feat: add functionality to delete invalid invites and update related components

.github/ISSUE_TEMPLATE/config.yml

@@ -1,7 +1,7 @@
 blank_issues_enabled: false
 contact_links:
   - name: Project Wiki/ 项目文档
-    url: https://github.com/shuaiplus/nodewarden/wiki
+    url: https://nodewarden.app
     about: |
       Please check the documentation for common questions and troubleshooting steps.
       请先查看文档，常见问题和排查步骤可能已经覆盖了你的问题。

.github/scripts/security.cjs

@@ -1,467 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-
-/**
- * Security Report Generator (Node.js)
- * Better, faster, and more maintainable than Bash.
- */
-
-class SecurityReport {
-    constructor() {
-        this.results = {
-            codeql: { status: 'PASS', findings: [], alertCount: 0, rulesCount: 0 },
-            snyk: { status: 'PASS', findings: [], vulnCount: 0 },
-            gitleaks: { status: 'PASS', findings: [], leaksCount: 0 },
-            trivy: { status: 'PASS', findings: [], misconfigCount: 0 },
-            coverage: { actions: 0, js: 0, ts: 0 },
-            artifactUris: []
-        };
-        this.auditTime = new Date().toISOString().replace('T', ' ').substring(0, 19) + ' UTC';
-        this.runId = process.env.GITHUB_RUN_ID || '0';
-        this.repository = process.env.GITHUB_REPOSITORY || 'unknown/repo';
-        this.runUrl = `https://github.com/${this.repository}/actions/runs/${this.runId}`;
-
-        this.locales = {
-            zh: {
-                filename: 'security-report-cn.md',
-                switcher: '[English](security-report.md) | 中文',
-                title: '🛡️ 安全审计与透明度报告',
-                grade: '安全评级',
-                important: '> [!IMPORTANT]\n> 本报告由 **GitHub Actions** 自动生成。为确保数据主权的绝对透明度，所有核心模块的安全扫描结果均实时公开。',
-                auditTime: '📅 审计时间',
-                runId: '📝 运行 ID',
-                env: '🛠️ 环境',
-                dashboard: '📉 实时安全仪表盘',
-                tool: '工具',
-                status: '状态',
-                findings: '发现项',
-                leaks: '泄露',
-                vulns: '漏洞',
-                alerts: '告警',
-                coverageTitle: '🔍 扫描覆盖范围',
-                module: '模块',
-                auditedFiles: '已审计文件',
-                coverage: '覆盖率',
-                detailedFindings: '🔍 详细发现项',
-                gitleaksTitle: '🔑 凭据泄露检查 (Gitleaks)',
-                gitleaksDesc: '`检测代码历史记录中硬编码的 API 密钥、密码或其他敏感令牌。`',
-                gitleaksSafe: '✅ **安全**：未发现硬编码的敏感凭据。',
-                gitleaksScope: '`扫描范围：所有代码更改和 Git 历史记录 (Gitleaks 全量扫描)`',
-                snykTitle: '📦 第三方依赖',
-                snykSafe: '✅ **安全**：在依赖项中未发现已知漏洞。',
-                package: '软件包',
-                severity: '严重程度',
-                description: '描述',
-                fixPlan: '修复方案',
-                codeqlTitle: '💻 代码质量与安全 (CodeQL)',
-                codeqlSummary: '#### 摘要',
-                rulesChecked: '已检查规则',
-                totalAlerts: '告警总数',
-                codeqlSafe: '✅ **安全**：CodeQL 扫描清洁，未检测到问题。',
-                ruleId: '规则 ID',
-                level: '级别',
-                location: '位置',
-                auditedList: '📂 已审计文件列表',
-                guideTitle: '⚠️ 操作指南',
-                guideDesc: '如果您看到 **FAIL** 状态或严重的代码问题：',
-                guideStep1: '1. **开发人员**：使用上方表格中的 **位置** 列找到确切的文件和行号。',
-                guideStep2: '2. **纠正**：遵循为每个规则提供的文档链接以提交修复。',
-                guideStep3: '3. **可追溯性**：完整的原始 `.sarif` 数据已附加到此分支。下载并将其导入您的 IDE（例如 VS Code SARIF 查看器）进行本地分析。',
-                footer: '💡 *由 NodeWarden 安全工作流生成。透明度是我们的承诺。*',
-                auditedIcon: '✅ **已审计**',
-                noFiles: '未检索到文件。',
-                trivyTitle: '🛡️ 容器配置安全 (Trivy)',
-                trivyDesc: '`检测 Dockerfile 和容器配置中的安全风险与最佳实践。`',
-                trivySafe: '✅ **安全**：未发现容器配置缺陷。'
-            },
-            en: {
-                filename: 'security-report.md',
-                switcher: 'English | [中文](security-report-cn.md)',
-                title: '🛡️ Security Audit & Transparency Report',
-                grade: 'Security Grade',
-                important: '> [!IMPORTANT]\n> This report is automatically generated by **GitHub Actions**. To ensure absolute transparency of data sovereignty, all core module security scan results are made public in real-time.',
-                auditTime: '📅 Audit Time',
-                runId: '📝 Run ID',
-                env: '🛠️ Environment',
-                dashboard: '📉 Real-time Security Dashboard',
-                tool: 'Tool',
-                status: 'Status',
-                findings: 'Findings',
-                leaks: 'Leaks',
-                vulns: 'Vulns',
-                alerts: 'Alerts',
-                coverageTitle: '🔍 Scan Coverage',
-                module: 'Module',
-                auditedFiles: 'Audited Files',
-                coverage: 'Coverage',
-                detailedFindings: '🔍 Detailed Findings',
-                gitleaksTitle: '🔑 Credential Leak Check (Gitleaks)',
-                gitleaksDesc: '`This section detects hardcoded API Keys, passwords, or other sensitive tokens in the code history.`',
-                gitleaksSafe: '✅ **SAFE**: No hardcoded sensitive credentials found.',
-                gitleaksScope: '`Scan Scope: All code changes and Git history (Gitleaks Full Scan)`',
-                snykTitle: '📦 Third-party Dependencies',
-                snykSafe: '✅ **SAFE**: No known vulnerabilities found in dependencies.',
-                package: 'Package',
-                severity: 'Severity',
-                description: 'Description',
-                fixPlan: 'Fix Plan',
-                codeqlTitle: '💻 Code Quality & Safety (CodeQL)',
-                codeqlSummary: '#### Summary',
-                rulesChecked: 'Rules Checked',
-                totalAlerts: 'Total Alerts',
-                codeqlSafe: '✅ **SAFE**: CodeQL clean. No issues detected.',
-                ruleId: 'Rule ID',
-                level: 'Level',
-                location: 'Location',
-                auditedList: '📂 Audited File List',
-                guideTitle: '⚠️ Action Guide',
-                guideDesc: 'If you see a **FAIL** status or serious code issues:',
-                guideStep1: '1. **Developers**: Use the **Location** column in the tables above to find the exact file and line number.',
-                guideStep2: '2. **Remediate**: Follow the documentation links provided for each rule to submit a fix.',
-                guideStep3: '3. **Traceability**: Full raw `.sarif` data is attached to this branch. Download and import it into your IDE (e.g., VS Code SARIF Viewer) for local analysis.',
-                footer: '💡 *Generated by the NodeWarden security workflow. Transparency is our commitment.*',
-                auditedIcon: '✅ **Audited**',
-                noFiles: 'No files found.',
-                trivyTitle: '🛡️ Container Config Security (Trivy)',
-                trivyDesc: '`This section detects security risks and best practices in Dockerfile and container configurations.`',
-                trivySafe: '✅ **SAFE**: No container configuration defects found.'
-            }
-        };
-    }
-
-    // --- Data Parsers ---
-
-    async parseCodeQL() {
-        const sarifPath = 'sarif-results';
-        if (!fs.existsSync(sarifPath)) return;
-
-        const files = this.globFiles(sarifPath, '.sarif');
-        let totalAlerts = 0;
-        let rulesSet = new Set();
-        let findings = [];
-        let artifactUris = new Set();
-
-        for (const file of files) {
-            const data = JSON.parse(fs.readFileSync(file, 'utf8'));
-            for (const run of data.runs || []) {
-                // Collect Rules
-                (run.tool.driver.rules || []).forEach(r => rulesSet.add(r.id));
-                (run.tool.extensions || []).forEach(ext => {
-                    (ext.rules || []).forEach(r => rulesSet.add(r.id));
-                });
-
-                // Collect Results
-                for (const res of run.results || []) {
-                    totalAlerts++;
-                    const loc = (res.locations && res.locations[0]?.physicalLocation) || {};
-                    findings.push({
-                        id: res.ruleId,
-                        level: res.level || 'warning',
-                        path: loc.artifactLocation?.uri || 'Global',
-                        line: loc.region?.startLine || '-',
-                        message: res.message?.text || 'No description'
-                    });
-                }
-
-                // Track Coverage (Deduplicated)
-                (run.artifacts || []).forEach(art => {
-                    const uri = art.location?.uri || '';
-                    if (uri) artifactUris.add(uri);
-                });
-            }
-        }
-
-        this.results.artifactUris = Array.from(artifactUris).sort();
-        this.results.coverage.actions = this.results.artifactUris.filter(u => u.startsWith('.github/workflows/')).length;
-        this.results.coverage.js = this.results.artifactUris.filter(u => u.endsWith('.js')).length;
-        this.results.coverage.ts = this.results.artifactUris.filter(u => u.endsWith('.ts')).length;
-
-        this.results.codeql.alertCount = totalAlerts;
-        this.results.codeql.rulesCount = rulesSet.size;
-        this.results.codeql.findings = findings;
-        if (totalAlerts > 0) this.results.codeql.status = 'INFO';
-    }
-
-    async parseSnyk() {
-        const jsonPath = 'snyk_result.json';
-        if (!fs.existsSync(jsonPath)) return;
-
-        try {
-            const data = JSON.parse(fs.readFileSync(jsonPath, 'utf8'));
-            const projects = Array.isArray(data) ? data : [data];
-            let vulnTotal = 0;
-            let findings = [];
-
-            for (const proj of projects) {
-                const vulns = proj.vulnerabilities || [];
-                vulnTotal += vulns.length;
-                vulns.forEach(v => {
-                    findings.push({
-                        pkg: `${v.packageName}@${v.version}`,
-                        severity: v.severity,
-                        title: v.title,
-                        url: v.url,
-                        fixedIn: Array.isArray(v.fixedIn) ? v.fixedIn.join(', ') : (v.fixedIn || 'N/A')
-                    });
-                });
-            }
-
-            this.results.snyk.vulnCount = vulnTotal;
-            this.results.snyk.findings = findings;
-            if (vulnTotal > 0) this.results.snyk.status = 'WARN';
-        } catch (e) {
-            console.error('Error parsing Snyk JSON:', e.message);
-        }
-    }
-
-    async parseGitleaks() {
-        const files = this.globFiles('.', 'results.sarif');
-        if (files.length === 0) return;
-
-        try {
-            const data = JSON.parse(fs.readFileSync(files[0], 'utf8'));
-            let leaks = 0;
-            let findings = [];
-            for (const run of data.runs || []) {
-                for (const res of run.results || []) {
-                    leaks++;
-                    findings.push({
-                        id: res.ruleId,
-                        message: res.message.text,
-                        path: res.locations[0]?.physicalLocation?.artifactLocation?.uri || 'Unknown'
-                    });
-                }
-            }
-
-            this.results.gitleaks.leaksCount = leaks;
-            this.results.gitleaks.findings = findings;
-            if (leaks > 0) this.results.gitleaks.status = 'FAIL';
-        } catch (e) {
-            console.error('Error parsing Gitleaks SARIF:', e.message);
-        }
-    }
-
-    async parseTrivy() {
-        const jsonPath = 'trivy_result.json';
-        if (!fs.existsSync(jsonPath)) return;
-
-        try {
-            const data = JSON.parse(fs.readFileSync(jsonPath, 'utf8'));
-            let misconfigs = 0;
-            let findings = [];
-
-            (data.Results || []).forEach(res => {
-                (res.Misconfigurations || []).forEach(m => {
-                    misconfigs++;
-                    findings.push({
-                        id: m.ID,
-                        severity: m.Severity,
-                        title: m.Title,
-                        message: m.Message,
-                        status: m.Status,
-                        target: res.Target
-                    });
-                });
-            });
-
-            this.results.trivy.misconfigCount = misconfigs;
-            this.results.trivy.findings = findings;
-            if (misconfigs > 0) this.results.trivy.status = 'WARN';
-        } catch (e) {
-            console.error('Error parsing Trivy JSON:', e.message);
-        }
-    }
-
-    generateTable(type, t) {
-        let files = [];
-        if (type === 'actions') files = this.results.artifactUris.filter(u => u.startsWith('.github/workflows/'));
-        else if (type === 'js') files = this.results.artifactUris.filter(u => u.endsWith('.js'));
-        else if (type === 'ts') files = this.results.artifactUris.filter(u => u.endsWith('.ts'));
-
-        if (files.length === 0) return `> ${t.noFiles}\n`;
-
-        let table = `| ${t.module} | ${t.location} | ${t.status} |\n| :--- | :--- | :--- |\n`;
-        files.forEach(f => {
-            const filename = path.basename(f);
-            table += `| \`${filename}\` | \`${f}\` | ${t.auditedIcon} |\n`;
-        });
-        return table;
-    }
-
-    // --- Renderers ---
-
-    generateMarkdown(localeKey) {
-        const { codeql, snyk, gitleaks, coverage } = this.results;
-        const t = this.locales[localeKey];
-
-        // Calculate Grade
-        let grade = 'A+';
-        let gradeColor = 'success';
-        if (gitleaks.status === 'FAIL') { grade = 'D'; gradeColor = 'red'; }
-        else if (snyk.vulnCount > 10 || this.results.trivy.misconfigCount > 5) { grade = 'C'; gradeColor = 'orange'; }
-        else if (snyk.vulnCount > 0 || codeql.alertCount > 0 || this.results.trivy.misconfigCount > 0) { grade = 'B'; gradeColor = 'blue'; }
-
-        const badge = (label, value, color) => `![${label}](https://img.shields.io/badge/${label.replace(/ /g, '_')}-${value}-${color}?style=for-the-badge)`;
-
-        let md = `# ${t.title}\n\n`;
-        md += `${t.switcher}\n\n`;
-        md += `${badge(t.grade.replace(/ /g, '_'), grade, gradeColor)}\n\n`;
-        md += `${t.important}\n\n`;
-
-        md += `| ${t.auditTime} | ${t.runId} | ${t.env} |\n`;
-        md += `| :--- | :--- | :--- |\n`;
-        md += `| \`${this.auditTime}\` | [#${this.runId}](${this.runUrl}) | \`GitHub CI/CD\` |\n\n`;
-
-        md += `---\n\n## ${t.dashboard}\n\n`;
-        md += `| ${t.tool} | ${t.status} | ${t.findings} |\n`;
-        md += `| :--- | :--- | :--- |\n`;
-        md += `| **Credential Leak (Gitleaks)** | ${this.getBadge(gitleaks.status)} | \`${gitleaks.leaksCount}\` ${t.leaks} |\n`;
-        md += `| **Dependency Scan (Snyk)** | ${this.getBadge(snyk.status)} | \`${snyk.vulnCount}\` ${t.vulns} |\n`;
-        md += `| **Static Analysis (CodeQL)** | ${this.getBadge(codeql.status)} | \`${codeql.alertCount}\` ${t.alerts} |\n`;
-        md += `| **Container Scan (Trivy)** | ${this.getBadge(this.results.trivy.status)} | \`${this.results.trivy.misconfigCount}\` ${t.findings} |\n\n`;
-
-        md += `---\n\n## ${t.coverageTitle}\n\n`;
-        md += `| ${t.module} | ${t.auditedFiles} | ${t.coverage} |\n`;
-        md += `| :--- | :---: | :---: |\n`;
-        md += `| **GitHub Actions** | \`${coverage.actions}\` | ✨ **100%** |\n`;
-        md += `| **JavaScript (Frontend)** | \`${coverage.js}\` | ✨ **100%** |\n`;
-        md += `| **TypeScript (Backend)** | \`${coverage.ts}\` | ✨ **100%** |\n\n`;
-
-        md += `---\n\n## ${t.detailedFindings}\n\n`;
-
-        // Gitleaks Section
-        md += `### ${t.gitleaksTitle}\n`;
-        md += `${t.gitleaksDesc} ${t.gitleaksScope}\n\n`;
-        if (gitleaks.findings.length > 0) {
-            md += `| ${t.ruleId} | ${t.location} | ${t.description} |\n`;
-            md += `| :--- | :--- | :--- |\n`;
-            gitleaks.findings.forEach(f => {
-                md += `| \`${f.id}\` | \`${f.path}\` | ${f.message} |\n`;
-            });
-        } else {
-            md += `${t.gitleaksSafe}\n`;
-        }
-
-        // Trivy Section
-        md += `\n### ${t.trivyTitle}\n`;
-        md += `${t.trivyDesc}\n\n`;
-        if (this.results.trivy.findings.length > 0) {
-            md += `| ${t.ruleId} | ${t.severity} | ${t.location} | ${t.description} |\n`;
-            md += `| :--- | :---: | :--- | :--- |\n`;
-            this.results.trivy.findings.forEach(f => {
-                const icon = f.severity === 'CRITICAL' ? '🔴' : (f.severity === 'HIGH' ? '🟠' : '🟡');
-                md += `| \`${f.id}\` | ${icon} ${f.severity} | \`${f.target}\` | ${f.title}: ${f.message} |\n`;
-            });
-        } else {
-            md += `${t.trivySafe}\n`;
-        }
-
-        // Snyk Section
-        md += `\n### ${t.snykTitle}\n`;
-        if (snyk.findings.length > 0) {
-            md += `| ${t.package} | ${t.severity} | ${t.description} | ${t.fixPlan} |\n`;
-            md += `| :--- | :---: | :--- | :--- |\n`;
-            snyk.findings.forEach(f => {
-                const icon = f.severity === 'critical' ? '🔴' : (f.severity === 'high' ? '🟠' : '🟡');
-                md += `| \`${f.pkg}\` | ${icon} ${f.severity} | [${f.title}](${f.url}) | ${f.fixedIn === 'N/A' ? 'No fix' : `Upgrade to \`${f.fixedIn}\``} |\n`;
-            });
-        } else {
-            md += `${t.snykSafe}\n`;
-        }
-
-        // CodeQL Section
-        md += `\n### ${t.codeqlTitle}\n`;
-        if (codeql.findings.length > 0) {
-            md += `${t.codeqlSummary}\n- **${t.rulesChecked}**: \`${codeql.rulesCount}\`\n- **${t.totalAlerts}**: \`${codeql.alertCount}\`\n\n`;
-            md += `| ${t.ruleId} | ${t.level} | ${t.location} | ${t.description} |\n`;
-            md += `| :--- | :---: | :--- | :--- |\n`;
-            codeql.findings.forEach(f => {
-                const icon = f.level === 'error' ? '🔴' : (f.level === 'warning' ? '🟠' : '🔵');
-                const prefix = f.id.split('/')[0];
-                const langMap = {
-                    'js': 'javascript',
-                    'actions': 'github-actions',
-                    'cpp': 'cpp',
-                    'cs': 'csharp',
-                    'go': 'go',
-                    'java': 'java',
-                    'py': 'python',
-                    'rb': 'ruby',
-                    'swift': 'swift'
-                };
-                const langPath = langMap[prefix] || 'javascript';
-                md += `| [${f.id}](https://codeql.github.com/codeql-query-help/${langPath}/${f.id.replace(/\//g, '-')}/) | ${icon} ${f.level} | \`${f.path}:${f.line}\` | ${f.message} |\n`;
-            });
-        } else {
-            md += `${t.codeqlSafe}\n`;
-        }
-
-        // Audited Files List
-        md += `\n### ${t.auditedList}\n`;
-        md += `<details>\n<summary><b>GitHub Actions (${this.results.coverage.actions})</b></summary>\n\n`;
-        md += this.generateTable('actions', t);
-        md += `\n</details>\n\n`;
-
-        md += `<details>\n<summary><b>JavaScript (${this.results.coverage.js})</b></summary>\n\n`;
-        md += this.generateTable('js', t);
-        md += `\n</details>\n\n`;
-
-        md += `<details>\n<summary><b>TypeScript (${this.results.coverage.ts})</b></summary>\n\n`;
-        md += this.generateTable('ts', t);
-        md += `\n</details>\n\n`;
-
-        // Action Guide
-        md += `--- \n\n## ${t.guideTitle}\n\n`;
-        md += `${t.guideDesc}\n`;
-        md += `${t.guideStep1}\n`;
-        md += `${t.guideStep2}\n`;
-        md += `${t.guideStep3}\n\n`;
-
-        md += `--- \n\n${t.footer}`;
-
-        return md;
-    }
-
-    // --- Helpers ---
-
-    getBadge(status) {
-        if (status === 'PASS') return '![Pass](https://img.shields.io/badge/Status-PASS-success?style=for-the-badge)';
-        if (status === 'WARN' || status === 'INFO') return '![Warning](https://img.shields.io/badge/Status-NOTICE-orange?style=for-the-badge)';
-        return '![Fail](https://img.shields.io/badge/Status-FAIL-red?style=for-the-badge)';
-    }
-
-    globFiles(dir, ext) {
-        let results = [];
-        const list = fs.readdirSync(dir);
-        for (const file of list) {
-            const fullPath = path.join(dir, file);
-            const stat = fs.statSync(fullPath);
-            if (stat && stat.isDirectory()) {
-                results = results.concat(this.globFiles(fullPath, ext));
-            } else if (file.endsWith(ext)) {
-                results.push(fullPath);
-            }
-        }
-        return results;
-    }
-
-    async run() {
-        console.log('--- Security Report Generation Started ---');
-        await this.parseCodeQL();
-        await this.parseSnyk();
-        await this.parseGitleaks();
-        await this.parseTrivy();
-
-        for (const localeKey of Object.keys(this.locales)) {
-            const locale = this.locales[localeKey];
-            const markdown = this.generateMarkdown(localeKey);
-            fs.writeFileSync(locale.filename, markdown);
-            console.log(`Report generated successfully at ${locale.filename}`);
-        }
-    }
-}
-
-new SecurityReport().run().catch(err => {
-    console.error('Report generation failed:', err);
-    process.exit(1);
-});

.github/workflows/security.yml

@@ -1,142 +0,0 @@
-name: Security Scan
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches: 
-      - main
-  workflow_dispatch:
-
-jobs:
-  scan:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: write
-      actions: read
-    env:
-      SECURITY_SNYK_TOKEN: ${{ secrets.SECURITY_SNYK_TOKEN }}
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Initialize CodeQL
-        if: env.ACT != 'true'
-        continue-on-error: true
-        uses: github/codeql-action/init@v4
-        with:
-          languages: javascript-typescript, actions
-          build-mode: none
-          queries: security-extended,security-and-quality
-
-      - name: Perform CodeQL Analysis
-        if: env.ACT != 'true'
-        continue-on-error: true
-        uses: github/codeql-action/analyze@v4
-        with:
-          upload: true
-          output: sarif-results
-
-      - name: Install Gitleaks
-        if: env.ACT != 'true'
-        continue-on-error: true
-        run: |
-          GITLEAKS_VERSION="8.28.0"
-          curl -sSL -o gitleaks.tar.gz "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
-          tar -xzf gitleaks.tar.gz gitleaks
-          chmod +x gitleaks
-          sudo mv gitleaks /usr/local/bin/gitleaks
-
-      - name: Secret Detection
-        if: env.ACT != 'true'
-        continue-on-error: true
-        run: |
-          gitleaks git . --report-format sarif --report-path results.sarif --no-banner || true
-
-      - name: Install Project Dependencies
-        if: env.SECURITY_SNYK_TOKEN != ''
-        env:
-          SECURITY_PACKAGE: ${{ vars.SECURITY_PACKAGE || '' }}
-        run: |
-          echo "Preparing dependency lock files for security scanning..."
-          if [ -z "$SECURITY_PACKAGE" ]; then
-            echo "SECURITY_PACKAGE is empty, installing in root..."
-            npm install --package-lock-only
-          else
-            echo "SECURITY_PACKAGE is set to: $SECURITY_PACKAGE"
-            # Split by comma and install
-            IFS=',' read -ra PACKAGES <<< "$SECURITY_PACKAGE"
-            for pkg in "${PACKAGES[@]}"; do
-              if [ -d "$pkg" ]; then
-                echo "Installing in "$pkg"..."
-                npm install --prefix "$pkg" --package-lock-only
-              else
-                echo "Warning: Directory $pkg not found, skipping."
-              fi
-            done
-          fi
-
-      - name: Dependency Scan
-        id: snyk
-        if: env.SECURITY_SNYK_TOKEN != ''
-        continue-on-error: true
-        run: |
-          npm install -g snyk          
-          snyk auth ${{ secrets.SECURITY_SNYK_TOKEN }}
-          snyk test --all-projects --json-file-output=snyk_result.json > snyk_result.txt || true
-        env:
-          SECURITY_SNYK_TOKEN: ${{ secrets.SECURITY_SNYK_TOKEN }}
-
-      - name: Check for Dockerfile
-        id: check_docker
-        run: |
-          if [ -f "Dockerfile" ]; then
-            echo "exists=true" >> $GITHUB_OUTPUT
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Container Security Scan (Trivy)
-        if: steps.check_docker.outputs.exists == 'true'
-        continue-on-error: true
-        run: |
-          VERSION="0.56.1"
-          echo "Installing Trivy $VERSION..."
-          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "v$VERSION"
-          trivy config . --format json --output trivy_result.json --severity CRITICAL,HIGH || true
-
-      - name: Generate Security Report
-        run: |
-          # Gitleaks typically produces results.sarif if configured or by default in some versions
-          # We'll ensure it exists for our reporter
-          node .github/scripts/security.cjs
-          
-          # Also append to step summary for immediate visibility in GHA UI
-          cat security-report.md >> $GITHUB_STEP_SUMMARY
-          echo -e "\n---\n" >> $GITHUB_STEP_SUMMARY
-          cat security-report-cn.md >> $GITHUB_STEP_SUMMARY
-
-      - name: Upload Gitleaks Results to GitHub Security
-        uses: github/codeql-action/upload-sarif@v4
-        if: always()
-        with:
-          sarif_file: results.sarif
-          category: gitleaks
-
-      - name: Upload Security Report Artifacts
-        if: always()
-        uses: actions/upload-artifact@v6
-        with:
-          name: security-report
-          if-no-files-found: ignore
-          path: |
-            security-report.md
-            security-report-cn.md
-            snyk_result.txt
-            snyk_result.json
-            trivy_result.json
-            results.sarif
-            sarif-results/*.sarif

.gitignore

@@ -56,6 +56,7 @@ NodeWarden-compat/
 .codex-upstream/bitwarden-browser/
 
 .reasonix/
+.upstream/
 
 # Compatibility analysis documents
 BITWARDEN_COMPATIBILITY_ANALYSIS.md

src/handlers/admin.ts

@@ -249,7 +249,7 @@ export async function handleAdminListInvites(
 }
 
 // DELETE /api/admin/invites/:code
-export async function handleAdminRevokeInvite(
+export async function handleAdminDeleteInvite(
   request: Request,
   env: Env,
   actorUser: User,
@@ -260,12 +260,14 @@ export async function handleAdminRevokeInvite(
   }
 
   const storage = new StorageService(env.DB);
-  const revoked = await storage.revokeInvite(code);
+  const deleted = await storage.deleteInvite(code);
-  if (!revoked) {
+  if (!deleted) {
-    return errorResponse('Invite not found or already inactive', 404);
+    return errorResponse('Invite not found', 404);
   }
 
-  await writeAuditLog(storage, actorUser.id, 'admin.invite.revoke', 'invite', null, null, request);
+  await writeAuditLog(storage, actorUser.id, 'admin.invite.delete', 'invite', null, {
+    code,
+  }, request);
   return new Response(null, { status: 204 });
 }
 
@@ -275,12 +277,21 @@ export async function handleAdminDeleteAllInvites(
   env: Env,
   actorUser: User
 ): Promise<Response> {
-  void request;
   if (!isAdmin(actorUser)) {
     return errorResponse('Forbidden', 403);
   }
 
   const storage = new StorageService(env.DB);
+  const url = new URL(request.url);
+  if (url.searchParams.get('scope') === 'invalid') {
+    const deleted = await storage.deleteInvalidInvites();
+    await writeAuditLog(storage, actorUser.id, 'admin.invite.delete_invalid', 'invite', null, {
+      deleted,
+    }, request);
+
+    return jsonResponse({ deleted }, 200);
+  }
+
   const deleted = await storage.deleteAllInvites();
   await writeAuditLog(storage, actorUser.id, 'admin.invite.delete_all', 'invite', null, {
     deleted,

src/router-admin.ts

@@ -4,7 +4,7 @@ import {
   handleAdminCreateInvite,
   handleAdminListInvites,
   handleAdminDeleteAllInvites,
-  handleAdminRevokeInvite,
+  handleAdminDeleteInvite,
   handleAdminSetUserStatus,
   handleAdminDeleteUser,
   handleAdminListAuditLogs,
@@ -52,7 +52,7 @@ export async function handleAdminRoute(
   const adminInviteMatch = path.match(/^\/api\/admin\/invites\/([^/]+)$/i);
   if (adminInviteMatch && method === 'DELETE') {
     const inviteCode = decodeURIComponent(adminInviteMatch[1]);
-    return handleAdminRevokeInvite(request, env, actorUser, inviteCode);
+    return handleAdminDeleteInvite(request, env, actorUser, inviteCode);
   }
 
   const adminUserStatusMatch = path.match(/^\/api\/admin\/users\/([a-f0-9-]+)\/status$/i);

src/services/storage-admin-repo.ts

@@ -151,15 +151,23 @@ export async function revertInviteUsed(db: D1Database, code: string, userId: str
   return (result.meta.changes ?? 0) > 0;
 }
 
-export async function revokeInvite(db: D1Database, code: string): Promise<boolean> {
+export async function deleteInvite(db: D1Database, code: string): Promise<boolean> {
-  const now = new Date().toISOString();
   const result = await db
-    .prepare("UPDATE invites SET status = 'revoked', updated_at = ? WHERE code = ? AND status = 'active'")
+    .prepare('DELETE FROM invites WHERE code = ?')
-    .bind(now, code)
+    .bind(code)
     .run();
   return (result.meta.changes ?? 0) > 0;
 }
 
+export async function deleteInvalidInvites(db: D1Database): Promise<number> {
+  const now = new Date().toISOString();
+  const result = await db
+    .prepare("DELETE FROM invites WHERE status != 'active' OR expires_at <= ?")
+    .bind(now)
+    .run();
+  return Number(result.meta.changes ?? 0);
+}
+
 export async function deleteAllInvites(db: D1Database): Promise<number> {
   const result = await db.prepare('DELETE FROM invites').run();
   return Number(result.meta.changes ?? 0);

src/services/storage.ts

@@ -24,6 +24,8 @@ import {
   clearAuditLogs as clearStoredAuditLogs,
   assignInviteUsedBy as assignStoredInviteUsedBy,
   createInvite as createStoredInvite,
+  deleteInvite as deleteStoredInvite,
+  deleteInvalidInvites as deleteStoredInvalidInvites,
   deleteAllInvites as deleteStoredInvites,
   getInvite as findStoredInvite,
   listAuditLogs as listStoredAuditLogs,
@@ -32,7 +34,6 @@ import {
   pruneAuditLogs as pruneStoredAuditLogs,
   pruneAuditLogsToMax as pruneStoredAuditLogsToMax,
   revertInviteUsed as revertStoredInviteUsed,
-  revokeInvite as revokeStoredInvite,
 } from './storage-admin-repo';
 import {
   bulkDeleteFolders as deleteStoredFolders,
@@ -329,8 +330,12 @@ export class StorageService {
     return revertStoredInviteUsed(this.db, code, userId);
   }
 
-  async revokeInvite(code: string): Promise<boolean> {
+  async deleteInvite(code: string): Promise<boolean> {
-    return revokeStoredInvite(this.db, code);
+    return deleteStoredInvite(this.db, code);
+  }
+
+  async deleteInvalidInvites(): Promise<number> {
+    return deleteStoredInvalidInvites(this.db);
   }
 
   async deleteAllInvites(): Promise<number> {

webapp/src/App.tsx

@@ -1115,8 +1115,6 @@ export default function App() {
     queryFn: () => listPendingAuthRequests(authedFetch, profile?.email || session?.email || ''),
     enabled: !IS_DEMO_MODE && phase === 'app' && !!session?.accessToken && !!session?.symEncKey && !!session?.symMacKey && !!(profile?.email || session?.email),
     staleTime: 5_000,
-    refetchInterval: 15_000,
-    refetchIntervalInBackground: true,
   });
   const pendingAuthRequests = (pendingAuthRequestsQuery.data || []).filter(isPendingAuthRequest);
   const latestPendingAuthRequest = pendingAuthRequests[0] || null;
@@ -2015,7 +2013,8 @@ export default function App() {
     onEnableAccountPasskeyDirectUnlock: accountSecurityActions.enableAccountPasskeyDirectUnlock,
     onDeleteAccountPasskey: accountSecurityActions.deleteAccountPasskey,
     pendingAuthRequests,
-    pendingAuthRequestsLoading: pendingAuthRequestsQuery.isFetching,
+    pendingAuthRequestsLoading: pendingAuthRequestsQuery.isLoading,
+    pendingAuthRequestsRefreshing: pendingAuthRequestsQuery.isFetching && !pendingAuthRequestsQuery.isLoading,
     onRefreshPendingAuthRequests: async () => {
       await pendingAuthRequestsQuery.refetch();
     },
@@ -2037,10 +2036,11 @@ export default function App() {
     onRemoveAllDevices: accountSecurityActions.openRemoveAllDevices,
     onRefreshAdmin: adminActions.refreshAdmin,
     onCreateInvite: adminActions.createInvite,
+    onDeleteInvalidInvites: adminActions.deleteInvalidInvites,
     onDeleteAllInvites: adminActions.deleteAllInvites,
     onToggleUserStatus: adminActions.toggleUserStatus,
     onDeleteUser: adminActions.deleteUser,
-    onRevokeInvite: adminActions.revokeInvite,
+    onDeleteInvite: adminActions.deleteInvite,
     onLoadAuditLogs: (filters: AuditLogFilters) => listAuditLogs(authedFetch, filters),
     onLoadAuditLogSettings: () => getAuditLogSettings(authedFetch),
     onSaveAuditLogSettings: (settings: AuditLogSettings) => saveAuditLogSettings(authedFetch, settings),

webapp/src/components/AdminPage.tsx

@@ -13,10 +13,11 @@ interface AdminPageProps {
   error: string;
   onRefresh: () => void;
   onCreateInvite: (hours: number) => Promise<void>;
+  onDeleteInvalidInvites: () => Promise<void>;
   onDeleteAllInvites: () => Promise<void>;
   onToggleUserStatus: (userId: string, currentStatus: 'active' | 'banned') => Promise<void>;
   onDeleteUser: (userId: string) => Promise<void>;
-  onRevokeInvite: (code: string) => Promise<void>;
+  onDeleteInvite: (code: string) => Promise<void>;
 }
 
 export default function AdminPage(props: AdminPageProps) {
@@ -134,7 +135,10 @@ export default function AdminPage(props: AdminPageProps) {
           <h3>{t('txt_invites')}</h3>
           <div className="actions admin-invites-head-actions">
             <button type="button" className="btn btn-secondary small" disabled={props.loading} onClick={props.onRefresh}>
-              <RefreshCw size={14} className="btn-icon" /> {t('txt_sync')}
+              <RefreshCw size={14} className="btn-icon" /> {t('txt_refresh')}
+            </button>
+            <button type="button" className="btn btn-danger small" onClick={() => void props.onDeleteInvalidInvites()}>
+              <Trash2 size={14} className="btn-icon" /> {t('txt_delete_invalid')}
             </button>
             <button type="button" className="btn btn-danger small" onClick={() => void props.onDeleteAllInvites()}>
               <Trash2 size={14} className="btn-icon" /> {t('txt_delete_all')}
@@ -184,11 +188,9 @@ export default function AdminPage(props: AdminPageProps) {
                     >
                       <Clipboard size={14} className="btn-icon" /> {t('txt_copy_link')}
                     </button>
-                    {invite.status === 'active' && (
+                    <button type="button" className="btn btn-danger" onClick={() => void props.onDeleteInvite(invite.code)}>
-                      <button type="button" className="btn btn-danger" onClick={() => void props.onRevokeInvite(invite.code)}>
+                      <Trash2 size={14} className="btn-icon" /> {t('txt_delete')}
-                        <Trash2 size={14} className="btn-icon" /> {t('txt_revoke')}
+                    </button>
-                      </button>
-                    )}
                   </div>
                 </td>
               </tr>

webapp/src/components/AppMainRoutes.tsx

@@ -119,6 +119,7 @@ export interface AppMainRoutesProps {
   onDeleteAccountPasskey: (id: string, masterPassword: string) => Promise<void>;
   pendingAuthRequests: AuthRequest[];
   pendingAuthRequestsLoading: boolean;
+  pendingAuthRequestsRefreshing: boolean;
   onRefreshPendingAuthRequests: () => Promise<void>;
   onApproveAuthRequest: (request: AuthRequest) => Promise<void>;
   onDenyAuthRequest: (request: AuthRequest) => Promise<void>;
@@ -136,10 +137,11 @@ export interface AppMainRoutesProps {
   onRemoveAllDevices: () => void;
   onCreateInvite: (hours: number) => Promise<void>;
   onRefreshAdmin: () => void;
+  onDeleteInvalidInvites: () => Promise<void>;
   onDeleteAllInvites: () => Promise<void>;
   onToggleUserStatus: (userId: string, status: 'active' | 'banned') => Promise<void>;
   onDeleteUser: (userId: string) => Promise<void>;
-  onRevokeInvite: (code: string) => Promise<void>;
+  onDeleteInvite: (code: string) => Promise<void>;
   onLoadAuditLogs: (filters: AuditLogFilters) => Promise<AuditLogListResult>;
   onLoadAuditLogSettings: () => Promise<AuditLogSettings>;
   onSaveAuditLogSettings: (settings: AuditLogSettings) => Promise<AuditLogSettings>;
@@ -354,6 +356,7 @@ export default function AppMainRoutes(props: AppMainRoutesProps) {
                 error={props.authorizedDevicesError}
                 pendingAuthRequests={props.pendingAuthRequests}
                 pendingAuthRequestsLoading={props.pendingAuthRequestsLoading}
+                pendingAuthRequestsRefreshing={props.pendingAuthRequestsRefreshing}
                 onRefresh={() => void props.onRefreshAuthorizedDevices()}
                 onRefreshPendingAuthRequests={props.onRefreshPendingAuthRequests}
                 onApproveAuthRequest={props.onApproveAuthRequest}
@@ -411,10 +414,11 @@ export default function AppMainRoutes(props: AppMainRoutesProps) {
               error={props.adminError}
               onRefresh={props.onRefreshAdmin}
               onCreateInvite={props.onCreateInvite}
+              onDeleteInvalidInvites={props.onDeleteInvalidInvites}
               onDeleteAllInvites={props.onDeleteAllInvites}
               onToggleUserStatus={props.onToggleUserStatus}
               onDeleteUser={props.onDeleteUser}
-              onRevokeInvite={props.onRevokeInvite}
+              onDeleteInvite={props.onDeleteInvite}
             />
           </Suspense>
         </div>

webapp/src/components/PendingAuthRequestsPanel.tsx

@@ -7,6 +7,7 @@ import { t } from '@/lib/i18n';
 interface PendingAuthRequestsPanelProps {
   pendingAuthRequests: AuthRequest[];
   pendingAuthRequestsLoading: boolean;
+  pendingAuthRequestsRefreshing?: boolean;
   onRefreshPendingAuthRequests: () => Promise<void>;
   onApproveAuthRequest: (request: AuthRequest) => Promise<void>;
   onDenyAuthRequest: (request: AuthRequest) => Promise<void>;
@@ -22,6 +23,7 @@ function formatDateTime(value: string | null | undefined): string {
 
 export default function PendingAuthRequestsPanel(props: PendingAuthRequestsPanelProps) {
   const [authRequestSubmittingId, setAuthRequestSubmittingId] = useState<string | null>(null);
+  const refreshing = props.pendingAuthRequestsLoading || !!props.pendingAuthRequestsRefreshing;
 
   async function approveAuthRequest(authRequest: AuthRequest): Promise<void> {
     if (authRequestSubmittingId) return;
@@ -50,10 +52,10 @@ export default function PendingAuthRequestsPanel(props: PendingAuthRequestsPanel
         <button
           type="button"
           className="btn btn-secondary small"
-          disabled={props.pendingAuthRequestsLoading}
+          disabled={refreshing}
           onClick={() => void props.onRefreshPendingAuthRequests()}
         >
-          <RefreshCw size={14} className="btn-icon" />
+          <RefreshCw size={14} className={`btn-icon${refreshing ? ' btn-icon-spin' : ''}`} />
           {t('txt_refresh')}
         </button>
       </div>

webapp/src/components/SecurityDevicesPage.tsx

@@ -13,6 +13,7 @@ interface SecurityDevicesPageProps {
   error: string;
   pendingAuthRequests: AuthRequest[];
   pendingAuthRequestsLoading: boolean;
+  pendingAuthRequestsRefreshing: boolean;
   onRefresh: () => void;
   onRefreshPendingAuthRequests: () => Promise<void>;
   onApproveAuthRequest: (request: AuthRequest) => Promise<void>;
@@ -106,6 +107,7 @@ export default function SecurityDevicesPage(props: SecurityDevicesPageProps) {
           loadingVariant="compact"
           pendingAuthRequests={props.pendingAuthRequests}
           pendingAuthRequestsLoading={props.pendingAuthRequestsLoading}
+          pendingAuthRequestsRefreshing={props.pendingAuthRequestsRefreshing}
           onRefreshPendingAuthRequests={props.onRefreshPendingAuthRequests}
           onApproveAuthRequest={props.onApproveAuthRequest}
           onDenyAuthRequest={props.onDenyAuthRequest}

webapp/src/hooks/useAdminActions.ts

@@ -1,5 +1,5 @@
 import { useMemo } from 'preact/hooks';
-import { createInvite, deleteAllInvites, deleteUser, revokeInvite, setUserStatus } from '@/lib/api/admin';
+import { createInvite, deleteAllInvites, deleteInvalidInvites, deleteInvite, deleteUser, setUserStatus } from '@/lib/api/admin';
 import { t } from '@/lib/i18n';
 import type { AppConfirmState } from '@/components/AppGlobalOverlays';
 import type { AuthedFetch } from '@/lib/api/shared';
@@ -45,14 +45,44 @@ export default function useAdminActions(options: UseAdminActionsOptions) {
         }
       },
 
-      async revokeInvite(code: string) {
+      async deleteInvite(code: string) {
-        try {
+        onSetConfirm({
-          await revokeInvite(authedFetch, code);
+          title: t('txt_delete_invite'),
-          await refetchInvites();
+          message: t('txt_delete_invite_confirm_message'),
-          onNotify('success', t('txt_invite_revoked'));
+          danger: true,
-        } catch (error) {
+          onConfirm: () => {
-          onNotify('error', error instanceof Error ? error.message : t('txt_revoke_invite_failed'));
+            onSetConfirm(null);
-        }
+            void (async () => {
+              try {
+                await deleteInvite(authedFetch, code);
+                await refetchInvites();
+                onNotify('success', t('txt_invite_deleted'));
+              } catch (error) {
+                onNotify('error', error instanceof Error ? error.message : t('txt_delete_invite_failed'));
+              }
+            })();
+          },
+        });
+      },
+
+      async deleteInvalidInvites() {
+        onSetConfirm({
+          title: t('txt_delete_invalid_invites'),
+          message: t('txt_delete_invalid_invites_confirm_message'),
+          danger: true,
+          onConfirm: () => {
+            onSetConfirm(null);
+            void (async () => {
+              try {
+                await deleteInvalidInvites(authedFetch);
+                await refetchInvites();
+                onNotify('success', t('txt_invalid_invites_deleted'));
+              } catch (error) {
+                onNotify('error', error instanceof Error ? error.message : t('txt_delete_invalid_invites_failed'));
+              }
+            })();
+          },
+        });
       },
 
       async deleteAllInvites() {

webapp/src/lib/api/admin.ts

@@ -24,9 +24,14 @@ export async function createInvite(authedFetch: AuthedFetch, hours: number): Pro
   if (!resp.ok) throw new Error('Create invite failed');
 }
 
-export async function revokeInvite(authedFetch: AuthedFetch, code: string): Promise<void> {
+export async function deleteInvite(authedFetch: AuthedFetch, code: string): Promise<void> {
   const resp = await authedFetch(`/api/admin/invites/${encodeURIComponent(code)}`, { method: 'DELETE' });
-  if (!resp.ok) throw new Error('Revoke invite failed');
+  if (!resp.ok) throw new Error('Delete invite failed');
+}
+
+export async function deleteInvalidInvites(authedFetch: AuthedFetch): Promise<void> {
+  const resp = await authedFetch('/api/admin/invites?scope=invalid', { method: 'DELETE' });
+  if (!resp.ok) throw new Error('Delete invalid invites failed');
 }
 
 export async function deleteAllInvites(authedFetch: AuthedFetch): Promise<void> {

webapp/src/lib/demo.ts

@@ -1127,6 +1127,13 @@ export function createDemoMainRoutesProps(base: AppMainRoutesProps, notify: Noti
     onRefreshAdmin: () => {
       notify('success', t('txt_demo_admin_refreshed'));
     },
+    onDeleteInvalidInvites: async () => {
+      const now = Date.now();
+      state.setInvites((prev) => prev.filter((invite) => (
+        invite.status === 'active' && (!invite.expiresAt || new Date(invite.expiresAt).getTime() > now)
+      )));
+      notify('success', t('txt_invalid_invites_deleted'));
+    },
     onDeleteAllInvites: async () => {
       state.setInvites([]);
       notify('success', t('txt_all_invites_deleted'));
@@ -1141,11 +1148,9 @@ export function createDemoMainRoutesProps(base: AppMainRoutesProps, notify: Noti
       state.setUsers((prev) => prev.filter((user) => user.id !== userId));
       notify('success', t('txt_user_deleted'));
     },
-    onRevokeInvite: async (code) => {
+    onDeleteInvite: async (code) => {
-      state.setInvites((prev) => prev.map((invite) => (
+      state.setInvites((prev) => prev.filter((invite) => invite.code !== code));
-        invite.code === code ? { ...invite, status: 'inactive' } : invite
+      notify('success', t('txt_invite_deleted'));
-      )));
-      notify('success', t('txt_invite_revoked'));
     },
     onLoadAuditLogSettings: async () => ({ retentionDays: 90, maxEntries: null }),
     onSaveAuditLogSettings: async (settings) => {

webapp/src/lib/export-formats.ts

@@ -449,6 +449,43 @@ function appendRecordFieldLines(lines: string[], prefix: string, value: unknown)
   }
 }
 
+const BITWARDEN_CSV_OBJECT_FIELDS: Record<string, readonly string[]> = {
+  card: ['cardholderName', 'brand', 'number', 'expMonth', 'expYear', 'code'],
+  identity: [
+    'title',
+    'firstName',
+    'middleName',
+    'lastName',
+    'username',
+    'company',
+    'ssn',
+    'passportNumber',
+    'licenseNumber',
+    'email',
+    'phone',
+    'address1',
+    'address2',
+    'address3',
+    'city',
+    'state',
+    'postalCode',
+    'country',
+  ],
+  sshKey: ['privateKey', 'publicKey', 'keyFingerprint', 'fingerprint'],
+};
+
+function appendKnownRecordFieldLines(lines: string[], prefix: string, value: unknown): void {
+  if (!isRecord(value)) return;
+  const keys = BITWARDEN_CSV_OBJECT_FIELDS[prefix];
+  if (!keys) {
+    appendRecordFieldLines(lines, prefix, value);
+    return;
+  }
+  for (const key of keys) {
+    appendFieldLine(lines, `${prefix}.${key}`, value[key]);
+  }
+}
+
 function buildBitwardenCsvFields(item: Record<string, unknown>, type: number): string {
   const lines: string[] = [];
   const fields = Array.isArray(item.fields) ? item.fields : [];
@@ -457,8 +494,9 @@ function buildBitwardenCsvFields(item: Record<string, unknown>, type: number): s
     appendFieldLine(lines, field.name, field.value);
   }
   if (type !== 1 && type !== 2) {
-    appendFieldLine(lines, 'nodewardenType', sourceTypeLabel(type));
+    const sourceLabel = sourceTypeLabel(type);
-    appendRecordFieldLines(lines, sourceTypeLabel(type), item[sourceTypeLabel(type)]);
+    appendFieldLine(lines, 'nodewardenType', sourceLabel);
+    appendKnownRecordFieldLines(lines, sourceLabel, item[sourceLabel]);
   }
   return lines.join('\n');
 }

webapp/src/lib/i18n/locales/en.ts

@@ -582,8 +582,17 @@ const en: Record<string, string> = {
   "txt_identity_details": "Identity Details",
   "txt_ie_browser": "IE Browser",
   "txt_create_invite_failed": "Failed to create invite",
+  "txt_delete_invalid": "Delete Invalid",
+  "txt_delete_invalid_invites": "Delete invalid invites",
+  "txt_delete_invalid_invites_confirm_message": "Delete all invalid invite codes? Active, unexpired invite codes will be kept.",
+  "txt_delete_invalid_invites_failed": "Failed to delete invalid invites",
+  "txt_delete_invite": "Delete invite",
+  "txt_delete_invite_confirm_message": "Delete this invite code? This cannot be undone.",
+  "txt_delete_invite_failed": "Failed to delete invite",
   "txt_invite_code_required": "Invite Code (Required)",
   "txt_invite_created": "Invite created",
+  "txt_invite_deleted": "Invite deleted",
+  "txt_invalid_invites_deleted": "Invalid invites deleted",
   "txt_invite_revoked": "Invite revoked",
   "txt_revoke_invite_failed": "Failed to revoke invite",
   "txt_invite_validity_hours": "Invite validity (hours)",
@@ -1156,7 +1165,9 @@ const en: Record<string, string> = {
   "txt_log_action_admin_backup_settings_repair": "Repair backup settings",
   "txt_log_action_admin_backup_settings_update": "Update backup settings",
   "txt_log_action_admin_invite_create": "Create invite",
+  "txt_log_action_admin_invite_delete": "Delete invite",
   "txt_log_action_admin_invite_delete_all": "Clear invites",
+  "txt_log_action_admin_invite_delete_invalid": "Delete invalid invites",
   "txt_log_action_admin_invite_revoke": "Revoke invite",
   "txt_log_action_admin_user_delete": "Delete user",
   "txt_log_action_admin_user_status": "Change user status",

webapp/src/lib/i18n/locales/es.ts

@@ -582,8 +582,17 @@ const es: Record<string, string> = {
   "txt_identity_details": "Detalles de identidad",
   "txt_ie_browser": "Navegador Internet Explorer",
   "txt_create_invite_failed": "Error al crear invitación",
+  "txt_delete_invalid": "Eliminar inválidas",
+  "txt_delete_invalid_invites": "Eliminar invitaciones inválidas",
+  "txt_delete_invalid_invites_confirm_message": "¿Eliminar todos los códigos de invitación inválidos? Se conservarán los códigos activos y no vencidos.",
+  "txt_delete_invalid_invites_failed": "Error al eliminar invitaciones inválidas",
+  "txt_delete_invite": "Eliminar invitación",
+  "txt_delete_invite_confirm_message": "¿Eliminar este código de invitación? Esta acción no se puede deshacer.",
+  "txt_delete_invite_failed": "Error al eliminar invitación",
   "txt_invite_code_required": "Código de invitación (obligatorio)",
   "txt_invite_created": "Invitación creada",
+  "txt_invite_deleted": "Invitación eliminada",
+  "txt_invalid_invites_deleted": "Invitaciones inválidas eliminadas",
   "txt_invite_revoked": "Invitación revocada",
   "txt_revoke_invite_failed": "Error al revocar invitación",
   "txt_invite_validity_hours": "Validez de la invitación en horas",
@@ -1156,7 +1165,9 @@ const es: Record<string, string> = {
   "txt_log_action_admin_backup_settings_repair": "Repair backup settings",
   "txt_log_action_admin_backup_settings_update": "Update backup settings",
   "txt_log_action_admin_invite_create": "Create invite",
+  "txt_log_action_admin_invite_delete": "Delete invite",
   "txt_log_action_admin_invite_delete_all": "Clear invites",
+  "txt_log_action_admin_invite_delete_invalid": "Delete invalid invites",
   "txt_log_action_admin_invite_revoke": "Revoke invite",
   "txt_log_action_admin_user_delete": "Delete user",
   "txt_log_action_admin_user_status": "Change user status",

webapp/src/lib/i18n/locales/ru.ts

@@ -582,8 +582,17 @@ const ru: Record<string, string> = {
   "txt_identity_details": "Данные личности",
   "txt_ie_browser": "IE-браузер",
   "txt_create_invite_failed": "Не удалось создать приглашение",
+  "txt_delete_invalid": "Удалить недействительные",
+  "txt_delete_invalid_invites": "Удалить недействительные приглашения",
+  "txt_delete_invalid_invites_confirm_message": "Удалить все недействительные пригласительные коды? Активные и не истекшие коды будут сохранены.",
+  "txt_delete_invalid_invites_failed": "Не удалось удалить недействительные приглашения",
+  "txt_delete_invite": "Удалить приглашение",
+  "txt_delete_invite_confirm_message": "Удалить этот пригласительный код? Это действие нельзя отменить.",
+  "txt_delete_invite_failed": "Не удалось удалить приглашение",
   "txt_invite_code_required": "Пригласительный код (обязательно)",
   "txt_invite_created": "Приглашение создано",
+  "txt_invite_deleted": "Приглашение удалено",
+  "txt_invalid_invites_deleted": "Недействительные приглашения удалены",
   "txt_invite_revoked": "Приглашение отозвано",
   "txt_revoke_invite_failed": "Не удалось отозвать приглашение",
   "txt_invite_validity_hours": "Срок действия приглашения (часы)",
@@ -1156,7 +1165,9 @@ const ru: Record<string, string> = {
   "txt_log_action_admin_backup_settings_repair": "Repair backup settings",
   "txt_log_action_admin_backup_settings_update": "Update backup settings",
   "txt_log_action_admin_invite_create": "Create invite",
+  "txt_log_action_admin_invite_delete": "Delete invite",
   "txt_log_action_admin_invite_delete_all": "Clear invites",
+  "txt_log_action_admin_invite_delete_invalid": "Delete invalid invites",
   "txt_log_action_admin_invite_revoke": "Revoke invite",
   "txt_log_action_admin_user_delete": "Delete user",
   "txt_log_action_admin_user_status": "Change user status",

webapp/src/lib/i18n/locales/zh-CN.ts

@@ -582,8 +582,17 @@ const zhCN: Record<string, string> = {
   "txt_identity_details": "身份详情",
   "txt_ie_browser": "IE 浏览器",
   "txt_create_invite_failed": "创建邀请码失败",
+  "txt_delete_invalid": "删除无效",
+  "txt_delete_invalid_invites": "删除无效邀请码",
+  "txt_delete_invalid_invites_confirm_message": "确定删除所有无效邀请码吗？仍有效且未过期的邀请码会保留。",
+  "txt_delete_invalid_invites_failed": "删除无效邀请码失败",
+  "txt_delete_invite": "删除邀请码",
+  "txt_delete_invite_confirm_message": "确定删除该邀请码吗？删除后无法恢复。",
+  "txt_delete_invite_failed": "删除邀请码失败",
   "txt_invite_code_required": "邀请码（必填）",
   "txt_invite_created": "邀请码已创建",
+  "txt_invite_deleted": "邀请码已删除",
+  "txt_invalid_invites_deleted": "无效邀请码已删除",
   "txt_invite_revoked": "邀请码已撤销",
   "txt_revoke_invite_failed": "撤销邀请码失败",
   "txt_invite_validity_hours": "邀请码有效期（小时）",
@@ -1156,7 +1165,9 @@ const zhCN: Record<string, string> = {
   "txt_log_action_admin_backup_settings_repair": "修复备份设置",
   "txt_log_action_admin_backup_settings_update": "更新备份设置",
   "txt_log_action_admin_invite_create": "创建邀请",
+  "txt_log_action_admin_invite_delete": "删除邀请",
   "txt_log_action_admin_invite_delete_all": "清空邀请",
+  "txt_log_action_admin_invite_delete_invalid": "删除无效邀请",
   "txt_log_action_admin_invite_revoke": "撤销邀请",
   "txt_log_action_admin_user_delete": "删除用户",
   "txt_log_action_admin_user_status": "修改用户状态",

webapp/src/lib/i18n/locales/zh-TW.ts

@@ -582,8 +582,17 @@ const zhTW: Record<string, string> = {
   "txt_identity_details": "身份詳情",
   "txt_ie_browser": "IE 瀏覽器",
   "txt_create_invite_failed": "創建邀請碼失敗",
+  "txt_delete_invalid": "刪除無效",
+  "txt_delete_invalid_invites": "刪除無效邀請碼",
+  "txt_delete_invalid_invites_confirm_message": "確定刪除所有無效邀請碼嗎？仍有效且未過期的邀請碼會保留。",
+  "txt_delete_invalid_invites_failed": "刪除無效邀請碼失敗",
+  "txt_delete_invite": "刪除邀請碼",
+  "txt_delete_invite_confirm_message": "確定刪除此邀請碼嗎？刪除後無法復原。",
+  "txt_delete_invite_failed": "刪除邀請碼失敗",
   "txt_invite_code_required": "邀請碼（必填）",
   "txt_invite_created": "邀請碼已創建",
+  "txt_invite_deleted": "邀請碼已刪除",
+  "txt_invalid_invites_deleted": "無效邀請碼已刪除",
   "txt_invite_revoked": "邀請碼已撤銷",
   "txt_revoke_invite_failed": "撤銷邀請碼失敗",
   "txt_invite_validity_hours": "邀請碼有效期（小時）",
@@ -1156,7 +1165,9 @@ const zhTW: Record<string, string> = {
   "txt_log_action_admin_backup_settings_repair": "修復備份設定",
   "txt_log_action_admin_backup_settings_update": "更新備份設定",
   "txt_log_action_admin_invite_create": "建立邀請",
+  "txt_log_action_admin_invite_delete": "刪除邀請",
   "txt_log_action_admin_invite_delete_all": "清空邀請",
+  "txt_log_action_admin_invite_delete_invalid": "刪除無效邀請",
   "txt_log_action_admin_invite_revoke": "撤銷邀請",
   "txt_log_action_admin_user_delete": "刪除使用者",
   "txt_log_action_admin_user_status": "修改使用者狀態",

webapp/src/lib/import-formats-browser.ts

@@ -1,6 +1,102 @@
 import type { CiphersImportPayload } from '@/lib/api/vault';
 import { addFolder, cardBrand, makeLoginCipher, nameFromUrl, normalizeUri, parseCsv, parseSerializedUris, processKvp, txt, val } from '@/lib/import-format-shared';
 
+type BitwardenCsvFieldLine = {
+  key: string;
+  value: string;
+};
+
+const NODEWARDEN_CSV_TYPE_FIELD = 'nodewardenType';
+const NODEWARDEN_CSV_PREFIX_TYPES: Record<string, number> = {
+  card: 3,
+  identity: 4,
+  sshkey: 5,
+};
+const NODEWARDEN_CSV_TYPE_PREFIXES: Record<number, 'card' | 'identity' | 'sshKey'> = {
+  3: 'card',
+  4: 'identity',
+  5: 'sshKey',
+};
+const NODEWARDEN_CSV_OBJECT_FIELDS: Record<'card' | 'identity' | 'sshKey', readonly string[]> = {
+  card: ['cardholderName', 'brand', 'number', 'expMonth', 'expYear', 'code'],
+  identity: [
+    'title',
+    'firstName',
+    'middleName',
+    'lastName',
+    'username',
+    'company',
+    'ssn',
+    'passportNumber',
+    'licenseNumber',
+    'email',
+    'phone',
+    'address1',
+    'address2',
+    'address3',
+    'city',
+    'state',
+    'postalCode',
+    'country',
+  ],
+  sshKey: ['privateKey', 'publicKey', 'keyFingerprint', 'fingerprint'],
+};
+
+function parseBitwardenCsvFieldLines(rawFields: unknown): BitwardenCsvFieldLine[] {
+  return String(rawFields || '')
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => {
+      const delim = line.lastIndexOf(': ');
+      if (delim < 0) return null;
+      const key = txt(line.slice(0, delim));
+      const value = txt(line.slice(delim + 2));
+      return key && value ? { key, value } : null;
+    })
+    .filter((line): line is BitwardenCsvFieldLine => !!line);
+}
+
+function getNodeWardenCsvType(lines: BitwardenCsvFieldLine[]): number | null {
+  const typeLine = lines.find((line) => line.key === NODEWARDEN_CSV_TYPE_FIELD);
+  const normalized = txt(typeLine?.value).toLowerCase().replace(/[\s_-]+/g, '');
+  const type = NODEWARDEN_CSV_PREFIX_TYPES[normalized] ?? null;
+  if (!type) return null;
+  const prefix = NODEWARDEN_CSV_TYPE_PREFIXES[type];
+  return lines.some((line) => line.key.startsWith(`${prefix}.`)) ? type : null;
+}
+
+function applyBitwardenCustomFields(cipher: Record<string, unknown>, lines: BitwardenCsvFieldLine[]): void {
+  for (const line of lines) {
+    processKvp(cipher, line.key, line.value, false);
+  }
+}
+
+function restoreNodeWardenObject(lines: BitwardenCsvFieldLine[], prefix: 'card' | 'identity' | 'sshKey'): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  const fieldPrefix = `${prefix}.`;
+  const allowedKeys = new Set(NODEWARDEN_CSV_OBJECT_FIELDS[prefix]);
+  for (const line of lines) {
+    if (!line.key.startsWith(fieldPrefix)) continue;
+    const key = line.key.slice(fieldPrefix.length);
+    if (!allowedKeys.has(key)) continue;
+    out[key] = line.value;
+  }
+  return out;
+}
+
+function nodeWardenMetadataLines(lines: BitwardenCsvFieldLine[]): Set<BitwardenCsvFieldLine> {
+  return new Set(
+    lines.filter(
+      (line) =>
+        line.key === NODEWARDEN_CSV_TYPE_FIELD ||
+        line.key.startsWith('card.') ||
+        line.key.startsWith('identity.') ||
+        line.key.startsWith('sshKey.')
+    )
+  );
+}
+
 export function parseChromeCsv(textRaw: string): CiphersImportPayload {
   const rows = parseCsv(textRaw);
   const result: CiphersImportPayload = { ciphers: [], folders: [], folderRelationships: [] };
@@ -62,19 +158,33 @@ export function parseSafariCsv(textRaw: string): CiphersImportPayload {
 export function parseBitwardenCsv(textRaw: string): CiphersImportPayload {
   const rows = parseCsv(textRaw);
   const result: CiphersImportPayload = { ciphers: [], folders: [], folderRelationships: [] };
-  const applyBitwardenCustomFields = (cipher: Record<string, unknown>, rawFields: unknown) => {
-    const lines = String(rawFields || '')
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter(Boolean);
-    for (const line of lines) {
-      const delim = line.lastIndexOf(': ');
-      if (delim < 0) continue;
-      processKvp(cipher, line.slice(0, delim), line.slice(delim + 2), false);
-    }
-  };
   for (const row of rows) {
     const type = txt(row.type).toLowerCase() || 'login';
+    const fieldLines = parseBitwardenCsvFieldLines(row.fields);
+    const restoredNodeWardenType = type === 'note' ? getNodeWardenCsvType(fieldLines) : null;
+    if (restoredNodeWardenType === 3 || restoredNodeWardenType === 4 || restoredNodeWardenType === 5) {
+      const metadataLines = nodeWardenMetadataLines(fieldLines);
+      const customLines = fieldLines.filter((line) => !metadataLines.has(line));
+      const cipher: Record<string, unknown> = {
+        type: restoredNodeWardenType,
+        name: val(row.name, '--'),
+        notes: val(row.notes),
+        favorite: txt(row.favorite) === '1',
+        reprompt: Number(row.reprompt ?? 0) || 0,
+        key: null,
+        login: null,
+        card: restoredNodeWardenType === 3 ? restoreNodeWardenObject(fieldLines, 'card') : null,
+        identity: restoredNodeWardenType === 4 ? restoreNodeWardenObject(fieldLines, 'identity') : null,
+        secureNote: null,
+        fields: [],
+        passwordHistory: null,
+        sshKey: restoredNodeWardenType === 5 ? restoreNodeWardenObject(fieldLines, 'sshKey') : null,
+      };
+      applyBitwardenCustomFields(cipher, customLines);
+      const idx = result.ciphers.push(cipher) - 1;
+      addFolder(result, row.folder, idx);
+      continue;
+    }
     if (type === 'note' || type === 'secure note' || type === 'securenote') {
       const cipher = {
         type: 2,
@@ -91,7 +201,7 @@ export function parseBitwardenCsv(textRaw: string): CiphersImportPayload {
         passwordHistory: null,
         sshKey: null,
       };
-      applyBitwardenCustomFields(cipher, row.fields);
+      applyBitwardenCustomFields(cipher, fieldLines);
       const idx = result.ciphers.push(cipher) - 1;
       addFolder(result, row.folder, idx);
       continue;
@@ -101,7 +211,7 @@ export function parseBitwardenCsv(textRaw: string): CiphersImportPayload {
     cipher.notes = val(row.notes);
     cipher.favorite = txt(row.favorite) === '1';
     cipher.reprompt = Number(row.reprompt ?? 0) || 0;
-    applyBitwardenCustomFields(cipher, row.fields);
+    applyBitwardenCustomFields(cipher, fieldLines);
     const login = cipher.login as Record<string, unknown>;
     login.username = val(row.login_username, val(row.username));
     login.password = val(row.login_password, val(row.password));

webapp/src/styles/forms.css

@@ -172,6 +172,10 @@ input[type='file'].input::file-selector-button:hover {
   @apply shrink-0;
 }
 
+.btn-icon-spin {
+  animation: spin 0.9s linear infinite;
+}
+
 .btn.full {
   @apply my-2.5 h-12 w-full;
   font-size: var(--font-md);