• Only the owner can publish new versions of an existing skill, role, agent, or memory
• Users cannot delete their own content — only admins can soft-delete
• Slug ownership is per-type: skills, roles, agents, and memories each have separate namespaces

Users can report skills, roles, agents, memories, and comments for moderation review.

Public queries exclude soft-deleted content. Admin queries retain access to deleted items for review and restoration.

Admins can:

• Soft-delete and restore skills, roles, agents, and memories
• Ban and unban users
• Assign user roles (admin, moderator, user)

All moderation actions are logged in the auditLogs table.

Banning a user blocks API access and hides their content. The ban reason is stored for audit purposes.

strawhub ban-user <handle> --reason "spam"
strawhub ban-user <handle> --unban

Users can delete their own account from Settings. Deletion is a soft-delete (deactivatedAt timestamp). Re-signing in with GitHub reactivates the account. Published content is preserved.

Admins are designated via the ADMIN_GITHUB_LOGINS Convex environment variable — a comma-separated list of GitHub logins (case-insensitive). The role is synced on every sign-in: users in the list get admin, everyone else gets user.

• Token format: sh_ prefix + 32 random hex bytes
• Only the SHA-256 hash is stored server-side
• Raw token shown once on creation
• Tokens can be revoked from Settings

All rate limits are per IP address.

• Max 100 files per package, 10 MB each, 50 MB total
• Allowed extensions: .md, .txt, .json, .yaml, .yml, .toml
• Roles must contain exactly one file (ROLE.md)

• Max 100 files per package, 10 MB each, 50 MB total
• Supports binary files (compiled executables, data files)

• Version monotonicity: new versions must be strictly greater than the latest
• Dependency constraints are validated at publish time