref=e19]:
+            - generic [ref=e20]: consumer
+            - generic [ref=e21]: created
+        - generic [ref=e22]:
+          - button "⬤ Timeline 1" [ref=e23] [cursor=pointer]:
+            - generic [ref=e24]: ⬤
+            - text: Timeline
+            - generic [ref=e25]: "1"
+          - button "Refresh" [ref=e26] [cursor=pointer]
+      - navigation "Journey progress" [ref=e28]:
+        - button "1 Describe" [ref=e30] [cursor=pointer]:
+          - generic [ref=e31]: "1"
+          - generic [ref=e32]: Describe
+        - button "2 Facts" [disabled] [ref=e35]:
+          - generic [ref=e36]: "2"
+          - generic [ref=e37]: Facts
+        - button "3 Route" [disabled] [ref=e40]:
+          - generic [ref=e41]: "3"
+          - generic [ref=e42]: Route
+        - button "4 Action" [disabled] [ref=e45]:
+          - generic [ref=e46]: "4"
+          - generic [ref=e47]: Action
+        - button "5 Follow-up" [disabled] [ref=e50]:
+          - generic [ref=e51]: "5"
+          - generic [ref=e52]: Follow-up
+        - button "6 Outcome" [disabled] [ref=e55]:
+          - generic [ref=e56]: "6"
+          - generic [ref=e57]: Outcome
+      - generic [ref=e59]:
+        - generic [ref=e61]: Mission created — let's gather the details.
+        - generic [ref=e62]:
+          - generic [ref=e63]: Your next step
+          - text: Describe what happened and upload any evidence.
+        - generic [ref=e64]:
+          - generic [ref=e65]: "System will:"
+          - text: Run intake to structure your grievance.
+      - generic [ref=e66]:
+        - tablist [ref=e67]:
+          - tab "Describe" [selected] [ref=e68] [cursor=pointer]
+          - tab "Facts" [ref=e69] [cursor=pointer]
+          - tab "Route" [ref=e70] [cursor=pointer]
+          - tab "Action" [ref=e71] [cursor=pointer]
+          - tab "Follow-up" [ref=e72] [cursor=pointer]
+          - tab "Outcome" [ref=e73] [cursor=pointer]
+        - tabpanel "Describe" [ref=e74]:
+          - heading "Describe your problem" [level=2] [ref=e75]
+          - paragraph [ref=e76]: Tell us what happened in your own words.
+          - generic [ref=e77]:
+            - generic [ref=e78]:
+              - generic [ref=e79]: Title
+              - generic [ref=e80]: Test smoke mission
+            - generic [ref=e82]:
+              - generic [ref=e83]: Domain
+              - generic [ref=e84]: consumer
+            - generic [ref=e85]: Created 29 May 2026, 6:26 pm
+      - generic [ref=e86]: Legal information & workflow assistance only — not a lawyer-client relationship. CourtMitra does not guarantee outcomes.
+  - region "Notifications alt+T"
+  - alert [ref=e87]

.playwright-mcp/page-2026-05-29T16-35-07-854Z.yml

@@ -0,0 +1,78 @@
+- generic [active] [ref=e1]:
+  - banner [ref=e2]:
+    - generic [ref=e3]:
+      - link "CourtMitra MissionOS" [ref=e4] [cursor=pointer]:
+        - /url: /hi
+        - generic [ref=e5]: CourtMitra
+        - generic [ref=e6]: MissionOS
+      - navigation [ref=e7]:
+        - link "समाधान खाता" [ref=e8] [cursor=pointer]:
+          - /url: /hi/ledger
+        - generic "Language switcher" [ref=e10]:
+          - button "EN" [ref=e11] [cursor=pointer]
+          - button "हिंदी" [ref=e12] [cursor=pointer]
+  - main [ref=e13]:
+    - generic [ref=e14]:
+      - generic [ref=e15]:
+        - generic [ref=e16]:
+          - link "← All missions" [ref=e17] [cursor=pointer]:
+            - /url: /
+          - heading "Test smoke mission" [level=1] [ref=e18]
+          - generic [ref=e19]:
+            - generic [ref=e20]: consumer
+            - generic [ref=e21]: created
+        - generic [ref=e22]:
+          - button "⬤ समयरेखा 1" [ref=e23] [cursor=pointer]:
+            - generic [ref=e24]: ⬤
+            - text: समयरेखा
+            - generic [ref=e25]: "1"
+          - button "Refresh" [ref=e26] [cursor=pointer]
+      - navigation "Journey progress" [ref=e28]:
+        - button "1 विवरण" [ref=e30] [cursor=pointer]:
+          - generic [ref=e31]: "1"
+          - generic [ref=e32]: विवरण
+        - button "2 तथ्य" [disabled] [ref=e35]:
+          - generic [ref=e36]: "2"
+          - generic [ref=e37]: तथ्य
+        - button "3 मार्ग" [disabled] [ref=e40]:
+          - generic [ref=e41]: "3"
+          - generic [ref=e42]: मार्ग
+        - button "4 कार्रवाई" [disabled] [ref=e45]:
+          - generic [ref=e46]: "4"
+          - generic [ref=e47]: कार्रवाई
+        - button "5 अनुवर्ती" [disabled] [ref=e50]:
+          - generic [ref=e51]: "5"
+          - generic [ref=e52]: अनुवर्ती
+        - button "6 परिणाम" [disabled] [ref=e55]:
+          - generic [ref=e56]: "6"
+          - generic [ref=e57]: परिणाम
+      - generic [ref=e59]:
+        - generic [ref=e61]: Mission created — let's gather the details.
+        - generic [ref=e62]:
+          - generic [ref=e63]: Your next step
+          - text: Describe what happened and upload any evidence.
+        - generic [ref=e64]:
+          - generic [ref=e65]: "System will:"
+          - text: Run intake to structure your grievance.
+      - generic [ref=e66]:
+        - tablist [ref=e67]:
+          - tab "विवरण" [selected] [ref=e68] [cursor=pointer]
+          - tab "तथ्य" [ref=e69] [cursor=pointer]
+          - tab "मार्ग" [ref=e70] [cursor=pointer]
+          - tab "कार्रवाई" [ref=e71] [cursor=pointer]
+          - tab "अनुवर्ती" [ref=e72] [cursor=pointer]
+          - tab "परिणाम" [ref=e73] [cursor=pointer]
+        - tabpanel "विवरण" [ref=e74]:
+          - heading "अपनी समस्या बताएं" [level=2] [ref=e75]
+          - paragraph [ref=e76]: हमें बताएं कि क्या हुआ, अपने शब्दों में।
+          - generic [ref=e77]:
+            - generic [ref=e78]:
+              - generic [ref=e79]: Title
+              - generic [ref=e80]: Test smoke mission
+            - generic [ref=e82]:
+              - generic [ref=e83]: Domain
+              - generic [ref=e84]: consumer
+            - generic [ref=e85]: Created 29 May 2026, 6:26 pm
+      - generic [ref=e86]: केवल कानूनी जानकारी और कार्यप्रवाह सहायता — यह वकील-मुवक्किल संबंध नहीं है। कोर्टमित्र परिणामों की गारंटी नहीं देता।
+  - region "Notifications alt+T"
+  - alert [ref=e87]

DEPLOY.md

@@ -0,0 +1,285 @@
+# Deployment Guide — CourtMitra MissionOS
+
+> **Target:** Vercel (frontend) + Hugging Face Spaces (backend + worker) + Google OAuth (Clerk) + Neon (Postgres)
+
+---
+
+## Honest Time Estimate
+
+| Milestone | Time |
+|---|---|
+| Clerk setup (Google OAuth) + env vars | **10 min** |
+| Neon Postgres + run migrations | **10 min** |
+| Frontend on Vercel | **5 min** |
+| API + Worker on Hugging Face Spaces | **20–30 min** |
+| Wire frontend → backend + smoke test | **10 min** |
+| **Running frontend + API + Worker + DB + Google Auth** | **~1 hour** (if everything goes smoothly) |
+
+---
+
+## Prerequisites
+
+- GitHub repo pushed and public (or HF Pro for private Spaces)
+- Accounts (all have generous free tiers):
+  - [Vercel](https://vercel.com)
+  - [Clerk](https://clerk.com)
+  - [Hugging Face](https://huggingface.co)
+  - [Neon](https://neon.tech)
+  - [Inngest](https://inngest.com) (optional — for background workflows)
+- OpenRouter API key (or OpenCode / OpenAI key) for LLM calls
+
+---
+
+## Step 1: Clerk + Google OAuth (10 min)
+
+1. Go to [dashboard.clerk.com](https://dashboard.clerk.com) → Create Application.
+2. In the **Social Connections** section, enable **Google**.
+   - For development, use Clerk's shared OAuth credentials (just toggle it on).
+   - For production, add your own Google Client ID/Secret.
+3. Copy your **Publishable Key** and **Secret Key** from Clerk Dashboard → API Keys.
+4. Set these in Vercel (Step 3) and locally:
+   ```
+   NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_...
+   CLERK_SECRET_KEY=sk_test_...
+   NEXT_PUBLIC_CLERK_SIGN_IN_URL=/en/sign-in
+   NEXT_PUBLIC_CLERK_SIGN_UP_URL=/en/sign-up
+   ```
+5. That's it — the frontend has Clerk wired with `SignInButton`, `UserButton`, and `<Show when="signed-in">` components.
+6. **Backend Clerk verification:** The API verifies Clerk JWTs from the `Authorization: Bearer <token>` header. On first API call, it auto-creates a user in the DB and links their Google identity.
+
+---
+
+## Step 2: Neon Postgres (10 min)
+
+1. Go to [neon.tech](https://neon.tech) → New Project → copy the **connection string**.
+2. Save it as `DATABASE_URL` and `DIRECT_DATABASE_URL`.
+3. **Run migrations** against the Neon DB:
+   ```bash
+   # At repo root
+   export DATABASE_URL="postgres://..."
+   export DIRECT_DATABASE_URL="postgres://..."
+   pnpm db:migrate
+   pnpm db:seed
+   ```
+
+---
+
+## Step 3: Frontend → Vercel (5 min)
+
+1. Push this repo to GitHub.
+2. In Vercel → **Add New Project** → import the repo.
+3. Set these **Environment Variables** in the Vercel dashboard:
+   ```
+   NEXT_PUBLIC_API_BASE_URL=https://your-hf-space.hf.space/api
+   NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_...
+   CLERK_SECRET_KEY=sk_test_...
+   NEXT_PUBLIC_CLERK_SIGN_IN_URL=/en/sign-in
+   NEXT_PUBLIC_CLERK_SIGN_UP_URL=/en/sign-up
+   ```
+4. Deploy. Vercel will auto-detect Next.js in `apps/web`.
+
+> **Tip:** `next.config.mjs` already has `output: "standalone"`, so Vercel optimizes automatically.
+
+---
+
+## Step 4: Backend → Hugging Face Spaces (25 min)
+
+### 4a. Create the Space
+
+1. Go to [huggingface.co/spaces](https://huggingface.co/spaces) → **Create new Space**.
+2. **Space name:** `courtmitra-api`
+3. **SDK:** `Docker`
+4. **Visibility:** Public (free tier)
+5. **Hardware:** Free CPU
+
+### 4b. Deploy the Dockerfile
+
+The repo root has `Dockerfile.hf` which builds the monorepo and runs the NestJS API + Inngest Worker in ONE container.
+
+Push it to HF (or link your GitHub repo in HF Space settings):
+
+```bash
+git add Dockerfile.hf
+git commit -m "Add HF Spaces Dockerfile (API + Worker combined)"
+git push origin main
+```
+
+Then in your HF Space → **Settings** → **Repository** → link your GitHub repo.
+
+### 4c. Set Environment Variables
+
+In your HF Space → **Settings** → **Variables & Secrets**:
+
+```
+PORT=7860
+API_PORT=7860
+DATABASE_URL=postgres://... (Neon)
+DIRECT_DATABASE_URL=postgres://... (Neon)
+AI_PROVIDER=openrouter
+OPENROUTER_API_KEY=sk-or-v1-...
+AI_MODEL=google/gemini-2.0-flash-exp:free
+AI_VISION_MODEL=google/gemini-2.0-flash-exp:free
+APP_BASE_URL=https://your-hf-space.hf.space
+API_BASE_URL=https://your-hf-space.hf.space
+WEBHOOK_BASE_URL=https://your-hf-space.hf.space
+LOCAL_STORAGE_DIR=/app/.storage
+JWT_SECRET=hackathon-jwt-secret-change-me
+PII_HASH_SALT=hackathon-salt
+TOKEN_ENCRYPTION_KEY=hackathon-enc-key-min-32-chars!!
+CLERK_SECRET_KEY=sk_test_...
+CLERK_JWT_KEY=... (optional — for networkless JWT verification)
+```
+
+Optional (for email actions):
+```
+RESEND_API_KEY=re_...
+RESEND_FROM=noreply@yourdomain.com
+```
+
+Optional (for Inngest background workflows):
+```
+INNGEST_EVENT_KEY=... (from Inngest Cloud)
+INNGEST_SIGNING_KEY=... (from Inngest Cloud)
+INNGEST_BASE_URL=https://api.inngest.com
+```
+
+Optional (for local dev without Clerk):
+```
+DEMO_MODE=true
+```
+
+### 4d. Verify the API
+
+Once the Space builds, visit:
+- `https://your-space.hf.space/api/admin/health` → should return `{"status":"ok"}`
+- `https://your-space.hf.space/api/inngest` → should return the Inngest registration JSON
+
+---
+
+## Step 5: Wire Frontend → Backend
+
+Update your Vercel environment variable:
+```
+NEXT_PUBLIC_API_BASE_URL=https://your-hf-space.hf.space/api
+```
+Redeploy the frontend (or Vercel will auto-redeploy on save).
+
+---
+
+## Architecture (Combined Container)
+
+```
+┌─────────────────────────────────────────────────┐
+│         Hugging Face Spaces — Port 7860          │
+│  ┌─────────────────────────────────────────┐     │
+│  │      Fastify HTTP Server (NestJS)       │     │
+│  │  ┌─────────────┐    ┌────────────────┐  │     │
+│  │  │ API Routes  │    │ /api/inngest   │  │     │
+│  │  │ /api/*      │    │ (Worker Fns)   │  │     │
+│  │  │             │    │                │  │     │
+│  │  │ - missions  │    │ - intake       │  │     │
+│  │  │ - actions   │    │ - evidence     │  │     │
+│  │  │ - users     │    │ - route-plan   │  │     │
+│  │  │ - evidence  │    │ - execute      │  │     │
+│  │  └─────────────┘    └────────────────┘  │     │
+│  └─────────────────────────────────────────┘     │
+│           ↓                                      │
+│      Neon Postgres (Cloud)                       │
+└─────────────────────────────────────────────────┘
+```
+
+---
+
+## Quick Smoke Test
+
+After both are deployed:
+
+1. Open your Vercel URL → click **Sign In** → choose **Google**.
+2. After signing in, you should see your avatar in the top-right corner.
+3. Click **Get Started** (hero CTA) → describe a problem.
+4. The API call should reach HF Spaces, create a user in the DB, and create a mission.
+5. Visit `/{locale}/profile` → you should see your profile and the mission you just created.
+6. Check `https://your-hf-space.hf.space/api/admin/health` to confirm backend is alive.
+
+---
+
+## New Features
+
+| Feature | Status |
+|---|---|
+| Google OAuth via Clerk | ✅ Frontend + Backend verified |
+| User auto-creation on first API call | ✅ Creates `users` + `userIdentities` rows |
+| Profile page (`/{locale}/profile`) | ✅ Shows avatar, name, email, editable phone + language |
+| My Missions list on profile | ✅ Lists user's own missions |
+| Mission ownership | ✅ Users only see their own missions |
+| Combined API + Worker container | ✅ One HF Space serves both |
+| Demo mode | ✅ `DEMO_MODE=true` bypasses auth for local dev |
+
+---
+
+## Known Limitations for Hackathon Demo
+
+| Feature | Status in 1-hour deploy |
+|---|---|
+| Frontend + Google OAuth on Vercel | ✅ Works |
+| API + Worker + DB on HF + Neon | ✅ Works |
+| Mission CRUD (user-scoped) | ✅ Works |
+| Evidence upload | ✅ Works (if storage configured) |
+| Background AI workflows | ⚠️ Needs Inngest Cloud keys for production webhooks |
+| Email sending via Resend | ⚠️ Needs Resend key + verified domain |
+| WhatsApp / Telegram channels | ❌ Needs Meta Business verification (days) |
+| Portal automation / eCourts | ❌ Phase 2 only |
+
+---
+
+## Troubleshooting
+
+**HF Space build fails:**
+- Check **Factory Logs** in HF. If `pnpm` is missing, the Dockerfile installs it via `corepack`.
+- If out of disk: HF free tier has ~50GB disk. The Dockerfile removes frontend packages (`next`, `react`) from the API deploy to save space.
+
+**API returns 401 Unauthorized:**
+- Make sure `CLERK_SECRET_KEY` is set in HF Space env vars.
+- Make sure the frontend passes `Authorization: Bearer <token>` header. Check browser DevTools Network tab.
+
+**API returns 500:**
+- Verify `DATABASE_URL` is set and migrations ran.
+- Verify `OPENROUTER_API_KEY` is set (some endpoints call LLMs).
+
+**CORS errors from frontend:**
+- The API has `app.enableCors({ origin: true })` which reflects the request origin. If blocked, add your Vercel domain to `origin: ["https://your-vercel.app"]` in `apps/api/src/main.ts`.
+
+**Clerk sign-in fails:**
+- Make sure `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY` and `CLERK_SECRET_KEY` are set in Vercel.
+- In Clerk Dashboard → **Social Connections** → **Google**, ensure it's enabled.
+- Add your Vercel domain to Clerk Dashboard → **URLs** → **Allowed Origins**.
+
+**Inngest events not firing:**
+- Make sure `INNGEST_EVENT_KEY` and `INNGEST_SIGNING_KEY` are correct.
+- Check the Inngest Cloud dashboard for failed runs.
+- HF free-tier Spaces sleep after inactivity. Use a paid Space or keep-alive ping for reliable background processing.
+
+---
+
+## Local Dev
+
+```bash
+# 1. Start local Postgres + Inngest
+pnpm infra:up
+
+# 2. Copy env and fill in keys
+cp infra/.env.example .env
+
+# 3. Run everything
+pnpm dev
+```
+
+- Web: http://localhost:3000
+- API: http://localhost:3001/api
+- Inngest Dev Server: http://localhost:8288
+
+**Note:** For local dev without Clerk, set `DEMO_MODE=true` in `.env`. The API will skip JWT verification and use a demo user.
+
+---
+
+*Good luck at the hackathon! 🚀*

Dockerfile.hf

@@ -0,0 +1,65 @@
+# CourtMitra API + Worker — NestJS + Fastify + Inngest on Hugging Face Spaces
+# HF expects a web service on PORT (default 7860).
+# This container runs BOTH the API and the Inngest worker in one process.
+
+# ── Stage 1: builder ────────────────────────────────────────────────────────
+FROM node:23-alpine AS builder
+RUN corepack enable && corepack prepare pnpm@10 --activate
+WORKDIR /app
+
+# Workspace manifests
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json tsconfig.base.json ./
+COPY apps/api/package.json apps/api/
+COPY apps/worker/package.json apps/worker/
+COPY packages/adapters/package.json packages/adapters/
+COPY packages/contracts/package.json packages/contracts/
+COPY packages/db/package.json packages/db/
+COPY packages/domain/package.json packages/domain/
+COPY packages/ports/package.json packages/ports/
+COPY packages/prompts/package.json packages/prompts/
+
+RUN pnpm install --frozen-lockfile
+
+# Source — API + Worker + all packages
+COPY apps/api/src apps/api/src
+COPY apps/worker/src apps/worker/src
+COPY packages/adapters/src packages/adapters/src
+COPY packages/contracts/src packages/contracts/src
+COPY packages/db/src packages/db/src
+COPY packages/domain/src packages/domain/src
+COPY packages/ports/src packages/ports/src
+COPY packages/prompts/src packages/prompts/src
+COPY packages/db/drizzle.config.ts packages/db/drizzle.config.ts
+COPY apps/api/tsconfig.json apps/api/tsconfig.json
+COPY apps/worker/tsconfig.json apps/worker/tsconfig.json
+
+# Deploy flat production node_modules for the API
+RUN pnpm --filter @courtmitra/api deploy --prod --legacy /deploy
+
+# Remove leaked frontend-only packages to save space
+RUN rm -rf /deploy/node_modules/.pnpm/next@* \
+           /deploy/node_modules/.pnpm/@next+* \
+           /deploy/node_modules/.pnpm/typescript@* \
+           /deploy/node_modules/.pnpm/caniuse-lite@* \
+           /deploy/node_modules/.pnpm/react@* \
+           /deploy/node_modules/.pnpm/react-dom@* \
+           /deploy/node_modules/.pnpm/web-streams-polyfill@*
+
+# ── Stage 2: runner ─────────────────────────────────────────────────────────
+FROM node:23-alpine AS runner
+RUN apk add --no-cache tini curl
+WORKDIR /app
+
+COPY --from=builder /deploy ./
+
+# HF provides PORT env var (default 7860)
+EXPOSE 7860
+ENV API_PORT=7860
+ENV PORT=7860
+
+# Healthcheck for HF
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD curl -f http://localhost:7860/api/admin/health || exit 1
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["npx", "tsx", "src/main.ts"]

GAP_AUDIT_M1_M9.md

@@ -0,0 +1,189 @@
+# CourtMitra M1-M9 Gap Audit
+
+## Audit Date: 2026-05-29
+## Commit Under Review: f892836 "Implement CourtMitra autopilot roadmap"
+
+---
+
+### M0 — Core Automation Loop
+**Status:** Mostly complete. Intake, evidence, facts, legal grounding, route plan, action preview/consent, email send, reply ingestion, follow-up, resolution, ledger all have code paths. Tests green.
+
+---
+
+### M1 — Rate-Limit & Action Executor Idempotency
+**Current:**
+- `checkRateLimit` lives in `action-execution-policy.ts` and is called from `executeAction`.
+- Source is `submissions` table with `status = "sent"` in a rolling window.
+
+**Gaps / Bugs:**
+1. **Single source of truth risk.** The comment says "counted from `submissions`/`action_attempts`", but only `submissions` is queried. If the post-send DB transaction rolls back, the email was sent but `submissions` row is missing → under-count on retry.
+2. **Idempotency gap.** `canExecute` allows `status === "executing"`. If the DB transaction fails after `emailAdapter.submit` succeeds, Inngest retries and the email is sent again because nothing blocks a second execution of an "executing" action.
+3. **Env vars undocumented.** `ACTION_RATE_WINDOW_MINUTES` and `ACTION_RATE_MAX_PER_WINDOW` are not in `HANDOFF.md`.
+
+**Fix plan:**
+- Count from `action_attempts` (status = "succeeded") as a fallback / dual source.
+- In `executeAction`, query existing attempts before calling the adapter. If a non-failed attempt exists and the prior attempt has a `startedAt` older than a short threshold, assume send succeeded and reconcile DB state without re-sending.
+
+---
+
+### M2 — Escalation Deadline Timezone
+**Current:**
+- `deadline-checker` cron runs hourly.
+- `escalation-policy.ts` `addDays()` uses `new Date(from.getTime() + days * 24 * 60 * 60 * 1000)`.
+- `action-executor.ts` sets `currentDeadlineAt: addDays(new Date(), deadlineDays)`.
+
+**Gaps / Bugs:**
+1. **Timezone not Asia/Kolkata.** `addDays` operates on server-local UTC time. If the server is not in IST, deadlines drift by 5.5 hours, causing the hourly checker to fire too early or too late.
+2. **State rank mismatch.** `resolution-verify.ts` uses its own `STATE_RANK` map with different numeric values (`resolution_claimed: 17`, `resolved: 18`) compared to the canonical map in other workers (`resolution_claimed: 18`, `resolved: 19`). This can cause state regression or incorrect transitions.
+
+**Fix plan:**
+- Create a `deadlineInKolkata(from, days)` helper that computes the deadline in `Asia/Kolkata` timezone.
+- Align `resolution-verify.ts` STATE_RANK with the canonical map used by `route-plan.ts`, `reply-classify.ts`, etc.
+
+---
+
+### M3 — Autopilot Triggers & Resolution Flow
+**Current:**
+- `autopilot-tick` Inngest function listens to `mission.autopilot_tick`.
+- Emitted by `route-plan.ts` (after plan ready) and `reply-classify.ts` (after reply classified).
+- `runAutopilotTick` uses a ToolLoopAgent with tools: `halt`, `draftFirstAction`, `openParallelTracks`, `requestResolution`, `waitForUser`.
+
+**Gaps / Bugs:**
+1. **Auto-claims resolution without user consent.** The `requestResolution` tool creates a `resolutionOutcomes` row, sets mission state to `resolution_claimed`, and emits `mission.resolution_claimed` — all without explicit user approval. Phase 1 spec requires user-confirmed resolution.
+2. **Missing triggers.** Autopilot does NOT tick on:
+   - `mission.deadline_breached` (should evaluate next step)
+   - `action_executed` / `action_execution_failed` (should decide follow-up)
+   - `followup.due` (should draft escalation)
+3. **No mode-gated behavior.** `autopilotMode` on the mission row is read but never used. The `requestResolution` tool should be blocked in "moderate" mode.
+
+**Fix plan:**
+- Change `requestResolution` to emit a `resolution.proposed` snapshot and wait for user confirmation, instead of auto-claiming.
+- Add autopilot tick emission in `escalation.ts` (deadline breached) and after action execution.
+- Respect `autopilotMode`: only auto-claim resolution in an explicit "aggressive" mode; "moderate" should always wait for user.
+
+---
+
+### M4 — Parallel Tracks (routeGraph AND/OR, parent_action_id)
+**Current:**
+- Schema has `actions.parentActionId` and `actions.trackLabel`.
+- `draftConsentGatedAction` accepts `parentActionId` and `trackLabel`.
+- `openParallelTracks` tool in autopilot.ts drafts up to 2 actions with different authorities.
+- `resolution-verify.ts` supersedes dangling `proposed`/`preview_ready`/`approved` actions on resolution.
+
+**Gaps / Bugs:**
+1. **`parentActionId` never set.** In `openParallelTracks`, each track action is drafted with `trackLabel` but `parentActionId` is always `null`. There is no "parent" action that spawned the parallel tracks, so the link is unused.
+2. **Route plan has no AND/OR encoding.** The generated `RoutePlanStepDto[]` is linear. The `routeGraph` in route_rules has `nodes`/`edges`, but the LLM-generated plan steps do not encode which steps can run in parallel.
+3. **Escalation policy ignores tracks.** `getNextEscalationTier` advances linearly; it doesn't respect track boundaries. If two parallel tracks are open, escalating one should not automatically advance the other.
+
+**Fix plan:**
+- When `openParallelTracks` opens tracks, create a synthetic "parent" action (or use the first action) and set `parentActionId` on subsequent tracks.
+- Add `parallelGroup` field to `RoutePlanStepDto` so the plan can encode parallelizable steps.
+- Update `getNextEscalationTier` to accept an optional `trackLabel` filter so each track escalates independently.
+
+---
+
+### M5 — Settlement Flow
+**Current:**
+- `reply-classify.v2` prompt extracts settlement offers.
+- `decideSettlementNextAction` in `settlement-policy.ts` recommends accept/counter/escalate/wait.
+- `reply-classify.ts` auto-drafts a counter-offer action if policy says "counter".
+
+**Gaps / Bugs:**
+1. **No settlement acceptance action.** If the user wants to accept a settlement, there's no UI action or API endpoint to generate an acceptance email.
+2. **No integration tests for settlement end-to-end.** The unit tests for `settlement-policy.ts` exist, but there's no test covering the reply-classify → settlement policy → draft action flow.
+3. **Counter-offer authority may be wrong.** `from` (the raw reply email) is used as the authority/destination, but it could be a no-reply address.
+
+**Fix plan:**
+- Add a settlement-accept endpoint stub and UI button.
+- Add an integration test for the settlement classification → counter-offer flow.
+- Document the counter-offer authority caveat.
+
+---
+
+### M6 — RTI Seeds & Prompts
+**Current:**
+- `legal-data.ts` has RTI Act 2005 chunks (Sections 6, 7, 19, 19(6)).
+- `route-rules-data.ts` has `governmentRtiRouteRule` with RTI0→RTI1→RTI2 steps.
+- Schema supports `issueDomain = "government"`.
+
+**Gaps / Bugs:**
+1. **Intake prompt missing government domain.** `intake.v1` prompt only lists `"consumer" | "payment" | "cyber_fraud"`, so LLM will never classify a government/RTI grievance correctly.
+2. **No RTI-specific prompt.** There is no dedicated `rti-application.v1` or `rti-packet.v1` prompt for generating RTI application text.
+3. **No E2E test.** The test suite has no fixture for a government-domain mission.
+
+**Fix plan:**
+- Update `intake.v1` prompt to include `"government"` domain.
+- Add `rti-packet.v1` prompt stub.
+- Add a government mission fixture to the seed/integration test data.
+
+---
+
+### M7 — Voice / Indic Intake
+**Current:**
+- `evidence.ts` routes audio to ASR adapter, stores transcript in `transcripts` table.
+- `transcripts` schema exists (Module 2 migration).
+- Redacted text is fed into claim extraction.
+
+**Gaps / Bugs:**
+1. **Original transcript lost.** `evidence.ts` passes `redactedText` as `rawText` to the claim extraction flow. The original unredacted transcript is stored in `transcripts.text` but never preserved separately for audit.
+2. **Missing unique constraint / idempotency.** `db.insert(schema.transcripts).values(...).onConflictDoNothing()` has no explicit target constraint. On Inngest retry, duplicate rows could accumulate if the table has no unique index on `evidenceItemId`.
+3. **No language persistence for intake.** ASR returns `language`, but it's only stored in `transcripts.language`. It's not propagated to the mission's `facts` or used to trigger translation.
+
+**Fix plan:**
+- Store both `originalText` and `redactedText` in the ASR result / evidence flow.
+- Add a unique index on `transcripts(evidenceItemId)` (or ensure one exists) and specify the conflict target.
+- Propagate detected language to mission facts.
+
+---
+
+### M8 — Portal Assist
+**Current:**
+- `portal-assist.ts` contracts define `PortalAssistState`, `PortalAssistSession`, etc.
+- Schema has `portal_assist_sessions` table.
+- No Inngest function, no API controller, no UI panel.
+
+**Gaps / Bugs:**
+1. **No web session viewer.** The mission page has no portal-assist panel.
+2. **No screenshot/receipt flow.** There is no endpoint to upload a receipt after a portal submission.
+3. **No honest `receipt_verified` path.** The `ProofState` enum includes `receipt_verified`, but no code path sets it. Portal actions are always `ready_for_user_submission` or `user_confirmed_external_submission`.
+
+**Fix plan:**
+- Add `POST /api/missions/:id/portal-receipt` endpoint that accepts a receipt file and updates the action's `proofState` to `receipt_verified`.
+- Add a minimal portal-assist panel in the mission UI.
+- Document that portal automation is manual-packet only until Browserbase/Stagehand is configured.
+
+---
+
+### M9 — Swarm / Social / DPDP
+**Current:**
+- Swarm and social contracts exist (`swarm.ts`, `social.ts`).
+- Schema has `entities`, `swarms`, `swarm_members`, `social_accounts`, `social_posts` tables.
+- `copy-ready-fallback.ts` social adapter exists.
+- DPDP controller exists in API.
+
+**Gaps / Bugs:**
+1. **No swarm UI on mission page.** `SwarmWithEntity` is imported but never rendered.
+2. **Social publisher not consent-gated.** `social.ts` contract has `consentGrantId`, but there's no check in the adapter or API that a social post has a valid consent grant before publishing.
+3. **DPDP consent flow incomplete.** No evidence that the first-contact consent notice is actually delivered to WhatsApp/Telegram users.
+
+**Fix plan:**
+- Add a swarm membership opt-in stub to the mission UI.
+- Add a `canPublishSocial` guard that validates `consentGrantId` + action preview hash before any social adapter call.
+- Document DPDP first-contact delivery in the intake flow.
+
+---
+
+## Summary of Priority Fixes
+
+| Priority | Module | Fix |
+|----------|--------|-----|
+| P0 | M1 | Dual-source rate limit (submissions + attempts); executor attempt guard |
+| P0 | M2 | Asia/Kolkata deadline helper; align STATE_RANK |
+| P0 | M3 | Stop autopilot auto-claiming resolution; add missing tick triggers |
+| P1 | M4 | Set parentActionId in openParallelTracks; add parallelGroup to steps |
+| P1 | M6 | Add "government" to intake.v1 prompt |
+| P1 | M7 | Preserve original transcript; fix transcript conflict target |
+| P1 | M8 | Add receipt_verified endpoint stub |
+| P1 | M9 | Add social publish consent guard |
+| P2 | M5 | Settlement integration test |
+

apps/api/package.json

@@ -11,6 +11,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@clerk/clerk-sdk-node": "^5.1.6",
     "@courtmitra/adapters": "workspace:*",
     "@courtmitra/contracts": "workspace:*",
     "@courtmitra/db": "workspace:*",
@@ -19,15 +20,16 @@
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
     "@nestjs/platform-fastify": "^11.0.0",
+    "drizzle-orm": "^0.45.2",
     "fastify": "^5.8.5",
     "inngest": "^4.4.0",
-    "drizzle-orm": "^0.45.2",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.1",
-    "zod": "^4.4.3",
-    "tsx": "^4.19.2"
+    "tsx": "^4.19.2",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@types/express": "^5.0.6",
     "@types/node": "^22.10.2",
     "typescript": "^5.7.2"
   }

apps/api/src/app.module.ts

@@ -1,5 +1,6 @@
 import { Module } from "@nestjs/common";
 import { DbModule } from "./db/db.module.js";
+import { AuthModule } from "./auth/auth.module.js";
 import { MissionsModule } from "./missions/missions.module.js";
 import { InngestModule } from "./workflow/inngest.module.js";
 import { ConversationsModule } from "./conversations/conversations.module.js";
@@ -16,12 +17,14 @@ import { PortalAssistModule } from "./portal-assist/portal-assist.module.js";
 import { ResolverModule } from "./resolver/resolver.module.js";
 import { CaseLookupModule } from "./case-lookup/case-lookup.module.js";
 import { ComplianceModule } from "./compliance/compliance.module.js";
+import { UsersModule } from "./users/users.module.js";
 import { CapabilitiesController } from "./capabilities/capabilities.controller.js";
 import { HealthController } from "./health.controller.js";
 
 @Module({
   imports: [
     DbModule,
+    AuthModule,
     InngestModule,
     ConversationsModule,
     MissionsModule,
@@ -38,6 +41,7 @@ import { HealthController } from "./health.controller.js";
     ResolverModule,
     CaseLookupModule,
     ComplianceModule,
+    UsersModule,
   ],
   controllers: [CapabilitiesController, HealthController],
 })

apps/api/src/auth/auth.module.ts

@@ -0,0 +1,17 @@
+import { Global, Module } from "@nestjs/common";
+import { APP_GUARD } from "@nestjs/core";
+import { AuthService } from "./auth.service.js";
+import { ClerkAuthGuard } from "./clerk-auth.guard.js";
+
+@Global()
+@Module({
+  providers: [
+    AuthService,
+    {
+      provide: APP_GUARD,
+      useClass: ClerkAuthGuard,
+    },
+  ],
+  exports: [AuthService],
+})
+export class AuthModule {}

apps/api/src/auth/auth.service.ts

@@ -0,0 +1,79 @@
+import { Injectable, Inject, UnauthorizedException } from "@nestjs/common";
+import { eq } from "drizzle-orm";
+import { users, userIdentities, type Database } from "@courtmitra/db";
+import { DB } from "../db/db.module.js";
+
+export interface ClerkUser {
+  id: string;
+  emailAddresses: { emailAddress: string }[];
+  firstName: string | null;
+  lastName: string | null;
+  imageUrl: string | null;
+}
+
+@Injectable()
+export class AuthService {
+  constructor(@Inject(DB) private readonly db: Database) {}
+
+  /**
+   * Find or create a user from Clerk OAuth data.
+   * Maps Clerk userId -> our users table via userIdentities.
+   */
+  async findOrCreateUser(clerkUser: ClerkUser): Promise<{ id: string; email: string | null }> {
+    const providerSubject = clerkUser.id;
+
+    // Try to find existing identity
+    const existingIdentity = await this.db
+      .select({ userId: userIdentities.userId })
+      .from(userIdentities)
+      .where(eq(userIdentities.provider, "google"))
+      .innerJoin(users, eq(users.id, userIdentities.userId))
+      .limit(1);
+
+    if (existingIdentity[0]) {
+      const user = await this.db
+        .select()
+        .from(users)
+        .where(eq(users.id, existingIdentity[0].userId))
+        .limit(1);
+      if (user[0]) {
+        return { id: user[0].id, email: user[0].email ?? null };
+      }
+    }
+
+    // Create new user
+    const email = clerkUser.emailAddresses[0]?.emailAddress ?? null;
+    const fullName = [clerkUser.firstName, clerkUser.lastName].filter(Boolean).join(" ") || null;
+
+    const [userRow] = await this.db
+      .insert(users)
+      .values({
+        displayName: fullName ?? email ?? "User",
+        email,
+        avatarUrl: clerkUser.imageUrl,
+        fullName,
+      })
+      .returning();
+
+    if (!userRow) {
+      throw new UnauthorizedException("Failed to create user");
+    }
+
+    // Create identity link
+    await this.db.insert(userIdentities).values({
+      userId: userRow.id,
+      provider: "google",
+      providerSubject,
+      isVerified: true,
+      metadata: { source: "clerk_oauth" },
+    });
+
+    return { id: userRow.id, email };
+  }
+
+  /** Look up a user by their internal DB id. */
+  async findUserById(id: string) {
+    const rows = await this.db.select().from(users).where(eq(users.id, id)).limit(1);
+    return rows[0] ?? null;
+  }
+}

apps/api/src/auth/clerk-auth.guard.ts

@@ -0,0 +1,72 @@
+import { Injectable, CanActivate, ExecutionContext, UnauthorizedException } from "@nestjs/common";
+import { verifyToken } from "@clerk/clerk-sdk-node";
+import { AuthService } from "./auth.service.js";
+
+@Injectable()
+export class ClerkAuthGuard implements CanActivate {
+  constructor(private readonly authService: AuthService) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context.switchToHttp().getRequest<{ headers: { authorization?: string }; userId?: string; clerkUserId?: string }>();
+    const authHeader = request.headers.authorization;
+
+    if (!authHeader?.startsWith("Bearer ")) {
+      // Demo mode fallback — allow through with a demo user context
+      // This lets local dev work without Clerk keys
+      if (process.env.DEMO_MODE === "true") {
+        (request as any).clerkUserId = "demo";
+        (request as any).userId = "demo";
+        return true;
+      }
+      throw new UnauthorizedException("Missing Authorization header");
+    }
+
+    const token = authHeader.replace("Bearer ", "");
+
+    try {
+      // Verify the Clerk JWT
+      const verified = await verifyToken(token, {
+        jwtKey: process.env.CLERK_JWT_KEY,
+        authorizedParties: process.env.CLERK_AUTHORIZED_PARTIES?.split(",") ?? [],
+      });
+
+      const clerkUserId = verified.sub;
+
+      // Find or create the user in our DB
+      const user = await this.authService.findOrCreateUser({
+        id: clerkUserId,
+        emailAddresses: [{ emailAddress: verified.email as string }],
+        firstName: (verified as any).first_name ?? null,
+        lastName: (verified as any).last_name ?? null,
+        imageUrl: (verified as any).image_url ?? null,
+      });
+
+      // Attach to request for controllers
+      (request as any).clerkUserId = clerkUserId;
+      (request as any).userId = user.id;
+
+      return true;
+    } catch (err) {
+      // If no CLERK_JWT_KEY set, allow through with clerk user id from token payload (dev mode)
+      if (!process.env.CLERK_JWT_KEY && process.env.DEMO_MODE !== "false") {
+        try {
+          const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64").toString());
+          const clerkUserId = payload.sub;
+          const user = await this.authService.findOrCreateUser({
+            id: clerkUserId,
+            emailAddresses: [{ emailAddress: payload.email ?? "" }],
+            firstName: payload.first_name ?? null,
+            lastName: payload.last_name ?? null,
+            imageUrl: payload.image_url ?? null,
+          });
+          (request as any).clerkUserId = clerkUserId;
+          (request as any).userId = user.id;
+          return true;
+        } catch {
+          throw new UnauthorizedException("Invalid token");
+        }
+      }
+      throw new UnauthorizedException("Invalid or expired token");
+    }
+  }
+}

apps/api/src/auth/current-user.decorator.ts

@@ -0,0 +1,12 @@
+import { createParamDecorator, ExecutionContext } from "@nestjs/common";
+
+/**
+ * Injects the DB userId from the request (set by ClerkAuthGuard).
+ * Falls back to "demo" user id in local dev when no auth is present.
+ */
+export const CurrentUser = createParamDecorator(
+  (_data: unknown, ctx: ExecutionContext): string => {
+    const request = ctx.switchToHttp().getRequest<{ userId?: string }>();
+    return request.userId ?? "demo";
+  }
+);

apps/api/src/main.ts

@@ -2,6 +2,8 @@ import "reflect-metadata";
 import { NestFactory } from "@nestjs/core";
 import { FastifyAdapter, type NestFastifyApplication } from "@nestjs/platform-fastify";
 import { AppModule } from "./app.module.js";
+import { serve } from "inngest/node";
+import { inngest as workerInngest, functions } from "../../worker/src/inngest.js";
 
 async function bootstrap() {
   const app = await NestFactory.create<NestFastifyApplication>(AppModule, new FastifyAdapter(), {
@@ -10,9 +12,23 @@ async function bootstrap() {
   app.setGlobalPrefix("api");
   app.enableCors({ origin: true });
 
-  const port = Number(process.env.API_PORT ?? 3001);
+  // Mount Inngest worker handler on /api/inngest (combined container)
+  const inngestHandler = serve({ client: workerInngest, functions });
+  const fastify = app.getHttpAdapter().getInstance();
+
+  fastify.route({
+    method: ["GET", "POST", "PUT"],
+    url: "/api/inngest",
+    handler: async (request: any, reply: any) => {
+      reply.hijack();
+      inngestHandler(request.raw, reply.raw);
+    },
+  });
+
+  const port = Number(process.env.API_PORT ?? process.env.PORT ?? 3001);
   await app.listen(port, "0.0.0.0");
   console.log(`[api] listening on http://localhost:${port}/api`);
+  console.log(`[worker] inngest endpoint on http://localhost:${port}/api/inngest`);
 }
 
 bootstrap().catch((err) => {

apps/api/src/missions/missions.controller.ts

@@ -1,13 +1,14 @@
-import { Body, Controller, Get, Headers, Inject, NotFoundException, Param, Patch, Post, Query } from "@nestjs/common";
+import { Body, Controller, Get, Headers, Inject, NotFoundException, Param, Patch, Post, Query, UseGuards } from "@nestjs/common";
 import { CreateMissionInput, UpdateMissionDomainInput } from "@courtmitra/contracts";
 import { parseOrThrow } from "../common/zod-validation.pipe.js";
 import { MissionsService } from "./missions.service.js";
 import { DB } from "../db/db.module.js";
 import { schema, type Database } from "@courtmitra/db";
 import { eq, desc } from "drizzle-orm";
+import { CurrentUser } from "../auth/current-user.decorator.js";
+import { ClerkAuthGuard } from "../auth/clerk-auth.guard.js";
 
-// Explicit @Inject tokens: the tsx/esbuild runtime does not emit decorator
-// metadata, so Nest cannot inject by type. Project convention for the API.
+@UseGuards(ClerkAuthGuard)
 @Controller("missions")
 export class MissionsController {
   constructor(
@@ -16,39 +17,43 @@ export class MissionsController {
   ) {}
 
   @Post()
-  async create(@Body() body: unknown, @Headers("idempotency-key") idempotencyKey?: string) {
+  async create(
+    @Body() body: unknown,
+    @CurrentUser() userId: string,
+    @Headers("idempotency-key") idempotencyKey?: string,
+  ) {
     const input = parseOrThrow(CreateMissionInput, body);
-    return this.missions.create(input, idempotencyKey);
+    return this.missions.create(userId, input, idempotencyKey);
   }
 
   @Get()
-  async list() {
-    return this.missions.list();
+  async list(@CurrentUser() userId: string) {
+    return this.missions.list(userId);
   }
 
   @Get(":id")
-  async get(@Param("id") id: string) {
-    return this.missions.get(id);
+  async get(@Param("id") id: string, @CurrentUser() userId: string) {
+    return this.missions.get(id, userId);
   }
 
   @Get(":id/snapshot")
-  async snapshot(@Param("id") id: string) {
+  async snapshot(@Param("id") id: string, @CurrentUser() userId: string) {
     return this.missions.latestSnapshot(id);
   }
 
   @Get(":id/timeline")
-  async timeline(@Param("id") id: string, @Query("cursor") cursor?: string) {
-    return this.missions.timeline(id, cursor);
+  async timeline(@Param("id") id: string, @CurrentUser() userId: string, @Query("cursor") cursor?: string) {
+    return this.missions.timeline(id, userId, cursor);
   }
 
   @Patch(":id/domain")
-  async updateDomain(@Param("id") id: string, @Body() body: unknown) {
+  async updateDomain(@Param("id") id: string, @CurrentUser() userId: string, @Body() body: unknown) {
     const input = parseOrThrow(UpdateMissionDomainInput, body);
-    return this.missions.updateDomain(id, input);
+    return this.missions.updateDomain(id, userId, input);
   }
 
   @Get(":id/public-page")
-  async publicPage(@Param("id") id: string) {
+  async publicPage(@Param("id") id: string, @CurrentUser() userId: string) {
     const [row] = await this.db
       .select({ slug: schema.publicCasePages.slug })
       .from(schema.publicCasePages)

apps/api/src/missions/missions.service.ts

@@ -7,7 +7,6 @@ import {
   missionEvents,
   missionStatusSnapshots,
   idempotencyKeys,
-  users,
   conversations,
   messages,
 } from "@courtmitra/db";
@@ -23,9 +22,6 @@ import { WorkflowService } from "../workflow/inngest.module.js";
 
 type MissionRow = typeof missions.$inferSelect;
 
-/** Day-1 demo identity: until auth lands (Day 2), browser missions attach to a single demo user. */
-const DEMO_USER_NAME = "Demo User";
-
 function sha256Json(value: unknown): string {
   return createHash("sha256").update(JSON.stringify(value), "utf8").digest("hex");
 }
@@ -71,14 +67,6 @@ export class MissionsService {
     };
   }
 
-  /** Get-or-create the Day-1 demo user inside a transaction. */
-  private async ensureDemoUser(tx: Database): Promise<string> {
-    const existing = await tx.select().from(users).where(eq(users.displayName, DEMO_USER_NAME)).limit(1);
-    if (existing[0]) return existing[0].id;
-    const [created] = await tx.insert(users).values({ displayName: DEMO_USER_NAME }).returning();
-    return created!.id;
-  }
-
   /**
    * Create a mission. The mission row, its `mission.created` event and the
    * initial status snapshot are written in ONE transaction (PHASE_1 §3.5).
@@ -86,7 +74,7 @@ export class MissionsService {
    * After creation, creates a synthetic conversation + message and triggers
    * the intake worker so the mission is processed automatically.
    */
-  async create(input: CreateMissionInput, idempotencyKey?: string): Promise<Mission> {
+  async create(userId: string, input: CreateMissionInput, idempotencyKey?: string): Promise<Mission> {
     // Check idempotency first, before any transaction
     if (idempotencyKey) {
       const prior = await this.db.select().from(idempotencyKeys).where(eq(idempotencyKeys.key, idempotencyKey)).limit(1);
@@ -96,13 +84,11 @@ export class MissionsService {
       }
     }
 
-    const { mission, userId } = await this.db.transaction(async (tx) => {
-      const uid = await this.ensureDemoUser(tx as unknown as Database);
-
+    const { mission } = await this.db.transaction(async (tx) => {
       const [m] = await tx
         .insert(missions)
         .values({
-          userId: uid,
+          userId,
           title: input.title,
           issueDomain: input.issueDomain,
           state: "created",
@@ -117,7 +103,7 @@ export class MissionsService {
         missionId: m!.id,
         eventType: "mission.created",
         actorType: "user",
-        actorId: uid,
+        actorId: userId,
         payload: { issueDomain: input.issueDomain, title: input.title, source: "browser" },
       });
 
@@ -133,11 +119,10 @@ export class MissionsService {
         });
       }
 
-      return { mission: m!, userId: uid };
+      return { mission: m! };
     });
 
     // After the transaction, create a synthetic conversation + message and trigger intake.
-    // This is done outside the transaction so the intake worker can read the mission immediately.
     const messageBody = input.description
       ? `${input.title}\n\n${input.description}`
       : input.title;
@@ -173,13 +158,21 @@ export class MissionsService {
     return this.toDto(mission);
   }
 
-  async list(): Promise<Mission[]> {
-    const rows = await this.db.select().from(missions).orderBy(desc(missions.createdAt)).limit(100);
+  /** List missions for a specific user, newest first. */
+  async list(userId: string): Promise<Mission[]> {
+    const rows = await this.db
+      .select()
+      .from(missions)
+      .where(eq(missions.userId, userId))
+      .orderBy(desc(missions.createdAt))
+      .limit(100);
     return rows.map((m) => this.toDto(m));
   }
 
-  async get(id: string): Promise<Mission> {
-    const rows = await this.db.select().from(missions).where(eq(missions.id, id)).limit(1);
+  /** Get a mission IF it belongs to the requesting user. */
+  async get(id: string, userId?: string): Promise<Mission> {
+    const where = userId ? and(eq(missions.id, id), eq(missions.userId, userId)) : eq(missions.id, id);
+    const rows = await this.db.select().from(missions).where(where).limit(1);
     if (!rows[0]) throw new NotFoundException(`mission ${id} not found`);
     return this.toDto(rows[0]);
   }
@@ -210,8 +203,8 @@ export class MissionsService {
     };
   }
 
-  async updateDomain(id: string, input: UpdateMissionDomainInput): Promise<Mission> {
-    const mission = await this.get(id);
+  async updateDomain(id: string, userId: string, input: UpdateMissionDomainInput): Promise<Mission> {
+    const mission = await this.get(id, userId);
     const [updated] = await this.db
       .update(missions)
       .set({ issueDomain: input.issueDomain, updatedAt: new Date() })
@@ -222,15 +215,15 @@ export class MissionsService {
       missionId: id,
       eventType: "mission.domain_changed",
       actorType: "user",
-      actorId: mission.userId,
+      actorId: userId,
       payload: { from: mission.issueDomain, to: input.issueDomain },
     });
     return this.toDto(updated);
   }
 
   /** Cursor-paginated mission timeline (PHASE_1 §7), newest-first by createdAt. */
-  async timeline(missionId: string, cursor?: string, limit = 50): Promise<{ items: MissionEvent[]; nextCursor: string | null }> {
-    await this.get(missionId);
+  async timeline(missionId: string, userId: string, cursor?: string, limit = 50): Promise<{ items: MissionEvent[]; nextCursor: string | null }> {
+    await this.get(missionId, userId);
     const where = cursor
       ? and(eq(missionEvents.missionId, missionId), lt(missionEvents.createdAt, new Date(cursor)))
       : eq(missionEvents.missionId, missionId);

apps/api/src/users/users.controller.ts

@@ -0,0 +1,28 @@
+import { Body, Controller, Get, Inject, Patch, UseGuards } from "@nestjs/common";
+import { UsersService } from "./users.service.js";
+import { CurrentUser } from "../auth/current-user.decorator.js";
+import { ClerkAuthGuard } from "../auth/clerk-auth.guard.js";
+
+@UseGuards(ClerkAuthGuard)
+@Controller("users")
+export class UsersController {
+  constructor(@Inject(UsersService) private readonly usersService: UsersService) {}
+
+  @Get("me")
+  async me(@CurrentUser() userId: string) {
+    return this.usersService.getProfile(userId);
+  }
+
+  @Patch("me")
+  async updateMe(
+    @CurrentUser() userId: string,
+    @Body() body: { phone?: string; fullName?: string; preferredLanguage?: string },
+  ) {
+    return this.usersService.updateProfile(userId, body);
+  }
+
+  @Get("me/missions")
+  async myMissions(@CurrentUser() userId: string) {
+    return this.usersService.listUserMissions(userId);
+  }
+}

apps/api/src/users/users.module.ts

@@ -0,0 +1,10 @@
+import { Module } from "@nestjs/common";
+import { UsersController } from "./users.controller.js";
+import { UsersService } from "./users.service.js";
+
+@Module({
+  controllers: [UsersController],
+  providers: [UsersService],
+  exports: [UsersService],
+})
+export class UsersModule {}

apps/api/src/users/users.service.ts

@@ -0,0 +1,55 @@
+import { Injectable, Inject, NotFoundException } from "@nestjs/common";
+import { eq, desc } from "drizzle-orm";
+import { users, missions, type Database } from "@courtmitra/db";
+import { DB } from "../db/db.module.js";
+
+@Injectable()
+export class UsersService {
+  constructor(@Inject(DB) private readonly db: Database) {}
+
+  async getProfile(userId: string) {
+    const rows = await this.db.select().from(users).where(eq(users.id, userId)).limit(1);
+    if (!rows[0]) throw new NotFoundException("User not found");
+    const u = rows[0];
+    return {
+      id: u.id,
+      displayName: u.displayName,
+      email: u.email,
+      avatarUrl: u.avatarUrl,
+      phone: u.phone,
+      fullName: u.fullName,
+      preferredLanguage: u.preferredLanguage,
+    };
+  }
+
+  async updateProfile(userId: string, data: { phone?: string; fullName?: string; preferredLanguage?: string }) {
+    const [updated] = await this.db
+      .update(users)
+      .set({
+        phone: data.phone,
+        fullName: data.fullName,
+        preferredLanguage: data.preferredLanguage,
+        updatedAt: new Date(),
+      })
+      .where(eq(users.id, userId))
+      .returning();
+    if (!updated) throw new NotFoundException("User not found");
+    return this.getProfile(userId);
+  }
+
+  async listUserMissions(userId: string) {
+    const rows = await this.db
+      .select()
+      .from(missions)
+      .where(eq(missions.userId, userId))
+      .orderBy(desc(missions.createdAt))
+      .limit(100);
+    return rows.map((m) => ({
+      id: m.id,
+      title: m.title,
+      state: m.state,
+      issueDomain: m.issueDomain,
+      createdAt: m.createdAt.toISOString(),
+    }));
+  }
+}

apps/web/.env.local.example

@@ -0,0 +1,9 @@
+# Clerk (Google OAuth enabled in dashboard)
+NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_...
+CLERK_SECRET_KEY=sk_test_...
+NEXT_PUBLIC_CLERK_SIGN_IN_URL=/en/sign-in
+NEXT_PUBLIC_CLERK_SIGN_UP_URL=/en/sign-up
+
+# Backend API (HF Spaces or local)
+NEXT_PUBLIC_API_BASE_URL=http://localhost:3001/api
+INTERNAL_API_BASE_URL=http://localhost:3001/api

apps/web/middleware.ts

@@ -0,0 +1,29 @@
+import { clerkMiddleware, createRouteMatcher } from "@clerk/nextjs/server";
+import createMiddleware from "next-intl/middleware";
+import { routing } from "./src/i18n/routing";
+
+const intlMiddleware = createMiddleware(routing);
+
+const isProtectedRoute = createRouteMatcher([
+  "/:locale/ledger",
+  "/:locale/missions(.*)",
+]);
+
+export default clerkMiddleware(async (auth, req) => {
+  // Protect specific routes
+  if (isProtectedRoute(req)) {
+    await auth.protect();
+  }
+
+  // Always run next-intl middleware for locale handling
+  return intlMiddleware(req);
+});
+
+export const config = {
+  matcher: [
+    // Skip Next.js internals and all static files
+    "/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)",
+    // Always run for API routes
+    "/(api|trpc)(.*)",
+  ],
+};

apps/web/package.json

@@ -9,6 +9,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@clerk/nextjs": "^7.4.2",
     "@courtmitra/contracts": "workspace:*",
     "@hookform/resolvers": "^5.4.0",
     "@radix-ui/react-label": "^2.1.8",

apps/web/src/app/[locale]/layout.tsx

@@ -7,7 +7,9 @@ import { routing } from "@/i18n/routing";
 import { Toaster } from "@/components/ui/sonner";
 import { TooltipProvider } from "@/components/ui/tooltip";
 import { LocaleSwitcher } from "@/components/app/LocaleSwitcher";
+import { Show, SignInButton, UserButton } from "@clerk/nextjs";
 import Link from "next/link";
+import { AuthTokenProvider } from "@/lib/auth-token";
 
 export const metadata: Metadata = {
   title: "CourtMitra MissionOS",
@@ -41,7 +43,8 @@ export default async function LocaleLayout({
 
   return (
     <NextIntlClientProvider locale={locale} messages={messages}>
-      <TooltipProvider>
+      <AuthTokenProvider>
+        <TooltipProvider>
         {/* ── Top navigation bar ─────────────────────────────── */}
         <header
           style={{
@@ -135,6 +138,45 @@ export default async function LocaleLayout({
               />
 
               <LocaleSwitcher />
+
+              {/* Divider */}
+              <span
+                style={{
+                  width: 1,
+                  height: 20,
+                  background: "var(--border)",
+                  margin: "0 4px",
+                  display: "inline-block",
+                }}
+              />
+
+              {/* Auth */}
+              <Show when="signed-out">
+                <SignInButton mode="modal">
+                  <button
+                    style={{
+                      fontSize: 14,
+                      fontWeight: 500,
+                      color: "var(--primary)",
+                      padding: "6px 10px",
+                      borderRadius: 6,
+                      background: "none",
+                      border: "none",
+                      cursor: "pointer",
+                      whiteSpace: "nowrap",
+                    }}
+                  >
+                    {locale === "hi" ? "साइन इन" : "Sign In"}
+                  </button>
+                </SignInButton>
+              </Show>
+              <Show when="signed-in">
+                <UserButton>
+                  <UserButton.MenuItems>
+                    <UserButton.Link label="Profile" labelIcon={<span>👤</span>} href={`/${locale}/profile`} />
+                  </UserButton.MenuItems>
+                </UserButton>
+              </Show>
             </nav>
           </div>
         </header>
@@ -153,6 +195,7 @@ export default async function LocaleLayout({
           }}
         />
       </TooltipProvider>
+      </AuthTokenProvider>
     </NextIntlClientProvider>
   );
 }

apps/web/src/app/[locale]/page.tsx

@@ -4,8 +4,10 @@ import { useEffect, useState } from "react";
 import { useRouter } from "next/navigation";
 import Link from "next/link";
 import { useTranslations, useLocale } from "next-intl";
+import { Show, SignInButton } from "@clerk/nextjs";
 import type { IssueDomain, Mission, MissionState } from "@courtmitra/contracts";
-import { api } from "@/lib/api";
+import { api, setAuthTokenGetter } from "@/lib/api";
+import { useAuthToken } from "@/lib/auth-token";
 import {
   Dialog,
   DialogContent,
@@ -15,15 +17,15 @@ import {
 } from "@/components/ui/dialog";
 import { stateToStage } from "@/components/mission";
 import { AutopilotSimulator, TemplateId } from "@/components/app/AutopilotSimulator";
-import { 
-  ShoppingBag, 
-  CreditCard, 
-  ShieldAlert, 
-  Briefcase, 
-  Home as HomeIcon, 
-  Building2, 
-  Smartphone, 
-  HeartPulse, 
+import {
+  ShoppingBag,
+  CreditCard,
+  ShieldAlert,
+  Briefcase,
+  Home as HomeIcon,
+  Building2,
+  Smartphone,
+  HeartPulse,
   ArrowRight,
   TrendingUp,
   Clock,
@@ -421,6 +423,15 @@ export default function MissionBoard() {
   // Autopilot Simulator template state
   const [activeTemplate, setActiveTemplate] = useState<TemplateId>("upi");
 
+  const { getToken } = useAuthToken();
+
+  // Register auth token getter with API client
+  useEffect(() => {
+    if (getToken) {
+      setAuthTokenGetter(getToken);
+    }
+  }, [getToken]);
+
   async function refresh() {
     setLoadingMissions(true);
     try {
@@ -535,15 +546,29 @@ export default function MissionBoard() {
 
               {/* CTAs */}
               <div className="flex flex-wrap gap-3.5 mb-8">
-                <button
-                  onClick={() => setDialogOpen(true)}
-                  className="bg-primary text-white border-none rounded-xl px-7 py-3.5 font-bold cursor-pointer transition-all duration-200 hover:bg-primary-hover shadow-lg hover:-translate-y-0.5 text-[15px] animate-pulse-border"
-                  style={{
-                    boxShadow: "0 10px 20px -5px rgba(29, 53, 87, 0.25)"
-                  }}
-                >
-                  {tLanding("ctaStart")}
-                </button>
+                <Show when="signed-in">
+                  <button
+                    onClick={() => setDialogOpen(true)}
+                    className="bg-primary text-white border-none rounded-xl px-7 py-3.5 font-bold cursor-pointer transition-all duration-200 hover:bg-primary-hover shadow-lg hover:-translate-y-0.5 text-[15px] animate-pulse-border"
+                    style={{
+                      boxShadow: "0 10px 20px -5px rgba(29, 53, 87, 0.25)"
+                    }}
+                  >
+                    {tLanding("ctaStart")}
+                  </button>
+                </Show>
+                <Show when="signed-out">
+                  <SignInButton mode="modal" fallbackRedirectUrl={`/${locale}`}>
+                    <button
+                      className="bg-primary text-white border-none rounded-xl px-7 py-3.5 font-bold cursor-pointer transition-all duration-200 hover:bg-primary-hover shadow-lg hover:-translate-y-0.5 text-[15px] animate-pulse-border"
+                      style={{
+                        boxShadow: "0 10px 20px -5px rgba(29, 53, 87, 0.25)"
+                      }}
+                    >
+                      {locale === "hi" ? "शुरू करें" : "Get Started"}
+                    </button>
+                  </SignInButton>
+                </Show>
                 <Link
                   href={`/${locale}/ledger`}
                   className="inline-flex items-center justify-center bg-card text-foreground border border-border rounded-xl px-7 py-3.5 font-bold text-[15px] text-decoration-none transition-all duration-200 hover:bg-surface-elevated hover:-translate-y-0.5"

apps/web/src/app/[locale]/profile/page.tsx

@@ -0,0 +1,209 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { useUser } from "@clerk/nextjs";
+import { useLocale } from "next-intl";
+import { useRouter } from "next/navigation";
+import { api, setAuthTokenGetter } from "@/lib/api";
+import { useAuthToken } from "@/lib/auth-token";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { ArrowLeft, Save, User, Phone, Globe, Mail } from "lucide-react";
+import type { UserProfile, UserMissionSummary } from "@/lib/api";
+
+export default function ProfilePage() {
+  const locale = useLocale();
+  const router = useRouter();
+  const { user } = useUser();
+  const { getToken } = useAuthToken();
+
+  const [profile, setProfile] = useState<UserProfile | null>(null);
+  const [missions, setMissions] = useState<UserMissionSummary[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [saving, setSaving] = useState(false);
+
+  const [phone, setPhone] = useState("");
+  const [fullName, setFullName] = useState("");
+  const [preferredLanguage, setPreferredLanguage] = useState("en");
+
+  useEffect(() => {
+    if (getToken) setAuthTokenGetter(getToken);
+  }, [getToken]);
+
+  useEffect(() => {
+    async function load() {
+      try {
+        const [p, m] = await Promise.all([api.getProfile(), api.getUserMissions()]);
+        setProfile(p);
+        setMissions(m.items);
+        setPhone(p.phone ?? "");
+        setFullName(p.fullName ?? "");
+        setPreferredLanguage(p.preferredLanguage ?? "en");
+      } catch (e) {
+        console.error("Failed to load profile", e);
+      } finally {
+        setLoading(false);
+      }
+    }
+    void load();
+  }, []);
+
+  async function handleSave() {
+    setSaving(true);
+    try {
+      const updated = await api.updateProfile({
+        phone: phone || undefined,
+        fullName: fullName || undefined,
+        preferredLanguage,
+      });
+      setProfile(updated);
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  if (loading) {
+    return (
+      <div className="w-full min-h-screen bg-background flex items-center justify-center">
+        <div className="animate-pulse text-foreground-muted font-sans">Loading profile…</div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="w-full min-h-screen bg-background">
+      <div className="max-w-3xl mx-auto px-5 py-10">
+        {/* Back button */}
+        <button
+          onClick={() => router.push(`/${locale}`)}
+          className="flex items-center gap-2 text-sm font-medium text-foreground-muted hover:text-foreground transition-colors mb-8 cursor-pointer"
+        >
+          <ArrowLeft className="w-4 h-4" />
+          {locale === "hi" ? "वापस" : "Back"}
+        </button>
+
+        {/* Header */}
+        <div className="mb-10">
+          <h1 className="text-3xl font-bold text-foreground font-serif tracking-tight mb-2">
+            {locale === "hi" ? "प्रोफ़ाइल" : "Profile"}
+          </h1>
+          <p className="text-foreground-muted font-sans">
+            {locale === "hi" ? "अपनी जानकारी और मिशन देखें" : "View your info and missions"}
+          </p>
+        </div>
+
+        {/* Identity Card */}
+        <div className="bg-card border border-border rounded-2xl p-6 mb-8">
+          <div className="flex items-center gap-4 mb-6">
+            {user?.imageUrl ? (
+              <img
+                src={user.imageUrl}
+                alt="avatar"
+                className="w-16 h-16 rounded-full border-2 border-border object-cover"
+              />
+            ) : (
+              <div className="w-16 h-16 rounded-full bg-surface-sunken flex items-center justify-center border-2 border-border">
+                <User className="w-7 h-7 text-foreground-muted" />
+              </div>
+            )}
+            <div>
+              <div className="text-lg font-bold text-foreground font-serif">
+                {profile?.fullName || user?.fullName || profile?.displayName || "User"}
+              </div>
+              <div className="flex items-center gap-1.5 text-sm text-foreground-muted font-sans">
+                <Mail className="w-3.5 h-3.5" />
+                {profile?.email || user?.primaryEmailAddress?.emailAddress || "—"}
+              </div>
+            </div>
+          </div>
+
+          {/* Editable fields */}
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-5">
+            <div className="space-y-2">
+              <Label className="flex items-center gap-1.5 text-sm font-medium text-foreground-muted font-sans">
+                <Phone className="w-3.5 h-3.5" />
+                {locale === "hi" ? "फ़ोन" : "Phone"}
+              </Label>
+              <Input
+                value={phone}
+                onChange={(e) => setPhone(e.target.value)}
+                placeholder="+91 98765 43210"
+                className="bg-background border-border font-sans"
+              />
+            </div>
+
+            <div className="space-y-2">
+              <Label className="flex items-center gap-1.5 text-sm font-medium text-foreground-muted font-sans">
+                <Globe className="w-3.5 h-3.5" />
+                {locale === "hi" ? "भाषा" : "Language"}
+              </Label>
+              <select
+                value={preferredLanguage}
+                onChange={(e) => setPreferredLanguage(e.target.value)}
+                className="w-full h-10 px-3 rounded-md border border-border bg-background text-sm font-sans focus:outline-none focus:ring-2 focus:ring-primary-ring"
+              >
+                <option value="en">English</option>
+                <option value="hi">हिन्दी</option>
+              </select>
+            </div>
+          </div>
+
+          <div className="mt-6 flex justify-end">
+            <Button
+              onClick={handleSave}
+              disabled={saving}
+              className="bg-primary text-white hover:bg-primary-hover font-sans"
+            >
+              <Save className="w-4 h-4 mr-2" />
+              {saving ? (locale === "hi" ? "सहेज रहा है…" : "Saving…") : (locale === "hi" ? "सहेजें" : "Save Profile")}
+            </Button>
+          </div>
+        </div>
+
+        {/* My Missions */}
+        <div>
+          <h2 className="text-xl font-bold text-foreground font-serif mb-4">
+            {locale === "hi" ? "मेरे मिशन" : "My Missions"}
+          </h2>
+
+          {missions.length === 0 ? (
+            <div className="bg-card border border-border rounded-2xl p-8 text-center">
+              <p className="text-foreground-muted font-sans mb-4">
+                {locale === "hi" ? "अभी तक कोई मिशन नहीं।" : "No missions yet."}
+              </p>
+              <button
+                onClick={() => router.push(`/${locale}`)}
+                className="text-primary font-medium hover:underline font-sans cursor-pointer"
+              >
+                {locale === "hi" ? "पहला मिशन शुरू करें" : "Start your first mission"}
+              </button>
+            </div>
+          ) : (
+            <div className="space-y-3">
+              {missions.map((m) => (
+                <button
+                  key={m.id}
+                  onClick={() => router.push(`/${locale}/missions/${m.id}`)}
+                  className="w-full text-left bg-card border border-border rounded-xl p-4 hover:bg-surface-elevated transition-colors cursor-pointer"
+                >
+                  <div className="flex items-center justify-between mb-1">
+                    <span className="font-medium text-foreground font-sans text-sm truncate pr-4">
+                      {m.title || "Untitled Mission"}
+                    </span>
+                    <span className="text-[10px] font-bold uppercase tracking-wider px-2 py-1 rounded-full bg-surface-sunken text-foreground-muted font-sans whitespace-nowrap">
+                      {m.state}
+                    </span>
+                  </div>
+                  <div className="text-xs text-foreground-muted font-sans">
+                    {m.issueDomain} · {new Date(m.createdAt).toLocaleDateString(locale === "hi" ? "hi-IN" : "en-IN")}
+                  </div>
+                </button>
+              ))}
+            </div>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}

apps/web/src/app/[locale]/sign-in/[[...sign-in]]/page.tsx

@@ -0,0 +1,23 @@
+import { SignIn } from "@clerk/nextjs";
+import type { Metadata } from "next";
+
+export const metadata: Metadata = {
+  title: "Sign In — CourtMitra",
+};
+
+export default function SignInPage() {
+  return (
+    <div
+      style={{
+        display: "flex",
+        alignItems: "center",
+        justifyContent: "center",
+        minHeight: "100vh",
+        padding: 24,
+        background: "var(--background)",
+      }}
+    >
+      <SignIn routing="hash" signUpUrl="/en/sign-up" />
+    </div>
+  );
+}

apps/web/src/app/[locale]/sign-up/[[...sign-up]]/page.tsx

@@ -0,0 +1,23 @@
+import { SignUp } from "@clerk/nextjs";
+import type { Metadata } from "next";
+
+export const metadata: Metadata = {
+  title: "Sign Up — CourtMitra",
+};
+
+export default function SignUpPage() {
+  return (
+    <div
+      style={{
+        display: "flex",
+        alignItems: "center",
+        justifyContent: "center",
+        minHeight: "100vh",
+        padding: 24,
+        background: "var(--background)",
+      }}
+    >
+      <SignUp routing="hash" signInUrl="/en/sign-in" />
+    </div>
+  );
+}

apps/web/src/app/layout.tsx

@@ -1,3 +1,4 @@
+import { ClerkProvider } from "@clerk/nextjs";
 import type { Metadata } from "next";
 import type { ReactNode } from "react";
 import "./globals.css";
@@ -7,13 +8,12 @@ export const metadata: Metadata = {
   description: "Citizen grievance / legal-action autopilot for India.",
 };
 
-// Root layout — minimal HTML shell.
-// Fonts come from the @import in globals.css (Noto Sans + Noto Serif).
-// All i18n, nav, and providers live in app/[locale]/layout.tsx.
 export default function RootLayout({ children }: { children: ReactNode }) {
   return (
-    <html lang="en" suppressHydrationWarning>
-      <body suppressHydrationWarning>{children}</body>
-    </html>
+    <ClerkProvider>
+      <html lang="en" suppressHydrationWarning>
+        <body suppressHydrationWarning>{children}</body>
+      </html>
+    </ClerkProvider>
   );
 }

apps/web/src/lib/api.ts

@@ -21,10 +21,30 @@ const API_BASE = (typeof window === "undefined" ? process.env.INTERNAL_API_BASE_
   || process.env.NEXT_PUBLIC_API_BASE_URL
   || "http://localhost:3001/api";
 
+/** Global token getter — set by AuthTokenProvider on client mount. */
+let getAuthToken: (() => Promise<string | null>) | null = null;
+
+export function setAuthTokenGetter(fn: () => Promise<string | null>) {
+  getAuthToken = fn;
+}
+
 async function http<T>(path: string, init?: RequestInit): Promise<T> {
+  const headers: Record<string, string> = {
+    "content-type": "application/json",
+    ...(init?.headers as Record<string, string> ?? {}),
+  };
+
+  // Add Clerk JWT if available (client-side only)
+  if (typeof window !== "undefined" && getAuthToken) {
+    const token = await getAuthToken();
+    if (token) {
+      headers["Authorization"] = `Bearer ${token}`;
+    }
+  }
+
   const res = await fetch(`${API_BASE}${path}`, {
     ...init,
-    headers: { "content-type": "application/json", ...(init?.headers ?? {}) },
+    headers,
     cache: "no-store",
   });
   if (!res.ok) {
@@ -38,8 +58,6 @@ async function http<T>(path: string, init?: RequestInit): Promise<T> {
 // Evidence endpoint response types — use contract types (invariant #6).
 // ---------------------------------------------------------------------------
 
-// Re-export contract types for consumers (EvidenceClaimDto has no `id` field,
-// so we extend it with the DB id here at the API boundary).
 export type { ParsedEvidenceDto, EvidenceClaimDto };
 
 export interface EvidenceClaimWithId extends EvidenceClaimDto {
@@ -52,7 +70,6 @@ export interface EvidenceItem {
   sourceChannel: string | null;
   captureDate: string | null;
   piiLevel: string;
-  /** URL pointing to GET /api/files/:key — or null if no file attached */
   fileUrl: string | null;
   parsed: ParsedEvidenceDto | null;
   claims: EvidenceClaimWithId[];
@@ -62,7 +79,6 @@ export interface EvidenceListResponse {
   items: EvidenceItem[];
 }
 
-// Re-export RoutePlanDto for consumers.
 export type { RoutePlanDto };
 
 // ---------------------------------------------------------------------------
@@ -73,9 +89,30 @@ export interface FactsResponse {
   facts: Record<string, unknown> | null;
 }
 
-/** Convenience: typed view of the `intake` sub-object within mission.facts */
 export type IntakeFacts = Partial<IntakeResult> & Record<string, unknown>;
 
+// ---------------------------------------------------------------------------
+// Profile types
+// ---------------------------------------------------------------------------
+
+export interface UserProfile {
+  id: string;
+  displayName: string | null;
+  email: string | null;
+  avatarUrl: string | null;
+  phone: string | null;
+  fullName: string | null;
+  preferredLanguage: string | null;
+}
+
+export interface UserMissionSummary {
+  id: string;
+  title: string | null;
+  state: string;
+  issueDomain: string | null;
+  createdAt: string;
+}
+
 // ---------------------------------------------------------------------------
 // API surface
 // ---------------------------------------------------------------------------
@@ -93,16 +130,9 @@ export const api = {
       body: JSON.stringify(input),
     }),
 
-  /** GET /api/missions/:id/facts — returns mission.facts jsonb or null */
   getFacts: (id: string) => http<FactsResponse>(`/missions/${id}/facts`),
-
-  /** GET /api/missions/:id/evidence — list of evidence items with parsed outputs + claims */
   getEvidence: (id: string) => http<EvidenceListResponse>(`/missions/${id}/evidence`),
 
-  /**
-   * POST /api/missions/:id/facts/confirm
-   * Confirms (and optionally edits) extracted facts; advances snapshot to facts_confirmed.
-   */
   confirmFacts: (id: string, facts: Record<string, unknown>) =>
     http<{ ok: boolean; state: string }>(`/missions/${id}/facts/confirm`, {
       method: "POST",
@@ -110,16 +140,8 @@ export const api = {
       body: JSON.stringify({ facts }),
     }),
 
-  /**
-   * GET /api/missions/:id/route-plan
-   * Returns the latest non-superseded RoutePlanDto, or throws 404 if not ready.
-   */
   getRoutePlan: (id: string) => http<RoutePlanDto>(`/missions/${id}/route-plan`),
 
-  /**
-   * POST /api/missions/:id/route-plan
-   * Triggers route plan generation; returns 202 Accepted.
-   */
   triggerRoutePlan: (id: string) =>
     http<{ missionId: string }>(`/missions/${id}/route-plan`, {
       method: "POST",
@@ -127,7 +149,6 @@ export const api = {
       body: JSON.stringify({}),
     }),
 
-  // --- Action endpoints ---
   previewAction: (missionId: string, input: CreateActionPreviewInput) =>
     http<ActionPreviewDto>(`/missions/${missionId}/actions/preview`, {
       method: "POST",
@@ -163,7 +184,6 @@ export const api = {
       },
     ),
 
-  // --- Day 5: Resolution ---
   confirmResolution: (missionId: string, input: ConfirmResolutionInput) =>
     http<ResolutionOutcomeDto>(`/missions/${missionId}/resolution/confirm`, {
       method: "POST",
@@ -182,4 +202,13 @@ export const api = {
 
   getPublicPage: (missionId: string) =>
     http<{ slug: string; url: string }>(`/missions/${missionId}/public-page`),
+
+  // --- Profile endpoints ---
+  getProfile: () => http<UserProfile>("/users/me"),
+  updateProfile: (data: { phone?: string; fullName?: string; preferredLanguage?: string }) =>
+    http<UserProfile>("/users/me", {
+      method: "PATCH",
+      body: JSON.stringify(data),
+    }),
+  getUserMissions: () => http<{ items: UserMissionSummary[] }>("/users/me/missions"),
 };

apps/web/src/lib/auth-token.tsx

@@ -0,0 +1,49 @@
+"use client";
+
+import { useAuth } from "@clerk/nextjs";
+import { createContext, useContext, useEffect, useState, type ReactNode } from "react";
+
+interface AuthTokenContextType {
+  getToken: () => Promise<string | null>;
+  isLoaded: boolean;
+}
+
+const AuthTokenContext = createContext<AuthTokenContextType>({
+  getToken: async () => null,
+  isLoaded: false,
+});
+
+export function useAuthToken() {
+  return useContext(AuthTokenContext);
+}
+
+/** Provides a getToken function that the API client can call on every request. */
+export function AuthTokenProvider({ children }: { children: ReactNode }) {
+  const { getToken: clerkGetToken, isLoaded } = useAuth();
+  const [token, setToken] = useState<string | null>(null);
+
+  // Refresh token periodically (Clerk tokens expire every ~1 min)
+  useEffect(() => {
+    if (!isLoaded) return;
+    
+    const refresh = async () => {
+      const t = await clerkGetToken();
+      setToken(t);
+    };
+    
+    refresh();
+    const interval = setInterval(refresh, 45000); // refresh every 45s
+    return () => clearInterval(interval);
+  }, [isLoaded, clerkGetToken]);
+
+  const getToken = async () => {
+    if (token) return token;
+    return clerkGetToken();
+  };
+
+  return (
+    <AuthTokenContext.Provider value={{ getToken, isLoaded }}>
+      {children}
+    </AuthTokenContext.Provider>
+  );
+}

packages/db/src/migrations/0011_blushing_puma.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "users" ADD COLUMN "email" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "avatar_url" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "phone" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "full_name" text;

packages/db/src/migrations/meta/_journal.json

@@ -78,6 +78,13 @@
       "when": 1780034770882,
       "tag": "0010_amusing_runaways",
       "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "7",
+      "when": 1780245420535,
+      "tag": "0011_blushing_puma",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema.ts

@@ -144,6 +144,10 @@ export const localizedTexts = pgTable("localized_texts", {
 export const users = pgTable("users", {
   id: id(),
   displayName: text("display_name"),
+  email: text("email"),
+  avatarUrl: text("avatar_url"),
+  phone: text("phone"),
+  fullName: text("full_name"),
   preferredLanguage: text("preferred_language").default("en"),
   riskFlags: jsonb("risk_flags"),
   createdAt: createdAt(),

pnpm-lock.yaml

@@ -33,6 +33,9 @@ importers:
 
   apps/api:
     dependencies:
+      '@clerk/clerk-sdk-node':
+        specifier: ^5.1.6
+        version: 5.1.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       '@courtmitra/adapters':
         specifier: workspace:*
         version: link:../../packages/adapters
@@ -79,6 +82,9 @@ importers:
         specifier: ^4.4.3
         version: 4.4.3
     devDependencies:
+      '@types/express':
+        specifier: ^5.0.6
+        version: 5.0.6
       '@types/node':
         specifier: ^22.10.2
         version: 22.19.19
@@ -88,6 +94,9 @@ importers:
 
   apps/web:
     dependencies:
+      '@clerk/nextjs':
+        specifier: ^7.4.2
+        version: 7.4.2(next@15.5.18(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       '@courtmitra/contracts':
         specifier: workspace:*
         version: link:../../packages/contracts
@@ -639,6 +648,80 @@ packages:
   '@cfworker/json-schema@4.1.1':
     resolution: {integrity: sha512-gAmrUZSGtKc3AiBL71iNWxDsyUC5uMaKKGdvzYsBoTW/xi42JQHl7eKV2OYzCUqvc+D2RCcf7EXY2iCyFIk6og==}
 
+  '@clerk/backend@1.34.0':
+    resolution: {integrity: sha512-9rZ8hQJVpX5KX2bEpiuVXfpjhojQCiqCWADJDdCI0PCeKxn58Ep0JPYiIcczg4VKUc3a7jve9vXylykG2XajLQ==}
+    engines: {node: '>=18.17.0'}
+    peerDependencies:
+      svix: ^1.62.0
+    peerDependenciesMeta:
+      svix:
+        optional: true
+
+  '@clerk/backend@3.4.14':
+    resolution: {integrity: sha512-0iaMT7k4wDk31QVC3HMaoeVFttblwsCECTHKNQpbRzIyD8j2gHdKEw/FNjffoyqyBqPw869IQlk1YokUlwVAqQ==}
+    engines: {node: '>=20.9.0'}
+
+  '@clerk/clerk-sdk-node@5.1.6':
+    resolution: {integrity: sha512-KeF5p0XP0gNoCx+YIHrfrkNNADBz8ZabwPAhOiJZ9Wo14r93WlzRA51IE0Qgteej8IpWwnvKu4/MpiV7FFoLqA==}
+    engines: {node: '>=18.17.0'}
+    deprecated: 'January 10 2025 marks the end of support for @clerk/clerk-sdk-node as previously announced in our October 2024 deprecation notice. Express users can migrate to the @clerk/express package. For more information, you can find our changelog here: https://clerk.com/changelog/2025-01-10-node-sdk-eol'
+
+  '@clerk/nextjs@7.4.2':
+    resolution: {integrity: sha512-DpqljtLkTtMNsi03XRWYaWYyt0tb4S07HjS9fSmUtN//CKNqM7QAVMZzpgMAZz5yb2QhIVIVF1Uir2c7f72+MA==}
+    engines: {node: '>=20.9.0'}
+    peerDependencies:
+      next: ^15.2.8 || ^15.3.8 || ^15.4.10 || ^15.5.9 || ^15.6.0-0 || ^16.0.10 || ^16.1.0-0
+      react: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
+      react-dom: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
+
+  '@clerk/react@6.7.2':
+    resolution: {integrity: sha512-tgRWWTfW+ejXj6WiZqx7iMbtvh45h0445uEvbSNVCyJBEOaBlCF0/ZfAfXlWAQNbRZ+bPIphEfNUmatadZgGOQ==}
+    engines: {node: '>=20.9.0'}
+    peerDependencies:
+      react: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
+      react-dom: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
+
+  '@clerk/shared@2.22.1':
+    resolution: {integrity: sha512-AaPMypQXJAQgJGhN8+5VRE6/VKT9D+fI8o1dCvqXjQBcegpZWyK6Tqe9QH54Wl6qVj12Hv4qh2yH5ejEflm2KQ==}
+    engines: {node: '>=18.17.0'}
+    peerDependencies:
+      react: ^18.0.0 || ^19.0.0 || ^19.0.0-0
+      react-dom: ^18.0.0 || ^19.0.0 || ^19.0.0-0
+    peerDependenciesMeta:
+      react:
+        optional: true
+      react-dom:
+        optional: true
+
+  '@clerk/shared@3.47.7':
+    resolution: {integrity: sha512-9Yv4MJFEaC7BzV0whxa4txQ4SoMu/3j1LBnI85EBykb5CcfXxIKvNX/9sjMUUySHlTOjsj7XZa5i3W5Dx02K/Q==}
+    engines: {node: '>=18.17.0'}
+    peerDependencies:
+      react: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
+      react-dom: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
+    peerDependenciesMeta:
+      react:
+        optional: true
+      react-dom:
+        optional: true
+
+  '@clerk/shared@4.14.0':
+    resolution: {integrity: sha512-StZCFJ2rg0ITE3fYjIN9CKuKq8ZACW6l2+5qGCFPPYd4hZphA+VDselmh/lHPsF1ex/WRVUSHvquykAHR8cQbQ==}
+    engines: {node: '>=20.9.0'}
+    peerDependencies:
+      react: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
+      react-dom: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
+    peerDependenciesMeta:
+      react:
+        optional: true
+      react-dom:
+        optional: true
+
+  '@clerk/types@4.101.20':
+    resolution: {integrity: sha512-MHvr1tGL5lwxD6zdzzixkHICbbZz/S1LChONKR52Qeu0yRGChZomPknsgqBMG9J3yNeyhaj0SWa5phQgQUk0lg==}
+    engines: {node: '>=18.17.0'}
+    deprecated: 'This package is no longer supported. Please import types from @clerk/shared/types instead. See the upgrade guide for more info: https://clerk.com/docs/guides/development/upgrading/upgrade-guides/core-3'
+
   '@connectrpc/connect-node@2.1.1':
     resolution: {integrity: sha512-s3TfsI1XF+n+1z6MBS9rTnFsxxR4Rw5wmdEnkQINli81ESGxcsfaEet8duzq8LVuuCupmhUsgpRo0Nv9pZkufg==}
     engines: {node: '>=20'}
@@ -3288,6 +3371,9 @@ packages:
   '@tailwindcss/postcss@4.3.0':
     resolution: {integrity: sha512-Jm05Tjx+9yCLGv5qw1c+84Psds8MnyrEQYCB+FFk2lgGiUjlRqdxke4mVTuYrj2xnVZqKim2Apr5ySuQRYAw/w==}
 
+  '@tanstack/query-core@5.100.14':
+    resolution: {integrity: sha512-5X41dGpxgeaHISCRW2oYwcSycZeULZzAunaudXT9ov1KOTj9xwt0CH6hbwqP1/z74ZWF7rYFnDpyYH07XFcZew==}
+
   '@tokenizer/inflate@0.4.1':
     resolution: {integrity: sha512-2mAv+8pkG6GIZiF1kNg1jAjh27IDxEPKwdGul3snfztFerfPGI1LjDezZp3i7BElXompqEtPmoPx6c2wgtWsOA==}
     engines: {node: '>=18'}
@@ -3342,6 +3428,9 @@ packages:
   '@types/aws-lambda@8.10.161':
     resolution: {integrity: sha512-rUYdp+MQwSFocxIOcSsYSF3YYYC/uUpMbCY/mbO21vGqfrEYvNSoPyKYDj6RhXXpPfS0KstW9RwG3qXh9sL7FQ==}
 
+  '@types/body-parser@1.19.6':
+    resolution: {integrity: sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==}
+
   '@types/bunyan@1.8.11':
     resolution: {integrity: sha512-758fRH7umIMk5qt5ELmRMff4mLDlN+xyYzC+dkPTdKwbSkJFvz6xwyScrytPU0QIBbRRwbiE8/BIg8bpajerNQ==}
 
@@ -3360,6 +3449,15 @@ packages:
   '@types/estree@1.0.9':
     resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
 
+  '@types/express-serve-static-core@5.1.1':
+    resolution: {integrity: sha512-v4zIMr/cX7/d2BpAEX3KNKL/JrT1s43s96lLvvdTmza1oEvDudCqK9aF/djc/SWgy8Yh0h30TZx5VpzqFCxk5A==}
+
+  '@types/express@5.0.6':
+    resolution: {integrity: sha512-sKYVuV7Sv9fbPIt/442koC7+IIwK5olP1KWeD88e/idgoJqDm3JV/YUiPwkoKK92ylff2MGxSz1CSjsXelx0YA==}
+
+  '@types/http-errors@2.0.5':
+    resolution: {integrity: sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==}
+
   '@types/json-schema@7.0.15':
     resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
 
@@ -3393,6 +3491,12 @@ packages:
   '@types/pg@8.20.0':
     resolution: {integrity: sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow==}
 
+  '@types/qs@6.15.1':
+    resolution: {integrity: sha512-GZHUBZR9hckSUhrxmp1nG6NwdpM9fCunJwyThLW1X3AyHgd9IlHb6VANpQQqDr2o/qQp6McZ3y/IA2rVzKzSbw==}
+
+  '@types/range-parser@1.2.7':
+    resolution: {integrity: sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==}
+
   '@types/react-dom@19.2.3':
     resolution: {integrity: sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==}
     peerDependencies:
@@ -3404,6 +3508,12 @@ packages:
   '@types/retry@0.12.0':
     resolution: {integrity: sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA==}
 
+  '@types/send@1.2.1':
+    resolution: {integrity: sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==}
+
+  '@types/serve-static@2.2.0':
+    resolution: {integrity: sha512-8mam4H1NHLtu7nmtalF7eyBH14QyOASmcxHhSfEoRyr0nP/YdoesEtU+uSRvMe96TW/HPTtkoKqQLl53N7UXMQ==}
+
   '@types/set-cookie-parser@2.4.10':
     resolution: {integrity: sha512-GGmQVGpQWUe5qglJozEjZV/5dyxbOOZ0LHe/lqyWssB88Y4svNfst0uqBVscdDeIKl5Jy5+aPSvy7mI9tYRguw==}
 
@@ -3812,6 +3922,10 @@ packages:
     resolution: {integrity: sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==}
     engines: {node: '>= 0.6'}
 
+  cookie@1.0.2:
+    resolution: {integrity: sha512-9Kr/j4O16ISv8zBBhJoi4bXOYNTkFLOqSL3UDB0njXxCXNezjeyVrJyGOWtgfs/q2km1gwBcfH8q1yEGoMYunA==}
+    engines: {node: '>=18'}
+
   cookie@1.1.1:
     resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
     engines: {node: '>=18'}
@@ -3841,6 +3955,9 @@ packages:
     engines: {node: '>=4'}
     hasBin: true
 
+  csstype@3.1.3:
+    resolution: {integrity: sha512-M1uQkMl8rQK/szD0LNhtqxIPLpimGm8sOBwU7lLnCpSbTyY3yeU1Vc7l4KT5zT4s/yOxHH5O7tIuuLOCnLADRw==}
+
   csstype@3.2.3:
     resolution: {integrity: sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==}
 
@@ -3917,6 +4034,9 @@ packages:
     resolution: {integrity: sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw==}
     engines: {node: '>=0.3.1'}
 
+  dot-case@3.0.4:
+    resolution: {integrity: sha512-Kv5nKlh6yRrdrGvxeJ2e5y2eRUpkUosIW4A2AS38zwSz27zu7ufDwQPi5Jhs3XAlGNetl3bmnGhQsMtkKJnj3w==}
+
   dotenv@17.4.2:
     resolution: {integrity: sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==}
     engines: {node: '>=12'}
@@ -4409,6 +4529,9 @@ packages:
     resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
     engines: {node: '>=10.13.0'}
 
+  glob-to-regexp@0.4.1:
+    resolution: {integrity: sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==}
+
   globals@14.0.0:
     resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==}
     engines: {node: '>=18'}
@@ -4681,6 +4804,14 @@ packages:
     resolution: {integrity: sha512-34wB/Y7MW7bzjKRjUKTa46I2Z7eV62Rkhva+KkopW7Qvv/OSWBqvkSY7vusOPrNuZcUG3tApvdVgNB8POj3SPw==}
     engines: {node: '>=10'}
 
+  js-cookie@3.0.5:
+    resolution: {integrity: sha512-cEiJEAEoIbWfCZYKWhVwFuvPX1gETRYPw6LlaTKoxD3s2AkXzkCjnp6h0V77ozyqj0jakteJ4YqDJT830+lVGw==}
+    engines: {node: '>=14'}
+
+  js-cookie@3.0.7:
+    resolution: {integrity: sha512-z/wZZgDrkNV1eA0ULjM/F9/50Ya8fbzgKneSpoPsXSGd0KnpdtHfOZWK+GcwLk+EZbS4F9RBhU+K2RgzuDaItw==}
+    engines: {node: '>=20'}
+
   js-tiktoken@1.0.21:
     resolution: {integrity: sha512-biOj/6M5qdgx5TKjDnFT1ymSpM5tbd3ylwDtrQvFQSu0Z7bBYko2dF+W/aUkXUPuk6IVpRxk/3Q2sHOzGlS36g==}
 
@@ -4872,6 +5003,9 @@ packages:
   long@5.3.2:
     resolution: {integrity: sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==}
 
+  lower-case@2.0.2:
+    resolution: {integrity: sha512-7fm3l3NAF9WfN6W3JOmf5drwpVqX78JtoGJ3A6W0a6ZnldM41w2fV5D490psKFTpMds8TJse/eHLFFsNHHjHgg==}
+
   lru-cache@5.1.1:
     resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
 
@@ -4883,6 +5017,10 @@ packages:
   magic-string@0.30.21:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
+  map-obj@4.3.0:
+    resolution: {integrity: sha512-hdN1wVrZbb29eBGiGjJbeP8JbKjq1urkHJ/LIP/NY48MZ1QVXUsQBV1G1zvYFHn1XE06cwjBsOI2K3Ulnj1YXQ==}
+    engines: {node: '>=8'}
+
   marky@1.3.0:
     resolution: {integrity: sha512-ocnPZQLNpvbedwTy9kNrQEsknEfgvcLMvOtz3sFeWApDq1MXH1TqkCIx58xlpESsfwQOnuBO9beyQuNGzVvuhQ==}
 
@@ -5022,6 +5160,9 @@ packages:
       sass:
         optional: true
 
+  no-case@3.0.4:
+    resolution: {integrity: sha512-fgAN3jGAh+RoxUGZHTSOLJIqUc2wmoBwGR4tbpNAKmmovFoWq0OdRkb0VkldReO2a2iBT/OEulG9XSUc10r3zg==}
+
   node-addon-api@7.1.1:
     resolution: {integrity: sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==}
 
@@ -5553,6 +5694,9 @@ packages:
     resolution: {integrity: sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==}
     engines: {node: '>= 18'}
 
+  server-only@0.0.1:
+    resolution: {integrity: sha512-qepMx2JxAa5jjfzxG79yPPq+8BuFToHd1hm7kI+Z4zAq1ftQiP7HcxMhDDItrbtwVeLg/cY2JnKnrcFkmiswNA==}
+
   set-cookie-parser@2.7.2:
     resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
 
@@ -5610,6 +5754,13 @@ packages:
   sisteransi@1.0.5:
     resolution: {integrity: sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==}
 
+  snake-case@3.0.4:
+    resolution: {integrity: sha512-LAOh4z89bGQvl9pFfNF8V146i7o7/CqFPbqzYgP+yYzDIDeS9HaNFtXABamRW+AQzEVODcvE79ljJ+8a9YSdMg==}
+
+  snakecase-keys@8.0.1:
+    resolution: {integrity: sha512-Sj51kE1zC7zh6TDlNNz0/Jn1n5HiHdoQErxO8jLtnyrkJW/M5PrI7x05uDgY3BO7OUQYKCvmeMurW6BPUdwEOw==}
+    engines: {node: '>=18'}
+
   sonic-boom@4.2.1:
     resolution: {integrity: sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==}
 
@@ -5644,6 +5795,9 @@ packages:
     resolution: {integrity: sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
     engines: {node: '>= 0.8'}
 
+  std-env@3.10.0:
+    resolution: {integrity: sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==}
+
   std-env@4.1.0:
     resolution: {integrity: sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==}
 
@@ -5719,6 +5873,16 @@ packages:
     resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
     engines: {node: '>= 0.4'}
 
+  swr@2.3.4:
+    resolution: {integrity: sha512-bYd2lrhc+VarcpkgWclcUi92wYCpOgMws9Sd1hG1ntAu0NEy+14CbotuFjshBU2kt9rYj9TSmDcybpxpeTU1fg==}
+    peerDependencies:
+      react: ^16.11.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  swr@2.4.1:
+    resolution: {integrity: sha512-2CC6CiKQtEwaEeNiqWTAw9PGykW8SR5zZX8MZk6TeAvEAnVS7Visz8WzphqgtQ8v2xz/4Q5K+j+SeMaKXeeQIA==}
+    peerDependencies:
+      react: ^16.11.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
   tagged-tag@1.0.0:
     resolution: {integrity: sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng==}
     engines: {node: '>=20'}
@@ -5807,6 +5971,9 @@ packages:
     resolution: {integrity: sha512-NoZ4roiN7LnbKn9QqE1amc9DJfzvZXxF4xDavcOWt1BPkdx+m+0gJuPM+S0vCe7zTJMYUP0R8pO2XMr+Y8oLIg==}
     engines: {node: '>=6'}
 
+  tslib@2.4.1:
+    resolution: {integrity: sha512-tGyy4dAjRIEwI7BzsB0lynWgOpfqjUdq91XXAlIWD2OwKBH7oCl/GZG/HT4BOHrTlPMOASlMQ7veyTqpmRcrNA==}
+
   tslib@2.8.1:
     resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
 
@@ -5826,6 +5993,10 @@ packages:
     resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
     engines: {node: '>= 0.8.0'}
 
+  type-fest@4.41.0:
+    resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==}
+    engines: {node: '>=16'}
+
   type-fest@5.6.0:
     resolution: {integrity: sha512-8ZiHFm91orbSAe2PSAiSVBVko18pbhbiB3U9GglSzF/zCGkR+rxpHx6sEMCUm4kxY4LjDIUGgCfUMtwfZfjfUA==}
     engines: {node: '>=20'}
@@ -6576,6 +6747,97 @@ snapshots:
 
   '@cfworker/json-schema@4.1.1': {}
 
+  '@clerk/backend@1.34.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+    dependencies:
+      '@clerk/shared': 3.47.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@clerk/types': 4.101.20(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      cookie: 1.0.2
+      snakecase-keys: 8.0.1
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - react
+      - react-dom
+
+  '@clerk/backend@3.4.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+    dependencies:
+      '@clerk/shared': 4.14.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      standardwebhooks: 1.0.0
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - react
+      - react-dom
+
+  '@clerk/clerk-sdk-node@5.1.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+    dependencies:
+      '@clerk/backend': 1.34.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@clerk/shared': 2.22.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@clerk/types': 4.101.20(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      tslib: 2.4.1
+    transitivePeerDependencies:
+      - react
+      - react-dom
+      - svix
+
+  '@clerk/nextjs@7.4.2(next@15.5.18(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+    dependencies:
+      '@clerk/backend': 3.4.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@clerk/react': 6.7.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@clerk/shared': 4.14.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      next: 15.5.18(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      react: 19.2.6
+      react-dom: 19.2.6(react@19.2.6)
+      server-only: 0.0.1
+      tslib: 2.8.1
+
+  '@clerk/react@6.7.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+    dependencies:
+      '@clerk/shared': 4.14.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      react: 19.2.6
+      react-dom: 19.2.6(react@19.2.6)
+      tslib: 2.8.1
+
+  '@clerk/shared@2.22.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+    dependencies:
+      '@clerk/types': 4.101.20(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      dequal: 2.0.3
+      glob-to-regexp: 0.4.1
+      js-cookie: 3.0.5
+      std-env: 3.10.0
+      swr: 2.4.1(react@19.2.6)
+    optionalDependencies:
+      react: 19.2.6
+      react-dom: 19.2.6(react@19.2.6)
+
+  '@clerk/shared@3.47.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+    dependencies:
+      csstype: 3.1.3
+      dequal: 2.0.3
+      glob-to-regexp: 0.4.1
+      js-cookie: 3.0.7
+      std-env: 3.10.0
+      swr: 2.3.4(react@19.2.6)
+    optionalDependencies:
+      react: 19.2.6
+      react-dom: 19.2.6(react@19.2.6)
+
+  '@clerk/shared@4.14.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+    dependencies:
+      '@tanstack/query-core': 5.100.14
+      dequal: 2.0.3
+      glob-to-regexp: 0.4.1
+      js-cookie: 3.0.7
+      std-env: 3.10.0
+    optionalDependencies:
+      react: 19.2.6
+      react-dom: 19.2.6(react@19.2.6)
+
+  '@clerk/types@4.101.20(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+    dependencies:
+      '@clerk/shared': 3.47.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+    transitivePeerDependencies:
+      - react
+      - react-dom
+
   '@connectrpc/connect-node@2.1.1(@bufbuild/protobuf@2.12.0)(@connectrpc/connect@2.1.1(@bufbuild/protobuf@2.12.0))':
     dependencies:
       '@bufbuild/protobuf': 2.12.0
@@ -9171,6 +9433,8 @@ snapshots:
       postcss: 8.5.15
       tailwindcss: 4.3.0
 
+  '@tanstack/query-core@5.100.14': {}
+
   '@tokenizer/inflate@0.4.1':
     dependencies:
       debug: 4.4.3
@@ -9226,6 +9490,11 @@ snapshots:
 
   '@types/aws-lambda@8.10.161': {}
 
+  '@types/body-parser@1.19.6':
+    dependencies:
+      '@types/connect': 3.4.38
+      '@types/node': 22.19.19
+
   '@types/bunyan@1.8.11':
     dependencies:
       '@types/node': 22.19.19
@@ -9247,6 +9516,21 @@ snapshots:
 
   '@types/estree@1.0.9': {}
 
+  '@types/express-serve-static-core@5.1.1':
+    dependencies:
+      '@types/node': 22.19.19
+      '@types/qs': 6.15.1
+      '@types/range-parser': 1.2.7
+      '@types/send': 1.2.1
+
+  '@types/express@5.0.6':
+    dependencies:
+      '@types/body-parser': 1.19.6
+      '@types/express-serve-static-core': 5.1.1
+      '@types/serve-static': 2.2.0
+
+  '@types/http-errors@2.0.5': {}
+
   '@types/json-schema@7.0.15': {}
 
   '@types/memcached@2.2.10':
@@ -9292,6 +9576,10 @@ snapshots:
       pg-protocol: 1.14.0
       pg-types: 2.2.0
 
+  '@types/qs@6.15.1': {}
+
+  '@types/range-parser@1.2.7': {}
+
   '@types/react-dom@19.2.3(@types/react@19.2.15)':
     dependencies:
       '@types/react': 19.2.15
@@ -9302,6 +9590,15 @@ snapshots:
 
   '@types/retry@0.12.0': {}
 
+  '@types/send@1.2.1':
+    dependencies:
+      '@types/node': 22.19.19
+
+  '@types/serve-static@2.2.0':
+    dependencies:
+      '@types/http-errors': 2.0.5
+      '@types/node': 22.19.19
+
   '@types/set-cookie-parser@2.4.10':
     dependencies:
       '@types/node': 22.19.19
@@ -9715,6 +10012,8 @@ snapshots:
 
   cookie@0.7.2: {}
 
+  cookie@1.0.2: {}
+
   cookie@1.1.1: {}
 
   cors@2.8.6:
@@ -9745,6 +10044,8 @@ snapshots:
 
   cssesc@3.0.0: {}
 
+  csstype@3.1.3: {}
+
   csstype@3.2.3: {}
 
   data-uri-to-buffer@4.0.1: {}
@@ -9786,6 +10087,11 @@ snapshots:
 
   diff@8.0.4: {}
 
+  dot-case@3.0.4:
+    dependencies:
+      no-case: 3.0.4
+      tslib: 2.8.1
+
   dotenv@17.4.2: {}
 
   drizzle-kit@0.31.10:
@@ -10350,6 +10656,8 @@ snapshots:
     dependencies:
       is-glob: 4.0.3
 
+  glob-to-regexp@0.4.1: {}
+
   globals@14.0.0: {}
 
   google-auth-library@10.6.2:
@@ -10574,6 +10882,10 @@ snapshots:
 
   joycon@3.1.1: {}
 
+  js-cookie@3.0.5: {}
+
+  js-cookie@3.0.7: {}
+
   js-tiktoken@1.0.21:
     dependencies:
       base64-js: 1.5.1
@@ -10738,6 +11050,10 @@ snapshots:
 
   long@5.3.2: {}
 
+  lower-case@2.0.2:
+    dependencies:
+      tslib: 2.8.1
+
   lru-cache@5.1.1:
     dependencies:
       yallist: 3.1.1
@@ -10750,6 +11066,8 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
 
+  map-obj@4.3.0: {}
+
   marky@1.3.0:
     optional: true
 
@@ -10883,6 +11201,11 @@ snapshots:
       - '@babel/core'
       - babel-plugin-macros
 
+  no-case@3.0.4:
+    dependencies:
+      lower-case: 2.0.2
+      tslib: 2.8.1
+
   node-addon-api@7.1.1: {}
 
   node-domexception@1.0.0: {}
@@ -11509,6 +11832,8 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  server-only@0.0.1: {}
+
   set-cookie-parser@2.7.2: {}
 
   set-cookie-parser@3.1.0: {}
@@ -11633,6 +11958,17 @@ snapshots:
 
   sisteransi@1.0.5: {}
 
+  snake-case@3.0.4:
+    dependencies:
+      dot-case: 3.0.4
+      tslib: 2.8.1
+
+  snakecase-keys@8.0.1:
+    dependencies:
+      map-obj: 4.3.0
+      snake-case: 3.0.4
+      type-fest: 4.41.0
+
   sonic-boom@4.2.1:
     dependencies:
       atomic-sleep: 1.0.0
@@ -11662,6 +11998,8 @@ snapshots:
 
   statuses@2.0.2: {}
 
+  std-env@3.10.0: {}
+
   std-env@4.1.0: {}
 
   stdin-discarder@0.2.2: {}
@@ -11721,6 +12059,18 @@ snapshots:
 
   supports-preserve-symlinks-flag@1.0.0: {}
 
+  swr@2.3.4(react@19.2.6):
+    dependencies:
+      dequal: 2.0.3
+      react: 19.2.6
+      use-sync-external-store: 1.6.0(react@19.2.6)
+
+  swr@2.4.1(react@19.2.6):
+    dependencies:
+      dequal: 2.0.3
+      react: 19.2.6
+      use-sync-external-store: 1.6.0(react@19.2.6)
+
   tagged-tag@1.0.0: {}
 
   tailwind-merge@3.6.0: {}
@@ -11797,6 +12147,8 @@ snapshots:
       minimist: 1.2.8
       strip-bom: 3.0.0
 
+  tslib@2.4.1: {}
+
   tslib@2.8.1: {}
 
   tsx@4.22.3:
@@ -11820,6 +12172,8 @@ snapshots:
     dependencies:
       prelude-ls: 1.2.1
 
+  type-fest@4.41.0: {}
+
   type-fest@5.6.0:
     dependencies:
       tagged-tag: 1.0.0