From fea69fb6547bb94b834569f4350744ea13f1efbc Mon Sep 17 00:00:00 2001
From: Mathieu Piton <27002047+mpiton@users.noreply.github.com>
Date: Thu, 30 Apr 2026 17:14:07 +0200
Subject: [PATCH 1/5] feat(ui): keyboard-accessible
 move-download-between-packages (#134)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a keyboard-driven and screen-reader-friendly alternative to the
pointer-only HTML5 drag-and-drop introduced for moving downloads
between packages in PR #133.

- PackageDownloadRow: new "Move…" / "Cancel move" toggle button +
  aria-grabbed on the row.
- PackageRow: "Move selected here" target action + aria-dropeffect
  on the dropzone (source package excluded).
- PackagesView: shared moveDownloadBetweenPackages helper, pendingMove
  state, and a visually-hidden role="status" aria-live="polite" live
  region for selected/started/success/cancelled/error announcements.
- Pointer drag-and-drop path unchanged.
- New i18n keys (EN + FR) under packages.move.*.
- Five new Vitest tests cover all four AC from #134.
---
 CHANGELOG.md                                  |   2 +
 src/i18n/locales/en.json                      |  16 +++
 src/i18n/locales/fr.json                      |  16 +++
 src/views/PackagesView/PackageDownloadRow.tsx |  33 ++++-
 src/views/PackagesView/PackageRow.tsx         |  34 +++++
 src/views/PackagesView/PackageTree.tsx        |   9 +-
 src/views/PackagesView/PackagesView.tsx       | 108 ++++++++++++---
 .../__tests__/PackagesView.test.tsx           | 127 ++++++++++++++++++
 8 files changed, 328 insertions(+), 17 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9ab46c..59b833f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **Keyboard-accessible move-download-between-packages** (issue #134, PR #133 follow-up): the pointer-only HTML5 drag-and-drop introduced for moving downloads between packages now has a fully keyboard-driven and screen-reader-friendly alternative. Each `PackageDownloadRow` exposes a new `Move…` button (toggles to `Cancel move` while a selection is active) that marks the download as pending-move and sets `aria-grabbed="true"` on the source row. Once a download is selected, every other `PackageRow` (the source package is intentionally excluded) surfaces a `Move selected here` action and its dropzone wrapper gains `aria-dropeffect="move"`. Activating the target reuses the same `package_remove_download` + `package_add_download` IPC pair as the drag-and-drop path (now factored into a shared `moveDownloadBetweenPackages` helper so the rollback logic stays in one place) and surfaces start / success / cancel / error transitions through a new visually-hidden `role="status" aria-live="polite"` live region (`packages-move-live-region`). The drag-and-drop path is unchanged. New i18n keys `packages.move.{start,startAriaLabel,cancel,cancelAriaLabel,target,targetAriaLabel,liveRegionLabel,announce.{selected,cancelled,started,success,error}}` ship in EN + FR. Five new Vitest tests cover the four issue acceptance criteria: keyboard initiation without a pointer (`Move` button → aria-grabbed flips), correct ARIA semantics (target rows expose `aria-dropeffect="move"`, source row stays hidden), live region announcements (selected / success / cancelled / error wording), unchanged pointer drag-and-drop (existing test still green), and Vitest coverage of the new flow.
+
 - **Auto-grouping playlist → package** (PRD §6.3, PRD-v2 §P1.11, task 30): when the Link Grabber resolves a YouTube or SoundCloud playlist URL, every selected item is now auto-attached to a single `Package` per playlist. New `PlaylistGrouper` application service (`src-tauri/src/application/services/playlist_grouper.rs`) finds-or-creates a `Package` keyed by the new `external_id` natural key (the playlist URL acts as the natural id), so re-resolving the same playlist reuses the existing package instead of creating a duplicate. New `GroupPlaylistsCommand` handler (`group_playlists.rs`) routes the request through the grouper; new `link_group_playlists` Tauri IPC command (`PlaylistGroupInputDto` → `Vec<PlaylistGroupResultDto>`) lets the frontend orchestrate the group-then-attach flow. Migration `m20260430_000008_add_package_external_id` adds `packages.external_id TEXT NULL` plus the `idx_packages_external_id` index; the column is intentionally nullable (manual packages keep `NULL`) and the application layer enforces uniqueness through `find_by_external_id` rather than a DB UNIQUE constraint that would forbid more than one manual row. Domain `Package` aggregate gains an `external_id: Option<String>` field with `set_external_id` and `external_id()` accessors; `PackageRepository::find_by_external_id` is added to the trait, returning the oldest row by `(created_at, id)` so repeated reuses pick the same package deterministically. The `MediaGrabberDialog` now shows a `PlaylistPackageBanner` ("Will create package: {name} with {N} items" / "Will reuse existing package …") above the playlist item list once `metadata.isPlaylist` is true, with EN + FR plural translations under `mediaGrabber.playlistBanner.*`. `LinkGrabberView.handleMediaGrabberConfirm` now calls `link_group_playlists` first when the user has selected playlist items, then `download_media_start`, then attaches every returned `downloadId` to the package via `package_add_download` (failures on attach are non-fatal — downloads still run, only the grouping is missed). Visibility of `application::commands::tests_support` is bumped to `pub(crate)` so the new `playlist_grouper` and `group_playlists` tests can reuse the existing `InMemoryPackageRepo` / `CapturingEventBus` mocks. 13 new tests cover the four acceptance criteria: 7 unit tests on `PlaylistGrouper` (create / reuse / blank id / fallback name / batch / partial failure / trim), 5 SQLite tests on `find_by_external_id` (round-trip / match / not-found / no NULL match / oldest-on-duplicates / clear-on-upsert), 3 handler tests, 4 frontend tests on `PlaylistPackageBanner`. cargo test 1327 passing, vitest 626 passing, clippy + fmt clean. Unblocks the Link Grabber's playlist UX.
 - **Packages view** (PRD §6.3, PRD-v2 §P1.10, task 29): full Packages management UI replacing the previous `PlaceholderView`. New `src/views/PackagesView/` folder with `PackagesView` (root), `PackageToolbar` (filter chips `All / Container / Playlist / Manual / Split archive` + debounced search input + "New package" trigger), `PackageTree` (empty state + list of `PackageRow`), `PackageRow` (chevron toggle, inline rename trigger, source-type badge, file count via `_one`/`_other` plural keys, total bytes via `formatBytes`, aggregated `Progress` bar, folder browse button, `Key` password trigger, `Switch` for auto-extract, native `<select>` 1-10 priority, Pause-all / Start-all / Delete buttons), `PackageDownloadRow` (HTML5 native draggable child row with state badge + size + speed + ETA + per-row progress) and `PackageDialogs` (`AddPackageDialog`, `RenamePackageDialog`, `PasswordDialog` with `type="password"`, `FolderDialog` with `tauri-plugin-dialog` directory picker, `DeletePackageDialog` with optional "also delete child downloads" checkbox). New `src/types/package.ts` mirrors `PackageViewDto` (camelCase, no password field) plus `PackagePatch` / `PackageListFilter` / `CreatePackageInput` / `PackageMoveOutcome`. New `src/hooks/usePackagesQuery.ts` exposes `usePackagesQuery(filter?)` (TanStack Query, 30 s `staleTime`, forwards `sourceType` + `nameQ` to `package_list`) and `usePackageDownloadsQuery(packageId | null)` (lazy via `enabled`, 10 s `staleTime`, calls `package_list_downloads`). New `packageQueries` cache-key factory in `src/api/queries.ts` with `lists()` / `list(filter)` / `details()` / `detail(id)` / `downloads(id)` so mutations can target the right slice. The view wires every command from task 27: `package_create`, `package_update` (rename), `package_set_password` (keyring-only — UI never echoes the stored secret back), `package_set_priority`, `package_move_to_folder` (toast announces the count of moved children from `PackageMoveOutcome.moved.length`), `package_toggle_auto_extract`, `package_delete` (confirmation dialog with `deleteDownloads` boolean), `package_add_download` and `package_remove_download` (drag-and-drop pairing). Drag-and-drop uses native `dataTransfer` (no external lib): `PackageDownloadRow` sets `application/x-vortex-download` (id) + `application/x-vortex-source-package` (origin id) on `dragstart`; `PackageRow` registers itself as a drop zone via `data-testid="package-row-{id}-dropzone"` and the View's `dropDownload` handler short-circuits when `from === to`, parses the numeric id, calls `package_remove_download` then `package_add_download`, surfaces `moveDownloadSuccess` / `moveDownloadError` toasts, and invalidates the package cache. Bulk Pause-all / Start-all fans out the existing `download_pause` / `download_resume` IPC over `Promise.allSettled` for every member returned by `package_list_downloads`, then surfaces a single success toast or `bulkActionError` if any leg failed. Filter chips and the 300 ms debounced search (`useDebouncedValue`) re-key the `usePackagesQuery` so the round-trip happens server-side via `package_list { sourceType?, nameQ? }`; an empty filter object is collapsed to `undefined` so the SQL path takes the no-filter branch. Component boundary stays at 2 levels (View → Tree → Row) to honour the project's prop-drilling rule — dialogs are mounted at the View level and receive only the active target via state. New i18n namespace `packages.*` adds 60+ keys covering title / loading / empty / search placeholder / filter labels / row controls / dialog copy (Add / Rename / Password / Folder / Delete) / drag aria-labels / toast messages, with mirrored EN + FR translations and `_one` / `_other` plural variants for the file-count badge. `useTauriMutation`'s `invalidateKeys` array invalidates `packageQueries.all()` on every mutation; commands that touch downloads (`package_delete`, `package_move_to_folder`) additionally invalidate `downloadQueries.all()` so the main downloads list reflects the cascade. The legacy `src/views/PackagesView.tsx` placeholder file becomes a single-line re-export of the new folder, preserving every existing import path. The french translations test (`issue30-ui-fr.test.tsx`) is updated: `PackagesView` is no longer asserted as a placeholder; a new dedicated case asserts the FR header (`Paquets`) and search placeholder (`Rechercher des paquets`) render correctly with a real `QueryClientProvider`. 16 new Vitest tests cover the six acceptance criteria (tree expand/collapse, auto-extract toggle, masked password dialog, drag-and-drop FK update, ≥80 % coverage, ≤2-level prop drilling) plus filter chips, debounced search, dialog flows, fan-out bulk actions and the error state. Coverage on `src/views/PackagesView/`: 87.28 % statements / 90.07 % lines / 79.59 % functions — above the 80 % frontend threshold.
 - **Packages queries** (PRD §6.3, PRD-v2 §P1.9, task 28): three CQRS query handlers (`list_packages`, `get_package`, `list_package_downloads`) wired through the `QueryBus` builder via a new `with_package_read_repo` setter. New driven port `PackageReadRepository` (`find_packages` / `find_package_by_id` / `find_package_downloads`) and `SqlitePackageReadRepo` adapter compute every package statistic (`downloads_count`, `total_bytes`, `downloaded_bytes`, `progress_percent`, `all_completed`) in a single `LEFT JOIN packages → downloads` with `GROUP BY p.id` so listing N packages costs one round-trip instead of `N+1`. `PackageFilter { source_type?, name_q? }` AND-combines filters: `source_type` is an exact match against the lowercase wire form (`container` / `playlist` / `manual` / `split_archive`) and is delegated to the SQL `WHERE` clause, while `name_q` is a case-insensitive substring (`LOWER(p.name) LIKE %?%`) so the UI can fuzzy-search package titles. Blank / whitespace-only `name_q` is treated as "no filter" so the UI can blindly forward an empty input. Aggregate progress mirrors the per-download formula (`Completed` always reports 100 even when `downloaded < total`, unknown total reports 0, otherwise `downloaded / total * 100` rounded to 1 dp); `all_completed` flips to `true` only when the package has at least one member and every member is in the `Completed` state. New read model `PackageViewDto` (`#[serde(rename_all = "camelCase")]`) re-exposes the aggregated `PackageView` to the frontend with no password / credential reference field, by construction. `list_package_downloads(id)` reuses the existing `DownloadView` so the React layer can render member rows with the same component as the main downloads list. Three Tauri IPC commands (`package_list`, `package_get`, `package_list_downloads`) registered in `invoke_handler!` and re-exported from `lib.rs`; `package_list` validates an unknown `source_type` argument up-front so callers see "invalid package source type" instead of an empty result. The runtime now wires `SqlitePackageReadRepo` to the `QueryBus` via `with_package_read_repo`. Twenty-three new unit + integration tests cover the three acceptance criteria (SQL-side stats with no N+1, fuzzy `name_q`, in-memory SQLite fixtures): aggregate vs empty package, mixed-state aggregation, all-completed flip, unknown total treated as zero, deterministic ordering by `(created_at, id)`, exact `source_type` filter, case-insensitive substring `name_q`, AND combination, blank `name_q` ignored, missing-id `None`, member ordering by `queue_position` then `id`, no leak across packages, validation errors when the read repo is missing, and DTO camelCase + no-password serialization assertions. Unblocks task 29 (Vue Packages React).
diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json
index ad936d6..99abe0a 100644
--- a/src/i18n/locales/en.json
+++ b/src/i18n/locales/en.json
@@ -589,6 +589,22 @@
       "downloadHandleAriaLabel": "Drag download to another package",
       "dropZoneAriaLabel": "Drop downloads here"
     },
+    "move": {
+      "start": "Move…",
+      "startAriaLabel": "Mark {{name}} for move to another package",
+      "cancel": "Cancel move",
+      "cancelAriaLabel": "Cancel pending move of {{name}}",
+      "target": "Move selected here",
+      "targetAriaLabel": "Move selected download to {{name}}",
+      "liveRegionLabel": "Move status",
+      "announce": {
+        "selected": "Selected {{name}} for move. Choose a destination package.",
+        "cancelled": "Move cancelled",
+        "started": "Moving {{name}} to {{package}}…",
+        "success": "{{name}} moved to {{package}}",
+        "error": "Failed to move {{name}}"
+      }
+    },
     "toast": {
       "createSuccess": "Package created",
       "createError": "Failed to create package",
diff --git a/src/i18n/locales/fr.json b/src/i18n/locales/fr.json
index 7ab164c..0d2e4bb 100644
--- a/src/i18n/locales/fr.json
+++ b/src/i18n/locales/fr.json
@@ -589,6 +589,22 @@
       "downloadHandleAriaLabel": "Glisser le téléchargement vers un autre paquet",
       "dropZoneAriaLabel": "Déposer les téléchargements ici"
     },
+    "move": {
+      "start": "Déplacer…",
+      "startAriaLabel": "Marquer {{name}} pour déplacement vers un autre paquet",
+      "cancel": "Annuler le déplacement",
+      "cancelAriaLabel": "Annuler le déplacement en cours de {{name}}",
+      "target": "Déplacer la sélection ici",
+      "targetAriaLabel": "Déplacer le téléchargement sélectionné vers {{name}}",
+      "liveRegionLabel": "Statut du déplacement",
+      "announce": {
+        "selected": "{{name}} sélectionné pour déplacement. Choisissez un paquet de destination.",
+        "cancelled": "Déplacement annulé",
+        "started": "Déplacement de {{name}} vers {{package}}…",
+        "success": "{{name}} déplacé vers {{package}}",
+        "error": "Échec du déplacement de {{name}}"
+      }
+    },
     "toast": {
       "createSuccess": "Paquet créé",
       "createError": "Échec de la création du paquet",
diff --git a/src/views/PackagesView/PackageDownloadRow.tsx b/src/views/PackagesView/PackageDownloadRow.tsx
index a097d5b..fe21f19 100644
--- a/src/views/PackagesView/PackageDownloadRow.tsx
+++ b/src/views/PackagesView/PackageDownloadRow.tsx
@@ -1,5 +1,6 @@
 import { useTranslation } from "react-i18next";
-import { GripVertical } from "lucide-react";
+import { ArrowRightLeft, GripVertical, X } from "lucide-react";
+import { Button } from "@/components/ui/button";
 import { Progress } from "@/components/ui/progress";
 import { formatBytes, formatEta, formatSpeed } from "@/lib/format";
 import type { DownloadView } from "@/types/download";
@@ -7,21 +8,28 @@ import type { DownloadView } from "@/types/download";
 interface PackageDownloadRowProps {
   download: DownloadView;
   packageId: string;
+  isPendingMove: boolean;
   onDragStart: (download: DownloadView, fromPackageId: string) => void;
   onDragEnd: () => void;
+  onSelectForMove: (download: DownloadView, fromPackageId: string) => void;
+  onCancelMove: () => void;
 }
 
 export function PackageDownloadRow({
   download,
   packageId,
+  isPendingMove,
   onDragStart,
   onDragEnd,
+  onSelectForMove,
+  onCancelMove,
 }: PackageDownloadRowProps) {
   const { t } = useTranslation();
   return (
     <div
       data-testid={`package-download-row-${download.id}`}
       draggable
+      aria-grabbed={isPendingMove}
       onDragStart={(e) => {
         e.dataTransfer.effectAllowed = "move";
         e.dataTransfer.setData("application/x-vortex-download", download.id);
@@ -41,6 +49,29 @@ export function PackageDownloadRow({
       <span className="text-xs text-muted-foreground">{formatSpeed(download.speedBytesPerSec)}</span>
       <span className="text-xs text-muted-foreground">{formatEta(download.etaSeconds)}</span>
       <Progress value={download.progressPercent} className="h-1.5 w-32" />
+      {isPendingMove ? (
+        <Button
+          size="sm"
+          variant="outline"
+          data-testid={`package-download-row-${download.id}-move-cancel`}
+          aria-label={t("packages.move.cancelAriaLabel", { name: download.fileName })}
+          onClick={onCancelMove}
+        >
+          <X className="mr-1 h-3 w-3" />
+          <span className="hidden sm:inline">{t("packages.move.cancel")}</span>
+        </Button>
+      ) : (
+        <Button
+          size="sm"
+          variant="outline"
+          data-testid={`package-download-row-${download.id}-move`}
+          aria-label={t("packages.move.startAriaLabel", { name: download.fileName })}
+          onClick={() => onSelectForMove(download, packageId)}
+        >
+          <ArrowRightLeft className="mr-1 h-3 w-3" />
+          <span className="hidden sm:inline">{t("packages.move.start")}</span>
+        </Button>
+      )}
     </div>
   );
 }
diff --git a/src/views/PackagesView/PackageRow.tsx b/src/views/PackagesView/PackageRow.tsx
index e2344fd..dc398a0 100644
--- a/src/views/PackagesView/PackageRow.tsx
+++ b/src/views/PackagesView/PackageRow.tsx
@@ -1,6 +1,7 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
 import {
+  ArrowRightLeft,
   ChevronDown,
   ChevronRight,
   Folder,
@@ -19,6 +20,12 @@ import type { DownloadView } from "@/types/download";
 import type { PackageView } from "@/types/package";
 import { PackageDownloadRow } from "./PackageDownloadRow";
 
+export interface PendingMove {
+  downloadId: number;
+  fromPackageId: string;
+  fileName: string;
+}
+
 export interface PackageRowActions {
   toggleExpand: (id: string) => void;
   rename: (pkg: PackageView) => void;
@@ -32,6 +39,9 @@ export interface PackageRowActions {
   beginDragDownload: (download: DownloadView, fromPackageId: string) => void;
   endDragDownload: () => void;
   dropDownload: (toPackageId: string, e: React.DragEvent) => void;
+  selectForMove: (download: DownloadView, fromPackageId: string) => void;
+  cancelMove: () => void;
+  executeMove: (toPackage: PackageView) => void;
 }
 
 interface PackageRowProps {
@@ -40,6 +50,7 @@ interface PackageRowProps {
   childrenLoading: boolean;
   childrenError: Error | null;
   childDownloads: DownloadView[] | null;
+  pendingMove: PendingMove | null;
   actions: PackageRowActions;
 }
 
@@ -51,6 +62,7 @@ export function PackageRow({
   childrenLoading,
   childrenError,
   childDownloads,
+  pendingMove,
   actions,
 }: PackageRowProps) {
   const { t } = useTranslation();
@@ -64,6 +76,9 @@ export function PackageRow({
     actions.dropDownload(pkg.id, e);
   };
 
+  const isMoveTarget =
+    pendingMove !== null && pendingMove.fromPackageId !== pkg.id;
+
   return (
     <div
       data-testid={`package-row-${pkg.id}-dropzone`}
@@ -73,6 +88,7 @@ export function PackageRow({
       }}
       onDrop={handleDrop}
       aria-label={t("packages.drag.dropZoneAriaLabel")}
+      aria-dropeffect={isMoveTarget ? "move" : undefined}
     >
       <div
         data-testid={`package-row-${pkg.id}`}
@@ -193,6 +209,19 @@ export function PackageRow({
         >
           <Trash2 className="h-3 w-3" />
         </Button>
+
+        {isMoveTarget && (
+          <Button
+            size="sm"
+            variant="default"
+            data-testid={`package-row-${pkg.id}-move-target`}
+            onClick={() => actions.executeMove(pkg)}
+            aria-label={t("packages.move.targetAriaLabel", { name: pkg.name })}
+          >
+            <ArrowRightLeft className="mr-1 h-3 w-3" />
+            <span className="hidden sm:inline">{t("packages.move.target")}</span>
+          </Button>
+        )}
       </div>
 
       {expanded && (
@@ -215,8 +244,13 @@ export function PackageRow({
               key={d.id}
               download={d}
               packageId={pkg.id}
+              isPendingMove={
+                pendingMove !== null && pendingMove.downloadId === Number(d.id)
+              }
               onDragStart={actions.beginDragDownload}
               onDragEnd={actions.endDragDownload}
+              onSelectForMove={actions.selectForMove}
+              onCancelMove={actions.cancelMove}
             />
           ))}
         </div>
diff --git a/src/views/PackagesView/PackageTree.tsx b/src/views/PackagesView/PackageTree.tsx
index 457d63e..bde0fd4 100644
--- a/src/views/PackagesView/PackageTree.tsx
+++ b/src/views/PackagesView/PackageTree.tsx
@@ -1,7 +1,11 @@
 import { useTranslation } from "react-i18next";
 import type { DownloadView } from "@/types/download";
 import type { PackageView } from "@/types/package";
-import { PackageRow, type PackageRowActions } from "./PackageRow";
+import {
+  PackageRow,
+  type PackageRowActions,
+  type PendingMove,
+} from "./PackageRow";
 
 interface PackageTreeProps {
   packages: PackageView[];
@@ -9,6 +13,7 @@ interface PackageTreeProps {
   childrenLoading: boolean;
   childrenError: Error | null;
   childrenById: DownloadView[] | null;
+  pendingMove: PendingMove | null;
   actions: PackageRowActions;
 }
 
@@ -18,6 +23,7 @@ export function PackageTree({
   childrenLoading,
   childrenError,
   childrenById,
+  pendingMove,
   actions,
 }: PackageTreeProps) {
   const { t } = useTranslation();
@@ -45,6 +51,7 @@ export function PackageTree({
             childrenLoading={isExpanded && childrenLoading}
             childrenError={isExpanded ? childrenError : null}
             childDownloads={isExpanded ? childrenById : null}
+            pendingMove={pendingMove}
             actions={actions}
           />
         );
diff --git a/src/views/PackagesView/PackagesView.tsx b/src/views/PackagesView/PackagesView.tsx
index 5c1dc89..238510f 100644
--- a/src/views/PackagesView/PackagesView.tsx
+++ b/src/views/PackagesView/PackagesView.tsx
@@ -22,7 +22,7 @@ import {
   RenamePackageDialog,
 } from "./PackageDialogs";
 import { PackageTree } from "./PackageTree";
-import type { PackageRowActions } from "./PackageRow";
+import type { PackageRowActions, PendingMove } from "./PackageRow";
 import { PackageToolbar } from "./PackageToolbar";
 
 const INVALIDATE_KEYS = [packageQueries.all()] as const;
@@ -52,6 +52,8 @@ export function PackagesView() {
 
   const [expandedId, setExpandedId] = useState<string | null>(null);
   const dragRef = useRef<{ downloadId: number; fromPackageId: string } | null>(null);
+  const [pendingMove, setPendingMove] = useState<PendingMove | null>(null);
+  const [moveAnnouncement, setMoveAnnouncement] = useState("");
 
   const queryFilter = useMemo(() => {
     const f: { sourceType?: string; nameQ?: string } = {};
@@ -233,6 +235,24 @@ export function PackagesView() {
     [],
   );
 
+  const moveDownloadBetweenPackages = useCallback(
+    async (downloadId: number, fromId: string, toPackageId: string) => {
+      await removeFromPackageMut.mutateAsync({ packageId: fromId, downloadId });
+      try {
+        await addToPackageMut.mutateAsync({ packageId: toPackageId, downloadId });
+        return { ok: true as const };
+      } catch (addError) {
+        try {
+          await addToPackageMut.mutateAsync({ packageId: fromId, downloadId });
+        } catch {
+          return { ok: false as const, rollbackFailed: true };
+        }
+        throw addError;
+      }
+    },
+    [addToPackageMut, removeFromPackageMut],
+  );
+
   const actions = useMemo<PackageRowActions>(() => ({
     toggleExpand: (id: string) => {
       setExpandedId((prev) => (prev === id ? null : id));
@@ -293,18 +313,11 @@ export function PackagesView() {
         return;
       }
       try {
-        await removeFromPackageMut.mutateAsync({ packageId: fromId, downloadId });
-        try {
-          await addToPackageMut.mutateAsync({ packageId: toPackageId, downloadId });
-        } catch (addError) {
-          try {
-            await addToPackageMut.mutateAsync({ packageId: fromId, downloadId });
-          } catch {
-            toast.error(t("packages.toast.moveDownloadRollbackError"));
-            invalidatePackages();
-            return;
-          }
-          throw addError;
+        const result = await moveDownloadBetweenPackages(downloadId, fromId, toPackageId);
+        if (!result.ok) {
+          toast.error(t("packages.toast.moveDownloadRollbackError"));
+          invalidatePackages();
+          return;
         }
         toast.success(t("packages.toast.moveDownloadSuccess"));
         invalidatePackages();
@@ -312,13 +325,67 @@ export function PackagesView() {
         toast.error(t("packages.toast.moveDownloadError"));
       }
     },
+    selectForMove: (download, fromPackageId) => {
+      const numericId = Number(download.id);
+      if (!Number.isFinite(numericId)) return;
+      setPendingMove({
+        downloadId: numericId,
+        fromPackageId,
+        fileName: download.fileName,
+      });
+      setMoveAnnouncement(
+        t("packages.move.announce.selected", { name: download.fileName }),
+      );
+    },
+    cancelMove: () => {
+      setPendingMove(null);
+      setMoveAnnouncement(t("packages.move.announce.cancelled"));
+    },
+    executeMove: async (toPackage) => {
+      const move = pendingMove;
+      if (!move || move.fromPackageId === toPackage.id) return;
+      setMoveAnnouncement(
+        t("packages.move.announce.started", {
+          name: move.fileName,
+          package: toPackage.name,
+        }),
+      );
+      try {
+        const result = await moveDownloadBetweenPackages(
+          move.downloadId,
+          move.fromPackageId,
+          toPackage.id,
+        );
+        if (!result.ok) {
+          setMoveAnnouncement(
+            t("packages.move.announce.error", { name: move.fileName }),
+          );
+          toast.error(t("packages.toast.moveDownloadRollbackError"));
+          invalidatePackages();
+          return;
+        }
+        setMoveAnnouncement(
+          t("packages.move.announce.success", {
+            name: move.fileName,
+            package: toPackage.name,
+          }),
+        );
+        invalidatePackages();
+      } catch {
+        setMoveAnnouncement(
+          t("packages.move.announce.error", { name: move.fileName }),
+        );
+      } finally {
+        setPendingMove(null);
+      }
+    },
   }), [
-    addToPackageMut,
     fanoutDownloadAction,
     invalidatePackages,
+    moveDownloadBetweenPackages,
     pauseMut,
+    pendingMove,
     priorityMut,
-    removeFromPackageMut,
     resumeMut,
     t,
     toggleAutoExtractMut,
@@ -359,9 +426,20 @@ export function PackagesView() {
           childrenLoading={childrenLoading}
           childrenError={(childrenError as Error | null) ?? null}
           childrenById={childrenById}
+          pendingMove={pendingMove}
           actions={actions}
         />
       )}
+      <div
+        data-testid="packages-move-live-region"
+        role="status"
+        aria-live="polite"
+        aria-atomic="true"
+        aria-label={t("packages.move.liveRegionLabel")}
+        className="sr-only"
+      >
+        {moveAnnouncement}
+      </div>
       <AddPackageDialog
         open={addOpen}
         onOpenChange={setAddOpen}
diff --git a/src/views/PackagesView/__tests__/PackagesView.test.tsx b/src/views/PackagesView/__tests__/PackagesView.test.tsx
index 610a04f..af03572 100644
--- a/src/views/PackagesView/__tests__/PackagesView.test.tsx
+++ b/src/views/PackagesView/__tests__/PackagesView.test.tsx
@@ -416,6 +416,133 @@ describe("PackagesView", () => {
     });
   });
 
+  it("marks a download as pending-move when the Move button is pressed", async () => {
+    mockInvoke.mockImplementation(defaultInvokeImpl());
+    const user = userEvent.setup();
+    renderView();
+    await screen.findByText("Holiday playlist");
+    await user.click(screen.getByTestId("package-row-pkg-1-toggle"));
+    await screen.findByText("song-01.mp3");
+
+    const row = screen.getByTestId("package-download-row-42");
+    expect(row).toHaveAttribute("aria-grabbed", "false");
+
+    await user.click(screen.getByTestId("package-download-row-42-move"));
+
+    expect(row).toHaveAttribute("aria-grabbed", "true");
+    expect(screen.getByTestId("packages-move-live-region")).toHaveTextContent(
+      /selected song-01\.mp3/i,
+    );
+  });
+
+  it("shows Move-here target on non-source packages and hides it on the source", async () => {
+    mockInvoke.mockImplementation(defaultInvokeImpl());
+    const user = userEvent.setup();
+    renderView();
+    await screen.findByText("Holiday playlist");
+    await user.click(screen.getByTestId("package-row-pkg-1-toggle"));
+    await screen.findByText("song-01.mp3");
+
+    expect(screen.queryByTestId("package-row-pkg-1-move-target")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("package-row-pkg-2-move-target")).not.toBeInTheDocument();
+
+    await user.click(screen.getByTestId("package-download-row-42-move"));
+
+    expect(screen.queryByTestId("package-row-pkg-1-move-target")).not.toBeInTheDocument();
+    expect(screen.getByTestId("package-row-pkg-2-move-target")).toBeInTheDocument();
+    expect(screen.getByTestId("package-row-pkg-2-dropzone")).toHaveAttribute(
+      "aria-dropeffect",
+      "move",
+    );
+  });
+
+  it("executes a keyboard move via Move-here target and announces success", async () => {
+    mockInvoke.mockImplementation(async (command: string) => {
+      if (command === "package_list") return samplePackages();
+      if (command === "package_list_downloads") return sampleChildren();
+      if (command === "package_remove_download") return null;
+      if (command === "package_add_download") return null;
+      return null;
+    });
+    const user = userEvent.setup();
+    renderView();
+    await screen.findByText("Holiday playlist");
+    await user.click(screen.getByTestId("package-row-pkg-1-toggle"));
+    await screen.findByText("song-01.mp3");
+
+    await user.click(screen.getByTestId("package-download-row-42-move"));
+    await user.click(screen.getByTestId("package-row-pkg-2-move-target"));
+
+    await waitFor(() => {
+      expect(mockInvoke).toHaveBeenCalledWith(
+        "package_remove_download",
+        expect.objectContaining({ packageId: "pkg-1", downloadId: 42 }),
+      );
+      expect(mockInvoke).toHaveBeenCalledWith(
+        "package_add_download",
+        expect.objectContaining({ packageId: "pkg-2", downloadId: 42 }),
+      );
+    });
+    await waitFor(() => {
+      expect(screen.getByTestId("packages-move-live-region")).toHaveTextContent(
+        /song-01\.mp3 moved to backup archive/i,
+      );
+    });
+    expect(
+      screen.queryByTestId("package-row-pkg-2-move-target"),
+    ).not.toBeInTheDocument();
+  });
+
+  it("cancels a pending move and clears the live region", async () => {
+    mockInvoke.mockImplementation(defaultInvokeImpl());
+    const user = userEvent.setup();
+    renderView();
+    await screen.findByText("Holiday playlist");
+    await user.click(screen.getByTestId("package-row-pkg-1-toggle"));
+    await screen.findByText("song-01.mp3");
+
+    await user.click(screen.getByTestId("package-download-row-42-move"));
+    expect(
+      screen.getByTestId("package-download-row-42"),
+    ).toHaveAttribute("aria-grabbed", "true");
+
+    await user.click(screen.getByTestId("package-download-row-42-move-cancel"));
+
+    expect(
+      screen.getByTestId("package-download-row-42"),
+    ).toHaveAttribute("aria-grabbed", "false");
+    expect(screen.getByTestId("packages-move-live-region")).toHaveTextContent(
+      /move cancelled/i,
+    );
+    expect(
+      screen.queryByTestId("package-row-pkg-2-move-target"),
+    ).not.toBeInTheDocument();
+  });
+
+  it("announces an error when keyboard move fails on add", async () => {
+    mockInvoke.mockImplementation(async (command: string) => {
+      if (command === "package_list") return samplePackages();
+      if (command === "package_list_downloads") return sampleChildren();
+      if (command === "package_remove_download") return null;
+      if (command === "package_add_download") throw new Error("boom");
+      return null;
+    });
+    const user = userEvent.setup();
+    renderView();
+    await screen.findByText("Holiday playlist");
+    await user.click(screen.getByTestId("package-row-pkg-1-toggle"));
+    await screen.findByText("song-01.mp3");
+
+    await user.click(screen.getByTestId("package-download-row-42-move"));
+    await user.click(screen.getByTestId("package-row-pkg-2-move-target"));
+
+    await waitFor(() => {
+      expect(screen.getByTestId("packages-move-live-region")).toHaveTextContent(
+        /failed to move song-01\.mp3/i,
+      );
+    });
+  });
+
   it("surfaces the error state when package_list fails", async () => {
     mockInvoke.mockImplementation(async (command: string) => {
       if (command === "package_list") throw new Error("boom");

From 1b833035f7d3f2968c349ce3e1e22116571fb59c Mon Sep 17 00:00:00 2001
From: Mathieu Piton <27002047+mpiton@users.noreply.github.com>
Date: Thu, 30 Apr 2026 17:26:09 +0200
Subject: [PATCH 2/5] fix(ui): toast feedback on keyboard move path (#137
 review)

Match the pointer drag-and-drop path: surface toast.success on
successful keyboard move and toast.error on rollback / catch so
sighted keyboard users see a visible notification instead of only
the sr-only live region. Live region announcements are kept as-is
for screen readers.
---
 src/views/PackagesView/PackagesView.tsx                | 2 ++
 src/views/PackagesView/__tests__/PackagesView.test.tsx | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/src/views/PackagesView/PackagesView.tsx b/src/views/PackagesView/PackagesView.tsx
index 238510f..e98c0ac 100644
--- a/src/views/PackagesView/PackagesView.tsx
+++ b/src/views/PackagesView/PackagesView.tsx
@@ -370,11 +370,13 @@ export function PackagesView() {
             package: toPackage.name,
           }),
         );
+        toast.success(t("packages.toast.moveDownloadSuccess"));
         invalidatePackages();
       } catch {
         setMoveAnnouncement(
           t("packages.move.announce.error", { name: move.fileName }),
         );
+        toast.error(t("packages.toast.moveDownloadError"));
       } finally {
         setPendingMove(null);
       }
diff --git a/src/views/PackagesView/__tests__/PackagesView.test.tsx b/src/views/PackagesView/__tests__/PackagesView.test.tsx
index af03572..0edf7da 100644
--- a/src/views/PackagesView/__tests__/PackagesView.test.tsx
+++ b/src/views/PackagesView/__tests__/PackagesView.test.tsx
@@ -488,6 +488,7 @@ describe("PackagesView", () => {
         /song-01\.mp3 moved to backup archive/i,
       );
     });
+    expect(mockToastSuccess).toHaveBeenCalled();
     expect(
       screen.queryByTestId("package-row-pkg-2-move-target"),
     ).not.toBeInTheDocument();
@@ -541,6 +542,7 @@ describe("PackagesView", () => {
         /failed to move song-01\.mp3/i,
       );
     });
+    expect(mockToastError).toHaveBeenCalled();
   });
 
   it("surfaces the error state when package_list fails", async () => {

From 40798f1b5911a4f8261331002fee4abc97f3fe57 Mon Sep 17 00:00:00 2001
From: Mathieu Piton <27002047+mpiton@users.noreply.github.com>
Date: Fri, 1 May 2026 08:03:51 +0200
Subject: [PATCH 3/5] test(ui): tighten keyboard-move error-path test (#137
 review)

Per CodeRabbit nitpick: the previous mock made `package_add_download`
throw on every call, which exercised the rollback-failure branch of
`moveDownloadBetweenPackages` instead of the intended "target add fails,
rollback succeeds" path. Throw only when `packageId === "pkg-2"` so the
rollback `package_add_download` to `pkg-1` returns null, the inner
`throw addError` propagates, and `executeMove`'s outer catch surfaces
`packages.move.announce.error` + `toast.error(moveDownloadError)`. Two
new ordering assertions on `package_add_download` calls pin the
contract.
---
 .../PackagesView/__tests__/PackagesView.test.tsx | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/views/PackagesView/__tests__/PackagesView.test.tsx b/src/views/PackagesView/__tests__/PackagesView.test.tsx
index 0edf7da..5f5c223 100644
--- a/src/views/PackagesView/__tests__/PackagesView.test.tsx
+++ b/src/views/PackagesView/__tests__/PackagesView.test.tsx
@@ -520,12 +520,16 @@ describe("PackagesView", () => {
     ).not.toBeInTheDocument();
   });
 
-  it("announces an error when keyboard move fails on add", async () => {
-    mockInvoke.mockImplementation(async (command: string) => {
+  it("announces an error when keyboard move fails on add (rollback succeeds)", async () => {
+    mockInvoke.mockImplementation(async (command: string, args?: unknown) => {
       if (command === "package_list") return samplePackages();
       if (command === "package_list_downloads") return sampleChildren();
       if (command === "package_remove_download") return null;
-      if (command === "package_add_download") throw new Error("boom");
+      if (command === "package_add_download") {
+        const { packageId } = args as { packageId: string };
+        if (packageId === "pkg-2") throw new Error("boom");
+        return null;
+      }
       return null;
     });
     const user = userEvent.setup();
@@ -543,6 +547,12 @@ describe("PackagesView", () => {
       );
     });
     expect(mockToastError).toHaveBeenCalled();
+    const addCalls = mockInvoke.mock.calls.filter(
+      ([c]) => c === "package_add_download",
+    );
+    expect(addCalls).toHaveLength(2);
+    expect(addCalls[0]?.[1]).toMatchObject({ packageId: "pkg-2", downloadId: 42 });
+    expect(addCalls[1]?.[1]).toMatchObject({ packageId: "pkg-1", downloadId: 42 });
   });
 
   it("surfaces the error state when package_list fails", async () => {

From a4e49a0f9c3d4097bb5f12a36e8ab355d332d667 Mon Sep 17 00:00:00 2001
From: Mathieu Piton <27002047+mpiton@users.noreply.github.com>
Date: Fri, 1 May 2026 08:33:34 +0200
Subject: [PATCH 4/5] fix(ui): drop deprecated ARIA + guard executeMove race
 (#137 review)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Address two cubic-dev-ai findings:

1. `aria-grabbed` and `aria-dropeffect` are deprecated in WAI-ARIA 1.1.
   Replace `aria-grabbed` on the download row with `aria-pressed` on a
   single `PackageDownloadRow` toggle button (Move ↔ Cancel-move),
   which is the natural toggle-button semantic for a two-state action.
   Drop `aria-dropeffect` from the package dropzone wrapper: the
   `Move selected here` button already announces the affordance through
   its `aria-label`, and the `aria-live="polite"` region announces
   start/success/cancel/error transitions.

2. `executeMove` cleared `pendingMove` unconditionally in its `finally`
   block, which could erase a fresher selection made by the user while
   the move's async work was still in flight. Wrap the clear in a
   functional `setPendingMove` that only nulls when the current value
   still matches the snapshot taken at the start of `executeMove`.

A new vitest case pins the race guard via a deferred `package_remove_download`
mock; the existing aria-attribute assertions are migrated to the new
`aria-pressed` shape. CHANGELOG updated to reflect the modern ARIA
choice.
---
 CHANGELOG.md                                  |  2 +-
 src/views/PackagesView/PackageDownloadRow.tsx | 51 +++++++++-------
 src/views/PackagesView/PackageRow.tsx         |  1 -
 src/views/PackagesView/PackagesView.tsx       |  8 ++-
 .../__tests__/PackagesView.test.tsx           | 59 +++++++++++++++----
 5 files changed, 84 insertions(+), 37 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 59b833f..8bd1e63 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- **Keyboard-accessible move-download-between-packages** (issue #134, PR #133 follow-up): the pointer-only HTML5 drag-and-drop introduced for moving downloads between packages now has a fully keyboard-driven and screen-reader-friendly alternative. Each `PackageDownloadRow` exposes a new `Move…` button (toggles to `Cancel move` while a selection is active) that marks the download as pending-move and sets `aria-grabbed="true"` on the source row. Once a download is selected, every other `PackageRow` (the source package is intentionally excluded) surfaces a `Move selected here` action and its dropzone wrapper gains `aria-dropeffect="move"`. Activating the target reuses the same `package_remove_download` + `package_add_download` IPC pair as the drag-and-drop path (now factored into a shared `moveDownloadBetweenPackages` helper so the rollback logic stays in one place) and surfaces start / success / cancel / error transitions through a new visually-hidden `role="status" aria-live="polite"` live region (`packages-move-live-region`). The drag-and-drop path is unchanged. New i18n keys `packages.move.{start,startAriaLabel,cancel,cancelAriaLabel,target,targetAriaLabel,liveRegionLabel,announce.{selected,cancelled,started,success,error}}` ship in EN + FR. Five new Vitest tests cover the four issue acceptance criteria: keyboard initiation without a pointer (`Move` button → aria-grabbed flips), correct ARIA semantics (target rows expose `aria-dropeffect="move"`, source row stays hidden), live region announcements (selected / success / cancelled / error wording), unchanged pointer drag-and-drop (existing test still green), and Vitest coverage of the new flow.
+- **Keyboard-accessible move-download-between-packages** (issue #134, PR #133 follow-up): the pointer-only HTML5 drag-and-drop introduced for moving downloads between packages now has a fully keyboard-driven and screen-reader-friendly alternative. Each `PackageDownloadRow` exposes a single toggle button (`Move…` ↔ `Cancel move`) that marks the download as pending-move; the button carries `aria-pressed` so screen readers announce the toggle state, replacing the deprecated `aria-grabbed` named in the original issue. Once a download is selected, every other `PackageRow` (the source package is intentionally excluded) surfaces a `Move selected here` action with an explicit `aria-label="Move selected download to {package}"`; the deprecated `aria-dropeffect` is intentionally not used because the descriptive button label plus the live region cover the same intent without the deprecated attribute. Activating the target reuses the same `package_remove_download` + `package_add_download` IPC pair as the drag-and-drop path (now factored into a shared `moveDownloadBetweenPackages` helper so the rollback logic stays in one place), surfaces start / success / cancel / error transitions through a new visually-hidden `role="status" aria-live="polite"` live region (`packages-move-live-region`), and matches the pointer path's visual feedback by raising `toast.success(packages.toast.moveDownloadSuccess)` on success and `toast.error(packages.toast.moveDownloadError)` in the catch (`toast.error(packages.toast.moveDownloadRollbackError)` still fires when both the move and the rollback fail). The `executeMove` finally block guards against an in-flight move clobbering a newer pending selection: `setPendingMove` is cleared only when the current state still references the move that just completed. The drag-and-drop path is unchanged. New i18n keys `packages.move.{start,startAriaLabel,cancel,cancelAriaLabel,target,targetAriaLabel,liveRegionLabel,announce.{selected,cancelled,started,success,error}}` ship in EN + FR. Six new Vitest tests cover the four issue acceptance criteria: keyboard initiation without a pointer (`Move` button → `aria-pressed` flips), live region announcements (selected / success / cancelled / error wording), unchanged pointer drag-and-drop (existing test still green), error-path coverage of the "target add fails, rollback succeeds" branch with explicit call-order assertions, and a race-condition guard that proves a stale `executeMove` does not erase a newer selection when its `package_remove_download` resolves late.
 
 - **Auto-grouping playlist → package** (PRD §6.3, PRD-v2 §P1.11, task 30): when the Link Grabber resolves a YouTube or SoundCloud playlist URL, every selected item is now auto-attached to a single `Package` per playlist. New `PlaylistGrouper` application service (`src-tauri/src/application/services/playlist_grouper.rs`) finds-or-creates a `Package` keyed by the new `external_id` natural key (the playlist URL acts as the natural id), so re-resolving the same playlist reuses the existing package instead of creating a duplicate. New `GroupPlaylistsCommand` handler (`group_playlists.rs`) routes the request through the grouper; new `link_group_playlists` Tauri IPC command (`PlaylistGroupInputDto` → `Vec<PlaylistGroupResultDto>`) lets the frontend orchestrate the group-then-attach flow. Migration `m20260430_000008_add_package_external_id` adds `packages.external_id TEXT NULL` plus the `idx_packages_external_id` index; the column is intentionally nullable (manual packages keep `NULL`) and the application layer enforces uniqueness through `find_by_external_id` rather than a DB UNIQUE constraint that would forbid more than one manual row. Domain `Package` aggregate gains an `external_id: Option<String>` field with `set_external_id` and `external_id()` accessors; `PackageRepository::find_by_external_id` is added to the trait, returning the oldest row by `(created_at, id)` so repeated reuses pick the same package deterministically. The `MediaGrabberDialog` now shows a `PlaylistPackageBanner` ("Will create package: {name} with {N} items" / "Will reuse existing package …") above the playlist item list once `metadata.isPlaylist` is true, with EN + FR plural translations under `mediaGrabber.playlistBanner.*`. `LinkGrabberView.handleMediaGrabberConfirm` now calls `link_group_playlists` first when the user has selected playlist items, then `download_media_start`, then attaches every returned `downloadId` to the package via `package_add_download` (failures on attach are non-fatal — downloads still run, only the grouping is missed). Visibility of `application::commands::tests_support` is bumped to `pub(crate)` so the new `playlist_grouper` and `group_playlists` tests can reuse the existing `InMemoryPackageRepo` / `CapturingEventBus` mocks. 13 new tests cover the four acceptance criteria: 7 unit tests on `PlaylistGrouper` (create / reuse / blank id / fallback name / batch / partial failure / trim), 5 SQLite tests on `find_by_external_id` (round-trip / match / not-found / no NULL match / oldest-on-duplicates / clear-on-upsert), 3 handler tests, 4 frontend tests on `PlaylistPackageBanner`. cargo test 1327 passing, vitest 626 passing, clippy + fmt clean. Unblocks the Link Grabber's playlist UX.
 - **Packages view** (PRD §6.3, PRD-v2 §P1.10, task 29): full Packages management UI replacing the previous `PlaceholderView`. New `src/views/PackagesView/` folder with `PackagesView` (root), `PackageToolbar` (filter chips `All / Container / Playlist / Manual / Split archive` + debounced search input + "New package" trigger), `PackageTree` (empty state + list of `PackageRow`), `PackageRow` (chevron toggle, inline rename trigger, source-type badge, file count via `_one`/`_other` plural keys, total bytes via `formatBytes`, aggregated `Progress` bar, folder browse button, `Key` password trigger, `Switch` for auto-extract, native `<select>` 1-10 priority, Pause-all / Start-all / Delete buttons), `PackageDownloadRow` (HTML5 native draggable child row with state badge + size + speed + ETA + per-row progress) and `PackageDialogs` (`AddPackageDialog`, `RenamePackageDialog`, `PasswordDialog` with `type="password"`, `FolderDialog` with `tauri-plugin-dialog` directory picker, `DeletePackageDialog` with optional "also delete child downloads" checkbox). New `src/types/package.ts` mirrors `PackageViewDto` (camelCase, no password field) plus `PackagePatch` / `PackageListFilter` / `CreatePackageInput` / `PackageMoveOutcome`. New `src/hooks/usePackagesQuery.ts` exposes `usePackagesQuery(filter?)` (TanStack Query, 30 s `staleTime`, forwards `sourceType` + `nameQ` to `package_list`) and `usePackageDownloadsQuery(packageId | null)` (lazy via `enabled`, 10 s `staleTime`, calls `package_list_downloads`). New `packageQueries` cache-key factory in `src/api/queries.ts` with `lists()` / `list(filter)` / `details()` / `detail(id)` / `downloads(id)` so mutations can target the right slice. The view wires every command from task 27: `package_create`, `package_update` (rename), `package_set_password` (keyring-only — UI never echoes the stored secret back), `package_set_priority`, `package_move_to_folder` (toast announces the count of moved children from `PackageMoveOutcome.moved.length`), `package_toggle_auto_extract`, `package_delete` (confirmation dialog with `deleteDownloads` boolean), `package_add_download` and `package_remove_download` (drag-and-drop pairing). Drag-and-drop uses native `dataTransfer` (no external lib): `PackageDownloadRow` sets `application/x-vortex-download` (id) + `application/x-vortex-source-package` (origin id) on `dragstart`; `PackageRow` registers itself as a drop zone via `data-testid="package-row-{id}-dropzone"` and the View's `dropDownload` handler short-circuits when `from === to`, parses the numeric id, calls `package_remove_download` then `package_add_download`, surfaces `moveDownloadSuccess` / `moveDownloadError` toasts, and invalidates the package cache. Bulk Pause-all / Start-all fans out the existing `download_pause` / `download_resume` IPC over `Promise.allSettled` for every member returned by `package_list_downloads`, then surfaces a single success toast or `bulkActionError` if any leg failed. Filter chips and the 300 ms debounced search (`useDebouncedValue`) re-key the `usePackagesQuery` so the round-trip happens server-side via `package_list { sourceType?, nameQ? }`; an empty filter object is collapsed to `undefined` so the SQL path takes the no-filter branch. Component boundary stays at 2 levels (View → Tree → Row) to honour the project's prop-drilling rule — dialogs are mounted at the View level and receive only the active target via state. New i18n namespace `packages.*` adds 60+ keys covering title / loading / empty / search placeholder / filter labels / row controls / dialog copy (Add / Rename / Password / Folder / Delete) / drag aria-labels / toast messages, with mirrored EN + FR translations and `_one` / `_other` plural variants for the file-count badge. `useTauriMutation`'s `invalidateKeys` array invalidates `packageQueries.all()` on every mutation; commands that touch downloads (`package_delete`, `package_move_to_folder`) additionally invalidate `downloadQueries.all()` so the main downloads list reflects the cascade. The legacy `src/views/PackagesView.tsx` placeholder file becomes a single-line re-export of the new folder, preserving every existing import path. The french translations test (`issue30-ui-fr.test.tsx`) is updated: `PackagesView` is no longer asserted as a placeholder; a new dedicated case asserts the FR header (`Paquets`) and search placeholder (`Rechercher des paquets`) render correctly with a real `QueryClientProvider`. 16 new Vitest tests cover the six acceptance criteria (tree expand/collapse, auto-extract toggle, masked password dialog, drag-and-drop FK update, ≥80 % coverage, ≤2-level prop drilling) plus filter chips, debounced search, dialog flows, fan-out bulk actions and the error state. Coverage on `src/views/PackagesView/`: 87.28 % statements / 90.07 % lines / 79.59 % functions — above the 80 % frontend threshold.
diff --git a/src/views/PackagesView/PackageDownloadRow.tsx b/src/views/PackagesView/PackageDownloadRow.tsx
index fe21f19..6b9927d 100644
--- a/src/views/PackagesView/PackageDownloadRow.tsx
+++ b/src/views/PackagesView/PackageDownloadRow.tsx
@@ -25,11 +25,26 @@ export function PackageDownloadRow({
   onCancelMove,
 }: PackageDownloadRowProps) {
   const { t } = useTranslation();
+  const moveTestId = isPendingMove
+    ? `package-download-row-${download.id}-move-cancel`
+    : `package-download-row-${download.id}-move`;
+  const moveAriaLabel = isPendingMove
+    ? t("packages.move.cancelAriaLabel", { name: download.fileName })
+    : t("packages.move.startAriaLabel", { name: download.fileName });
+  const moveLabel = isPendingMove
+    ? t("packages.move.cancel")
+    : t("packages.move.start");
+  const handleMoveClick = () => {
+    if (isPendingMove) {
+      onCancelMove();
+    } else {
+      onSelectForMove(download, packageId);
+    }
+  };
   return (
     <div
       data-testid={`package-download-row-${download.id}`}
       draggable
-      aria-grabbed={isPendingMove}
       onDragStart={(e) => {
         e.dataTransfer.effectAllowed = "move";
         e.dataTransfer.setData("application/x-vortex-download", download.id);
@@ -49,29 +64,21 @@ export function PackageDownloadRow({
       <span className="text-xs text-muted-foreground">{formatSpeed(download.speedBytesPerSec)}</span>
       <span className="text-xs text-muted-foreground">{formatEta(download.etaSeconds)}</span>
       <Progress value={download.progressPercent} className="h-1.5 w-32" />
-      {isPendingMove ? (
-        <Button
-          size="sm"
-          variant="outline"
-          data-testid={`package-download-row-${download.id}-move-cancel`}
-          aria-label={t("packages.move.cancelAriaLabel", { name: download.fileName })}
-          onClick={onCancelMove}
-        >
+      <Button
+        size="sm"
+        variant={isPendingMove ? "default" : "outline"}
+        data-testid={moveTestId}
+        aria-pressed={isPendingMove}
+        aria-label={moveAriaLabel}
+        onClick={handleMoveClick}
+      >
+        {isPendingMove ? (
           <X className="mr-1 h-3 w-3" />
-          <span className="hidden sm:inline">{t("packages.move.cancel")}</span>
-        </Button>
-      ) : (
-        <Button
-          size="sm"
-          variant="outline"
-          data-testid={`package-download-row-${download.id}-move`}
-          aria-label={t("packages.move.startAriaLabel", { name: download.fileName })}
-          onClick={() => onSelectForMove(download, packageId)}
-        >
+        ) : (
           <ArrowRightLeft className="mr-1 h-3 w-3" />
-          <span className="hidden sm:inline">{t("packages.move.start")}</span>
-        </Button>
-      )}
+        )}
+        <span className="hidden sm:inline">{moveLabel}</span>
+      </Button>
     </div>
   );
 }
diff --git a/src/views/PackagesView/PackageRow.tsx b/src/views/PackagesView/PackageRow.tsx
index dc398a0..0d9b74a 100644
--- a/src/views/PackagesView/PackageRow.tsx
+++ b/src/views/PackagesView/PackageRow.tsx
@@ -88,7 +88,6 @@ export function PackageRow({
       }}
       onDrop={handleDrop}
       aria-label={t("packages.drag.dropZoneAriaLabel")}
-      aria-dropeffect={isMoveTarget ? "move" : undefined}
     >
       <div
         data-testid={`package-row-${pkg.id}`}
diff --git a/src/views/PackagesView/PackagesView.tsx b/src/views/PackagesView/PackagesView.tsx
index e98c0ac..c1cec62 100644
--- a/src/views/PackagesView/PackagesView.tsx
+++ b/src/views/PackagesView/PackagesView.tsx
@@ -378,7 +378,13 @@ export function PackagesView() {
         );
         toast.error(t("packages.toast.moveDownloadError"));
       } finally {
-        setPendingMove(null);
+        setPendingMove((current) =>
+          current &&
+          current.downloadId === move.downloadId &&
+          current.fromPackageId === move.fromPackageId
+            ? null
+            : current,
+        );
       }
     },
   }), [
diff --git a/src/views/PackagesView/__tests__/PackagesView.test.tsx b/src/views/PackagesView/__tests__/PackagesView.test.tsx
index 5f5c223..76fcc95 100644
--- a/src/views/PackagesView/__tests__/PackagesView.test.tsx
+++ b/src/views/PackagesView/__tests__/PackagesView.test.tsx
@@ -424,12 +424,13 @@ describe("PackagesView", () => {
     await user.click(screen.getByTestId("package-row-pkg-1-toggle"));
     await screen.findByText("song-01.mp3");
 
-    const row = screen.getByTestId("package-download-row-42");
-    expect(row).toHaveAttribute("aria-grabbed", "false");
+    const moveButton = screen.getByTestId("package-download-row-42-move");
+    expect(moveButton).toHaveAttribute("aria-pressed", "false");
 
-    await user.click(screen.getByTestId("package-download-row-42-move"));
+    await user.click(moveButton);
 
-    expect(row).toHaveAttribute("aria-grabbed", "true");
+    const cancelButton = screen.getByTestId("package-download-row-42-move-cancel");
+    expect(cancelButton).toHaveAttribute("aria-pressed", "true");
     expect(screen.getByTestId("packages-move-live-region")).toHaveTextContent(
       /selected song-01\.mp3/i,
     );
@@ -450,10 +451,6 @@ describe("PackagesView", () => {
 
     expect(screen.queryByTestId("package-row-pkg-1-move-target")).not.toBeInTheDocument();
     expect(screen.getByTestId("package-row-pkg-2-move-target")).toBeInTheDocument();
-    expect(screen.getByTestId("package-row-pkg-2-dropzone")).toHaveAttribute(
-      "aria-dropeffect",
-      "move",
-    );
   });
 
   it("executes a keyboard move via Move-here target and announces success", async () => {
@@ -504,14 +501,14 @@ describe("PackagesView", () => {
 
     await user.click(screen.getByTestId("package-download-row-42-move"));
     expect(
-      screen.getByTestId("package-download-row-42"),
-    ).toHaveAttribute("aria-grabbed", "true");
+      screen.getByTestId("package-download-row-42-move-cancel"),
+    ).toHaveAttribute("aria-pressed", "true");
 
     await user.click(screen.getByTestId("package-download-row-42-move-cancel"));
 
     expect(
-      screen.getByTestId("package-download-row-42"),
-    ).toHaveAttribute("aria-grabbed", "false");
+      screen.getByTestId("package-download-row-42-move"),
+    ).toHaveAttribute("aria-pressed", "false");
     expect(screen.getByTestId("packages-move-live-region")).toHaveTextContent(
       /move cancelled/i,
     );
@@ -555,6 +552,44 @@ describe("PackagesView", () => {
     expect(addCalls[1]?.[1]).toMatchObject({ packageId: "pkg-1", downloadId: 42 });
   });
 
+  it("does not clobber a newer pending-move when a previous executeMove resolves", async () => {
+    const removeGate: { resolve: ((value: unknown) => void) | null } = {
+      resolve: null,
+    };
+    mockInvoke.mockImplementation(async (command: string) => {
+      if (command === "package_list") return samplePackages();
+      if (command === "package_list_downloads") return sampleChildren();
+      if (command === "package_remove_download") {
+        return new Promise((res) => {
+          removeGate.resolve = res;
+        });
+      }
+      if (command === "package_add_download") return null;
+      return null;
+    });
+    const user = userEvent.setup();
+    renderView();
+    await screen.findByText("Holiday playlist");
+    await user.click(screen.getByTestId("package-row-pkg-1-toggle"));
+    await screen.findByText("song-01.mp3");
+
+    await user.click(screen.getByTestId("package-download-row-42-move"));
+    await user.click(screen.getByTestId("package-row-pkg-2-move-target"));
+
+    await user.click(screen.getByTestId("package-download-row-43-move"));
+    expect(
+      screen.getByTestId("package-download-row-43-move-cancel"),
+    ).toHaveAttribute("aria-pressed", "true");
+
+    removeGate.resolve?.(null);
+
+    await waitFor(() => {
+      expect(
+        screen.getByTestId("package-download-row-43-move-cancel"),
+      ).toHaveAttribute("aria-pressed", "true");
+    });
+  });
+
   it("surfaces the error state when package_list fails", async () => {
     mockInvoke.mockImplementation(async (command: string) => {
       if (command === "package_list") throw new Error("boom");

From 5a1efe653df3041e0bfbf5ea17992c87f170ce76 Mon Sep 17 00:00:00 2001
From: Mathieu Piton <27002047+mpiton@users.noreply.github.com>
Date: Fri, 1 May 2026 08:41:43 +0200
Subject: [PATCH 5/5] =?UTF-8?q?fix(core):=20bump=20wasmtime=2043.0.1=20?=
 =?UTF-8?q?=E2=86=92=2043.0.2=20(RUSTSEC-2026-0114)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cargo-audit started flagging wasmtime 43.0.1 on 2026-04-30 with
RUSTSEC-2026-0114 ("Panic when allocating a table exceeding the size
of the host's address space", medium severity, fixed in 43.0.2). The
patch bump is constrained by the wasi-common 43.0.1 → 43.0.2 pin, so
both crates and their internal helpers (wasmtime-environ, wiggle,
winch-codegen, every wasmtime-internal-* shim, etc.) move to 43.0.2
in lockstep. No source change required — the extism git dep at
mpiton/extism@f14e56d still resolves cleanly against the new patch.

cargo audit --file src-tauri/Cargo.lock: 0 vulnerabilities.
cargo clippy --workspace --all-targets -- -D warnings: clean.
cargo test --workspace: 1330 passing, 7 ignored.
---
 src-tauri/Cargo.lock | 160 +++++++++++++++++++++----------------------
 1 file changed, 80 insertions(+), 80 deletions(-)

diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index c406a2c..1768fad 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -150,7 +150,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -161,7 +161,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -1154,27 +1154,27 @@ dependencies = [
 
 [[package]]
 name = "cranelift-assembler-x64"
-version = "0.130.1"
+version = "0.130.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "046d4b584c3bb9b5eb500c8f29549bec36be11000f1ba2a927cef3d1a9875691"
+checksum = "adc822414b18d1f5b1b33ce1441534e311e62fef86ebb5b9d382af857d0272c9"
 dependencies = [
  "cranelift-assembler-x64-meta",
 ]
 
 [[package]]
 name = "cranelift-assembler-x64-meta"
-version = "0.130.1"
+version = "0.130.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9b194a7870becb1490366fc0ae392ccd188065ff35f8391e77ac659db6fb977"
+checksum = "8c646808b06f4532478d8d6057d74f15c3322f10d995d9486e7dcea405bf521a"
 dependencies = [
  "cranelift-srcgen",
 ]
 
 [[package]]
 name = "cranelift-bforest"
-version = "0.130.1"
+version = "0.130.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb6a4ab44c6b371e661846b97dab687387a60ac4e2f864e2d4257284aad9e889"
+checksum = "7b5996f01a686b2349cdb379083ec5ad3e8cb8767fb2d495d3a4f2ee4163a18d"
 dependencies = [
  "cranelift-entity",
  "wasmtime-internal-core",
@@ -1182,9 +1182,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-bitset"
-version = "0.130.1"
+version = "0.130.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8b7a44150c2f471a94023482bda1902710746e4bed9f9973d60c5a94319b06d"
+checksum = "523fea83273f6a985520f57788809a4de2165794d9ab00fb1254fceb4f5aa00c"
 dependencies = [
  "serde",
  "serde_derive",
@@ -1193,9 +1193,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen"
-version = "0.130.1"
+version = "0.130.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01b06598133b1dd76758b8b95f8d6747c124124aade50cea96a3d88b962da9fa"
+checksum = "d73d1e372730b5f64ed1a2bd9f01fe4686c8ec14a28034e3084e530c8d951878"
 dependencies = [
  "bumpalo",
  "cranelift-assembler-x64",
@@ -1221,9 +1221,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-meta"
-version = "0.130.1"
+version = "0.130.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6190e2e7bcf0a678da2f715363d34ed530fedf7a2f0ab75edaefef72a70465ff"
+checksum = "b0319c18165e93dc1ebf78946a8da0b1c341c95b4a39729a69574671639bdb5f"
 dependencies = [
  "cranelift-assembler-x64-meta",
  "cranelift-codegen-shared",
@@ -1234,24 +1234,24 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-shared"
-version = "0.130.1"
+version = "0.130.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f583cf203d1aa8b79560e3b01f929bdacf9070b015eec4ea9c46e22a3f83e4a0"
+checksum = "9195cd8aeecb55e401aa96b2eaa55921636e8246c127ed7908f7ef7e0d40f270"
 
 [[package]]
 name = "cranelift-control"
-version = "0.130.1"
+version = "0.130.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "803159df35cc398ae54473c150b16d6c77e92ab2948be638488de126a3328fbc"
+checksum = "8976c2154b74136322befc74222ab5c7249edd7e2604f8cbef2b94975541ffb9"
 dependencies = [
  "arbitrary",
 ]
 
 [[package]]
 name = "cranelift-entity"
-version = "0.130.1"
+version = "0.130.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3109e417257082d88087f5bcce677525bdaa8322b88dd7f175ed1a1fd41d546c"
+checksum = "6038b3147c7982f4951150d5f96c7c06c1e7214b99d4b4a98607aadf8ded89d1"
 dependencies = [
  "cranelift-bitset",
  "serde",
@@ -1261,9 +1261,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-frontend"
-version = "0.130.1"
+version = "0.130.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14db6b0e0e4994c581092df78d837be2072578f7cb2528f96a6cf895e56dee63"
+checksum = "4cbd294abe236e23cc3d907b0936226b6a8342db7636daa9c7c72be1e323420e"
 dependencies = [
  "cranelift-codegen",
  "log",
@@ -1273,15 +1273,15 @@ dependencies = [
 
 [[package]]
 name = "cranelift-isle"
-version = "0.130.1"
+version = "0.130.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec66ea5025c7317383699778282ac98741d68444f956e3b1d7b62f12b7216e67"
+checksum = "b5a90b6ed3aba84189352a87badeb93b2126d3724225a42dc67fdce53d1b139c"
 
 [[package]]
 name = "cranelift-native"
-version = "0.130.1"
+version = "0.130.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "373ade56438e6232619d85678477d0a88a31b3581936e0503e61e96b546b0800"
+checksum = "c3ec0cc1a54e22925eacf4fc3dc815f907734d3b377899d19d52bec04863e853"
 dependencies = [
  "cranelift-codegen",
  "libc",
@@ -1290,9 +1290,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-srcgen"
-version = "0.130.1"
+version = "0.130.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef53619d3cd5c78fd998c6d9420547af26b72e6456f94c2a8a2334cb76b42baa"
+checksum = "948865622f87f30907bb46fbb081b235ae63c1896a99a83c26a003305c1fa82d"
 
 [[package]]
 name = "crc"
@@ -1689,7 +1689,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users 0.5.2",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -1938,7 +1938,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -4025,7 +4025,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -4365,7 +4365,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.45.0",
 ]
 
 [[package]]
@@ -5044,9 +5044,9 @@ dependencies = [
 
 [[package]]
 name = "pulley-interpreter"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "010dec3755eb61b2f1051ecb3611b718460b7a74c131e474de2af20a845938af"
+checksum = "7ec12fe19a9588315a49fe5704502a9c02d6a198303314b0c7c86123b06d29e5"
 dependencies = [
  "cranelift-bitset",
  "log",
@@ -5056,9 +5056,9 @@ dependencies = [
 
 [[package]]
 name = "pulley-macros"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad360c32e85ca4b083ac0e2b6856e8f11c3d5060dafa7d5dc57b370857fa3018"
+checksum = "36f7d5ef31ebf1b46cd7e722ffef934e670d7e462f49aa01cde07b9b76dca580"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5672,7 +5672,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -5741,7 +5741,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -6424,7 +6424,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -7353,7 +7353,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -7861,7 +7861,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
  "memoffset",
  "tempfile",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -8229,9 +8229,9 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasi-common"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0eea20bcd8f9aa8bb7d069b9bc8b998e71f2cfef2220c4b461c55f4988b977"
+checksum = "46137f5bcc41a0f002ed14688e463665388a6f3a6662a12a8c315d4b8849791c"
 dependencies = [
  "async-trait",
  "bitflags 2.11.0",
@@ -8458,9 +8458,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce205cd643d661b5ba5ba4717e13730262e8cdbc8f2eacbc7b906d45c1a74026"
+checksum = "efb1ed5899dde98357cfdcf647a4614498798719793898245b4b34e663addabf"
 dependencies = [
  "addr2line",
  "async-trait",
@@ -8511,9 +8511,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-environ"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b8b78abf3677d4a0a5db82e5015b4d085ff3a1b8b472cbb8c70d4b769f019ce"
+checksum = "4172382dcc785c31d0e862c6780a18f5dd437914d22c4691351f965ef751c821"
 dependencies = [
  "anyhow",
  "cpp_demangle",
@@ -8542,9 +8542,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-cache"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e4fd4103ba413c0da2e636f73490c6c8e446d708cbde7573703941bc3d6a448"
+checksum = "4ed398988226d7aa0505ac6bb576e09532ad722d702ec4e66365d78ed695c95f"
 dependencies = [
  "base64 0.22.1",
  "directories-next",
@@ -8562,9 +8562,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-component-macro"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d3d6914f34be2f9d78d8ee9f422e834dfc204e71ccce697205fae95fed87892"
+checksum = "ae5ec9fff073ff13b81732d56a9515d761c245750bcda09093827f84130ebc25"
 dependencies = [
  "anyhow",
  "proc-macro2",
@@ -8577,15 +8577,15 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-component-util"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3751b0616b914fdd87fe1bf804694a078f321b000338e6476bc48a4d6e454f21"
+checksum = "935d9ab293ba27d1ec9aa7bc1b3a43993dbe961af2a8f23f90a11e1331b4c13f"
 
 [[package]]
 name = "wasmtime-internal-core"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22632b187e1b0716f1b9ac57ad29013bed33175fcb19e10bb6896126f82fac67"
+checksum = "9a3820b174f477d2a7083209d1ad5353fcdb11eaea434b2137b8681029460dd3"
 dependencies = [
  "anyhow",
  "hashbrown 0.16.1",
@@ -8595,9 +8595,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-cranelift"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b3ca07b3e0bb3429674b173b5800577719d600774dd81bff58f775c0aaa64ee"
+checksum = "d1679d205caf9766c6aa309d45bb3e7c634d7725e3164404df33824b9f7c4fb7"
 dependencies = [
  "cfg-if",
  "cranelift-codegen",
@@ -8622,9 +8622,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-fiber"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20c8b2c9704eb1f33ead025ec16038277ccb63d0a14c31e99d5b765d7c36da55"
+checksum = "f1e505254058be5b0df458d670ee42d9eafe2349d04c1296e9dc01071dc20a85"
 dependencies = [
  "cc",
  "cfg-if",
@@ -8637,9 +8637,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-jit-debug"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d950310d07391d34369f62c48336ebb14eacbd4d6f772bb5f349c24e838e0664"
+checksum = "1c2e05b345f1773e59c20e6ad7298fd6857cdea245023d88bb659c96d8f0ea72"
 dependencies = [
  "cc",
  "object",
@@ -8649,9 +8649,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-jit-icache-coherence"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3606662c156962d096be3127b8b8ae8ee2f8be3f896dad29259ff01ddb64abfd"
+checksum = "b86701b234a4643e3f111869aa792b3a05a06e02d486ee9cb6c04dae16b52dab"
 dependencies = [
  "cfg-if",
  "libc",
@@ -8661,9 +8661,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-unwinder"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75eef0747e52dc545b075f64fd0e0cc237ae738e641266b1970e07e2d744bc32"
+checksum = "f63558d801beb83dde9b336eb4ae049019aee26627926edb32cd119d7e4c83cd"
 dependencies = [
  "cfg-if",
  "cranelift-codegen",
@@ -8674,9 +8674,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-versioned-export-macros"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8b0a5dab02a8fb527f547855ecc0e05f9fdc3d5bd57b8b080349408f9a6cece"
+checksum = "737c4d956fc3a848541a064afb683dd2771132a6b125be5baaf95c4379aa47df"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -8685,9 +8685,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-winch"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8007342bd12ff400293a817973f7ecd6f1d9a8549a53369a9c1af357166f1f1e"
+checksum = "f599b79545e3bba0b7913406055ebede5bb0dabee9ba2015ef25a9f4c9f47807"
 dependencies = [
  "cranelift-codegen",
  "gimli",
@@ -8702,9 +8702,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-wit-bindgen"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7900c3e3c1d6e475bc225d73b02d6d5484815f260022e6964dca9558e50dd01a"
+checksum = "2192a77a00b9a67800c2b4e1c70fb6abca79d6b529e53a2ef9dcdcc36090330d"
 dependencies = [
  "anyhow",
  "bitflags 2.11.0",
@@ -8981,9 +8981,9 @@ checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
 
 [[package]]
 name = "wiggle"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc1b1135efc8e5a008971897bea8d41ca56d8d501d4efb807842ae0a1c78f639"
+checksum = "9c8cfd3db2f05619c6f36f257d84327c11546e28d61e3a1c1220aaad553bc4b0"
 dependencies = [
  "bitflags 2.11.0",
  "thiserror 2.0.18",
@@ -8996,9 +8996,9 @@ dependencies = [
 
 [[package]]
 name = "wiggle-generate"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7bc2b0d50ec8773b44fbfe1da6cb5cc44a92deaf8483233dcf0831e6db33172"
+checksum = "4bd7a197903e5b4ff5e13aef9c891960d71e92073600ecf4c86c7e795ac1c803"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
@@ -9010,9 +9010,9 @@ dependencies = [
 
 [[package]]
 name = "wiggle-macro"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6c7d44ea552e1fbfdcd7a2cd83f5c2d1e803d5b1a11e3462c06888b77f455f"
+checksum = "6410b86fcec207070d9372b215d3470bad67215e6bbac46981a16999c4abbc28"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -9042,7 +9042,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -9053,9 +9053,9 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "winch-codegen"
-version = "43.0.1"
+version = "43.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb9f45f7172a2628c8317766e427babc0a400f9d10b1c0f0b0617c5ed5b79de6"
+checksum = "52dbb0cf07b0dfe7b7a1ca8efb8f94ba98bd0fb144c411ea1665c78f0449e958"
 dependencies = [
  "cranelift-assembler-x64",
  "cranelift-codegen",