app: rebuild the explorer from scratch as a portfolio-first app

.dockerignore

@@ -0,0 +1,18 @@
+# Never send local credentials or build output into the image: anything
+# here would be readable in the builder stage and its cache. Build-time
+# config comes in as --build-arg (see Dockerfile).
+.env
+.env.*
+!.env.example
+*.pem
+.git
+.github
+.next
+node_modules
+.pnpm-store
+.vercel
+.claude
+.playwright-mcp
+coverage
+*.tsbuildinfo
+.DS_Store

.env.example

@@ -1,19 +1,30 @@
-CHANGEFEED_ACCESS_TOKEN=
-GITHUB_ACCESS_TOKEN=
-LIVEPEER_COM_API_ADMIN_TOKEN=
-PINATA_JWT=
+# Subgraph. With a Graph API key, queries go through The Graph's gateway to
+# the published subgraph's latest version (lib/config.ts); restrict the key
+# to your domains in Subgraph Studio, since it's used from the browser.
+# Without one, the rate-limited Studio URL is used (fine for local dev).
+NEXT_PUBLIC_SUBGRAPH_API_KEY=
+# Optional: pin one version by deployment id (Qm…), or a whole endpoint URL.
+NEXT_PUBLIC_SUBGRAPH_DEPLOYMENT=
+NEXT_PUBLIC_SUBGRAPH_ENDPOINT=
 
-NEXT_PUBLIC_GA_TRACKING_ID=
-NEXT_PUBLIC_NETWORK=ARBITRUM_ONE
+# RPC. Public endpoints are used when these are empty.
 NEXT_PUBLIC_INFURA_KEY=
 NEXT_PUBLIC_L1_RPC_URL=
 NEXT_PUBLIC_L2_RPC_URL=
-NEXT_PUBLIC_GITHUB_LIP_NAMESPACE=adamsoffer
-NEXT_PUBLIC_SUBGRAPH_API_KEY=
-NEXT_PUBLIC_SUBGRAPH_ID=FE63YgkzcpVocxdCEyEYbvjYqEf2kb1A6daMYRxmejYC
-NEXT_PUBLIC_WALLET_CONNECT_PROJECT_ID=
-NEXT_PUBLIC_METRICS_SERVER_URL=https://leaderboard-serverless.vercel.app
-NEXT_PUBLIC_AI_METRICS_SERVER_URL=https://leaderboard-api.livepeer.cloud
 
-# Optional dev overrides (e.g. Graph Studio sandbox; leave empty in prod)
-NEXT_PUBLIC_SUBGRAPH_ENDPOINT=
+# Reown (formerly WalletConnect) project ID, from cloud.reown.com. Each domain
+# the app runs on must be on that project's allowlist.
+NEXT_PUBLIC_REOWN_PROJECT_ID=
+
+# Public URL of this deployment, e.g. https://explorer.livepeer.org. Used for
+# absolute share-image URLs. Optional on Vercel when system environment
+# variables are exposed; otherwise links preview without an image.
+SITE_URL=
+
+# Creating LIP polls: the explorer pins the LIP's text to IPFS through Pinata
+# before the poll is created on-chain. Without it, poll creation is disabled.
+PINATA_JWT=
+
+# Optional: raises GitHub's rate limit when reading the LIPs repository.
+GITHUB_ACCESS_TOKEN=
+

.github/dependabot.yml

@@ -21,9 +21,20 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    # Same wait as npm: a hijacked action tag is the same kind of attack.
+    cooldown:
+      default-days: 7
     # One combined PR; action majors are routine tag moves and CI
     # validates the grouped PR anyway.
     groups:
       actions:
         patterns:
           - "*"
+
+  # Lighthouse CI is locked on its own, away from the app's install.
+  - package-ecosystem: npm
+    directory: /tools/lhci
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -4,6 +4,13 @@ on:
   pull_request:
     branches: ['*']
 
+# Least privilege: jobs only read the repo unless they say otherwise.
+permissions:
+  contents: read
+
+# Actions are pinned to full commit SHAs (the tag each was at is noted), so
+# a moved tag can't swap in different code. Update them deliberately.
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest
@@ -15,16 +22,18 @@ jobs:
 
     steps:
       - name: ⬇️ Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: 📦 Install pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 10.33.0
           run_install: false
 
       - name: 🟢 Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: pnpm
@@ -41,11 +50,10 @@ jobs:
       - name: 🧪 Run tests
         run: pnpm test
 
-      # Fails on known critical advisories in production dependencies.
-      # Tighten to `high` once the remaining high (sharp, pinned by next)
-      # clears upstream.
+      # Fails on known high or critical advisories in production
+      # dependencies.
       - name: 🔒 Audit production dependencies
-        run: pnpm audit --prod --audit-level=critical
+        run: pnpm audit --prod --audit-level=high
 
   # Fails the PR if it introduces a dependency with a known vulnerability.
   dependency-review:
@@ -54,9 +62,11 @@ jobs:
       contents: read
     steps:
       - name: ⬇️ Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: 🔍 Review dependency changes
-        uses: actions/dependency-review-action@v5
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
           fail-on-severity: high

.github/workflows/lighthouse-vercel-preview.yml

@@ -14,17 +14,20 @@ jobs:
     timeout-minutes: 25
 
     steps:
+      # Actions pinned to full commit SHAs, the tag noted beside each.
       - name: ⬇️ Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: 🟢 Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
 
       - name: 🔎 Wait for Vercel Deployment + grab Preview URL
         id: vercel
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -68,22 +71,28 @@ jobs:
             throw new Error("Timed out waiting for Vercel preview deployment URL.");
 
       - name: 📦 Install pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 10.33.0
           run_install: false
 
+      # Lighthouse CI lives in its own locked project, so its dependencies
+      # are the ones in tools/lhci/pnpm-lock.yaml and the app's are not
+      # installed in this job.
+      - name: 📥 Install Lighthouse CI
+        run: pnpm --dir tools/lhci install --frozen-lockfile --ignore-workspace
+
       - name: 🔎 Run Lighthouse CI against Vercel Preview
         env:
           PREVIEW_URL: ${{ steps.vercel.outputs.preview_url }}
         run: |
           echo "Running Lighthouse CI on: $PREVIEW_URL"
-          pnpm dlx @lhci/cli collect --config=./.lighthouserc.json \
+          pnpm --dir tools/lhci exec lhci collect --config="$GITHUB_WORKSPACE/.lighthouserc.json" \
             --url="$PREVIEW_URL/" \
             --url="$PREVIEW_URL/orchestrators" \
-            --url="$PREVIEW_URL/leaderboard" \
-            --url="$PREVIEW_URL/transactions" \
-            --url="$PREVIEW_URL/voting" \
-            --url="$PREVIEW_URL/treasury"
-          pnpm dlx @lhci/cli assert  --config=./.lighthouserc.json
-          pnpm dlx @lhci/cli upload  --config=./.lighthouserc.json --target=temporary-public-storage
+            --url="$PREVIEW_URL/network" \
+            --url="$PREVIEW_URL/activity" \
+            --url="$PREVIEW_URL/governance" \
+            --url="$PREVIEW_URL/gateways"
+          pnpm --dir tools/lhci exec lhci assert --config="$GITHUB_WORKSPACE/.lighthouserc.json"
+          pnpm --dir tools/lhci exec lhci upload --config="$GITHUB_WORKSPACE/.lighthouserc.json" --target=temporary-public-storage

.gitignore

@@ -1,7 +1,7 @@
 # See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
 
 # dependencies
-/node_modules
+node_modules
 /.pnp
 .pnp.js
 

.prettierignore

@@ -14,10 +14,6 @@ node_modules
 .github
 .vscode
 .playwright-mcp
-@types
-apollo
-codegen.yml
-data
 next-env.d.ts
 pnpm-lock.yaml
 public

AGENTS.md

@@ -0,0 +1,9 @@
+<!-- BEGIN:nextjs-agent-rules -->
+
+# This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->

CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

CONTRIBUTING.md

@@ -18,7 +18,20 @@ If you find an issue you want to work on, follow the Commits and Pull Request in
 
 ### Commits
 
-As best as possible, try to follow [Conventional Commits v1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) patterns.
+Start the subject with the area of the app it touches, then a short summary in the imperative:
+
+```text
+orchestrators: rank by expected yield
+wallet: resume the action once the right account connects
+network, docs: explain what the sparklines cover
+```
+
+- **Area:** lowercase, naming the part of the app, such as `portfolio`, `orchestrators`, `gateways`, `governance`, `network`, `wallet`, `shell`, `ui`, `data`, `build` or `docs`. Separate two with a comma, and use `app` for changes across the whole app.
+- **Summary:** lowercase and imperative ("add", not "added" or "adds"), with no trailing period. Keep the whole subject under 72 characters.
+- **Body:** wrapped at 72 characters. Explain why and anything that isn't obvious from the diff, rather than listing files.
+- **One logical change per commit,** each building and passing tests.
+
+PRs are squash-merged, so the PR title becomes the commit on `main`: write it the same way.
 
 ### Code Conventions
 
@@ -29,6 +42,10 @@ Additional conventions, not yet enforced at the time of writing, include:
 
 Write JSDoc for all functions and methods in classes unless you have a good reason not to (e.g., NextJS route or page components). At minimum, include a general description of the functionality.
 
+#### Lighthouse
+
+CI runs Lighthouse CI against each Vercel preview, installed from `tools/lhci` so it stays out of the app's dependencies. To check a page yourself, use the Lighthouse tab in Chrome DevTools or `pnpm dlx lighthouse <url>`.
+
 ### Pull Requests
 
 In general, PRs should:

Dockerfile

@@ -2,38 +2,23 @@ FROM node:24 AS builder
 WORKDIR /app
 RUN corepack enable
 
-ARG CHANGEFEED_ACCESS_TOKEN
-ARG GITHUB_ACCESS_TOKEN
-ARG LIVEPEER_COM_API_ADMIN_TOKEN
-ARG PINATA_JWT
-ARG NEXT_PUBLIC_GA_TRACKING_ID
-ARG NEXT_PUBLIC_NETWORK=ARBITRUM_ONE
+ARG NEXT_PUBLIC_SUBGRAPH_ENDPOINT
+ARG NEXT_PUBLIC_SUBGRAPH_API_KEY
+ARG NEXT_PUBLIC_SUBGRAPH_DEPLOYMENT
 ARG NEXT_PUBLIC_INFURA_KEY
 ARG NEXT_PUBLIC_L1_RPC_URL
 ARG NEXT_PUBLIC_L2_RPC_URL
-ARG NEXT_PUBLIC_GITHUB_LIP_NAMESPACE=adamsoffer
-ARG NEXT_PUBLIC_SUBGRAPH_API_KEY
-ARG NEXT_PUBLIC_SUBGRAPH_ID
-ARG NEXT_PUBLIC_WALLET_CONNECT_PROJECT_ID
-ARG NEXT_PUBLIC_METRICS_SERVER_URL=https://leaderboard-serverless.vercel.app
-ARG NEXT_PUBLIC_AI_METRICS_SERVER_URL=https://leaderboard-api.livepeer.cloud
+ARG NEXT_PUBLIC_REOWN_PROJECT_ID
+ARG SITE_URL
 
-# Step 5: Create .env file with substituted values
-RUN echo "CHANGEFEED_ACCESS_TOKEN=${CHANGEFEED_ACCESS_TOKEN}" >> .env && \
-    echo "GITHUB_ACCESS_TOKEN=${GITHUB_ACCESS_TOKEN}" >> .env && \
-    echo "LIVEPEER_COM_API_ADMIN_TOKEN=${LIVEPEER_COM_API_ADMIN_TOKEN}" >> .env && \
-    echo "PINATA_JWT=${PINATA_JWT}" >> .env && \
-    echo "NEXT_PUBLIC_GA_TRACKING_ID=${NEXT_PUBLIC_GA_TRACKING_ID}" >> .env && \
-    echo "NEXT_PUBLIC_NETWORK=${NEXT_PUBLIC_NETWORK}" >> .env && \
-    echo "NEXT_PUBLIC_INFURA_KEY=${NEXT_PUBLIC_INFURA_KEY}" >> .env && \
-    echo "NEXT_PUBLIC_L1_RPC_URL=${NEXT_PUBLIC_L1_RPC_URL}" >> .env && \
-    echo "NEXT_PUBLIC_L2_RPC_URL=${NEXT_PUBLIC_L2_RPC_URL}" >> .env && \
-    echo "NEXT_PUBLIC_GITHUB_LIP_NAMESPACE=${NEXT_PUBLIC_GITHUB_LIP_NAMESPACE}" >> .env && \
-    echo "NEXT_PUBLIC_SUBGRAPH_API_KEY=${NEXT_PUBLIC_SUBGRAPH_API_KEY}" >> .env && \
-    echo "NEXT_PUBLIC_SUBGRAPH_ID=${NEXT_PUBLIC_SUBGRAPH_ID}" >> .env && \
-    echo "NEXT_PUBLIC_WALLET_CONNECT_PROJECT_ID=${NEXT_PUBLIC_WALLET_CONNECT_PROJECT_ID}" >> .env && \
-    echo "NEXT_PUBLIC_METRICS_SERVER_URL=${NEXT_PUBLIC_METRICS_SERVER_URL}" >> .env && \
-    echo "NEXT_PUBLIC_AI_METRICS_SERVER_URL=${NEXT_PUBLIC_AI_METRICS_SERVER_URL}" >> .env
+ENV NEXT_PUBLIC_SUBGRAPH_ENDPOINT=${NEXT_PUBLIC_SUBGRAPH_ENDPOINT} \
+    NEXT_PUBLIC_SUBGRAPH_API_KEY=${NEXT_PUBLIC_SUBGRAPH_API_KEY} \
+    NEXT_PUBLIC_SUBGRAPH_DEPLOYMENT=${NEXT_PUBLIC_SUBGRAPH_DEPLOYMENT} \
+    NEXT_PUBLIC_INFURA_KEY=${NEXT_PUBLIC_INFURA_KEY} \
+    NEXT_PUBLIC_L1_RPC_URL=${NEXT_PUBLIC_L1_RPC_URL} \
+    NEXT_PUBLIC_L2_RPC_URL=${NEXT_PUBLIC_L2_RPC_URL} \
+    NEXT_PUBLIC_REOWN_PROJECT_ID=${NEXT_PUBLIC_REOWN_PROJECT_ID} \
+    SITE_URL=${SITE_URL}
 
 COPY . .
 RUN pnpm install --frozen-lockfile && pnpm run build