Merge master and preserve YT6801 ioctl removal

2026-09-24 11:58:23 +01:00
commit cda21f1d62
@@ -1,5 +1,19 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "a0f4262f94eb8a5b604146e71d42a3bb522feedf"
+  "upstream": {
+    "watch": {
+      "debian": "https://downloads.1password.com/linux/debian/amd64/dists/beta/main/binary-amd64/Packages",
+      "package": "1password",
+      "pattern": "(?P<version>[0-9]+(?:\\.[0-9]+)*)~(?P<build>[0-9]+)\\.BETA",
+      "version": "{version}_{build}.BETA",
+      "variables": {
+        "_tarver": "{version}-{build}.BETA"
+      }
+    }
+  },
+  "origin": {
+    "aur": "1password-beta",
+    "commit": "18d2de51dc01c9a58c1e8e96262f7afadcbf0648"
+  }
 }
@@ -1,83 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-# Keep the AUR x86_64 checksums and add aarch64 sources. The aarch64
-# artifacts are signed by 1Password's validpgpkeys, so we skip checksums there
-# instead of baking version-specific hashes into Omarchy metadata.
-set +u
-CARCH=x86_64 source PKGBUILD
-set -u
-
-if declare -p sha256sums >/dev/null 2>&1 && [[ ${#sha256sums[@]} -ge 2 ]]; then
-  x86_sums=("${sha256sums[@]}")
-elif declare -p sha256sums_x86_64 >/dev/null 2>&1 && [[ ${#sha256sums_x86_64[@]} -ge 2 ]]; then
-  x86_sums=("${sha256sums_x86_64[@]}")
-else
-  echo "Unable to read x86_64 checksums from PKGBUILD" >&2
-  exit 1
-fi
-
-sha256_from_url() {
-  curl -fsSL "$1" | sha256sum | awk '{ print $1 }'
-}
-
-arm_url="https://downloads.1password.com/linux/tar/beta/aarch64/1password-${_tarver}.arm64.tar.gz"
-arm_tar_sum=$(sha256_from_url "$arm_url")
-arm_sig_sum=$(sha256_from_url "$arm_url.sig")
-
-emit_archdir() {
-  cat <<'EOF'
-case "${CARCH}" in
-    x86_64)
-        _archdir="x64"
-        ;;
-    aarch64)
-        _archdir="arm64"
-        ;;
-esac
-EOF
-}
-
-emit_sources() {
-  cat <<EOF
-source=()
-sha256sums=()
-source_x86_64=(https://downloads.1password.com/linux/tar/beta/x86_64/1password-\${_tarver}.x64.tar.gz{,.sig})
-source_aarch64=(https://downloads.1password.com/linux/tar/beta/aarch64/1password-\${_tarver}.arm64.tar.gz{,.sig})
-sha256sums_x86_64=('${x86_sums[0]}'
-                   '${x86_sums[1]}')
-sha256sums_aarch64=('$arm_tar_sum'
-                    '$arm_sig_sum')
-EOF
-}
-
-tmpfile=$(mktemp)
-skip_checksums=false
-
-while IFS= read -r line || [[ -n "$line" ]]; do
-  if [[ "$skip_checksums" == true ]]; then
-    [[ "$line" == ")" ]] && skip_checksums=false
-    continue
-  fi
-
-  case "$line" in
-    '_tar="1password-${_tarver}.x64.tar.gz"')
-      emit_archdir >> "$tmpfile"
-      ;;
-    "arch=('x86_64')")
-      echo "arch=('x86_64' 'aarch64')" >> "$tmpfile"
-      ;;
-    source=\(*)
-      emit_sources >> "$tmpfile"
-      ;;
-    sha256sums=\(*)
-      [[ "$line" == *")" ]] || skip_checksums=true
-      ;;
-    *)
-      line=${line//1password-\$\{_tarver\}.x64/1password-\$\{_tarver\}.\$\{_archdir\}}
-      printf '%s\n' "$line" >> "$tmpfile"
-      ;;
-  esac
-done < PKGBUILD
-
-mv "$tmpfile" PKGBUILD
@@ -1,6 +1,6 @@
 pkgname=1password-beta

-_tarver=8.12.34-29.BETA
+_tarver=8.12.38-25.BETA
 case "${CARCH}" in
    x86_64)
        _archdir="x64"
@@ -9,8 +9,8 @@ case "${CARCH}" in
        _archdir="arm64"
        ;;
 esac
-pkgver=${_tarver//-/_}
-pkgrel=29.1
+pkgver=8.12.38_25.BETA
+pkgrel=25.2
 conflicts=('1password' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
 arch=('x86_64' 'aarch64')
@@ -22,10 +22,10 @@ source=()
 sha256sums=()
 source_x86_64=(https://downloads.1password.com/linux/tar/beta/x86_64/1password-${_tarver}.x64.tar.gz{,.sig})
 source_aarch64=(https://downloads.1password.com/linux/tar/beta/aarch64/1password-${_tarver}.arm64.tar.gz{,.sig})
-sha256sums_x86_64=('6894b283a534cf94b07903fb38966a0aab2e37f75ee3848ce340308819aadddb'
-                   '8d4df4d0a80d2be7aad7d91ad964a750c8f32db5007261045003c191690c8246')
-sha256sums_aarch64=('c77ce6ddf36dbd6054c64d91b7f644274d3218f465fd60e211d0296f6443124a'
-                    '91c7249a1cf5e7924ef2810cb0cb1b893d8a9a424b373b433f45d7aaa5a8369b')
+sha256sums_x86_64=('c6d302a2c7404a7ded34a3c4f1c401a43eafeed8b147d128dcb416284c2c2b71'
+                   'cc0f00054749c32d77fba31a12a8dece812e409f4b9d81850d2f9b50fab55dca')
+sha256sums_aarch64=('1fd62cd0df90098dd5e50d22e9a6c0a5221f9db6355b7c848db7af7076b395fd'
+                    '4d273b71ab987dcadad9e4fa7cfac7e0173dc4dbe7908c9a3e76af274313dd76')
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')

 package() {
@@ -42,7 +42,7 @@ package() {
            "${pkgdir}/usr/share/icons/hicolor/${resolution}/apps/1password.png"
    done
    # Install desktop file
-    install -Dm0644 resources/1password.desktop -t "${pkgdir}"/usr/share/applications/
+    install -Dm0644 resources/com.onepassword.OnePassword.desktop -t "${pkgdir}"/usr/share/applications/

    # Fill in policy kit file with a list of (the first 10) human users of the system.
    export POLICY_OWNERS
@@ -65,8 +65,7 @@ EOF" > ./com.1password.1Password.policy
    # Cleanup un-needed files
    rm "${pkgdir}"/opt/1Password/com.1password.1Password.policy "${pkgdir}"/opt/1Password/com.1password.1Password.policy.tpl "${pkgdir}"/opt/1Password/install_biometrics_policy.sh
    rm -r "${pkgdir}"/opt/1Password/resources/icons/
-    rm "${pkgdir}"/opt/1Password/resources/1password.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
-
+    rm "${pkgdir}"/opt/1Password/resources/com.onepassword.OnePassword.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
    # Symlink /usr/bin executable to opt
    install -dm0755 "${pkgdir}"/usr/bin
    ln -s /opt/1Password/1password "${pkgdir}"/usr/bin/1password
@@ -1,5 +1,14 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "b0d208821677a5dbb883a8b92f06a5c92b9e861a"
+  "upstream": {
+    "watch": {
+      "json": "https://app-updates.agilebits.com/check/1/0/CLI2/en/0",
+      "path": "version"
+    }
+  },
+  "origin": {
+    "aur": "1password-cli",
+    "commit": "b0d208821677a5dbb883a8b92f06a5c92b9e861a"
+  }
 }
@@ -1,6 +1,6 @@
 pkgname=1password
-pkgver=8.12.34
-pkgrel=36
+pkgver=8.12.36
+pkgrel=2
 conflicts=('1password-beta' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
 arch=('x86_64' 'aarch64')
@@ -16,11 +16,13 @@ source_aarch64=(
    "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${pkgver}.arm64.tar.gz"
    "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${pkgver}.arm64.tar.gz.sig"
 )
-sha256sums_x86_64=('297784aa66770b645607a7f04c9ba2c4aebed4f46d21202487f521ba572b7b13'
-                   'ec085bef60de748895d3c51a8208301ba2ac8fb47db99334539ba4bd1d3260d7'
+sha256sums_x86_64=(
+  '393c93c8025fee5dda76a4d0f1e478e98526cc946e58a22efe26f540ea2b5729'
+  '251177694bfdc63c431021e2bd2ed64f241b8a0247d5dd1c46d4d2dadffe7b97'
 )
-sha256sums_aarch64=('ea5102363d6cf3442b96a7abd6743da8c1d261f56a628e1a3c183d84fa65fdcb'
-                    'f44db73fa44c3f68c3ab78a9cce140be9355de1dd9be4ce731c9d6597960c907'
+sha256sums_aarch64=(
+  '4b58851b3bf52a7bbc79243fc6b9cba9591cabe8b7eb2d0e271593bad2192af9'
+  'b5ba754ec22f9ecd980986582cb3ea0c6af45b276bfe8897724bf4abfa17e27f'
 )
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')

@@ -49,7 +51,8 @@ package() {
            "${pkgdir}/usr/share/icons/hicolor/${resolution}/apps/1password.png"
    done
    # Install desktop file
-    install -Dm0644 resources/1password.desktop -t "${pkgdir}"/usr/share/applications/
+    install -Dm0644 resources/com.onepassword.OnePassword.desktop \
+        "${pkgdir}/usr/share/applications/1password.desktop"

    # 1Password reads the display scale itself, the way Electron apps do, and
    # comes up oversized next to every other window on a scaled monitor. Pin it
@@ -78,7 +81,7 @@ EOF" > ./com.1password.1Password.policy
    # Cleanup un-needed files
    rm "${pkgdir}"/opt/1Password/com.1password.1Password.policy "${pkgdir}"/opt/1Password/com.1password.1Password.policy.tpl "${pkgdir}"/opt/1Password/install_biometrics_policy.sh
    rm -r "${pkgdir}"/opt/1Password/resources/icons/
-    rm "${pkgdir}"/opt/1Password/resources/1password.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
+    rm "${pkgdir}"/opt/1Password/resources/com.onepassword.OnePassword.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers

    # Symlink /usr/bin executable to opt
    install -dm0755 "${pkgdir}"/usr/bin
@@ -1,5 +1,14 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "0f047f40a200121075ca3cedce59ddf226f2a0f1"
+  "upstream": {
+    "watch": {
+      "github": "omacom/aether",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "aether",
+    "commit": "0f047f40a200121075ca3cedce59ddf226f2a0f1"
+  }
 }
@@ -1,6 +1,6 @@
 # Maintainer: Bjarne Øverli <bjarne@oever.li>
 pkgname=aether
-pkgver=4.29.8
+pkgver=4.30.0
 pkgrel=1
 pkgdesc='Desktop theming application - extract colors from wallpapers and apply cohesive themes'
 arch=('x86_64' 'aarch64')
@@ -10,9 +10,9 @@ depends=('webkit2gtk-4.1' 'gtk3')
 source=("aether-${pkgver}.tar.gz::https://github.com/omacom/aether/archive/refs/tags/v${pkgver}.tar.gz")
 source_x86_64=("aether-linux-amd64-${pkgver}::https://github.com/omacom/aether/releases/download/v${pkgver}/aether-linux-amd64")
 source_aarch64=("aether-linux-arm64-${pkgver}::https://github.com/omacom/aether/releases/download/v${pkgver}/aether-linux-arm64")
-sha256sums=('b83e0eeb1332b4ed655389a051d5b9b14a3e109968b7f278005e52c5e69a1e9c')
-sha256sums_x86_64=('d3d2d07b32da7a495221ed271ee66f4a1e344c91dcec9b267ec0a74ab6e36462')
-sha256sums_aarch64=('ffcfd23d0375a3f0c0ce014821cc5e1670f2e061c35e991340e75352dac9b731')
+sha256sums=('f67c8d2c6f27f67a755bc279ece5ddb194f1bb165648280b9a7be86904d36ff5')
+sha256sums_x86_64=('75bda600ddd3ecab3338de5c0c5d5e2c9f08cfc0c465b63f8e6cb9c5cb60d68e')
+sha256sums_aarch64=('a91d800736def74d86e19d8acbecc4bda3d7c3e64fb95273f809707104c3a5bc')
 noextract=("aether-linux-amd64-${pkgver}" "aether-linux-arm64-${pkgver}")

 package() {
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "b0ec6ca495eb331a684db91b0fe12085a868b632"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "git_tags": "https://github.com/OpenGamingCollective/asusctl.git",
+      "pattern": "(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "asusctl",
+    "commit": "b0ec6ca495eb331a684db91b0fe12085a868b632"
+  }
 }
@@ -4,7 +4,7 @@

 pkgbase=asusctl
 pkgname=(asusctl rog-control-center)
-pkgver=6.4.0
+pkgver=6.5.0
 pkgrel=1
 pkgdesc="Daemon and tools to control your ASUS ROG laptop"
 arch=('x86_64')
@@ -12,7 +12,7 @@ url="https://asus-linux.org"
 license=('MPL-2.0')
 makedepends=('cargo' 'fontconfig')
 source=("${pkgbase}-${pkgver}.tar.gz::https://github.com/OpenGamingCollective/asusctl/archive/${pkgver}.tar.gz")
-b2sums=('e90074e904f364386ad661784bd9fc2e929e83ea06ac62fd1d34eb03490cefe8aae3bed2722162f1e8ea5d69248138cb5fd9f90c3a18443d1d8c04cf732b928a')
+b2sums=('4179e08a60f9480b62e41d84faade1f46407140a213ca4d60c8699837a2486bda8e66b4ca43fa06149667d02e3d060c3efd792348f9a93a675f762d6ea2d05f8')

 prepare() {
    cd "${pkgbase}-${pkgver}"
@@ -0,0 +1,9 @@
+{
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)",
+      "git_tags": "https://github.com/AsahiLinux/avd-fw.git"
+    }
+  }
+}
@@ -0,0 +1,51 @@
+# Open replacement firmware for the Apple Video Decoder.
+# Built from AsahiLinux sources, without extracting proprietary firmware.
+
+pkgname=avd-fw
+pkgver=0.1
+pkgrel=1
+pkgdesc='Open replacement firmware for the Apple Video Decoder (AVD) on Apple Silicon'
+# This recipe uses the native ARM linker and serves Apple Silicon systems.
+# Restrict both builds and publication to aarch64.
+arch=('aarch64')
+url='https://github.com/AsahiLinux/avd-fw'
+license=('MIT')
+# clang cross-compiles to arm-none-eabi out of the box, so no arm-none-eabi
+# toolchain is required; llvm supplies llvm-objcopy, which meson.build looks
+# up by name to turn each linked ELF into a padded raw image.
+makedepends=('meson' 'clang' 'llvm')
+# !buildflags is load-bearing: makepkg's CFLAGS/LDFLAGS target the aarch64 host
+# and would be injected into a bare-metal Cortex-M3 build. !strip keeps makepkg
+# from running the host strip over raw firmware images.
+options=('!strip' '!debug' '!buildflags' '!lto')
+source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
+sha256sums=('2e131244275cb15c94243e41eec8a2a665ec895cfe3a818181549db991e62c67')
+
+build() {
+  # The cross file selects clang, pins the host machine to cortex-m3 and sets
+  # libdir=lib, which lands the images in /usr/lib/firmware/apple.
+  #
+  # Optimization is pinned to match upstream's Makefile (-O2). Meson's default
+  # buildtype is "debug" (-O0 -g), which would ship unoptimized firmware; the
+  # MMIO accessors in src/util.c go through a volatile typedef, so -O2 cannot
+  # elide register reads or writes.
+  meson setup \
+    --cross-file "$pkgname-$pkgver/llvm.ini" \
+    --prefix=/usr \
+    -Doptimization=2 \
+    -Ddebug=false \
+    "$pkgname-$pkgver" build
+
+  meson compile -C build
+}
+
+package() {
+  meson install -C build --destdir "$pkgdir"
+
+  # meson installs custom_target outputs 0755; these are firmware blobs, not
+  # programs, and every other firmware file on the system is 0644.
+  chmod 644 "$pkgdir"/usr/lib/firmware/apple/*.bin
+
+  install -Dm644 "$pkgname-$pkgver/LICENSE" \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}
@@ -0,0 +1,17 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "origin": {
+    "aur": "bambustudio-bin",
+    "commit": "b962c12d14873f94669e0e256a444f957b1843cd"
+  },
+  "upstream": {
+    "watch": {
+      "regex": "https://api.github.com/repos/bambulab/BambuStudio/releases/latest",
+      "pattern": "\"name\"\\s*:\\s*\"BambuStudio_ubuntu24\\.04-v(?P<version>[0-9]+(?:\\.[0-9]+)*)-(?P<build>[0-9]+)\\.AppImage\"",
+      "variables": {
+        "_build": "{build}"
+      }
+    }
+  }
+}
@@ -0,0 +1,12 @@
+[Desktop Entry]
+Name=Bambu Studio
+GenericName=3D Printing Software
+Comment=Slicer for Bambu Lab and other 3D printers
+Exec=/usr/bin/bambu-studio %U
+Icon=BambuStudio
+Terminal=false
+Type=Application
+Categories=Graphics;3DGraphics;Engineering;
+MimeType=x-scheme-handler/bambustudio;x-scheme-handler/bambustudioopen;model/stl;model/3mf;application/vnd.ms-3mfdocument;application/prs.wavefront-obj;application/x-amf;
+Keywords=3D;Printing;Slicer;gcode;stl;3mf;
+StartupWMClass=bambu-studio
@@ -0,0 +1,48 @@
+# Maintainer: goll <adrian.goll+aur[at]gmail>
+# Contributor: George Woodall <georgewoodall82@gmail.com>
+pkgname=bambustudio-bin
+pkgver=02.08.02.61
+pkgrel=1
+pkgdesc="PC Software for BambuLab's 3D printers"
+arch=("x86_64")
+url="https://github.com/bambulab/BambuStudio"
+license=('AGPL-3.0-only')
+conflicts=('bambustudio' 'bambustudio-git')
+depends=('cairo' 'dbus' 'fontconfig' 'gcc-libs' 'glib2' 'glibc'
+         'gst-libav' 'gst-plugins-base-libs' 'gstreamer' 'gtk3' 'libglvnd'
+         'libx11' 'mesa' 'pango' 'wayland' 'webkit2gtk-4.1')
+makedepends=('7zip')
+options=('!strip' '!debug')
+# The upstream watch updates the timestamp together with pkgver.
+_build=20260820225108
+source=("bambustudio-${pkgver}.AppImage::https://github.com/bambulab/BambuStudio/releases/download/v${pkgver}/BambuStudio_ubuntu24.04-v${pkgver}-${_build}.AppImage"
+        "BambuStudio.desktop"
+        "bambu-studio")
+noextract=("bambustudio-${pkgver}.AppImage")
+sha256sums=(
+    'd501b103fac5424513ec0e8d6bc145fb30719de2c7d94d7320d723740c81a7fd'
+    'f10718a8b201cad64800746fe8167ccc032c545d05f7ad8caa99eb5fb975f2a1'
+    'a3a5c8f6a8b287e42b93957e9602621923c766e0b6a3f10c14eca10b023b15f2'
+)
+
+prepare() {
+    # Read the embedded SquashFS without executing or modifying the AppImage.
+    rm -rf "$srcdir/squashfs-root"
+    7z x "$srcdir/bambustudio-${pkgver}.AppImage" -o"$srcdir/squashfs-root" >/dev/null
+}
+
+package() {
+    cd "$srcdir/squashfs-root"
+    install -Dm755 AppRun "$pkgdir/opt/$pkgname/AppRun"
+    cp -a bin resources "$pkgdir/opt/$pkgname/"
+
+    local icon size
+    for icon in usr/share/icons/hicolor/*/apps/BambuStudio.png; do
+        size="${icon#usr/share/icons/hicolor/}"
+        install -Dm644 "$icon" "$pkgdir/usr/share/icons/hicolor/$size"
+    done
+
+    install -Dm755 "$srcdir/bambu-studio" "$pkgdir/usr/bin/bambu-studio"
+    install -Dm644 "$srcdir/BambuStudio.desktop" \
+        "$pkgdir/usr/share/applications/BambuStudio.desktop"
+}
@@ -0,0 +1,2 @@
+#!/bin/bash
+exec "/opt/bambustudio-bin/AppRun" "$@"
@@ -1,5 +1,14 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "1e7bd48ef192b3d6a2854916e75e14ea43f6f0b7"
+  "upstream": {
+    "watch": {
+      "github": "basecamp/basecamp-cli",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "basecamp-cli",
+    "commit": "89c4eb5a0ac9ffe98aecd4ea8b789cf1fee42bf1"
+  }
 }
@@ -1,7 +1,7 @@
 # Maintainer: Basecamp <support@basecamp.com>
 pkgname=basecamp-cli
-pkgver=0.10.0
-pkgrel=1
+pkgver=0.11.0
+pkgrel=2
 pkgdesc="CLI for Basecamp project management"
 arch=('x86_64' 'aarch64')
 url="https://github.com/basecamp/basecamp-cli"
@@ -13,10 +13,10 @@ optdepends=(
  'zsh: for zsh shell completions'
  'fish: for fish shell completions'
 )
-source_x86_64=("https://github.com/basecamp/basecamp-cli/releases/download/v0.10.0/basecamp_${pkgver}_linux_amd64.tar.gz")
-source_aarch64=("https://github.com/basecamp/basecamp-cli/releases/download/v0.10.0/basecamp_${pkgver}_linux_arm64.tar.gz")
-sha256sums_x86_64=('ca8b3a085f90323c8ab1694b83ff624cf10c459618ca6010ce204534f3f01987')
-sha256sums_aarch64=('dd1b5db88b9b309e95ae1ec0d642d23f4955a3abe159bffe00796a0ef6030c1d')
+source_x86_64=("https://github.com/basecamp/basecamp-cli/releases/download/v${pkgver}/basecamp_${pkgver}_linux_amd64.tar.gz")
+source_aarch64=("https://github.com/basecamp/basecamp-cli/releases/download/v${pkgver}/basecamp_${pkgver}_linux_arm64.tar.gz")
+sha256sums_x86_64=('425ffab1251c4315c5f731f8367c3c8c37b54b6b1050eafdbe369e11e1a1ce51')
+sha256sums_aarch64=('9c433b12a704402a98b238abb3128a0844a0bc682064adb260b11bc228b3595e')

 package() {
  install -Dm755 "basecamp" "${pkgdir}/usr/bin/basecamp"
@@ -1,5 +1,14 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "195b828d52ce9a181215f753927123e7ef2af252"
+  "upstream": {
+    "watch": {
+      "github": "oven-sh/bun",
+      "pattern": "bun-v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "bun-bin",
+    "commit": "195b828d52ce9a181215f753927123e7ef2af252"
+  }
 }
@@ -3,7 +3,7 @@
 # Contributor: 37h4n (aarch64 support added by Ethan Reece <aur at ethanreece dot com>)
 # Contributor: sh!zeeg (shizeeque@gmail.com) support for non-avx2 CPUs, shell completions.
 pkgname=bun-bin
-pkgver=1.3.11
+pkgver=1.4.2
 pkgrel=1
 pkgdesc="All-in-one JavaScript runtime built for speed, with bundler, transpiler, test runner, and package manager. Includes bunx, shell completions and support for baseline CPUs"
 arch=('x86_64' 'aarch64')
@@ -12,11 +12,8 @@ license=('MIT')
 provides=('bun')
 conflicts=('bun')
 options=('!debug')
-sha256sums_x86_64=('8611ba935af886f05a6f38740a15160326c15e5d5d07adef966130b4493607ed'
-                   'abe346f63414547cdf6b35b7a649a490c728b93d006226156923918a84c0e59b'
-                   '9b296bcc20090b5ea079dc1bca15913a32246121169bcf54cbdb7384d6f5b32b')
-sha256sums_aarch64=('d13944da12a53ecc74bf6a720bd1d04c4555c038dfe422365356a7be47691fdf'
-                    '9b296bcc20090b5ea079dc1bca15913a32246121169bcf54cbdb7384d6f5b32b')
+sha256sums_x86_64=('36368faef7527875d5ffa52e53cd48021741f2a83eb6208a8dd64068d422a913' 'c678040f14fe0440eb839d37cbd0ce4c051a32da72806ac97de6a6aab6bf728f' '9b296bcc20090b5ea079dc1bca15913a32246121169bcf54cbdb7384d6f5b32b')
+sha256sums_aarch64=('54328bbc2d9c8e0c9f892c544d66c57a83b84139e34909e5ee81758f1ac8fda7' '9b296bcc20090b5ea079dc1bca15913a32246121169bcf54cbdb7384d6f5b32b')
 source_x86_64=(
 "bun-x64.zip::https://github.com/oven-sh/bun/releases/download/bun-v${pkgver}/bun-linux-x64.zip"
 "bun-x64-baseline.zip::https://github.com/oven-sh/bun/releases/download/bun-v${pkgver}/bun-linux-x64-baseline.zip"
@@ -1,5 +1,14 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "87aa5d5f2771c83dae737fe1bcfbc129110291fb"
+  "upstream": {
+    "watch": {
+      "regex": "https://downloads.claude.ai/claude-code-releases/latest",
+      "pattern": "^(?P<version>[0-9]+(?:\\.[0-9]+)*)\\s*$"
+    }
+  },
+  "origin": {
+    "aur": "claude-code",
+    "commit": "27f61daa48ebdca87c9b2c7c83c162100d233ccc"
+  }
 }
@@ -4,7 +4,7 @@
 # Automation repository: https://github.com/fabifont/claude-code-aur

 pkgname=claude-code
-pkgver=2.1.263
+pkgver=2.1.278
 pkgrel=1
 pkgdesc="An agentic coding tool that lives in your terminal"
 arch=('x86_64' 'aarch64')
@@ -29,8 +29,8 @@ source_x86_64=("claude-${pkgver}-x86_64::https://downloads.claude.ai/claude-code
 source_aarch64=("claude-${pkgver}-aarch64::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-arm64/claude")

 sha256sums=('SKIP')
-sha256sums_x86_64=('26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba')
-sha256sums_aarch64=('7d25d7c8ae6c6e009cc7dae4e817f674179fd31fb7761bcd56fee4c2902b4c03')
+sha256sums_x86_64=('5c4735937844e84f8a93306e841a5b0e12252909b07870f789b190468da147ab')
+sha256sums_aarch64=('7de6cab134e48321148e30182c98614118e8f4666819412bead45865190b34ed')

 package() {
 	install -Dm755 "${srcdir}/claude-${pkgver}-${CARCH}" "${pkgdir}/opt/claude-code/bin/claude"
@@ -0,0 +1,12 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "upstream": {
+    "debian": "https://downloads.claude.ai/claude-desktop/apt/stable/dists/stable/main/binary-amd64/Packages",
+    "package": "claude-desktop",
+    "sources": {
+      "x86_64": ["https://downloads.claude.ai/claude-desktop/apt/stable/pool/main/c/claude-desktop/claude-desktop_{pkgver}_amd64.deb"],
+      "aarch64": ["https://downloads.claude.ai/claude-desktop/apt/stable/pool/main/c/claude-desktop/claude-desktop_{pkgver}_arm64.deb"]
+    }
+  }
+}
@@ -0,0 +1,99 @@
+# Maintainer: Spencer Bull <spencerbull2554@gmail.com>
+
+# Omarchy tracks Anthropic's own Debian repository, the only channel the
+# Linux beta ships through. The declarative "debian" upstream provider in
+# .omarchy/package.json rewrites the version and checksums below from that
+# repository's package index.
+
+pkgname=claude-desktop
+pkgver=2.2553.1
+pkgrel=1
+pkgdesc="Official Claude desktop app with Claude Code"
+arch=('x86_64' 'aarch64')
+url="https://claude.ai"
+license=('custom')
+
+depends=(
+  'alsa-lib'
+  'at-spi2-core'
+  'bash'
+  'gcc-libs'
+  'glibc'
+  'gtk3'
+  'libdrm'
+  'libnotify'
+  'libsecret'
+  'libxcb'
+  'libxtst'
+  'mesa'
+  'nss'
+  'util-linux-libs'
+  'xdg-desktop-portal'
+  'xdg-utils'
+)
+
+optdepends=(
+  'gnome-keyring: store credentials in a system keyring'
+  'bubblewrap: Claude Code sandboxing'
+  'socat: Claude Code sandboxing'
+)
+# Cowork is x86_64-only here: Arch Linux ARM ships no UEFI firmware package,
+# so on aarch64 the app's /usr/share/AAVMF probe has nothing to resolve to.
+optdepends_x86_64=(
+  'qemu-system-x86: run Cowork tasks in a local virtual machine'
+  'edk2-ovmf: UEFI firmware for the Cowork virtual machine'
+  'virtiofsd: file sharing with the Cowork virtual machine'
+)
+
+makedepends=('libarchive')
+options=('!debug' '!strip')
+
+# Omarchy: same treatment as openai-codex-desktop. The build image compresses
+# with zstd at its default level, which leaves this 560 MB Electron tree at
+# 210 MB. Maximum zstd takes it to 160 MB for ~3 extra minutes of build time
+# -- worth it for a package every user re-downloads on each of Anthropic's
+# frequent releases.
+COMPRESSZST=(zstd -c -z -q --ultra -22 --threads=0 -)
+
+_deb_x86_64="claude-desktop_${pkgver}_amd64.deb"
+_deb_aarch64="claude-desktop_${pkgver}_arm64.deb"
+source=('claude-desktop-launcher.sh')
+_pool="https://downloads.claude.ai/claude-desktop/apt/stable/pool/main/c/claude-desktop"
+source_x86_64=("${_deb_x86_64}::${_pool}/${_deb_x86_64}")
+source_aarch64=("${_deb_aarch64}::${_pool}/${_deb_aarch64}")
+noextract=("${_deb_x86_64}" "${_deb_aarch64}")
+sha256sums=('edfdbc63b65891ef7c481b07086c7e630fc102c042b6ed65331a52fcaf72b14a')
+sha256sums_x86_64=('6700fdd84e77a6b8c93912c2f69eb5d1e40fa99bcd9d37f438f809ef2a6fe6f8')
+sha256sums_aarch64=('0003a6f9605a210f03c38670d62cd59c71153c2702aa4427e4cabe2e2e5f3390')
+
+package() {
+  cd "${srcdir}"
+
+  local deb_var="_deb_${CARCH}"
+  local deb="${!deb_var}"
+
+  bsdtar -xOf "${deb}" data.tar.xz |
+    bsdtar --no-same-owner -xf - -C "${pkgdir}"
+
+  # Upstream's /usr/bin/claude-desktop is a bare symlink to the Electron
+  # binary; replace it with a launcher that picks the right Ozone platform.
+  rm "${pkgdir}/usr/bin/claude-desktop"
+  install -Dm755 claude-desktop-launcher.sh "${pkgdir}/usr/bin/claude-desktop"
+
+  install -Dm644 "${pkgdir}/usr/share/doc/claude-desktop/copyright" \
+    "${pkgdir}/usr/share/licenses/${pkgname}/copyright"
+
+  # Cowork probes Debian's paths for its VM stack; map them onto Arch's.
+  # The links dangle harmlessly until the matching optdepends are installed.
+  if [[ "${CARCH}" == x86_64 ]]; then
+    install -d "${pkgdir}/usr/libexec"
+    ln -s ../lib/virtiofsd "${pkgdir}/usr/libexec/virtiofsd"
+    # The app derives the VARS path from the CODE path, so both need a link.
+    install -d "${pkgdir}/usr/share/edk2"
+    ln -s x64/OVMF_CODE.4m.fd "${pkgdir}/usr/share/edk2/OVMF_CODE_4M.fd"
+    ln -s x64/OVMF_VARS.4m.fd "${pkgdir}/usr/share/edk2/OVMF_VARS_4M.fd"
+  fi
+
+  # Debian package-policy files are not used on Arch Linux.
+  rm -rf "${pkgdir}/usr/share/doc" "${pkgdir}/usr/share/lintian"
+}
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -euo pipefail
+
+user_flags=()
+config_home="${XDG_CONFIG_HOME:-}"
+[[ -n "$config_home" || -z "${HOME:-}" ]] || config_home="$HOME/.config"
+flags_file="${config_home:+$config_home/claude-desktop-flags.conf}"
+
+if [[ -n "$flags_file" && -f "$flags_file" && -r "$flags_file" ]]; then
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    line="${line%%#*}"
+    [[ -n "${line//[[:space:]]/}" ]] || continue
+    read -r -a flags <<<"$line"
+    user_flags+=("${flags[@]}")
+  done <"$flags_file"
+fi
+
+# Chromium's own Ozone detection falls back to XWayland often enough to matter,
+# and the result is a blurry window on every scaled display. Ask for Wayland
+# directly, unless the user has already picked a platform themselves.
+platform_flags=()
+if [[ -n "${WAYLAND_DISPLAY:-}" || "${XDG_SESSION_TYPE:-}" == wayland ]]; then
+  platform_flags=(--ozone-platform=wayland)
+
+  for flag in "${user_flags[@]}" "$@"; do
+    case "$flag" in
+      --ozone-platform=* | --ozone-platform-hint=*) platform_flags=() ;;
+    esac
+  done
+fi
+
+exec /usr/lib/claude-desktop/claude-desktop "${platform_flags[@]}" "${user_flags[@]}" "$@"
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "0e012cbfe1ea6cbbf15e2ada9cf93cca7aaa9ca0"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "bjarneo/cliamp",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "cliamp",
+    "commit": "92fb021a1c78f75043cbbd402aca8b515af069ec"
+  }
 }
@@ -1,6 +1,6 @@
 # Maintainer: bjarneo <https://github.com/bjarneo>
 pkgname=cliamp
-pkgver=2.0.1
+pkgver=2.2.0
 pkgrel=1
 pkgdesc='A retro terminal music player inspired by Winamp 2.x'
 arch=('x86_64' 'aarch64')
@@ -11,7 +11,7 @@ optdepends=('pipewire-alsa: audio output on PipeWire systems'
  'pulseaudio-alsa: audio output on PulseAudio systems')
 makedepends=('go')
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/bjarneo/cliamp/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('2c5885665dba5ed2e8dc156bce64751199a92efed7f63959c65e985759b73732')
+sha256sums=('54ffbba6983880c915d2c13c83ca1339de2d2a3c5af3bb0a176923faa9afc015')

 build() {
    cd "${pkgname}-${pkgver}"
@@ -1,5 +1,14 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "1a56795cad77f703b8d0e5edefcd30926c6091c6"
+  "upstream": {
+    "watch": {
+      "github": "charmbracelet/crush",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "crush-bin",
+    "commit": "9c63847ccd3650646141f84384545c8fe2d68bb7"
+  }
 }
@@ -3,7 +3,7 @@
 # Maintainer: caarlos0 <carlos@charm.sh>

 pkgname='crush-bin'
-pkgver=0.92.0
+pkgver=0.96.0
 pkgrel=1
 pkgdesc='A powerful terminal-based AI assistant for developers, providing intelligent coding assistance directly in your terminal.'
 url='https://charm.sh/crush'
@@ -13,16 +13,16 @@ provides=('crush')
 conflicts=('crush')

 source_aarch64=("${pkgname}_${pkgver}_aarch64.tar.gz::https://github.com/charmbracelet/crush/releases/download/v${pkgver}/crush_${pkgver}_Linux_arm64.tar.gz")
-sha256sums_aarch64=('1b6f0384297a1e77d01df41db1f56fc0872f1e9c9d99634c4b2c208b7bb5d935')
+sha256sums_aarch64=('667062a39d499506b0fe151148f8d7a1c5cb5722902080d44bb3dd2ddafbf5c1')

 source_armv7h=("${pkgname}_${pkgver}_armv7h.tar.gz::https://github.com/charmbracelet/crush/releases/download/v${pkgver}/crush_${pkgver}_Linux_armv7.tar.gz")
-sha256sums_armv7h=('dac6c6d57e3ffc84d24883ce63b84e9a940ca243d9ea6954a732f0f7da862a2a')
+sha256sums_armv7h=('1de4c1ccb237743e4debb8c302df612fcef5c9b3b5378f5b65c8c6f8bc15cbfa')

 source_i686=("${pkgname}_${pkgver}_i686.tar.gz::https://github.com/charmbracelet/crush/releases/download/v${pkgver}/crush_${pkgver}_Linux_i386.tar.gz")
-sha256sums_i686=('29f2586dfc6b065a30d5f740ff2ca1ed03fbccdcd84a8bf826f1882f0f3660a1')
+sha256sums_i686=('4ec66431565de5721afb7afdd99e45ff6bc9c7e667bd18d9696ea7c5622e158d')

 source_x86_64=("${pkgname}_${pkgver}_x86_64.tar.gz::https://github.com/charmbracelet/crush/releases/download/v${pkgver}/crush_${pkgver}_Linux_x86_64.tar.gz")
-sha256sums_x86_64=('7d9aca9ab7808ee828a0bb0fde01d96fc480ce0a66a5ff617aa27ac09e23cbd5')
+sha256sums_x86_64=('5b33303a404acacf761c027e9fa9e69d4d2dd050c2690abe40877c49574b7475')

 package() {
  case "$CARCH" in
@@ -0,0 +1,5 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "min_release_age": "24h"
+}
@@ -0,0 +1,160 @@
+#!/bin/bash
+# Offline hook fixtures, also run by bin/sync-upstream self-test. Requires
+# GNU date, jq, and pacman's vercmp, like the repository's other self-tests.
+set -euo pipefail
+hook="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/upstream.sh"
+fixture_dir=$(mktemp -d)
+trap 'rm -rf "$fixture_dir"' EXIT
+printf 'pkgver=0.23.2\n' > "$fixture_dir/PKGBUILD"
+cd "$fixture_dir"
+
+failures=0
+check() {
+  if [[ "$2" == "$3" ]]; then
+    echo "  ok: $1"
+  else
+    echo "  FAIL: $1 (expected '$2', got '$3')"
+    failures=$((failures + 1))
+  fi
+}
+
+# Freeze time at the exact 24-hour boundary of the fixture's 0.24.0.
+date() {
+  if [[ "$*" == '+%s' ]]; then
+    jq -nr '"2026-09-08T16:51:50Z" | fromdateiso8601'
+  else
+    command date "$@"
+  fi
+}
+curl() {
+  local url="${!#}"
+  case "$url" in
+    'https://api.github.com/repos/trycua/cua/releases?per_page=100&page='*)
+      local page="${url##*=}"
+      [[ "$page" != "${FAIL_PAGE:-}" ]] || { echo 'fixture API failure' >&2; return 22; }
+      if [[ "${ENDLESS:-}" == 1 || "$page" == 1 ]]; then
+        if [[ "${LARGE_PAGE:-}" == 1 ]]; then
+          jq -c '.[0].body = ("x" * 131072)' <<<"$PAGE1"
+        else
+          printf '%s\n' "$PAGE1"
+        fi
+      elif [[ "$page" == 2 ]]; then
+        printf '%s\n' "$PAGE2"
+      else
+        echo '[]'
+      fi
+      ;;
+    'https://github.com/trycua/cua/releases/download/'*'/checksums.txt')
+      [[ "${FAIL_CHECKSUMS:-}" != 1 ]] || { echo 'fixture download failure' >&2; return 22; }
+      printf '%s\n' "$CHECKSUMS"
+      ;;
+    *) echo "unexpected fixture URL: $url" >&2; return 1 ;;
+  esac
+}
+export -f curl date
+export PAGE1 PAGE2 CHECKSUMS FAIL_PAGE FAIL_CHECKSUMS ENDLESS LARGE_PAGE
+export MIN_RELEASE_AGE_SECONDS=86400
+export BYPASS_MIN_RELEASE_AGE=''
+FAIL_PAGE='' FAIL_CHECKSUMS='' ENDLESS='' LARGE_PAGE=''
+PAGE2='[]'
+
+release() {
+  jq -cn --arg tag "$1" --arg published "${2:-2026-09-06T16:51:50Z}" \
+    '{tag_name: $tag, published_at: $published, draft: false, prerelease: true}'
+}
+run_hook() {
+  status=0
+  out=$(bash "$hook" 2>&1) || status=$?
+}
+expect_failure() {
+  run_hook
+  check "$1 fails" yes "$([[ "$status" != 0 ]] && echo yes || echo no)"
+  check "$1 reports the reason" yes "$([[ "$out" == *"$2"* ]] && echo yes || echo no)"
+}
+sum_x=$(printf 'a%.0s' {1..64})
+sum_a=$(printf 'b%.0s' {1..64})
+CHECKSUMS=$(printf '%s\n' \
+  "$sum_x  cua-driver-rs-0.24.0-linux-x86_64.tar.gz" \
+  "$sum_a  cua-driver-rs-0.24.0-linux-arm64.tar.gz")
+foreign_page=$(jq -cn '[range(100) | {tag_name: "fleet-v9.0.0", draft: false}]')
+stable=$(release cua-driver-rs-v0.24.0 2026-09-07T16:51:50Z)
+
+echo 'Cua Driver release hook:'
+PAGE1="$foreign_page"
+PAGE2="[$stable]"
+run_hook
+check 'component found beyond the first 100 releases' 0 "$status"
+check 'stable-shaped prerelease accepted at exactly 24h' 0.24.0 "$(jq -r '.pkgver' <<<"$out")"
+check 'x86_64 checksum' "$sum_x" "$(jq -r '.sha256sums.x86_64[0]' <<<"$out")"
+check 'ARM checksum' "$sum_a" "$(jq -r '.sha256sums.aarch64[0]' <<<"$out")"
+check 'publication date preserved' 2026-09-07T16:51:50Z "$(jq -r '.published_at' <<<"$out")"
+
+LARGE_PAGE=1
+run_hook
+check 'release page larger than the argument limit succeeds' 0 "$status"
+check 'large release page preserves version selection' 0.24.0 "$(jq -r '.pkgver' <<<"$out")"
+LARGE_PAGE=''
+
+# An eligible lower version on page one must not terminate the scan.
+rebuilt=$(release cua-driver-rs-v0.23.3 2026-09-07T16:51:50Z)
+PAGE1=$(jq -c --argjson rebuilt "$rebuilt" '.[0] = $rebuilt' <<<"$foreign_page")
+PAGE2="[$(release cua-driver-rs-v0.24.0)]"
+run_hook
+check 'older page outranks recently rebuilt lower version' 0.24.0 "$(jq -r '.pkgver' <<<"$out")"
+
+draft=$(release cua-driver-rs-v99.0.0 | jq -c '.draft = true')
+nightly=$(release nightly-cua-driver-rs-v99.0.0)
+suffix=$(release cua-driver-rs-v99.0.0-nightly.1)
+young=$(release cua-driver-rs-v0.25.0 2026-09-07T16:51:51Z)
+PAGE1="[$draft,$nightly,$suffix,$young,$stable,$rebuilt]"
+PAGE2='[]'
+run_hook
+check 'drafts/nightlies rejected and young release quarantined' 0.24.0 "$(jq -r '.pkgver' <<<"$out")"
+
+PAGE1="[$young]"
+run_hook
+check 'all candidates too young is a successful skip' 0 "$status"
+check 'all young candidates emit empty JSON' '{}' "${out##*$'\n'}"
+check 'quarantine reason is reported' yes "$([[ "$out" == *release-age* ]] && echo yes || echo no)"
+
+PAGE1="[$(release cua-driver-rs-v0.23.2)]"
+run_hook
+check 'current package version is unchanged' '{}' "$out"
+
+PAGE1="[$draft,$nightly,$suffix]"
+expect_failure 'no stable component candidate' 'no stable cua-driver-rs-v'
+PAGE1='[]'
+expect_failure 'empty feed' 'no stable cua-driver-rs-v'
+PAGE1="[$(release cua-driver-rs-v0.24.0 yesterday)]"
+expect_failure 'relative publication date' 'invalid published_at'
+PAGE1="[$(release cua-driver-rs-v0.24.0 2026-02-30T00:00:00Z)]"
+expect_failure 'impossible publication date' 'invalid published_at'
+PAGE1='[{"tag_name":"cua-driver-rs-v0.24.0","draft":false}]'
+expect_failure 'missing publication date' 'invalid published_at'
+
+PAGE1="$foreign_page"
+PAGE2='{"message":"API rate limit exceeded"}'
+expect_failure 'API error object on later page' 'invalid release feed'
+PAGE2='not json'
+expect_failure 'malformed JSON on later page' 'invalid release feed'
+PAGE2='[42]'
+expect_failure 'malformed release entry' 'Cannot index'
+PAGE2="[$stable]"
+FAIL_PAGE=2
+expect_failure 'network failure after first page' 'fixture API failure'
+FAIL_PAGE=''
+ENDLESS=1
+expect_failure 'feed exceeds pagination bound' 'refusing incomplete selection'
+ENDLESS=''
+
+PAGE1="[$stable]"
+PAGE2='[]'
+FAIL_CHECKSUMS=1
+expect_failure 'checksum download failure' 'fixture download failure'
+FAIL_CHECKSUMS=''
+CHECKSUMS="$sum_x  cua-driver-rs-0.24.0-linux-x86_64.tar.gz"
+expect_failure 'missing ARM checksum' 'no valid checksum'
+CHECKSUMS='invalid  cua-driver-rs-0.24.0-linux-x86_64.tar.gz'
+expect_failure 'invalid checksum' 'no valid checksum'
+
+[[ "$failures" == 0 ]]
@@ -0,0 +1,111 @@
+#!/bin/bash
+# cua-driver ships from the trycua/cua monorepo, whose single release feed
+# interleaves many products (cua-driver-rs-v*, fleet-v*, sandbox-v*, and
+# nightly-* builds). The declarative github provider reads a feed as one
+# product and stops on the first foreign tag, so this hook selects the newest
+# stable cua-driver-rs release itself and reads its checksums.txt manifest.
+set -euo pipefail
+
+REPO="trycua/cua"
+TAG_PREFIX="cua-driver-rs-v"
+
+# Publication order is not version order: older pages can contain a newer
+# driver version than a recently rebuilt release. Exhaust the feed before
+# selecting, and fail closed if the bounded scan cannot reach its end.
+releases='[]'
+max_pages=100
+for ((page = 1; page <= max_pages; page++)); do
+  release_page=$(curl --connect-timeout 10 --max-time 30 -fsSL \
+    "https://api.github.com/repos/$REPO/releases?per_page=100&page=$page")
+  if ! page_size=$(jq -er 'if type == "array" and length <= 100 then length else error("expected release page of at most 100 entries") end' <<<"$release_page"); then
+    echo "invalid release feed for $REPO on page $page" >&2
+    exit 1
+  fi
+  releases=$(printf '%s\n' "$releases" "$release_page" | jq -cs 'add')
+  (( page_size == 100 )) || break
+done
+if (( page > max_pages )); then
+  echo "release feed for $REPO exceeds $max_pages pages; refusing incomplete selection" >&2
+  exit 1
+fi
+
+# Keep jq failures in the main shell, where errexit can reject malformed data.
+release_rows=$(jq -r '.[] | select(.draft | not) | [.tag_name // "", .published_at // ""] | @tsv' <<<"$releases")
+
+min_age="${MIN_RELEASE_AGE_SECONDS:-0}"
+now=$(date +%s)
+candidates=0
+best_pkgver="" best_tag="" best_published=""
+while IFS=$'\t' read -r tag published_at; do
+  [[ "$tag" == "$TAG_PREFIX"* ]] || continue
+  pkgver=${tag#"$TAG_PREFIX"}
+  # Upstream marks every driver release "prerelease" so the monorepo's
+  # "latest" can point at another product; stability lives in the tag shape
+  # instead. Stable driver versions are plain dotted numbers -- nightlies
+  # carry a nightly- tag prefix and a -nightly.N version suffix, and both
+  # fall out here.
+  [[ "$pkgver" =~ ^[0-9]+(\.[0-9]+)*$ ]] || continue
+
+  # Strict ISO 8601 before GNU date sees it, matching bin/sync-upstream's
+  # backstop: date alone also accepts relative expressions, which would let a
+  # malformed feed fabricate an age instead of failing closed.
+  if [[ ! "$published_at" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]+)?(Z|[+-][0-9]{2}:?[0-9]{2})$ ]] \
+      || ! published_epoch=$(date --date="$published_at" +%s 2>/dev/null); then
+    echo "$REPO release $tag has an invalid published_at: ${published_at:-<empty>}" >&2
+    exit 1
+  fi
+  candidates=$((candidates + 1))
+
+  if (( now - published_epoch < min_age )); then
+    if [[ "${BYPASS_MIN_RELEASE_AGE:-}" == "1" ]]; then
+      echo "Bypassing release-age gate for $REPO $tag" >&2
+    else
+      continue
+    fi
+  fi
+
+  if [[ -z "$best_pkgver" ]] || [[ "$(vercmp "$pkgver" "$best_pkgver")" -gt 0 ]]; then
+    best_pkgver=$pkgver
+    best_tag=$tag
+    best_published=$published_at
+  fi
+done <<<"$release_rows"
+
+# A feed with no stable driver release at all is an anomaly worth a loud
+# error; every candidate merely being inside the quarantine window is not.
+if (( candidates == 0 )); then
+  echo "no stable $TAG_PREFIX releases in the feed for $REPO" >&2
+  exit 1
+fi
+if [[ -z "$best_tag" ]]; then
+  echo "every recent $TAG_PREFIX release is still inside the release-age quarantine; skipping" >&2
+  echo '{}'
+  exit 0
+fi
+
+current=$(grep -m1 '^pkgver=' PKGBUILD | cut -d= -f2- | tr -d "\"'")
+if [[ -n "$current" ]] && [[ "$(vercmp "$best_pkgver" "$current")" -le 0 ]]; then
+  echo '{}'
+  exit 0
+fi
+
+checksums=$(curl -fsSL "https://github.com/$REPO/releases/download/$best_tag/checksums.txt")
+
+sums_json='{}'
+for arch in x86_64 aarch64; do
+  case "$arch" in
+    x86_64) platform="linux-x86_64" ;;
+    aarch64) platform="linux-arm64" ;;
+  esac
+  asset="cua-driver-rs-${best_pkgver}-${platform}.tar.gz"
+  sum=$(awk -v f="$asset" '$2 == f { print $1; exit }' <<<"$checksums")
+  if [[ ! "$sum" =~ ^[0-9a-f]{64}$ ]]; then
+    echo "no valid checksum for $asset in $REPO $best_tag checksums.txt" >&2
+    exit 1
+  fi
+  sums_json=$(jq -c --arg arch "$arch" --arg sum "$sum" '.[$arch] = [$sum]' <<<"$sums_json")
+done
+
+jq -n --arg pkgver "$best_pkgver" --arg published_at "$best_published" \
+  --argjson sums "$sums_json" \
+  '{pkgver: $pkgver, published_at: $published_at, sha256sums: $sums}'
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Cua AI, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -0,0 +1,113 @@
+# Maintainer: Spencer Bull <spencerbull2554@gmail.com>
+
+# cua-driver ships prebuilt from the trycua/cua monorepo release feed, so this
+# repackages the vendor tarball. Upstream keeps the CLI, its cursor-theme
+# compiler, and the SDK artifacts together in one directory and exposes the
+# CLI through a symlink -- the binary resolves its helpers as siblings of
+# /proc/self/exe -- so the whole tree lands under /usr/lib/cua-driver with a
+# /usr/bin symlink. .omarchy/upstream.sh rewrites the version and checksums
+# below from the release feed.
+#
+# The binary carries its own updater: `cua-driver update --apply` pipes the
+# vendor installer into bash, which would install a second copy under
+# ~/.cua-driver and link it into ~/.local/bin, stepping around pacman and
+# this repository's release gate. Driver 0.27.0 detects pacman ownership, but
+# deliberately treats failed and timed-out ownership queries as unmanaged.
+# A /usr/bin wrapper would not cover MCP configurations that record the
+# resolved executable, so prepare() rewrites the installer URL inside the
+# binary to point at pm.sh, a stand-in that declines and names pacman instead.
+
+pkgname=cua-driver-bin
+pkgver=0.28.2
+pkgrel=1
+pkgdesc="Computer-use driver for native GUI apps: accessibility-tree snapshots and input injection"
+arch=('x86_64' 'aarch64')
+url="https://github.com/trycua/cua"
+license=('MIT')
+# at-spi2-core carries the AT-SPI accessibility bus the driver reads GUI
+# trees through; the X libraries are linked, not dlopen'd.
+depends=(
+  'at-spi2-core'
+  'gcc-libs'
+  'glibc'
+  'libx11'
+  'libxcb'
+  'libxext'
+  'libxi'
+  'libxkbcommon'
+)
+provides=("cua-driver=${pkgver}")
+conflicts=('cua-driver')
+# Prebuilt Rust binaries ship byte-exact apart from the installer rewrite
+# below: their build ids are what upstream symbolication matches.
+options=('!strip' '!debug')
+source=('LICENSE' 'pm.sh')
+source_x86_64=("https://github.com/trycua/cua/releases/download/cua-driver-rs-v${pkgver}/cua-driver-rs-${pkgver}-linux-x86_64.tar.gz")
+source_aarch64=("https://github.com/trycua/cua/releases/download/cua-driver-rs-v${pkgver}/cua-driver-rs-${pkgver}-linux-arm64.tar.gz")
+sha256sums=('c0779290c1d4783169aa3dbfb55feb505e563ef8a004bbf55298ceffcfbda8d9'
+            'c76e251c3ed424200eac52bec35ba534336307fabd83a175ab0b47e2084ab0d8')
+sha256sums_x86_64=('8f3e5b669e2bcd98d0eecc64f40640aac77f358b6332a06abc6ee79991620f7d')
+sha256sums_aarch64=('cadd7e6b757c3ce50f2b5f6e273c154ea48450fb5fcaff744209b382915eddf5')
+
+case "${CARCH}" in
+  x86_64) _platform="linux-x86_64" ;;
+  aarch64) _platform="linux-arm64" ;;
+esac
+_vendor_tree="cua-driver-rs-${pkgver}-${_platform}"
+
+# Rust strings carry their length out of band, so the replacement has to be
+# exactly as long as the original, which is what fixes the
+# stand-in's short name and location.
+_vendor_installer='https://cua.ai/driver/install.sh'
+_pacman_installer='file:///usr/lib/cua-driver/pm.sh'
+
+prepare() {
+  cd "${srcdir}/${_vendor_tree}"
+
+  if (( ${#_vendor_installer} != ${#_pacman_installer} )); then
+    echo "installer URLs must be the same length to rewrite in place" >&2
+    return 1
+  fi
+
+  # In 0.28.1 the URL appears in the updater, the printed reinstall command,
+  # and two embedded copies of Skills/cua-driver/README.md. Rewrite all four
+  # so the embedded instructions also defer to pacman. Any other count means
+  # the release layout changed and needs review before packaging.
+  local expected=4 found
+  found=$(grep -obUaF "${_vendor_installer}" cua-driver | wc -l)
+  if (( found != expected )); then
+    echo "expected the vendor installer URL ${expected} times in cua-driver, found ${found}" >&2
+    return 1
+  fi
+
+  local size_before size_after
+  size_before=$(stat -c %s cua-driver)
+  sed -i "s|${_vendor_installer//./\\.}|${_pacman_installer}|g" cua-driver
+  size_after=$(stat -c %s cua-driver)
+
+  if (( size_before != size_after )) \
+      || grep -qUaF "${_vendor_installer}" cua-driver \
+      || (( $(grep -obUaF "${_pacman_installer}" cua-driver | wc -l) != expected )); then
+    echo "installer URL rewrite did not land cleanly in cua-driver" >&2
+    return 1
+  fi
+}
+
+package() {
+  cd "${srcdir}/${_vendor_tree}"
+
+  # The vendor tree stays together: cua-driver execs cua-cursor-theme as a
+  # sibling of the resolved binary, and the SDK library, node runtime, ABI
+  # header, and the GNOME wayland-helper extension are versioned with it.
+  install -d "${pkgdir}/usr/lib/cua-driver"
+  cp -a . "${pkgdir}/usr/lib/cua-driver/"
+  chmod -R a+rX "${pkgdir}/usr/lib/cua-driver"
+
+  # The path prepare() wrote into the binary.
+  install -Dm755 "${srcdir}/pm.sh" "${pkgdir}/usr/lib/cua-driver/pm.sh"
+
+  install -d "${pkgdir}/usr/bin"
+  ln -s ../lib/cua-driver/cua-driver "${pkgdir}/usr/bin/cua-driver"
+
+  install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+}
@@ -0,0 +1,12 @@
+#!/bin/bash
+# Stands in for the vendor installer. cua-driver-bin points the binary's
+# `update --apply` here instead of https://cua.ai/driver/install.sh, which
+# would otherwise install a second copy under ~/.cua-driver and link it into
+# ~/.local/bin, stepping around pacman and the repository's release gate. The
+# exit status is what `cua-driver update --apply` reports.
+{
+  echo "cua-driver is installed by pacman (cua-driver-bin), so the vendor installer is disabled."
+  echo "Upgrade it with pacman instead:"
+  echo "  sudo pacman -Syu cua-driver-bin"
+} >&2
+exit 1
@@ -0,0 +1,3 @@
+{
+  "source": "local"
+}
@@ -0,0 +1,57 @@
+{
+  "files": {
+    "CMakeLists.txt": "7e874a595e1abd708cb0626bd9f0f58d79b4b4bbc6d99b45a0cbe1c5c53b43bc",
+    "LICENSE.md": "c0779290c1d4783169aa3dbfb55feb505e563ef8a004bbf55298ceffcfbda8d9",
+    "SOURCE-PROVENANCE.json": "54f514664c84e1358a435f29cd6befd5661b0b133d76997191c000b10f021a75",
+    "cmake/DetectHyprlandAPI.cmake": "216133ec0eb141c3696bf3770a23e63e46521c9e91a0245a7cb75c20a75ba2c5",
+    "cmake/VerifyRuntime.cmake": "5869f79a418e7aa6178d2b9166c36cd01c3093c2579b647624968244db57b761",
+    "include/cua_hyprland/protocol.hpp": "7051463b3c61a2dc93c388e66b6136b7bb524f8694350f249f9d2b5c55826493",
+    "include/cua_hyprland/session.hpp": "e6a968e4f2ac28122cb7413a0e318f6222d2a0a1b7b0c45f4ab419a78639ebea",
+    "include/cua_hyprland/status.hpp": "56a9656647c0f4eeb0c588cd4b98a77df198d1f90421f973e9a80e6802f61495",
+    "src/drag_geometry.hpp": "c5b783d15ff197f22938f08f8d176bab5d45544fe989d150f15cb99295acedb8",
+    "src/foreground_route.hpp": "4aa016c237b33c15e352a9f5f64bbbca7e1a9c1671ffd593a95a0d87994fb519",
+    "src/inject_server.cpp": "0935283580c50fcf0e4ad956f858885700536002b1d86d2f078da9c4404ee9e8",
+    "src/inject_server.hpp": "67de008b4d6983371207bb22a57bab154b1dedda9b38d1207d3ac8cb379382eb",
+    "src/input_client_deadline.hpp": "00a91a789ff698820607449ff7152e2fb50d0f315e0fa9c5c3855752bfffe2ef",
+    "src/input_experiment.cpp": "7017748c782b64b0bc1d257f4ade1a8d46fd19ce940ecc21f22d628614fcef37",
+    "src/input_experiment.hpp": "9da2ddab7f0de6e9cf02aea53e9119acef17ef8513af849bb5aa3d137ebd12c3",
+    "src/input_grant.hpp": "90b544b2f559bacd920b85ab5915f09ff201de3c05a052ce1b71ff71f767e6a6",
+    "src/keyboard_layout.hpp": "bc2ec039ac1974caebbb66fe4acb7a2a81832c9054b3aa644a9adcc8954a2467",
+    "src/owned_socket_path.hpp": "8e784656d944c700f3ded383c93a8cadf846dabdaa4cc12673bcb637c26d9fd1",
+    "src/passive_pointer_target.hpp": "ede36fd9fd6e95ae5923c751f12591084392be9d2270eb06ad64eb4f245169fa",
+    "src/plugin.cpp": "712fd73ef8e9046e0fd91531b7bf5da50ce37ccca9df174160137e1924a74b09",
+    "src/primary_trace.cpp": "e9468d1a3f3be2a90d47bf8c4a638ad8a60fe10b6297582ab7825751cb707aa9",
+    "src/primary_trace.hpp": "8d62535fb0b24a02bb80d9a8dcd540b39204afb2f3b4bcb5cabd5275c3b5eaa7",
+    "src/protocol.cpp": "bd083d65efb05e80946566dc535b1a6fadaa581c66ec327eff41796feba795b1",
+    "src/seat_lifetime.hpp": "386cf5c72c178f8eec0824f2a7d46fa755b0bb000861f9a6e00802f6b81fb779",
+    "src/session.cpp": "0105c7ba5f9e2dbdd9a21f48be0bc1f2bde930f6aa19f77e2216403d7790e4df",
+    "src/status.cpp": "e46e81e5e8ae3b1f50af5dcaa6c1776e236321c788fe61b402c9923c797b1270",
+    "tests/agent_keymap_test.py": "9b112f520a97a77a0d55f1009cd2594988d3c1e8e7bcaa39f213ffad2644dc56",
+    "tests/cmake-api/CMakeLists.txt": "6a66c8f98023f029998af917fcd3ec6b1388607bdf7acaf5bdfaef9141962685",
+    "tests/cmake-api/include/src/plugins/PluginAPI.hpp": "86c8ad51e668908d18928cef1b04e8e6d32a33894525640b52f0b31769c870a0",
+    "tests/desktop_fault_policy_fixture.cpp": "ac24d675ebc64cc98148e852eb5aba5858bffc06332678d14276d04b317aaf15",
+    "tests/desktop_fault_policy_test.py": "c3f624c0239036babd23eaaf1bb6b722f3a0c3321a5d3d6668ae7ab4910ca95c",
+    "tests/drag_geometry_test.cpp": "d32ea649d008fc051fe18555d6fbc54ba5d057b61880b648c5df8aa076a53fbc",
+    "tests/foreground_modifiers_test.py": "abf0ddde2d51c6639c8bdca8fdda51cdc8f922b57575a00fc8925c683ccc3bb2",
+    "tests/foreground_route_test.cpp": "1024168828b13ee6abd8242941e73c042e9381b39108e3ada74823039c7e7932",
+    "tests/input_client_deadline_test.cpp": "d62373a7815d531f1269c9a838773595f43e8bcef6482fa140edb162e59a6cac",
+    "tests/input_grant_test.cpp": "1f327b7ee678189ebad6a50bb1b9bd06767521cebc9cfb478d92de4a8bf7e7fe",
+    "tests/keyboard_layout_test.cpp": "3bb0fade4675d7ad92a81eb4a1c5201dd1d01bcc418b7ea59a4284dc235e5fb2",
+    "tests/mock-hyprland/mock.hpp": "3aeb1a4b9d6b83506b66c129d3fa812330fad4509fe218a0dbb99dd2bb5b6319",
+    "tests/mock-hyprland/src/config/values/types/BoolValue.hpp": "47cf2cca89f71a273573968cb9b8ba46a1496841d6c892756ebf123500a7ecb3",
+    "tests/mock-hyprland/src/plugins/PluginAPI.hpp": "5654d90ec9090a88bea3d31f8a79617d4c79742b09068648e64448319d395110",
+    "tests/owned_socket_path_test.cpp": "eaff6b5c6f148eca6c8650ee3dc212a5e892f002ee4f68b2a1290c7205ee7e42",
+    "tests/passive_pointer_target_test.cpp": "2aeef1de1dc8932b26ab8c41b83fb16a4289ff96c177a5816088f07b9a168948",
+    "tests/plugin_api_test.cpp": "1e7e200c309996ee945c88e172273ae942be2837e24564d422dee79d8b77d8a2",
+    "tests/plugin_input_lifetime_test.cpp": "82e57b335ea1216ea24cca07fe4feebafebdebb779785fde20b8dab6ee222e1b",
+    "tests/protocol_test.cpp": "119cfe0df81c0c00036a2d181764eda7601d6ee72459c2275a96226d4f670447",
+    "tests/seat_lifetime_test.cpp": "b07570edbe0a142f97c54560eeb93e8327c435ab3b8cbc7496d55175e387b78a",
+    "tests/status_test.cpp": "b8990efc53ec3820cfe498c920b9220c4b70615ad585468558e032e7619e32f3",
+    "tests/transport_test.cpp": "deef114a950a27eaff0a530165ddf7db0bfc0fe7e8fb55bdbb66135c8e0c04c9",
+    "verify.py": "fb35d62313ff4661f892f88666919b33b160f8b6d4fb2d5d52610708bf7f4a54"
+  },
+  "patch_sha256": "e74d9021111a5c217b12f3e13c1bbdd260e829c60db5fc2f7293ba4846e1a7d7",
+  "schema": 1,
+  "upstream_manifest_sha256": "54f514664c84e1358a435f29cd6befd5661b0b133d76997191c000b10f021a75",
+  "upstream_revision": "cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7"
+}
@@ -0,0 +1,208 @@
+# Verified upstream kit plus a separately pinned Omarchy keyboard-remap patch.
+# Normal reruns need a fresh build directory; makepkg -e reuses verified extracted trees.
+# Profile kit: original source bytes and separately committed packaging tooling.
+# shellcheck shell=bash disable=SC2034,SC2154
+pkgname=cua-hyprland-plugin
+pkgver=0.26.1
+pkgrel=6
+pkgdesc='Cua input candidate for reviewed profile omarchy-hypr0562r3-aq0151-remaps'
+arch=('x86_64')
+url='https://github.com/trycua/cua'
+license=('MIT')
+depends=('hyprland=0.56.2-3' 'aquamarine=0.15.1-1' 'glibc=2.44+r24+g16be1518495f-1' 'hyprcursor=0.1.13-7' 'hyprgraphics=0.5.1-4' 'hyprlang=0.6.8-5' 'hyprutils=0.14.2-1' 'libgcc=16.2.1+r23+gd564253eb6c8-1' 'libstdc++=16.2.1+r23+gd564253eb6c8-1' 'libxkbcommon=1.13.2-1' 'wayland=1.26.0-1' 'python>=3.11' 'binutils')
+makedepends=('cmake>=3.30' 'ninja' 'pkgconf' 'gcc' 'patch')
+options=('!strip' '!debug' '!lto')
+_stem='cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7'
+_archive_sha256='47bca9e018f32f4fcfe683f91c7475c60368f3b65d318cc35c1f2de88a4ee9ab'
+_kit_sha256='819779b93655d603d9ebb0d33ea052326c3374674a1d473886106af25e0fffdd'
+_profile_sha256='a2eade8b8195036be2c666788a1d28ac722403285a35987d92b3344e095f9a5e'
+_verifier_sha256='480f649cbd35a0ddc7f49dc0a3a44785402c9e0ec9653b0f8ea4965d52d7f900'
+_cxx="${CUA_RELEASE_CXX:-/usr/bin/g++}"
+_download_name='cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7-profile-omarchy-stable-20260910-kit-1.1.0-5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a-67f89ceb47edd973aa748820eadd02ddbfb3d3e4.tar.gz'
+_download_sha256='a89bfa7f6490f598719dfabdd2a5badc137e27b0764fd25e6a05e1f969433520'
+source=('https://github.com/trycua/cua/releases/download/cua-hyprland-kit-v1.1.0-omarchy-stable-20260910/cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7-profile-omarchy-stable-20260910-kit-1.1.0-5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a-67f89ceb47edd973aa748820eadd02ddbfb3d3e4.tar.gz'
+        'PROFILE.json')
+noextract=("$_download_name")
+sha256sums=('a89bfa7f6490f598719dfabdd2a5badc137e27b0764fd25e6a05e1f969433520'
+            'a2eade8b8195036be2c666788a1d28ac722403285a35987d92b3344e095f9a5e')
+
+# Downstream inputs are also checked explicitly when makepkg integrity is skipped.
+declare -gA _downstream_sha256=(
+  ['independent-keymaps.patch']='e74d9021111a5c217b12f3e13c1bbdd260e829c60db5fc2f7293ba4846e1a7d7'
+  ['DOWNSTREAM-PROVENANCE.json']='e0c95350ec3ff2dd54a05e9377d79ddffffdb1cf494d05553a90207a3a919f7e'
+  ['downstream.py']='7c9725805ad038737bd4d346c85f27991ce9ddfff436a32ebf515cad1bf98ca1'
+  ['downstream_test.py']='7b9a992979b22a5e061fdf011ac6be59a3f1ae6e0d7c0a8ff631f74e71984c5a'
+)
+source+=('independent-keymaps.patch' 'DOWNSTREAM-PROVENANCE.json' 'downstream.py' 'downstream_test.py')
+sha256sums+=('e74d9021111a5c217b12f3e13c1bbdd260e829c60db5fc2f7293ba4846e1a7d7' 'e0c95350ec3ff2dd54a05e9377d79ddffffdb1cf494d05553a90207a3a919f7e' '7c9725805ad038737bd4d346c85f27991ce9ddfff436a32ebf515cad1bf98ca1' '7b9a992979b22a5e061fdf011ac6be59a3f1ae6e0d7c0a8ff631f74e71984c5a')
+
+_verify_download() {
+  python3 -I - "$SRCDEST/$_download_name" "$_download_sha256" "$srcdir" "$1" "$SRCDEST/PROFILE.json" <<'CUA_DOWNLOAD_PY'
+import hashlib
+import io
+import json
+from pathlib import Path, PurePosixPath
+import sys
+import tarfile
+
+expected = {'KIT-PROVENANCE.json': '7beb736adfd334eed52e84070177634269e3a09f8bb25971b38606933ff4c997', 'PKGBUILD': 'b945a6a6eda13d0e382770edd5419485e3196041956663eb38f5183b05d30db3', 'PROFILE-PKGBUILD.in': 'c350d1b2375946cb0166893d67a1fc01344ee5e3215bbe801b4d54bb361d6bce', 'PROFILE-USAGE.md': 'c14d8e8103fccab59e558758f4249f86bce700a8723cd4ba1b97b1102e02bbd2', 'PROFILE.json': '5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a', 'SHA256SUMS': '34a2126bcfab983f171382aafac3ef218475b652f4583c58f4a04088044cb935', 'SOURCE-PROVENANCE.json': '54f514664c84e1358a435f29cd6befd5661b0b133d76997191c000b10f021a75', 'cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7.tar.gz': '47bca9e018f32f4fcfe683f91c7475c60368f3b65d318cc35c1f2de88a4ee9ab', 'lifecycle.py': 'b18dceb8b8e05b93586ddd3a2f1d90d70ae1c36088e54fc05c89e08585290990', 'profile_bundle.py': 'ac883883814787da477c037f017939ee92c9fb5f46f373af7de1331b24f1f6da', 'profile_verify.py': '480f649cbd35a0ddc7f49dc0a3a44785402c9e0ec9653b0f8ea4965d52d7f900'}
+stem = 'cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7'
+
+def require(condition, message):
+    if not condition:
+        raise SystemExit(message)
+
+def digest(data):
+    return hashlib.sha256(data).hexdigest()
+
+archive, checksum, srcdir, mode, profile_path = sys.argv[1:]
+archive, srcdir = Path(archive), Path(srcdir)
+require(mode in {'check', 'extract'}, 'invalid kit verification mode')
+require(archive.is_file() and not archive.is_symlink(), 'outer archive must be a regular file')
+data = archive.read_bytes()
+require(digest(data) == checksum, 'outer archive checksum mismatch')
+payload = {}
+with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as contents:
+    for member in contents:
+        require(member.isfile() and not member.issparse() and not member.pax_headers,
+                'nonregular outer kit member')
+        require(member.name in expected and member.name not in payload, 'outer kit inventory mismatch')
+        content = contents.extractfile(member).read()
+        require(digest(content) == expected[member.name], 'outer kit member checksum mismatch')
+        payload[member.name] = content
+require(payload.keys() == expected.keys(), 'outer kit inventory mismatch')
+# Derive the reviewed Hyprland -3/Aquamarine 0.15.1 profile while preserving
+# upstream source/tooling and compiler, compositor, header and runtime hashes.
+profile_data = Path(profile_path).read_bytes()
+require(digest(profile_data) == 'a2eade8b8195036be2c666788a1d28ac722403285a35987d92b3344e095f9a5e',
+        'local profile checksum mismatch')
+profile = json.loads(payload['PROFILE.json'])
+profile.update(profile_id='omarchy-hypr0562r3-aq0151-remaps', package_release=6)
+profile['hyprland']['package_version'] = '0.56.2-3'
+profile['runtime']['packages']['aquamarine'] = '0.15.1-1'
+require(json.loads(profile_data) == profile, 'local profile changes more than the reviewed package versions')
+payload['PROFILE.json'] = profile_data
+provenance = json.loads(payload['KIT-PROVENANCE.json'])
+provenance['profile_sha256'] = digest(profile_data)
+payload['KIT-PROVENANCE.json'] = (json.dumps(provenance, sort_keys=True, indent=2) + '\n').encode()
+recipe = payload['PKGBUILD'].decode()
+for old, new in [('pkgrel=2\n', 'pkgrel=6\n'), ('omarchy-stable-20260910', profile['profile_id']),
+                 ('hyprland=0.56.2-2', 'hyprland=0.56.2-3'),
+                 ('aquamarine=0.15.0-2', 'aquamarine=0.15.1-1'),
+                 ('5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a', digest(profile_data)),
+                 ('7beb736adfd334eed52e84070177634269e3a09f8bb25971b38606933ff4c997', digest(payload['KIT-PROVENANCE.json']))]:
+    recipe = recipe.replace(old, new)
+payload['PKGBUILD'] = recipe.encode()
+payload['SHA256SUMS'] = ''.join(f'{digest(body)}  {name}\n' for name, body in sorted(payload.items())
+                              if name != 'SHA256SUMS').encode()
+expected.update({'PROFILE.json': 'a2eade8b8195036be2c666788a1d28ac722403285a35987d92b3344e095f9a5e',
+                 'KIT-PROVENANCE.json': '819779b93655d603d9ebb0d33ea052326c3374674a1d473886106af25e0fffdd',
+                 'PKGBUILD': 'c3e4149eba3f7def10ef700b30b9d0abcea994e3dd32fb169014874a0b75687c',
+                 'SHA256SUMS': 'd9057a9534f7a820ee04cbf5d60db567c5072fa96d1f71030a6a85b4bb7ce881'})
+for name, content in payload.items():
+    require(digest(content) == expected[name], 'derived kit checksum mismatch: ' + name)
+require(srcdir.is_dir() and not srcdir.is_symlink(), 'srcdir must be a real directory')
+kit, source = srcdir / 'cua-profile-kit', srcdir / stem
+if mode == 'extract':
+    require(not kit.exists() and not kit.is_symlink() and not source.exists() and not source.is_symlink(),
+            'prepare requires fresh kit and source destinations; use a clean srcdir')
+    source_payload = {}
+    with tarfile.open(fileobj=io.BytesIO(payload[stem + '.tar.gz']), mode='r:gz') as contents:
+        for member in contents:
+            require(member.isfile() and not member.issparse() and not member.pax_headers and
+                    member.name.startswith(stem + '/'), 'invalid source member')
+            name = member.name[len(stem) + 1:]
+            path = PurePosixPath(name)
+            require(name and path.as_posix() == name and not path.is_absolute() and
+                    '..' not in path.parts and '\\' not in name and name not in source_payload,
+                    'unsafe or duplicate source path')
+            source_payload[name] = contents.extractfile(member).read()
+    kit.mkdir()
+    source.mkdir()
+    for name, content in payload.items():
+        (kit / name).write_bytes(content)
+    for name, content in source_payload.items():
+        destination = source / name
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        destination.write_bytes(content)
+require(kit.is_dir() and not kit.is_symlink(), 'kit must be a real directory')
+require({path.name for path in kit.iterdir()} == expected.keys(), 'extracted kit inventory mismatch')
+for name, checksum in expected.items():
+    path = kit / name
+    require(path.is_file() and not path.is_symlink() and digest(path.read_bytes()) == checksum,
+            'extracted kit checksum mismatch: ' + name)
+CUA_DOWNLOAD_PY
+}
+
+_verify() {
+  printf '%s  %s\n' "$_download_sha256" "$SRCDEST/$_download_name" | sha256sum -c - || return 1
+  _verify_download check || return 1
+  # Explicit checks still apply to --skipinteg, --noextract and --repackage.
+  printf '%s  %s\n' "$_archive_sha256" "$srcdir/cua-profile-kit/${_stem}.tar.gz" | sha256sum -c - || return 1
+  printf '%s  %s\n' "$_kit_sha256" "$srcdir/cua-profile-kit/KIT-PROVENANCE.json" | sha256sum -c - || return 1
+  printf '%s  %s\n' "$_profile_sha256" "$srcdir/cua-profile-kit/PROFILE.json" | sha256sum -c - || return 1
+  printf '%s  %s\n' "$_verifier_sha256" "$srcdir/cua-profile-kit/profile_verify.py" | sha256sum -c - || return 1
+  python3 "$srcdir/cua-profile-kit/profile_verify.py" --kit "$srcdir/cua-profile-kit" --kit-sha256 "$_kit_sha256" \
+    --archive "$srcdir/cua-profile-kit/${_stem}.tar.gz" --source "$srcdir/$_stem" --cxx "$_cxx"
+}
+
+_downstream() {
+  local name
+  for name in independent-keymaps.patch DOWNSTREAM-PROVENANCE.json downstream.py downstream_test.py; do
+    printf '%s  %s\n' "${_downstream_sha256[$name]}" "$SRCDEST/$name" | sha256sum -c - || return 1
+  done
+  python3 -B "$SRCDEST/downstream.py" "$1" \
+    --pristine "$srcdir/$_stem" --source "$srcdir/omarchy-source" \
+    --patch "$SRCDEST/independent-keymaps.patch" --manifest "$SRCDEST/DOWNSTREAM-PROVENANCE.json" \
+    --kit "$srcdir/cua-profile-kit" --kit-sha256 "$_kit_sha256" \
+    --archive "$srcdir/cua-profile-kit/${_stem}.tar.gz" --cxx "$_cxx" "${@:2}"
+}
+
+prepare() {
+  _verify_download extract || return 1
+  _verify || return 1
+  _downstream prepare
+}
+
+build() {
+  _verify || return 1
+  _downstream check || return 1
+  cmake -S "$srcdir/omarchy-source" -B "$srcdir/build" -G Ninja \
+    -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_COMPILER="$_cxx" \
+    -DPKG_CONFIG_EXECUTABLE=/usr/bin/pkgconf -DPKG_CONFIG_ARGN= \
+    -DPKG_CONFIG_USE_CMAKE_PREFIX_PATH=OFF -DCMAKE_PREFIX_PATH= \
+    -DBUILD_TESTING=ON -DCUA_HYPRLAND_BUILD_PLUGIN=ON \
+    -DCUA_HYPRLAND_EXPECTED_VERSION=0.56.2 \
+    -DCUA_HYPRLAND_INPUT=ON -DCUA_HYPRLAND_TEST_INPUT=OFF \
+    -DCUA_HYPRLAND_INPUT_TRACE=OFF -DCUA_HYPRLAND_TEST_OPERATOR_KEY= || return 1
+  cmake --build "$srcdir/build"
+}
+
+check() {
+  _verify || return 1
+  _downstream check || return 1
+  python3 -B "$SRCDEST/downstream_test.py" || return 1
+  (
+    unset LD_PRELOAD FAKEROOTKEY FAKED_MODE
+    ctest --test-dir "$srcdir/build" --output-on-failure --no-tests=error
+  )
+}
+
+package() {
+  check || return 1
+  _downstream build --build "$srcdir/build" --output "$srcdir/BUILD-PROVENANCE.json" || return 1
+  install -Dm755 "$srcdir/build/cua-hyprland-plugin.so" \
+    "$pkgdir/usr/lib/cua/hyprland/cua-hyprland-plugin.so" || return 1
+  install -Dm644 "$srcdir/$_stem/LICENSE.md" \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE" || return 1
+  install -Dm644 "$srcdir/$_stem/SOURCE-PROVENANCE.json" \
+    "$pkgdir/usr/share/$pkgname/SOURCE-PROVENANCE.json" || return 1
+  local name
+  install -Dm644 "$srcdir/BUILD-PROVENANCE.json" "$pkgdir/usr/share/$pkgname/BUILD-PROVENANCE.json" || return 1
+  for name in KIT-PROVENANCE.json PROFILE.json profile_verify.py; do
+    install -Dm644 "$srcdir/cua-profile-kit/$name" "$pkgdir/usr/share/$pkgname/$name" || return 1
+  done
+  for name in DOWNSTREAM-PROVENANCE.json independent-keymaps.patch; do
+    install -Dm644 "$SRCDEST/$name" "$pkgdir/usr/share/$pkgname/$name" || return 1
+  done
+}
@@ -0,0 +1,40 @@
+{
+  "architecture": "x86_64",
+  "compiler": {
+    "comment": "GCC: (GNU) 16.2.1 20260810",
+    "sha256": "f04191f6a7b2cd7d9a62e1745872b8a6088791e5af6955488c69c9b2c4668bc9",
+    "version": "16.2.1 20260810"
+  },
+  "hyprland": {
+    "header_version": "0.56.2",
+    "headers_sha256": "88a6875af00203627b264a5c1f9908781be4ad8d9cee4e577fef174e72dd0e28",
+    "package_version": "0.56.2-3",
+    "sha256": "da8fcacf347bcbed83edc40108c6e2298da095e22246bd764e9bb382786cebb2"
+  },
+  "kit_version": "1.1.0",
+  "package_release": 6,
+  "profile_id": "omarchy-hypr0562r3-aq0151-remaps",
+  "runtime": {
+    "basename": "libstdc++.so.6.0.36",
+    "packages": {
+      "aquamarine": "0.15.1-1",
+      "glibc": "2.44+r24+g16be1518495f-1",
+      "hyprcursor": "0.1.13-7",
+      "hyprgraphics": "0.5.1-4",
+      "hyprlang": "0.6.8-5",
+      "hyprutils": "0.14.2-1",
+      "libgcc": "16.2.1+r23+gd564253eb6c8-1",
+      "libstdc++": "16.2.1+r23+gd564253eb6c8-1",
+      "libxkbcommon": "1.13.2-1",
+      "wayland": "1.26.0-1"
+    },
+    "sha256": "f5fc7380f2ae46fa4053a64be04e7b98109f1066a4bbfff3c37042488aa0be0e"
+  },
+  "schema": 2,
+  "source": {
+    "archive_sha256": "47bca9e018f32f4fcfe683f91c7475c60368f3b65d318cc35c1f2de88a4ee9ab",
+    "driver_version": "0.26.1",
+    "manifest_sha256": "54f514664c84e1358a435f29cd6befd5661b0b133d76997191c000b10f021a75",
+    "revision": "cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7"
+  }
+}
@@ -0,0 +1,215 @@
+# Optional Cua Hyprland plugin
+
+This package targets **Omarchy x86_64**, with Inkscape `1.4.4-6` and two independent background-input lanes. Release `6` is an edge candidate for Aquamarine `0.15.1-1`; it retains the keyboard-remap patch introduced in release `5`, which includes the Omarchy patch for independent agent keymaps, operation-specific foreground checks, and compatible Num Lock state; the upstream native qualification below covers the unpatched source, not this change. Cua's native qualification is recorded in [the kit's qualification record](https://github.com/trycua/cua/releases/download/cua-hyprland-kit-v1.1.0-omarchy-stable-20260910/QUALIFICATION.md) and [Cua #3698](https://github.com/trycua/cua/pull/3698). Omabot replay and Omarchy's merge decision are recorded in [omarchy-pkgs #346](https://github.com/omacom/omarchy-pkgs/pull/346). Scheduling the recipe does not expand the qualified stable target.
+
+The plugin is optional. Cua Driver works independently, and installation does not load the plugin or enable input. The package follows the normal edge-to-RC-to-stable promotion path instead of the fast release ring. Its PKGBUILD limits builds to x86_64. The upstream qualification covers the original stable profile; the updated Aquamarine profile needs its own Omabot validation before promotion.
+
+## Source and build profile
+
+The package uses the [Driver 0.26.1 plugin source](https://github.com/trycua/cua/releases/tag/cua-driver-rs-v0.26.1),
+including the [desktop-fault cleanup repair](https://github.com/trycua/cua/pull/3702).
+It is not a repackaging of the unmodified 0.24.0 plugin.
+
+The qualified upstream Driver pairing is `cua-driver-bin 0.27.0-1`, with input protocol v3. Driver 0.27.0 contains the bounded stale-geometry retry validated with the upstream module; its production plugin source is the base for the downstream patch used here. Discovery protocol v2 is separate. A newer Driver release is a changed pairing and requires affected replay before promotion.
+
+Profile `omarchy-hypr0562r3-aq0151-remaps`, kit tooling `1.1.0`, and package release `6` pin:
+
+- Hyprland `0.56.2-3`, headers `0.56.2`, and measured executable/header hashes.
+- GCC `16.2.1 20260810`, including compiler bytes and emitted ELF identity.
+- Shared runtime `libstdc++.so.6.0.36`, its bytes, and exact ABI package versions, including Aquamarine `0.15.1-1`.
+
+This profile derives from Cua's `omarchy-stable-20260910` profile. Arch's
+Hyprland `-3` package splits out `hyprpm` and changes package dependencies;
+its compositor executable and all 498 header/pkg-config files are byte-identical
+to `-2`. Both executables have SHA-256
+`da8fcacf347bcbed83edc40108c6e2298da095e22246bd764e9bb382786cebb2`.
+The checked-in `PROFILE.json` changes only the profile name, package release, and exact Hyprland and Aquamarine package versions. Compiler, libstdc++ runtime, upstream source, compositor executable, and header identities remain unchanged; the separately recorded patch changes the build source. The download wrapper verifies the
+original kit before deriving the updated profile, recipe, and provenance,
+then verifies every derived member against its recorded digest.
+
+The native qualification below was recorded with package release `2` and
+Hyprland `-2`. The downstream keymap change and Aquamarine update need their own application and Driver replay before promotion. Hyprland `0.56.2-3` and Aquamarine `0.15.1-1` must both reach a destination channel before this artifact can be installed there; publication still follows edge → RC → stable.
+
+The generated `PKGBUILD` identifies the immutable kit download, outer checksum,
+and member checksums. The kit records the full source and tooling revisions,
+profile digest, and source archive/manifest digests. Do not infer compatibility
+from a matching version label or substitute an unreviewed profile.
+
+The download wrapper verifies its complete inventory before executing downloaded
+tooling. It preserves the source archive and its historical embedded verifier,
+but explicitly uses the new kit's `profile_verify.py`. Source integrity,
+package-owned headers, pkg-config selection, compiler probes, runtime equality,
+and production flags remain mandatory. Packaging runs all bundled CTests even
+with `--nocheck` or `--repackage`; `--skipinteg` does not bypass recipe checks.
+Production input is built in; experimental signed input and tracing are off.
+
+The pristine upstream archive, manifest, and verifier remain unchanged. `independent-keymaps.patch` is applied to a separate source tree, and `DOWNSTREAM-PROVENANCE.json` pins the patch and every resulting source file. Build, check, and package revalidate both trees, including when makepkg integrity checks are skipped. `BUILD-PROVENANCE.json` records the upstream base under `source`, the applied change under `downstream`, and the final module digest; the downstream manifest and patch are installed beside it. This preserves the existing compiler, headers, runtime, and consumer checks without representing the modified module as an unmodified upstream build.
+
+## Aquamarine dependency refresh
+
+Release `5` required Aquamarine `0.15.0-2`. When the edge mirror moved to `0.15.1-1`, pacman could no longer resolve that dependency, even after a full database refresh. Release `6` derives a new profile from the same verified upstream kit and pins `0.15.1-1` in both the package dependencies and the installed compatibility verifier. Source, patch, compiler, compositor, headers, and libstdc++ hashes remain pinned; the original upstream qualification does not establish compatibility with the changed Aquamarine package.
+
+A package release bump alone cannot repair future dependency drift: the checked-in profile and derived kit checksums must agree with the new environment, and affected native checks must pass before publication. Do not remove exact dependencies or selectively downgrade a library to bypass a mismatch.
+
+## Keyboard behavior
+
+Each background lane owns a canonical US keymap and independent modifier state. The physical keyboard keeps its layout, Compose key, and remaps. No installation or activation step edits `input:kb_*`. Existing Driver keycodes are interpreted by the agent keyboard, so this does not add Unicode, IME, or new Driver text routes.
+
+Plain click, scroll, drag, and foreground activation do not require a canonical keyboard layout. Foreground keys still use the primary seat: the plugin checks the requested key and modifier sequence against its actual XKB map before activation or input. Unrelated remaps are accepted; a sequence whose symbols or modifier/lock transitions differ from the canonical meaning is refused with `unsupported_layout`. Arbitrary foreground layout translation remains outside protocol v3.
+
+Foreground typing preserves Num Lock and admits a requested key sequence only when its symbols and shortcut semantics still match the canonical meaning. Num Lock does not block unaffected letters, top-row digits, Enter, or compatible shortcuts; a keypad sequence whose meaning changes is refused. Caps Lock, other unsupported lock states, held or latched modifiers, and nonzero layout groups remain guarded.
+
+Both routes retain target/conflict checks and cancellation on desktop/keymap changes. `hyprctl -j cua:status` exposes `keyboard_layout_independent: true` and `foreground_numlock_compatible: true` for installers to distinguish this implementation from an older mapped module. The marker does not identify every future package revision; plugin updates still require a fresh desktop session.
+
+## Historical upstream qualification
+
+The initial app scope is native Wayland Inkscape `1.4.4-6` with the canonical
+US keymap. Two lanes require independent Driver processes and distinct native
+application clients, not merely two windows. This is concurrency inside one
+desktop account, not multi-user or mutually untrusted-agent isolation.
+
+Cua's retained evidence covers background application effects, two-lane overlap,
+third-owner refusal, primary-input preservation, conflicts, stale targets and
+geometry, cancellation, desktop faults, recovery, and cold package transitions.
+Production-package app checks and independent primary observers are separate
+from trace-enabled diagnostics. Cua's retained canonical run
+`433ce968ee164d5e8e3226e800db93a6` recorded all 128 required cells: 87
+deliveries and 41 expected refusals, with no failures or skips; its completion
+report has SHA-256
+`1eda4cc008ea6b27d96c21d58f8041834398a43409642376bafe84ad38f0e112`.
+That historical run used source-built released Driver 0.24.0; earlier real-app
+checks separately used the then-published Omarchy `cua-driver-bin 0.24.0-1`
+executable. A separate later Omabot replay reported 124 passes and four
+failures, plus seven incomplete native cases. Cua subsequently passed those
+four cells with the repair candidate shipped in Driver 0.27.0 and passed all
+seven lifecycle cases. A final exact-release Fleet replay then passed all four
+cells with Driver and harness source `082de4344b731ae4738ddc6a6f13f21bb3c49a85`,
+released Driver binary SHA-256
+`bb1b65394e912246220f9f758c9efbbf6260cec16e3562e62a361fa95329377f`,
+and evidence SHA-256
+`b6c47278a3db398ecbb4d7aed2bce44a467e2af37e6d4ccfc236d1e07aa70af7`.
+See the linked qualification record and PR description for exact artifacts and observation limits. Omarchy replay of the 0.27.0 package pairing is recorded in #346; it does not qualify later Driver releases.
+
+Duplicate motion notifications are retained and counted. They are acceptable
+only when pointer identity, coordinates, focus, held input, and foreground
+interaction remain unchanged. Actual motion—including moving away and back—
+fails isolation. After cancellation, an inert agent pointer may remain parked
+if held input is released and authority is revoked.
+
+Current LibreOffice Calc `26.8`, Chromium/Electron raw background input,
+XWayland, Unicode/IME, non-US layouts, and modified pointer gestures are outside
+this profile. The plugin does not widen Driver's application admission.
+Foreground input, capture, and accessibility have separate contracts; a
+background refusal never authorizes a hidden foreground fallback or unlock.
+
+## Omabot replay before promotion
+
+Build the unsigned candidate in edge:
+
+```sh
+./bin/build --package cua-hyprland-plugin --arch x86_64 --mirror edge
+```
+
+In a fresh worker matching the reviewed profile:
+
+1. Verify the downloaded kit and source identities against the reviewed recipe.
+   Record the actual channel snapshot, Driver, compiler, compositor, runtime,
+   applications, keymap, and resulting package/module hashes.
+2. Require all bundled tests and native compatibility checks. Do not weaken
+   exact dependencies or replace the compositor to make the build pass.
+3. Install through pacman and activate in a fresh session. Replay the declared
+   app, two-lane, refusal, primary-input, cancellation, and fault/recovery checks
+   against the actual packaged Driver and module. A Cua Fleet result is not an
+   Omabot result; matching source alone does not certify different binaries.
+4. Verify restart-based upgrade, rollback, removal, and reinstallation. Retain
+   evidence that binds each result to the package and mapped module bytes.
+
+After the exact package and Driver pairing passes, advance the signed artifact with `bin/repo advance --from edge --to rc --package cua-hyprland-plugin`, validate RC, and then use `bin/repo advance --from rc --to stable --package cua-hyprland-plugin`. Do not rebuild independently in RC or stable.
+
+Portable tests, screenshots, health reports, and a successful build do not
+replace native qualification. Recheck the published Driver package before
+rollout and qualify any changed pairing explicitly.
+
+## Activation, updates, and removal
+
+The package installs the module at
+`/usr/lib/cua/hyprland/cua-hyprland-plugin.so` and provenance plus the consumer
+verifier under `/usr/share/cua-hyprland-plugin/`. There are no hooks, autoloading,
+configuration edits, or hot replacement.
+
+Save your work and exit Hyprland before installing, replacing, or removing the
+package. Install the exact reviewed package from a text console, then start a
+fresh session. Before loading, run the consumer check with this package's derived
+kit-provenance digest:
+
+```sh
+python3 /usr/share/cua-hyprland-plugin/profile_verify.py \
+  --kit /usr/share/cua-hyprland-plugin \
+  --kit-sha256 819779b93655d603d9ebb0d33ea052326c3374674a1d473886106af25e0fffdd \
+  --consumer /usr/lib/cua/hyprland/cua-hyprland-plugin.so
+```
+
+This check requires Python 3.11+, binutils `readelf`, and system `ldd`/`pacman`,
+not a compiler or headers. If it fails, leave the plugin unloaded. It verifies
+installed compatibility, not runtime mapping or input effects.
+
+After that check passes in the fresh session, load the module explicitly:
+
+```sh
+hyprctl plugin load /usr/lib/cua/hyprland/cua-hyprland-plugin.so
+hyprctl -j cua:status
+```
+
+Loading alone does not enable input. Use Omarchy's explicit Cua Input toggle when available; it verifies the installed profile and loaded capability and removes the legacy copied toggle's keyboard override. If it reports an older mapped plugin, disable Cua Input and log out and back in before enabling it again. Never hot-unload and reload the module.
+
+For manual activation, add only this plugin setting to a sourced Hyprland Lua configuration file, preserving all existing input settings:
+
+```lua
+hl.config({
+  plugin = { cua = { enabled = true } },
+})
+```
+
+Then reload and inspect status:
+
+```sh
+hyprctl reload
+hyprctl -j cua:status
+```
+
+Continue only when status reports `keyboard_layout_independent: true`, `foreground_numlock_compatible: true`, input protocol v3, input capability, socket paths, and the expected compositor identity. Do not change `kb_layout`, `kb_options`, or NumLock for background input. If you previously followed the stock-US override instructions, remove only that Cua-specific override and reload to restore your underlying personal settings.
+
+Start Driver with `CUA_DRIVER_RS_ENABLE_WAYLAND=1`. In a new disposable Inkscape document, test an admitted background key operation and pointer operation, then verify the result in both a fresh snapshot and a saved/reopened SVG. Driver text-route restrictions still apply. Never test against an existing document or automatically replay an action with a partial or unknown outcome.
+
+To disable input, turn the Cua Input toggle off, or remove the manual `plugin.cua.enabled` setting and reload. Confirm that status reports input disabled. Retained inert agent pointers can remain until the compositor exits; disabling input does not unload the mapped module.
+
+Before an incompatible desktop update, remove operator-added plugin activation
+settings, save work, and exit the graphical session. From a text console, run
+`sudo pacman -R cua-hyprland-plugin`, then apply the normal desktop update and
+verify a fresh session without the plugin. Declining removal preserves the
+dependency refusal. Disabling input alone leaves exact dependencies installed;
+do not force an upgrade past them.
+
+Retain the previous package with its matching compositor, runtime, Driver, and
+provenance as a rollback set. Restore a consistent set outside the graphical
+session, then repeat the fresh-session consumer and app checks. Do not hot
+unload/reload or replace a mapped module.
+
+## Ownership and publication
+
+The [agreed ownership split](https://github.com/omacom/omarchy-pkgs/pull/346#issuecomment-5612834061)
+assigns profiles, build kits, plugin fixes, and native input evidence to Cua.
+Francesco (@f-trycua) is the Cua contact through this PR. Omarchy owns package
+integration, dependency-change detection, Omabot validation, and signing and
+publication decisions. Spencer (@spencerbull) and Emir (@emirb) jointly own
+that Omarchy package and release path. Maintenance is best effort, with no
+turnaround commitment.
+
+Edge detects upcoming incompatibilities; RC validates the intended stable
+environment. Mirror/channel changes and changes to ABI dependencies, Driver,
+or admitted apps request a new candidate and affected qualification. They do
+not establish compatibility or authorize additional publication channels.
+
+This package participates in scheduled builds, but has no upstream polling, AUR synchronization, or automatic rebuild bump. A checked-in version change or missing artifact can queue it for the normal release pipeline. Build selection, promotion, `push`, and `upload-prebuilt` do not supply native qualification or authorize a broader support claim. Do not silently substitute newly rebuilt bytes during signing or publication.
+
+Before calling a release complete, install the signed published package on a fresh consumer, verify its signature and package/module digests, and perform a short activation, background-action, and cleanup smoke. Edge and RC artifacts are compatibility checkpoints, not qualified support for those environments.
@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+"""Verify the Omarchy patch separately from the unchanged upstream source kit."""
+
+import argparse
+import hashlib
+import importlib.util
+import json
+from pathlib import Path, PurePosixPath
+import shutil
+import subprocess
+
+
+def require(condition, message):
+    if not condition:
+        raise ValueError(message)
+
+
+def digest(path):
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def inventory(root):
+    require(root.is_dir() and not root.is_symlink(), "source must be a real directory")
+    result = {}
+    for path in root.rglob("*"):
+        require(not path.is_symlink() and (path.is_dir() or path.is_file()), "nonregular source entry")
+        if path.is_file():
+            result[path.relative_to(root).as_posix()] = digest(path)
+    return result
+
+
+def verify_inputs(pristine, patch, manifest):
+    require(manifest["schema"] == 1, "unsupported downstream schema")
+    require(patch.is_file() and not patch.is_symlink() and digest(patch) == manifest["patch_sha256"],
+            "downstream patch checksum mismatch")
+    require(digest(pristine / "SOURCE-PROVENANCE.json") == manifest["upstream_manifest_sha256"],
+            "downstream base manifest mismatch")
+    require(manifest["files"], "empty downstream inventory")
+    for name in manifest["files"]:
+        path = PurePosixPath(name)
+        require(name and not path.is_absolute() and path.as_posix() == name and
+                ".." not in path.parts and "\\" not in name, "invalid downstream path")
+
+
+def verify_tree(source, manifest):
+    require(inventory(source) == manifest["files"], "patched source inventory/checksum mismatch")
+
+
+def prepare(pristine, source, patch, manifest):
+    require(not source.exists() and not source.is_symlink(), "patched source requires a fresh destination")
+    shutil.copytree(pristine, source)
+    subprocess.run(["patch", "--batch", "--fuzz=0", "-p1", "-i", str(patch.resolve())], cwd=source, check=True)
+    verify_tree(source, manifest)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("mode", choices=("prepare", "check", "build"))
+    parser.add_argument("--pristine", required=True, type=Path)
+    parser.add_argument("--source", required=True, type=Path)
+    parser.add_argument("--patch", required=True, type=Path)
+    parser.add_argument("--manifest", required=True, type=Path)
+    parser.add_argument("--kit", required=True, type=Path)
+    parser.add_argument("--kit-sha256", required=True)
+    parser.add_argument("--archive", required=True, type=Path)
+    parser.add_argument("--cxx", required=True, type=Path)
+    parser.add_argument("--build", type=Path)
+    parser.add_argument("--output", type=Path)
+    args = parser.parse_args()
+    try:
+        # PKGBUILD authenticates the verifier and this helper before execution.
+        spec = importlib.util.spec_from_file_location("upstream_profile", args.kit / "profile_verify.py")
+        upstream = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(upstream)
+        profile, kit = upstream.verify_kit(args.kit, args.kit_sha256)
+        base = upstream.verify_archive(args.archive, profile)
+        require(upstream.verify_source(args.pristine, profile) == base, "upstream source identity mismatch")
+        manifest = upstream.read_json(args.manifest.read_bytes())
+        verify_inputs(args.pristine, args.patch, manifest)
+        if args.mode == "prepare":
+            prepare(args.pristine, args.source, args.patch, manifest)
+        else:
+            verify_tree(args.source, manifest)
+        if args.mode == "build":
+            require(args.build is not None and args.output is not None, "build evidence requires output")
+            native = upstream.verify_native(args.cxx, profile)
+            native["module_sha256"] = upstream.verify_build(args.build, args.source, args.cxx, profile)
+            native["module_runtime_sha256"] = profile["runtime"]["sha256"]
+            args.output.write_bytes(upstream.json_bytes(dict(native, source=base, profile=profile,
+                                                            kit=kit, downstream=manifest)))
+    except (ValueError, KeyError, TypeError, OSError, subprocess.CalledProcessError) as error:
+        parser.exit(1, f"error: {error}\n")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+"""Exercise downstream integrity with real patch application and tampering."""
+
+import hashlib
+from pathlib import Path
+import tempfile
+import unittest
+
+import downstream
+
+
+class DownstreamTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.pristine = self.root / "pristine"
+        self.pristine.mkdir()
+        (self.pristine / "SOURCE-PROVENANCE.json").write_text("upstream\n")
+        (self.pristine / "input.cpp").write_text("old\n")
+        self.patch = self.root / "change.patch"
+        self.patch.write_text("--- a/input.cpp\n+++ b/input.cpp\n@@ -1 +1 @@\n-old\n+new\n")
+        self.source = self.root / "patched"
+        self.manifest = {
+            "schema": 1,
+            "patch_sha256": downstream.digest(self.patch),
+            "upstream_manifest_sha256": downstream.digest(self.pristine / "SOURCE-PROVENANCE.json"),
+            "files": {"SOURCE-PROVENANCE.json": downstream.digest(self.pristine / "SOURCE-PROVENANCE.json"),
+                      "input.cpp": hashlib.sha256(b"new\n").hexdigest()},
+        }
+
+    def test_applies_patch_without_changing_upstream(self):
+        downstream.verify_inputs(self.pristine, self.patch, self.manifest)
+        downstream.prepare(self.pristine, self.source, self.patch, self.manifest)
+        self.assertEqual((self.pristine / "input.cpp").read_text(), "old\n")
+        self.assertEqual((self.source / "input.cpp").read_text(), "new\n")
+
+    def test_changed_patch_refuses(self):
+        self.patch.write_text(self.patch.read_text().replace("+new", "+bad"))
+        with self.assertRaisesRegex(ValueError, "patch checksum"):
+            downstream.verify_inputs(self.pristine, self.patch, self.manifest)
+
+    def test_changed_base_manifest_refuses(self):
+        (self.pristine / "SOURCE-PROVENANCE.json").write_text("different\n")
+        with self.assertRaisesRegex(ValueError, "base manifest"):
+            downstream.verify_inputs(self.pristine, self.patch, self.manifest)
+
+    def test_tampered_missing_and_extra_files_refuse(self):
+        downstream.prepare(self.pristine, self.source, self.patch, self.manifest)
+        file = self.source / "input.cpp"
+        for content in ("tampered\n", None):
+            if content is None:
+                file.unlink()
+            else:
+                file.write_text(content)
+            with self.assertRaisesRegex(ValueError, "inventory/checksum"):
+                downstream.verify_tree(self.source, self.manifest)
+        file.write_text("new\n")
+        (self.source / "unexpected.cpp").write_text("extra\n")
+        with self.assertRaisesRegex(ValueError, "inventory/checksum"):
+            downstream.verify_tree(self.source, self.manifest)
+
+    def test_symlink_and_reused_destination_refuse(self):
+        downstream.prepare(self.pristine, self.source, self.patch, self.manifest)
+        with self.assertRaisesRegex(ValueError, "fresh destination"):
+            downstream.prepare(self.pristine, self.source, self.patch, self.manifest)
+        file = self.source / "input.cpp"
+        file.unlink()
+        file.symlink_to(self.pristine / "input.cpp")
+        with self.assertRaisesRegex(ValueError, "nonregular"):
+            downstream.verify_tree(self.source, self.manifest)
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -1,5 +1,20 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "c5073d62f60f3973a14340eb1b40fc5b5a4ea9f0"
+  "upstream": {
+    "watch": {
+      "json": "https://www.cursor.com/api/download?platform=linux-x64&releaseTrack=stable",
+      "path": "version",
+      "fields": {
+        "commit": "commitSha"
+      },
+      "variables": {
+        "_commit": "{commit}"
+      }
+    }
+  },
+  "origin": {
+    "aur": "cursor-bin",
+    "commit": "a87a0de17b0d8176ee4f046499b1e6e4b37cc422"
+  }
 }
@@ -1,34 +1,53 @@
 # Maintainer: Gunther Schulz <dev@guntherschulz.de>

 pkgname=cursor-bin
-pkgver=3.19.13
-pkgrel=1
+pkgver=3.21.16
+pkgrel=3
 pkgdesc='AI-first coding environment'
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url="https://www.cursor.com"
 license=('LicenseRef-Cursor_EULA')
 # upstream uses Electron newer than internal VSCode
 _electron=electron42
-depends=(xdg-utils ripgrep $_electron nodejs
-  'gcc-libs' 'hicolor-icon-theme' 'libxkbfile')
+depends=(xdg-utils gcc-libs hicolor-icon-theme libxkbfile)
+depends_x86_64=(ripgrep $_electron nodejs)
+# ARM retains bundled Electron because electron42 is unavailable in ALARM.
+depends_aarch64=(
+  alsa-lib at-spi2-core ca-certificates cairo curl dbus expat glib2 glibc gtk3
+  libcups libsecret libx11 libxcb libxcomposite libxdamage libxext libxfixes
+  libxkbcommon libxrandr mesa nspr nss pango systemd-libs which
+)
 options=(!strip !debug) # Don't break ext of VSCode
-_commit=dd066f332fcea7382764400fde902f61920648d5
-source=("https://downloads.cursor.com/production/${_commit}/linux/x64/deb/amd64/deb/cursor_${pkgver}_amd64.deb"
+_commit=8ae78e8eee1e63479c7e0504b664bc0a80c6800f
+source_x86_64=("https://downloads.cursor.com/production/${_commit}/linux/x64/deb/amd64/deb/cursor_${pkgver}_amd64.deb"
 "https://gitlab.archlinux.org/archlinux/packaging/packages/code/-/raw/main/code."{sh,mjs}
 rg.sh)
-sha512sums=('SKIP'
-  '937299c6cb6be2f8d25f7dbc95cf77423875c5f8353b8bd6cd7cc8e5603cbf8405b14dbf8bd615db2e3b36ed680fc8e1909410815f7f8587b7267a699e00ab37'
-  '793f9ff6306e3992ac89802d98110cba288ea1181a901467333293b7d76182ef9792c2a39ff49d9347a18a174b1f42bc58862091dff583f4146c2704eea28033'
-  'e79fe7659f59d1ae02fc68816399bfd31587315df6cdb6ccf1d0ca76f7cdc692c2a42b30591c0091147bd97ef14b1c7745dc26bd7cb3ea6bba45698e5044fa2a')
-sha512sums[0]=3c952035fa1809caded7059b7addbb01a9143cd248ecff27cdb3cb3af47d4bc824ed60dfd9757e105a342e53280e075d81f775790295a3272818bab5a994b305
-noextract=(cursor_${pkgver}_amd64.deb) # avoid double tarball
+sha512sums_x86_64=('032c86a5d51f154ce36b1a0bf34aa06b2d117666b4372a787ea3117fc0b2b1686e952c721388f2eaf7787f2e0581378c98608048126f7470df2e85e9dbd75ca4' '937299c6cb6be2f8d25f7dbc95cf77423875c5f8353b8bd6cd7cc8e5603cbf8405b14dbf8bd615db2e3b36ed680fc8e1909410815f7f8587b7267a699e00ab37' '793f9ff6306e3992ac89802d98110cba288ea1181a901467333293b7d76182ef9792c2a39ff49d9347a18a174b1f42bc58862091dff583f4146c2704eea28033' 'e79fe7659f59d1ae02fc68816399bfd31587315df6cdb6ccf1d0ca76f7cdc692c2a42b30591c0091147bd97ef14b1c7745dc26bd7cb3ea6bba45698e5044fa2a')
+source_aarch64=("https://downloads.cursor.com/production/${_commit}/linux/arm64/deb/arm64/deb/cursor_${pkgver}_arm64.deb")
+sha512sums_aarch64=('88a163c130e7ee8d9f29b93ccf1258e9f5eb0138d4de5d2333f5bc2992c0a4d0c3a72e8f5912b2e9ac9819a8d758de8e7249cd33bdf3ac631271001ca92700f7')
+noextract=(cursor_${pkgver}_amd64.deb cursor_${pkgver}_arm64.deb) # avoid double tarball
 _app=usr/share/cursor/resources/app
 package() {
-  # Exclude electron
-  bsdtar -xOf ${noextract[0]} data.tar.xz | tar -xJf - -C "$pkgdir" \
-    --exclude 'usr/share/cursor/[^r]*' --exclude 'usr/share/cursor/*.pak'
+  local deb="cursor_${pkgver}_amd64.deb"
+  local -a excludes=(--exclude 'usr/share/cursor/[^r]*' --exclude 'usr/share/cursor/*.pak')
+  if [[ "$CARCH" == aarch64 ]]; then
+    deb="cursor_${pkgver}_arm64.deb"
+    # Keep bundled Electron; omit Debian's AppArmor and sysctl settings.
+    excludes=(--exclude './etc')
+  fi
+  bsdtar -xOf "${srcdir}/${deb}" data.tar.xz | tar -xJf - -C "$pkgdir" "${excludes[@]}"
  cd "$pkgdir"
+  # Disable Cursor's bundled updater; Omarchy manages updates via pacman (#238).
+  sed -i '/^[[:space:]]*"\(backupUpdateUrl\|updateUrl\)":/d' \
+    "${_app}/product.json"
  mv usr/share/zsh/{vendor-completions,site-functions}
+  if [[ "$CARCH" == aarch64 ]]; then
+    install -d usr/bin
+    ln -s /usr/share/cursor/bin/cursor usr/bin/cursor
+    # Use Electron's unprivileged namespace sandbox.
+    chmod 0755 usr/share/cursor/chrome-sandbox
+    return
+  fi
  ln -sf /usr/bin/node ${_app}/resources/helpers/node
  install -Dm755 "${srcdir}/rg.sh" ${_app}/node_modules/@vscode/ripgrep/bin/rg
  ln -sf /usr/bin/xdg-open ${_app}/node_modules/open/xdg-open
@@ -1,5 +1,16 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "954e5556aa88f2309b86992b231c8b76f273cfb0"
+  "upstream": {
+    "watch": {
+      "regex": "https://cursor.com/install",
+      "pattern": "https://downloads\\.cursor\\.com/lab/(?P<version>[0-9]{4}\\.[0-9]{2}\\.[0-9]{2})-(?P<hash>[a-f0-9]+)/",
+      "version": "{version}.1.{hash}",
+      "sequence": true
+    }
+  },
+  "origin": {
+    "aur": "cursor-cli",
+    "commit": "954e5556aa88f2309b86992b231c8b76f273cfb0"
+  }
 }
@@ -1,7 +1,7 @@
 # Maintainer: Ismet Togay <ismet.togay at gmail dot com>
 # Contributor: Christopher Cooper <christopher@cg505.com>
 pkgname=cursor-cli
-pkgver=2026.08.25.1.3e8eec8
+pkgver=2026.09.18.1.9a7762b
 # Upstream is YYYY.MM.DD-<hash>. pkgver cannot contain hyphens, and hashes are
 # not monotonically ordered, so pkgver is YYYY.MM.DD.<n>.<hash>: n resets to 1
 # on a new date and increments when the same date gets a new hash.
@@ -25,8 +25,8 @@ source_x86_64=("cursor-cli-${_upstream_ver}-x86_64.tar.gz::https://downloads.cur
 source_aarch64=("cursor-cli-${_upstream_ver}-aarch64.tar.gz::https://downloads.cursor.com/lab/${_upstream_ver}/linux/arm64/agent-cli-package.tar.gz")
 b2sums=('d241ee9895bdb1c17514438fde8528222a8f2326568bd7a033d7a1b11432ce6b4575ff1a50625764bfe6bc6f8a9dc060f7439c3be7e95f8fd02912cdd37a011d'
        '1928e04c713e13911ea607f84c3e4a2fed1f76af9795503811078f43d2b53c753e28b2233e553fc17e766831800fb0dbc272aad2a80b387f95ba6071d7d4116a')
-b2sums_x86_64=('cd5485f7524688e1a688daa2b64669c76bedcdd9ab87638bac78f9b42c2442bd5000559920a2f5171e00b5eb7fcf737f9111ef296f1eba40369cebf3279ee0a9')
-b2sums_aarch64=('191ff1c538f294134d93d501e9ca68cc6d4f8101cb1cee449753dfefcd9039daecd7bf9f9f2baf9ee9262f40eea19aaf15f834c9abb56d967fb48a3a3f23b8ea')
+b2sums_x86_64=('3fccee6929df1042d03461895e56c222a996d3ae9e4f9c61dcc5e6ab7b1d075d3265c21a44f48dd94de0dcde4f8012cc39bfbf323e2bb0c6106cac79885c35ae')
+b2sums_aarch64=('3d3bb0a3cb7e2409acf4925f207eaa4e3f41782c3c947e2834b69664b116b972da0b67eea17147fc524ea248af9919494570adc7c48d12c44f12deca17ba2c28')

 prepare() {
    # Block cursor-agent auto-updates by making its versions directory
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "80626b9efefc215d55eede4330d56c017a522682"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "dropbox/dbxcli",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "dbxcli-bin",
+    "commit": "80626b9efefc215d55eede4330d56c017a522682"
+  }
 }
@@ -2,7 +2,7 @@

 _pkgname="dbxcli"
 pkgname="${_pkgname}-bin"
-pkgver=3.7.2
+pkgver=3.7.3
 pkgrel=1
 pkgdesc="A command line client for Dropbox built using the Go SDK"
 arch=(
@@ -33,9 +33,9 @@ source_armv7h=(
 source_x86_64=(
  "${url}/releases/download/v${pkgver}/${_pkgname}_${pkgver}_linux_amd64.tar.gz"
 )
-sha256sums_aarch64=('fc451469c87ad0e4f2d3201f6e36f2b57c1119e5c0adb5ebaec6182b3eb378ad')
-sha256sums_armv7h=('22f21d8b40dd23b5777ffb0ec07696d135d2910daa84f46679231a573aeb9899')
-sha256sums_x86_64=('1b1fa67fb3d3f6e2940566afdb84f072a21804ddfdb4f0dfade385ec0683ee63')
+sha256sums_aarch64=('9d654da62a1ac10c9e32ee8f66fa6cc8d88ed29bc95555435a5ce4255eb4b96a')
+sha256sums_armv7h=('8067cee274dc2f062a06ceda26200c44d9251336ec235f7d7a3826743c9a379e')
+sha256sums_x86_64=('fee977ce4144174356cd7d1bae0b546aecad2570f14666bd44417e96af943484')

 prepare() {
  local source_array="source_${CARCH}[0]"
@@ -2,7 +2,7 @@

 pkgname=dell-xps-touchpad-haptics
 pkgver=1.0.0
-pkgrel=3
+pkgrel=4
 pkgdesc="Synaptics haptic touchpad presets for Dell XPS on Omarchy"
 arch=('x86_64')
 url="https://github.com/omacom-io/omarchy-pkgs"
@@ -3,6 +3,7 @@ _default_level="high"
 _env_path="/etc/dell-xps-touchpad-haptics.env"
 _legacy_env_path="/etc/omarchy-dell-haptic-touchpad.env"
 _legacy_override_dir="/etc/systemd/system/dell-xps-haptic-touchpad.service.d"
+_runuser_path="/usr/bin/runuser"

 _existing_home() {
  local line value
@@ -124,18 +125,13 @@ _ensure_user_config() {
  local config_dir="$home/.config/omarchy"
  local config_path="$config_dir/dell-haptic.conf"

-  if [[ ! -f $config_path ]] && ! env HOME="$home" USER="$user" LOGNAME="$user" \
+  if [[ ! -f $config_path ]] && ! "$_runuser_path" --user "$user" -- \
+    /usr/bin/env HOME="$home" USER="$user" LOGNAME="$user" \
    /usr/bin/dell-xps-touchpad-haptics set "$_default_level"; then
    echo ":: Failed to create ${config_path} for user '$user'." >&2
    return 1
  fi

-  if [[ -f $config_path ]]; then
-    chown "$user:$user" "$home/.config" 2>/dev/null || true
-    chown "$user:$user" "$config_dir" 2>/dev/null || true
-    chown "$user:$user" "$config_path" 2>/dev/null || true
-  fi
-
  return 0
 }

@@ -0,0 +1,19 @@
+{
+  "source": "local",
+  "origin": {
+    "aur": "dotnet-core-bin",
+    "commit": "2c499d7ce634efb8e93eee4c4239490b02e98e09"
+  },
+  "upstream": {
+    "watch": {
+      "json": "https://builds.dotnet.microsoft.com/dotnet/release-metadata/10.0/releases.json",
+      "path": "latest-sdk",
+      "fields": {
+        "runtime": "latest-runtime"
+      },
+      "variables": {
+        "_runtimever": "{runtime}"
+      }
+    }
+  }
+}
@@ -0,0 +1,123 @@
+# Maintainer: Attila Greguss <floyd0122[at]gmail[dot]com>
+# Co-Maintainer: Nate Plumm <nate[at]ceresta[dot]com>
+
+pkgbase=dotnet-core-bin
+pkgname=(
+  'dotnet-host-bin'
+  'aspnet-runtime-bin'
+  'dotnet-runtime-bin'
+  'dotnet-sdk-bin'
+  'dotnet-targeting-pack-bin'
+  'aspnet-targeting-pack-bin'
+ )
+# Version the split family by SDK release; dependencies expose runtime versions.
+pkgver=10.0.401
+_runtimever=10.0.12
+_sdkver=$pkgver
+_short_ver=10.0
+pkgrel=2
+arch=('aarch64')
+url='https://www.microsoft.com/net/core'
+license=('MIT')
+options=('staticlibs' '!debug')
+source=('dotnet.sh')
+source_aarch64=("https://builds.dotnet.microsoft.com/dotnet/Sdk/${_sdkver}/dotnet-sdk-${_sdkver}-linux-arm64.tar.gz")
+sha512sums=('768151c7179fb6a126b3de9cae01e363e8894f6fab384b1e2c5066c2adca4578638983b1b62aea10dd18045e6d6e8f8ea13280481134de94f004a118919b2c06')
+sha512sums_aarch64=('58ace73ced6b4360754689a686bdfb8a317f4da6cb8bb416dbc7d0ba9f47e43e3c09f5eb1f1a1cfaacbd10df9558da4882bf2a5e195d6ab56a02c1f9f76102ed')
+
+# Keep each split package's notices usable when installed independently.
+_install_license() {
+  install -Dm644 LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE.txt"
+  install -Dm644 ThirdPartyNotices.txt "$pkgdir/usr/share/licenses/$pkgname/ThirdPartyNotices.txt"
+}
+
+package_dotnet-host-bin() {
+  pkgdesc='A generic driver for the .NET Core Command Line Interface (binary)'
+  provides=("dotnet-host" "dotnet-host=${_runtimever}")
+  conflicts=('dotnet-host')
+  depends=(
+    'libgcc'
+    'libstdc++'
+    'glibc'
+  )
+
+  install -dm 755 "${pkgdir}"/usr/{bin,lib,share/{dotnet,dnx}}
+  cp -dr --no-preserve='ownership' dotnet host dnx "${pkgdir}"/usr/share/dotnet/
+  _install_license
+  ln -sf /usr/share/dotnet/dotnet "${pkgdir}"/usr/bin/dotnet
+  ln -sf /usr/share/dotnet/dnx "${pkgdir}"/usr/bin/dnx
+  ln -sf /usr/share/dotnet/host/fxr/"${_runtimever}"/libhostfxr.so "${pkgdir}"/usr/lib/libhostfxr.so
+  install -Dm 644 "${srcdir}"/dotnet.sh -t "${pkgdir}"/etc/profile.d/
+}
+
+package_dotnet-runtime-bin() {
+  pkgdesc='The .NET Core runtime (binary)'
+  depends=(
+    "dotnet-host>=${_runtimever}"
+    'libgcc'
+    'libstdc++'
+    'glibc'
+    'icu'
+    'libunwind'
+    'zlib'
+    'openssl'
+  )
+  optdepends=('lttng-ust2.12: CoreCLR tracing')
+  provides=("dotnet-runtime=${_runtimever}" "dotnet-runtime-${_short_ver}")
+  conflicts=("dotnet-runtime=${_runtimever}" "dotnet-runtime-${_short_ver}")
+
+  install -dm 755 "${pkgdir}"/usr/share/{dotnet/shared,licenses}
+  cp -dr --no-preserve='ownership' shared/Microsoft.NETCore.App "${pkgdir}"/usr/share/dotnet/shared/
+  _install_license
+}
+
+package_aspnet-runtime-bin() {
+  pkgdesc='The ASP.NET Core runtime (binary)'
+  depends=('dotnet-runtime-bin')
+  provides=("aspnet-runtime=${_runtimever}" "aspnet-runtime-${_short_ver}")
+  conflicts=("aspnet-runtime=${_runtimever}" "aspnet-runtime-${_short_ver}")
+
+  install -dm 755 "${pkgdir}"/usr/share/{dotnet/shared,licenses}
+  cp -dr --no-preserve='ownership' shared/Microsoft.AspNetCore.App "${pkgdir}"/usr/share/dotnet/shared/
+  _install_license
+}
+
+package_dotnet-sdk-bin() {
+  pkgdesc='The .NET Core SDK (binary)'
+  depends=(
+    'glibc'
+    'libgcc'
+    'libstdc++'
+    'dotnet-runtime-bin'
+    'dotnet-targeting-pack-bin'
+    'aspnet-runtime-bin'
+    'aspnet-targeting-pack-bin'
+  )
+  provides=("dotnet-sdk-bin" "dotnet-sdk=${pkgver}" "dotnet-sdk-${_short_ver}=${pkgver}")
+  conflicts=("dotnet-sdk-bin" "dotnet-sdk=${pkgver}" "dotnet-sdk-${_short_ver}")
+
+  install -dm 755 "${pkgdir}"/usr/share/{dotnet,licenses}
+  cp -dr --no-preserve='ownership' sdk sdk-manifests templates "${pkgdir}"/usr/share/dotnet/
+  _install_license
+}
+
+package_dotnet-targeting-pack-bin() {
+  pkgdesc='The .NET Core targeting pack (binary)'
+  provides=(dotnet-targeting-pack=${_runtimever} dotnet-targeting-pack-${_short_ver})
+  conflicts=(dotnet-targeting-pack=${_runtimever} dotnet-targeting-pack-${_short_ver})
+
+  install -dm 755 "${pkgdir}"/usr/share/{dotnet,dotnet/packs,licenses}
+  cp -dr --no-preserve='ownership' packs/Microsoft.NETCore.App.{Host.linux-arm64,Ref} "${pkgdir}"/usr/share/dotnet/packs/
+  _install_license
+}
+
+package_aspnet-targeting-pack-bin() {
+  pkgdesc='The ASP.NET Core targeting pack (binary)'
+  depends=(dotnet-targeting-pack-bin)
+  provides=(aspnet-targeting-pack=${_runtimever} aspnet-targeting-pack-${_short_ver})
+  conflicts=(aspnet-targeting-pack=${_runtimever} aspnet-targeting-pack-${_short_ver})
+
+  install -dm 755 "${pkgdir}"/usr/share/{dotnet,dotnet/packs,licenses}
+  cp -dr --no-preserve='ownership' packs/Microsoft.AspNetCore.App.Ref "${pkgdir}"/usr/share/dotnet/packs/
+  _install_license
+}
@@ -0,0 +1,19 @@
+# Set location for AppHost lookup
+[ -z "$DOTNET_ROOT" ] && export DOTNET_ROOT=/usr/share/dotnet
+
+# Add dotnet directory to PATH, according to docs it must be added, plus VSCode C# Dev Kit doesn't work without this.
+# See https://learn.microsoft.com/en-us/dotnet/core/install/linux-scripted-manual#set-environment-variables-system-wide
+case "$PATH" in
+    *"$DOTNET_ROOT"* ) true ;;
+    * ) PATH="$PATH:$DOTNET_ROOT" ;;
+esac
+
+# Add dotnet tools directory to PATH
+[ -z "$DOTNET_TOOLS_PATH" ] && export DOTNET_TOOLS_PATH="$HOME/.dotnet/tools"
+case "$PATH" in
+    *"$DOTNET_TOOLS_PATH"* ) true ;;
+    * ) PATH="$PATH:$DOTNET_TOOLS_PATH" ;;
+esac
+
+# Extract self-contained executables under HOME to avoid multi-user issues from using the default '/var/tmp'
+[ -z "$DOTNET_BUNDLE_EXTRACT_BASE_DIR" ] && export DOTNET_BUNDLE_EXTRACT_BASE_DIR="${XDG_CACHE_HOME:-"$HOME"/.cache}/dotnet_bundle_extract"
@@ -1,5 +1,14 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "b67e475d16f4e061a16af53dae212a46d9bc3ea9"
+  "upstream": {
+    "watch": {
+      "regex": "https://linux.dropbox.com/packages/",
+      "pattern": "nautilus-dropbox-(?P<version>[0-9]{4}\\.[0-9]{2}\\.[0-9]{2})\\.tar\\.bz2"
+    }
+  },
+  "origin": {
+    "aur": "dropbox-cli",
+    "commit": "b67e475d16f4e061a16af53dae212a46d9bc3ea9"
+  }
 }
@@ -1,11 +0,0 @@
--- a/PKGBUILD
-+++ b/PKGBUILD
-@@ -11,7 +11,7 @@ pkgname=dropbox-cli
- pkgver=2024.04.17
- pkgrel=2
- pkgdesc="Command line interface for Dropbox"
-arch=("any")
-+arch=("x86_64")
- url="https://www.dropbox.com"
- license=("GPL-3.0-or-later")
- makedepends=("gdk-pixbuf2")
@@ -6,8 +6,8 @@
 # Contributor: carstene1ns <arch carsten-teibes de>

 pkgname=dropbox-cli
-pkgver=2024.04.17
-pkgrel=2.1
+pkgver=2026.05.06
+pkgrel=1
 pkgdesc="Command line interface for Dropbox"
 arch=("x86_64")
 url="https://www.dropbox.com"
@@ -18,8 +18,7 @@ optdepends=("gtk3: Dropbox update GUI"
            "python-gpgme: verify binary signature")
 source=("https://linux.dropbox.com/packages/nautilus-dropbox-${pkgver}.tar.bz2"
        "dropboxd-fallback.patch")
-sha256sums=('a6a098cf16aa4747f40816ac793d59e37e8ae3b7080d0b30611d6c2b8663f2c1'
-            '711ed63c6dfccfd05c6e9abaa291be9ac3c3909e84f788f568cb44dee2d48229')
+sha256sums=('c9d7ef418ccb0f34adc7cdda1952110be4fbbc788a79cdeb2cfd63e070bb3961' '711ed63c6dfccfd05c6e9abaa291be9ac3c3909e84f788f568cb44dee2d48229')

 prepare() {
  cd "nautilus-dropbox-${pkgver}"
@@ -1,5 +1,14 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "6379feda6f36bbbd496c97f040e4f71c5a1dcec7"
+  "upstream": {
+    "watch": {
+      "redirect": "https://www.dropbox.com/download?plat=lnx.x86_64",
+      "pattern": "dropbox-lnx\\.x86_64-(?P<version>[0-9]+\\.4\\.[0-9]+)\\.tar\\.gz"
+    }
+  },
+  "origin": {
+    "aur": "dropbox",
+    "commit": "6379feda6f36bbbd496c97f040e4f71c5a1dcec7"
+  }
 }
@@ -4,7 +4,7 @@
 # Contributor: David Manouchehri <d@32t.ca>

 pkgname=dropbox
-pkgver=264.4.3421
+pkgver=270.4.3312
 pkgrel=1
 pkgdesc="A free service that lets you bring your photos, docs, and videos anywhere and share them easily."
 arch=("x86_64")
@@ -27,12 +27,7 @@ source=("DropboxGlyph_Blue.svg"
        "dropbox@.service"
        "https://edge.dropboxstatic.com/dbx-releng/client/dropbox-lnx.x86_64-$pkgver.tar.gz"{,.asc})

-sha256sums=('9ba76205ec5838db85d822f23cfd7e2112fd2757e8031d8374709f102143c548'
-            '1610ff57e8b20ee7a37682c3cc505da4ddc9cec2bd7234c90c0f2073657521d2'
-            '6c67a9c8c95c08fafafd2f1d828074b13e3347b05d2e4f4bf4e62746115d7477'
-            '98581e65a91ae1f19ed42edcdaaa52e102298b5da0d71b50089393d364474d3d'
-            '4aa06821de43b5e1cf4f27f83cb5f0bca82d01107c758091d7895f0d723f5411'
-            'SKIP')
+sha256sums=('9ba76205ec5838db85d822f23cfd7e2112fd2757e8031d8374709f102143c548' '1610ff57e8b20ee7a37682c3cc505da4ddc9cec2bd7234c90c0f2073657521d2' '6c67a9c8c95c08fafafd2f1d828074b13e3347b05d2e4f4bf4e62746115d7477' '98581e65a91ae1f19ed42edcdaaa52e102298b5da0d71b50089393d364474d3d' '35404957d2a15dcac998d53cbec692d5236e197493f6c009accd91ea9aa8f34c' 'SKIP')
 # The PGP key fingerprint should match the one on https://www.dropbox.com/help/desktop-web/linux-commands
 validpgpkeys=(
  '1C61A2656FB57B7E4DE0F4C1FC918B335044912E'  # Dropbox Automatic Signing Key <linux@dropbox.com>
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "5614a0a61616643e448fb7c68d58237715ce2739"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-all",
+    "commit": "5614a0a61616643e448fb7c68d58237715ce2739"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "659b81f1aa74a13fd2ebec222e19da2046d8e977"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-archlinuxpkgs",
+    "commit": "659b81f1aa74a13fd2ebec222e19da2046d8e977"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "42d9dd5424884c51b8fe6bf7692caf0a31007f05"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-bluetooth",
+    "commit": "42d9dd5424884c51b8fe6bf7692caf0a31007f05"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "84aba9e90bbd65af45f83168cd6c7bce6ec4322e"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-calc",
+    "commit": "84aba9e90bbd65af45f83168cd6c7bce6ec4322e"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "3176f9de1445e7115009383f9cdac116729fc7be"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-clipboard",
+    "commit": "3176f9de1445e7115009383f9cdac116729fc7be"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "c30e33db5fef912dec9aa157773b10ffab1e0307"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-desktopapplications",
+    "commit": "c30e33db5fef912dec9aa157773b10ffab1e0307"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "2d16502b7a905e7d7a03e0026c5519c3b3c4abf2"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-files",
+    "commit": "2d16502b7a905e7d7a03e0026c5519c3b3c4abf2"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "5ab583fee6ba3e387d49ffe4e409bb84bc60ea24"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-menus",
+    "commit": "5ab583fee6ba3e387d49ffe4e409bb84bc60ea24"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "1d756a138e926a81b9d33265f0197b8661168845"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-providerlist",
+    "commit": "1d756a138e926a81b9d33265f0197b8661168845"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "e47641530d912199372204cf8780ef37f99f0b37"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-runner",
+    "commit": "e47641530d912199372204cf8780ef37f99f0b37"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "32263e8b71390ab38b8aa1fd82fc2595b41a5157"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-symbols",
+    "commit": "32263e8b71390ab38b8aa1fd82fc2595b41a5157"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "447978df5ea3afd1e10959d7973c0b35367724c3"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-todo",
+    "commit": "447978df5ea3afd1e10959d7973c0b35367724c3"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "23222b0d304a234c74f630c5b9176d58c6c6e0b3"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-unicode",
+    "commit": "23222b0d304a234c74f630c5b9176d58c6c6e0b3"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "6b5da831da33e3533593823826a8ffb1a008a299"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant-websearch",
+    "commit": "6b5da831da33e3533593823826a8ffb1a008a299"
+  }
 }
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "6dd02e6987a7a91be6a33e9600147523efa7fa5a"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "abenz1267/elephant",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "elephant",
+    "commit": "6dd02e6987a7a91be6a33e9600147523efa7fa5a"
+  }
 }
@@ -0,0 +1,17 @@
+# elsewhen
+
+Installs the Elsewhen world clock plugin from the `v{pkgver}` GitHub tag archive into `/usr/share/omarchy/shell/plugins/omacom.elsewhen/` (the directory name is the plugin id the shell scans for, not the package name), plus `LICENSE` under `/usr/share/licenses/elsewhen/` and the upstream `README.md` under `/usr/share/doc/elsewhen/`. The shell scans this directory alongside its bundled plugins.
+
+`package()` copies an explicit allow-list (`manifest.json`, every `*.qml` and `*.js`, `cities.json`, `world.json`, `worldclock-data.py`), so `tests/`, `.github/` and `.gitignore` never ship, and it fails the build if `manifest.json` is missing, does not declare `omacom.elsewhen`, or does not name a present `Panel.qml` as the entry point. An upstream release that adds a runtime file outside those patterns needs the allow-list extended here; the sync only moves versions and checksums. Every file is 0644: `Panel.qml` runs the script as `python3 <plugin dir>/worldclock-data.py`, so it needs no execute bit. No install hook: Omarchy restarts the shell after `omarchy update`, and nothing here may write into a user home. The script's only writes go to `$XDG_CACHE_HOME/omacom-elsewhen/`, which it creates itself at runtime.
+
+Dependencies, cited as `file: tool` in the upstream tree:
+
+- `omarchy`: `ArcText.qml`, `Chip.qml`, `EarthRow.qml`, `Globe.qml`, `MiniGlobe.qml`, `MoonDot.qml`, `Panel.qml: import qs.Commons`; `EarthRow.qml`, `Globe.qml`, `Panel.qml: import qs.Ui`. Owns `/usr/share/omarchy` and the shell plugin directory.
+- `quickshell`: `Globe.qml`, `Panel.qml: import Quickshell`; `Globe.qml`, `MiniGlobe.qml`, `Panel.qml: import Quickshell.Io` (`Process`, `FileView`, `StdioCollector`).
+- `python`: `Panel.qml: python3 <plugin dir>/worldclock-data.py` (the facts process). `worldclock-data.py` imports only `json`, `os`, `sys`, `time`, `urllib`.
+- Left implicit as members of `base`, per Arch convention: `bash` (`Panel.qml`, `Globe.qml: bash -c` wraps every probe), `coreutils` (`Panel.qml`, `Globe.qml: date`, one probe per refresh), `systemd` (`Panel.qml: timedatectl show`, `timedatectl list-timezones`, each with a fallback: `/etc/localtime` for the home zone and `find /usr/share/zoneinfo` for the catalog), `sed` and `grep` (`Panel.qml`: the symlink target of `/etc/localtime` and the zoneinfo catalog filter), `findutils` and `tzdata` (that fallback; `worldclock-data.py: /usr/share/zoneinfo/zone1970.tab`). `omarchy` cannot run without any of them either.
+- Not a dependency: `iso-codes`. Only `tests/currency_check.py` reads `/usr/share/iso-codes/json`, to validate the currency table before a release; the runtime never touches it.
+
+Release tracking: `bin/sync-upstream` follows `omacom/elsewhen` through the `upstream.watch.github` provider, which reads the GitHub Releases feed (drafts and prereleases excluded; a tag with no published Release is not seen) and matches exactly `vX.Y.Z`, the grammar upstream's `scripts/set-version.sh` enforces. A newer release rewrites `pkgver`, resets `pkgrel` to 1, fetches `archive/refs/tags/v{pkgver}.tar.gz` again and rewrites `sha256sums` from the download. The Release's `published_at` is what lets `min_release_age: 24h` hold a fresh release for a day; `release_ring: fast` builds it straight to rc and stable as well as edge.
+
+The watch only moves on a version increase, so the first release's digest is filled in by hand (`curl -fsSL <archive url> | sha256sum`), which is why the recipe carries a placeholder until the `v0.1.0` tag exists. Until upstream has published at least one Release, the watch finds nothing and fails the scheduled `sync-upstream` run for every package in the batch, so this recipe stays a draft until then.
@@ -0,0 +1,11 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "min_release_age": "24h",
+  "upstream": {
+    "watch": {
+      "github": "omacom/elsewhen",
+      "pattern": "v(?P<version>[0-9]+\\.[0-9]+\\.[0-9]+)"
+    }
+  }
+}
@@ -0,0 +1,63 @@
+# Maintainer: Spencer Bull <spencer.bull@hey.com>
+
+pkgname=elsewhen
+pkgver=1.0.0
+pkgrel=2
+pkgdesc='World clock plugin for the Omarchy shell'
+arch=('any')
+url='https://github.com/omacom/elsewhen'
+license=('MIT')
+
+# What the plugin needs to load and run. It also shells out to bash, date
+# (coreutils) and timedatectl (systemd) and reads /usr/share/zoneinfo
+# (tzdata); those are members of the base group and stay implicit, per Arch
+# convention. The citations for each entry are in .omarchy/README.md.
+depends=(
+  'omarchy'
+  'python'
+  'quickshell'
+)
+
+options=('!debug')
+
+source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
+sha256sums=('3124f0c0a19ebc1b158bcf04151cddd6c733ceeead88052186b6a54c46bee263')
+
+package() {
+  # Install alongside the bundled plugins in the shell's plugin directory.
+  local plugin="$pkgdir/usr/share/omarchy/shell/plugins/omacom.elsewhen"
+  cd "$srcdir/$pkgname-$pkgver" || return 1
+
+  # The shell loads the entry point each manifest declares. A tree without
+  # either would install cleanly and never load, so fail the build instead of
+  # shipping it.
+  [[ -f manifest.json ]] || {
+    echo "release tree is missing manifest.json" >&2
+    return 1
+  }
+  grep -Eq '"id"[[:space:]]*:[[:space:]]*"omacom\.elsewhen"' manifest.json || {
+    echo "manifest.json does not declare the plugin id omacom.elsewhen" >&2
+    return 1
+  }
+  grep -Eq '"barWidget"[[:space:]]*:[[:space:]]*"Panel\.qml"' manifest.json || {
+    echo "manifest.json does not name Panel.qml as the bar widget entry point" >&2
+    return 1
+  }
+  [[ -f Panel.qml ]] || {
+    echo "release tree is missing the entry point Panel.qml" >&2
+    return 1
+  }
+
+  # An explicit allow-list of runtime files, so tests/, .github/ and the rest
+  # of the repository never reach the package. Directories end up 0755 and
+  # every file 0644: worldclock-data.py runs as `python3 <path>` and needs no
+  # execute bit. An unmatched glob is left literal and fails install, which
+  # is the right outcome for a release tree missing its QML or JS.
+  local file
+  for file in manifest.json cities.json world.json worldclock-data.py *.qml *.js; do
+    install -Dm644 "$file" "$plugin/$file"
+  done
+
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
+}
@@ -1,16 +1,10 @@
 #!/bin/bash
-# Flea publishes signed source tags but no release artifacts or checksum manifest.
-# Check the small GitHub source tarball only when a newer stable release exists,
-# validate its expected root, then report its hash alongside the fixed hashes of
-# the four upstream security patches carried until a release includes them.
+# Verify Flea's published source archive against its checksum manifest when a
+# newer stable release exists, then check its root and required security fixes.
 set -euo pipefail

 REPO='thisisgm/flea'
 RELEASES_URL="https://api.github.com/repos/$REPO/releases?per_page=100"
-PATCH_2BD7CC2='c610a9f44294b67341940203943c9c567003b65cc436d6013cd36754379183d8'
-PATCH_27D19CA='e457ef17e26f70057b1184eeb938fccc5906f48a7c77f1df573d55d13a845425'
-PATCH_23290CE='f8381456a3b5f39d341cc6610bf27beb8354892b17a1c8c6d7882db4e40824c3'
-PATCH_B4B7EE4='46bdbe43f135a052c893b1987f8b0928736445616a84b0c65d2181ee74b21b25'

 current=$(awk -F= '/^pkgver=/ { print $2; exit }' PKGBUILD)
 releases=$(curl -fsSL "$RELEASES_URL")
@@ -58,7 +52,20 @@ fi

 tarball=$(mktemp)
 trap 'rm -f "$tarball"' EXIT
-curl -fsSL -o "$tarball" "https://github.com/$REPO/archive/refs/tags/$best_tag.tar.gz"
+release_url="https://github.com/$REPO/releases/download/$best_tag"
+asset="flea-$best_tag.tar.gz"
+checksums=$(curl -fsSL "$release_url/SHASUMS256.txt")
+expected_sum=$(awk -v asset="$asset" '$2 == asset { print $1 }' <<<"$checksums")
+if [[ ! $expected_sum =~ ^[0-9a-f]{64}$ ]]; then
+  printf 'Release %s has no unique SHA-256 checksum for %s\n' "$best_tag" "$asset" >&2
+  exit 1
+fi
+curl -fsSL -o "$tarball" "$release_url/$asset"
+source_sum=$(sha256sum "$tarball" | cut -d' ' -f1)
+if [[ $source_sum != "$expected_sum" ]]; then
+  printf 'Release %s source archive does not match its checksum manifest\n' "$best_tag" >&2
+  exit 1
+fi

 expected_root="flea-$best_version"
 served_roots=$(tar -tzf "$tarball" | cut -d/ -f1 | sort -u)
@@ -76,7 +83,16 @@ mediaprobe_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/mediaprobe.rs")
 metareq_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/metareq.rs")
 sharelink_qml=$(tar -xOzf "$tarball" "$expected_root/ui/ShareLink.qml")
 copyfile_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/copyfile.rs")
+regfile_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/regfile.rs")

+# Every check below pins a literal line except the O_NOFOLLOW one. That check
+# guards a property -- the copy opens its source with O_NOFOLLOW, so a symlink
+# swapped in cannot redirect the read -- and pinning the exact call expression
+# made it assert the spelling instead. v0.3.0 moved the first argument from
+# `src` to `src.at` when directory-relative opens landed, kept O_NOFOLLOW, and
+# hardened symlink handling further; the literal still refused it. Match the
+# call and the flag together so a rename cannot read as a removed fix, while
+# dropping O_NOFOLLOW still fails.
 if ! grep -Fq 'a.push("--".to_string());' <<<"$archive_rs" ||
  ! grep -Fq 'let input = std::fs::canonicalize(input)' <<<"$archiveops_rs" ||
  ! grep -Fq 'if op != "compress" && op != "extract"' <<<"$run_rs$archivereq_rs" ||
@@ -84,7 +100,8 @@ if ! grep -Fq 'a.push("--".to_string());' <<<"$archive_rs" ||
  ! grep -Fq 'if !sandbox::available()' <<<"$mediaprobe_rs" ||
  ! grep -Fq 'if !sandbox::available()' <<<"$metareq_rs" ||
  ! grep -Fq 'copyToClipboard.command = ["wl-copy", url]' <<<"$sharelink_qml" ||
-  ! grep -Fq '.custom_flags(O_NOFOLLOW)' <<<"$copyfile_rs"; then
+  ! grep -Eq 'open_if_regular\(.*O_NOFOLLOW' <<<"$copyfile_rs" ||
+  ! grep -Fq '.custom_flags(O_NONBLOCK | extra_flags)' <<<"$regfile_rs"; then
  printf 'Release %s does not contain every required upstream security fix\n' "$best_tag" >&2
  exit 1
 fi
@@ -92,9 +109,5 @@ fi
 jq -n \
  --arg pkgver "$best_version" \
  --arg published_at "$best_published_at" \
-  --arg source "$(sha256sum "$tarball" | cut -d' ' -f1)" \
-  --arg patch_2bd7cc2 "$PATCH_2BD7CC2" \
-  --arg patch_27d19ca "$PATCH_27D19CA" \
-  --arg patch_23290ce "$PATCH_23290CE" \
-  --arg patch_b4b7ee4 "$PATCH_B4B7EE4" \
-  '{pkgver: $pkgver, published_at: $published_at, sha256sums: {any: [$source, $patch_2bd7cc2, $patch_27d19ca, $patch_23290ce, $patch_b4b7ee4]}}'
+  --arg source "$source_sum" \
+  '{pkgver: $pkgver, published_at: $published_at, sha256sums: {any: [$source]}}'
@@ -1,25 +1,40 @@
 # Maintainer: GM <gianmarcomorales@icloud.com>

 pkgname=flea
-pkgver=0.1.3
-pkgrel=1
+pkgver=0.3.1
+pkgrel=2
 pkgdesc='Fast, keyboard-first file manager for Omarchy'
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url='https://github.com/thisisgm/flea'
 license=('MIT')

 depends=(
  'bubblewrap'
+  'expect'
  'gcc-libs'
  'glib2'
  'glibc'
+  'gvfs'
+  'gvfs-afc'
+  'gvfs-dnssd'
+  'gvfs-gphoto2'
+  'gvfs-mtp'
+  'gvfs-nfs'
+  'gvfs-smb'
  'hicolor-icon-theme'
+  'kimageformats'
+  'libheif'
  'omarchy'
+  'python'
+  'python-gobject'
  'quickshell'
  'qt6-multimedia'
  'qt6-webengine'
  'shared-mime-info'
+  'usbmuxd'
  'util-linux'
+  'wl-clipboard'
+  'xdg-terminal-exec'
  'xdg-utils'
 )
 makedepends=('cargo')
@@ -30,74 +45,14 @@ optdepends=(
  'imagemagick: image conversion'
  'libarchive: archive listing and extraction'
  'tailscale: Taildrop sharing'
-  'wl-clipboard: copy Dropbox share links to the clipboard'
 )
 conflicts=('flea-git')
 options=('!debug')

-_security_patches=(
-  '2bd7cc207c110ae3b3ea61a4d4e42336f1815111'
-  '27d19ca4a38ef4a0a920fb78441ce662a0101327'
-  '23290ce1917b0d7f0392dd09d04bf2a7504ec93a'
-  'b4b7ee47244b52457eec2874e21a8656d8ace647'
-)
 source=(
-  "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
-  "security-2bd7cc2.patch::$url/commit/${_security_patches[0]}.patch"
-  "security-27d19ca.patch::$url/commit/${_security_patches[1]}.patch"
-  "security-23290ce.patch::$url/commit/${_security_patches[2]}.patch"
-  "security-b4b7ee4.patch::$url/commit/${_security_patches[3]}.patch"
+  "$url/releases/download/v$pkgver/$pkgname-v$pkgver.tar.gz"
 )
-sha256sums=(
-  '3599ab76253c444dea027f1ebe85b32612d9a174e60eb8aca33ee21d9e2d6973'
-  'c610a9f44294b67341940203943c9c567003b65cc436d6013cd36754379183d8'
-  'e457ef17e26f70057b1184eeb938fccc5906f48a7c77f1df573d55d13a845425'
-  'f8381456a3b5f39d341cc6610bf27beb8354892b17a1c8c6d7882db4e40824c3'
-  '46bdbe43f135a052c893b1987f8b0928736445616a84b0c65d2181ee74b21b25'
-)
-
-prepare() {
-  cd "$pkgname-$pkgver"
-
-  security_patch_present() {
-    case "$1" in
-      2bd7cc207c110ae3b3ea61a4d4e42336f1815111)
-        grep -Fq 'a.push("--".to_string());' src/backend/archive.rs &&
-          grep -Fq 'let input = std::fs::canonicalize(input)' src/backend/archiveops.rs &&
-          grep -Fq 'if op != "compress" && op != "extract"' \
-            src/backend/run.rs src/backend/archivereq.rs
-        ;;
-      27d19ca4a38ef4a0a920fb78441ce662a0101327)
-        grep -Fq 'the sandbox is unavailable: bwrap or prlimit is not on PATH' src/backend/archivework.rs &&
-          grep -Fq 'if !sandbox::available()' src/backend/mediaprobe.rs &&
-          grep -Fq 'if !sandbox::available()' src/backend/metareq.rs
-        ;;
-      23290ce1917b0d7f0392dd09d04bf2a7504ec93a)
-        grep -Fq 'copyToClipboard.command = ["wl-copy", url]' ui/ShareLink.qml
-        ;;
-      b4b7ee47244b52457eec2874e21a8656d8ace647)
-        grep -Fq '.custom_flags(O_NOFOLLOW)' src/backend/copyfile.rs
-        ;;
-      *)
-        return 1
-        ;;
-    esac
-  }
-
-  local commit patch_file
-  for commit in "${_security_patches[@]}"; do
-    patch_file="$srcdir/security-${commit:0:7}.patch"
-
-    if patch --batch --forward --dry-run -Np1 -i "$patch_file" >/dev/null 2>&1; then
-      patch --batch --forward -Np1 -i "$patch_file"
-    elif security_patch_present "$commit"; then
-      printf 'Security patch %s is already present upstream\n' "$commit"
-    else
-      printf 'Security patch %s no longer applies and is not present upstream\n' "$commit" >&2
-      return 1
-    fi
-  done
-}
+sha256sums=('b146ac3f5025da987eae623c4392c44ce69a6a7275a8df3ec1a84563920a4dd2')

 build() {
  cd "$pkgname-$pkgver"
@@ -109,7 +64,13 @@ build() {
 check() {
  cd "$pkgname-$pkgver"

-  export CARGO_TARGET_DIR=target
+  # Upstream's release profile uses fat LTO, whose final link runs on one
+  # thread. build() keeps it for the shipped binary; the test harness is a
+  # throwaway second compile, so build it in parallel in its own target
+  # directory.
+  export CARGO_TARGET_DIR=target-check
+  export CARGO_PROFILE_RELEASE_LTO=thin
+  export CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16

  local -a test_args=()
  if ! /usr/bin/prlimit --cpu=30 --as=1073741824 \
@@ -120,6 +81,8 @@ check() {
    --proc /proc --dev /dev --tmpfs /tmp /usr/bin/true >/dev/null 2>&1; then
    printf 'Skipping sandbox integration tests: this builder cannot create an unprivileged namespace\n'
    test_args+=(
+      --skip backend::archiveops::tests::a_silent_failure_names_the_operation_that_was_running
+      --skip tui::job::tests::preview_worker_reads_held_source_in_readonly_sandbox
      --skip backend::archiveops::tests::a_tool_that_exits_zero_writing_nothing_is_caught_by_the_predicate
      --skip backend::archiveops::tests::an_empty_archive_extracts_to_an_empty_directory_and_that_is_success
      --skip backend::archiveops::tests::only_the_archive_root_extracts_to_nothing_while_nested_directories_do_not
@@ -141,7 +104,65 @@ check() {
    )
  fi

-  cargo test --frozen --release -- "${test_args[@]}"
+  # Recovery-lock tests are unreliable when run concurrently with other suites.
+  # These fixtures require O_TMPFILE, which the builder's /tmp filesystem may
+  # not provide. Keep executable fixtures in the remaining suites on the normal
+  # temp root (/dev/shm is noexec). Note that /dev/shm does NOT buy finer
+  # timestamps -- see the skip below.
+  # shelfundo::tests::undo_refuses_to_walk_a_stranger_back deletes a file,
+  # creates another under the same name, and expects undo to tell them
+  # apart by (dev, ino, kind). ext4 hands the freed inode number straight
+  # back to the next create, so on the builder's /tmp the stranger is
+  # identical and undo walks it back. tmpfs allocates inode numbers from a
+  # counter and never reuses one, which is what the test assumes.
+  local -a filesystem_tests=(
+    backend::menu_actions::tests::
+    backend::menudelete::tests::
+    backend::redo::tests::
+    backend::trashbrowse::tests::
+    backend::trashdelete::
+    backend::trashmanifest::tests::
+    shelfundo::tests::
+  )
+  # redo_refuses_changed_sources_and_destination_collisions writes a file and
+  # then immediately asks redo to notice the edit. flea decides "changed" from
+  # ctime alone -- src/backend/undo.rs records (ctime, ctime_nsec) as the whole
+  # identity -- and this kernel stamps ctime from the coarse clock, so two
+  # writes microseconds apart share a timestamp and the guard sees no change.
+  # Measured on this builder: 196/200 back-to-back write pairs on /dev/shm and
+  # 192/200 on the root filesystem produced an identical ctime. The assertion
+  # therefore fails on any builder fast enough to stay inside one granule, and
+  # moving the suite to tmpfs does not help. Both halves are upstream bugs --
+  # the test assumes a resolution the kernel never promised, and the identity it
+  # exercises cannot see a same-granule edit -- so skip it rather than paper
+  # over it by disabling the whole package.
+  local -a racy_ctime_tests=(
+    --skip backend::redo::tests::redo_refuses_changed_sources_and_destination_collisions
+  )
+
+  # These three expect spawning a missing or failing program to be reported
+  # as such. aarch64 builds run under QEMU user-mode emulation, where
+  # glibc's posix_spawn cannot see the child's failed execve: the spawn
+  # "succeeds" with exit 127, and the timing test's child never sleeps.
+  # Passes natively.
+  if [[ $CARCH == aarch64 ]]; then
+    test_args+=(
+      --skip backend::child::tests::a_child_is_noticed_when_it_exits_rather_than_at_the_next_poll_boundary
+      --skip backend::child::tests::a_child_that_never_started_is_told_apart_from_one_that_ran_and_failed
+      --skip backend::menu_registry::tests::unavailable_failed_and_oversized_queries_are_named_errors
+    )
+  fi
+
+  local test_tmp test_status=0 suite
+  test_tmp=$(mktemp -d /dev/shm/flea-tests.XXXXXXXX) || return 1
+  TMPDIR="$test_tmp" cargo test --frozen --release -- \
+    --test-threads=1 "${filesystem_tests[@]}" "${racy_ctime_tests[@]}" || test_status=$?
+  rm -rf -- "$test_tmp"
+  (( test_status == 0 )) || return "$test_status"
+  for suite in "${filesystem_tests[@]}"; do
+    test_args+=(--skip "$suite")
+  done
+  cargo test --frozen --release -- --test-threads=1 "${test_args[@]}"
  ./tests/js.sh
  ./tests/keymap-gen.sh
 }
@@ -150,6 +171,15 @@ package() {
  cd "$pkgname-$pkgver"

  install -Dm755 target/release/flea "$pkgdir/usr/bin/flea"
+  install -Dm755 tools/flea-gio-auth "$pkgdir/usr/lib/flea/flea-gio-auth"
+  install -Dm755 tools/flea-portal "$pkgdir/usr/lib/flea/flea-portal"
+  install -Dm644 packaging/flea.portal \
+    "$pkgdir/usr/share/xdg-desktop-portal/portals/flea.portal"
+  install -Dm644 packaging/org.freedesktop.impl.portal.desktop.flea.service \
+    "$pkgdir/usr/share/dbus-1/services/org.freedesktop.impl.portal.desktop.flea.service"
+  install -Dm755 tools/flea-filemanager1 "$pkgdir/usr/lib/flea/flea-filemanager1"
+  install -Dm644 packaging/com.thisisgm.flea.FileManager1.service \
+    "$pkgdir/usr/share/dbus-1/services/com.thisisgm.flea.FileManager1.service"
  install -Dm644 packaging/com.thisisgm.flea.desktop \
    "$pkgdir/usr/share/applications/com.thisisgm.flea.desktop"
  install -Dm644 packaging/com.thisisgm.flea.svg \
@@ -158,6 +188,9 @@ package() {

  install -Dm644 ui/qmldir ui/*.qml -t "$pkgdir/usr/share/flea/ui"
  install -Dm644 ui/js/*.js -t "$pkgdir/usr/share/flea/ui/js"
+  # Flea's Shelf setting installs this plugin into the user's plugin directory.
+  install -Dm644 shelf/manifest.json shelf/README.md shelf/*.qml shelf/*.js \
+    -t "$pkgdir/usr/share/flea/shelf"
  ln -s /usr/share/omarchy/shell/Commons "$pkgdir/usr/share/flea/ui/Commons"
  ln -s /usr/share/omarchy/shell/Ui "$pkgdir/usr/share/flea/ui/Ui"
 }
@@ -0,0 +1,10 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "upstream": {
+    "watch": {
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)",
+      "git_tags": "https://github.com/ghostty-org/ghostty.git"
+    }
+  }
+}
@@ -0,0 +1,123 @@
+# Ghostty for x86_64 and aarch64, built from the upstream release source tarball.
+#
+# Ghostty 1.3.x requires Zig 0.15.2 exactly. Distribution toolchains can move
+# ahead, so use the verified upstream toolchain for each architecture only at
+# package-build time rather than publishing a second Zig package.
+
+pkgbase=ghostty
+pkgname=(ghostty ghostty-shell-integration ghostty-terminfo ghostty-nautilus)
+pkgver=1.3.1
+pkgrel=3
+pkgdesc='Fast, native, feature-rich terminal emulator pushing modern features'
+arch=(x86_64 aarch64)
+url='https://github.com/ghostty-org/ghostty'
+license=(MIT)
+depends=(
+  bzip2
+  fontconfig
+  freetype2
+  glib2
+  glibc
+  gtk4
+  gtk4-layer-shell
+  harfbuzz
+  libadwaita
+  libpng
+  oniguruma
+  pixman
+  wayland
+  zlib
+)
+makedepends=(
+  blueprint-compiler
+  curl
+  gettext
+  pkgconf
+)
+_zigver=0.15.2
+_archive="$pkgbase-$pkgver"
+source=(
+  "https://release.files.ghostty.org/$pkgver/$_archive.tar.gz"
+  'build-data-llvm.patch'
+)
+sha256sums=(
+  '3349d25600ffbda281197a18314f7d18791969cffe9474f0ff16a45a9ebfccdb'
+  'd9f5781b748651fa1ff7b919f4a79cd8570118faefe2848f64f02ea4220257ba'
+)
+source_x86_64=("https://ziglang.org/download/$_zigver/zig-x86_64-linux-$_zigver.tar.xz")
+sha256sums_x86_64=('02aa270f183da276e5b5920b1dac44a63f1a49e55050ebde3aecc9eb82f93239')
+source_aarch64=("https://ziglang.org/download/$_zigver/zig-aarch64-linux-$_zigver.tar.xz")
+sha256sums_aarch64=('958ed7d1e00d0ea76590d27666efbf7a932281b3d7ba0c6b01b0ff26498f667f')
+
+prepare() {
+  cd "$_archive"
+  # Zig's native x86 linker cannot read .sframe relocations in Arch's crt1.o.
+  # Use bundled LLVM for the build-data helper, as the main executable does.
+  if [[ "$CARCH" == x86_64 ]]; then
+    patch -Np1 -i "$srcdir/build-data-llvm.patch"
+  fi
+  PATH="$srcdir/zig-$CARCH-linux-$_zigver:$PATH" \
+    ZIG_GLOBAL_CACHE_DIR="$srcdir/zig-global-cache" \
+    ./nix/build-support/fetch-zig-cache.sh
+}
+
+build() {
+  cd "$_archive"
+  # A '-' suffix is a SemVer prerelease and selects Ghostty's tip channel.
+  # Keep the package revision as build metadata on the stable release.
+  PATH="$srcdir/zig-$CARCH-linux-$_zigver:$PATH" \
+    DESTDIR=build \
+    zig build \
+      --prefix /usr \
+      --system "$srcdir/zig-global-cache/p" \
+      -Doptimize=ReleaseFast \
+      -Dgtk-x11=true \
+      -Dcpu=baseline \
+      -Dpie=true \
+      -Demit-docs=false \
+      -Dversion-string="$pkgver+omarchy.$pkgrel" \
+      --build-id=sha1
+}
+
+package_ghostty() {
+  depends+=(ghostty-shell-integration ghostty-terminfo)
+  optdepends=('ghostty-nautilus: Open in Ghostty context menu in GNOME Files')
+
+  cd "$_archive"
+  cp -a build/* "$pkgdir/"
+  install -Dm0644 LICENSE "$pkgdir/usr/share/licenses/ghostty/LICENSE"
+  rm -r "$pkgdir/usr/share/terminfo" \
+    "$pkgdir/usr/share/ghostty/shell-integration" \
+    "$pkgdir/usr/share/nautilus-python"
+}
+
+package_ghostty-shell-integration() {
+  pkgdesc='Shell integration scripts for Ghostty'
+  depends=()
+
+  cd "$_archive"
+  install -d "$pkgdir/usr/share/ghostty/shell-integration"
+  cp -a build/usr/share/ghostty/shell-integration/. \
+    "$pkgdir/usr/share/ghostty/shell-integration/"
+  install -Dm0644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}
+
+package_ghostty-terminfo() {
+  pkgdesc='Terminfo for Ghostty'
+  depends=()
+
+  cd "$_archive"
+  install -d "$pkgdir/usr/share/terminfo"
+  cp -a build/usr/share/terminfo/x "$pkgdir/usr/share/terminfo/"
+  install -Dm0644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}
+
+package_ghostty-nautilus() {
+  pkgdesc='Open in Ghostty for GNOME Files'
+  depends=(ghostty nautilus-python)
+  license=(GPL-2.0-or-later)
+
+  cd "$_archive"
+  install -d "$pkgdir/usr/share/nautilus-python"
+  cp -a build/usr/share/nautilus-python/. "$pkgdir/usr/share/nautilus-python/"
+}
@@ -0,0 +1,10 @@
+--- a/src/build/GhosttyResources.zig
+++ b/src/build/GhosttyResources.zig
+@@ -15,6 +15,7 @@
+     // This is the exe used to generate some build data.
+     const build_data_exe = b.addExecutable(.{
+         .name = "ghostty-build-data",
+        .use_llvm = true,
+         .root_module = b.createModule(.{
+             .root_source_file = b.path("src/main_build_data.zig"),
+             .target = b.graph.host,
@@ -6,7 +6,7 @@ _npmmodule=@github/copilot
 pkgname=github-copilot-cli
 _pkgexec=copilot

-pkgver=1.0.83
+pkgver=1.0.86
 pkgrel=1

 pkgdesc="GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal."
@@ -31,8 +31,8 @@ source=("https://registry.npmjs.org/${_npmmodule}/-/copilot-${pkgver}.tgz"
 noextract=("copilot-${pkgver}.tgz")

 sha256sums=(
-  '135506fc2b13163ab55dbf76a06e2fbcbad04ecac76b4e9c6659f0ba309e6a86'
-  '0c0064a10effac8adf9ad97338bafaa0d7d7d5bf191cc1c0384e05ff4366d36c'
+  '4c6433345f08199e96dcf8db1c3e46a337dfab96cea32132d6127ffcd63a6200'
+  'b94d2aab574cf3e0c8d950e72430186cdd918261a1376146de971fa90ba0a672'
 )

 # Document: https://wiki.archlinux.org/title/Node.js_package_guidelines
@@ -0,0 +1,3 @@
+{
+  "source": "local"
+}
@@ -0,0 +1,53 @@
+# Maintainer: David Heinemeier Hansson <david@hey.com>
+
+pkgname=gliff
+pkgver=0.1.0
+pkgrel=1
+pkgdesc="Hyprland remote desktop over SSH (Vulkan Video, 4:4:4)"
+arch=('x86_64')
+url="https://github.com/kevinmcconnell/gliff"
+license=('MIT')
+depends=('gcc-libs' 'glibc' 'wayland' 'libxkbcommon' 'libdrm' 'mesa'
+         'gtk4>=4.14' 'libadwaita>=1.5' 'vulkan-icd-loader' 'openssh')
+makedepends=('cargo' 'pkgconf')
+optdepends=('vulkan-radeon: Vulkan Video on AMD'
+            'vulkan-intel: Vulkan Video on Intel'
+            'vulkan-tools: vulkaninfo for debugging'
+            'vulkan-validation-layers: driver call validation for development')
+options=('!debug')
+
+# Upstream only publishes a rolling prerelease; pin its source for reproducible builds.
+_commit=2edbfba52780c7ace15dbb05ca92177f493d4bc9
+source=("$pkgname-$_commit.tar.gz::$url/archive/$_commit.tar.gz")
+sha256sums=('2d75961085a72fb8e34149de63e312a7336daa70fd6e157e30c2cd08c14eb1c7')
+
+prepare() {
+  cd "$pkgname-$_commit"
+
+  cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
+}
+
+build() {
+  cd "$pkgname-$_commit"
+
+  export CARGO_TARGET_DIR=target
+  cargo build --frozen --release
+}
+
+check() {
+  cd "$pkgname-$_commit"
+
+  export CARGO_TARGET_DIR=target
+  cargo test --frozen --release --workspace
+}
+
+package() {
+  cd "$pkgname-$_commit"
+
+  install -Dm755 target/release/gliff "$pkgdir/usr/bin/gliff"
+  install -Dm755 target/release/gliff-server "$pkgdir/usr/bin/gliff-server"
+  install -Dm755 target/release/gliff-probe "$pkgdir/usr/bin/gliff-probe"
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
+  install -Dm644 docs/hardware-quirks.md "$pkgdir/usr/share/doc/$pkgname/hardware-quirks.md"
+}
@@ -1,5 +1,8 @@
 {
-  "source": "aur",
+  "source": "local",
  "sync": false,
-  "upstream_commit": "05eb78fca06b482affda28b26223cbf249d4bbcd"
+  "origin": {
+    "aur": "grok-bot",
+    "commit": "05eb78fca06b482affda28b26223cbf249d4bbcd"
+  }
 }
@@ -2,14 +2,15 @@
 # Contributor: Omarchy

 pkgname=grok-bot
-pkgver=0.29.0
+pkgver=0.47.0
 pkgrel=1
-_commit=f0e5bfcee649ea84c0c61369cf896cd146d72136
+_commit=c1e7d7a46549956d25f53e9c0b9f59666e03aa3a
 pkgdesc='Grok Bot desktop agent'
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url='https://x.ai/bot'
 license=('custom')
 depends=(
+  'alsa-lib'
  'at-spi2-core'
  'gtk3'
  'hicolor-icon-theme'
@@ -25,32 +26,36 @@ optdepends=('libappindicator-gtk3: tray support')
 provides=('sand')
 conflicts=('sand')
 options=('!strip' '!debug')
+install=grok-bot.install
+
+_deb_x86_64="grok-bot_${pkgver}_amd64.deb"
+_deb_aarch64="grok-bot_${pkgver}_arm64.deb"
 source=(
-  "${pkgname}_${pkgver}.deb::https://downloads.cursor.com/grokbot/stable/${_commit}/linux/x64/Grok_Bot_${pkgver}.deb"
  'grok-bot.sh'
  'grok-bot.desktop'
 )
-sha256sums=('d223b5830282aef11d5c46d8f4d1edd239bf992e336405cbd288d4476b9233d4'
-            '6dfa6c305941afa6cbaefbeaae06d05ab5a88f31630005d25a819a160c20c7a3'
-            '856056c9ca63dda5d01158ce8fb6a9a7cbb3f67c13a92b573cd196d3e50f26e7')
-noextract=("${pkgname}_${pkgver}.deb")
+source_x86_64=(
+  "${_deb_x86_64}::https://downloads.cursor.com/grokbot/stable/${_commit}/linux/x64/${_deb_x86_64}"
+)
+source_aarch64=(
+  "${_deb_aarch64}::https://downloads.cursor.com/grokbot/stable/${_commit}/linux/arm64/${_deb_aarch64}"
+)
+sha256sums=('6dfa6c305941afa6cbaefbeaae06d05ab5a88f31630005d25a819a160c20c7a3'
+            '3e2a2461ea58d17ac1777616be9ba660f7cb9ceefa9292016e36c55758bf78dd')
+sha256sums_x86_64=('11ca0f51a535b97af51a352adf9c0f9ecd2e1b0430a69ae9451b688a7a065808')
+sha256sums_aarch64=('836f8d19d3826c6573c31ac45c7a9b797abc73381ae0d2b1e7a8dae5410e7e46')
+noextract=("${_deb_x86_64}" "${_deb_aarch64}")

 package() {
-  bsdtar -xOf "${srcdir}/${pkgname}_${pkgver}.deb" data.tar.xz |
+  local deb_var="_deb_${CARCH}"
+  local deb="${!deb_var}"
+
+  bsdtar -xOf "${srcdir}/${deb}" data.tar.xz |
    bsdtar -x -C "${pkgdir}" -f -

  rm -rf "${pkgdir}/usr/share/doc" \
-    "${pkgdir}/usr/share/applications/sand.desktop"
-
-  local icon1024="${pkgdir}/usr/share/icons/hicolor/1024x1024/apps"
-  if [[ -f "${icon1024}/sand.png" && ! -f "${icon1024}/grok-bot.png" ]]; then
-    install -Dm644 "${icon1024}/sand.png" "${icon1024}/grok-bot.png"
-  fi
-  rm -f "${icon1024}/sand.png"
-  if [[ -f "${icon1024}/grok-bot.png" ]]; then
-    install -Dm644 "${icon1024}/grok-bot.png" \
-      "${pkgdir}/usr/share/icons/hicolor/512x512/apps/grok-bot.png"
-  fi
+         "${pkgdir}/usr/share/applications/sand.desktop" \
+         "${pkgdir}/usr/share/applications/grok-bot.desktop"

  # Always install our Wayland wrapper; do not keep any /usr/bin from the .deb.
  rm -f "${pkgdir}/usr/bin/grok-bot" "${pkgdir}/usr/bin/sand"
@@ -64,9 +69,10 @@ package() {
  install -Dm644 "${pkgdir}/opt/Grok Bot/LICENSES.chromium.html" \
    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"

-  if ! { [[ -L /proc/self/ns/user ]] && unshare --user true; }; then
-    chmod 4755 "${pkgdir}/opt/Grok Bot/chrome-sandbox"
-  else
-    chmod 0755 "${pkgdir}/opt/Grok Bot/chrome-sandbox"
-  fi
+  # Ship chrome-sandbox without setuid. Upstream's build-time userns probe
+  # would measure the CI container, not the user's machine, and a setuid
+  # helper could not exec from "/opt/Grok Bot/" anyway (electron#44414).
+  # grok-bot.install tells users on kernels without unprivileged user
+  # namespaces how to run without the sandbox.
+  chmod 0755 "${pkgdir}/opt/Grok Bot/chrome-sandbox"
 }
@@ -8,6 +8,6 @@ Terminal=false
 Type=Application
 Categories=Development;
 MimeType=x-scheme-handler/grokbot;x-scheme-handler/sand;
-StartupWMClass=Grok Bot
+StartupWMClass=grok-bot
 StartupNotify=true
 Keywords=Grok;AI;Agent;
@@ -0,0 +1,41 @@
+# Electron's renderer sandbox needs unprivileged user namespaces, or else a
+# setuid-root chrome-sandbox. Upstream omarchy-pkgs probes for user namespaces
+# inside package() and sets 4755 when they are missing. That is wrong twice
+# for this repo: the build runs in a CI container where the probe fails, so
+# every user would get the setuid helper; and the helper lives under
+# "/opt/Grok Bot/", and Electron cannot exec a setuid chrome-sandbox from a
+# path with a space (electron/electron#44414), so 4755 would not even work.
+#
+# The package therefore always ships chrome-sandbox as 0755. This hook only
+# tells the user what to do on a host that lacks unprivileged user namespaces.
+# The probe drops to nobody first: pacman runs hooks as root, and root can
+# unshare a user namespace even where unprivileged users cannot.
+_userns_available() {
+  [[ -L /proc/self/ns/user ]] || return 1
+  if (( EUID == 0 )) && command -v setpriv >/dev/null; then
+    setpriv --reuid=65534 --regid=65534 --clear-groups -- unshare --user true 2>/dev/null
+  else
+    # Already unprivileged (or no setpriv): the direct probe is the real answer.
+    unshare --user true 2>/dev/null
+  fi
+}
+
+_advise() {
+  _userns_available && return 0
+  cat <<'MSG'
+==> Unprivileged user namespaces are unavailable on this kernel, so Grok Bot's
+    renderer sandbox cannot start. A setuid chrome-sandbox is not an option
+    here: Electron cannot exec it from "/opt/Grok Bot/" (electron#44414).
+    To run without the sandbox, add this line to ~/.config/grok-bot-flags.conf:
+
+        --no-sandbox
+MSG
+}
+
+post_install() {
+  _advise
+}
+
+post_upgrade() {
+  _advise
+}
@@ -1,7 +1,7 @@
 # Maintainer: David Heinemeier Hansson <david@hey.com>

 pkgname=herdr
-pkgver=0.8.2
+pkgver=0.9.1
 pkgrel=1
 pkgdesc="Herdr terminal workspace manager for AI coding agents"
 arch=('x86_64' 'aarch64')
@@ -13,13 +13,13 @@ replaces=('omarchy-herdr')
 conflicts=('omarchy-herdr')
 options=('!debug' '!lto')

-_zigver=0.15.2
+_zigver=0.16.0
 source=("herdr-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
 source_x86_64=("zig-x86_64-linux-$_zigver.tar.xz::https://ziglang.org/download/$_zigver/zig-x86_64-linux-$_zigver.tar.xz")
 source_aarch64=("zig-aarch64-linux-$_zigver.tar.xz::https://ziglang.org/download/$_zigver/zig-aarch64-linux-$_zigver.tar.xz")
-sha256sums=('60453051025ee44ebf055d26cdaf665a0accd99a992cddd22c166a26c49cd161')
-sha256sums_x86_64=('02aa270f183da276e5b5920b1dac44a63f1a49e55050ebde3aecc9eb82f93239')
-sha256sums_aarch64=('958ed7d1e00d0ea76590d27666efbf7a932281b3d7ba0c6b01b0ff26498f667f')
+sha256sums=('03403d3ef80dcf2b954dd5d27eb636e6c4f5279d240b48de272b7f53e4b73093')
+sha256sums_x86_64=('70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00')
+sha256sums_aarch64=('ea4b09bfb22ec6f6c6ceac57ab63efb6b46e17ab08d21f69f3a48b38e1534f17')

 prepare() {
  cd "herdr-$pkgver"
@@ -1,4 +1,3 @@
 {
-  "source": "local",
-  "release_ring": "fast"
+  "source": "local"
 }
@@ -4,8 +4,8 @@
 # so the upstream updater can rebuild and relaunch it in place.

 pkgname=hermes-desktop
-pkgver=2026.8.31
-pkgrel=3
+pkgver=2026.9.7
+pkgrel=1
 pkgdesc='Native desktop shell for Hermes Agent'
 arch=('x86_64')
 url='https://github.com/NousResearch/hermes-agent'
@@ -65,7 +65,7 @@ options=('!strip' '!debug')
 # before falling back to `git rev-parse`. That fallback is wrong here: makepkg
 # builds inside this repository, so git ascends out of srcdir and stamps the
 # app with an omarchy-pkgs commit that means nothing upstream.
-_commit=29112bef099274229cadff79cdff7bf7b99c4b77
+_commit=2237be355906fbe6065ce1815711eee52b2d646e

 _srcdir="hermes-agent-${pkgver}"
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
@@ -74,12 +74,12 @@ source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz
        'hermes-desktop.png'
        'runtime.patch'
        'runtime-test.py')
-sha256sums=('78fb3ff707ec1d17044b875ecac8bef28aa39d44242824f6871ca40afe7bf217'
+sha256sums=('907c2a72db1c5dd637ea8eeae97f4cb5b32cef615c17258f6b190924ec5bf688'
            '094d5f3191109a80eea9f23053b78a2e00dbecf90d62d1ca04c8e48866251469'
            '3ef685bfcf366776b025d26c37d32854d8d4aa2023b2bd07c8e08b001ef1e8c4'
            'd60d164e24fdcf6532133b8ea43c77a201e4b9e9dbc396187b58d51d8590ef52'
-            '03b67e26c234c797a6b1d4c9f34a57502dba37f462540e47ce6c88f6ea79302a'
-            '461e1120e7e6779f531c114d9926479e47fab79113d1b4646efea36bc771b3c5')
+            '9d5015d1be762a901f8f64319981ae862e9852fa5cb9a22a2ba1e691f90430a2'
+            '7337a12c71e8091ad5fc2e879e922c9cb1706c65f81b59d6dd70b12123dc7c00')

 build() {
  cd "${srcdir}/${_srcdir}"
@@ -109,10 +109,10 @@ package() {

  install -Dm644 "${srcdir}/${_srcdir}/scripts/install.sh" \
    "${pkgdir}/usr/share/${pkgname}/install.sh"
-  # Let the release's first updater relaunch with the user-namespace sandbox.
+  # Omarchy's installer still requires this patch. The release includes the
+  # fix, so the installer recognizes it through its reverse-apply check.
  install -Dm644 "${srcdir}/runtime.patch" "${pkgdir}/usr/share/${pkgname}/runtime.patch"

-
  install -Dm644 "${srcdir}/hermes-desktop.desktop" \
    "${pkgdir}/usr/share/applications/${pkgname}.desktop"

@@ -14,7 +14,9 @@ with tempfile.TemporaryDirectory(prefix="hermes-runtime-check-") as temporary:
    destination = root / "scripts/desktop-update/posix.sh"
    destination.parent.mkdir(parents=True)
    shutil.copyfile(source / "scripts/desktop-update/posix.sh", destination)
-    subprocess.run(["git", "apply", str(patch_file.resolve())], cwd=root, check=True)
+    # Omarchy's installer requires the patch and accepts an upstreamed fix
+    # through its reverse check. Verify that path without changing the release.
+    subprocess.run(["git", "apply", "--reverse", "--check", str(patch_file.resolve())], cwd=root, check=True)

    home = root / "home with spaces"
    runtime = home / ".hermes/hermes-agent"
@@ -42,13 +44,14 @@ Path(os.environ["TEST_OUTPUT"]).write_text(json.dumps({
    module = runtime / "hermes_cli"
    module.mkdir()
    (module / "__init__.py").touch()
-    upstream = ast.parse((source / "hermes_cli/main.py").read_text())
+    upstream = ast.parse((source / "hermes_cli/main_desktop.py").read_text())
    option_parser = next(node for node in upstream.body
                        if isinstance(node, ast.FunctionDef) and node.name == "_desktop_launch_options")
-    stores = next(node for node in upstream.body if isinstance(node, ast.Assign)
-                  and any(isinstance(target, ast.Name) and target.id == "_LINUX_PASSWORD_STORES"
-                          for target in node.targets))
-    helper = "import os, shlex\n" + ast.unparse(stores) + "\n" + ast.unparse(option_parser) + "\n"
+    constants = [node for node in upstream.body if isinstance(node, ast.Assign)
+                 and any(isinstance(target, ast.Name)
+                         and target.id in ("_LINUX_PASSWORD_STORES", "_GPU_FLAG_WORDS")
+                         for target in node.targets)]
+    helper = "import os, shlex\n" + "\n".join(map(ast.unparse, constants)) + "\n" + ast.unparse(option_parser) + "\n"
    (module / "main.py").write_text(helper)
    (module / "config.py").write_text('''import json, os
 from pathlib import Path
@@ -1,11 +1,13 @@
 --- a/scripts/desktop-update/posix.sh
 +++ b/scripts/desktop-update/posix.sh
-@@ -317,6 +317,8 @@
+@@ -327,6 +327,10 @@
+   sb="$unpacked/chrome-sandbox"
   if [ ! -e "$sb" ]; then GATE=relaunch; return; fi
   if [ -u "$sb" ] && [ "$(stat -c %u "$sb" 2>/dev/null)" = "0" ]; then GATE=relaunch; return; fi
- 
+  # Namespace sandbox usable => Electron never consults the setuid helper,
+  # so a non-root chrome-sandbox does not block relaunch (mirrors the
+  # _desktop_linux_userns_sandbox_available() probe in hermes_cli/main.py).
 +  if unshare --user --map-root-user true 2>/dev/null; then GATE=relaunch; return; fi
-+
+
   case "${ELECTRON_DISABLE_SANDBOX:-}" in 1|true|TRUE|True) GATE=relaunch; return ;; esac
   [ "$SANDBOX_FALLBACK" -eq 1 ] && { GATE=relaunch; return; }
-   for arg in ${RELAUNCH_ARGS[@]+"${RELAUNCH_ARGS[@]}"}; do
@@ -1,4 +1,13 @@
 {
-  "source": "aur",
-  "upstream_commit": "44b4e963c69541700088a5719855d34f5cf16c85"
+  "source": "local",
+  "upstream": {
+    "watch": {
+      "github": "Heroic-Games-Launcher/HeroicGamesLauncher",
+      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  },
+  "origin": {
+    "aur": "heroic-games-launcher-bin",
+    "commit": "44b4e963c69541700088a5719855d34f5cf16c85"
+  }
 }
@@ -2,16 +2,16 @@
 # Maintainer: CommandMC <kate@commandmc.de>

 pkgname=heroic-games-launcher-bin
-pkgver=2.22.1
+pkgver=2.22.3
 pkgrel=1
 pkgdesc="An Open source Launcher for Epic, Amazon and GOG Games"
 arch=('x86_64')
 url="https://heroicgameslauncher.com/"
 license=('GPL-3.0-only')
-_filename=Heroic-2.22.1-linux-x64.pacman
-source=("https://github.com/Heroic-Games-Launcher/HeroicGamesLauncher/releases/download/v2.22.1/Heroic-2.22.1-linux-x64.pacman")
-noextract=("Heroic-2.22.1-linux-x64.pacman")
-sha256sums=(66ed041a93ac2817b744d3d0985194adfa408c8d35f64d9a8967fa5e2a58f2c1)
+_filename=Heroic-${pkgver}-linux-x64.pacman
+source=("https://github.com/Heroic-Games-Launcher/HeroicGamesLauncher/releases/download/v${pkgver}/${_filename}")
+noextract=("${_filename}")
+sha256sums=('ed17ce083a71dd7e49a89218052ab475edd5a654cedf443853f6baacbb0a00e9')
 options=(!strip)
 depends=(
  which
@@ -27,4 +27,3 @@ package() {
 }

 # vim:set ts=2 sw=2 et: syntax=sh
-
@@ -0,0 +1,3 @@
+{
+  "source": "local"
+}
@@ -0,0 +1,42 @@
+# Maintainer: David Heinemeier Hansson <david@hey.com>
+
+pkgname=hype
+pkgver=0.4.1
+pkgrel=1
+pkgdesc='Simple Markdown presentations with a visual slide editor'
+arch=('x86_64' 'aarch64')
+url='https://github.com/omacom/hype'
+license=('MIT')
+install='hype.install'
+options=('!debug')
+depends=(
+  'ffmpeg'
+  'hicolor-icon-theme'
+  'qt6-base>=6.9'
+  'qt6-declarative>=6.9'
+  'qt6-multimedia>=6.9'
+  'qt6-imageformats'
+  'qt6-svg'
+  'source-highlight'
+  'zlib'
+  'libwebp'
+  'xdg-desktop-portal'
+)
+makedepends=('gcc' 'make')
+source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
+sha256sums=('0724a9d18df7657b50dff21ffe3dec1c107e9191a9e9fd5ad40b56ed9d5d6f51')
+
+build() {
+  cd "$srcdir/$pkgname-$pkgver"
+  ./bin/build
+}
+
+package() {
+  cd "$srcdir/$pkgname-$pkgver"
+
+  install -Dm755 build/hype "$pkgdir/usr/bin/hype"
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 pkgbuild/hype.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/hype.svg"
+  install -Dm644 pkgbuild/hype.desktop "$pkgdir/usr/share/applications/hype.desktop"
+  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
+}
@@ -0,0 +1,12 @@
+post_install() {
+  command -v update-desktop-database >/dev/null 2>&1 && update-desktop-database -q
+  command -v gtk-update-icon-cache >/dev/null 2>&1 && gtk-update-icon-cache -q -t -f usr/share/icons/hicolor
+}
+
+post_upgrade() {
+  post_install
+}
+
+post_remove() {
+  post_install
+}
@@ -2,7 +2,7 @@

 pkgname="hyprland-preview-share-picker"
 pkgver=0.2.1
-pkgrel=1
+pkgrel=2
 pkgdesc="An alternative share picker for hyprland with window and monitor previews"
 arch=(x86_64 aarch64)
 url="https://github.com/WhySoBad/hyprland-preview-share-picker"
@@ -32,14 +32,14 @@ fn main() {
 }
 EOF

-    export RUSTUP_TOOLCHAIN=nightly
+    export RUSTUP_TOOLCHAIN=stable
    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
 }

 build() {
    cd "$pkgname-$pkgver"

-    export RUSTUP_TOOLCHAIN=nightly
+    export RUSTUP_TOOLCHAIN=stable
    export CARGO_TARGET_DIR=target

    cargo build --frozen --release
@@ -1,5 +1,13 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "89c710019789541e4cf972ee847f266534d6a96d"
+  "upstream": {
+    "watch": {
+      "pypi": "hyprshade"
+    }
+  },
+  "origin": {
+    "aur": "hyprshade",
+    "commit": "89c710019789541e4cf972ee847f266534d6a96d"
+  }
 }