diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8d48ef4..3b10144 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,6 +35,15 @@ All notable changes follow Keep a Changelog and Semantic Versioning.
   freezing, and strict provider-event settlement.
 - A source-qualified Node.js 24, Next.js 16, and React 19.2 web-recipe decision
   for the Wave 4B greenfield path.
+- One exact bundled Node.js 24.18.1, npm 11.16.0, Next.js 16.3.4, React 19.2.8,
+  and Playwright 1.62.1 web recipe with native format, lint, type, unit,
+  integration, browser, build, package, and CI gates.
+- Deterministic separately approved greenfield and compatible-adoption plans,
+  transactional apply, generated-file ownership in `mill.lock`, manual detach
+  planning, and isolated adoption branches.
+- Attended lock/image-bound dependency preparation plus `run next`, resumable
+  `start`, and two-step `ship --draft` founder commands over existing lifecycle
+  authority.
 
 ### Changed
 
@@ -42,8 +51,32 @@ All notable changes follow Keep a Changelog and Semantic Versioning.
   incompatible major upgrades require an intentional toolchain qualification.
 - Executable JSON Schemas are generated from runtime contract inputs and checked
   for exact drift in the native gate.
+- Repository apply now uses target-scoped exclusion, no-replace reservation, and
+  final atomic Git-authority publication; dependency snapshots bind npm/registry
+  identity, validate lock origins and installed-tree content, stop and clean up
+  on cancellation, and founder start binds the selected PRD before spend.
 - New baseline qualifications and runs require task-packet version 2 with exact
   continuity authority; version 1 remains byte-stable for in-flight resume.
+- OCI command scratch is explicit and limited to comma-free top-level tmpfs
+  directories; dependency inputs remain exact-lock-bound and read-only.
+- Repository plans use one non-self-referential approval identity recorded in
+  the returned plan and `mill.lock`; founder resume selects preflight and
+  dependency work from the persisted lifecycle stage.
+- Recipe tasks require named behavior-specific oracles; integration plans bind
+  the generator version and canonical target, adoption binds exact lock/oracle
+  bytes, and dependency snapshots derive identity from frozen lock copies.
+- Canonical target identity is digest-bound, final greenfield publication never
+  replaces a late-created target, adoption blocks symbolic links and
+  credential-like files, and integration writes reject unsafe ancestors.
+- Generated impact and task risk now follows affected invariant criticality,
+  medium/high risk requires non-normal scenario evidence, and active-run
+  admission is serialized with run creation.
+- Founder resume preflights exact remote-review and interrupted recovery before
+  spending its bounded repair, and integration approvals must be active ISO
+  timestamps.
+- Recipe integration rejects cross-outcome scenarios, duplicate acceptance
+  references, unprovable invariant modes, builder-writable PRDs, `.npmrc`, and
+  non-root or credential/query-bearing npm lock-source bypasses.
 
 ### Deprecated
 
@@ -55,6 +88,8 @@ All notable changes follow Keep a Changelog and Semantic Versioning.
 
 ### Fixed
 
+- Complete SHA-512 integrity parsing and CommonMark punctuation escaping close
+  truncated-integrity and product-title interpretation gaps.
 - Exact-version recovery, DCO parsing, per-job workflow bounds, JSON usage
   errors, malformed-contract classification, operator-tool discovery, Node
   readiness, valid `..name` paths, Git-root lock authority, JSON help isolation,
@@ -105,6 +140,10 @@ All notable changes follow Keep a Changelog and Semantic Versioning.
   expired effect authority cannot strand readback or truthful closure.
 - Worker exit evidence and active-process clearing now commit atomically, so a
   controller crash after process exit leaves a safely reconcilable invocation.
+- Recipe verification uses a read-only workspace skeleton with individually
+  bound source entries, bounded writable scratch and browser shared memory,
+  delayed-mount cleanup handling, and fail-closed occupied or unrepresentable
+  mount targets.
 
 ### Security
 
diff --git a/README.md b/README.md
index 4d959ac..d410231 100644
--- a/README.md
+++ b/README.md
@@ -14,10 +14,13 @@ published eventually as `@davidahmann/mill` to avoid collision with the existing
 
 Wave 4A adds source-backed planning contracts, stable product invariants,
 approved per-slice impact, scenario-specific semantic evidence, and durable
-worker admission. Its planning commands are deliberately read-only: today an
-operator supplies the structured proposal, while Wave 4B will coordinate the
-qualified planner and transactionally apply the first Node.js 24/Next.js 16 web
-recipe.
+worker admission. Wave 4B adds one exact Node.js 24/Next.js 16 web recipe,
+transactional greenfield and compatible-adoption integration, lock-bound
+dependency preparation, offline read-only recipe verification, manual detach
+planning, and resumable founder commands. Planning remains deliberately honest:
+in this pre-alpha, an operator supplies the structured proposal that Mill
+assesses and freezes; live autonomous research and proposal generation are not
+implemented.
 
 Mill's v1 boundary is deliberately narrow:
 
@@ -44,6 +47,84 @@ node dist/cli.js inspect --prd product/PRD.md
 node dist/cli.js adopt --scan-only
 ```
 
+## Onboard one supported repository
+
+The first supported recipe is exact: Node.js 24.18.1, npm 11.16.0, Next.js
+16.3.4, React 19.2.8, TypeScript 6.0.3, and Playwright 1.62.1 in a digest-pinned
+OCI image. Mill itself uses Node.js 24.20.0; the recipe patches follow the
+contents of its verifier image.
+
+First run the read-only specification assessment and copy its exact approval
+digest. Then preview a greenfield or adoption plan. Apply is a second explicit,
+attended operation bound to that exact plan:
+
+```sh
+node dist/cli.js --json plan specification \
+  --prd product/PRD.md --sources product/sources.yaml \
+  --proposal product/proposal.yaml
+
+node dist/cli.js --json new my-product --dry-run \
+  --prd product/PRD.md --sources product/sources.yaml \
+  --proposal product/proposal.yaml --approve-product sha256:<product> \
+  --repository-id <uuid> --approved-by <identity> --approved-at <iso-time> \
+  --author-name <name> --author-email <email>
+
+node dist/cli.js --json new my-product --apply --attended \
+  --prd product/PRD.md --sources product/sources.yaml \
+  --proposal product/proposal.yaml --approve-product sha256:<product> \
+  --approve-plan sha256:<integration-plan> --repository-id <uuid> \
+  --approved-by <identity> --approved-at <iso-time> \
+  --author-name <name> --author-email <email>
+```
+
+For an existing compatible repository, use `adopt --plan` and then
+`adopt --apply --attended` with the same authority fields. Adoption supports
+only the exact recipe-compatible Next.js tuple, blocks conflicting repository
+truth, a missing or drifted recipe-native oracle closure, or unsafe Git state.
+The adoption boundary compares the exact qualified dependency lock, runtime,
+native scripts, and oracle bytes; existence alone is never compatibility. It
+creates an isolated branch and leaves the operator checkout unchanged; arbitrary
+existing test graphs are not inferred. Adoption also blocks symbolic links and
+credential-like files, including `.npmrc`, rather than allowing generated writes
+or builder context to follow them. The approved PRD must remain outside the
+generated `app`, `public`, and `src` builder scopes. Greenfield apply stages the
+complete target and, only after qualification succeeds, reserves the absent path
+without replacement. It copies non-authoritative files first and atomically
+installs the complete `.git` directory last; the target is not a repository
+before that final boundary. The integration approval digest is a
+non-self-referential identity over the approved target, including its
+canonical-path digest, product, recipe, policy, and every non-lock file action.
+`mill.lock` is deterministically derived from and records that same digest. An
+approved blueprint selecting any other recipe, version, or runtime blocks. The
+plan also exposes and binds the exact Mill generator package/version. Greenfield
+paths are canonicalized beneath the selected root, and any symbolic link or
+non-directory ancestor blocks before staging or registry access. Approval
+timestamps must be exact ISO datetimes that are already active, never
+future-dated declarations.
+
+Dependency installation is a distinct attended step with disclosed npm-registry
+network and disabled lifecycle scripts. The config declares npm and the exact
+`https://registry.npmjs.org` origin; preparation rejects resolved lock entries
+outside that HTTPS origin, credential-bearing or query-bearing URLs, entries
+without a complete SHA-512 source identity, and unsupported links/workspaces.
+The root `package-lock.json` consumed by `npm ci` must be included and is always
+the lock graph validated, regardless of other bound locks. Mill copies lock
+inputs first, keys and validates the frozen copies, and rechecks them after
+installation before atomic publication. Its marker binds and revalidates the
+installed dependency-tree bytes and filesystem shape before reuse and
+verification. Cancellation stops the installer process group and completes
+container cleanup. Preparation requires both attendance and build trust at the
+exported runtime boundary. Later verification has no network and never writes
+source:
+
+```sh
+node dist/cli.js --json dependencies prepare --attended
+node dist/cli.js --json detach plan
+```
+
+`detach plan` reports Mill-only files to remove and downstream-owned files to
+retain or review. It does not mutate the repository.
+
 ## Run one attended local task
 
 A build-enabled downstream repository supplies `mill.yaml`, a task packet, and
@@ -76,6 +157,34 @@ node dist/cli.js --json review --task product/tasks/TASK.yaml --run <run-id>
 node dist/cli.js --json status --run <run-id>
 ```
 
+A managed repository may instead select exactly one ready outcome and use the
+founder wrappers:
+
+```sh
+node dist/cli.js --json qualify --baseline \
+  --task product/tasks/<outcome>.yaml
+node dist/cli.js --json run next --approve sha256:<baseline> --attended
+node dist/cli.js --json start --prd product/PRD.md --attended
+node dist/cli.js --json ship --draft \
+  --task product/tasks/<outcome>.yaml --run <run-id>
+# Inspect the returned proposal, then:
+node dist/cli.js --json ship --draft \
+  --task product/tasks/<outcome>.yaml --run <run-id> \
+  --approve sha256:<delivery-plan> --attended
+```
+
+`start` proves the selected PRD and task authority before registry or model
+spend, including identical product-plan, product-contract, impact, and
+acceptance sets. It inventories every nonterminal run, even when a newer run is
+already terminal, then resumes the sole matching durable lifecycle. New-run
+admission repeats that check under the writer lease that creates the run.
+`run next` applies the same authority comparison before it can create a run.
+With `--draft-pr`, `start` prepares and returns the exact draft-PR plan digest;
+`ship --draft --approve` remains the separate attended mutation. A later `start`
+can resume remote readback and closure without requiring Codex or repeating
+dependency preparation. It still cannot mark ready, merge, or deploy. The expert
+lifecycle commands remain available for inspection and recovery.
+
 `run` creates the candidate on a Mill-owned branch in a disposable worktree; it
 does not modify the operator checkout. `resume` reconciles an interrupted
 controller only when no recorded execution can still be active, or performs the
@@ -193,10 +302,11 @@ excluded material untracked and outside the repository.
 
 Not published. Local attended delivery and the bounded draft-PR lifecycle are
 implemented, and the first disposable real-Codex/GitHub canary was human-merged,
-verified on resulting main, and truthfully finalized. Product-continuity and
-worker-admission contracts are implemented. Transactional recipe application,
-retrofit, the founder `start` coordinator, stronger hostile-host containment,
-genesis release, and generalized stack-compatibility claims remain pending their
+verified on resulting main, and truthfully finalized. Product continuity, worker
+admission, transactional application of one exact web recipe, compatible
+adoption, and the resumable founder path are implemented. Autonomous planning,
+stronger hostile-host worker containment, longitudinal qualification, genesis
+release, and generalized stack-compatibility claims remain pending their
 explicit gates.
 
 ## License
diff --git a/WORKFLOW.md b/WORKFLOW.md
index 0ff5e82..cd5c81b 100644
--- a/WORKFLOW.md
+++ b/WORKFLOW.md
@@ -9,7 +9,8 @@ bookkeeping, closure, tests, or docs into micro-PRs.
 3. Exact commit to draft PR, reconciliation, and closure.
 4. Product continuity, one greenfield web recipe, retrofit, and founder golden
    path. Wave 4A establishes the read-only contracts and durable worker
-   boundary; Wave 4B applies them transactionally.
+   boundary; Wave 4B applies them transactionally through exact product and
+   integration approvals.
 5. Audits, clean-room qualification, genesis distribution, and public alpha.
 
 For each wave:
@@ -36,6 +37,30 @@ it does not prevent readback or closure of an effect already attempted. A
 current candidate may add future oracles, but those changed oracles do not
 independently certify that same candidate.
 
-Current Factory skills are optional maintainer-side bootstrap tools. Their
-prompts, profiles, artifacts, or state are not Mill runtime or product
-dependencies. Native repository commands remain sufficient and authoritative.
+Factory skills may be used externally as optional maintainer-side delivery
+tools, but Mill does not track a Factory profile, verifier, pack, or runtime
+dependency. Mill's native repository commands, Git workflow, and GitHub checks
+remain sufficient and authoritative for development and shipping.
+
+For greenfield or adoption onboarding, first assess and explicitly approve the
+source-backed product proposal, then inspect and separately approve the exact
+repository integration plan. Greenfield apply publishes no target until the
+recipe's full native gate passes. Adoption apply writes one isolated branch and
+does not alter the operator checkout. Registry access is a separate attended
+dependency-preparation effect; later candidate verification has no network and
+mounts source read-only.
+
+A recipe-generated task may cite command evidence only through a named oracle
+declared by that exact recipe and selected by the approved scenario. The oracle
+binds its delivered behavior and evidence paths. Greenfield path ancestors,
+adoption lock/oracle bytes, the generator version, trust mode, and attendance
+are revalidated at the exported apply/effect boundary rather than trusted from
+the CLI wrapper.
+
+After onboarding, `run next` selects exactly one ready approved outcome. `start`
+may resume that outcome through the existing run, verify, review, delivery
+observation, and closure states. `ship --draft` remains a wrapper over the same
+exact proposal-digest and attended GitHub effect boundary. Wrappers do not mark
+a draft ready, merge, deploy, or create a second lifecycle. Selection compares
+the plan, product contract, impact, acceptance IDs, and task exactly and scans
+all nonterminal runs, not only the newest record, before any spend.
diff --git a/architecture/ARCHITECTURE.md b/architecture/ARCHITECTURE.md
index 2939e61..fcf2527 100644
--- a/architecture/ARCHITECTURE.md
+++ b/architecture/ARCHITECTURE.md
@@ -81,6 +81,85 @@ same transaction that clears its active-process binding. A possibly started
 mutating invocation becomes uncertain and is reconciled from candidate, process,
 and worktree state instead of being blindly replayed.
 
+Wave 4B turns those approved contracts into repository integration without
+adding another executor. The bundled `node-typescript-next-web` recipe binds one
+manifest digest to every exact generated asset, dependency version, runtime
+patch, native command, license allowlist, and digest-pinned verifier image. A
+greenfield plan is staged outside its destination, receives a separate exact
+human approval, prepares lock-bound dependencies through attended registry
+network, runs the complete recipe gate, creates one canonical DCO commit, and
+only then reserves the still-absent target without replacement. It materializes
+files without `.git` and atomically renames the complete staged `.git` directory
+into place as the final authority-publication boundary; the reserved path is not
+a repository before that operation. A target-scoped exclusive lock prevents
+concurrent Mill apply, while the exclusive reservation preserves a target
+created by another process after approval. Greenfield publication is a two-phase
+cancellation boundary: target materialization stays cancellable and rechecks
+immediately before the atomic `.git` rename; once that rename is invoked, Mill
+completes and reports the exact published result. Failure removes staging, the
+Mill-owned reservation, and only state created by that attempt. Adoption first
+performs the static scanner and exact compatibility checks, rejects symbolic
+links and credential-like files including `.npmrc`, and requires the approved
+PRD to remain outside generated builder-writable source scopes. It then records
+only non-conflicting integration files on an isolated branch; the operator
+checkout does not move. Adopted commands retain their native scripts only when
+they and their recipe-owned oracle files match the exact qualified closure; Mill
+does not guess an arbitrary repository's test graph. `mill.lock` records recipe
+and plan identity, base commit, file ownership, template bytes, installed bytes,
+and preexisting bytes so detachment can remain an inspectable manual decision.
+The approved plan identity excludes its derived lock bytes to avoid a digest
+cycle, binds every other plan field and file action including a digest of the
+canonical absolute target, and is then recorded unchanged in both the plan and
+`mill.lock`. Planning also proves that the approved blueprint selects the exact
+bundled recipe, version, and runtime. Packable template aliases are rendered to
+required dotfiles, and product values are emitted as syntax-safe source and
+Markdown literals. A generated product task may use recipe command evidence only
+when its approved scenario names a matching recipe oracle. That oracle declares
+the specific delivered behavior, command, and evidence paths; a generic `check`
+label alone grants no product evidence. Selected invariants must be
+command-verifiable, and scenarios cannot cross the selected outcome's acceptance
+closure. The integration identity also binds the exact Mill generator
+package/version. Greenfield targets are canonicalized beneath the selected root
+and reject symbolic-link or non-directory ancestors before plan or apply
+effects. Integration writes independently reject unsafe file ancestors rather
+than trusting a previous scan. Generated task risk is derived from affected
+invariant criticality; medium- and high-risk outcomes need an approved
+executable non-normal scenario.
+
+Dependency preparation and candidate verification are separate authorities.
+Preparation uses the exact verifier image, an explicit npm manager and HTTPS
+registry origin, disabled lifecycle scripts, bounded resources, and an attended
+network disclosure. The exported boundary independently requires build trust and
+attendance. It copies approved lock inputs to staging before identity, rejects
+an absent root `package-lock.json`, alternate or credential/query-bearing
+sources, unsupported links/workspaces, malformed or incomplete SHA-512
+integrity, and absent or symbolic dependency output, then rechecks the frozen
+inputs before atomically publishing a snapshot keyed by verifier image, manager,
+registry, target, and lock bytes. The marker also binds a deterministic digest
+of every installed directory, regular-file byte stream, executable bit, and
+contained symbolic-link target; both preparation reuse and verification
+recompute it. Operator cancellation reaches the networked installer process
+group and cleanup completes before the cancellation result is returned.
+Verification never installs or pulls. It mounts that snapshot read-only, mounts
+each top-level source entry read-only through a protected workspace skeleton,
+and exposes only declared comma-free top-level scratch directories as bounded
+tmpfs. This preserves a read-only candidate while supporting framework and
+browser outputs. Nested scratch paths, occupied mount targets, symbolic links,
+unsupported entries, and ambiguous comma-bearing entry names fail closed.
+
+The founder commands are coordinators, not new state machines. `run next`
+resolves exactly one ready outcome and calls the existing run boundary. `start`
+binds that outcome, its product-contract digest, approved impact, acceptance
+set, and task before registry or model spend, inventories all nonterminal runs
+rather than trusting recency, then advances the same sole durable build,
+verification, review, remote-readback, and closure states. Remote readback and
+closure do not re-run build preflight or dependency preparation. `ship --draft`
+retains the existing separate exact proposal and attended open operations. None
+of these commands can mark ready, merge, deploy, or interpret an unapproved PRD
+as execution authority. The lifecycle boundary repeats the no-active-run check
+under the same exclusive writer lease that creates a run, so two coordinators
+cannot pass a stale preflight and create parallel lifecycles.
+
 The GitHub adapter is isolated behind the delivery coordinator. Planning reads
 the live delegated actor, repository node identity, clone URL, fork status and
 default branch, then binds them with the candidate commit/tree, task/config,
@@ -179,12 +258,13 @@ allowing writes. There is no background daemon or implicit retry.
 - GitHub shipper, effect journal, readback, and closure;
 - audits and qualification/release commands.
 
-The first qualified greenfield recipe is a Node.js 24 TypeScript web modular
-monolith using Next.js 16 App Router and the React 19.2 family. It is
-deliberately one recipe, not a generalized stack claim. Wave 4B must freeze
-exact dependency and OCI identities, generate native
-lint/type/unit/integration/browser/build gates, and prove the repository works
-without Mill before applying it.
+The first qualified greenfield recipe is a Node.js 24.18.1 and npm 11.16.0
+TypeScript web modular monolith using Next.js 16.3.4, React 19.2.8, and
+Playwright 1.62.1. These runtime patches truthfully match the selected exact OCI
+image and are intentionally independent of Mill's Node 24.20.0 maintainer
+runtime. The recipe generates native format, lint, type, unit, integration,
+browser, build, and package gates and remains independently operable with npm.
+It is deliberately one qualified recipe, not a generalized stack claim.
 
 ## Identity and authority
 
@@ -197,18 +277,22 @@ before the call and reconciles unknown outcomes before retry.
 ## Containment claim
 
 Selected verification commands run against a clean exact candidate in a
-digest-pinned OCI environment with no network, a read-only root and workspace,
-dropped capabilities, no-new-privileges, resource bounds, and no implicit image
-pull. Every command receives an opaque Mill-owned container name and evidence is
-withheld until an unconditional, separately bounded `docker rm --force`
-succeeds. If a canonical workspace path contains a comma, Mill mounts it through
-a mode-restricted, exact-realpath temporary alias so Docker's comma-delimited
-long syntax does not truncate the source. Codex runs in attended trusted-host
-mode using workspace-write sandboxing and promotion-time Git scope and identity
-checks. Mill does not claim this prevents all host access. Stronger containment
-requires a separately qualified container/VM worker with controlled model
-authentication and no host-home, Docker-socket, keychain, or forge credential
-access.
+digest-pinned OCI environment with no network, a read-only root, individually
+read-only top-level source mounts, dropped capabilities, no-new-privileges,
+bounded PID/memory/CPU/shared-memory/output/deadline resources, and no implicit
+image pull. Declared top-level dependency inputs mount read-only and declared
+top-level scratch outputs mount as bounded tmpfs; they may not hide candidate
+content. Every command receives an opaque Mill-owned container name and evidence
+is withheld until an unconditional, separately bounded `docker rm --force`
+succeeds. If the canonical workspace or dependency source path contains a comma,
+Mill uses a mode-restricted exact-realpath alias so Docker's comma-delimited
+long syntax cannot truncate it. A top-level candidate entry containing a comma
+is not representable by this verifier and blocks. Codex runs in attended
+trusted-host mode using workspace-write sandboxing and promotion-time Git scope
+and identity checks. Mill does not claim this prevents all host access. Stronger
+containment requires a separately qualified container/VM worker with controlled
+model authentication and no host-home, Docker-socket, keychain, or forge
+credential access.
 
 ## Release trust
 
diff --git a/docs/canaries/wave-4b-recipe.md b/docs/canaries/wave-4b-recipe.md
new file mode 100644
index 0000000..dc7f1df
--- /dev/null
+++ b/docs/canaries/wave-4b-recipe.md
@@ -0,0 +1,73 @@
+# Wave 4B recipe qualification
+
+Status: pre-merge local qualification passed; exact-candidate repository gate
+and CI remain required for promotion
+
+Observed: 2026-09-02
+
+## Bound inputs
+
+- Recipe: `node-typescript-next-web` version `1.0.0`
+- Recipe digest:
+  `sha256:37fd49eea9c11ccb026006f0e93198a20d6e8b51da319690d7e5f97b1bcc8203`
+- Package manifest SHA-256:
+  `77e58b17cf2b2aa5e7ca28972398f63d86877f468d121e897d0467a3babd0a72`
+- Package lock SHA-256:
+  `7a7c7bc7baacb54150ef832107245c8e5274a1df193548422c90699edce1a3eb`
+- Verifier image:
+  `mcr.microsoft.com/playwright:v1.62.1-noble@sha256:dcc5531e97840b9b5e794f2814476b21571c5124a3fca2267d73041f56e7580e`
+- Runtime observed inside that image: Node.js `24.18.1`, npm `11.16.0`
+- Writable mounts: `.next`, `.mill-output`
+- Network during verification: none
+
+The dependency snapshot was prepared separately through attended npm-registry
+network with lifecycle scripts, audit, and funding calls disabled. The build
+trust and attendance grants were rechecked at the runtime boundary. The runtime
+copied lock inputs before deriving identity, required every installable entry to
+carry a declared HTTPS npm source and SHA-512 integrity, rejected links and
+workspaces, revalidated the frozen bytes after installation, and proved a
+regular dependency tree. Snapshot identity binds the manager, registry, target,
+exact image, and both frozen lock-input byte digests; its marker also binds the
+installed tree digest, which is recomputed before reuse and verification.
+
+## Executed path
+
+Mill's production verifier mounted every source entry read-only, mounted the
+prepared `node_modules` snapshot read-only, and provided the two declared output
+trees as bounded tmpfs. The container used a read-only root, dropped all
+capabilities, enabled no-new-privileges, bounded PID, memory, CPU, shared
+memory, deadline, and output, and was removed before evidence was accepted.
+
+The recipe's single required `check` executed:
+
+1. Prettier check
+2. ESLint
+3. TypeScript
+4. Unit test
+5. Integration test
+6. Chromium browser scenario against the production build
+7. Standalone production build/package check
+
+Result: passed in 16,344 ms (16,424 ms including verifier orchestration).
+Captured stdout/stderr digest:
+`sha256:b661a730c2307a405cc4e3f8a57b1f108856f8cd325321b292e71ac3cc52a211`.
+
+Deterministic repository fixtures separately cover exact greenfield and adoption
+planning, transactional apply, isolated adoption branches, failed-qualification
+cleanup, ownership/detach reporting, approval mismatch, incompatible versions,
+unsafe Git state, conflicting authority, dirty checkout, exact blueprint recipe
+selection, named recipe-oracle selection, canonical no-symlink targets,
+generator-bound plan-to-lock identity, exact adoption oracle and dependency-lock
+bytes, frozen dependency inputs, packed dotfile delivery, context-safe product
+titles, complete outcome/task/acceptance binding, all-run inventory, and
+stage-scoped resume preflight. The full Mill gate and exact-candidate review
+remain the promotion authority for the implementation that contains those
+fixtures.
+
+## Claim boundary
+
+This proves the exact bundled recipe can execute its native delivered-surface
+gate through Mill's offline verifier on this development host. It does not prove
+public distribution, clean-machine installation, arbitrary Next.js adoption,
+other stacks, another OCI engine, or autonomous PRD-to-proposal planning. Those
+claims remain Wave 5 or later work.
diff --git a/docs/development.md b/docs/development.md
index c5b6f35..18a1e79 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -90,6 +90,38 @@ and selected web-recipe contracts. Those tests prove contract behavior; they do
 not replace exact-candidate review or CI because a candidate cannot certify
 itself by changing its own oracle.
 
+Wave 4B adds deterministic greenfield and adoption plan/apply fixtures, exact
+recipe-asset digesting, ownership/detach checks, failed-staging cleanup,
+lock/image-bound dependency preparation, installed-tree drift rejection,
+cancellation cleanup, and founder coordinator recovery. Adversarial cases cover
+target-lock contention, preserved preexisting state, symbolic-link target
+ancestors, direct API attendance and trust bypasses, untrusted or incomplete npm
+lock sources, frozen-lock drift, missing installer output, exact
+PRD/source/outcome/acceptance authority, canonical-target aliasing, target
+creation between approval and reservation, future approval times,
+credential-like adoption files including `.npmrc`, PRDs inside builder-writable
+source scope, cross-outcome scenarios, unprovable invariant modes, unsafe
+generated-file ancestors, risk evidence understatement, older nonterminal runs
+hidden by newer terminal records, and adoption with missing or modified oracle
+bytes. Dependency cases validate the root lock consumed by npm even when another
+lock is listed first and reject credential/query-bearing registry URLs.
+Recipe-generated task evidence requires a named recipe-specific oracle; a
+generic command reference blocks. The recipe itself is also exercised in the
+exact pinned Playwright image with network disabled, a read-only root and source
+tree, read-only dependencies, declared top-level tmpfs scratch, bounded Chromium
+shared memory, and native
+format/lint/type/unit/integration/browser/build/package commands. This is one
+qualified recipe tuple, not evidence for arbitrary stacks.
+
+The npm dependency target is exactly `node_modules`; writable scratch paths must
+be comma-free top-level repository directories. They cannot already exist in the
+exact candidate because a mount would hide candidate content. The verifier also
+rejects more than 256 top-level entries, top-level symbolic links, unsupported
+filesystem entries, and top-level names containing commas. The workspace path
+itself may contain commas because Mill creates and verifies an exact temporary
+alias. These restrictions are current product limits, not silent portability
+claims.
+
 Task-packet version `1` is accepted only to resume or inspect work that began
 before the continuity contract. Baseline qualification and every new run require
 version `2`, including an approved impact manifest and explicit acceptance,
@@ -105,7 +137,13 @@ ready, merge, deploy, or rerun remote checks.
 The completed Wave 3 canary is recorded in
 [`docs/canaries/wave-3-real-github.md`](canaries/wave-3-real-github.md). It also
 shows why provider-authoritative usage must be budgeted: even a tiny task can
-consume substantial context tokens while currency cost remains unavailable.
+consume substantial context tokens while currency cost remains unavailable. The
+Wave 4B recipe qualification is recorded in
+[`docs/canaries/wave-4b-recipe.md`](canaries/wave-4b-recipe.md). The package
+test must load the installed tarball's recipe and assert that packable aliases
+render required dotfiles and untrusted product strings remain valid source
+literals. Integration tests must also prove the same approved plan digest
+appears in the plan result and generated `mill.lock`.
 
 ## Architecture questions
 
diff --git a/eslint.config.js b/eslint.config.js
index 7e465c0..6f0e8e8 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -3,7 +3,7 @@ import tseslint from "typescript-eslint";
 
 export default tseslint.config(
   {
-    ignores: ["coverage/**", "dist/**", "node_modules/**"],
+    ignores: ["coverage/**", "dist/**", "node_modules/**", "recipes/**"],
   },
   eslint.configs.recommended,
   ...tseslint.configs.strictTypeChecked,
diff --git a/package.json b/package.json
index a926d06..6c8a731 100644
--- a/package.json
+++ b/package.json
@@ -10,6 +10,7 @@
   },
   "files": [
     "dist/",
+    "recipes/",
     "schemas/",
     "README.md",
     "LICENSE"
diff --git a/product/PLAN.md b/product/PLAN.md
index 8c7fac0..bf543cc 100644
--- a/product/PLAN.md
+++ b/product/PLAN.md
@@ -23,9 +23,11 @@ choices close only before their wave. The current detailed task is in
 
 Waves 1 through 3 are landed. The attended Wave 3 disposable-repository canary
 opened, reviewed, human-merged, and truthfully finalized the exact candidate;
-its resulting-main check passed. Wave 4A is delivered by the current change:
-source and product continuity contracts, semantic impact evidence, immutable
-worker admission, and the selected Node.js 24/Next.js 16 web recipe. Wave 4B is
-next: transactional bootstrap and retrofit, recipe application, task
-compilation, and the resumable founder `start` path. No public-alpha or general
+its resulting-main check passed. Wave 4A is landed: source and product
+continuity contracts, semantic impact evidence, immutable worker admission, and
+the selected Node.js 24/Next.js 16 web-recipe decision. Wave 4B is delivered by
+the current change: the exact recipe assets, transactional greenfield and
+compatible-adoption integration, lock-bound dependency preparation, read-only
+offline recipe verification, task compilation, manual detach planning, and the
+resumable founder path. No public-alpha, autonomous-planner, or general
 stack-support claim is made before Wave 5 qualification.
diff --git a/product/PRD.md b/product/PRD.md
index f0eef43..73a7f0a 100644
--- a/product/PRD.md
+++ b/product/PRD.md
@@ -33,11 +33,20 @@ Given a PRD and supporting evidence, Mill must:
 9. push only the verified commit and open one draft PR through local `gh`;
 10. reconcile ambiguous external effects and observe human merge/main checks.
 
+In the current pre-alpha, an operator supplies the structured source manifest
+and specification proposal that Mill assesses and freezes. Mill does not yet
+claim autonomous live research or proposal generation from prose alone. Once a
+repository is integrated, `start` coordinates one already approved ready outcome
+through the existing lifecycle; it does not reinterpret the PRD on every run.
+
 For every material slice, Mill must also preserve product continuity: stable
 acceptance and invariant IDs, an approved impact manifest, a realistic scenario
 set, and item-level evidence that distinguishes new behavior from preservation.
 A generic passing test, model statement, digest, or current-run oracle change is
-not semantic evidence for an unrelated requirement.
+not semantic evidence for an unrelated requirement. For repository creation, a
+task may use bundled command evidence only when its approved scenario selects a
+named recipe oracle that declares the specific behavior and evidence paths.
+Otherwise the evidence disposition blocks.
 
 ## Trust modes
 
@@ -71,9 +80,18 @@ self-modification.
 - Humans approve consequential ambiguity and remote effects; tools do not infer
   authority from available credentials.
 - Native repo commands and typed contracts are authoritative.
+- Repository onboarding has a non-mutating product approval followed by an exact
+  integration-plan approval; apply never infers approval from a PRD.
+- Integration identities bind the generator version, canonical target, exact
+  recipe and adoption-oracle bytes, and frozen dependency lock graph.
 - Model output may vary; approved canonical bytes and exact candidates do not.
 - Research and planning propose product truth; they never approve themselves.
 - Durable worker admission precedes process launch, and a possibly started
   mutating invocation is reconciled rather than blindly replayed.
 - Required pending, skipped, stale, or flaky evidence does not count as pass.
 - Downstream repositories work without Mill.
+- Dependency preparation may use attended registry network, but candidate
+  verification is offline, source-read-only, and limited to declared scratch;
+  attendance and build trust are enforced again at the effect boundary.
+- Outcome execution compares plan, product, impact, acceptance, and task
+  authority and accounts for every nonterminal run before external spend.
diff --git a/product/blueprints/node-typescript-web.yaml b/product/blueprints/node-typescript-web.yaml
index 2021369..a8996f6 100644
--- a/product/blueprints/node-typescript-web.yaml
+++ b/product/blueprints/node-typescript-web.yaml
@@ -3,18 +3,22 @@ id: node-typescript-web
 productContractDigest: sha256:248dcec81cbe616a0899b246ea9d768f3bc5ae270484ff451fe01fbf9d36e3ea
 recipe: node-typescript-next-web
 recipeVersion: 1.0.0
-runtime: node-24-active-lts
+runtime: node-24.18.1-npm-11.16.0
 architecture:
   - TypeScript modular monolith
   - Next.js 16 App Router with React 19.2 family
   - server components by default and explicit client boundaries
   - native lint, typecheck, unit, integration, browser, build, and package gates
   - repository-local exact runtime and dependency lock
+  - exact Playwright 1.62.1 OCI verifier image with offline read-only source
+  - top-level .next and .mill-output scratch trees isolated as tmpfs
   - portable Node server or OCI deployment with no hosting-vendor requirement
 risks:
   - framework and dependency patches require source refresh and explicit recipe
     revision
   - browser acceptance needs a qualified Playwright image and deterministic
     fixtures
+  - recipe Node and npm patch pins follow the exact verifier image and can lag
+    Mill's maintainer runtime within the Node 24 family
   - persistence, identity, billing, and deployment are product decisions, not
     recipe defaults
diff --git a/product/impacts/WAVE_4B.yaml b/product/impacts/WAVE_4B.yaml
new file mode 100644
index 0000000..c8169aa
--- /dev/null
+++ b/product/impacts/WAVE_4B.yaml
@@ -0,0 +1,42 @@
+schemaVersion: "1"
+id: mill-wave-4b-founder-path
+productContractDigest: sha256:248dcec81cbe616a0899b246ea9d768f3bc5ae270484ff451fe01fbf9d36e3ea
+outcomeId: OUT-PRODUCT-CONTINUITY
+riskClass: high
+acceptanceIds:
+  - ACC-CONTINUITY
+  - ACC-TRUTHFUL-RECOVERY
+affectedInvariantIds:
+  - INV-HUMAN-AUTHORITY
+  - INV-EXACT-EVIDENCE
+  - INV-WORKER-LEAST-AUTHORITY
+  - INV-DOWNSTREAM-INDEPENDENT
+uncertainInvariantIds: []
+surfaces:
+  - id: repository-integration
+    kind: system
+    change: Apply one exact supported recipe or compatible adoption plan.
+  - id: native-web-verification
+    kind: system
+    change: Verify the complete recipe through read-only offline OCI execution.
+  - id: founder-coordinator
+    kind: user
+    change: Resume one approved outcome through existing lifecycle boundaries.
+scenarioIds:
+  - SCN-TRANSACTIONAL-GREENFIELD
+  - SCN-ADOPTION-CONFLICT
+  - SCN-READONLY-WEB-RECIPE
+  - SCN-FOUNDER-RESUME
+commandIds:
+  - test:coverage
+  - test:package
+materialDecisions:
+  - DEC-NODE-24
+  - DEC-WEB-RECIPE
+  - DEC-OPERATOR-SESSIONS
+unresolved: []
+exceptions: []
+approval:
+  approvedBy: davidahmann
+  approvedAt: "2026-09-02T15:00:00.000Z"
+  proposalDigest: sha256:6d192e7b8fab97ad2ca2d65f39c16c246bb263e02b7ec106e5fec59fd87aac85
diff --git a/product/sources.yaml b/product/sources.yaml
index 1af14e8..ab48ad8 100644
--- a/product/sources.yaml
+++ b/product/sources.yaml
@@ -24,7 +24,7 @@ sources:
   - id: SRC-PRD
     class: user_evidence
     uri: product/PRD.md
-    revision: sha256:3d61c3632c38c65d3994623166a4d003c35e7d363c170c7d347fd561aa7fa992
+    revision: sha256:0647e22a5bae4001dad81d842a67925715f1c70605770ebd7de66ae9d26c283f
     observedAt: "2026-09-02T11:00:00.000Z"
     freshness: current
     authority: constraint
diff --git a/product/tasks/WAVE_4A.yaml b/product/tasks/WAVE_4A.yaml
index 44a570f..3c11b5c 100644
--- a/product/tasks/WAVE_4A.yaml
+++ b/product/tasks/WAVE_4A.yaml
@@ -1,5 +1,5 @@
 task_id: mill-wave-4a-continuity
-status: active
+status: closed
 objective: >-
   Add source-backed product planning, stable behavioral invariants, approved
   per-slice impact manifests, item-level semantic validation, and durable
@@ -145,3 +145,11 @@ docs_sync_refs:
   - architecture/ARCHITECTURE.md
   - docs/development.md
   - WORKFLOW.md
+closure:
+  pull_request: https://github.com/davidahmann/mill/pull/5
+  candidate_commit: 19e56665d47a318e7e6805d2c9ad1074b7f35f05
+  merge_commit: 39ae11f55f7f72e048c10baef3a1754fecc83286
+  resulting_tree: 42c8a238edfb75b0522d1c22dadb1a448f8aa421
+  merged_at: "2026-09-02T14:11:54.000Z"
+  required_checks: [validate, codeql, dependency-review]
+  result: closed
diff --git a/product/tasks/WAVE_4B.yaml b/product/tasks/WAVE_4B.yaml
new file mode 100644
index 0000000..9d8409f
--- /dev/null
+++ b/product/tasks/WAVE_4B.yaml
@@ -0,0 +1,137 @@
+task_id: mill-wave-4b-founder-path
+status: closed
+objective: >-
+  Turn the approved Wave 4 product contracts into one transactional web-recipe
+  onboarding path, compatible adoption path, exact dependency and verifier
+  boundary, and resumable founder coordinator without introducing a second
+  execution or shipping state machine.
+risk_class: high
+base_commit: 39ae11f55f7f72e048c10baef3a1754fecc83286
+impact_manifest: product/impacts/WAVE_4B.yaml
+design_decisions:
+  - one exact Node.js 24, TypeScript, Next.js 16, and React 19.2 recipe is
+    supported; every other stack remains unsupported
+  - product approval and repository-integration approval are distinct exact
+    digests; neither a PRD nor a model grants apply authority
+  - greenfield apply stages and qualifies all bytes before one canonical commit
+    and publishes Git authority last through an atomic same-filesystem rename
+  - adoption creates an isolated branch and never rewrites the operator checkout
+  - generated ownership is explicit in mill.lock and detach remains plan-only
+  - registry network is attended and confined to dependency preparation;
+    candidate verification is networkless and source-read-only
+  - run next, start, and ship are coordinators over existing lifecycle methods,
+    not new state machines or authority channels
+  - the selected Playwright image truthfully determines recipe Node and npm
+    patch versions even though Mill itself uses a newer Node 24 patch
+allowed_paths:
+  - architecture/**
+  - docs/**
+  - product/**
+  - quality/**
+  - recipes/**
+  - schemas/**
+  - scripts/**
+  - src/**
+  - test/**
+  - CHANGELOG.md
+  - README.md
+  - WORKFLOW.md
+  - eslint.config.js
+  - package.json
+forbidden_paths:
+  - TEMP_MILL_GREENFIELD_WORK_PLAN_2026-08-31.md
+  - .env*
+  - .github/workflows/release.yml
+acceptance_items:
+  - W4B-A1 the recipe digest binds the exact manifest and every generated asset,
+    including named behavior-specific oracles, packable dotfile aliases, and
+    syntax-safe source and Markdown product-title rendering
+  - W4B-A2 greenfield and adoption plans are deterministic exact approvals and
+    bind the canonical target; apply rejects a different approved
+    recipe/version/runtime and cannot overwrite, widen, follow a symbolic-link
+    ancestor, use future-dated approval, place the PRD inside builder-writable
+    scope, adopt credential-like files, or expose partial authority; direct
+    apply APIs require attendance
+  - W4B-A3 greenfield creates one clean initial commit only after complete
+    recipe qualification; target locking prevents concurrent apply and failure
+    removes staging without clobbering preexisting state
+  - W4B-A4 adoption supports only the exact compatible Next.js tuple, preserves
+    the exact dependency lock and native oracle bytes, creates an isolated
+    branch, and blocks hazards, missing or modified oracle files, or conflicts
+  - W4B-A5 the non-self-referential approved plan identity is recorded unchanged
+    in the plan result and mill.lock alongside recipe, base, ownership,
+    generator version, template, installed, and preexisting identities for
+    manual detach and audit
+  - W4B-A6 dependency preparation requires attendance, exact image and lock
+    bytes frozen before identity, the root package-lock consumed by npm, build
+    trust, explicit credential-free npm/HTTPS registry identity, complete
+    SHA-512-bound allowed origins, disabled lifecycle scripts, post-install lock
+    revalidation, validated output, bounded access, installed-tree content
+    identity, cancellation cleanup, and atomic reuse
+  - W4B-A7 verification mounts dependency inputs read-only, source entries
+    read-only, and only declared comma-free top-level scratch paths as tmpfs
+  - W4B-A8 the exact recipe passes format, lint, type, unit, integration,
+    browser, build, and package checks offline in the pinned OCI image
+  - W4B-A9 run next selects exactly one approved ready outcome bound to the same
+    plan, product, impact, acceptance, and task authority, and start inventories
+    every nonterminal run while new-run admission rechecks under its writer
+    lease before resuming the sole existing build, verify, review, delivery, and
+    closure lifecycle
+  - W4B-A10 start performs readiness before dependency or model spend, blocks a
+    conflicting nonterminal task, permits a later task after terminalization,
+    binds the exact repo-native PRD source, avoids build/dependency preflight
+    for remote readback and closure, and never marks ready, merges, or deploys
+  - W4B-A11 ship draft preserves the existing separate plan/apply approval and
+    exact-candidate GitHub effect protocol
+  - W4B-A12 packed-package validation loads and renders the installed recipe,
+    required dotfile and escaped title, new schemas, and all founder-path help
+  - W4B-A13 code, schemas, docs, tests, canary evidence, and closure ship in
+    this same feature change without a bookkeeping tail; shipping uses Mill's
+    native checks and ordinary Git/GitHub interfaces without a tracked Factory
+    profile, verifier, pack, sibling checkout, or runtime dependency
+validation_commands:
+  - npm run format:check
+  - npm run lint
+  - npm run typecheck
+  - npm run check:workflows
+  - npm run schemas:check
+  - npm run test:coverage
+  - npm run test:package
+final_validation_commands:
+  - npm run check
+  - exact pinned-image offline recipe check
+required_reviews:
+  - code
+  - security
+  - architecture
+scope_exclusions:
+  - live autonomous specification generation or web research; an operator still
+    supplies the structured proposal that Mill assesses and freezes
+  - remote repository creation, branch-protection mutation, automatic readiness,
+    merge, deployment, daemon operation, or hosted control plane
+  - arbitrary stack adoption, in-place dependency migration, automated detach,
+    or upgrade/rollback planning
+  - genesis release, public npm publication, or public-alpha support claims
+stop_conditions:
+  - repository integration can hide or overwrite unapproved existing content
+  - candidate verification needs candidate network or source write authority
+  - coordinator wrappers bypass an existing lifecycle approval or state machine
+  - generated repositories require Mill for native build, test, or operation
+  - the same subsystem produces recurring P0/P1 review findings
+retry_budget: 1
+changelog_intent: add transactional recipe onboarding and founder delivery path
+versioning_impact: pre-alpha additive contract and CLI expansion
+migration_impact: >-
+  mill.lock and mill.yaml gain additive integration, dependency, and scratch
+  metadata; no released repository migration is claimed
+docs_sync_refs:
+  - README.md
+  - product/PLAN.md
+  - product/PRD.md
+  - architecture/ARCHITECTURE.md
+  - docs/development.md
+  - docs/canaries/wave-4b-recipe.md
+  - WORKFLOW.md
+closure:
+  method: same_change
+  result: closed_when_present_on_main
diff --git a/quality/scenarios.yaml b/quality/scenarios.yaml
index 4a2e445..c476a66 100644
--- a/quality/scenarios.yaml
+++ b/quality/scenarios.yaml
@@ -51,3 +51,94 @@ scenarios:
     executionRef: test:coverage
     forbidden:
       - replaying the same admitted invocation identity
+  - id: SCN-TRANSACTIONAL-GREENFIELD
+    kind: normal
+    given:
+      - an approved source-backed product proposal and exact greenfield plan
+      - the supported recipe and exact OCI dependency snapshot are available
+    when:
+      - the attended operator applies the approved plan
+    then:
+      - one clean canonical Git commit contains the exact planned files
+      - the plan and mill.lock expose the same non-cyclic approval identity
+      - the complete native web gate passes before the target is published
+      - a concurrent target is rejected and prior repository state is preserved
+    oracleOwner: repository
+    acceptanceRefs: [ACC-CONTINUITY]
+    invariantRefs: [INV-EXACT-EVIDENCE, INV-DOWNSTREAM-INDEPENDENT]
+    coverage: both
+    visibility: builder_visible
+    executionRef: test:coverage
+    forbidden:
+      - exposing a partial target after qualification failure
+      - deleting state created by an earlier integration instance
+      - using Mill as the downstream build system
+  - id: SCN-ADOPTION-CONFLICT
+    kind: authority
+    given:
+      - an existing compatible Node and Next.js repository
+    when:
+      - Mill scans, plans, or applies repository integration
+    then:
+      - existing product truth and native commands are retained
+      - missing or drifted recipe-owned oracle closure blocks without inference
+      - unsafe Git state, conflicting authority, or incompatible versions block
+    oracleOwner: repository
+    acceptanceRefs: [ACC-CONTINUITY, ACC-TRUTHFUL-RECOVERY]
+    invariantRefs:
+      - INV-HUMAN-AUTHORITY
+      - INV-EXACT-EVIDENCE
+      - INV-DOWNSTREAM-INDEPENDENT
+    coverage: both
+    visibility: reviewer_owned
+    executionRef: test:coverage
+    forbidden:
+      - overwriting existing repository truth
+      - mutating the operator checkout
+  - id: SCN-READONLY-WEB-RECIPE
+    kind: adversarial
+    given:
+      - the exact recipe lock and pre-pulled digest-pinned Playwright image
+    when:
+      - the complete native recipe gate runs with network disabled
+    then:
+      - source remains read-only and only declared top-level scratch trees write
+      - unit, integration, browser, build, and package evidence all pass
+      - dependency preparation rejects untrusted origins or invalid output
+      - the packed recipe renders required dotfiles and syntax-safe product text
+    oracleOwner: repository
+    acceptanceRefs: [ACC-CONTINUITY]
+    invariantRefs: [INV-EXACT-EVIDENCE, INV-DOWNSTREAM-INDEPENDENT]
+    coverage: both
+    visibility: reviewer_owned
+    executionRef: test:package
+    forbidden:
+      - writing dependency or generated output into candidate source
+      - pulling an image or package during verification
+  - id: SCN-FOUNDER-RESUME
+    kind: recovery
+    given:
+      - exactly one approved outcome is ready in a managed repository
+    when:
+      - the operator reruns the attended founder coordinator after a checkpoint
+    then:
+      - the selected PRD matches exact source and product-contract authority
+      - the selected outcome matches the task impact and acceptance authority
+      - the existing run advances through its authoritative lifecycle state
+      - another nonterminal task, failed baseline, or unresolved effect blocks
+        without replay while a terminal prior task permits the next outcome
+      - remote observation and closure do not require Codex or dependency setup
+    oracleOwner: repository
+    acceptanceRefs: [ACC-TRUTHFUL-RECOVERY]
+    invariantRefs:
+      - INV-HUMAN-AUTHORITY
+      - INV-EXACT-EVIDENCE
+      - INV-WORKER-LEAST-AUTHORITY
+    coverage: both
+    visibility: reviewer_owned
+    executionRef: test:coverage
+    forbidden:
+      - starting a second outcome while another task owns the active run
+      - executing a task approved for another outcome
+      - spending registry or model budget before PRD and task authority passes
+      - granting merge authority to the coordinator
diff --git a/recipes/node-typescript-next-web/.github/workflows/ci.yml b/recipes/node-typescript-next-web/.github/workflows/ci.yml
new file mode 100644
index 0000000..4f5d3fd
--- /dev/null
+++ b/recipes/node-typescript-next-web/.github/workflows/ci.yml
@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    container:
+      image: mcr.microsoft.com/playwright:v1.62.1-noble@sha256:dcc5531e97840b9b5e794f2814476b21571c5124a3fca2267d73041f56e7580e
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.18.1
+          cache: npm
+      - name: Install without lifecycle scripts
+        run: npm ci --ignore-scripts
+      - name: Full native gate
+        env:
+          NEXT_TELEMETRY_DISABLED: "1"
+        run: npm run check
diff --git a/recipes/node-typescript-next-web/.node-version b/recipes/node-typescript-next-web/.node-version
new file mode 100644
index 0000000..8dfc5cb
--- /dev/null
+++ b/recipes/node-typescript-next-web/.node-version
@@ -0,0 +1 @@
+24.18.1
diff --git a/recipes/node-typescript-next-web/.tool-versions b/recipes/node-typescript-next-web/.tool-versions
new file mode 100644
index 0000000..3d7962c
--- /dev/null
+++ b/recipes/node-typescript-next-web/.tool-versions
@@ -0,0 +1 @@
+nodejs 24.18.1
diff --git a/recipes/node-typescript-next-web/AGENTS.md b/recipes/node-typescript-next-web/AGENTS.md
new file mode 100644
index 0000000..bcca85c
--- /dev/null
+++ b/recipes/node-typescript-next-web/AGENTS.md
@@ -0,0 +1,9 @@
+# Repository delivery contract
+
+- Product behavior and invariants come from `product/contract.yaml`.
+- Architecture decisions come from `architecture/blueprint.yaml`.
+- Scenarios and their oracles come from `quality/scenarios.yaml`.
+- Native commands in `package.json` remain authoritative.
+- Change only paths granted by the active task packet.
+- Do not push, merge, deploy, expose credentials, or rewrite acceptance oracles.
+- Keep the repository operable without Mill.
diff --git a/recipes/node-typescript-next-web/README.md b/recipes/node-typescript-next-web/README.md
new file mode 100644
index 0000000..55f8951
--- /dev/null
+++ b/recipes/node-typescript-next-web/README.md
@@ -0,0 +1,16 @@
+# MILL_PRODUCT_TITLE_MARKDOWN_TOKEN
+
+This repository is independently operable with ordinary npm commands.
+
+```sh
+npm ci --ignore-scripts
+npm run check
+```
+
+Mill coordinates approved product work but is not the build system. See
+`product/contract.yaml`, `architecture/blueprint.yaml`, and
+`quality/scenarios.yaml` for approved product truth.
+
+The exact repository runtime is Node.js 24.18.1 with npm 11.16.0. Generated
+build and browser artifacts stay under `.next` and `.mill-output`; neither path
+is product source or delivery evidence.
diff --git a/recipes/node-typescript-next-web/WORKFLOW.md b/recipes/node-typescript-next-web/WORKFLOW.md
new file mode 100644
index 0000000..bca0797
--- /dev/null
+++ b/recipes/node-typescript-next-web/WORKFLOW.md
@@ -0,0 +1,6 @@
+# Delivery workflow
+
+Every product change binds approved product, scenario, architecture, impact,
+task, and exact-base identities. A candidate is committed before the complete
+native gate and independent review. Only the attended shipper may open a draft
+pull request, and a configured human remains the merge authority.
diff --git a/recipes/node-typescript-next-web/app/api/health/route.ts b/recipes/node-typescript-next-web/app/api/health/route.ts
new file mode 100644
index 0000000..9b82590
--- /dev/null
+++ b/recipes/node-typescript-next-web/app/api/health/route.ts
@@ -0,0 +1,5 @@
+import { healthPayload } from "../../../src/health";
+
+export function GET() {
+  return Response.json(healthPayload());
+}
diff --git a/recipes/node-typescript-next-web/app/layout.tsx b/recipes/node-typescript-next-web/app/layout.tsx
new file mode 100644
index 0000000..61d63a1
--- /dev/null
+++ b/recipes/node-typescript-next-web/app/layout.tsx
@@ -0,0 +1,19 @@
+import type { Metadata } from "next";
+import type { ReactNode } from "react";
+
+import "./styles.css";
+
+export const metadata: Metadata = {
+  title: __MILL_PRODUCT_TITLE_LITERAL__,
+  description: "A Mill-managed product foundation.",
+};
+
+export default function RootLayout({
+  children,
+}: Readonly<{ children: ReactNode }>) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}
diff --git a/recipes/node-typescript-next-web/app/page.tsx b/recipes/node-typescript-next-web/app/page.tsx
new file mode 100644
index 0000000..653aa1e
--- /dev/null
+++ b/recipes/node-typescript-next-web/app/page.tsx
@@ -0,0 +1,12 @@
+export default function Home() {
+  return (
+    <main>
+      <p className="eyebrow">Product foundation</p>
+      <h1>{__MILL_PRODUCT_TITLE_LITERAL__}</h1>
+      <p>
+        The repository is ready for one approved, continuity-aware delivery
+        slice.
+      </p>
+    </main>
+  );
+}
diff --git a/recipes/node-typescript-next-web/app/styles.css b/recipes/node-typescript-next-web/app/styles.css
new file mode 100644
index 0000000..a6d3fb0
--- /dev/null
+++ b/recipes/node-typescript-next-web/app/styles.css
@@ -0,0 +1,21 @@
+:root {
+  color-scheme: light dark;
+  font-family: ui-sans-serif, system-ui, sans-serif;
+}
+
+body {
+  margin: 0;
+}
+
+main {
+  margin: 0 auto;
+  max-width: 48rem;
+  padding: 6rem 1.5rem;
+}
+
+.eyebrow {
+  font-size: 0.75rem;
+  font-weight: 700;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+}
diff --git a/recipes/node-typescript-next-web/docs/development.md b/recipes/node-typescript-next-web/docs/development.md
new file mode 100644
index 0000000..233f4ee
--- /dev/null
+++ b/recipes/node-typescript-next-web/docs/development.md
@@ -0,0 +1,16 @@
+# Development
+
+Use Node.js 24.18.1 and npm 11.16.0. Those exact versions match the pinned
+Playwright verifier image.
+
+```sh
+npm ci --ignore-scripts
+npm run dev
+npm run check
+```
+
+The browser lane requires the Chromium revision bundled with Playwright 1.62.1.
+Mill validation uses the exact pinned Playwright OCI image with no network. It
+mounts repository source and `node_modules` read-only and provides only `.next`
+and `.mill-output` as temporary writable trees. Native host development remains
+ordinary npm usage and does not require Mill.
diff --git a/recipes/node-typescript-next-web/eslint.config.mjs b/recipes/node-typescript-next-web/eslint.config.mjs
new file mode 100644
index 0000000..b1babde
--- /dev/null
+++ b/recipes/node-typescript-next-web/eslint.config.mjs
@@ -0,0 +1,9 @@
+import { defineConfig, globalIgnores } from "eslint/config";
+import nextCoreWebVitals from "eslint-config-next/core-web-vitals";
+import nextTypeScript from "eslint-config-next/typescript";
+
+export default defineConfig([
+  ...nextCoreWebVitals,
+  ...nextTypeScript,
+  globalIgnores([".next/**", ".mill-output/**"]),
+]);
diff --git a/recipes/node-typescript-next-web/gitignore.template b/recipes/node-typescript-next-web/gitignore.template
new file mode 100644
index 0000000..30fcda1
--- /dev/null
+++ b/recipes/node-typescript-next-web/gitignore.template
@@ -0,0 +1,5 @@
+node_modules
+.next
+.mill-output
+.env*
+!.env.example
diff --git a/recipes/node-typescript-next-web/next-env.d.ts b/recipes/node-typescript-next-web/next-env.d.ts
new file mode 100644
index 0000000..ce4e94a
--- /dev/null
+++ b/recipes/node-typescript-next-web/next-env.d.ts
@@ -0,0 +1,7 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/types/routes.d.ts";
+import "./.next/types/root-params.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/recipes/node-typescript-next-web/next.config.ts b/recipes/node-typescript-next-web/next.config.ts
new file mode 100644
index 0000000..59f693c
--- /dev/null
+++ b/recipes/node-typescript-next-web/next.config.ts
@@ -0,0 +1,11 @@
+import type { NextConfig } from "next";
+
+const config: NextConfig = {
+  output: "standalone",
+  outputFileTracingRoot: import.meta.dirname,
+  poweredByHeader: false,
+  reactStrictMode: true,
+  turbopack: { root: import.meta.dirname },
+};
+
+export default config;
diff --git a/recipes/node-typescript-next-web/package-lock.json b/recipes/node-typescript-next-web/package-lock.json
new file mode 100644
index 0000000..c598524
--- /dev/null
+++ b/recipes/node-typescript-next-web/package-lock.json
@@ -0,0 +1,7540 @@
+{
+  "name": "mill-next-web-template",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "mill-next-web-template",
+      "version": "0.1.0",
+      "dependencies": {
+        "next": "16.3.4",
+        "react": "19.2.8",
+        "react-dom": "19.2.8"
+      },
+      "devDependencies": {
+        "@playwright/test": "1.62.1",
+        "@types/node": "24.13.3",
+        "@types/react": "19.2.18",
+        "@types/react-dom": "19.2.5",
+        "eslint": "9.39.5",
+        "eslint-config-next": "16.3.4",
+        "prettier": "3.9.6",
+        "typescript": "6.0.3",
+        "vitest": "4.1.11"
+      },
+      "engines": {
+        "node": ">=24.18.1 <25"
+      }
+    },
+    "node_modules/@babel/code-frame": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "js-tokens": "^4.0.0",
+        "picocolors": "^1.1.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/compat-data": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/core": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
+        "@jridgewell/remapping": "^2.3.5",
+        "convert-source-map": "^2.0.0",
+        "debug": "^4.1.0",
+        "gensync": "^1.0.0-beta.2",
+        "json5": "^2.2.3",
+        "semver": "^6.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/babel"
+      }
+    },
+    "node_modules/@babel/generator": {
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz",
+      "integrity": "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.29.8",
+        "@babel/types": "^7.29.8",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
+        "jsesc": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-compilation-targets": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
+        "browserslist": "^4.24.0",
+        "lru-cache": "^5.1.1",
+        "semver": "^6.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-globals": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-imports": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-transforms": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-string-parser": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-identifier": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-option": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helpers": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/parser": {
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz",
+      "integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.29.8"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/template": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/traverse": {
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.8.tgz",
+      "integrity": "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.8",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.8",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.8",
+        "debug": "^4.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/types": {
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz",
+      "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@emnapi/core": {
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
+      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.1",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@emnapi/runtime": {
+      "version": "1.11.3",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.3.tgz",
+      "integrity": "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@emnapi/wasi-threads": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
+      "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@eslint-community/eslint-utils": {
+      "version": "4.10.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz",
+      "integrity": "sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "eslint-visitor-keys": "^3.4.3"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0"
+      }
+    },
+    "node_modules/@eslint-community/eslint-utils/node_modules/eslint-visitor-keys": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
+      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/@eslint-community/regexpp": {
+      "version": "4.12.2",
+      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
+      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
+      }
+    },
+    "node_modules/@eslint/config-array": {
+      "version": "0.21.2",
+      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.2.tgz",
+      "integrity": "sha512-nJl2KGTlrf9GjLimgIru+V/mzgSK0ABCDQRvxw5BjURL7WfH5uoWmizbH7QB6MmnMBd8cIC9uceWnezL1VZWWw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/object-schema": "^2.1.7",
+        "debug": "^4.3.1",
+        "minimatch": "^3.1.5"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@eslint/config-array/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@eslint/config-array/node_modules/brace-expansion": {
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/@eslint/config-array/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/@eslint/config-helpers": {
+      "version": "0.4.2",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.4.2.tgz",
+      "integrity": "sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/core": "^0.17.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@eslint/core": {
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
+      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/json-schema": "^7.0.15"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@eslint/eslintrc": {
+      "version": "3.3.7",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.7.tgz",
+      "integrity": "sha512-F42g89Qd5oAWtp0k0nnSrjziAKza7w8SVT4mStc18LZMaRb4J1HQAHLCalEtDCxrTuksx7NU9qsmeLwpOfPqWw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^6.14.0",
+        "debug": "^4.3.2",
+        "espree": "^10.0.1",
+        "globals": "^14.0.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.2.1",
+        "js-yaml": "^4.3.2",
+        "minimatch": "^3.1.5",
+        "strip-json-comments": "^3.1.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/@eslint/eslintrc/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/@eslint/eslintrc/node_modules/globals": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
+      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@eslint/eslintrc/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/@eslint/js": {
+      "version": "9.39.5",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.5.tgz",
+      "integrity": "sha512-QywQuszQh77pIXCsq998c8hbhSTI/azTty1Z6N53dmAudKHhy573j3yvRLsX2BSp8YpLtoCEG8E9DJe+8zUh4A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://eslint.org/donate"
+      }
+    },
+    "node_modules/@eslint/object-schema": {
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-2.1.7.tgz",
+      "integrity": "sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@eslint/plugin-kit": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.4.1.tgz",
+      "integrity": "sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/core": "^0.17.0",
+        "levn": "^0.4.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@humanfs/core": {
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanfs/node": {
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
+        "@humanwhocodes/retry": "^0.4.0"
+      },
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanwhocodes/module-importer": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
+      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.22"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
+    "node_modules/@humanwhocodes/retry": {
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
+      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
+    "node_modules/@img/colour": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz",
+      "integrity": "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@img/sharp-darwin-arm64": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.35.4.tgz",
+      "integrity": "sha512-Uhfl4V4lhP2nbUVF9+hyH1+luj86f1gUFeo8ALYxFoULoU+G87D43BfeMP8XHsk9boxAnCY/bf2EHwhA7MuGsA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-darwin-arm64": "1.3.3"
+      }
+    },
+    "node_modules/@img/sharp-darwin-x64": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.35.4.tgz",
+      "integrity": "sha512-hWniXY3bG5qKpkKrAwPe4y+VTPmf086YQAnkxWh7uA1YrlRouWGa0M0Mxj3ZjnXFkv7/TD1bTy9lGUK26vRvWw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-darwin-x64": "1.3.3"
+      }
+    },
+    "node_modules/@img/sharp-freebsd-wasm32": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-freebsd-wasm32/-/sharp-freebsd-wasm32-0.35.4.tgz",
+      "integrity": "sha512-lIsKw/BU+kjB4eZjxrYrZmwOJYi3Ajrv66iAlBmUPyKc3HpnloevB1g3wxGD9P/5BbQ1brBGl65VRRrCvQDEqA==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "dependencies": {
+        "@img/sharp-wasm32": "0.35.4"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-darwin-arm64": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.3.3.tgz",
+      "integrity": "sha512-suTBPTDGrI9WodccaDdwZItTSaBYASlBk1NSfElSHrUfzu3szG6lvIF58+WiFvnfzuK8ZBFS5zE00PxqxnRiPg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-darwin-x64": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.3.3.tgz",
+      "integrity": "sha512-FVJZ5mITMobmXIz/hPDTw0EintTW5H3WfrxwLqEqjiIihlu+hVRyGrFQ60xl0Lxn7Bt3zdpevPaQi0HEzqz9fw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-arm": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.3.3.tgz",
+      "integrity": "sha512-3rbU4vqXXc3hY/OiXdl52xZvT0F1yEngWfvqudtPJg/KkyiaQw2DRsFrNzpmLvfavbwOq3qXn36GP8obHRULQA==",
+      "cpu": [
+        "arm"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-arm64": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.3.tgz",
+      "integrity": "sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-ppc64": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.3.tgz",
+      "integrity": "sha512-cdn1OvUBwsXhbC0zSzJnNzf5MZ/mTrobawDvNXBTxe8VtqKAm0sRuEY2Evzovb/w9JMk4TvRxqt1mekSuJz64w==",
+      "cpu": [
+        "ppc64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-riscv64": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.3.3.tgz",
+      "integrity": "sha512-HjPVx7yKz+0lqdhDlTw1tt90wamBoxhiXpvl1XZpJLiHH4RCJ5yDTqH+VlYPv2fwFs89JFw4c1IexYOcQUi4IQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-s390x": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.3.3.tgz",
+      "integrity": "sha512-neWLh+3yCNThxnfy3c4BbVBeGgt9aftno+XbT56iK28RgeDs3UOFWviLWlUu0bArYVYJaFDK+RRohbicUNCm8Q==",
+      "cpu": [
+        "s390x"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-x64": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.3.3.tgz",
+      "integrity": "sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linuxmusl-arm64": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.3.3.tgz",
+      "integrity": "sha512-Y9kQaLMuNoB0bPYOOdcZMaseNrFpPodIWWMrx+CZyydf2xn68j9WYc6sWWRrDwNkzCQjKYfc68L7jKjGlHMibw==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linuxmusl-x64": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.3.3.tgz",
+      "integrity": "sha512-fj8Mv0HHfD1Rr+4I68+3agJynxDWtBFgicTbSOb9Bke6pIwzGcJ+RX/yHjmiEGFMCavY/dxvem7MyNaJF+wDiw==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-linux-arm": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.35.4.tgz",
+      "integrity": "sha512-7OAS8gI0EReKGVN2HssHlM6umJgxF5VI3xN0p9FA91p/YO+ou5hiNghLdZ5BEHztwaaK5+bLKRf8x/o2L2nk9A==",
+      "cpu": [
+        "arm"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-arm": "1.3.3"
+      }
+    },
+    "node_modules/@img/sharp-linux-arm64": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.35.4.tgz",
+      "integrity": "sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-arm64": "1.3.3"
+      }
+    },
+    "node_modules/@img/sharp-linux-ppc64": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.35.4.tgz",
+      "integrity": "sha512-2oYZJeIl4kCcMGk4ouZVjnkCtFrpQFlNEtJ6GbxzhHQchwH0NH/qEb9ykmOl29dqwMq+JhFdZn+1ak2FKhI9fQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-ppc64": "1.3.3"
+      }
+    },
+    "node_modules/@img/sharp-linux-riscv64": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.35.4.tgz",
+      "integrity": "sha512-cPbNChoRURAWdebDIHSenxRpgEdy7JkPydSnUxRm9VvKD7m0/xVaR/8Fzlu81pk5nHEvHH87UZUA7cTtwnbJSA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-riscv64": "1.3.3"
+      }
+    },
+    "node_modules/@img/sharp-linux-s390x": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.35.4.tgz",
+      "integrity": "sha512-RY0JFY8Fd6RonCBtHz+DvadaPkXDSI1AUn6yWL9TipqkZ1vY8w8evqdgyDFnkm4/K1ve1TvZiaePP5oSd4+WVQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-s390x": "1.3.3"
+      }
+    },
+    "node_modules/@img/sharp-linux-x64": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.35.4.tgz",
+      "integrity": "sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-x64": "1.3.3"
+      }
+    },
+    "node_modules/@img/sharp-linuxmusl-arm64": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.35.4.tgz",
+      "integrity": "sha512-KB5jxpfWQTr0nc3xdHtWChdbifHrBGsd2SM62Eyxrl8afikm+f5qGBU75SJIZBT/S1MC8XyacdlXBMSWq6OURA==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.3"
+      }
+    },
+    "node_modules/@img/sharp-linuxmusl-x64": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.35.4.tgz",
+      "integrity": "sha512-f+eZJZIQNEEd26RPSW+76chwOf1XtA2Y/O+5ocVyLliHkeih3e+jhLVBdNTd2rS3IbNXK8+ug93Vf5ZXtF5Lxg==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.3"
+      }
+    },
+    "node_modules/@img/sharp-wasm32": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.4.tgz",
+      "integrity": "sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA==",
+      "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/runtime": "^1.11.3"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-webcontainers-wasm32": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-webcontainers-wasm32/-/sharp-webcontainers-wasm32-0.35.4.tgz",
+      "integrity": "sha512-ESfNkywmCfPNyaZjxooddJQiQ+l/nTpGEOGthxiLnIHXC/CmcBixnfwUleX9mCz9ovrUUvKMap/pm8RYbzfwaA==",
+      "cpu": [
+        "wasm32"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "dependencies": {
+        "@img/sharp-wasm32": "0.35.4"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-win32-arm64": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.4.tgz",
+      "integrity": "sha512-iNdlBX9gLVvqe2I3uIJSIKTq6wckP/DYxZtcqxm09x5Gi24DnFBmPAWZmr60ZyYMG0xlzo6goG3670ar+RXvRw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-win32-ia32": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.35.4.tgz",
+      "integrity": "sha512-kqRsbaa5CS6KHlpxnN7WhE6vAAugXyZButpRdvDWetlv6Qv4N9WTcrWzF7tXfB9T7MsoadqdI8hmwLq6UlLvtw==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-win32-x64": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.35.4.tgz",
+      "integrity": "sha512-XtmnYhBcrORsJ4XJngyzr/EWP0hRZLAZRFaApdKuviyqF78+ylxh2y06ZmtULAMOnObJ3ucpN0AcwSWnMowTRg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz",
+      "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
+    "node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.3.tgz",
+      "integrity": "sha512-UMduMbqO5s5zF2NkNacMT/yK5Y5QiKvWr2+50bzIIxFDwVJ2h49b+oyjaCGPhJxd2/gC2x39EHv/gHVuu36x2Q==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.3"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=23.5.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.4",
+        "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.4"
+      }
+    },
+    "node_modules/@next/env": {
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.3.4.tgz",
+      "integrity": "sha512-cjWZnUUa6jZq2kFaNe/ZyJdZonOZ/QoN0Zka2nz/FLOrfx14pQuM9c5RaSVkWMqgdt4ksgPAMWPyHSs/CyV48Q==",
+      "license": "MIT"
+    },
+    "node_modules/@next/eslint-plugin-next": {
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-16.3.4.tgz",
+      "integrity": "sha512-szW9y2Aumu4z88YXfTzcFsgUAg2k64uzbtcO5L9f1AKS4w/GUKJcbFllRflROVyNPgJtGOnvNxiyp3v6b+prIA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/eslint-utils": "4.9.1",
+        "fast-glob": "3.3.1"
+      }
+    },
+    "node_modules/@next/eslint-plugin-next/node_modules/@eslint-community/eslint-utils": {
+      "version": "4.9.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
+      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "eslint-visitor-keys": "^3.4.3"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0"
+      }
+    },
+    "node_modules/@next/eslint-plugin-next/node_modules/eslint-visitor-keys": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
+      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/@next/swc-darwin-arm64": {
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.3.4.tgz",
+      "integrity": "sha512-iBr3I5LZNk5/bgl5//iTgD2tcym14MX0Xo7fD//u9dYAEgGzza1y9oywluPtf74YnOswVdH1908aK9xVz7zQTw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-darwin-x64": {
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.3.4.tgz",
+      "integrity": "sha512-2dpiSyl2Jw/NrBPaU2MAKGSa+2MR82pJIn4Sm5Rjr+gxAeuh0z158Su3Z2O8zn7UNNq+ej4bToed6RcRN/Lydg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-linux-arm64-gnu": {
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.3.4.tgz",
+      "integrity": "sha512-+t+U8HZT+fApePCS5h89CSH3datz29MkzyfCn+6fpsZBG/oiEOhINcb9rtkv6sdpToLGFn2e6146NzaKCXkqrA==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-linux-arm64-musl": {
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.3.4.tgz",
+      "integrity": "sha512-mx03GNs1ocQA5JQ4FxDMmIsNkdrZh8cuezKCrId28e5/gIPU/l7Kcy2+vmCCzdjnnmXJy+iOAu+7K0QppO6Urg==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-linux-x64-gnu": {
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.3.4.tgz",
+      "integrity": "sha512-YIhGY6fSMfha52bnVxnzc9zaVBzJg+cqQTOD8tXIBSx4fuv0pVMxQTE0PaS59YhnMOiYiG09IMwxJAf/CFm/Dw==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-linux-x64-musl": {
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.3.4.tgz",
+      "integrity": "sha512-+eaaX6axpDb0yF1GCpiERe6njplvdC+nks/fKfcHu3XPGRrald8P3/X7yv7QLdjA51knnxwl9pxdIJsg+w1L+Q==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-win32-arm64-msvc": {
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.3.4.tgz",
+      "integrity": "sha512-0jcXW7Xs/uzICrmgV3MhDYDeRy++1CqnpDIerlPIqYO4bhzB4WNbX/aRnQclustsAyTkFKB0z6rbcjmNg5tR8A==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@next/swc-win32-x64-msvc": {
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.3.4.tgz",
+      "integrity": "sha512-vvBzwu1pYQCp92maZCFCIw/XgOTMR5tur9GjakwIo2cmwRTMKajRZZDS9+e4KsUZWKu1E007WUeAFXRRjZeuzw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@nodelib/fs.scandir": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.stat": "2.0.5",
+        "run-parallel": "^1.1.9"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.stat": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.walk": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.scandir": "2.1.5",
+        "fastq": "^1.6.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nolyfill/is-core-module": {
+      "version": "1.0.39",
+      "resolved": "https://registry.npmjs.org/@nolyfill/is-core-module/-/is-core-module-1.0.39.tgz",
+      "integrity": "sha512-nn5ozdjYQpUCZlWGuxcJY/KpxkWQs4DcbMCmKojjyrYDEAGy4Ce19NN4v5MduafTwJlbKc99UA8YhSVqq9yPZA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.4.0"
+      }
+    },
+    "node_modules/@oxc-project/types": {
+      "version": "0.148.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.148.0.tgz",
+      "integrity": "sha512-Nm4s/jB+4FpFsPhWGEC4h7rzksesmtnMXomo6rCMcg/b8zLQuOziRgkCS1fxDCXOlJB/6Q8oABOZ/OP6RIPj9A==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/oxc-project"
+      }
+    },
+    "node_modules/@playwright/test": {
+      "version": "1.62.1",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.62.1.tgz",
+      "integrity": "sha512-DTcUc8qii+cpHvtOwggMtBRMjKZHXYWdw8syRYu2vtzuq4Wxphqq4NfCs5Zt44L6mA8rfDfj+PHnxFc/FeK6mQ==",
+      "devOptional": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.62.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@rolldown/binding-android-arm-eabi": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.7.tgz",
+      "integrity": "sha512-EypzgnYCwyVY4NDHKzGmNJT5b+XaQEBniHxsMdeIQLB/tcCzZnhqrzHpZFbX9iaxx+5RiB8caATBtfvZP7zVxQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.7.tgz",
+      "integrity": "sha512-l17HE9EweWaqJZhuUuNBN/FzM62xw+DECVnJyvMsxn8vJFAGLy5QfLDoYAcronkAN8VxKZHezDpulHDPx95vFw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.7.tgz",
+      "integrity": "sha512-8ED8ELFvHXc6OCETIn4gXObPiaR6bckM/ipXtbzlPVDRMBfEGjCKgO90F9YtfdpDatVx/ZQw7aZ1vUMf/+T3Mw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.7.tgz",
+      "integrity": "sha512-/WPripjtiAIZ2tWY7ddijORT0Ujg87wxWW/qcoFVCKAWVDPhtY0xr7Dj0M3GyNGz60jGwTElhro/mkF9dT7dDQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.7.tgz",
+      "integrity": "sha512-14DI4NcqpvbICxSnGLx3PmtDaWqRP/KGSGb6C+JLLVPeZRl6dKdHba3pGsqT3vpdTqhEYIPG0MMQ8c0xYqoJxA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.7.tgz",
+      "integrity": "sha512-bxrWIRvHWQvbJwi+VIie/kDJmQxcNE6xxWwZdqF/ExVAigtHkv54WTLQPb+QsZdnFy18fg7JPfWGL0RH6vwIlQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.7.tgz",
+      "integrity": "sha512-toOY2BChBZyuxU7OYX6Tn389di4IzAqPTycVcci0O7FSfBqzRB3RZn+K5Is6ANf4tmgRd/K1yZTsNTXbkXsnLg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.7.tgz",
+      "integrity": "sha512-lAIXTH/aiLRLxsTgQvfhjo4K1ydWIp00+V0voOr9beb/9ZmkUFrSIb03dXNFRgMNvkE6oGsF10ioQ6UsI+vS5Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.7.tgz",
+      "integrity": "sha512-kdnwS28Pkenp/mZMRwjXXXwxQ7pIsm+bF919LUK93BOyhcLsrVKdP2p9fxpiPNPAbNuch8ypQt0pm2P2LYCAGg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.7.tgz",
+      "integrity": "sha512-516OdsyLdr5E65paF3yBF55t8mfm9+gmtCsK3xI7XKXIT7EfRlHhxL8K/NR6Hu8BWSgF5+1w74lTL0+nxcc8Qw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.7.tgz",
+      "integrity": "sha512-r8/z8n7GFaYRln3xmP1Cxy0HH/HLM0uBUPkEuSVEfKGDA89M0FsZRZJRSwe/tJjRx+fpH/gjorfhB8tmEbSFLA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.7.tgz",
+      "integrity": "sha512-pAsE8iiDxUg1xBqdhrTfg45AVDVpirjz00sblEYClGNNcMnDb+e8beQgqIAw6LvauX/APvgxUnwrgun/YYGBhw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.7.tgz",
+      "integrity": "sha512-lTcIYmmnQQA8Or/2DatS6oSqcdLHvendjS+zLu+FwgToynWMRSmQdpM65fTANJgIS4mjbMOo5KT2lnT9SAb96w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.7.tgz",
+      "integrity": "sha512-e3Gu3WxbNk/UqQhxqU7YIYO+9ZBvWNz3U+h/qRFosscMFzdRPbXYSaSWgSnklv2fz1TgzBTcti2z35c/7irsHw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.7.tgz",
+      "integrity": "sha512-W/jg5qoRSqjsEv0+dZi4e687mcHqmVuU0P4fK6qS/xjetW2Gmc1W8j//z5nAeNcC8Ttm0hV46IjcYeuVwYhuiw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/pluginutils": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@rtsao/scc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rtsao/scc/-/scc-1.1.0.tgz",
+      "integrity": "sha512-zt6OdqaDoOnJ1ZYsCYGt9YmWzDXl4vQdKTyJev62gFhRGKdx7mcT54V9KIjg+d2wi9EXsPvAPKe7i7WjfVWB8g==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@swc/helpers": {
+      "version": "0.5.23",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
+      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.8.0"
+      }
+    },
+    "node_modules/@tybys/wasm-util": {
+      "version": "0.10.3",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
+      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@types/chai": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
+      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/deep-eql": "*",
+        "assertion-error": "^2.0.1"
+      }
+    },
+    "node_modules/@types/deep-eql": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/json-schema": {
+      "version": "7.0.15",
+      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
+      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/json5": {
+      "version": "0.0.29",
+      "resolved": "https://registry.npmjs.org/@types/json5/-/json5-0.0.29.tgz",
+      "integrity": "sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "24.13.3",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
+      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~7.18.0"
+      }
+    },
+    "node_modules/@types/react": {
+      "version": "19.2.18",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.18.tgz",
+      "integrity": "sha512-AnzbBERsrLKtk2XSfTbYRLjQPdy116Sty4q+T+Bp3IC4l6jNBvreVPAHmpq9qhXQM7CXZPjLVmGMw9sy+hxQ3w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "csstype": "^3.2.2"
+      }
+    },
+    "node_modules/@types/react-dom": {
+      "version": "19.2.5",
+      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.5.tgz",
+      "integrity": "sha512-fMPwH9v7r/pp43yUd2/Mbiex5KouJwwR3dzHkhLREUC6764VyDsqxhAxv6OFEYR1RhjOyD1naqba8ECDBe7ZQg==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "^19.2.0"
+      }
+    },
+    "node_modules/@typescript-eslint/eslint-plugin": {
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.69.0.tgz",
+      "integrity": "sha512-t5jQTKPIgVW1PE6dR6H6Qz5gm8zjMlX5/2gRaOGd9eO6V7J+tQc6iWKukEe7dY8u9HyYasQ0yfF0/FSSTEO2gA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/regexpp": "^4.12.2",
+        "@typescript-eslint/scope-manager": "8.69.0",
+        "@typescript-eslint/type-utils": "8.69.0",
+        "@typescript-eslint/utils": "8.69.0",
+        "@typescript-eslint/visitor-keys": "8.69.0",
+        "ignore": "^7.0.5",
+        "natural-compare": "^1.4.0",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "@typescript-eslint/parser": "^8.69.0",
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
+      "version": "7.0.8",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.8.tgz",
+      "integrity": "sha512-YYNsSlXBjMk92SKnkwvB5LOVSa6OznlFUGcsvrFgNJbJCd0M1XKeFVRc8ZByeCqz32FivYNHJVooLmdqrmvp/Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/@typescript-eslint/parser": {
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.69.0.tgz",
+      "integrity": "sha512-l4b0DhWioGg6Gt2ebGlvfkFMOjRsauxtsnDRwUSRX1qHq3HdTfQHV8wW9zEXeciai6HfeaKOedQn2Zoofx3WBw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/scope-manager": "8.69.0",
+        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/typescript-estree": "8.69.0",
+        "@typescript-eslint/visitor-keys": "8.69.0",
+        "debug": "^4.4.3"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/project-service": {
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.69.0.tgz",
+      "integrity": "sha512-yi4obFrHMmnsesWehHbkg9zMA7Jt8cXT+mKM08G999pH1yT6nqgsHx7MYm0uY1wAj8CqiBXYRJ7WAT0QdQHQXg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/tsconfig-utils": "^8.69.0",
+        "@typescript-eslint/types": "^8.69.0",
+        "debug": "^4.4.3"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/scope-manager": {
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.69.0.tgz",
+      "integrity": "sha512-ewfspqWvSxKSOaplqAUNbaSFO0eB6w1EtQ+esfYFRm3614Ty4uNtExkcbgd6nWsXphbqKyf9ZYdbZdv2xEoWEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/visitor-keys": "8.69.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/tsconfig-utils": {
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.69.0.tgz",
+      "integrity": "sha512-xNqK7YTDZsLniQMV/4rpFR8Z5JlqeRvVjuG1YgF/mdPVH84HSD19L8CczMA0qg2RfwEV231GHH3VnToJDo4MfQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/type-utils": {
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.69.0.tgz",
+      "integrity": "sha512-ZfoJAVg3JZndQEpEl9petVlxau3lRuElc4HRMuAlLCf8to04/iHz692RUSNmXKDjEuJmIL+KZ2/BsOcBc16dsA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/typescript-estree": "8.69.0",
+        "@typescript-eslint/utils": "8.69.0",
+        "debug": "^4.4.3",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/types": {
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.69.0.tgz",
+      "integrity": "sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/typescript-estree": {
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.69.0.tgz",
+      "integrity": "sha512-AdFkgqck3Vudb/kWnxlyafU/4aBhHrbQ9locP2N4psXTy5mOBg0SHJumnLvx7r6g1gV4DKvUFwV2nJZBoqOD8w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/project-service": "8.69.0",
+        "@typescript-eslint/tsconfig-utils": "8.69.0",
+        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/visitor-keys": "8.69.0",
+        "debug": "^4.4.3",
+        "minimatch": "^10.2.2",
+        "semver": "^7.7.3",
+        "tinyglobby": "^0.2.15",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/typescript-estree/node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@typescript-eslint/utils": {
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.69.0.tgz",
+      "integrity": "sha512-tUbx60BBqQa31kXF5MCsOOLL5E/WzUuxIn7YpAvq+eaUlqvk8/NXnXMBNAdLCr0icjkzem7iUA5QqWHe/hJ1aw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.9.1",
+        "@typescript-eslint/scope-manager": "8.69.0",
+        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/typescript-estree": "8.69.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/visitor-keys": {
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.69.0.tgz",
+      "integrity": "sha512-+rmdgPA+EXkNgKYvHvFfhrs35utXbwaC5PGpDquSXcoXQDKUA5UjV0LmTucG/4JXkM31BTu4TilHtrN8IVBe8w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.69.0",
+        "eslint-visitor-keys": "^5.0.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@unrs/resolver-binding-android-arm-eabi": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm-eabi/-/resolver-binding-android-arm-eabi-1.12.2.tgz",
+      "integrity": "sha512-g5T90pqg1bo/7mytQx6F4iBNC0Wsh9cu+z9veDbFjc7HjpesJFWD7QMS0NGStXM075+7dJPPVvBbpZlnrdpi/w==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-android-arm64": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm64/-/resolver-binding-android-arm64-1.12.2.tgz",
+      "integrity": "sha512-YGCRZv/9GLhwmz6mYDeTsm/92BAyR28l6c2ReweVW5pWgfsitWLY8upvfRlGdoyD8HjeTHSYJWyZGD4KJA/nFQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-darwin-arm64": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-arm64/-/resolver-binding-darwin-arm64-1.12.2.tgz",
+      "integrity": "sha512-u9DiNT1auQMO20A9SyTuG3wUgQWB9Z7KjAg0uFuCDR1FsAY8A0CG2S6JpHS1xwm/w1G08bjXZDcyOCjv1WAm2w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-darwin-x64": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-x64/-/resolver-binding-darwin-x64-1.12.2.tgz",
+      "integrity": "sha512-f7rPLi/T1HVKZu/u6t87lroib16n8vrSzcyxI7lg4BGO9UF26KhQL44sd9eOUgrTYhvRXtWOIZT5PejdPyJfUA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-freebsd-x64": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-freebsd-x64/-/resolver-binding-freebsd-x64-1.12.2.tgz",
+      "integrity": "sha512-BpcOjWCJub6nRZUS2zA20pmLvjtqAtGejETaIyRLiZiQf++cbrjltLA5NN/xaXfqeOBOSlMFbemIl5/S5tljmg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-arm-gnueabihf": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-gnueabihf/-/resolver-binding-linux-arm-gnueabihf-1.12.2.tgz",
+      "integrity": "sha512-vZTDvdSISZjJx66OzJqtsOhzifbqRjbmI1Mnu49fQDwog5GtDI4QidRiEAYbZCRj9C8YZEW+3ZjqsyS9GR4k2A==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-arm-musleabihf": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-musleabihf/-/resolver-binding-linux-arm-musleabihf-1.12.2.tgz",
+      "integrity": "sha512-BiPI+IrIlwcW4nLLMM21+B1dFPzd55yAVgVGrdgDjNef+ch03GdxrcyaIz8X9SsQirh/kCQ7mviyWlMxdh2D7g==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-arm64-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-gnu/-/resolver-binding-linux-arm64-gnu-1.12.2.tgz",
+      "integrity": "sha512-zJc0H99FEPoFfSrNpa91HYfxzfAJCr502oxNK1cfdC9hlaFI43RT+JFCann9JUgZmLzzntChHyn13Sgn9ljHNg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-arm64-musl": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-musl/-/resolver-binding-linux-arm64-musl-1.12.2.tgz",
+      "integrity": "sha512-KQ3Lki6l+Pz1k/eBipN41ES+YUK30beLGb9YqcB1O542cyLCNE6GaxrfcY3T6EezmGGk84wb5XyO9loTM9tkcA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-loong64-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-loong64-gnu/-/resolver-binding-linux-loong64-gnu-1.12.2.tgz",
+      "integrity": "sha512-3SJGEh1DborhG6pyxvhPzCT4bbSIVihsvgJc13P1bHG7KLdNDaF9T3gsTwFc7Jw/5Y5/iWOjkEx7Zy0NvCGX3Q==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-loong64-musl": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-loong64-musl/-/resolver-binding-linux-loong64-musl-1.12.2.tgz",
+      "integrity": "sha512-jiuG/Obbel7uw1PwHNFfrkiKhLAF6mnyZ6aWlOAVN9WqKm8v0OFGnciJIHu8+CMvXLQ8AD51LPzAoUfT21D5Ew==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-ppc64-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-ppc64-gnu/-/resolver-binding-linux-ppc64-gnu-1.12.2.tgz",
+      "integrity": "sha512-q7xRvVpmcfeL+LlZg8Pbbo6QaTZwDU5BaGZbwfhkEsXJn3Was8xYfE0RBH266xZt0rM6B7i8xAYIvjthuUIWHg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-riscv64-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-gnu/-/resolver-binding-linux-riscv64-gnu-1.12.2.tgz",
+      "integrity": "sha512-0CVdx6lcnT3Q9inOH8tsMIOJ6ImndllMjqJHg8RLVdB7Vq4SfkEXl9mCSsVNuNA4MCYycRicCUxPCabVHJRr6A==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-riscv64-musl": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-musl/-/resolver-binding-linux-riscv64-musl-1.12.2.tgz",
+      "integrity": "sha512-iOwlRo9vnp6R6ohHQS11n0NnfdXx/omhkocmIfaPRpQhKZ+3BDMkkdRVh53qjkFkpPddf+FETA28NwGN7l5l+w==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-s390x-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-s390x-gnu/-/resolver-binding-linux-s390x-gnu-1.12.2.tgz",
+      "integrity": "sha512-HYJtLfXq94q8iZNFT1lknx258wlkkWhZeUXJRqzKBBUJ00CvZ+N33zgbCqimLjsyw5Va6uUxhVa12mI+kaveEw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-x64-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-gnu/-/resolver-binding-linux-x64-gnu-1.12.2.tgz",
+      "integrity": "sha512-mPsUhunKKDih5O96Y6enDQyHc1SqBPlY1E/SfMWDM3EdJ95Z9CArPeCVwCCqbP45ljvivdEk8Fxn+SIb1rDAJQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-x64-musl": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-musl/-/resolver-binding-linux-x64-musl-1.12.2.tgz",
+      "integrity": "sha512-azrt6+5ydLd8Vt210AAFis/lZevSfPw93EJRIJG+xPu4WCJ8K0kppCTpMyLPcKT7H15M4Jnt2tMp5bOvCkRC6A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-openharmony-arm64": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-openharmony-arm64/-/resolver-binding-openharmony-arm64-1.12.2.tgz",
+      "integrity": "sha512-YZ9hP4O0X9PQb8eO980qmLNGH4zT3I9+SZTdt0Pr0YyuGQhYKoOZkV02VzrzyOZJ5xIJ3UFIenKkUkGg8GjgWQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-wasm32-wasi": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-wasm32-wasi/-/resolver-binding-wasm32-wasi-1.12.2.tgz",
+      "integrity": "sha512-tYFDIkMxSflfEc/h92ZWNsZlHSwgimbNHSO3PL2JWQHfCuC2q316jMyYU9TIWZsFK2bQwyK5VAdYgn8ygPj69A==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@unrs/resolver-binding-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
+      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@unrs/resolver-binding-win32-arm64-msvc": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-arm64-msvc/-/resolver-binding-win32-arm64-msvc-1.12.2.tgz",
+      "integrity": "sha512-qzNyg3xL0VPQmCaUh+N5jSitce6k+uCBfMDesWRnlULOZaqUkaJ0ybdT+UqlAWJoQjuqfIU/0Ptx9bteN4D82g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-win32-ia32-msvc": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-ia32-msvc/-/resolver-binding-win32-ia32-msvc-1.12.2.tgz",
+      "integrity": "sha512-WD9sY00OfpHVGfsnHZoA8jVT+esS/Bg8z8jzxp5BnDCjjwsuKsPQrzswwpFy4J1AUJbXPRfkpcX0mXrzeXW79g==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-win32-x64-msvc": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.12.2.tgz",
+      "integrity": "sha512-nAB74NfSNKknqQ1RrYj6uz8FcXEomu/MATJZxh/x+BArzN2U3JbOYC0APYzUIGhVY3m5hRxA8VPNdPBoG8txlA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@vitest/expect": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.11.tgz",
+      "integrity": "sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.1.0",
+        "@types/chai": "^5.2.2",
+        "@vitest/spy": "4.1.11",
+        "@vitest/utils": "4.1.11",
+        "chai": "^6.2.2",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/mocker": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.11.tgz",
+      "integrity": "sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/spy": "4.1.11",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.21"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/pretty-format": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.11.tgz",
+      "integrity": "sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/runner": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.11.tgz",
+      "integrity": "sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/utils": "4.1.11",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/snapshot": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.11.tgz",
+      "integrity": "sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "4.1.11",
+        "@vitest/utils": "4.1.11",
+        "magic-string": "^0.30.21",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/spy": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.11.tgz",
+      "integrity": "sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/utils": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.11.tgz",
+      "integrity": "sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "4.1.11",
+        "convert-source-map": "^2.0.0",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/acorn": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz",
+      "integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-jsx": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
+      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
+    "node_modules/ajv": {
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "fast-json-stable-stringify": "^2.0.0",
+        "json-schema-traverse": "^0.4.1",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true,
+      "license": "Python-2.0"
+    },
+    "node_modules/aria-query": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.2.tgz",
+      "integrity": "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/array-buffer-byte-length": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/array-buffer-byte-length/-/array-buffer-byte-length-1.0.2.tgz",
+      "integrity": "sha512-LHE+8BuR7RYGDKvnrmcuSq3tDcKv9OFEXQt/HpbZhY7V6h0zlUXutnAD82GiFx9rdieCMjkvtcsPqBwgUl1Iiw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.3",
+        "is-array-buffer": "^3.0.5"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/array-includes": {
+      "version": "3.1.9",
+      "resolved": "https://registry.npmjs.org/array-includes/-/array-includes-3.1.9.tgz",
+      "integrity": "sha512-FmeCCAenzH0KH381SPT5FZmiA/TmpndpcaShhfgEN9eCVjnFBqq3l1xrI42y8+PPLI6hypzou4GXw00WHmPBLQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.8",
+        "call-bound": "^1.0.4",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.24.0",
+        "es-object-atoms": "^1.1.1",
+        "get-intrinsic": "^1.3.0",
+        "is-string": "^1.1.1",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/array.prototype.findlast": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/array.prototype.findlast/-/array.prototype.findlast-1.2.5.tgz",
+      "integrity": "sha512-CVvd6FHg1Z3POpBLxO6E6zr+rSKEQ9L6rZHAaY7lLfhKsWYUBBOuMs0e9o24oopj6H+geRCX0YJ+TJLBK2eHyQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.7",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.23.2",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.0.0",
+        "es-shim-unscopables": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/array.prototype.findlastindex": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/array.prototype.findlastindex/-/array.prototype.findlastindex-1.2.6.tgz",
+      "integrity": "sha512-F/TKATkzseUExPlfvmwQKGITM3DGTK+vkAsCZoDc5daVygbJBnjEUCbgkAvVFsgfXfX4YIqZ/27G3k3tdXrTxQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.8",
+        "call-bound": "^1.0.4",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.23.9",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "es-shim-unscopables": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/array.prototype.flat": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/array.prototype.flat/-/array.prototype.flat-1.3.3.tgz",
+      "integrity": "sha512-rwG/ja1neyLqCuGZ5YYrznA62D4mZXg0i1cIskIUKSiqF3Cje9/wXAls9B9s1Wa2fomMsIv8czB8jZcPmxCXFg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.8",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.23.5",
+        "es-shim-unscopables": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/array.prototype.flatmap": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/array.prototype.flatmap/-/array.prototype.flatmap-1.3.3.tgz",
+      "integrity": "sha512-Y7Wt51eKJSyi80hFrJCePGGNo5ktJCslFuboqJsbf57CCPcm5zztluPlc4/aD8sWsKvlwatezpV4U1efk8kpjg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.8",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.23.5",
+        "es-shim-unscopables": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/array.prototype.tosorted": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/array.prototype.tosorted/-/array.prototype.tosorted-1.1.4.tgz",
+      "integrity": "sha512-p6Fx8B7b7ZhL/gmUsAy0D15WhvDccw3mnGNbZpi3pmeJdxtWsj2jEaI4Y6oo3XiHfzuSgPwKc04MYt6KgvC/wA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.7",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.23.3",
+        "es-errors": "^1.3.0",
+        "es-shim-unscopables": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/arraybuffer.prototype.slice": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/arraybuffer.prototype.slice/-/arraybuffer.prototype.slice-1.0.4.tgz",
+      "integrity": "sha512-BNoCY6SXXPQ7gF2opIP4GBE+Xw7U+pHMYKuzjgCN3GwiaIR09UUeKfheyIry77QtrCBlC0KK0q5/TER/tYh3PQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "array-buffer-byte-length": "^1.0.1",
+        "call-bind": "^1.0.8",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.23.5",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.6",
+        "is-array-buffer": "^3.0.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/assertion-error": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/ast-types-flow": {
+      "version": "0.0.8",
+      "resolved": "https://registry.npmjs.org/ast-types-flow/-/ast-types-flow-0.0.8.tgz",
+      "integrity": "sha512-OH/2E5Fg20h2aPrbe+QL8JZQFko0YZaF+j4mnQ7BGhfavO7OpSLa8a0y9sBwomHdSbkhTS8TQNayBfnW5DwbvQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/async-function": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/async-function/-/async-function-1.0.0.tgz",
+      "integrity": "sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/available-typed-arrays": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/available-typed-arrays/-/available-typed-arrays-1.0.7.tgz",
+      "integrity": "sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "possible-typed-array-names": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/axe-core": {
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.13.0.tgz",
+      "integrity": "sha512-UzGt8zg7Ny8djbYMhxl2zuEevVa7r2gJjYY5Lwr1xM7+XU2nd6CkIWFTVcCIbAP63vSz71NaVyyuSk9lHKcy0A==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/axobject-query": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
+      "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/baseline-browser-mapping": {
+      "version": "2.11.20",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz",
+      "integrity": "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==",
+      "license": "Apache-2.0",
+      "bin": {
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/braces": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fill-range": "^7.1.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/browserslist": {
+      "version": "4.28.8",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
+      "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "baseline-browser-mapping": "^2.11.12",
+        "caniuse-lite": "^1.0.30001809",
+        "electron-to-chromium": "^1.5.402",
+        "node-releases": "^2.0.53",
+        "update-browserslist-db": "^1.3.0"
+      },
+      "bin": {
+        "browserslist": "cli.js"
+      },
+      "engines": {
+        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
+      }
+    },
+    "node_modules/call-bind": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.9.tgz",
+      "integrity": "sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "get-intrinsic": "^1.3.0",
+        "set-function-length": "^1.2.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
+      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "get-intrinsic": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/callsites": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
+      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/caniuse-lite": {
+      "version": "1.0.30001810",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "CC-BY-4.0"
+    },
+    "node_modules/chai": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
+      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/client-only": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
+      "integrity": "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==",
+      "license": "MIT"
+    },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/convert-source-map": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/csstype": {
+      "version": "3.2.3",
+      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
+      "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/damerau-levenshtein": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/damerau-levenshtein/-/damerau-levenshtein-1.0.8.tgz",
+      "integrity": "sha512-sdQSFB7+llfUcQHUQO3+B8ERRj0Oa4w9POWMI/puGtuf7gFywGmkaLCElnudfTiKZV+NvHqL0ifzdrI8Ro7ESA==",
+      "dev": true,
+      "license": "BSD-2-Clause"
+    },
+    "node_modules/data-view-buffer": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/data-view-buffer/-/data-view-buffer-1.0.2.tgz",
+      "integrity": "sha512-EmKO5V3OLXh1rtK2wgXRansaK1/mtVdTUEiEI0W8RkvgT05kfxaH29PliLnpLP73yYO6142Q72QNa8Wx/A5CqQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.3",
+        "es-errors": "^1.3.0",
+        "is-data-view": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/data-view-byte-length": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/data-view-byte-length/-/data-view-byte-length-1.0.2.tgz",
+      "integrity": "sha512-tuhGbE6CfTM9+5ANGf+oQb72Ky/0+s3xKUpHvShfiz2RxMFgFPjsXuRLBVMtvMs15awe45SRb83D6wH4ew6wlQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.3",
+        "es-errors": "^1.3.0",
+        "is-data-view": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/inspect-js"
+      }
+    },
+    "node_modules/data-view-byte-offset": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/data-view-byte-offset/-/data-view-byte-offset-1.0.1.tgz",
+      "integrity": "sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "is-data-view": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/deep-is": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
+      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/define-data-property": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz",
+      "integrity": "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-define-property": "^1.0.0",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/define-properties": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.2.1.tgz",
+      "integrity": "sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "define-data-property": "^1.0.1",
+        "has-property-descriptors": "^1.0.0",
+        "object-keys": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "devOptional": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/doctrine": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-2.1.0.tgz",
+      "integrity": "sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "esutils": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/electron-to-chromium": {
+      "version": "1.5.420",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.420.tgz",
+      "integrity": "sha512-2yD6XreGusOfNV+dUcvipJEXc3n/n7fgr7996aszTG+YY5E4mqM4tOq/3uhP129cazL9YHbVWSpc79ePotWtPA==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/emoji-regex": {
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/es-abstract": {
+      "version": "1.24.2",
+      "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.24.2.tgz",
+      "integrity": "sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "array-buffer-byte-length": "^1.0.2",
+        "arraybuffer.prototype.slice": "^1.0.4",
+        "available-typed-arrays": "^1.0.7",
+        "call-bind": "^1.0.8",
+        "call-bound": "^1.0.4",
+        "data-view-buffer": "^1.0.2",
+        "data-view-byte-length": "^1.0.2",
+        "data-view-byte-offset": "^1.0.1",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "es-set-tostringtag": "^2.1.0",
+        "es-to-primitive": "^1.3.0",
+        "function.prototype.name": "^1.1.8",
+        "get-intrinsic": "^1.3.0",
+        "get-proto": "^1.0.1",
+        "get-symbol-description": "^1.1.0",
+        "globalthis": "^1.0.4",
+        "gopd": "^1.2.0",
+        "has-property-descriptors": "^1.0.2",
+        "has-proto": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "internal-slot": "^1.1.0",
+        "is-array-buffer": "^3.0.5",
+        "is-callable": "^1.2.7",
+        "is-data-view": "^1.0.2",
+        "is-negative-zero": "^2.0.3",
+        "is-regex": "^1.2.1",
+        "is-set": "^2.0.3",
+        "is-shared-array-buffer": "^1.0.4",
+        "is-string": "^1.1.1",
+        "is-typed-array": "^1.1.15",
+        "is-weakref": "^1.1.1",
+        "math-intrinsics": "^1.1.0",
+        "object-inspect": "^1.13.4",
+        "object-keys": "^1.1.1",
+        "object.assign": "^4.1.7",
+        "own-keys": "^1.0.1",
+        "regexp.prototype.flags": "^1.5.4",
+        "safe-array-concat": "^1.1.3",
+        "safe-push-apply": "^1.0.0",
+        "safe-regex-test": "^1.1.0",
+        "set-proto": "^1.0.0",
+        "stop-iteration-iterator": "^1.1.0",
+        "string.prototype.trim": "^1.2.10",
+        "string.prototype.trimend": "^1.0.9",
+        "string.prototype.trimstart": "^1.0.8",
+        "typed-array-buffer": "^1.0.3",
+        "typed-array-byte-length": "^1.0.3",
+        "typed-array-byte-offset": "^1.0.4",
+        "typed-array-length": "^1.0.7",
+        "unbox-primitive": "^1.1.0",
+        "which-typed-array": "^1.1.19"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/es-abstract-get": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/es-abstract-get/-/es-abstract-get-1.0.0.tgz",
+      "integrity": "sha512-6PMWXpdhshVvFp+FoWYs1EvG1Nj0tvk0dZM+XcK0xMEM1czRVcP6ohqPWHy6qPagSpC8j4+p89WXlT+xXJs/fg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.2",
+        "is-callable": "^1.2.7",
+        "object-inspect": "^1.13.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-iterator-helpers": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/es-iterator-helpers/-/es-iterator-helpers-1.4.0.tgz",
+      "integrity": "sha512-c/A0P0oxkACDc+cKWw8evLXK83oBKgn0qPOqCYT4x9uolpCIJAcYvJC9QYKNDRPsTeGyCrQ326jrvgZWdCdK5Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.9",
+        "call-bound": "^1.0.4",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.24.2",
+        "es-errors": "^1.3.0",
+        "es-set-tostringtag": "^2.1.0",
+        "function-bind": "^1.1.2",
+        "get-intrinsic": "^1.3.0",
+        "globalthis": "^1.0.4",
+        "gopd": "^1.2.0",
+        "has-property-descriptors": "^1.0.2",
+        "has-proto": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "internal-slot": "^1.1.0",
+        "iterator.prototype": "^1.1.5",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-module-lexer": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
+      "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-set-tostringtag": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
+      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.6",
+        "has-tostringtag": "^1.0.2",
+        "hasown": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-shim-unscopables": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/es-shim-unscopables/-/es-shim-unscopables-1.1.0.tgz",
+      "integrity": "sha512-d9T8ucsEhh8Bi1woXCf+TIKDIROLG5WCkxg8geBCbvk22kzwC5G2OnXVMO6FUsvQlgUUXQ2itephWDLqDzbeCw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hasown": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-to-primitive": {
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/es-to-primitive/-/es-to-primitive-1.3.4.tgz",
+      "integrity": "sha512-yPDz7wqpg1/mmHLmS3tcfTfbw5f1eryXvyghYBffGdERwe+mV7ZcWzTR8LR17Kvqt3qfPurjlonmnq3MKXIOXw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-abstract-get": "^1.0.0",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "is-callable": "^1.2.7",
+        "is-date-object": "^1.1.0",
+        "is-symbol": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/escalade": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
+      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/escape-string-regexp": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/eslint": {
+      "version": "9.39.5",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.5.tgz",
+      "integrity": "sha512-DgZS62aPLXKlnxILS/AYCoRvHaZeXceIzlXPkkGGzJWSow1aEk0lbTlxUSlyjC8jcaKxAdOnTDz+o1JFSBsyjw==",
+      "deprecated": "This version is no longer supported. Please see https://eslint.org/version-support for other options.",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.8.0",
+        "@eslint-community/regexpp": "^4.12.1",
+        "@eslint/config-array": "^0.21.2",
+        "@eslint/config-helpers": "^0.4.2",
+        "@eslint/core": "^0.17.0",
+        "@eslint/eslintrc": "^3.3.6",
+        "@eslint/js": "9.39.5",
+        "@eslint/plugin-kit": "^0.4.1",
+        "@humanfs/node": "^0.16.6",
+        "@humanwhocodes/module-importer": "^1.0.1",
+        "@humanwhocodes/retry": "^0.4.2",
+        "@types/estree": "^1.0.6",
+        "ajv": "^6.14.0",
+        "chalk": "^4.0.0",
+        "cross-spawn": "^7.0.6",
+        "debug": "^4.3.2",
+        "escape-string-regexp": "^4.0.0",
+        "eslint-scope": "^8.4.0",
+        "eslint-visitor-keys": "^4.2.1",
+        "espree": "^10.4.0",
+        "esquery": "^1.5.0",
+        "esutils": "^2.0.2",
+        "fast-deep-equal": "^3.1.3",
+        "file-entry-cache": "^8.0.0",
+        "find-up": "^5.0.0",
+        "glob-parent": "^6.0.2",
+        "ignore": "^5.2.0",
+        "imurmurhash": "^0.1.4",
+        "is-glob": "^4.0.0",
+        "json-stable-stringify-without-jsonify": "^1.0.1",
+        "lodash.merge": "^4.6.2",
+        "minimatch": "^3.1.5",
+        "natural-compare": "^1.4.0",
+        "optionator": "^0.9.3"
+      },
+      "bin": {
+        "eslint": "bin/eslint.js"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://eslint.org/donate"
+      },
+      "peerDependencies": {
+        "jiti": "*"
+      },
+      "peerDependenciesMeta": {
+        "jiti": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/eslint-config-next": {
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-16.3.4.tgz",
+      "integrity": "sha512-35/8RM10huEL9vlr8hUZMERMENHBrnyHN3ZZkF9efSgzGaqK34jIqry44A956//zriUhUAUW0XSkcolhrryqAA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@next/eslint-plugin-next": "16.3.4",
+        "eslint-import-resolver-node": "^0.3.6",
+        "eslint-import-resolver-typescript": "^3.5.2",
+        "eslint-plugin-import": "^2.32.0",
+        "eslint-plugin-jsx-a11y": "^6.10.0",
+        "eslint-plugin-react": "^7.37.0",
+        "eslint-plugin-react-hooks": "^7.0.0",
+        "globals": "16.4.0",
+        "typescript-eslint": "^8.46.0"
+      },
+      "peerDependencies": {
+        "eslint": ">=9.0.0",
+        "typescript": ">=3.3.1"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/eslint-config-next/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/eslint-config-next/node_modules/brace-expansion": {
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/eslint-config-next/node_modules/eslint-import-resolver-typescript": {
+      "version": "3.10.1",
+      "resolved": "https://registry.npmjs.org/eslint-import-resolver-typescript/-/eslint-import-resolver-typescript-3.10.1.tgz",
+      "integrity": "sha512-A1rHYb06zjMGAxdLSkN2fXPBwuSaQ0iO5M/hdyS0Ajj1VBaRp0sPD3dn1FhME3c/JluGFbwSxyCfqdSbtQLAHQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "@nolyfill/is-core-module": "1.0.39",
+        "debug": "^4.4.0",
+        "get-tsconfig": "^4.10.0",
+        "is-bun-module": "^2.0.0",
+        "stable-hash": "^0.0.5",
+        "tinyglobby": "^0.2.13",
+        "unrs-resolver": "^1.6.2"
+      },
+      "engines": {
+        "node": "^14.18.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint-import-resolver-typescript"
+      },
+      "peerDependencies": {
+        "eslint": "*",
+        "eslint-plugin-import": "*",
+        "eslint-plugin-import-x": "*"
+      },
+      "peerDependenciesMeta": {
+        "eslint-plugin-import": {
+          "optional": true
+        },
+        "eslint-plugin-import-x": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/eslint-config-next/node_modules/eslint-plugin-import": {
+      "version": "2.32.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-import/-/eslint-plugin-import-2.32.0.tgz",
+      "integrity": "sha512-whOE1HFo/qJDyX4SnXzP4N6zOWn79WhnCUY/iDR0mPfQZO8wcYE4JClzI2oZrhBnnMUCBCHZhO6VQyoBU95mZA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@rtsao/scc": "^1.1.0",
+        "array-includes": "^3.1.9",
+        "array.prototype.findlastindex": "^1.2.6",
+        "array.prototype.flat": "^1.3.3",
+        "array.prototype.flatmap": "^1.3.3",
+        "debug": "^3.2.7",
+        "doctrine": "^2.1.0",
+        "eslint-import-resolver-node": "^0.3.9",
+        "eslint-module-utils": "^2.12.1",
+        "hasown": "^2.0.2",
+        "is-core-module": "^2.16.1",
+        "is-glob": "^4.0.3",
+        "minimatch": "^3.1.2",
+        "object.fromentries": "^2.0.8",
+        "object.groupby": "^1.0.3",
+        "object.values": "^1.2.1",
+        "semver": "^6.3.1",
+        "string.prototype.trimend": "^1.0.9",
+        "tsconfig-paths": "^3.15.0"
+      },
+      "engines": {
+        "node": ">=4"
+      },
+      "peerDependencies": {
+        "eslint": "^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 || ^9"
+      }
+    },
+    "node_modules/eslint-config-next/node_modules/eslint-plugin-import/node_modules/debug": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
+      "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.1"
+      }
+    },
+    "node_modules/eslint-config-next/node_modules/eslint-plugin-jsx-a11y": {
+      "version": "6.10.2",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsx-a11y/-/eslint-plugin-jsx-a11y-6.10.2.tgz",
+      "integrity": "sha512-scB3nz4WmG75pV8+3eRUQOHZlNSUhFNq37xnpgRkCCELU3XMvXAxLk1eqWWyE22Ki4Q01Fnsw9BA3cJHDPgn2Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "aria-query": "^5.3.2",
+        "array-includes": "^3.1.8",
+        "array.prototype.flatmap": "^1.3.2",
+        "ast-types-flow": "^0.0.8",
+        "axe-core": "^4.10.0",
+        "axobject-query": "^4.1.0",
+        "damerau-levenshtein": "^1.0.8",
+        "emoji-regex": "^9.2.2",
+        "hasown": "^2.0.2",
+        "jsx-ast-utils": "^3.3.5",
+        "language-tags": "^1.0.9",
+        "minimatch": "^3.1.2",
+        "object.fromentries": "^2.0.8",
+        "safe-regex-test": "^1.0.3",
+        "string.prototype.includes": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=4.0"
+      },
+      "peerDependencies": {
+        "eslint": "^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9"
+      }
+    },
+    "node_modules/eslint-config-next/node_modules/eslint-plugin-react": {
+      "version": "7.37.5",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-react/-/eslint-plugin-react-7.37.5.tgz",
+      "integrity": "sha512-Qteup0SqU15kdocexFNAJMvCJEfa2xUKNV4CC1xsVMrIIqEy3SQ/rqyxCWNzfrd3/ldy6HMlD2e0JDVpDg2qIA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "array-includes": "^3.1.8",
+        "array.prototype.findlast": "^1.2.5",
+        "array.prototype.flatmap": "^1.3.3",
+        "array.prototype.tosorted": "^1.1.4",
+        "doctrine": "^2.1.0",
+        "es-iterator-helpers": "^1.2.1",
+        "estraverse": "^5.3.0",
+        "hasown": "^2.0.2",
+        "jsx-ast-utils": "^2.4.1 || ^3.0.0",
+        "minimatch": "^3.1.2",
+        "object.entries": "^1.1.9",
+        "object.fromentries": "^2.0.8",
+        "object.values": "^1.2.1",
+        "prop-types": "^15.8.1",
+        "resolve": "^2.0.0-next.5",
+        "semver": "^6.3.1",
+        "string.prototype.matchall": "^4.0.12",
+        "string.prototype.repeat": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      },
+      "peerDependencies": {
+        "eslint": "^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7"
+      }
+    },
+    "node_modules/eslint-config-next/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/eslint-import-resolver-node": {
+      "version": "0.3.10",
+      "resolved": "https://registry.npmjs.org/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.10.tgz",
+      "integrity": "sha512-tRrKqFyCaKict5hOd244sL6EQFNycnMQnBe+j8uqGNXYzsImGbGUU4ibtoaBmv5FLwJwcFJNeg1GeVjQfbMrDQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^3.2.7",
+        "is-core-module": "^2.16.1",
+        "resolve": "^2.0.0-next.6"
+      }
+    },
+    "node_modules/eslint-import-resolver-node/node_modules/debug": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
+      "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.1"
+      }
+    },
+    "node_modules/eslint-module-utils": {
+      "version": "2.14.0",
+      "resolved": "https://registry.npmjs.org/eslint-module-utils/-/eslint-module-utils-2.14.0.tgz",
+      "integrity": "sha512-W2WCRZ9Dqntd+2u8jJcVMV2PKulc6RdLgUUoh/yQr3uB6lo/ZOeGx11sv60/8S4QFFKNslAlWhr9u0Ef7ZW6Ig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^3.2.7"
+      },
+      "engines": {
+        "node": ">=4"
+      },
+      "peerDependenciesMeta": {
+        "eslint": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/eslint-module-utils/node_modules/debug": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
+      "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.1"
+      }
+    },
+    "node_modules/eslint-plugin-react-hooks": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-7.1.1.tgz",
+      "integrity": "sha512-f2I7Gw6JbvCexzIInuSbZpfdQ44D7iqdWX01FKLvrPgqxoE7oMj8clOfto8U6vYiz4yd5oKu39rRSVOe1zRu0g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/core": "^7.24.4",
+        "@babel/parser": "^7.24.4",
+        "hermes-parser": "^0.25.1",
+        "zod": "^3.25.0 || ^4.0.0",
+        "zod-validation-error": "^3.5.0 || ^4.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "eslint": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0 || ^10.0.0"
+      }
+    },
+    "node_modules/eslint-scope": {
+      "version": "8.4.0",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-8.4.0.tgz",
+      "integrity": "sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "esrecurse": "^4.3.0",
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/eslint-visitor-keys": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
+      "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/eslint/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/eslint/node_modules/brace-expansion": {
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/eslint/node_modules/eslint-visitor-keys": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.1.tgz",
+      "integrity": "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/eslint/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/espree": {
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz",
+      "integrity": "sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "acorn": "^8.15.0",
+        "acorn-jsx": "^5.3.2",
+        "eslint-visitor-keys": "^4.2.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/espree/node_modules/eslint-visitor-keys": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.1.tgz",
+      "integrity": "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/esquery": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.7.0.tgz",
+      "integrity": "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "estraverse": "^5.1.0"
+      },
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
+    "node_modules/esrecurse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
+      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
+    "node_modules/esutils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/expect-type": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
+      "integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-glob": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.1.tgz",
+      "integrity": "sha512-kNFPyjhh5cKjrUltxs+wFx+ZkbRaxxmZ+X0ZU31SOsxCEtP9VPgtq2teZw1DebupL5GmDaNQ6yKMMVcM41iqDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.stat": "^2.0.2",
+        "@nodelib/fs.walk": "^1.2.3",
+        "glob-parent": "^5.1.2",
+        "merge2": "^1.3.0",
+        "micromatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=8.6.0"
+      }
+    },
+    "node_modules/fast-glob/node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/fast-json-stable-stringify": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
+      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-levenshtein": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
+      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fastq": {
+      "version": "1.20.3",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.3.tgz",
+      "integrity": "sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "reusify": "^1.0.4"
+      }
+    },
+    "node_modules/file-entry-cache": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
+      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "flat-cache": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
+    "node_modules/fill-range": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "to-regex-range": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/find-up": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
+      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "locate-path": "^6.0.0",
+        "path-exists": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/flat-cache": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
+      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "flatted": "^3.2.9",
+        "keyv": "^4.5.4"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/flatted": {
+      "version": "3.4.4",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.4.tgz",
+      "integrity": "sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/for-each": {
+      "version": "0.3.5",
+      "resolved": "https://registry.npmjs.org/for-each/-/for-each-0.3.5.tgz",
+      "integrity": "sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-callable": "^1.2.7"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/function.prototype.name": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/function.prototype.name/-/function.prototype.name-1.2.0.tgz",
+      "integrity": "sha512-jObKIik1P2QjPHP5nz5BaOtUlfgS0fWo8IUByNXkM+o+02sJOi94em77GwJKQSJ3gfPHdgzLNrHc1uokV4P/ew==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.9",
+        "call-bound": "^1.0.4",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "functions-have-names": "^1.2.3",
+        "has-property-descriptors": "^1.0.2",
+        "hasown": "^2.0.4",
+        "is-callable": "^1.2.7",
+        "is-document.all": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/functions-have-names": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/functions-have-names/-/functions-have-names-1.2.3.tgz",
+      "integrity": "sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/generator-function": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/generator-function/-/generator-function-2.0.1.tgz",
+      "integrity": "sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/gensync": {
+      "version": "1.0.0-beta.2",
+      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
+      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/get-symbol-description": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/get-symbol-description/-/get-symbol-description-1.1.0.tgz",
+      "integrity": "sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.3",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.6"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-tsconfig": {
+      "version": "4.14.3",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.14.3.tgz",
+      "integrity": "sha512-++QEw4DIY7WGoukz+/+A/8dGYPT9l9yIadnmSgZ8Rjr3YVSVDipQSO9CdnJo9ePqFqUUqh+wk9uIaoiAwsiPkA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "resolve-pkg-maps": "^1.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
+      }
+    },
+    "node_modules/glob-parent": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
+      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/globals": {
+      "version": "16.4.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-16.4.0.tgz",
+      "integrity": "sha512-ob/2LcVVaVGCYN+r14cnwnoDPUufjiYgSqRhiFD0Q1iI4Odora5RE8Iv1D24hAz5oMophRGkGz+yuvQmmUMnMw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/globalthis": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/globalthis/-/globalthis-1.0.4.tgz",
+      "integrity": "sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "define-properties": "^1.2.1",
+        "gopd": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-bigints": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-bigints/-/has-bigints-1.1.0.tgz",
+      "integrity": "sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/has-property-descriptors": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz",
+      "integrity": "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-define-property": "^1.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-proto": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.2.0.tgz",
+      "integrity": "sha512-KIL7eQPfHQRC8+XluaIw7BHUwwqL19bQn4hzNgdr+1wXoU0KKj6rufu47lhY7KbJR2C6T6+PfyN0Ea7wkSS+qQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-tostringtag": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
+      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "has-symbols": "^1.0.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/hasown": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/hermes-estree": {
+      "version": "0.25.1",
+      "resolved": "https://registry.npmjs.org/hermes-estree/-/hermes-estree-0.25.1.tgz",
+      "integrity": "sha512-0wUoCcLp+5Ev5pDW2OriHC2MJCbwLwuRx+gAqMTOkGKJJiBCLjtrvy4PWUGn6MIVefecRpzoOZ/UV6iGdOr+Cw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/hermes-parser": {
+      "version": "0.25.1",
+      "resolved": "https://registry.npmjs.org/hermes-parser/-/hermes-parser-0.25.1.tgz",
+      "integrity": "sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hermes-estree": "0.25.1"
+      }
+    },
+    "node_modules/ignore": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
+      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/import-fresh": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.1.tgz",
+      "integrity": "sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "parent-module": "^1.0.0",
+        "resolve-from": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/imurmurhash": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8.19"
+      }
+    },
+    "node_modules/internal-slot": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.1.0.tgz",
+      "integrity": "sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "hasown": "^2.0.2",
+        "side-channel": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/is-array-buffer": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/is-array-buffer/-/is-array-buffer-3.0.5.tgz",
+      "integrity": "sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.8",
+        "call-bound": "^1.0.3",
+        "get-intrinsic": "^1.2.6"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-async-function": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-async-function/-/is-async-function-2.1.1.tgz",
+      "integrity": "sha512-9dgM/cZBnNvjzaMYHVoxxfPj2QXt22Ev7SuuPrs+xav0ukGB0S6d4ydZdEiM48kLx5kDV+QBPrpVnFyefL8kkQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "async-function": "^1.0.0",
+        "call-bound": "^1.0.3",
+        "get-proto": "^1.0.1",
+        "has-tostringtag": "^1.0.2",
+        "safe-regex-test": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-bigint": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/is-bigint/-/is-bigint-1.1.0.tgz",
+      "integrity": "sha512-n4ZT37wG78iz03xPRKJrHTdZbe3IicyucEtdRsV5yglwc3GyUfbAfpSeD0FJ41NbUNSt5wbhqfp1fS+BgnvDFQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "has-bigints": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-boolean-object": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/is-boolean-object/-/is-boolean-object-1.2.2.tgz",
+      "integrity": "sha512-wa56o2/ElJMYqjCjGkXri7it5FbebW5usLw/nPmCMs5DeZ7eziSYZhSmPRn0txqeW4LnAmQQU7FgqLpsEFKM4A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.3",
+        "has-tostringtag": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-bun-module": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/is-bun-module/-/is-bun-module-2.0.0.tgz",
+      "integrity": "sha512-gNCGbnnnnFAUGKeZ9PdbyeGYJqewpmc2aKHUEMO5nQPWU9lOmv7jcmQIv+qHD8fXW6W7qfuCwX4rY9LNRjXrkQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.7.1"
+      }
+    },
+    "node_modules/is-bun-module/node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/is-callable": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.2.7.tgz",
+      "integrity": "sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-core-module": {
+      "version": "2.16.2",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.2.tgz",
+      "integrity": "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hasown": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-data-view": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/is-data-view/-/is-data-view-1.0.2.tgz",
+      "integrity": "sha512-RKtWF8pGmS87i2D6gqQu/l7EYRlVdfzemCJN/P3UOs//x1QE7mfhvzHIApBTRf7axvT6DMGwSwBXYCT0nfB9xw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "get-intrinsic": "^1.2.6",
+        "is-typed-array": "^1.1.13"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-date-object": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/is-date-object/-/is-date-object-1.1.0.tgz",
+      "integrity": "sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "has-tostringtag": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-document.all": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-document.all/-/is-document.all-1.0.0.tgz",
+      "integrity": "sha512-+XSoyS05OdBbhFuELhgTCpFNHkpBOJqtsZfUFFpe5QTw+9Sjbh8zitxhQkYAo6wV7e1Vb8cAPvpCk9jGam/82g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-finalizationregistry": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/is-finalizationregistry/-/is-finalizationregistry-1.1.1.tgz",
+      "integrity": "sha512-1pC6N8qWJbWoPtEjgcL2xyhQOP491EQjeUo3qTKcmV8YSDDJrOepfG8pcC7h/QgnQHYSv0mJ3Z/ZWxmatVrysg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-generator-function": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/is-generator-function/-/is-generator-function-1.1.2.tgz",
+      "integrity": "sha512-upqt1SkGkODW9tsGNG5mtXTXtECizwtS2kA161M+gJPc1xdb/Ax629af6YrTwcOeQHbewrPNlE5Dx7kzvXTizA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.4",
+        "generator-function": "^2.0.0",
+        "get-proto": "^1.0.1",
+        "has-tostringtag": "^1.0.2",
+        "safe-regex-test": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-extglob": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-map": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/is-map/-/is-map-2.0.3.tgz",
+      "integrity": "sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-negative-zero": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/is-negative-zero/-/is-negative-zero-2.0.3.tgz",
+      "integrity": "sha512-5KoIu2Ngpyek75jXodFvnafB6DJgr3u8uuK0LEZJjrU19DrMD3EVERaR8sjz8CCGgpZvxPl9SuE1GMVPFHx1mw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.12.0"
+      }
+    },
+    "node_modules/is-number-object": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/is-number-object/-/is-number-object-1.1.1.tgz",
+      "integrity": "sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.3",
+        "has-tostringtag": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-regex": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.2.1.tgz",
+      "integrity": "sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "gopd": "^1.2.0",
+        "has-tostringtag": "^1.0.2",
+        "hasown": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-set": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/is-set/-/is-set-2.0.3.tgz",
+      "integrity": "sha512-iPAjerrse27/ygGLxw+EBR9agv9Y6uLeYVJMu+QNCoouJ1/1ri0mGrcWpfCqFZuzzx3WjtwxG098X+n4OuRkPg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-shared-array-buffer": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/is-shared-array-buffer/-/is-shared-array-buffer-1.0.4.tgz",
+      "integrity": "sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-string": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/is-string/-/is-string-1.1.1.tgz",
+      "integrity": "sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.3",
+        "has-tostringtag": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-symbol": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/is-symbol/-/is-symbol-1.1.1.tgz",
+      "integrity": "sha512-9gGx6GTtCQM73BgmHQXfDmLtfjjTUDSyoxTCbp5WtoixAhfgsDirWIcVQ/IHpvI5Vgd5i/J5F7B9cN/WlVbC/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "has-symbols": "^1.1.0",
+        "safe-regex-test": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-typed-array": {
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/is-typed-array/-/is-typed-array-1.1.15.tgz",
+      "integrity": "sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "which-typed-array": "^1.1.16"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-weakmap": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/is-weakmap/-/is-weakmap-2.0.2.tgz",
+      "integrity": "sha512-K5pXYOm9wqY1RgjpL3YTkF39tni1XajUIkawTLUo9EZEVUFga5gSQJF8nNS7ZwJQ02y+1YCNYcMh+HIf1ZqE+w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-weakref": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/is-weakref/-/is-weakref-1.1.1.tgz",
+      "integrity": "sha512-6i9mGWSlqzNMEqpCp93KwRS1uUOodk2OJ6b+sq7ZPDSy2WuI5NFIxp/254TytR8ftefexkWn5xNiHUNpPOfSew==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-weakset": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/is-weakset/-/is-weakset-2.0.4.tgz",
+      "integrity": "sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.3",
+        "get-intrinsic": "^1.2.6"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/isarray": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz",
+      "integrity": "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/iterator.prototype": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/iterator.prototype/-/iterator.prototype-1.1.5.tgz",
+      "integrity": "sha512-H0dkQoCa3b2VEeKQBOxFph+JAbcrQdE7KC0UkqwpLmv2EC4P41QXP+rqo9wYodACiG5/WM5s9oDApTU8utwj9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "define-data-property": "^1.1.4",
+        "es-object-atoms": "^1.0.0",
+        "get-intrinsic": "^1.2.6",
+        "get-proto": "^1.0.0",
+        "has-symbols": "^1.1.0",
+        "set-function-name": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/js-yaml": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/jsesc": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
+      "integrity": "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "jsesc": "bin/jsesc"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/json-buffer": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
+      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json-stable-stringify-without-jsonify": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
+      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json5": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "json5": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/jsx-ast-utils": {
+      "version": "3.3.5",
+      "resolved": "https://registry.npmjs.org/jsx-ast-utils/-/jsx-ast-utils-3.3.5.tgz",
+      "integrity": "sha512-ZZow9HBI5O6EPgSJLUb8n2NKgmVWTwCvHGwFuJlMjvLFqlGG6pjirPhtdsseaLZjSibD8eegzmYpUZwoIlj2cQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "array-includes": "^3.1.6",
+        "array.prototype.flat": "^1.3.1",
+        "object.assign": "^4.1.4",
+        "object.values": "^1.1.6"
+      },
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/keyv": {
+      "version": "4.5.4",
+      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
+      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "json-buffer": "3.0.1"
+      }
+    },
+    "node_modules/language-subtag-registry": {
+      "version": "0.3.23",
+      "resolved": "https://registry.npmjs.org/language-subtag-registry/-/language-subtag-registry-0.3.23.tgz",
+      "integrity": "sha512-0K65Lea881pHotoGEa5gDlMxt3pctLi2RplBb7Ezh4rRdLEOtgi7n4EwK9lamnUCkKBqaeKRVebTq6BAxSkpXQ==",
+      "dev": true,
+      "license": "CC0-1.0"
+    },
+    "node_modules/language-tags": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/language-tags/-/language-tags-1.0.9.tgz",
+      "integrity": "sha512-MbjN408fEndfiQXbFQ1vnd+1NoLDsnQW41410oQBXiyXDMYH5z505juWa4KUE1LqxRC7DgOgZDbKLxHIwm27hA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "language-subtag-registry": "^0.3.20"
+      },
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
+    "node_modules/levn": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
+      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "prelude-ls": "^1.2.1",
+        "type-check": "~0.4.0"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/lightningcss": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
+      "integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.33.0",
+        "lightningcss-darwin-arm64": "1.33.0",
+        "lightningcss-darwin-x64": "1.33.0",
+        "lightningcss-freebsd-x64": "1.33.0",
+        "lightningcss-linux-arm-gnueabihf": "1.33.0",
+        "lightningcss-linux-arm64-gnu": "1.33.0",
+        "lightningcss-linux-arm64-musl": "1.33.0",
+        "lightningcss-linux-x64-gnu": "1.33.0",
+        "lightningcss-linux-x64-musl": "1.33.0",
+        "lightningcss-win32-arm64-msvc": "1.33.0",
+        "lightningcss-win32-x64-msvc": "1.33.0"
+      }
+    },
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
+      "integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
+      "integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
+      "integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-freebsd-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
+      "integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
+      "integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
+      "integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
+      "integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
+      "integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
+      "integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
+      "integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
+      "integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/locate-path": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
+      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-locate": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/lodash.merge": {
+      "version": "4.6.2",
+      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
+      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/loose-envify": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz",
+      "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "js-tokens": "^3.0.0 || ^4.0.0"
+      },
+      "bin": {
+        "loose-envify": "cli.js"
+      }
+    },
+    "node_modules/lru-cache": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
+      "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "yallist": "^3.0.2"
+      }
+    },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/merge2": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
+      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/micromatch": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
+      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "braces": "^3.0.3",
+        "picomatch": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=8.6"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/napi-postinstall": {
+      "version": "0.3.4",
+      "resolved": "https://registry.npmjs.org/napi-postinstall/-/napi-postinstall-0.3.4.tgz",
+      "integrity": "sha512-PHI5f1O0EP5xJ9gQmFGMS6IZcrVvTjpXjz7Na41gTE7eE2hK11lg04CECCYEEjdc17EV4DO+fkGEtt7TpTaTiQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "napi-postinstall": "lib/cli.js"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/napi-postinstall"
+      }
+    },
+    "node_modules/natural-compare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
+      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/next": {
+      "version": "16.3.4",
+      "resolved": "https://registry.npmjs.org/next/-/next-16.3.4.tgz",
+      "integrity": "sha512-/Ztf6CeRH+ejEXUrYtqI4gkS66eFIHuSwqi60RgcpWKodxFZx2/dqVCMKBwILfAHXQ+F1b1vAudgj3mnxqtoIA==",
+      "license": "MIT",
+      "dependencies": {
+        "@next/env": "16.3.4",
+        "@swc/helpers": "0.5.23",
+        "baseline-browser-mapping": "^2.9.19",
+        "caniuse-lite": "^1.0.30001579",
+        "postcss": "8.5.23",
+        "styled-jsx": "5.1.6"
+      },
+      "bin": {
+        "next": "dist/bin/next"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "optionalDependencies": {
+        "@next/swc-darwin-arm64": "16.3.4",
+        "@next/swc-darwin-x64": "16.3.4",
+        "@next/swc-linux-arm64-gnu": "16.3.4",
+        "@next/swc-linux-arm64-musl": "16.3.4",
+        "@next/swc-linux-x64-gnu": "16.3.4",
+        "@next/swc-linux-x64-musl": "16.3.4",
+        "@next/swc-win32-arm64-msvc": "16.3.4",
+        "@next/swc-win32-x64-msvc": "16.3.4",
+        "sharp": "^0.35.4"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.1.0",
+        "@playwright/test": "^1.51.1",
+        "babel-plugin-react-compiler": "*",
+        "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0",
+        "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0",
+        "sass": "^1.3.0"
+      },
+      "peerDependenciesMeta": {
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@playwright/test": {
+          "optional": true
+        },
+        "babel-plugin-react-compiler": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/node-exports-info": {
+      "version": "1.6.2",
+      "resolved": "https://registry.npmjs.org/node-exports-info/-/node-exports-info-1.6.2.tgz",
+      "integrity": "sha512-kXs9Go0cah0qHVV2v389IXQLdLCeE1xfFtjOAF+iobu0OIoG1pje8At2vMHyaPMiPMnG/LWP50twML21eMcAag==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "array.prototype.flatmap": "^1.3.3",
+        "es-errors": "^1.3.0",
+        "object.entries": "^1.1.9",
+        "semver": "^6.3.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/node-releases": {
+      "version": "2.0.54",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",
+      "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/object-assign": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/object-inspect": {
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/object-keys": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
+      "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/object.assign": {
+      "version": "4.1.7",
+      "resolved": "https://registry.npmjs.org/object.assign/-/object.assign-4.1.7.tgz",
+      "integrity": "sha512-nK28WOo+QIjBkDduTINE4JkF/UJJKyf2EJxvJKfblDpyg0Q+pkOHNTL0Qwy6NP6FhE/EnzV73BxxqcJaXY9anw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.8",
+        "call-bound": "^1.0.3",
+        "define-properties": "^1.2.1",
+        "es-object-atoms": "^1.0.0",
+        "has-symbols": "^1.1.0",
+        "object-keys": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/object.entries": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/object.entries/-/object.entries-1.1.9.tgz",
+      "integrity": "sha512-8u/hfXFRBD1O0hPUjioLhoWFHRmt6tKA4/vZPyckBr18l1KE9uHrFaFaUi8MDRTpi4uak2goyPTSNJLXX2k2Hw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.8",
+        "call-bound": "^1.0.4",
+        "define-properties": "^1.2.1",
+        "es-object-atoms": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/object.fromentries": {
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/object.fromentries/-/object.fromentries-2.0.8.tgz",
+      "integrity": "sha512-k6E21FzySsSK5a21KRADBd/NGneRegFO5pLHfdQLpRDETUNJueLXs3WCzyQ3tFRDYgbq3KHGXfTbi2bs8WQ6rQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.7",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.23.2",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/object.groupby": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/object.groupby/-/object.groupby-1.0.3.tgz",
+      "integrity": "sha512-+Lhy3TQTuzXI5hevh8sBGqbmurHbbIjAi0Z4S63nthVLmLxfbj4T54a4CfZrXIrt9iP4mVAPYMo/v99taj3wjQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.7",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.23.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/object.values": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/object.values/-/object.values-1.2.1.tgz",
+      "integrity": "sha512-gXah6aZrcUxjWg2zR2MwouP2eHlCBzdV4pygudehaKXSGW4v2AsRQUK+lwwXhii6KFZcunEnmSUoYp5CXibxtA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.8",
+        "call-bound": "^1.0.3",
+        "define-properties": "^1.2.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/obug": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.4.tgz",
+      "integrity": "sha512-4a+OsYv9UktOJKE+l1A4OufDgdRF9PifWj+tJnHURo/P+WOxpG4GzUFL9qCalmWauao6ogiG+QvnCovwPoyAWA==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/sxzz",
+        "https://opencollective.com/debug"
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/optionator": {
+      "version": "0.9.4",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
+      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "deep-is": "^0.1.3",
+        "fast-levenshtein": "^2.0.6",
+        "levn": "^0.4.1",
+        "prelude-ls": "^1.2.1",
+        "type-check": "^0.4.0",
+        "word-wrap": "^1.2.5"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/own-keys": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/own-keys/-/own-keys-1.0.2.tgz",
+      "integrity": "sha512-19YVAg7T+WTrxggPukVq7DjTv6+PJ867TmhCvBsYwmbFCsZd344rq2Ld1p0wo8f8Qrrhgp82c6FJRqdXWtSEhg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.4",
+        "get-intrinsic": "^1.3.0",
+        "object-keys": "^1.1.1",
+        "safe-push-apply": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/p-limit": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
+      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "yocto-queue": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/p-locate": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
+      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-limit": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/parent-module": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
+      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "callsites": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/path-exists": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-parse": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
+      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/pathe": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "license": "ISC"
+    },
+    "node_modules/picomatch": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/playwright": {
+      "version": "1.62.1",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.62.1.tgz",
+      "integrity": "sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg==",
+      "devOptional": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.62.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.62.1",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.62.1.tgz",
+      "integrity": "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==",
+      "devOptional": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/possible-typed-array-names": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz",
+      "integrity": "sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/postcss": {
+      "version": "8.5.23",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz",
+      "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.16",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
+    "node_modules/prelude-ls": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
+      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/prettier": {
+      "version": "3.9.6",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.6.tgz",
+      "integrity": "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "prettier": "bin/prettier.cjs"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/prettier/prettier?sponsor=1"
+      }
+    },
+    "node_modules/prop-types": {
+      "version": "15.8.1",
+      "resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.8.1.tgz",
+      "integrity": "sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "loose-envify": "^1.4.0",
+        "object-assign": "^4.1.1",
+        "react-is": "^16.13.1"
+      }
+    },
+    "node_modules/punycode": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/queue-microtask": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
+      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/react": {
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.8.tgz",
+      "integrity": "sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/react-dom": {
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.8.tgz",
+      "integrity": "sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ==",
+      "license": "MIT",
+      "dependencies": {
+        "scheduler": "^0.27.0"
+      },
+      "peerDependencies": {
+        "react": "^19.2.8"
+      }
+    },
+    "node_modules/react-is": {
+      "version": "16.13.1",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz",
+      "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/reflect.getprototypeof": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/reflect.getprototypeof/-/reflect.getprototypeof-1.0.10.tgz",
+      "integrity": "sha512-00o4I+DVrefhv+nX0ulyi3biSHCPDe+yLv5o/p6d/UVlirijB8E16FtfwSAi4g3tcqrQ4lRAqQSoFEZJehYEcw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.8",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.23.9",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.0.0",
+        "get-intrinsic": "^1.2.7",
+        "get-proto": "^1.0.1",
+        "which-builtin-type": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/regexp.prototype.flags": {
+      "version": "1.5.4",
+      "resolved": "https://registry.npmjs.org/regexp.prototype.flags/-/regexp.prototype.flags-1.5.4.tgz",
+      "integrity": "sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.8",
+        "define-properties": "^1.2.1",
+        "es-errors": "^1.3.0",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "set-function-name": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/resolve": {
+      "version": "2.0.0-next.7",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-2.0.0-next.7.tgz",
+      "integrity": "sha512-tqt+NBWwyaMgw3zDsnygx4CByWjQEJHOPMdslYhppaQSJUtL/D4JO9CcBBlhPoI8lz9oJIDXkwXfhF4aWqP8xQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "is-core-module": "^2.16.2",
+        "node-exports-info": "^1.6.0",
+        "object-keys": "^1.1.1",
+        "path-parse": "^1.0.7",
+        "supports-preserve-symlinks-flag": "^1.0.0"
+      },
+      "bin": {
+        "resolve": "bin/resolve"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/resolve-from": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
+      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/resolve-pkg-maps": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-pkg-maps/-/resolve-pkg-maps-1.0.0.tgz",
+      "integrity": "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
+      }
+    },
+    "node_modules/reusify": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz",
+      "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "iojs": ">=1.0.0",
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/rolldown": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.7.tgz",
+      "integrity": "sha512-g0EtLvBjTUB7jhyV0S/TCup3v/XSVl45vUIGbOGU4QPiyjTenCe4mKuFvW9fEgYmS2Fo42AUssRmNuMziXdrig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.148.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm-eabi": "1.2.7",
+        "@rolldown/binding-android-arm64": "1.2.7",
+        "@rolldown/binding-darwin-arm64": "1.2.7",
+        "@rolldown/binding-darwin-x64": "1.2.7",
+        "@rolldown/binding-freebsd-x64": "1.2.7",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.2.7",
+        "@rolldown/binding-linux-arm64-gnu": "1.2.7",
+        "@rolldown/binding-linux-arm64-musl": "1.2.7",
+        "@rolldown/binding-linux-ppc64-gnu": "1.2.7",
+        "@rolldown/binding-linux-s390x-gnu": "1.2.7",
+        "@rolldown/binding-linux-x64-gnu": "1.2.7",
+        "@rolldown/binding-linux-x64-musl": "1.2.7",
+        "@rolldown/binding-openharmony-arm64": "1.2.7",
+        "@rolldown/binding-win32-arm64-msvc": "1.2.7",
+        "@rolldown/binding-win32-x64-msvc": "1.2.7"
+      }
+    },
+    "node_modules/run-parallel": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
+      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "queue-microtask": "^1.2.2"
+      }
+    },
+    "node_modules/safe-array-concat": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/safe-array-concat/-/safe-array-concat-1.1.4.tgz",
+      "integrity": "sha512-wtZlHyOje6OZTGqAoaDKxFkgRtkF9CnHAVnCHKfuj200wAgL+bSJhdsCD2l0Qx/2ekEXjPWcyKkfGb5CPboslg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.9",
+        "call-bound": "^1.0.4",
+        "get-intrinsic": "^1.3.0",
+        "has-symbols": "^1.1.0",
+        "isarray": "^2.0.5"
+      },
+      "engines": {
+        "node": ">=0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/safe-push-apply": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/safe-push-apply/-/safe-push-apply-1.0.0.tgz",
+      "integrity": "sha512-iKE9w/Z7xCzUMIZqdBsp6pEQvwuEebH4vdpjcDWnyzaI6yl6O9FHvVpmGelvEHNsoY6wGblkxR6Zty/h00WiSA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "isarray": "^2.0.5"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/safe-regex-test": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/safe-regex-test/-/safe-regex-test-1.1.0.tgz",
+      "integrity": "sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "is-regex": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/scheduler": {
+      "version": "0.27.0",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
+      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
+      "license": "MIT"
+    },
+    "node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/set-function-length": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.2.2.tgz",
+      "integrity": "sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "define-data-property": "^1.1.4",
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2",
+        "get-intrinsic": "^1.2.4",
+        "gopd": "^1.0.1",
+        "has-property-descriptors": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/set-function-name": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/set-function-name/-/set-function-name-2.0.2.tgz",
+      "integrity": "sha512-7PGFlmtwsEADb0WYyvCMa1t+yke6daIG4Wirafur5kcf+MhUnPms1UeR0CKQdTZD81yESwMHbtn+TR+dMviakQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "define-data-property": "^1.1.4",
+        "es-errors": "^1.3.0",
+        "functions-have-names": "^1.2.3",
+        "has-property-descriptors": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/set-proto": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/set-proto/-/set-proto-1.0.0.tgz",
+      "integrity": "sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/sharp": {
+      "version": "0.35.4",
+      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.4.tgz",
+      "integrity": "sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "dependencies": {
+        "@img/colour": "^1.1.0",
+        "detect-libc": "^2.1.2",
+        "semver": "^7.8.5"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-darwin-arm64": "0.35.4",
+        "@img/sharp-darwin-x64": "0.35.4",
+        "@img/sharp-freebsd-wasm32": "0.35.4",
+        "@img/sharp-libvips-darwin-arm64": "1.3.3",
+        "@img/sharp-libvips-darwin-x64": "1.3.3",
+        "@img/sharp-libvips-linux-arm": "1.3.3",
+        "@img/sharp-libvips-linux-arm64": "1.3.3",
+        "@img/sharp-libvips-linux-ppc64": "1.3.3",
+        "@img/sharp-libvips-linux-riscv64": "1.3.3",
+        "@img/sharp-libvips-linux-s390x": "1.3.3",
+        "@img/sharp-libvips-linux-x64": "1.3.3",
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.3",
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.3",
+        "@img/sharp-linux-arm": "0.35.4",
+        "@img/sharp-linux-arm64": "0.35.4",
+        "@img/sharp-linux-ppc64": "0.35.4",
+        "@img/sharp-linux-riscv64": "0.35.4",
+        "@img/sharp-linux-s390x": "0.35.4",
+        "@img/sharp-linux-x64": "0.35.4",
+        "@img/sharp-linuxmusl-arm64": "0.35.4",
+        "@img/sharp-linuxmusl-x64": "0.35.4",
+        "@img/sharp-webcontainers-wasm32": "0.35.4",
+        "@img/sharp-win32-arm64": "0.35.4",
+        "@img/sharp-win32-ia32": "0.35.4",
+        "@img/sharp-win32-x64": "0.35.4"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/sharp/node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "license": "ISC",
+      "optional": true,
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/side-channel": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4",
+        "side-channel-list": "^1.0.1",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/siginfo": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
+      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/stable-hash": {
+      "version": "0.0.5",
+      "resolved": "https://registry.npmjs.org/stable-hash/-/stable-hash-0.0.5.tgz",
+      "integrity": "sha512-+L3ccpzibovGXFK+Ap/f8LOS0ahMrHTf3xu7mMLSpEGU0EO9ucaysSylKo9eRDFNhWve/y275iPmIZ4z39a9iA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/stackback": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
+      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/std-env": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.2.0.tgz",
+      "integrity": "sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/stop-iteration-iterator": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/stop-iteration-iterator/-/stop-iteration-iterator-1.1.0.tgz",
+      "integrity": "sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "internal-slot": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/string.prototype.includes": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/string.prototype.includes/-/string.prototype.includes-2.0.1.tgz",
+      "integrity": "sha512-o7+c9bW6zpAdJHTtujeePODAhkuicdAryFsfVKwA+wGw89wJ4GTY484WTucM9hLtDEOpOvI+aHnzqnC5lHp4Rg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.7",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.23.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/string.prototype.matchall": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/string.prototype.matchall/-/string.prototype.matchall-4.1.0.tgz",
+      "integrity": "sha512-tHNHTxInrYLCga9O9YGxWA3G9/nnzQw8UGAyqGx3Ar1pSTTzIuM4woFSq4SowkXCjJIwq5sIiQvEfRI9tCH1qQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.9",
+        "call-bound": "^1.0.4",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.24.2",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.2",
+        "get-intrinsic": "^1.3.0",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "internal-slot": "^1.1.0",
+        "regexp.prototype.flags": "^1.5.4",
+        "set-function-name": "^2.0.2",
+        "side-channel": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/string.prototype.repeat": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/string.prototype.repeat/-/string.prototype.repeat-1.0.0.tgz",
+      "integrity": "sha512-0u/TldDbKD8bFCQ/4f5+mNRrXwZ8hg2w7ZR8wa16e8z9XpePWl3eGEcUD0OXpEH/VJH/2G3gjUtR3ZOiBe2S/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "define-properties": "^1.1.3",
+        "es-abstract": "^1.17.5"
+      }
+    },
+    "node_modules/string.prototype.trim": {
+      "version": "1.2.11",
+      "resolved": "https://registry.npmjs.org/string.prototype.trim/-/string.prototype.trim-1.2.11.tgz",
+      "integrity": "sha512-PwvK7BU+CMTJGYQCTZb5RWXIML92lftJLhQz1tBzgKiqGxJaMlBAa48POXaNAC2s4y8jr3EFqrkF9+44neS46w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.9",
+        "call-bound": "^1.0.4",
+        "define-data-property": "^1.1.4",
+        "define-properties": "^1.2.1",
+        "es-abstract": "^1.24.2",
+        "es-object-atoms": "^1.1.2",
+        "has-property-descriptors": "^1.0.2",
+        "safe-regex-test": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/string.prototype.trimend": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/string.prototype.trimend/-/string.prototype.trimend-1.0.10.tgz",
+      "integrity": "sha512-2+3aDAOmPTmuFwjDnmJG2ctEkQKVki7vOSqaxkv42Mowj1V6PnvuwFCRrR5lChUux1TBskPjfkeTOhqczDMxTw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.9",
+        "call-bound": "^1.0.4",
+        "define-properties": "^1.2.1",
+        "es-object-atoms": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/string.prototype.trimstart": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/string.prototype.trimstart/-/string.prototype.trimstart-1.0.8.tgz",
+      "integrity": "sha512-UXSH262CSZY1tfu3G3Secr6uGLCFVPMhIqHjlgCUtCCcgihYc/xKs9djMTMUOb2j1mVSeU8EU6NWc/iQKU6Gfg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.7",
+        "define-properties": "^1.2.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/strip-bom": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
+      "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/styled-jsx": {
+      "version": "5.1.6",
+      "resolved": "https://registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.6.tgz",
+      "integrity": "sha512-qSVyDTeMotdvQYoHWLNGwRFJHC+i+ZvdBRYosOFgC+Wg1vx4frN2/RG/NA7SYqqvKNLf39P2LSRA2pu6n0XYZA==",
+      "license": "MIT",
+      "dependencies": {
+        "client-only": "0.0.1"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "peerDependencies": {
+        "react": ">= 16.8.0 || 17.x.x || ^18.0.0-0 || ^19.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "@babel/core": {
+          "optional": true
+        },
+        "babel-plugin-macros": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/supports-preserve-symlinks-flag": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
+      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/tinybench": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
+      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tinyexec": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.0.tgz",
+      "integrity": "sha512-QKAl9m8gWWGHV8jZcPeym6j+XULi6tOf1mT83WYJ4Lk2ytW/uwAWkrP0uFsdoYMdueVJ0qs26wZ+23xeB4ibNQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tinyglobby": {
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
+      }
+    },
+    "node_modules/tinyglobby/node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/tinyglobby/node_modules/picomatch": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/tinyrainbow": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.1.tgz",
+      "integrity": "sha512-yau8yJdTt989Mm0Bd/236QnzEiPf2xLLTqUZRUJOo/3CB078LSwzei343DgtJVmfJKJE3TMINY1u42SQsP6mXw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-number": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=8.0"
+      }
+    },
+    "node_modules/ts-api-utils": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
+      "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.12"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4"
+      }
+    },
+    "node_modules/tsconfig-paths": {
+      "version": "3.15.0",
+      "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-3.15.0.tgz",
+      "integrity": "sha512-2Ac2RgzDe/cn48GvOe3M+o82pEFewD3UPbyoUHHdKasHwJKjds4fLXWf/Ux5kATBKN20oaFGu+jbElp1pos0mg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/json5": "^0.0.29",
+        "json5": "^1.0.2",
+        "minimist": "^1.2.6",
+        "strip-bom": "^3.0.0"
+      }
+    },
+    "node_modules/tsconfig-paths/node_modules/json5": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
+      "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "minimist": "^1.2.0"
+      },
+      "bin": {
+        "json5": "lib/cli.js"
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/type-check": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
+      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "prelude-ls": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/typed-array-buffer": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/typed-array-buffer/-/typed-array-buffer-1.0.3.tgz",
+      "integrity": "sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.3",
+        "es-errors": "^1.3.0",
+        "is-typed-array": "^1.1.14"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/typed-array-byte-length": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/typed-array-byte-length/-/typed-array-byte-length-1.0.3.tgz",
+      "integrity": "sha512-BaXgOuIxz8n8pIq3e7Atg/7s+DpiYrxn4vdot3w9KbnBhcRQq6o3xemQdIfynqSeXeDrF32x+WvfzmOjPiY9lg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.8",
+        "for-each": "^0.3.3",
+        "gopd": "^1.2.0",
+        "has-proto": "^1.2.0",
+        "is-typed-array": "^1.1.14"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/typed-array-byte-offset": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/typed-array-byte-offset/-/typed-array-byte-offset-1.0.4.tgz",
+      "integrity": "sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "available-typed-arrays": "^1.0.7",
+        "call-bind": "^1.0.8",
+        "for-each": "^0.3.3",
+        "gopd": "^1.2.0",
+        "has-proto": "^1.2.0",
+        "is-typed-array": "^1.1.15",
+        "reflect.getprototypeof": "^1.0.9"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/typed-array-length": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/typed-array-length/-/typed-array-length-1.0.8.tgz",
+      "integrity": "sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bind": "^1.0.9",
+        "for-each": "^0.3.5",
+        "gopd": "^1.2.0",
+        "is-typed-array": "^1.1.15",
+        "possible-typed-array-names": "^1.1.0",
+        "reflect.getprototypeof": "^1.0.10"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
+      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/typescript-eslint": {
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.69.0.tgz",
+      "integrity": "sha512-B3MltX0VqjUBNEe3b3sSuiRbfa6XrfHFtBiPamjT5AsW/dfq+y+bc0wyuS9DxAS1LyzCxRp2+rxzpLUvqM2BvA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/eslint-plugin": "8.69.0",
+        "@typescript-eslint/parser": "8.69.0",
+        "@typescript-eslint/typescript-estree": "8.69.0",
+        "@typescript-eslint/utils": "8.69.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/unbox-primitive": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.1.0.tgz",
+      "integrity": "sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.3",
+        "has-bigints": "^1.0.2",
+        "has-symbols": "^1.1.0",
+        "which-boxed-primitive": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "7.18.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
+      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/unrs-resolver": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/unrs-resolver/-/unrs-resolver-1.12.2.tgz",
+      "integrity": "sha512-dmlRxBJJayXjqTwC+JtF1HhJmgf3ftQ3YejFcZrf4+KKtJv0qDsK1pjqaaVjG7wJ5NJ6UVP1OqRMQ71Z4C3rxQ==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "napi-postinstall": "^0.3.4"
+      },
+      "funding": {
+        "url": "https://opencollective.com/unrs-resolver"
+      },
+      "optionalDependencies": {
+        "@unrs/resolver-binding-android-arm-eabi": "1.12.2",
+        "@unrs/resolver-binding-android-arm64": "1.12.2",
+        "@unrs/resolver-binding-darwin-arm64": "1.12.2",
+        "@unrs/resolver-binding-darwin-x64": "1.12.2",
+        "@unrs/resolver-binding-freebsd-x64": "1.12.2",
+        "@unrs/resolver-binding-linux-arm-gnueabihf": "1.12.2",
+        "@unrs/resolver-binding-linux-arm-musleabihf": "1.12.2",
+        "@unrs/resolver-binding-linux-arm64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-arm64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-loong64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-loong64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-ppc64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-riscv64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-riscv64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-s390x-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-x64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-x64-musl": "1.12.2",
+        "@unrs/resolver-binding-openharmony-arm64": "1.12.2",
+        "@unrs/resolver-binding-wasm32-wasi": "1.12.2",
+        "@unrs/resolver-binding-win32-arm64-msvc": "1.12.2",
+        "@unrs/resolver-binding-win32-ia32-msvc": "1.12.2",
+        "@unrs/resolver-binding-win32-x64-msvc": "1.12.2"
+      }
+    },
+    "node_modules/update-browserslist-db": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
+      "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "escalade": "^3.2.0",
+        "picocolors": "^1.1.1"
+      },
+      "bin": {
+        "update-browserslist-db": "cli.js"
+      },
+      "peerDependencies": {
+        "browserslist": ">= 4.21.0"
+      }
+    },
+    "node_modules/uri-js": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "punycode": "^2.1.0"
+      }
+    },
+    "node_modules/vite": {
+      "version": "8.2.2",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.2.2.tgz",
+      "integrity": "sha512-cFKLV/PRgAUlIRm5WjMjJ86jrftzpqcgH+Us+DS8mI3CDNiH30Whrz8uHL3+MOLPAgqbMBAqWdAHAphOAM+z/Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lightningcss": "^1.33.0",
+        "picomatch": "^4.0.5",
+        "postcss": "^8.5.26",
+        "rolldown": "~1.2.4",
+        "tinyglobby": "^0.2.17"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^20.19.0 || >=22.12.0",
+        "@vitejs/devtools": "^0.4.0 || ^0.5.0",
+        "esbuild": "^0.27.0 || ^0.28.0",
+        "jiti": ">=1.21.0",
+        "less": "^4.0.0",
+        "sass": "^1.70.0",
+        "sass-embedded": "^1.70.0",
+        "stylus": ">=0.54.8",
+        "sugarss": "^5.0.0",
+        "terser": "^5.16.0",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "esbuild": {
+          "optional": true
+        },
+        "jiti": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vite/node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/vite/node_modules/picomatch": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/vite/node_modules/postcss": {
+      "version": "8.5.26",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
+      "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.17",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
+    "node_modules/vitest": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.11.tgz",
+      "integrity": "sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/expect": "4.1.11",
+        "@vitest/mocker": "4.1.11",
+        "@vitest/pretty-format": "4.1.11",
+        "@vitest/runner": "4.1.11",
+        "@vitest/snapshot": "4.1.11",
+        "@vitest/spy": "4.1.11",
+        "@vitest/utils": "4.1.11",
+        "es-module-lexer": "^2.0.0",
+        "expect-type": "^1.3.0",
+        "magic-string": "^0.30.21",
+        "obug": "^2.1.1",
+        "pathe": "^2.0.3",
+        "picomatch": "^4.0.3",
+        "std-env": "^4.0.0-rc.1",
+        "tinybench": "^2.9.0",
+        "tinyexec": "^1.0.2",
+        "tinyglobby": "^0.2.15",
+        "tinyrainbow": "^3.1.0",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
+        "why-is-node-running": "^2.3.0"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@opentelemetry/api": "^1.9.0",
+        "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
+        "@vitest/browser-playwright": "4.1.11",
+        "@vitest/browser-preview": "4.1.11",
+        "@vitest/browser-webdriverio": "4.1.11",
+        "@vitest/coverage-istanbul": "4.1.11",
+        "@vitest/coverage-v8": "4.1.11",
+        "@vitest/ui": "4.1.11",
+        "happy-dom": "*",
+        "jsdom": "*",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
+          "optional": true
+        },
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@types/node": {
+          "optional": true
+        },
+        "@vitest/browser-playwright": {
+          "optional": true
+        },
+        "@vitest/browser-preview": {
+          "optional": true
+        },
+        "@vitest/browser-webdriverio": {
+          "optional": true
+        },
+        "@vitest/coverage-istanbul": {
+          "optional": true
+        },
+        "@vitest/coverage-v8": {
+          "optional": true
+        },
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        },
+        "vite": {
+          "optional": false
+        }
+      }
+    },
+    "node_modules/vitest/node_modules/picomatch": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/which-boxed-primitive": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/which-boxed-primitive/-/which-boxed-primitive-1.1.1.tgz",
+      "integrity": "sha512-TbX3mj8n0odCBFVlY8AxkqcHASw3L60jIuF8jFP78az3C2YhmGvqbHBpAjTRH2/xqYunrJ9g1jSyjCjpoWzIAA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-bigint": "^1.1.0",
+        "is-boolean-object": "^1.2.1",
+        "is-number-object": "^1.1.1",
+        "is-string": "^1.1.1",
+        "is-symbol": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/which-builtin-type": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/which-builtin-type/-/which-builtin-type-1.2.1.tgz",
+      "integrity": "sha512-6iBczoX+kDQ7a3+YJBnh3T+KZRxM/iYNPXicqk66/Qfm1b93iu+yOImkg0zHbj5LNOcNv1TEADiZ0xa34B4q6Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "function.prototype.name": "^1.1.6",
+        "has-tostringtag": "^1.0.2",
+        "is-async-function": "^2.0.0",
+        "is-date-object": "^1.1.0",
+        "is-finalizationregistry": "^1.1.0",
+        "is-generator-function": "^1.0.10",
+        "is-regex": "^1.2.1",
+        "is-weakref": "^1.0.2",
+        "isarray": "^2.0.5",
+        "which-boxed-primitive": "^1.1.0",
+        "which-collection": "^1.0.2",
+        "which-typed-array": "^1.1.16"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/which-collection": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/which-collection/-/which-collection-1.0.2.tgz",
+      "integrity": "sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-map": "^2.0.3",
+        "is-set": "^2.0.3",
+        "is-weakmap": "^2.0.2",
+        "is-weakset": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/which-typed-array": {
+      "version": "1.1.22",
+      "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.22.tgz",
+      "integrity": "sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "available-typed-arrays": "^1.0.7",
+        "call-bind": "^1.0.9",
+        "call-bound": "^1.0.4",
+        "for-each": "^0.3.5",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-tostringtag": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/why-is-node-running": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
+      "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "siginfo": "^2.0.0",
+        "stackback": "0.0.2"
+      },
+      "bin": {
+        "why-is-node-running": "cli.js"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/word-wrap": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
+      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/yallist": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
+      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/yocto-queue": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
+      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/zod": {
+      "version": "4.5.4",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.5.4.tgz",
+      "integrity": "sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    },
+    "node_modules/zod-validation-error": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/zod-validation-error/-/zod-validation-error-4.0.2.tgz",
+      "integrity": "sha512-Q6/nZLe6jxuU80qb/4uJ4t5v2VEZ44lzQjPDhYJNztRQ4wyWc6VF3D3Kb/fAuPetZQnhS3hnajCf9CsWesghLQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "peerDependencies": {
+        "zod": "^3.25.0 || ^4.0.0"
+      }
+    }
+  }
+}
diff --git a/recipes/node-typescript-next-web/package.json b/recipes/node-typescript-next-web/package.json
new file mode 100644
index 0000000..c0cd99e
--- /dev/null
+++ b/recipes/node-typescript-next-web/package.json
@@ -0,0 +1,39 @@
+{
+  "name": "mill-next-web-template",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "engines": {
+    "node": ">=24.18.1 <25"
+  },
+  "packageManager": "npm@11.16.0",
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
+    "format:check": "prettier --check .",
+    "lint": "eslint . --max-warnings 0",
+    "typecheck": "tsc --noEmit",
+    "test:unit": "vitest run test/unit",
+    "test:integration": "vitest run test/integration",
+    "test:browser": "playwright test",
+    "test:package": "npm run build && node scripts/check-package.mjs",
+    "check": "npm run format:check && npm run lint && npm run typecheck && npm run test:unit && npm run test:integration && npm run test:browser && npm run test:package"
+  },
+  "dependencies": {
+    "next": "16.3.4",
+    "react": "19.2.8",
+    "react-dom": "19.2.8"
+  },
+  "devDependencies": {
+    "@playwright/test": "1.62.1",
+    "@types/node": "24.13.3",
+    "@types/react": "19.2.18",
+    "@types/react-dom": "19.2.5",
+    "eslint": "9.39.5",
+    "eslint-config-next": "16.3.4",
+    "prettier": "3.9.6",
+    "typescript": "6.0.3",
+    "vitest": "4.1.11"
+  }
+}
diff --git a/recipes/node-typescript-next-web/playwright.config.ts b/recipes/node-typescript-next-web/playwright.config.ts
new file mode 100644
index 0000000..0e96d59
--- /dev/null
+++ b/recipes/node-typescript-next-web/playwright.config.ts
@@ -0,0 +1,23 @@
+import { defineConfig, devices } from "@playwright/test";
+
+export default defineConfig({
+  testDir: "test/browser",
+  fullyParallel: false,
+  forbidOnly: true,
+  retries: 0,
+  workers: 1,
+  reporter: "line",
+  outputDir: ".mill-output/test-results",
+  use: {
+    baseURL: "http://127.0.0.1:3100",
+    trace: "retain-on-failure",
+  },
+  projects: [{ name: "chromium", use: devices["Desktop Chrome"] }],
+  webServer: {
+    command:
+      "npm run build && mkdir -p .next/standalone/.next && cp -R .next/static .next/standalone/.next/static && HOSTNAME=127.0.0.1 PORT=3100 node .next/standalone/server.js",
+    url: "http://127.0.0.1:3100/api/health",
+    reuseExistingServer: false,
+    timeout: 60_000,
+  },
+});
diff --git a/recipes/node-typescript-next-web/recipe.yaml b/recipes/node-typescript-next-web/recipe.yaml
new file mode 100644
index 0000000..53794c2
--- /dev/null
+++ b/recipes/node-typescript-next-web/recipe.yaml
@@ -0,0 +1,71 @@
+schemaVersion: "1"
+id: node-typescript-next-web
+version: 1.0.0
+status: supported
+observedAt: "2026-09-02T14:15:00.000Z"
+runtime:
+  node: 24.18.1
+  npm: 11.16.0
+stack:
+  next: 16.3.4
+  react: 19.2.8
+  reactDom: 19.2.8
+  typescript: 6.0.3
+  eslint: 9.39.5
+  prettier: 3.9.6
+  vitest: 4.1.11
+  playwright: 1.62.1
+verifierImage: mcr.microsoft.com/playwright:v1.62.1-noble@sha256:dcc5531e97840b9b5e794f2814476b21571c5124a3fca2267d73041f56e7580e
+registry: https://registry.npmjs.org
+licensePolicy:
+  allowed:
+    - 0BSD
+    - Apache-2.0
+    - BSD-2-Clause
+    - BSD-3-Clause
+    - BlueOak-1.0.0
+    - CC-BY-4.0
+    - CC0-1.0
+    - ISC
+    - LGPL-3.0-or-later
+    - MIT
+    - MPL-2.0
+    - Python-2.0
+  reviewedPackages:
+    - { name: next, license: MIT }
+    - { name: react, license: MIT }
+    - { name: react-dom, license: MIT }
+    - { name: "@playwright/test", license: Apache-2.0 }
+commands:
+  required: [check]
+  native:
+    - format:check
+    - lint
+    - typecheck
+    - test:unit
+    - test:integration
+    - test:browser
+    - test:package
+    - check
+oracles:
+  - id: web-title-and-health
+    commandId: test:browser
+    evidencePaths:
+      - app/page.tsx
+      - app/api/health/route.ts
+      - src/health.ts
+      - test/browser/home.spec.ts
+    proves:
+      - the approved product title renders on the delivered web surface
+      - the delivered health endpoint returns the stable healthy payload
+writablePaths: [.mill-output, .next]
+sources:
+  - https://nodejs.org/en/about/previous-releases
+  - https://nextjs.org/docs/app/getting-started/installation
+  - https://nextjs.org/docs/app/getting-started/deploying
+  - https://react.dev/versions
+  - https://registry.npmjs.org/next/16.3.4
+  - https://registry.npmjs.org/react/19.2.8
+  - https://registry.npmjs.org/react-dom/19.2.8
+  - https://registry.npmjs.org/@playwright/test/1.62.1
+  - https://mcr.microsoft.com/v2/playwright/manifests/v1.62.1-noble
diff --git a/recipes/node-typescript-next-web/scripts/check-package.mjs b/recipes/node-typescript-next-web/scripts/check-package.mjs
new file mode 100644
index 0000000..8df83b5
--- /dev/null
+++ b/recipes/node-typescript-next-web/scripts/check-package.mjs
@@ -0,0 +1,3 @@
+import { access } from "node:fs/promises";
+
+await access(new URL("../.next/standalone/server.js", import.meta.url));
diff --git a/recipes/node-typescript-next-web/src/health.ts b/recipes/node-typescript-next-web/src/health.ts
new file mode 100644
index 0000000..c4203a3
--- /dev/null
+++ b/recipes/node-typescript-next-web/src/health.ts
@@ -0,0 +1,3 @@
+export function healthPayload() {
+  return { status: "ok" } as const;
+}
diff --git a/recipes/node-typescript-next-web/test/browser/home.spec.ts b/recipes/node-typescript-next-web/test/browser/home.spec.ts
new file mode 100644
index 0000000..cf6aaea
--- /dev/null
+++ b/recipes/node-typescript-next-web/test/browser/home.spec.ts
@@ -0,0 +1,14 @@
+import { expect, test } from "@playwright/test";
+
+test("renders the approved product title and a healthy API", async ({
+  page,
+  request,
+}) => {
+  await page.goto("/");
+  await expect(page.getByRole("heading", { level: 1 })).toHaveText(
+    __MILL_PRODUCT_TITLE_LITERAL__,
+  );
+  const response = await request.get("/api/health");
+  expect(response.ok()).toBe(true);
+  await expect(response.json()).resolves.toEqual({ status: "ok" });
+});
diff --git a/recipes/node-typescript-next-web/test/integration/health-route.test.ts b/recipes/node-typescript-next-web/test/integration/health-route.test.ts
new file mode 100644
index 0000000..f406bd4
--- /dev/null
+++ b/recipes/node-typescript-next-web/test/integration/health-route.test.ts
@@ -0,0 +1,11 @@
+import { describe, expect, it } from "vitest";
+
+import { GET } from "../../app/api/health/route";
+
+describe("GET /api/health", () => {
+  it("returns the public health contract", async () => {
+    const response = GET();
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ status: "ok" });
+  });
+});
diff --git a/recipes/node-typescript-next-web/test/unit/health.test.ts b/recipes/node-typescript-next-web/test/unit/health.test.ts
new file mode 100644
index 0000000..daf519f
--- /dev/null
+++ b/recipes/node-typescript-next-web/test/unit/health.test.ts
@@ -0,0 +1,9 @@
+import { describe, expect, it } from "vitest";
+
+import { healthPayload } from "../../src/health";
+
+describe("healthPayload", () => {
+  it("reports a stable healthy state", () => {
+    expect(healthPayload()).toEqual({ status: "ok" });
+  });
+});
diff --git a/recipes/node-typescript-next-web/tsconfig.json b/recipes/node-typescript-next-web/tsconfig.json
new file mode 100644
index 0000000..3070a61
--- /dev/null
+++ b/recipes/node-typescript-next-web/tsconfig.json
@@ -0,0 +1,33 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "es2022"],
+    "allowJs": false,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "incremental": false,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "paths": {
+      "@/*": ["./*"]
+    }
+  },
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": ["node_modules"]
+}
diff --git a/schemas/README.md b/schemas/README.md
index bdb9567..202557f 100644
--- a/schemas/README.md
+++ b/schemas/README.md
@@ -14,6 +14,8 @@ documents use the same data model.
 - `impact-manifest.schema.json`
 - `mill-config.schema.json`
 - `mill-lock.schema.json`
+- `recipe-manifest.schema.json`
+- `repository-integration-plan.schema.json`
 - `task-packet.schema.json`
 - `context-manifest.schema.json`
 - `worker-profile.schema.json`
@@ -34,6 +36,17 @@ cannot start new work. Version `2` is the continuity contract: it requires an
 approved impact manifest and explicit acceptance, invariant, scenario, coverage,
 and evidence bindings. Every new run requires version `2`.
 
+Recipe manifests bind the one supported generated stack, exact assets, and named
+behavior-specific oracles. Approved scenarios must select a matching recipe
+oracle before generated tasks can use its command evidence. Repository
+integration plans bind greenfield or adoption target identity, approval,
+generator version, file actions, recipe identity, and baseline posture.
+`mill.lock` records the installed integration and ownership map. Verifier
+dependency targets are currently the literal `node_modules`; writable paths are
+comma-free top-level directories because they become explicit read-only or tmpfs
+OCI mounts. Dependency configuration also binds the supported npm manager and
+exact HTTPS registry origin; those fields participate in snapshot identity.
+
 JSON Schemas are generated from the runtime Zod contracts in input mode. Run
 `npm run schemas:generate` after an intentional contract change;
 `npm run schemas:check` fails if committed JSON and runtime validation drift.
diff --git a/schemas/mill-config.schema.json b/schemas/mill-config.schema.json
index 192bda6..8c684ca 100644
--- a/schemas/mill-config.schema.json
+++ b/schemas/mill-config.schema.json
@@ -27,7 +27,28 @@
           "type": "string",
           "pattern": "^[^@\\s]+@sha256:[a-f0-9]{64}$"
         },
-        "network": { "type": "string", "const": "none" }
+        "network": { "type": "string", "const": "none" },
+        "dependencies": {
+          "type": "object",
+          "properties": {
+            "manager": { "type": "string", "const": "npm" },
+            "registry": {
+              "type": "string",
+              "const": "https://registry.npmjs.org"
+            },
+            "targetPath": { "type": "string", "const": "node_modules" },
+            "lockPaths": {
+              "minItems": 1,
+              "type": "array",
+              "items": {
+                "type": "string",
+                "pattern": "^(?!\\/)(?!.*(?:^|\\/)\\.\\.(?:\\/|$))[^*?[\\]\\\\]+(?:\\/\\*\\*)?$"
+              }
+            }
+          },
+          "required": ["manager", "registry", "targetPath", "lockPaths"],
+          "additionalProperties": false
+        }
       },
       "required": ["image", "network"],
       "additionalProperties": false
@@ -161,6 +182,13 @@
             "default": "oci",
             "type": "string",
             "enum": ["oci", "host"]
+          },
+          "writablePaths": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "pattern": "^(?!\\.\\.?$)(?!.*[,/])[^*?[\\]\\\\]+$"
+            }
           }
         },
         "required": ["argv", "cwd", "controlPaths", "capability"],
diff --git a/schemas/mill-lock.schema.json b/schemas/mill-lock.schema.json
index 3da3116..3f42f25 100644
--- a/schemas/mill-lock.schema.json
+++ b/schemas/mill-lock.schema.json
@@ -34,6 +34,59 @@
       },
       "required": ["id", "version", "digest"],
       "additionalProperties": false
+    },
+    "integration": {
+      "type": "object",
+      "properties": {
+        "mode": { "type": "string", "enum": ["greenfield", "adoption"] },
+        "planDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "baseCommit": {
+          "anyOf": [
+            { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+            { "type": "null" }
+          ]
+        },
+        "files": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "path": {
+                "type": "string",
+                "pattern": "^(?!\\/)(?!.*(?:^|\\/)\\.\\.(?:\\/|$))[^*?[\\]\\\\]+(?:\\/\\*\\*)?$"
+              },
+              "ownership": {
+                "type": "string",
+                "enum": ["mill_only", "generated_once", "managed"]
+              },
+              "templateDigest": {
+                "type": "string",
+                "pattern": "^sha256:[a-f0-9]{64}$"
+              },
+              "installedDigest": {
+                "type": "string",
+                "pattern": "^sha256:[a-f0-9]{64}$"
+              },
+              "preexistingDigest": {
+                "anyOf": [
+                  { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+                  { "type": "null" }
+                ]
+              }
+            },
+            "required": [
+              "path",
+              "ownership",
+              "templateDigest",
+              "installedDigest",
+              "preexistingDigest"
+            ],
+            "additionalProperties": false
+          }
+        }
+      },
+      "required": ["mode", "planDigest", "baseCommit", "files"],
+      "additionalProperties": false
     }
   },
   "required": ["schemaVersion", "mill"],
diff --git a/schemas/outcome-plan.schema.json b/schemas/outcome-plan.schema.json
index 64a6141..192a711 100644
--- a/schemas/outcome-plan.schema.json
+++ b/schemas/outcome-plan.schema.json
@@ -20,6 +20,12 @@
             "type": "array",
             "items": { "type": "string", "minLength": 1 }
           },
+          "acceptanceIds": {
+            "minItems": 1,
+            "type": "array",
+            "items": { "type": "string", "minLength": 1 },
+            "uniqueItems": true
+          },
           "dependsOn": {
             "type": "array",
             "items": { "type": "string", "minLength": 1 }
@@ -27,6 +33,10 @@
           "status": {
             "type": "string",
             "enum": ["proposed", "approved", "ready", "blocked", "closed"]
+          },
+          "taskRef": {
+            "type": "string",
+            "pattern": "^(?!\\/)(?!.*(?:^|\\/)\\.\\.(?:\\/|$))[^*?[\\]\\\\]+(?:\\/\\*\\*)?$"
           }
         },
         "required": ["id", "title", "acceptance", "dependsOn", "status"],
diff --git a/schemas/product-contract.schema.json b/schemas/product-contract.schema.json
index 394b576..4f3af7c 100644
--- a/schemas/product-contract.schema.json
+++ b/schemas/product-contract.schema.json
@@ -14,7 +14,13 @@
         "type": "object",
         "properties": {
           "id": { "type": "string", "pattern": "^OUT-[A-Z0-9][A-Z0-9-]*$" },
-          "statement": { "type": "string", "minLength": 1 }
+          "statement": { "type": "string", "minLength": 1 },
+          "acceptanceIds": {
+            "minItems": 1,
+            "type": "array",
+            "items": { "type": "string", "minLength": 1 },
+            "uniqueItems": true
+          }
         },
         "required": ["id", "statement"],
         "additionalProperties": false
diff --git a/schemas/recipe-manifest.schema.json b/schemas/recipe-manifest.schema.json
new file mode 100644
index 0000000..db84e15
--- /dev/null
+++ b/schemas/recipe-manifest.schema.json
@@ -0,0 +1,187 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "schemaVersion": { "type": "string", "const": "1" },
+    "id": { "type": "string", "const": "node-typescript-next-web" },
+    "version": {
+      "type": "string",
+      "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+    },
+    "status": {
+      "type": "string",
+      "enum": ["supported", "experimental", "unsupported"]
+    },
+    "observedAt": {
+      "type": "string",
+      "format": "date-time",
+      "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
+    },
+    "runtime": {
+      "type": "object",
+      "properties": {
+        "node": {
+          "type": "string",
+          "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+        },
+        "npm": {
+          "type": "string",
+          "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+        }
+      },
+      "required": ["node", "npm"],
+      "additionalProperties": false
+    },
+    "stack": {
+      "type": "object",
+      "properties": {
+        "next": {
+          "type": "string",
+          "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+        },
+        "react": {
+          "type": "string",
+          "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+        },
+        "reactDom": {
+          "type": "string",
+          "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+        },
+        "typescript": {
+          "type": "string",
+          "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+        },
+        "eslint": {
+          "type": "string",
+          "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+        },
+        "prettier": {
+          "type": "string",
+          "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+        },
+        "vitest": {
+          "type": "string",
+          "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+        },
+        "playwright": {
+          "type": "string",
+          "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+        }
+      },
+      "required": [
+        "next",
+        "react",
+        "reactDom",
+        "typescript",
+        "eslint",
+        "prettier",
+        "vitest",
+        "playwright"
+      ],
+      "additionalProperties": false
+    },
+    "verifierImage": {
+      "type": "string",
+      "pattern": "^[^@\\s]+@sha256:[a-f0-9]{64}$"
+    },
+    "registry": { "type": "string", "format": "uri" },
+    "licensePolicy": {
+      "type": "object",
+      "properties": {
+        "allowed": {
+          "minItems": 1,
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "reviewedPackages": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": { "type": "string", "minLength": 1 },
+              "license": { "type": "string", "minLength": 1 }
+            },
+            "required": ["name", "license"],
+            "additionalProperties": false
+          }
+        }
+      },
+      "required": ["allowed", "reviewedPackages"],
+      "additionalProperties": false
+    },
+    "commands": {
+      "type": "object",
+      "properties": {
+        "required": {
+          "minItems": 1,
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "native": {
+          "minItems": 1,
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        }
+      },
+      "required": ["required", "native"],
+      "additionalProperties": false
+    },
+    "oracles": {
+      "minItems": 1,
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "id": { "type": "string", "minLength": 1 },
+          "commandId": { "type": "string", "minLength": 1 },
+          "evidencePaths": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "string",
+              "pattern": "^(?!\\/)(?!.*(?:^|\\/)\\.\\.(?:\\/|$))[^*?[\\]\\\\]+(?:\\/\\*\\*)?$"
+            }
+          },
+          "proves": {
+            "minItems": 1,
+            "type": "array",
+            "items": { "type": "string", "minLength": 1 }
+          }
+        },
+        "required": ["id", "commandId", "evidencePaths", "proves"],
+        "additionalProperties": false
+      }
+    },
+    "writablePaths": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "pattern": "^(?!\\.\\.?$)(?!.*[,/])[^*?[\\]\\\\]+$"
+      }
+    },
+    "sources": {
+      "minItems": 1,
+      "type": "array",
+      "items": { "type": "string", "format": "uri" }
+    }
+  },
+  "required": [
+    "schemaVersion",
+    "id",
+    "version",
+    "status",
+    "observedAt",
+    "runtime",
+    "stack",
+    "verifierImage",
+    "registry",
+    "licensePolicy",
+    "commands",
+    "oracles",
+    "writablePaths",
+    "sources"
+  ],
+  "additionalProperties": false,
+  "$id": "https://github.com/davidahmann/mill/schemas/recipe-manifest.schema.json",
+  "title": "RecipeManifest"
+}
diff --git a/schemas/repository-integration-plan.schema.json b/schemas/repository-integration-plan.schema.json
new file mode 100644
index 0000000..de05c6e
--- /dev/null
+++ b/schemas/repository-integration-plan.schema.json
@@ -0,0 +1,156 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "schemaVersion": { "type": "string", "const": "1" },
+    "planDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "generator": {
+      "type": "object",
+      "properties": {
+        "package": { "type": "string", "const": "@davidahmann/mill" },
+        "version": {
+          "type": "string",
+          "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+        }
+      },
+      "required": ["package", "version"],
+      "additionalProperties": false
+    },
+    "mode": { "type": "string", "enum": ["greenfield", "adoption"] },
+    "target": {
+      "type": "object",
+      "properties": {
+        "directoryName": { "type": "string", "minLength": 1 },
+        "canonicalPathDigest": {
+          "type": "string",
+          "pattern": "^sha256:[a-f0-9]{64}$"
+        },
+        "baseCommit": {
+          "anyOf": [
+            { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+            { "type": "null" }
+          ]
+        },
+        "scanDigest": {
+          "anyOf": [
+            { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+            { "type": "null" }
+          ]
+        }
+      },
+      "required": [
+        "directoryName",
+        "canonicalPathDigest",
+        "baseCommit",
+        "scanDigest"
+      ],
+      "additionalProperties": false
+    },
+    "productProposalDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "productContractDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "recipe": {
+      "type": "object",
+      "properties": {
+        "id": { "type": "string", "const": "node-typescript-next-web" },
+        "version": {
+          "type": "string",
+          "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+        },
+        "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "status": { "type": "string", "const": "supported" },
+        "verifierImage": {
+          "type": "string",
+          "pattern": "^[^@\\s]+@sha256:[a-f0-9]{64}$"
+        }
+      },
+      "required": ["id", "version", "digest", "status", "verifierImage"],
+      "additionalProperties": false
+    },
+    "approval": {
+      "type": "object",
+      "properties": {
+        "approvedBy": { "type": "string", "minLength": 1 },
+        "approvedAt": {
+          "type": "string",
+          "format": "date-time",
+          "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
+        }
+      },
+      "required": ["approvedBy", "approvedAt"],
+      "additionalProperties": false
+    },
+    "files": {
+      "minItems": 1,
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "path": {
+            "type": "string",
+            "pattern": "^(?!\\/)(?!.*(?:^|\\/)\\.\\.(?:\\/|$))[^*?[\\]\\\\]+(?:\\/\\*\\*)?$"
+          },
+          "ownership": {
+            "type": "string",
+            "enum": ["mill_only", "generated_once", "managed"]
+          },
+          "action": {
+            "type": "string",
+            "enum": ["create", "retain_identical"]
+          },
+          "contentDigest": {
+            "type": "string",
+            "pattern": "^sha256:[a-f0-9]{64}$"
+          },
+          "preexistingDigest": {
+            "anyOf": [
+              { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+              { "type": "null" }
+            ]
+          }
+        },
+        "required": [
+          "path",
+          "ownership",
+          "action",
+          "contentDigest",
+          "preexistingDigest"
+        ],
+        "additionalProperties": false
+      }
+    },
+    "commandIds": {
+      "minItems": 1,
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "networkDisclosure": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "baseline": { "type": "string", "const": "unverified" }
+  },
+  "required": [
+    "schemaVersion",
+    "planDigest",
+    "generator",
+    "mode",
+    "target",
+    "productProposalDigest",
+    "productContractDigest",
+    "recipe",
+    "approval",
+    "files",
+    "commandIds",
+    "networkDisclosure",
+    "baseline"
+  ],
+  "additionalProperties": false,
+  "$id": "https://github.com/davidahmann/mill/schemas/repository-integration-plan.schema.json",
+  "title": "RepositoryIntegrationPlan"
+}
diff --git a/schemas/scenario-set.schema.json b/schemas/scenario-set.schema.json
index 0254205..5a3038b 100644
--- a/schemas/scenario-set.schema.json
+++ b/schemas/scenario-set.schema.json
@@ -65,6 +65,7 @@
             "enum": ["builder_visible", "reviewer_owned", "human_acceptance"]
           },
           "executionRef": { "type": "string", "minLength": 1 },
+          "recipeOracle": { "type": "string", "minLength": 1 },
           "forbidden": {
             "default": [],
             "type": "array",
diff --git a/schemas/specification-proposal.schema.json b/schemas/specification-proposal.schema.json
index 49afed1..c786938 100644
--- a/schemas/specification-proposal.schema.json
+++ b/schemas/specification-proposal.schema.json
@@ -31,7 +31,13 @@
             "type": "object",
             "properties": {
               "id": { "type": "string", "pattern": "^OUT-[A-Z0-9][A-Z0-9-]*$" },
-              "statement": { "type": "string", "minLength": 1 }
+              "statement": { "type": "string", "minLength": 1 },
+              "acceptanceIds": {
+                "minItems": 1,
+                "type": "array",
+                "items": { "type": "string", "minLength": 1 },
+                "uniqueItems": true
+              }
             },
             "required": ["id", "statement"],
             "additionalProperties": false
@@ -309,6 +315,7 @@
                 ]
               },
               "executionRef": { "type": "string", "minLength": 1 },
+              "recipeOracle": { "type": "string", "minLength": 1 },
               "forbidden": {
                 "default": [],
                 "type": "array",
diff --git a/scripts/generate-schemas.mjs b/scripts/generate-schemas.mjs
index 781508a..4ac2b0b 100644
--- a/scripts/generate-schemas.mjs
+++ b/scripts/generate-schemas.mjs
@@ -18,6 +18,11 @@ const definitions = {
   millLock: ["mill-lock.schema.json", "MillLock"],
   outcomePlan: ["outcome-plan.schema.json", "OutcomePlan"],
   productContract: ["product-contract.schema.json", "ProductContract"],
+  recipeManifest: ["recipe-manifest.schema.json", "RecipeManifest"],
+  repositoryIntegrationPlan: [
+    "repository-integration-plan.schema.json",
+    "RepositoryIntegrationPlan",
+  ],
   reviewResult: ["review-result.schema.json", "ReviewResult"],
   scenarioSet: ["scenario-set.schema.json", "ScenarioSet"],
   sourceManifest: ["source-manifest.schema.json", "SourceManifest"],
diff --git a/scripts/test-package.mjs b/scripts/test-package.mjs
index 8a99714..6736a93 100644
--- a/scripts/test-package.mjs
+++ b/scripts/test-package.mjs
@@ -10,6 +10,7 @@ import {
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
 
 import { canonicalDigest } from "../dist/contracts/canonical.js";
 
@@ -75,6 +76,8 @@ try {
     "schemas/delivery-record.schema.json",
     "schemas/impact-manifest.schema.json",
     "schemas/mill-config.schema.json",
+    "schemas/recipe-manifest.schema.json",
+    "schemas/repository-integration-plan.schema.json",
     "schemas/review-result.schema.json",
     "schemas/source-manifest.schema.json",
     "schemas/specification-proposal.schema.json",
@@ -82,6 +85,9 @@ try {
     "schemas/validation-evidence.schema.json",
     "schemas/worker-invocation.schema.json",
     "schemas/worker-profile.schema.json",
+    "recipes/node-typescript-next-web/recipe.yaml",
+    "recipes/node-typescript-next-web/gitignore.template",
+    "recipes/node-typescript-next-web/package-lock.json",
   ]) {
     if (!files.includes(required)) {
       throw new Error(`packed artifact is missing ${required}`);
@@ -127,6 +133,49 @@ try {
   if (packageJson.scripts?.postinstall !== undefined) {
     throw new Error("packed package must not define postinstall");
   }
+  const installedPackageRoot = path.join(
+    temporary,
+    "node_modules",
+    "@davidahmann",
+    "mill",
+  );
+  const installedMill = await import(
+    pathToFileURL(path.join(installedPackageRoot, "dist", "index.js")).href
+  );
+  const renderedRecipe = await installedMill.renderNodeWebRecipe({
+    projectName: "packed-recipe",
+    productTitle: 'Packed "Recipe" # Draft & Review',
+  });
+  const renderedIgnore = renderedRecipe.find(
+    (entry) => entry.path === ".gitignore",
+  );
+  if (
+    renderedIgnore === undefined ||
+    !renderedIgnore.content.includes("node_modules")
+  ) {
+    throw new Error("packed recipe does not render its .gitignore contract");
+  }
+  const renderedLayout = renderedRecipe.find(
+    (entry) => entry.path === "app/layout.tsx",
+  );
+  if (
+    !renderedLayout?.content.includes(
+      'title: "Packed \\"Recipe\\" # Draft & Review"',
+    )
+  ) {
+    throw new Error("packed recipe does not syntax-escape its product title");
+  }
+  const renderedReadme = renderedRecipe.find(
+    (entry) => entry.path === "README.md",
+  );
+  if (
+    !renderedReadme?.content.startsWith(
+      '# Packed \\"Recipe\\" \\# Draft \\& Review\n',
+    ) ||
+    renderedReadme.content.includes("MILL_PRODUCT_TITLE")
+  ) {
+    throw new Error("packed recipe does not Markdown-escape its product title");
+  }
   const schemaImport = spawnSync(
     process.execPath,
     [
@@ -146,7 +195,11 @@ try {
     );
   }
   for (const command of [
+    "new",
+    "adopt",
     "auth",
+    "dependencies",
+    "detach",
     "plan",
     "qualify",
     "run",
@@ -154,6 +207,8 @@ try {
     "verify",
     "review",
     "pr",
+    "ship",
+    "start",
     "resume",
     "cancel",
     "state",
@@ -440,10 +495,11 @@ import path from "node:path";
 const args=process.argv.slice(2);
 if(args[0]==="image"&&args[1]==="inspect"){process.exit(0)}
 if(args[0]==="rm"){process.exit(0)}
-const mount=args[args.indexOf("--mount")+1]??"";
+const mounts=args.flatMap((value,index)=>value==="--mount"?[args[index+1]??""]:[]);
+const mount=mounts.find((value)=>value.includes("target=/workspace/src,"))??"";
 const source=/source=([^,]+)/u.exec(mount)?.[1];
 if(!source||!mount.includes("readonly"))process.exit(2);
-const value=await readFile(path.join(source,"src/value.js"),"utf8");
+const value=await readFile(path.join(source,"value.js"),"utf8");
 process.exit(/value = [1-9]/u.test(value)?0:1);
 `,
     { mode: 0o700 },
diff --git a/src/cli-program.ts b/src/cli-program.ts
index a601ab4..d9e9eea 100644
--- a/src/cli-program.ts
+++ b/src/cli-program.ts
@@ -9,6 +9,13 @@ import { doctor, doctorReady, type DoctorMode } from "./doctor.js";
 import { asMillError, ExitCode, MillError } from "./errors.js";
 import { inspectPrd } from "./intake/prd.js";
 import { scanRepository } from "./repository/scan.js";
+import {
+  applyAdoptionIntegration,
+  applyGreenfieldIntegration,
+  planAdoptionIntegration,
+  planDetach,
+  planGreenfieldIntegration,
+} from "./repository/integration.js";
 import {
   assessSpecificationProposal,
   loadPlanningSources,
@@ -44,6 +51,11 @@ import {
 import { commandResult, formatHuman, type CommandResult } from "./result.js";
 import { safeReadText } from "./security/safe-path.js";
 import { MILL_VERSION } from "./version.js";
+import {
+  prepareRepositoryDependencies,
+  startNextReadyOutcome,
+  startFounderDelivery,
+} from "./workflows/founder.js";
 
 export interface CliIo {
   stdout: { write(value: string): unknown };
@@ -70,6 +82,63 @@ function globals(program: Command): GlobalOptions {
   return program.opts<GlobalOptions>();
 }
 
+function requiredValue(value: string | undefined, option: string): string {
+  if (value === undefined || value.trim().length === 0) {
+    throw new MillError(
+      "USAGE_ERROR",
+      `${option} is required for this operation.`,
+      ExitCode.usage,
+    );
+  }
+  return value;
+}
+
+interface IntegrationCliOptions {
+  prd?: string;
+  sources?: string;
+  proposal?: string;
+  approveProduct?: string;
+  approvePlan?: string;
+  repositoryId?: string;
+  approvedBy?: string;
+  approvedAt?: string;
+  authorName?: string;
+  authorEmail?: string;
+  attended?: boolean;
+}
+
+function integrationOptions(
+  root: string,
+  options: IntegrationCliOptions,
+): {
+  sourceRoot: string;
+  prdPath: string;
+  sourceManifestPath: string;
+  proposalPath: string;
+  productApprovalDigest: string;
+  repositoryId: string;
+  approvedBy: string;
+  approvedAt: string;
+  authorName: string;
+  authorEmail: string;
+} {
+  return {
+    sourceRoot: root,
+    prdPath: requiredValue(options.prd, "--prd"),
+    sourceManifestPath: requiredValue(options.sources, "--sources"),
+    proposalPath: requiredValue(options.proposal, "--proposal"),
+    productApprovalDigest: requiredValue(
+      options.approveProduct,
+      "--approve-product",
+    ),
+    repositoryId: requiredValue(options.repositoryId, "--repository-id"),
+    approvedBy: requiredValue(options.approvedBy, "--approved-by"),
+    approvedAt: requiredValue(options.approvedAt, "--approved-at"),
+    authorName: requiredValue(options.authorName, "--author-name"),
+    authorEmail: requiredValue(options.authorEmail, "--author-email"),
+  };
+}
+
 export function createProgram(io: CliIo, jsonErrors = false): Command {
   const program = new Command();
   program
@@ -146,59 +215,276 @@ export function createProgram(io: CliIo, jsonErrors = false): Command {
       );
     });
 
+  program
+    .command("new <directory>")
+    .description("preview or transactionally create the supported web recipe")
+    .option("--dry-run", "return the exact approved file plan without writes")
+    .option("--apply", "apply the exact approved file plan")
+    .option("--prd <path>", "PRD path inside the selected root")
+    .option("--sources <path>", "source manifest path")
+    .option("--proposal <path>", "approved specification proposal path")
+    .option("--approve-product <digest>", "exact specification approval digest")
+    .option("--approve-plan <digest>", "exact integration-plan approval digest")
+    .option("--repository-id <uuid>", "new stable repository UUID")
+    .option("--approved-by <identity>", "human integration approver")
+    .option("--approved-at <time>", "exact ISO approval time")
+    .option("--author-name <name>", "initial commit author name")
+    .option("--author-email <email>", "initial commit author email")
+    .option("--attended", "approve disclosed registry and local Git effects")
+    .action(
+      async (
+        directory: string,
+        options: IntegrationCliOptions & { dryRun?: boolean; apply?: boolean },
+      ) => {
+        const global = globals(program);
+        const root = await findRepositoryRoot(global.cwd);
+        await enforceExactVersion(root);
+        if (options.dryRun === options.apply) {
+          throw new MillError(
+            "USAGE_ERROR",
+            "Choose exactly one of --dry-run or --apply.",
+            ExitCode.usage,
+          );
+        }
+        const common = {
+          ...integrationOptions(root, options),
+          targetDirectory: directory,
+        };
+        if (options.dryRun === true) {
+          const planned = await planGreenfieldIntegration(common);
+          emit(
+            io,
+            global.json === true,
+            commandResult({
+              command: "new.plan",
+              ok: true,
+              data: {
+                plan: planned.plan,
+                approvalDigest: planned.approvalDigest,
+              },
+            }),
+          );
+          return;
+        }
+        if (options.attended !== true) {
+          throw new MillError(
+            "ATTENDANCE_REQUIRED",
+            "Greenfield apply requires attended registry and local Git authority.",
+            ExitCode.configuration,
+          );
+        }
+        const result = await applyGreenfieldIntegration({
+          ...common,
+          attended: true,
+          planApprovalDigest: requiredValue(
+            options.approvePlan,
+            "--approve-plan",
+          ),
+        });
+        emit(
+          io,
+          global.json === true,
+          commandResult({ command: "new.apply", ok: true, data: result }),
+        );
+      },
+    );
+
   program
     .command("adopt")
     .description(
-      "inspect an existing repository without executing its commands",
+      "scan, plan, or transactionally integrate an existing repository",
+    )
+    .option("--scan-only", "perform only the static adoption scan")
+    .option("--plan", "return an exact adoption file plan")
+    .option("--apply", "apply an approved plan in an isolated branch")
+    .option("--prd <path>", "repo-native PRD path")
+    .option("--sources <path>", "source manifest path")
+    .option("--proposal <path>", "approved specification proposal path")
+    .option("--approve-product <digest>", "exact specification approval digest")
+    .option("--approve-plan <digest>", "exact integration-plan approval digest")
+    .option("--repository-id <uuid>", "new stable repository UUID")
+    .option("--approved-by <identity>", "human integration approver")
+    .option("--approved-at <time>", "exact ISO approval time")
+    .option("--author-name <name>", "adoption commit author name")
+    .option("--author-email <email>", "adoption commit author email")
+    .option("--attended", "approve isolated local branch creation")
+    .action(
+      async (
+        options: IntegrationCliOptions & {
+          scanOnly?: boolean;
+          plan?: boolean;
+          apply?: boolean;
+        },
+      ) => {
+        const global = globals(program);
+        const root = await findRepositoryRoot(global.cwd);
+        await enforceExactVersion(root);
+        const selected = [options.scanOnly, options.plan, options.apply].filter(
+          (value) => value === true,
+        ).length;
+        if (selected !== 1) {
+          throw new MillError(
+            "USAGE_ERROR",
+            "Choose exactly one of --scan-only, --plan, or --apply.",
+            ExitCode.usage,
+          );
+        }
+        if (options.plan === true || options.apply === true) {
+          const common = {
+            ...integrationOptions(root, options),
+            repositoryRoot: root,
+          };
+          if (options.plan === true) {
+            const planned = await planAdoptionIntegration(common);
+            emit(
+              io,
+              global.json === true,
+              commandResult({
+                command: "adopt.plan",
+                ok: true,
+                data: {
+                  plan: planned.plan,
+                  approvalDigest: planned.approvalDigest,
+                },
+              }),
+            );
+            return;
+          }
+          if (options.attended !== true) {
+            throw new MillError(
+              "ATTENDANCE_REQUIRED",
+              "Adoption apply requires attended local branch authority.",
+              ExitCode.configuration,
+            );
+          }
+          const result = await applyAdoptionIntegration({
+            ...common,
+            attended: true,
+            planApprovalDigest: requiredValue(
+              options.approvePlan,
+              "--approve-plan",
+            ),
+          });
+          emit(
+            io,
+            global.json === true,
+            commandResult({ command: "adopt.apply", ok: true, data: result }),
+          );
+          return;
+        }
+        const report = await scanRepository(root);
+        const blocked =
+          report.gitConfigHazards.length > 0 ||
+          report.truncatedDirectories.length > 0 ||
+          report.symlinksSkipped.length > 0 ||
+          report.secretReferences.length > 0;
+        const reasons = [
+          ...(report.gitConfigHazards.length > 0
+            ? [
+                {
+                  code: "UNSAFE_GIT_CONFIGURATION",
+                  message:
+                    "Repository Git configuration requires human disposition.",
+                },
+              ]
+            : []),
+          ...(report.truncatedDirectories.length > 0
+            ? [
+                {
+                  code: "SCAN_INCOMPLETE",
+                  message:
+                    "Repository scan reached its depth limit and is incomplete.",
+                },
+              ]
+            : []),
+          ...(report.symlinksSkipped.length > 0
+            ? [
+                {
+                  code: "SYMLINKS_UNSUPPORTED",
+                  message:
+                    "Repository symbolic links require human disposition before adoption.",
+                },
+              ]
+            : []),
+          ...(report.secretReferences.length > 0
+            ? [
+                {
+                  code: "SENSITIVE_PATHS_PRESENT",
+                  message:
+                    "Repository credential-like files require human disposition before adoption.",
+                },
+              ]
+            : []),
+        ];
+        emit(
+          io,
+          global.json === true,
+          commandResult({
+            command: "adopt.scan",
+            ok: !blocked,
+            status: blocked ? "blocked" : "ok",
+            data: report,
+            reasons,
+          }),
+        );
+        if (blocked) {
+          throw new MillError(
+            reasons[0]?.code ?? "SCAN_INCOMPLETE",
+            reasons[0]?.message ?? "Repository scan is incomplete.",
+            ExitCode.configuration,
+            { resultAlreadyEmitted: true },
+          );
+        }
+      },
+    );
+
+  const dependencies = program
+    .command("dependencies")
+    .description("manage exact local verifier dependency snapshots");
+  dependencies
+    .command("prepare")
+    .description("prepare one lock-bound snapshot through the exact OCI image")
+    .requiredOption(
+      "--attended",
+      "approve disclosed npm registry network access",
     )
-    .requiredOption("--scan-only", "perform only the static adoption scan")
     .action(async () => {
       const global = globals(program);
       const root = await findRepositoryRoot(global.cwd);
       await enforceExactVersion(root);
-      const report = await scanRepository(root);
-      const blocked =
-        report.gitConfigHazards.length > 0 ||
-        report.truncatedDirectories.length > 0;
-      const reasons = [
-        ...(report.gitConfigHazards.length > 0
-          ? [
-              {
-                code: "UNSAFE_GIT_CONFIGURATION",
-                message:
-                  "Repository Git configuration requires human disposition.",
-              },
-            ]
-          : []),
-        ...(report.truncatedDirectories.length > 0
-          ? [
-              {
-                code: "SCAN_INCOMPLETE",
-                message:
-                  "Repository scan reached its depth limit and is incomplete.",
-              },
-            ]
-          : []),
-      ];
+      const result = await prepareRepositoryDependencies(root, true);
       emit(
         io,
         global.json === true,
         commandResult({
-          command: "adopt.scan",
-          ok: !blocked,
-          status: blocked ? "blocked" : "ok",
-          data: report,
-          reasons,
+          command: "dependencies.prepare",
+          ok: true,
+          data: result ?? { configured: false },
+        }),
+      );
+    });
+
+  const detach = program
+    .command("detach")
+    .description("inspect manual Mill detachment");
+  detach
+    .command("plan")
+    .description(
+      "report Mill-only removals and downstream-owned retained files",
+    )
+    .action(async () => {
+      const global = globals(program);
+      const root = await findRepositoryRoot(global.cwd);
+      await enforceExactVersion(root);
+      emit(
+        io,
+        global.json === true,
+        commandResult({
+          command: "detach.plan",
+          ok: true,
+          data: await planDetach(root),
         }),
       );
-      if (blocked) {
-        throw new MillError(
-          reasons[0]?.code ?? "SCAN_INCOMPLETE",
-          reasons[0]?.message ?? "Repository scan is incomplete.",
-          ExitCode.configuration,
-          { resultAlreadyEmitted: true },
-        );
-      }
     });
 
   program
@@ -502,36 +788,113 @@ export function createProgram(io: CliIo, jsonErrors = false): Command {
       }
     });
 
-  program
+  const run = program
     .command("run")
     .description(
       "build one explicitly approved task in an isolated local worktree",
     )
-    .requiredOption("--task <path>", "approved task packet path")
-    .requiredOption(
+    .option("--task <path>", "approved task packet path")
+    .option(
       "--approve <digest>",
       "approval digest from successful matching baseline qualification",
     )
+    .option("--attended", "acknowledge attended trusted-host Codex execution")
+    .action(
+      async (options: {
+        task?: string;
+        approve?: string;
+        attended?: boolean;
+      }) => {
+        const global = globals(program);
+        const root = await findRepositoryRoot(global.cwd);
+        await enforceExactVersion(root);
+        if (options.attended !== true) {
+          throw new MillError(
+            "ATTENDANCE_REQUIRED",
+            "Run requires attended trusted-host Codex authority.",
+            ExitCode.configuration,
+          );
+        }
+        const result = await startLocalRun({
+          root,
+          taskPath: requiredValue(options.task, "--task"),
+          approvalDigest: requiredValue(options.approve, "--approve"),
+        });
+        emit(
+          io,
+          global.json === true,
+          commandResult({ command: "run", ok: true, data: result }),
+        );
+      },
+    );
+  run
+    .command("next")
+    .description(
+      "run the one ready approved outcome through the existing lifecycle",
+    )
     .requiredOption(
-      "--attended",
-      "acknowledge attended trusted-host Codex execution",
+      "--approve <digest>",
+      "approval digest from successful matching baseline qualification",
     )
-    .action(async (options: { task: string; approve: string }) => {
+    .requiredOption("--attended", "acknowledge attended trusted-host execution")
+    .action(async (options: { approve: string }) => {
       const global = globals(program);
       const root = await findRepositoryRoot(global.cwd);
       await enforceExactVersion(root);
-      const result = await startLocalRun({
+      const started = await startNextReadyOutcome({
         root,
-        taskPath: options.task,
         approvalDigest: options.approve,
       });
       emit(
         io,
         global.json === true,
-        commandResult({ command: "run", ok: true, data: result }),
+        commandResult({
+          command: "run.next",
+          ok: true,
+          data: { outcome: started.outcome, ...started.result },
+        }),
       );
     });
 
+  program
+    .command("start")
+    .description(
+      "advance the one ready outcome through the resumable founder path",
+    )
+    .requiredOption("--prd <path>", "approved repo-native PRD path")
+    .option("--repo <path>", "managed repository path")
+    .option(
+      "--draft-pr",
+      "prepare the later exact reviewed candidate's draft-PR plan",
+    )
+    .requiredOption(
+      "--attended",
+      "approve attended dependency, model, and scoped forge use",
+    )
+    .action(
+      async (options: { prd: string; repo?: string; draftPr?: boolean }) => {
+        const global = globals(program);
+        const root = await findRepositoryRoot(options.repo ?? global.cwd);
+        await enforceExactVersion(root);
+        const inspectedPrd = path
+          .normalize(options.prd)
+          .split(path.sep)
+          .join("/");
+        await safeReadText(root, inspectedPrd, 2 * 1024 * 1024);
+        const result = await startFounderDelivery({
+          root,
+          prdPath: inspectedPrd,
+          attended: true,
+          draftPr: options.draftPr === true,
+        });
+        emit(
+          io,
+          global.json === true,
+          commandResult({ command: "start", ok: true, data: result }),
+        );
+      },
+    );
+
   program
     .command("status")
     .description("report durable local run state")
@@ -830,6 +1193,68 @@ export function createProgram(io: CliIo, jsonErrors = false): Command {
       }
     });
 
+  program
+    .command("ship")
+    .description(
+      "plan or open one draft PR through the existing delivery state machine",
+    )
+    .requiredOption("--draft", "limit shipping to one draft pull request")
+    .requiredOption("--task <path>", "approved task packet path")
+    .requiredOption("--run <id>", "reviewed run identifier")
+    .option(
+      "--approve <digest>",
+      "exact unexpired digest returned by this wrapper",
+    )
+    .option("--attended", "acknowledge attended GitHub authority")
+    .action(
+      async (options: {
+        task: string;
+        run: string;
+        approve?: string;
+        attended?: boolean;
+      }) => {
+        const global = globals(program);
+        const root = await findRepositoryRoot(global.cwd);
+        await enforceExactVersion(root);
+        if (options.approve === undefined) {
+          const result = await planDraftPr({
+            root,
+            taskPath: options.task,
+            runId: options.run,
+          });
+          emit(
+            io,
+            global.json === true,
+            commandResult({
+              command: "ship.draft.plan",
+              ok: true,
+              data: result,
+            }),
+          );
+          return;
+        }
+        if (options.attended !== true) {
+          throw new MillError(
+            "ATTENDANCE_REQUIRED",
+            "Draft shipping requires attended use of the operator-owned GitHub session.",
+            ExitCode.configuration,
+          );
+        }
+        const result = await openDraftPr({
+          root,
+          taskPath: options.task,
+          runId: options.run,
+          approvalDigest: options.approve,
+          attended: true,
+        });
+        emit(
+          io,
+          global.json === true,
+          commandResult({ command: "ship.draft.open", ok: true, data: result }),
+        );
+      },
+    );
+
   program
     .command("cancel")
     .description("persist cancellation for the exact foreground controller")
diff --git a/src/contracts/schemas.ts b/src/contracts/schemas.ts
index 691dd2f..51943a6 100644
--- a/src/contracts/schemas.ts
+++ b/src/contracts/schemas.ts
@@ -13,6 +13,13 @@ const stableInvariantIdSchema = z.string().regex(/^INV-[A-Z0-9][A-Z0-9-]*$/u);
 const stableSourceIdSchema = z.string().regex(/^SRC-[A-Z0-9][A-Z0-9-]*$/u);
 const stableDecisionIdSchema = z.string().regex(/^DEC-[A-Z0-9][A-Z0-9-]*$/u);
 const stableOutcomeIdSchema = z.string().regex(/^OUT-[A-Z0-9][A-Z0-9-]*$/u);
+const uniqueNonemptyStringArraySchema = z
+  .array(z.string().min(1))
+  .min(1)
+  .refine((values) => new Set(values).size === values.length, {
+    message: "expected unique values",
+  })
+  .meta({ uniqueItems: true });
 
 export const sourceManifestSchema = z.strictObject({
   schemaVersion: z.literal("1"),
@@ -116,6 +123,7 @@ export const productContractSchema = z.strictObject({
       z.strictObject({
         id: stableOutcomeIdSchema,
         statement: z.string().min(1),
+        acceptanceIds: uniqueNonemptyStringArraySchema.optional(),
       }),
     )
     .min(1),
@@ -169,6 +177,7 @@ export const scenarioSchema = z.strictObject({
     .enum(["builder_visible", "reviewer_owned", "human_acceptance"])
     .default("builder_visible"),
   executionRef: z.string().min(1).optional(),
+  recipeOracle: z.string().min(1).optional(),
   forbidden: z.array(z.string().min(1)).default([]),
 });
 
@@ -182,8 +191,13 @@ export const outcomeSchema = z.strictObject({
   id: z.string().min(1),
   title: z.string().min(1),
   acceptance: z.array(z.string().min(1)).min(1),
+  acceptanceIds: uniqueNonemptyStringArraySchema.optional(),
   dependsOn: z.array(z.string().min(1)),
   status: z.enum(["proposed", "approved", "ready", "blocked", "closed"]),
+  taskRef: z
+    .string()
+    .regex(/^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[^*?[\]\\]+(?:\/\*\*)?$/u)
+    .optional(),
 });
 
 export const outcomePlanSchema = z.strictObject({
@@ -283,6 +297,13 @@ const repositoryPathPatternSchema = z
   .string()
   .regex(/^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[^*?[\]\\]+(?:\/\*\*)?$/u);
 
+const repositoryMountDirectorySchema = z
+  .string()
+  .regex(
+    /^(?!\.\.?$)(?!.*[,/])[^*?[\]\\]+$/u,
+    "expected a comma-free top-level repository directory",
+  );
+
 const githubReviewPolicySchema = z
   .strictObject({
     mode: z.enum(["local_only", "github_required"]),
@@ -327,6 +348,14 @@ export const millConfigSchema = z
       .strictObject({
         image: z.string().regex(/^[^@\s]+@sha256:[a-f0-9]{64}$/u),
         network: z.literal("none"),
+        dependencies: z
+          .strictObject({
+            manager: z.literal("npm"),
+            registry: z.literal("https://registry.npmjs.org"),
+            targetPath: z.literal("node_modules"),
+            lockPaths: z.array(repositoryPathPatternSchema).min(1),
+          })
+          .optional(),
       })
       .optional(),
     propose: z
@@ -360,6 +389,7 @@ export const millConfigSchema = z
         required: z.boolean().default(true),
         timeoutSeconds: z.number().int().min(1).max(3600).default(600),
         execution: z.enum(["oci", "host"]).default("oci"),
+        writablePaths: z.array(repositoryMountDirectorySchema).optional(),
       }),
     ),
   })
@@ -731,6 +761,115 @@ export const millLockSchema = z.strictObject({
       digest: digestSchema,
     })
     .optional(),
+  integration: z
+    .strictObject({
+      mode: z.enum(["greenfield", "adoption"]),
+      planDigest: digestSchema,
+      baseCommit: z
+        .string()
+        .regex(/^[a-f0-9]{40}$/u)
+        .nullable(),
+      files: z.array(
+        z.strictObject({
+          path: repositoryPathPatternSchema,
+          ownership: z.enum(["mill_only", "generated_once", "managed"]),
+          templateDigest: digestSchema,
+          installedDigest: digestSchema,
+          preexistingDigest: digestSchema.nullable(),
+        }),
+      ),
+    })
+    .optional(),
+});
+
+export const recipeManifestSchema = z.strictObject({
+  schemaVersion: z.literal("1"),
+  id: z.literal("node-typescript-next-web"),
+  version: exactSemverSchema,
+  status: z.enum(["supported", "experimental", "unsupported"]),
+  observedAt: z.iso.datetime(),
+  runtime: z.strictObject({
+    node: exactSemverSchema,
+    npm: exactSemverSchema,
+  }),
+  stack: z.strictObject({
+    next: exactSemverSchema,
+    react: exactSemverSchema,
+    reactDom: exactSemverSchema,
+    typescript: exactSemverSchema,
+    eslint: exactSemverSchema,
+    prettier: exactSemverSchema,
+    vitest: exactSemverSchema,
+    playwright: exactSemverSchema,
+  }),
+  verifierImage: z.string().regex(/^[^@\s]+@sha256:[a-f0-9]{64}$/u),
+  registry: z.url(),
+  licensePolicy: z.strictObject({
+    allowed: z.array(z.string().min(1)).min(1),
+    reviewedPackages: z.array(
+      z.strictObject({ name: z.string().min(1), license: z.string().min(1) }),
+    ),
+  }),
+  commands: z.strictObject({
+    required: z.array(z.string().min(1)).min(1),
+    native: z.array(z.string().min(1)).min(1),
+  }),
+  oracles: z
+    .array(
+      z.strictObject({
+        id: z.string().min(1),
+        commandId: z.string().min(1),
+        evidencePaths: z.array(repositoryPathPatternSchema).min(1),
+        proves: z.array(z.string().min(1)).min(1),
+      }),
+    )
+    .min(1),
+  writablePaths: z.array(repositoryMountDirectorySchema),
+  sources: z.array(z.url()).min(1),
+});
+
+const integrationFileSchema = z.strictObject({
+  path: repositoryPathPatternSchema,
+  ownership: z.enum(["mill_only", "generated_once", "managed"]),
+  action: z.enum(["create", "retain_identical"]),
+  contentDigest: digestSchema,
+  preexistingDigest: digestSchema.nullable(),
+});
+
+export const repositoryIntegrationPlanSchema = z.strictObject({
+  schemaVersion: z.literal("1"),
+  planDigest: digestSchema,
+  generator: z.strictObject({
+    package: z.literal("@davidahmann/mill"),
+    version: exactSemverSchema,
+  }),
+  mode: z.enum(["greenfield", "adoption"]),
+  target: z.strictObject({
+    directoryName: z.string().min(1),
+    canonicalPathDigest: digestSchema,
+    baseCommit: z
+      .string()
+      .regex(/^[a-f0-9]{40}$/u)
+      .nullable(),
+    scanDigest: digestSchema.nullable(),
+  }),
+  productProposalDigest: digestSchema,
+  productContractDigest: digestSchema,
+  recipe: z.strictObject({
+    id: z.literal("node-typescript-next-web"),
+    version: exactSemverSchema,
+    digest: digestSchema,
+    status: z.literal("supported"),
+    verifierImage: z.string().regex(/^[^@\s]+@sha256:[a-f0-9]{64}$/u),
+  }),
+  approval: z.strictObject({
+    approvedBy: z.string().min(1),
+    approvedAt: z.iso.datetime(),
+  }),
+  files: z.array(integrationFileSchema).min(1),
+  commandIds: z.array(z.string().min(1)).min(1),
+  networkDisclosure: z.array(z.string().min(1)),
+  baseline: z.literal("unverified"),
 });
 
 export const contractSchemas = {
@@ -742,6 +881,8 @@ export const contractSchemas = {
   millLock: millLockSchema,
   outcomePlan: outcomePlanSchema,
   productContract: productContractSchema,
+  recipeManifest: recipeManifestSchema,
+  repositoryIntegrationPlan: repositoryIntegrationPlanSchema,
   reviewResult: reviewResultSchema,
   scenarioSet: scenarioSetSchema,
   sourceManifest: sourceManifestSchema,
diff --git a/src/doctor.ts b/src/doctor.ts
index 75521a1..b0ff5eb 100644
--- a/src/doctor.ts
+++ b/src/doctor.ts
@@ -175,7 +175,7 @@ export async function doctor(
   };
   const tools = await Promise.all([
     tool("git", root, true),
-    tool("codex", root, mode !== "inspect"),
+    tool("codex", root, mode === "build"),
     tool("gh", root, mode === "propose"),
   ]);
   return { mode, root, runtime, tools, lock: await readLockStatus(root) };
diff --git a/src/index.ts b/src/index.ts
index b170742..154c092 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -31,7 +31,27 @@ export {
   type ImpactManifest,
   type SemanticEvidence,
 } from "./planning/impact.js";
+export {
+  loadNodeWebRecipe,
+  renderNodeWebRecipe,
+  type FileOwnership,
+  type RecipeFile,
+  type RecipeManifest,
+} from "./recipes/node-typescript-next-web.js";
+export {
+  applyAdoptionIntegration,
+  applyGreenfieldIntegration,
+  planAdoptionIntegration,
+  planDetach,
+  planGreenfieldIntegration,
+  type RepositoryIntegrationPlan,
+} from "./repository/integration.js";
 export { scanRepository, type RepositoryScan } from "./repository/scan.js";
+export {
+  dependencySnapshotDirectory,
+  prepareDependencySnapshot,
+  type DependencyPreparationResult,
+} from "./runtime/dependencies.js";
 export {
   finalizeDraftPr,
   observeDraftPr,
@@ -46,6 +66,7 @@ export {
   qualifyBaseline,
   resumeRun,
   reviewRun,
+  runInventory,
   runStatus,
   startLocalRun,
   stateBackup,
@@ -60,4 +81,11 @@ export {
   type WorkerInvocation,
   type WorkerProfile,
 } from "./runtime/worker.js";
+export {
+  nextReadyOutcome,
+  prepareRepositoryDependencies,
+  startNextReadyOutcome,
+  startFounderDelivery,
+  type NextOutcome,
+} from "./workflows/founder.js";
 export { MILL_PACKAGE, MILL_VERSION } from "./version.js";
diff --git a/src/intake/prd.ts b/src/intake/prd.ts
index f2d7d87..d93163e 100644
--- a/src/intake/prd.ts
+++ b/src/intake/prd.ts
@@ -54,7 +54,7 @@ export async function inspectPrd(
     .slice(0, 50);
 
   return {
-    path: path.relative(root, path.resolve(root, requestedPath)) || ".",
+    path: path.relative(root, path.resolve(root, requestedPath)),
     digest: canonicalDigest(source),
     bytes: Buffer.byteLength(source),
     headings,
diff --git a/src/planning/impact.ts b/src/planning/impact.ts
index 809fc96..2f5a18d 100644
--- a/src/planning/impact.ts
+++ b/src/planning/impact.ts
@@ -120,7 +120,7 @@ export function assessImpactManifest(input: {
   authorityMode?: "authorize" | "readback";
 }): ImpactAssessment {
   const blockers: string[] = [];
-  const productDigest = canonicalDigest(input.product);
+  const productDigest = canonicalDigest(input.product as unknown as JsonValue);
   const acceptanceIds = new Set(
     input.product.acceptance.map((item) => item.id),
   );
diff --git a/src/planning/specification.ts b/src/planning/specification.ts
index 8c58a45..075d668 100644
--- a/src/planning/specification.ts
+++ b/src/planning/specification.ts
@@ -144,6 +144,33 @@ export function assessSpecificationProposal(input: {
   if (proposal.sourceManifestDigest !== input.sourceManifestDigest) {
     blockers.push("proposal source-manifest identity is stale");
   }
+  const normalizedPrdPath = path
+    .normalize(input.prdPath)
+    .split(path.sep)
+    .join("/");
+  const prdSources = sourceManifest.sources.filter((source) => {
+    const normalizedSourcePath = path
+      .normalize(source.uri)
+      .split(path.sep)
+      .join("/");
+    return (
+      normalizedSourcePath === normalizedPrdPath &&
+      (source.revision === input.prdDigest || source.digest === input.prdDigest)
+    );
+  });
+  if (prdSources.length !== 1) {
+    blockers.push("exactly one source must bind the inspected PRD identity");
+  }
+  const prdSource = prdSources[0];
+  if (
+    prdSources.length === 1 &&
+    prdSource !== undefined &&
+    !proposal.productContract.sourceRefs.includes(prdSource.id)
+  ) {
+    blockers.push(
+      `product contract does not bind the inspected PRD source: ${prdSource.id}`,
+    );
+  }
   for (const duplicate of duplicates(
     sourceManifest.sources.map((source) => source.id),
   )) {
@@ -155,6 +182,15 @@ export function assessSpecificationProposal(input: {
   if (proposal.productContract.invariants.length === 0) {
     blockers.push("product contract has no stable behavioral invariants");
   }
+  for (const outcome of proposal.productContract.outcomes) {
+    for (const acceptanceRef of outcome.acceptanceIds ?? []) {
+      if (!acceptanceIds.has(acceptanceRef)) {
+        blockers.push(
+          `outcome acceptance reference is unresolved: ${outcome.id}/${acceptanceRef}`,
+        );
+      }
+    }
+  }
   for (const duplicate of duplicates([
     ...proposal.productContract.outcomes.map((item) => item.id),
     ...proposal.productContract.acceptance.map((item) => item.id),
@@ -198,7 +234,9 @@ export function assessSpecificationProposal(input: {
     if (question.blocking)
       blockers.push(`blocking question remains: ${question.id}`);
   }
-  const productDigest = canonicalDigest(proposal.productContract);
+  const productDigest = canonicalDigest(
+    proposal.productContract as unknown as JsonValue,
+  );
   for (const blueprint of proposal.blueprints) {
     if (blueprint.productContractDigest !== productDigest) {
       blockers.push(
diff --git a/src/recipes/node-typescript-next-web.ts b/src/recipes/node-typescript-next-web.ts
new file mode 100644
index 0000000..98261f4
--- /dev/null
+++ b/src/recipes/node-typescript-next-web.ts
@@ -0,0 +1,202 @@
+import type { Dirent } from "node:fs";
+import { createHash } from "node:crypto";
+import { lstat, opendir, readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+import { parse as parseYaml } from "yaml";
+import type { z } from "zod";
+
+import { canonicalDigest } from "../contracts/canonical.js";
+import { recipeManifestSchema } from "../contracts/schemas.js";
+import { ExitCode, MillError } from "../errors.js";
+
+export type RecipeManifest = z.infer<typeof recipeManifestSchema>;
+export type FileOwnership = "mill_only" | "generated_once" | "managed";
+
+export interface RecipeFile {
+  path: string;
+  content: string;
+  contentDigest: string;
+  ownership: FileOwnership;
+}
+
+const recipeRoot = fileURLToPath(
+  new URL("../../recipes/node-typescript-next-web/", import.meta.url),
+);
+const ignoredDirectories = new Set([
+  ".next",
+  "coverage",
+  "node_modules",
+  "playwright-report",
+  "test-results",
+]);
+const ignoredFiles = new Set([".DS_Store"]);
+
+function digest(content: string): string {
+  return `sha256:${createHash("sha256").update(content, "utf8").digest("hex")}`;
+}
+
+function ownership(relativePath: string): FileOwnership {
+  if (["mill.yaml", "mill.lock"].includes(relativePath)) return "mill_only";
+  if (relativePath === ".github/workflows/ci.yml") return "managed";
+  return "generated_once";
+}
+
+function packageName(value: string): string {
+  const normalized = value
+    .toLowerCase()
+    .normalize("NFKD")
+    .replaceAll(/[^a-z0-9._-]+/gu, "-")
+    .replaceAll(/^-+|-+$/gu, "")
+    .slice(0, 214);
+  return normalized.length === 0 ? "mill-web-product" : normalized;
+}
+
+function markdownTitle(value: string): string {
+  return value
+    .replaceAll(/[\r\n\t]+/gu, " ")
+    .replaceAll(/\s+/gu, " ")
+    .trim()
+    .replaceAll(
+      /[\u0021-\u002F\u003A-\u0040\u005B-\u0060\u007B-\u007E]/gu,
+      "\\$&",
+    );
+}
+
+async function walk(directory: string, relative = "."): Promise<string[]> {
+  const handle = await opendir(path.join(directory, relative));
+  const entries: Dirent[] = [];
+  for await (const entry of handle) entries.push(entry);
+  const files: string[] = [];
+  for (const entry of entries.sort((left, right) =>
+    left.name.localeCompare(right.name),
+  )) {
+    if (
+      ignoredFiles.has(entry.name) ||
+      (entry.isDirectory() && ignoredDirectories.has(entry.name))
+    ) {
+      continue;
+    }
+    const child = path.join(relative, entry.name);
+    const information = await lstat(path.join(directory, child));
+    if (information.isSymbolicLink()) {
+      throw new MillError(
+        "RECIPE_SYMLINK_FORBIDDEN",
+        "Recipe assets cannot contain symbolic links.",
+        ExitCode.data,
+        { path: child },
+      );
+    }
+    if (information.isDirectory())
+      files.push(...(await walk(directory, child)));
+    else if (information.isFile()) {
+      if (information.size > 8 * 1024 * 1024) {
+        throw new MillError(
+          "RECIPE_ASSET_TOO_LARGE",
+          "A bundled recipe asset exceeds the per-file size limit.",
+          ExitCode.data,
+          { path: child },
+        );
+      }
+      files.push(child);
+    } else {
+      throw new MillError(
+        "RECIPE_ASSET_UNSUPPORTED",
+        "A bundled recipe asset has an unsupported filesystem type.",
+        ExitCode.data,
+        { path: child },
+      );
+    }
+  }
+  if (files.length > 128) {
+    throw new MillError(
+      "RECIPE_ASSET_LIMIT_EXCEEDED",
+      "The bundled recipe exceeds its file-count limit.",
+      ExitCode.data,
+    );
+  }
+  return files;
+}
+
+export async function loadNodeWebRecipe(): Promise<{
+  manifest: RecipeManifest;
+  digest: string;
+}> {
+  const source = await readFile(path.join(recipeRoot, "recipe.yaml"), "utf8");
+  let raw: unknown;
+  try {
+    raw = parseYaml(source);
+  } catch (error) {
+    throw new MillError(
+      "RECIPE_MANIFEST_INVALID",
+      "The bundled recipe manifest is invalid YAML.",
+      ExitCode.data,
+      { cause: String(error) },
+    );
+  }
+  const manifest = recipeManifestSchema.parse(raw);
+  if (manifest.status !== "supported") {
+    throw new MillError(
+      "RECIPE_NOT_SUPPORTED",
+      "The selected recipe is not qualified for apply.",
+      ExitCode.configuration,
+      { status: manifest.status },
+    );
+  }
+  const assets = await walk(recipeRoot);
+  const assetDigests = await Promise.all(
+    assets
+      .filter((asset) => asset.split(path.sep).join("/") !== "recipe.yaml")
+      .map(async (asset) => ({
+        path: asset.split(path.sep).join("/").replace(/^\.\//u, ""),
+        digest: digest(await readFile(path.join(recipeRoot, asset), "utf8")),
+      })),
+  );
+  return {
+    manifest,
+    digest: canonicalDigest({ manifest, assets: assetDigests }),
+  };
+}
+
+export async function renderNodeWebRecipe(input: {
+  projectName: string;
+  productTitle: string;
+}): Promise<RecipeFile[]> {
+  const files = await walk(recipeRoot);
+  const rendered: RecipeFile[] = [];
+  for (const file of files) {
+    const assetPath = file.split(path.sep).join("/").replace(/^\.\//u, "");
+    if (assetPath === "recipe.yaml") continue;
+    const normalized =
+      assetPath === "gitignore.template" ? ".gitignore" : assetPath;
+    let content = await readFile(path.join(recipeRoot, file), "utf8");
+    if (normalized === "package.json" || normalized === "package-lock.json") {
+      const parsed = JSON.parse(content) as Record<string, unknown>;
+      parsed.name = packageName(input.projectName);
+      if (normalized === "package-lock.json") {
+        const packages = parsed.packages as
+          Record<string, Record<string, unknown>> | undefined;
+        if (packages?.[""] !== undefined) {
+          packages[""].name = packageName(input.projectName);
+        }
+      }
+      content = `${JSON.stringify(parsed, undefined, 2)}\n`;
+    } else {
+      content = content.replace(
+        /__MILL_PRODUCT_TITLE_LITERAL__|MILL_PRODUCT_TITLE_MARKDOWN_TOKEN/gu,
+        (token) =>
+          token === "__MILL_PRODUCT_TITLE_LITERAL__"
+            ? JSON.stringify(input.productTitle)
+            : markdownTitle(input.productTitle),
+      );
+    }
+    rendered.push({
+      path: normalized,
+      content,
+      contentDigest: digest(content),
+      ownership: ownership(normalized),
+    });
+  }
+  return rendered.sort((left, right) => left.path.localeCompare(right.path));
+}
diff --git a/src/repository/integration.ts b/src/repository/integration.ts
new file mode 100644
index 0000000..b49d6bc
--- /dev/null
+++ b/src/repository/integration.ts
@@ -0,0 +1,2108 @@
+import { createHash } from "node:crypto";
+import {
+  chmod,
+  cp,
+  lstat,
+  mkdir,
+  mkdtemp,
+  readFile,
+  readdir,
+  realpath,
+  rename,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import path from "node:path";
+
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { z } from "zod";
+
+import { canonicalDigest, type JsonValue } from "../contracts/canonical.js";
+import {
+  millConfigSchema,
+  millLockSchema,
+  repositoryIntegrationPlanSchema,
+  taskPacketV1Schema,
+  taskPacketV2Schema,
+} from "../contracts/schemas.js";
+import { findTrustedExecutable } from "../doctor.js";
+import { ExitCode, MillError } from "../errors.js";
+import {
+  assessSpecificationProposal,
+  loadPlanningSources,
+  loadSpecificationProposal,
+  promoteSpecificationProposal,
+  type SpecificationProposal,
+} from "../planning/specification.js";
+import {
+  loadNodeWebRecipe,
+  renderNodeWebRecipe,
+  type FileOwnership,
+  type RecipeFile,
+} from "../recipes/node-typescript-next-web.js";
+import { isWithin, safeReadText } from "../security/safe-path.js";
+import { MILL_PACKAGE, MILL_VERSION } from "../version.js";
+import { processCancellationScope, runProcess } from "../runtime/process.js";
+import {
+  assertVisibleIndexState,
+  resolveCommit,
+} from "../runtime/repository.js";
+import { textDigest } from "../runtime/inputs.js";
+import { prepareDependencySnapshot } from "../runtime/dependencies.js";
+import { repositoryStateDirectory } from "../runtime/state.js";
+import { verifyDeclaredCommands } from "../runtime/verifier.js";
+import { scanRepository, type RepositoryScan } from "./scan.js";
+
+export type RepositoryIntegrationPlan = z.infer<
+  typeof repositoryIntegrationPlanSchema
+>;
+
+interface IntegrationOptions {
+  sourceRoot: string;
+  prdPath: string;
+  sourceManifestPath: string;
+  proposalPath: string;
+  productApprovalDigest: string;
+  repositoryId: string;
+  approvedBy: string;
+  approvedAt: string;
+  authorName: string;
+  authorEmail: string;
+}
+
+interface PlannedIntegration {
+  plan: RepositoryIntegrationPlan;
+  approvalDigest: string;
+  files: RecipeFile[];
+}
+
+interface ExistingFile {
+  content: string;
+  digest: string;
+}
+
+const gitEnvironment: NodeJS.ProcessEnv = {
+  HOME: "/var/empty",
+  LANG: "C",
+  LC_ALL: "C",
+  PATH: "/usr/bin:/bin:/usr/sbin:/sbin",
+  GIT_CONFIG_GLOBAL: "/dev/null",
+  GIT_CONFIG_NOSYSTEM: "1",
+  GIT_NO_REPLACE_OBJECTS: "1",
+  GIT_OPTIONAL_LOCKS: "0",
+  GIT_PAGER: "cat",
+  PAGER: "cat",
+};
+
+function digest(content: string): string {
+  return `sha256:${createHash("sha256").update(content, "utf8").digest("hex")}`;
+}
+
+function slug(value: string): string {
+  const normalized = value
+    .toLowerCase()
+    .normalize("NFKD")
+    .replaceAll(/[^a-z0-9._-]+/gu, "-")
+    .replaceAll(/^-+|-+$/gu, "")
+    .slice(0, 48);
+  return normalized.length === 0 ? "first-outcome" : normalized;
+}
+
+function hasControlCharacter(value: string): boolean {
+  for (const character of value) {
+    const code = character.codePointAt(0) ?? 0;
+    if (code <= 31 || code === 127) return true;
+  }
+  return false;
+}
+
+function assertRelativePath(value: string, label: string): void {
+  if (
+    value.length === 0 ||
+    path.isAbsolute(value) ||
+    value.split(/[\\/]/u).includes("..") ||
+    hasControlCharacter(value)
+  ) {
+    throw new MillError(
+      "INVALID_INTEGRATION_PATH",
+      `${label} must be a safe relative path.`,
+      ExitCode.configuration,
+      { value },
+    );
+  }
+}
+
+async function greenfieldTarget(
+  sourceRoot: string,
+  targetDirectory: string,
+): Promise<{ target: string; parent: string }> {
+  assertRelativePath(targetDirectory, "Target directory");
+  const canonicalRoot = await realpath(sourceRoot);
+  const segments = targetDirectory.split(/[\\/]/u).filter(Boolean);
+  let current = canonicalRoot;
+  for (const [index, segment] of segments.slice(0, -1).entries()) {
+    current = path.join(current, segment);
+    try {
+      const information = await lstat(current);
+      if (information.isSymbolicLink() || !information.isDirectory()) {
+        throw new MillError(
+          "GREENFIELD_TARGET_ANCESTOR_UNSAFE",
+          "Greenfield target ancestors must be real directories inside the approved source root.",
+          ExitCode.configuration,
+          { path: segments.slice(0, index + 1).join("/") },
+        );
+      }
+    } catch (error) {
+      if (
+        error instanceof Error &&
+        "code" in error &&
+        error.code === "ENOENT"
+      ) {
+        throw new MillError(
+          "GREENFIELD_TARGET_ANCESTOR_UNSAFE",
+          "Greenfield target parents must already exist as real directories inside the approved source root.",
+          ExitCode.configuration,
+          { path: segments.slice(0, index + 1).join("/") },
+        );
+      }
+      throw error;
+    }
+  }
+  const requestedTarget = path.resolve(canonicalRoot, targetDirectory);
+  if (!isWithin(canonicalRoot, requestedTarget)) {
+    throw new MillError(
+      "GREENFIELD_TARGET_OUTSIDE_ROOT",
+      "The greenfield target must remain inside the approved source root.",
+      ExitCode.configuration,
+    );
+  }
+  const canonicalParent = await realpath(path.dirname(requestedTarget));
+  if (!isWithin(canonicalRoot, canonicalParent)) {
+    throw new MillError(
+      "GREENFIELD_TARGET_ANCESTOR_UNSAFE",
+      "The greenfield target parent resolved outside the approved source root.",
+      ExitCode.configuration,
+    );
+  }
+  return {
+    target: path.join(canonicalParent, path.basename(requestedTarget)),
+    parent: canonicalParent,
+  };
+}
+
+function assertIdentity(input: IntegrationOptions): void {
+  if (
+    !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+      input.repositoryId,
+    )
+  ) {
+    throw new MillError(
+      "INVALID_REPOSITORY_ID",
+      "Repository integration requires one explicit UUIDv4 identity.",
+      ExitCode.configuration,
+    );
+  }
+  if (!validAuthorEmail(input.authorEmail)) {
+    throw new MillError(
+      "INVALID_AUTHOR_IDENTITY",
+      "Repository integration requires an explicit valid author email.",
+      ExitCode.configuration,
+    );
+  }
+  if (
+    input.authorName.trim().length === 0 ||
+    input.approvedBy.trim().length === 0
+  ) {
+    throw new MillError(
+      "INVALID_AUTHOR_IDENTITY",
+      "Repository integration requires explicit author and approval identities.",
+      ExitCode.configuration,
+    );
+  }
+  const approval = z.iso.datetime().safeParse(input.approvedAt);
+  if (!approval.success || Date.parse(input.approvedAt) > Date.now()) {
+    throw new MillError(
+      "INVALID_APPROVAL_TIME",
+      "Repository integration requires an exact active ISO approval time.",
+      ExitCode.configuration,
+    );
+  }
+}
+
+function validAuthorEmail(value: string): boolean {
+  if (value.length > 254) return false;
+  const separator = value.indexOf("@");
+  if (
+    separator <= 0 ||
+    separator !== value.lastIndexOf("@") ||
+    separator > 64
+  ) {
+    return false;
+  }
+  const local = value.slice(0, separator);
+  const domain = value.slice(separator + 1);
+  if (
+    local.startsWith(".") ||
+    local.endsWith(".") ||
+    local.includes("..") ||
+    domain.length === 0 ||
+    domain.length > 253
+  ) {
+    return false;
+  }
+  const localPunctuation = "!#$%&'*+-/=?^_`{|}~.";
+  for (const character of local) {
+    const code = character.codePointAt(0) ?? 0;
+    const alphanumeric =
+      (code >= 48 && code <= 57) ||
+      (code >= 65 && code <= 90) ||
+      (code >= 97 && code <= 122);
+    if (!alphanumeric && !localPunctuation.includes(character)) return false;
+  }
+  const labels = domain.split(".");
+  if (labels.length < 2) return false;
+  for (const label of labels) {
+    if (label.length === 0 || label.length > 63) return false;
+    for (let index = 0; index < label.length; index += 1) {
+      const code = label.codePointAt(index) ?? 0;
+      const alphanumeric =
+        (code >= 48 && code <= 57) ||
+        (code >= 65 && code <= 90) ||
+        (code >= 97 && code <= 122);
+      if (
+        !alphanumeric &&
+        (label[index] !== "-" || index === 0 || index === label.length - 1)
+      ) {
+        return false;
+      }
+    }
+  }
+  return true;
+}
+
+async function authority(input: IntegrationOptions): Promise<{
+  prd: string;
+  sourceManifest: Awaited<
+    ReturnType<typeof loadPlanningSources>
+  >["sourceManifest"];
+  proposal: SpecificationProposal;
+  proposalDigest: string;
+}> {
+  assertIdentity(input);
+  const [planning, proposal] = await Promise.all([
+    loadPlanningSources({
+      root: input.sourceRoot,
+      prdPath: input.prdPath,
+      sourceManifestPath: input.sourceManifestPath,
+    }),
+    loadSpecificationProposal(input.sourceRoot, input.proposalPath),
+  ]);
+  const assessment = assessSpecificationProposal({
+    proposal,
+    prdPath: planning.prdPath,
+    prdDigest: planning.prdDigest,
+    sourceManifest: planning.sourceManifest,
+    sourceManifestDigest: planning.sourceManifestDigest,
+  });
+  const promoted = promoteSpecificationProposal({
+    proposal,
+    approvalDigest: input.productApprovalDigest,
+    assessment,
+  });
+  return {
+    prd: planning.prd,
+    sourceManifest: planning.sourceManifest,
+    proposal,
+    proposalDigest: promoted.proposalDigest,
+  };
+}
+
+function assertApprovedRecipe(
+  approved: Awaited<ReturnType<typeof authority>>,
+  recipe: Awaited<ReturnType<typeof loadNodeWebRecipe>>,
+): void {
+  const blueprint = approved.proposal.blueprints[0];
+  const runtime = `node-${recipe.manifest.runtime.node}-npm-${recipe.manifest.runtime.npm}`;
+  if (
+    blueprint?.recipe !== recipe.manifest.id ||
+    blueprint.recipeVersion !== recipe.manifest.version ||
+    blueprint.runtime !== runtime
+  ) {
+    throw new MillError(
+      "APPROVED_RECIPE_UNSUPPORTED",
+      "The approved blueprint does not select the exact supported recipe, version, and runtime.",
+      ExitCode.configuration,
+      {
+        approvedRecipe: blueprint?.recipe ?? null,
+        approvedVersion: blueprint?.recipeVersion ?? null,
+        approvedRuntime: blueprint?.runtime ?? null,
+        supportedRecipe: recipe.manifest.id,
+        supportedVersion: recipe.manifest.version,
+        supportedRuntime: runtime,
+      },
+    );
+  }
+}
+
+function yaml(value: unknown): string {
+  return stringifyYaml(value, { lineWidth: 88 });
+}
+
+function recipeCommands(
+  nativeCommands: readonly string[],
+  writablePaths: readonly string[],
+): Record<string, unknown> {
+  const controlPaths: Record<string, string[]> = {
+    "format:check": ["package.json", "package-lock.json"],
+    lint: ["package.json", "package-lock.json", "eslint.config.mjs"],
+    typecheck: [
+      "package.json",
+      "package-lock.json",
+      "tsconfig.json",
+      "next-env.d.ts",
+    ],
+    "test:unit": ["package.json", "package-lock.json", "test/unit/**"],
+    "test:integration": [
+      "package.json",
+      "package-lock.json",
+      "test/integration/**",
+    ],
+    "test:browser": [
+      "package.json",
+      "package-lock.json",
+      "playwright.config.ts",
+      "test/browser/**",
+    ],
+    "test:package": [
+      "package.json",
+      "package-lock.json",
+      "next.config.ts",
+      "scripts/check-package.mjs",
+    ],
+    check: [
+      "package.json",
+      "package-lock.json",
+      "eslint.config.mjs",
+      "tsconfig.json",
+      "next.config.ts",
+      "playwright.config.ts",
+      "scripts/check-package.mjs",
+      "test/**",
+    ],
+  };
+  return Object.fromEntries(
+    nativeCommands.map((id) => [
+      id,
+      {
+        argv: ["npm", "run", id],
+        cwd: ".",
+        controlPaths: controlPaths[id] ?? ["package.json", "package-lock.json"],
+        capability: id === "test:package" ? "package" : "test",
+        required: true,
+        timeoutSeconds: id === "check" ? 900 : 300,
+        execution: "oci",
+        writablePaths,
+      },
+    ]),
+  );
+}
+
+function selectedOutcome(proposal: SpecificationProposal) {
+  const outcome = proposal.productContract.outcomes[0];
+  if (outcome === undefined) {
+    throw new MillError(
+      "OUTCOME_REQUIRED",
+      "Repository integration requires at least one approved product outcome.",
+      ExitCode.configuration,
+    );
+  }
+  const acceptanceIds =
+    outcome.acceptanceIds ??
+    proposal.productContract.acceptance.map((item) => item.id);
+  const acceptanceSet = new Set(acceptanceIds);
+  const scenarios = proposal.scenarioSet.scenarios.filter((scenario) =>
+    scenario.acceptanceRefs.some((id) => acceptanceIds.includes(id)),
+  );
+  const crossingScenario = scenarios.find((scenario) =>
+    scenario.acceptanceRefs.some((id) => !acceptanceSet.has(id)),
+  );
+  if (crossingScenario !== undefined) {
+    throw new MillError(
+      "OUTCOME_SCENARIO_SCOPE_INVALID",
+      "A selected first-outcome scenario cannot reference acceptance outside that outcome.",
+      ExitCode.configuration,
+      { scenarioId: crossingScenario.id },
+    );
+  }
+  if (acceptanceIds.length === 0 || scenarios.length === 0) {
+    throw new MillError(
+      "OUTCOME_ORACLE_REQUIRED",
+      "The first outcome requires explicit acceptance IDs and approved scenarios before recipe apply.",
+      ExitCode.configuration,
+    );
+  }
+  return { outcome, acceptanceIds, scenarios };
+}
+
+function dynamicFiles(input: {
+  options: IntegrationOptions;
+  authority: Awaited<ReturnType<typeof authority>>;
+  mode: "greenfield" | "adoption";
+  baseCommit: string | null;
+  recipe: Awaited<ReturnType<typeof loadNodeWebRecipe>>;
+  nativeCommands: readonly string[];
+  existingByPath: ReadonlyMap<string, ExistingFile>;
+}): RecipeFile[] {
+  const { proposal } = input.authority;
+  const selection = selectedOutcome(proposal);
+  const supportedCommands = new Set(input.nativeCommands);
+  const recipeOracles = new Map(
+    input.recipe.manifest.oracles.map((oracle) => [oracle.id, oracle]),
+  );
+  const commandIds = new Set<string>();
+  for (const scenario of selection.scenarios) {
+    const recipeOracle =
+      scenario.recipeOracle === undefined
+        ? undefined
+        : recipeOracles.get(scenario.recipeOracle);
+    if (
+      recipeOracle === undefined ||
+      scenario.executionRef === undefined ||
+      recipeOracle.commandId !== scenario.executionRef ||
+      !supportedCommands.has(scenario.executionRef)
+    ) {
+      throw new MillError(
+        "RECIPE_SCENARIO_UNSUPPORTED",
+        "An approved first-outcome scenario requires an explicit matching recipe-specific oracle.",
+        ExitCode.configuration,
+        {
+          scenarioId: scenario.id,
+          recipeOracle: scenario.recipeOracle ?? null,
+          executionRef: scenario.executionRef ?? null,
+        },
+      );
+    }
+    commandIds.add(scenario.executionRef);
+  }
+  for (const invariant of proposal.productContract.invariants) {
+    if (
+      selection.scenarios.some((scenario) =>
+        scenario.invariantRefs.includes(invariant.id),
+      )
+    ) {
+      if (invariant.verification.mode !== "command") {
+        throw new MillError(
+          "RECIPE_INVARIANT_UNSUPPORTED",
+          "A recipe-generated task requires command-verifiable affected invariants.",
+          ExitCode.configuration,
+          {
+            invariantId: invariant.id,
+            verificationMode: invariant.verification.mode,
+          },
+        );
+      }
+      if (!supportedCommands.has(invariant.verification.ref)) {
+        throw new MillError(
+          "RECIPE_INVARIANT_UNSUPPORTED",
+          "An affected invariant is not mapped to a supported native recipe command.",
+          ExitCode.configuration,
+          {
+            invariantId: invariant.id,
+            executionRef: invariant.verification.ref,
+          },
+        );
+      }
+      commandIds.add(invariant.verification.ref);
+    }
+  }
+  if (!supportedCommands.has("check")) {
+    throw new MillError(
+      "RECIPE_FULL_GATE_UNAVAILABLE",
+      "Repository integration requires one native check command for preservation evidence.",
+      ExitCode.configuration,
+    );
+  }
+  commandIds.add("check");
+  const productContractDigest = canonicalDigest(
+    proposal.productContract as unknown as JsonValue,
+  );
+  const outcomeSlug = slug(selection.outcome.id.replace(/^OUT-/u, ""));
+  const impactPath = `product/impacts/${outcomeSlug}.yaml`;
+  const taskPath = `product/tasks/${outcomeSlug}.yaml`;
+  const acceptance = selection.acceptanceIds.map((id) => {
+    const contract = proposal.productContract.acceptance.find(
+      (item) => item.id === id,
+    );
+    if (contract === undefined) {
+      throw new MillError(
+        "OUTCOME_ACCEPTANCE_UNRESOLVED",
+        "The first outcome references an unknown acceptance item.",
+        ExitCode.configuration,
+        { acceptanceId: id },
+      );
+    }
+    const scenarios = selection.scenarios.filter((scenario) =>
+      scenario.acceptanceRefs.includes(id),
+    );
+    const executionRef = scenarios[0]?.executionRef;
+    if (executionRef === undefined) {
+      throw new MillError(
+        "OUTCOME_ORACLE_REQUIRED",
+        "Each first-outcome acceptance item requires an executable approved scenario.",
+        ExitCode.configuration,
+        { acceptanceId: id },
+      );
+    }
+    return {
+      id,
+      statement: contract.statement,
+      invariantIds: [
+        ...new Set(scenarios.flatMap((item) => item.invariantRefs)),
+      ],
+      scenarioIds: scenarios.map((item) => item.id),
+      coverage: scenarios.every((item) => item.coverage === "new_behavior")
+        ? "new_behavior"
+        : scenarios.every((item) => item.coverage === "preservation")
+          ? "preservation"
+          : "both",
+      evidence: { mode: "command", commandId: executionRef },
+    } as const;
+  });
+  const affectedInvariantIds = [
+    ...new Set(
+      selection.scenarios.flatMap((scenario) => scenario.invariantRefs),
+    ),
+  ];
+  let riskClass: "low" | "medium" | "high" = "low";
+  for (const invariant of proposal.productContract.invariants) {
+    if (!affectedInvariantIds.includes(invariant.id)) continue;
+    if (
+      invariant.criticality === "high" ||
+      invariant.criticality === "critical"
+    ) {
+      riskClass = "high";
+      break;
+    }
+    if (invariant.criticality === "medium") riskClass = "medium";
+  }
+  if (
+    riskClass !== "low" &&
+    !selection.scenarios.some((scenario) => scenario.kind !== "normal")
+  ) {
+    throw new MillError(
+      "OUTCOME_RISK_EVIDENCE_REQUIRED",
+      "A medium- or high-risk outcome requires an approved non-normal executable scenario.",
+      ExitCode.configuration,
+      { riskClass, affectedInvariantIds },
+    );
+  }
+  const impactProposal = {
+    schemaVersion: "1" as const,
+    id: outcomeSlug,
+    productContractDigest,
+    outcomeId: selection.outcome.id,
+    riskClass,
+    acceptanceIds: selection.acceptanceIds,
+    affectedInvariantIds,
+    uncertainInvariantIds: [],
+    surfaces: [
+      {
+        id: "web-product",
+        kind: "user" as const,
+        change: selection.outcome.statement,
+      },
+    ],
+    scenarioIds: selection.scenarios.map((scenario) => scenario.id),
+    commandIds: [...commandIds].sort(),
+    materialDecisions: proposal.productContract.decisions
+      .filter((decision) => decision.status === "approved")
+      .map((decision) => decision.id),
+    unresolved: [],
+    exceptions: [],
+    approval: null,
+  };
+  const impact = {
+    ...impactProposal,
+    approval: {
+      approvedBy: input.options.approvedBy,
+      approvedAt: input.options.approvedAt,
+      proposalDigest: canonicalDigest(impactProposal),
+    },
+  };
+  const product = yaml(proposal.productContract);
+  const scenarios = yaml(proposal.scenarioSet);
+  const policy =
+    input.existingByPath.get("WORKFLOW.md")?.content ??
+    "# Delivery workflow\n\nEvery product change binds approved product, scenario, architecture, impact,\ntask, and exact-base identities. A candidate is committed before the complete\nnative gate and independent review. Only the attended shipper may open a draft\npull request, and a configured human remains the merge authority.\n";
+  const blueprint = yaml(proposal.blueprints[0]);
+  const plan = yaml({
+    schemaVersion: "1",
+    productContractDigest,
+    outcomes: proposal.productContract.outcomes.map((outcome, index) => ({
+      id: outcome.id,
+      title: outcome.statement,
+      acceptance: (
+        outcome.acceptanceIds ??
+        proposal.productContract.acceptance.map((item) => item.id)
+      )
+        .map(
+          (id) =>
+            proposal.productContract.acceptance.find((item) => item.id === id)
+              ?.statement,
+        )
+        .filter((value): value is string => value !== undefined),
+      acceptanceIds:
+        outcome.acceptanceIds ??
+        proposal.productContract.acceptance.map((item) => item.id),
+      dependsOn:
+        index === 0
+          ? []
+          : [proposal.productContract.outcomes[index - 1]?.id].filter(
+              (value): value is string => value !== undefined,
+            ),
+      status: index === 0 ? "ready" : "approved",
+      ...(index === 0 ? { taskRef: taskPath } : {}),
+    })),
+  });
+  const impactSource = yaml(impact);
+  const prdTarget =
+    input.mode === "greenfield"
+      ? "product/PRD.md"
+      : path.normalize(input.options.prdPath).split(path.sep).join("/");
+  assertRelativePath(prdTarget, "PRD integration path");
+  const builderAllowedPaths = ["app/**", "public/**", "src/**"];
+  if (
+    builderAllowedPaths.some((pattern) => {
+      const prefix = pattern.slice(0, -3);
+      return prdTarget === prefix || prdTarget.startsWith(`${prefix}/`);
+    })
+  ) {
+    throw new MillError(
+      "PRD_BUILDER_SCOPE_OVERLAP",
+      "The approved PRD cannot be placed inside the generated builder-writable scope.",
+      ExitCode.configuration,
+      { path: prdTarget },
+    );
+  }
+  const task = taskPacketV2Schema.parse({
+    schemaVersion: "2",
+    id: outcomeSlug,
+    title: selection.outcome.statement,
+    objective: selection.outcome.statement,
+    riskClass,
+    baseRef: "HEAD",
+    authority: {
+      productContract: {
+        path: "product/contract.yaml",
+        digest: textDigest(product),
+      },
+      scenarioSet: {
+        path: "quality/scenarios.yaml",
+        digest: textDigest(scenarios),
+      },
+      policy: { path: "WORKFLOW.md", digest: textDigest(policy) },
+      impactManifest: { path: impactPath, digest: textDigest(impactSource) },
+    },
+    contextPaths: [
+      "WORKFLOW.md",
+      "architecture/blueprint.yaml",
+      "product/contract.yaml",
+      "quality/scenarios.yaml",
+      prdTarget,
+    ],
+    allowedPaths: builderAllowedPaths,
+    commandIds: [...commandIds].sort(),
+    attestations: [],
+    acceptance,
+    commit: {
+      message: `feat: deliver ${outcomeSlug}\n\nSigned-off-by: ${input.options.authorName} <${input.options.authorEmail}>`,
+      authorName: input.options.authorName,
+      authorEmail: input.options.authorEmail,
+    },
+    budget: {
+      deadlineSeconds: 3600,
+      maxOutputBytes: 2_000_000,
+      retryCount: 1,
+    },
+  });
+  const config = millConfigSchema.parse({
+    schemaVersion: "1",
+    repositoryId: input.options.repositoryId,
+    trustCeiling: "build",
+    sensitivePaths: [
+      ".env",
+      ".env.local",
+      ".env.production",
+      ".env.development",
+      ".env.test",
+      ".npmrc",
+      "config/credentials.json",
+    ],
+    verifier: {
+      image: input.recipe.manifest.verifierImage,
+      network: "none",
+      dependencies: {
+        manager: "npm",
+        registry: input.recipe.manifest.registry,
+        targetPath: "node_modules",
+        lockPaths: ["package.json", "package-lock.json"],
+      },
+    },
+    commands: recipeCommands(
+      input.mode === "greenfield"
+        ? input.nativeCommands
+        : [...commandIds].sort(),
+      input.recipe.manifest.writablePaths,
+    ),
+  });
+  const sourcePrdPath = path
+    .normalize(input.options.prdPath)
+    .split(path.sep)
+    .join("/");
+  const prdDigest = textDigest(input.authority.prd);
+  let prdSourceCount = 0;
+  let prdSourceId: string | undefined;
+  const sourceManifest = {
+    ...input.authority.sourceManifest,
+    sources: input.authority.sourceManifest.sources.map((source) => {
+      const sourceUri = path.normalize(source.uri).split(path.sep).join("/");
+      if (sourceUri !== sourcePrdPath) return source;
+      prdSourceCount += 1;
+      prdSourceId = source.id;
+      if (source.revision !== prdDigest && source.digest !== prdDigest) {
+        throw new MillError(
+          "PRD_SOURCE_IDENTITY_MISMATCH",
+          "The PRD source entry must bind the exact approved PRD digest.",
+          ExitCode.configuration,
+          { sourceId: source.id },
+        );
+      }
+      return {
+        ...source,
+        uri: prdTarget,
+        revision: prdDigest,
+        digest: prdDigest,
+      };
+    }),
+  };
+  if (prdSourceCount !== 1) {
+    throw new MillError(
+      "PRD_SOURCE_IDENTITY_REQUIRED",
+      "Repository integration requires exactly one source entry for the approved PRD.",
+      ExitCode.configuration,
+      { prdPath: input.options.prdPath, matches: prdSourceCount },
+    );
+  }
+  if (
+    prdSourceId === undefined ||
+    !proposal.productContract.sourceRefs.includes(prdSourceId)
+  ) {
+    throw new MillError(
+      "PRD_SOURCE_PRODUCT_BINDING_REQUIRED",
+      "The approved product contract must bind the exact PRD source used for repository integration.",
+      ExitCode.configuration,
+      { sourceId: prdSourceId ?? null },
+    );
+  }
+  const values: [string, string, FileOwnership][] = [
+    [prdTarget, input.authority.prd, "generated_once"],
+    ["product/sources.yaml", yaml(sourceManifest), "generated_once"],
+    ["product/contract.yaml", product, "generated_once"],
+    ["quality/scenarios.yaml", scenarios, "generated_once"],
+    ["architecture/blueprint.yaml", blueprint, "generated_once"],
+    ["product/plan.yaml", plan, "generated_once"],
+    [impactPath, impactSource, "generated_once"],
+    [taskPath, yaml(task), "generated_once"],
+    ["mill.yaml", yaml(config), "mill_only"],
+    ...(input.mode === "adoption"
+      ? ([["WORKFLOW.md", policy, "generated_once"]] as [
+          string,
+          string,
+          FileOwnership,
+        ][])
+      : []),
+  ];
+  return values.map(([file, content, ownership]) => ({
+    path: file,
+    content,
+    contentDigest: digest(content),
+    ownership,
+  }));
+}
+
+async function existingFile(
+  root: string,
+  relative: string,
+): Promise<ExistingFile | undefined> {
+  try {
+    const information = await lstat(path.join(root, relative));
+    if (
+      !information.isFile() ||
+      information.isSymbolicLink() ||
+      information.size > 8 * 1024 * 1024
+    ) {
+      throw new MillError(
+        "INTEGRATION_FILE_UNSAFE",
+        "An integration target is not a bounded regular file.",
+        ExitCode.configuration,
+        { path: relative },
+      );
+    }
+    const content = await readFile(path.join(root, relative), "utf8");
+    return { content, digest: digest(content) };
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT")
+      return undefined;
+    throw error;
+  }
+}
+
+async function existingMap(
+  root: string,
+  paths: readonly string[],
+): Promise<Map<string, ExistingFile>> {
+  const entries = await Promise.all(
+    [...new Set(paths)].map(
+      async (relative) =>
+        [relative, await existingFile(root, relative)] as const,
+    ),
+  );
+  return new Map(
+    entries.filter(
+      (entry): entry is readonly [string, ExistingFile] =>
+        entry[1] !== undefined,
+    ),
+  );
+}
+
+async function commitFile(
+  root: string,
+  commit: string,
+  relative: string,
+  maxOutputBytes = 8 * 1024 * 1024,
+): Promise<ExistingFile | undefined> {
+  assertRelativePath(relative, "Committed integration file");
+  const gitPath = path.normalize(relative).split(path.sep).join("/");
+  assertRelativePath(gitPath, "Normalized committed integration file");
+  const listing = await git(
+    root,
+    [
+      "ls-tree",
+      "-z",
+      "--full-tree",
+      "--format=%(objectmode)%x09%(objecttype)%x09%(objectname)%x09%(path)",
+      commit,
+      "--",
+      gitPath,
+    ],
+    undefined,
+    256 * 1024,
+  );
+  if (listing.length === 0) return undefined;
+  const records = listing.split("\0").filter(Boolean);
+  if (records.length !== 1) {
+    throw new MillError(
+      "INTEGRATION_BASE_FILE_UNSAFE",
+      "An exact-base integration path did not resolve to one regular Git blob.",
+      ExitCode.configuration,
+      { path: relative },
+    );
+  }
+  const [mode, type, objectId, listedPath] = records[0]?.split("\t") ?? [];
+  if (
+    (mode !== "100644" && mode !== "100755") ||
+    type !== "blob" ||
+    !/^[a-f0-9]{40,64}$/u.test(objectId ?? "") ||
+    listedPath !== gitPath
+  ) {
+    throw new MillError(
+      "INTEGRATION_BASE_FILE_UNSAFE",
+      "An exact-base integration path is not a bounded regular Git file.",
+      ExitCode.configuration,
+      { path: gitPath, mode, type },
+    );
+  }
+  const content = await git(
+    root,
+    ["cat-file", "blob", `${commit}:${gitPath}`],
+    undefined,
+    maxOutputBytes,
+  );
+  const roundTripObjectId = (
+    await git(root, ["hash-object", "--stdin"], undefined, 256 * 1024, content)
+  ).trim();
+  if (roundTripObjectId !== objectId) {
+    throw new MillError(
+      "INTEGRATION_BASE_FILE_UNSAFE",
+      "An exact-base integration file is not losslessly decodable UTF-8 text.",
+      ExitCode.configuration,
+      { path: gitPath },
+    );
+  }
+  return { content, digest: digest(content) };
+}
+
+async function existingMapAtCommit(
+  root: string,
+  commit: string,
+  paths: readonly string[],
+): Promise<Map<string, ExistingFile>> {
+  const entries = await Promise.all(
+    [...new Set(paths)].map(
+      async (relative) =>
+        [relative, await commitFile(root, commit, relative)] as const,
+    ),
+  );
+  return new Map(
+    entries.filter(
+      (entry): entry is readonly [string, ExistingFile] =>
+        entry[1] !== undefined,
+    ),
+  );
+}
+
+function lockFile(input: {
+  mode: "greenfield" | "adoption";
+  planDigest: string;
+  baseCommit: string | null;
+  recipe: Awaited<ReturnType<typeof loadNodeWebRecipe>>;
+  files: readonly RecipeFile[];
+  existingByPath: ReadonlyMap<string, ExistingFile>;
+}): RecipeFile {
+  const lock = millLockSchema.parse({
+    schemaVersion: "1",
+    mill: { package: MILL_PACKAGE, version: MILL_VERSION },
+    schemaDigests: {},
+    recipe: {
+      id: input.recipe.manifest.id,
+      version: input.recipe.manifest.version,
+      digest: input.recipe.digest,
+    },
+    integration: {
+      mode: input.mode,
+      planDigest: input.planDigest,
+      baseCommit: input.baseCommit,
+      files: input.files.map((file) => ({
+        path: file.path,
+        ownership: file.ownership,
+        templateDigest: file.contentDigest,
+        installedDigest: file.contentDigest,
+        preexistingDigest: input.existingByPath.get(file.path)?.digest ?? null,
+      })),
+    },
+  });
+  const content = yaml(lock);
+  return {
+    path: "mill.lock",
+    content,
+    contentDigest: digest(content),
+    ownership: "mill_only",
+  };
+}
+
+function integrationPlanBody(input: {
+  mode: "greenfield" | "adoption";
+  directoryName: string;
+  canonicalTargetPath: string;
+  baseCommit: string | null;
+  scan: RepositoryScan | null;
+  authority: Awaited<ReturnType<typeof authority>>;
+  recipe: Awaited<ReturnType<typeof loadNodeWebRecipe>>;
+  files: readonly RecipeFile[];
+  existingByPath: ReadonlyMap<string, ExistingFile>;
+  options: IntegrationOptions;
+}) {
+  return {
+    generator: { package: MILL_PACKAGE, version: MILL_VERSION },
+    mode: input.mode,
+    target: {
+      directoryName: input.directoryName,
+      canonicalPathDigest: canonicalDigest({
+        canonicalPath: input.canonicalTargetPath,
+      }),
+      baseCommit: input.baseCommit,
+      scanDigest: input.scan?.digest ?? null,
+    },
+    productProposalDigest: input.authority.proposalDigest,
+    productContractDigest: canonicalDigest(
+      input.authority.proposal.productContract as unknown as JsonValue,
+    ),
+    recipe: {
+      id: input.recipe.manifest.id,
+      version: input.recipe.manifest.version,
+      digest: input.recipe.digest,
+      status: "supported" as const,
+      verifierImage: input.recipe.manifest.verifierImage,
+    },
+    approval: {
+      approvedBy: input.options.approvedBy,
+      approvedAt: input.options.approvedAt,
+    },
+    files: input.files.map((file) => ({
+      path: file.path,
+      ownership: file.ownership,
+      action: input.existingByPath.has(file.path)
+        ? ("retain_identical" as const)
+        : ("create" as const),
+      contentDigest: file.contentDigest,
+      preexistingDigest: input.existingByPath.get(file.path)?.digest ?? null,
+    })),
+    commandIds: input.recipe.manifest.commands.required,
+    networkDisclosure:
+      input.mode === "greenfield"
+        ? [`HTTPS package installation from ${input.recipe.manifest.registry}`]
+        : [],
+    baseline: "unverified" as const,
+  };
+}
+
+function integrationPlanIdentity(
+  input: Parameters<typeof integrationPlanBody>[0],
+): string {
+  return canonicalDigest({
+    schemaVersion: "1",
+    ...integrationPlanBody(input),
+    derivedFiles: [
+      {
+        path: "mill.lock",
+        ownership: "mill_only",
+        derivation: "mill-lock-v1-from-plan-digest-and-generator",
+      },
+    ],
+  });
+}
+
+function integrationPlan(input: {
+  mode: "greenfield" | "adoption";
+  directoryName: string;
+  canonicalTargetPath: string;
+  baseCommit: string | null;
+  scan: RepositoryScan | null;
+  authority: Awaited<ReturnType<typeof authority>>;
+  recipe: Awaited<ReturnType<typeof loadNodeWebRecipe>>;
+  files: readonly RecipeFile[];
+  existingByPath: ReadonlyMap<string, ExistingFile>;
+  options: IntegrationOptions;
+  planDigest: string;
+}): { plan: RepositoryIntegrationPlan; approvalDigest: string } {
+  const plan = repositoryIntegrationPlanSchema.parse({
+    schemaVersion: "1",
+    planDigest: input.planDigest,
+    ...integrationPlanBody(input),
+  });
+  return {
+    plan,
+    approvalDigest: input.planDigest,
+  };
+}
+
+async function assertCompatibleAdoption(
+  root: string,
+  baseCommit: string,
+  productTitle: string,
+): Promise<{ nativeCommands: string[] }> {
+  const [packageSource, lockSource, currentPackage, currentLock] =
+    await Promise.all([
+      commitFile(root, baseCommit, "package.json", 2 * 1024 * 1024),
+      commitFile(root, baseCommit, "package-lock.json", 8 * 1024 * 1024),
+      existingFile(root, "package.json"),
+      existingFile(root, "package-lock.json"),
+    ]);
+  if (packageSource === undefined || lockSource === undefined) {
+    throw new MillError(
+      "ADOPTION_MANIFEST_INVALID",
+      "Compatible adoption requires package.json and package-lock.json in the exact base commit.",
+      ExitCode.configuration,
+    );
+  }
+  let packageJson: Record<string, unknown>;
+  let packageLock: JsonValue;
+  try {
+    packageJson = JSON.parse(packageSource.content) as Record<string, unknown>;
+    packageLock = JSON.parse(lockSource.content) as JsonValue;
+    JSON.parse(currentPackage?.content ?? "");
+    JSON.parse(currentLock?.content ?? "");
+  } catch (error) {
+    throw new MillError(
+      "ADOPTION_MANIFEST_INVALID",
+      "Compatible adoption requires valid package.json and package-lock.json files.",
+      ExitCode.data,
+      { cause: String(error) },
+    );
+  }
+  if (
+    currentPackage?.digest !== packageSource.digest ||
+    currentLock?.digest !== lockSource.digest
+  ) {
+    throw new MillError(
+      "ADOPTION_ORACLE_INCOMPATIBLE",
+      "Compatible adoption requires the working dependency manifests to match the exact base bytes.",
+      ExitCode.configuration,
+    );
+  }
+  const projectName = packageJson.name;
+  if (typeof projectName !== "string" || projectName.length === 0) {
+    throw new MillError(
+      "ADOPTION_MANIFEST_INVALID",
+      "Compatible adoption requires one explicit package name.",
+      ExitCode.configuration,
+    );
+  }
+  const rendered = await renderNodeWebRecipe({ projectName, productTitle });
+  const renderedByPath = new Map(rendered.map((file) => [file.path, file]));
+  const expectedPackage = JSON.parse(
+    renderedByPath.get("package.json")?.content ?? "{}",
+  ) as Record<string, unknown>;
+  const expectedLock = JSON.parse(
+    renderedByPath.get("package-lock.json")?.content ?? "{}",
+  ) as JsonValue;
+  if (canonicalDigest(packageLock) !== canonicalDigest(expectedLock)) {
+    throw new MillError(
+      "ADOPTION_ORACLE_INCOMPATIBLE",
+      "Compatible adoption requires the exact qualified dependency lock graph.",
+      ExitCode.configuration,
+      { path: "package-lock.json" },
+    );
+  }
+  for (const field of [
+    "type",
+    "engines",
+    "packageManager",
+    "scripts",
+    "dependencies",
+    "devDependencies",
+  ]) {
+    const actualValue = packageJson[field];
+    const expectedValue = expectedPackage[field];
+    if (
+      actualValue === undefined ||
+      expectedValue === undefined ||
+      canonicalDigest(actualValue as JsonValue) !==
+        canonicalDigest(expectedValue as JsonValue)
+    ) {
+      throw new MillError(
+        "ADOPTION_ORACLE_INCOMPATIBLE",
+        "Compatible adoption requires exact qualified runtime, dependency, and native-oracle pins.",
+        ExitCode.configuration,
+        { field },
+      );
+    }
+  }
+  const dependencies = packageJson.dependencies as
+    Record<string, unknown> | undefined;
+  const devDependencies = packageJson.devDependencies as
+    Record<string, unknown> | undefined;
+  const nextVersion = dependencies?.next;
+  const reactVersion = dependencies?.react;
+  const reactDomVersion = dependencies?.["react-dom"];
+  if (
+    nextVersion !== "16.3.4" ||
+    reactVersion !== "19.2.8" ||
+    reactDomVersion !== "19.2.8" ||
+    devDependencies?.typescript !== "6.0.3"
+  ) {
+    throw new MillError(
+      "ADOPTION_RECIPE_INCOMPATIBLE",
+      "The first adoption mapping supports only the exact qualified Next.js 16.3.4, React 19.2.8, and TypeScript 6.0.3 tuple.",
+      ExitCode.configuration,
+    );
+  }
+  const scripts = packageJson.scripts as Record<string, unknown> | undefined;
+  const nativeCommands = Object.entries(scripts ?? {})
+    .filter((entry): entry is [string, string] => typeof entry[1] === "string")
+    .map(([id]) => id);
+  if (!nativeCommands.includes("check")) {
+    throw new MillError(
+      "ADOPTION_COMMANDS_INCOMPATIBLE",
+      "Compatible adoption requires one existing native check script; Mill will not invent or replace it.",
+      ExitCode.configuration,
+    );
+  }
+  const requiredScripts = {
+    "format:check": "prettier --check .",
+    lint: "eslint . --max-warnings 0",
+    typecheck: "tsc --noEmit",
+    "test:unit": "vitest run test/unit",
+    "test:integration": "vitest run test/integration",
+    "test:browser": "playwright test",
+    "test:package": "npm run build && node scripts/check-package.mjs",
+    check:
+      "npm run format:check && npm run lint && npm run typecheck && npm run test:unit && npm run test:integration && npm run test:browser && npm run test:package",
+  } as const;
+  for (const [id, expected] of Object.entries(requiredScripts)) {
+    if (scripts?.[id] !== expected) {
+      throw new MillError(
+        "ADOPTION_ORACLE_INCOMPATIBLE",
+        "Compatible adoption requires the exact qualified native check closure; Mill will not infer an existing repository's oracle graph.",
+        ExitCode.configuration,
+        { commandId: id },
+      );
+    }
+  }
+  try {
+    await Promise.all(
+      [
+        ".node-version",
+        ".tool-versions",
+        "eslint.config.mjs",
+        "tsconfig.json",
+        "next-env.d.ts",
+        "next.config.ts",
+        "playwright.config.ts",
+        "scripts/check-package.mjs",
+        "test/unit/health.test.ts",
+        "test/integration/health-route.test.ts",
+        "test/browser/home.spec.ts",
+      ].map(async (relative) => {
+        const [actual, current] = await Promise.all([
+          commitFile(root, baseCommit, relative, 2 * 1024 * 1024),
+          existingFile(root, relative),
+        ]);
+        const expected = renderedByPath.get(relative);
+        if (
+          actual?.digest !== expected?.contentDigest ||
+          current?.digest !== actual?.digest
+        ) {
+          throw new MillError(
+            "ADOPTION_ORACLE_INCOMPATIBLE",
+            "Compatible adoption requires exact qualified native oracle bytes.",
+            ExitCode.configuration,
+            { path: relative },
+          );
+        }
+      }),
+    );
+  } catch (error) {
+    throw new MillError(
+      "ADOPTION_ORACLE_INCOMPATIBLE",
+      "Compatible adoption requires the exact qualified native oracle files.",
+      ExitCode.configuration,
+      { cause: String(error) },
+    );
+  }
+  return { nativeCommands };
+}
+
+function assertNoConflicts(
+  files: readonly RecipeFile[],
+  existing: ReadonlyMap<string, ExistingFile>,
+): void {
+  for (const file of files) {
+    const current = existing.get(file.path);
+    if (current !== undefined && current.digest !== file.contentDigest) {
+      throw new MillError(
+        "ADOPTION_AUTHORITY_CONFLICT",
+        "Adoption would overwrite an existing authority or generated path.",
+        ExitCode.configuration,
+        { path: file.path },
+      );
+    }
+  }
+}
+
+export async function planGreenfieldIntegration(
+  input: IntegrationOptions & {
+    targetDirectory: string;
+  },
+): Promise<PlannedIntegration> {
+  const { target } = await greenfieldTarget(
+    input.sourceRoot,
+    input.targetDirectory,
+  );
+  try {
+    await lstat(target);
+    throw new MillError(
+      "GREENFIELD_TARGET_EXISTS",
+      "Greenfield apply requires a target path that does not yet exist.",
+      ExitCode.configuration,
+    );
+  } catch (error) {
+    if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
+      throw error;
+  }
+  const [approved, recipe] = await Promise.all([
+    authority(input),
+    loadNodeWebRecipe(),
+  ]);
+  assertApprovedRecipe(approved, recipe);
+  const template = await renderNodeWebRecipe({
+    projectName: path.basename(target),
+    productTitle: approved.proposal.productContract.title,
+  });
+  const existingByPath = new Map<string, ExistingFile>();
+  const dynamic = dynamicFiles({
+    options: input,
+    authority: approved,
+    mode: "greenfield",
+    baseCommit: null,
+    recipe,
+    nativeCommands: recipe.manifest.commands.native,
+    existingByPath,
+  });
+  const withoutLock = [...template, ...dynamic].sort((left, right) =>
+    left.path.localeCompare(right.path),
+  );
+  const planInput = {
+    mode: "greenfield" as const,
+    directoryName: input.targetDirectory,
+    canonicalTargetPath: target,
+    baseCommit: null,
+    scan: null,
+    authority: approved,
+    recipe,
+    files: withoutLock,
+    existingByPath,
+    options: input,
+  };
+  const planDigest = integrationPlanIdentity(planInput);
+  const files = [
+    ...withoutLock,
+    lockFile({
+      mode: "greenfield",
+      planDigest,
+      baseCommit: null,
+      recipe,
+      files: withoutLock,
+      existingByPath,
+    }),
+  ].sort((left, right) => left.path.localeCompare(right.path));
+  const planned = integrationPlan({
+    ...planInput,
+    files,
+    planDigest,
+  });
+  return { ...planned, files };
+}
+
+export async function planAdoptionIntegration(
+  input: IntegrationOptions & {
+    repositoryRoot: string;
+  },
+): Promise<PlannedIntegration> {
+  const root = await realpath(input.repositoryRoot);
+  await assertVisibleIndexState(root);
+  const baseCommit = await resolveCommit(root, "HEAD");
+  const [approved, recipe, scan] = await Promise.all([
+    authority(input),
+    loadNodeWebRecipe(),
+    scanRepository(root),
+  ]);
+  assertApprovedRecipe(approved, recipe);
+  const compatibility = await assertCompatibleAdoption(
+    root,
+    baseCommit,
+    approved.proposal.productContract.title,
+  );
+  if (
+    scan.gitConfigHazards.length > 0 ||
+    scan.truncatedDirectories.length > 0 ||
+    scan.symlinksSkipped.length > 0 ||
+    scan.secretReferences.length > 0
+  ) {
+    throw new MillError(
+      "ADOPTION_SCAN_BLOCKED",
+      "Adoption requires a complete static scan with no Git hazards, symbolic links, or credential-like files.",
+      ExitCode.configuration,
+      {
+        gitConfigHazards: scan.gitConfigHazards,
+        truncatedDirectories: scan.truncatedDirectories,
+        symlinksSkipped: scan.symlinksSkipped,
+        secretReferences: scan.secretReferences,
+      },
+    );
+  }
+  const candidatePaths = [
+    "WORKFLOW.md",
+    "README.md",
+    input.prdPath,
+    "product/sources.yaml",
+    "product/contract.yaml",
+    "quality/scenarios.yaml",
+    "architecture/blueprint.yaml",
+    "product/plan.yaml",
+    "mill.yaml",
+    "mill.lock",
+  ];
+  const [initialExisting, workingExisting] = await Promise.all([
+    existingMapAtCommit(root, baseCommit, candidatePaths),
+    existingMap(root, candidatePaths),
+  ]);
+  if (
+    initialExisting.has("mill.yaml") ||
+    initialExisting.has("mill.lock") ||
+    workingExisting.has("mill.yaml") ||
+    workingExisting.has("mill.lock")
+  ) {
+    throw new MillError(
+      "REPOSITORY_ALREADY_MANAGED",
+      "Adoption apply is only for a repository without an existing Mill integration.",
+      ExitCode.configuration,
+    );
+  }
+  const dynamic = dynamicFiles({
+    options: input,
+    authority: approved,
+    mode: "adoption",
+    baseCommit,
+    recipe,
+    nativeCommands: compatibility.nativeCommands,
+    existingByPath: initialExisting,
+  });
+  const [existingByPath, workingDynamic] = await Promise.all([
+    existingMapAtCommit(
+      root,
+      baseCommit,
+      dynamic.map((file) => file.path),
+    ),
+    existingMap(
+      root,
+      dynamic.map((file) => file.path),
+    ),
+  ]);
+  assertNoConflicts(dynamic, existingByPath);
+  assertNoConflicts(dynamic, workingDynamic);
+  const withoutLock = dynamic.sort((left, right) =>
+    left.path.localeCompare(right.path),
+  );
+  const planInput = {
+    mode: "adoption" as const,
+    directoryName: path.basename(root),
+    canonicalTargetPath: root,
+    baseCommit,
+    scan,
+    authority: approved,
+    recipe,
+    files: withoutLock,
+    existingByPath,
+    options: input,
+  };
+  const planDigest = integrationPlanIdentity(planInput);
+  const files = [
+    ...withoutLock,
+    lockFile({
+      mode: "adoption",
+      planDigest,
+      baseCommit,
+      recipe,
+      files: withoutLock,
+      existingByPath,
+    }),
+  ].sort((left, right) => left.path.localeCompare(right.path));
+  const planned = integrationPlan({
+    ...planInput,
+    files,
+    planDigest,
+  });
+  return { ...planned, files };
+}
+
+async function writeFiles(
+  root: string,
+  files: readonly RecipeFile[],
+): Promise<void> {
+  const canonicalRoot = await realpath(root);
+  for (const file of files) {
+    assertRelativePath(file.path, "Integration file");
+    const parentSegments = path
+      .dirname(file.path)
+      .split(/[\\/]/u)
+      .filter((segment) => segment !== "." && segment !== "");
+    let parent = canonicalRoot;
+    for (const segment of parentSegments) {
+      parent = path.join(parent, segment);
+      try {
+        await mkdir(parent, { mode: 0o700 });
+      } catch (error) {
+        if (!(
+          error instanceof Error &&
+          "code" in error &&
+          error.code === "EEXIST"
+        )) {
+          throw error;
+        }
+      }
+      const information = await lstat(parent);
+      if (information.isSymbolicLink() || !information.isDirectory()) {
+        throw new MillError(
+          "INTEGRATION_FILE_ANCESTOR_UNSAFE",
+          "Integration file ancestors must be real directories inside the repository.",
+          ExitCode.configuration,
+          { path: file.path },
+        );
+      }
+    }
+    const canonicalParent = await realpath(parent);
+    if (!isWithin(canonicalRoot, canonicalParent)) {
+      throw new MillError(
+        "INTEGRATION_FILE_ANCESTOR_UNSAFE",
+        "An integration file ancestor resolved outside the repository.",
+        ExitCode.configuration,
+        { path: file.path },
+      );
+    }
+    const destination = path.join(canonicalParent, path.basename(file.path));
+    const current = await existingFile(canonicalRoot, file.path);
+    if (current !== undefined) {
+      if (current.digest !== file.contentDigest) {
+        throw new MillError(
+          "INTEGRATION_PLAN_DRIFT",
+          "An integration target changed after approval.",
+          ExitCode.configuration,
+          { path: file.path },
+        );
+      }
+      continue;
+    }
+    await writeFile(destination, file.content, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 0o600,
+    });
+  }
+}
+
+async function publishGreenfieldStaging(
+  staging: string,
+  target: string,
+  signal: AbortSignal,
+): Promise<void> {
+  try {
+    await mkdir(target, { mode: 0o700 });
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "EEXIST") {
+      throw new MillError(
+        "GREENFIELD_TARGET_EXISTS",
+        "The approved greenfield target appeared before publication and was preserved.",
+        ExitCode.configuration,
+      );
+    }
+    throw error;
+  }
+  try {
+    const entries = await readdir(staging);
+    if (!entries.includes(".git")) {
+      throw new MillError(
+        "GREENFIELD_AUTHORITY_MISSING",
+        "The qualified staging repository has no Git authority marker.",
+        ExitCode.data,
+      );
+    }
+    for (const entry of entries.filter((entry) => entry !== ".git")) {
+      if (signal.aborted) {
+        throw new MillError(
+          "GREENFIELD_CANCELLED",
+          "Greenfield apply was cancelled before repository authority was published.",
+          ExitCode.temporary,
+        );
+      }
+      await cp(path.join(staging, entry), path.join(target, entry), {
+        recursive: true,
+        force: false,
+        errorOnExist: true,
+        preserveTimestamps: true,
+        verbatimSymlinks: true,
+      });
+    }
+    // Portable Node has no atomic no-replace directory rename. The absent
+    // target is therefore reserved exclusively, non-authoritative files are
+    // materialized, and the complete Git authority marker is published last
+    // with one same-filesystem rename. Before that boundary this is not a repo.
+    if (signal.aborted) {
+      throw new MillError(
+        "GREENFIELD_CANCELLED",
+        "Greenfield apply was cancelled before repository authority was published.",
+        ExitCode.temporary,
+      );
+    }
+    await rename(path.join(staging, ".git"), path.join(target, ".git"));
+  } catch (error) {
+    await rm(target, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+async function git(
+  root: string,
+  args: readonly string[],
+  signal?: AbortSignal,
+  maxOutputBytes = 2 * 1024 * 1024,
+  stdin?: string,
+): Promise<string> {
+  const executable = await findTrustedExecutable("git", root);
+  if (executable === undefined) {
+    throw new MillError(
+      "GIT_UNAVAILABLE",
+      "A trusted Git executable is required.",
+      ExitCode.unavailable,
+    );
+  }
+  const result = await runProcess({
+    executable,
+    args: [
+      "-c",
+      "core.hooksPath=/dev/null",
+      "-c",
+      "core.fsmonitor=false",
+      ...args,
+    ],
+    cwd: root,
+    env: gitEnvironment,
+    deadlineMs: Date.now() + 60_000,
+    maxOutputBytes,
+    ...(stdin === undefined ? {} : { stdin }),
+    ...(signal === undefined ? {} : { signal }),
+  });
+  if (
+    result.exitCode !== 0 ||
+    result.timedOut ||
+    result.outputExceeded ||
+    result.cancelled
+  ) {
+    throw new MillError(
+      "GIT_COMMAND_FAILED",
+      `Git command failed: git ${args[0] ?? ""}`,
+      ExitCode.io,
+      { exitCode: result.exitCode, stderr: result.stderr.slice(0, 2_000) },
+    );
+  }
+  return result.stdout;
+}
+
+async function commitIntegration(
+  root: string,
+  input: IntegrationOptions,
+  message: string,
+  files: readonly RecipeFile[],
+  signal?: AbortSignal,
+): Promise<string> {
+  await git(
+    root,
+    ["add", "--force", "--", ...files.map((file) => file.path)],
+    signal,
+  );
+  if (signal?.aborted === true) {
+    throw new MillError(
+      "INTEGRATION_CANCELLED",
+      "Repository integration was cancelled before the commit publication boundary.",
+      ExitCode.temporary,
+    );
+  }
+  // Once commit publication begins, finish and report the exact result even if
+  // cancellation arrives. Returning failure after advancing the branch would
+  // strand deterministic authority and make a safe retry impossible.
+  await git(root, [
+    "-c",
+    `user.name=${input.authorName}`,
+    "-c",
+    `user.email=${input.authorEmail}`,
+    "-c",
+    "commit.gpgsign=false",
+    "commit",
+    "--no-verify",
+    "--no-gpg-sign",
+    "-m",
+    `${message}\n\nSigned-off-by: ${input.authorName} <${input.authorEmail}>`,
+  ]);
+  const commit = (await git(root, ["rev-parse", "HEAD"])).trim();
+  for (const file of files) {
+    const committed = await commitFile(root, commit, file.path);
+    if (committed?.digest !== file.contentDigest) {
+      throw new MillError(
+        "INTEGRATION_COMMIT_MISMATCH",
+        "The resulting commit does not contain every exact approved integration file.",
+        ExitCode.data,
+        { path: file.path },
+      );
+    }
+  }
+  return commit;
+}
+
+function assertPlanApproval(
+  planned: PlannedIntegration,
+  approvalDigest: string,
+): void {
+  if (approvalDigest !== planned.approvalDigest) {
+    throw new MillError(
+      "INTEGRATION_APPROVAL_MISMATCH",
+      "Integration apply requires the exact current file-plan approval digest.",
+      ExitCode.configuration,
+      { expected: planned.approvalDigest },
+    );
+  }
+}
+
+async function applyGreenfieldIntegrationWithSignal(
+  input: IntegrationOptions & {
+    targetDirectory: string;
+    planApprovalDigest: string;
+    attended: boolean;
+    signal: AbortSignal;
+  },
+): Promise<{
+  repository: string;
+  commit: string;
+  planDigest: string;
+  baseline: "unverified";
+}> {
+  if (!input.attended) {
+    throw new MillError(
+      "ATTENDANCE_REQUIRED",
+      "Greenfield apply requires attended registry and local Git authority.",
+      ExitCode.configuration,
+    );
+  }
+  const planned = await planGreenfieldIntegration(input);
+  assertPlanApproval(planned, input.planApprovalDigest);
+  const { target, parent } = await greenfieldTarget(
+    input.sourceRoot,
+    input.targetDirectory,
+  );
+  const lockDirectory = path.join(
+    parent,
+    `.mill-new-${createHash("sha256").update(target).digest("hex").slice(0, 16)}.lock`,
+  );
+  try {
+    await mkdir(lockDirectory, { mode: 0o700 });
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "EEXIST") {
+      throw new MillError(
+        "GREENFIELD_APPLY_ACTIVE",
+        "Another apply owns this exact target; remove the lock only after proving no apply is active.",
+        ExitCode.temporary,
+        { target: input.targetDirectory, lockDirectory },
+      );
+    }
+    throw error;
+  }
+  let staging: string | undefined;
+  const stateDirectory = repositoryStateDirectory(
+    input.repositoryId,
+    path.join(target, ".git"),
+  );
+  let statePreviouslyExisted = true;
+  let preparedDirectory: string | undefined;
+  let preparedReused = false;
+  let targetPublished = false;
+  try {
+    statePreviouslyExisted = await lstat(stateDirectory)
+      .then(() => true)
+      .catch((error: unknown) => {
+        if (
+          error instanceof Error &&
+          "code" in error &&
+          error.code === "ENOENT"
+        )
+          return false;
+        throw error;
+      });
+    staging = await mkdtemp(path.join(parent, ".mill-new-"));
+    await chmod(staging, 0o700);
+    await writeFiles(staging, planned.files);
+    const configSource = await readFile(
+      path.join(staging, "mill.yaml"),
+      "utf8",
+    );
+    const config = millConfigSchema.parse(parseYaml(configSource));
+    const prepared = await prepareDependencySnapshot({
+      root: staging,
+      stateDirectory,
+      config,
+      attended: input.attended,
+      signal: input.signal,
+    });
+    preparedDirectory = prepared.directory;
+    preparedReused = prepared.reused;
+    const task = taskPacketV1Schema.parse({
+      schemaVersion: "1",
+      id: "recipe-bootstrap",
+      title: "Qualify the exact generated repository",
+      objective:
+        "Prove every required native recipe gate before Git authority exists.",
+      riskClass: "low",
+      baseRef: "HEAD",
+      authority: {
+        productContract: {
+          path: "product/contract.yaml",
+          digest: digest("bootstrap"),
+        },
+        scenarioSet: {
+          path: "quality/scenarios.yaml",
+          digest: digest("bootstrap"),
+        },
+        policy: { path: "WORKFLOW.md", digest: digest("bootstrap") },
+      },
+      contextPaths: ["README.md"],
+      allowedPaths: ["app/**"],
+      commandIds: planned.plan.commandIds,
+      acceptance: [
+        {
+          id: "RECIPE-BOOTSTRAP",
+          statement: "All required recipe gates pass.",
+        },
+      ],
+      commit: {
+        message: "chore: qualify generated repository",
+        authorName: input.authorName,
+        authorEmail: input.authorEmail,
+      },
+      budget: {
+        deadlineSeconds: 1200,
+        maxOutputBytes: 2_000_000,
+        retryCount: 0,
+      },
+    });
+    const evidence = await verifyDeclaredCommands({
+      root: staging,
+      dependencyRoot: prepared.directory,
+      candidateCommit: "0".repeat(40),
+      config,
+      task,
+      deadlineMs: Date.now() + 20 * 60_000,
+      maxOutputBytes: 2_000_000,
+      signal: input.signal,
+    });
+    if (!evidence.passed) {
+      throw new MillError(
+        "RECIPE_QUALIFICATION_FAILED",
+        "A required generated-repository gate failed before Git authority was created.",
+        ExitCode.configuration,
+        { evidence },
+      );
+    }
+    await git(staging, ["init", "--initial-branch=main"], input.signal);
+    const commit = await commitIntegration(
+      staging,
+      input,
+      "chore: bootstrap approved product repository",
+      planned.files,
+      input.signal,
+    );
+    if (input.signal.aborted) {
+      throw new MillError(
+        "GREENFIELD_CANCELLED",
+        "Greenfield apply was cancelled before repository authority was published.",
+        ExitCode.temporary,
+      );
+    }
+    await publishGreenfieldStaging(staging, target, input.signal);
+    targetPublished = true;
+    await rm(staging, { recursive: true, force: true });
+    staging = undefined;
+    return {
+      repository: input.targetDirectory,
+      commit,
+      planDigest: planned.approvalDigest,
+      baseline: "unverified",
+    };
+  } catch (error) {
+    if (staging !== undefined)
+      await rm(staging, { recursive: true, force: true });
+    if (targetPublished) {
+      await rm(target, { recursive: true, force: true });
+    }
+    if (!statePreviouslyExisted) {
+      await rm(stateDirectory, { recursive: true, force: true });
+    } else if (preparedDirectory !== undefined && !preparedReused) {
+      await rm(preparedDirectory, { recursive: true, force: true });
+    }
+    throw error;
+  } finally {
+    await rm(lockDirectory, { recursive: true, force: true });
+  }
+}
+
+export async function applyGreenfieldIntegration(
+  input: IntegrationOptions & {
+    targetDirectory: string;
+    planApprovalDigest: string;
+    attended: boolean;
+    signal?: AbortSignal;
+  },
+): Promise<{
+  repository: string;
+  commit: string;
+  planDigest: string;
+  baseline: "unverified";
+}> {
+  const signals = processCancellationScope(input.signal);
+  try {
+    return await applyGreenfieldIntegrationWithSignal({
+      ...input,
+      signal: signals.signal,
+    });
+  } finally {
+    signals.dispose();
+  }
+}
+
+async function applyAdoptionIntegrationWithSignal(
+  input: IntegrationOptions & {
+    repositoryRoot: string;
+    planApprovalDigest: string;
+    attended: boolean;
+    signal: AbortSignal;
+  },
+): Promise<{
+  branch: string;
+  commit: string;
+  planDigest: string;
+  baseline: "unverified";
+}> {
+  if (!input.attended) {
+    throw new MillError(
+      "ATTENDANCE_REQUIRED",
+      "Adoption apply requires attended isolated-branch authority.",
+      ExitCode.configuration,
+    );
+  }
+  const planned = await planAdoptionIntegration(input);
+  assertPlanApproval(planned, input.planApprovalDigest);
+  if (input.signal.aborted) {
+    throw new MillError(
+      "ADOPTION_CANCELLED",
+      "Adoption apply was cancelled before creating Git authority.",
+      ExitCode.temporary,
+    );
+  }
+  const root = await realpath(input.repositoryRoot);
+  const checkoutStatus = await git(
+    root,
+    ["status", "--porcelain=v1", "--untracked-files=all"],
+    input.signal,
+  );
+  if (checkoutStatus.length > 0) {
+    throw new MillError(
+      "ADOPTION_CHECKOUT_DIRTY",
+      "Adoption apply requires a clean checkout at the approved exact base.",
+      ExitCode.configuration,
+    );
+  }
+  const baseCommit = planned.plan.target.baseCommit;
+  if (
+    baseCommit === null ||
+    (await resolveCommit(root, "HEAD")) !== baseCommit
+  ) {
+    throw new MillError(
+      "INTEGRATION_BASE_DRIFT",
+      "The adoption base changed after file-plan approval.",
+      ExitCode.configuration,
+    );
+  }
+  const branch = `mill/adopt-${planned.approvalDigest.slice(7, 19)}`;
+  const temporary = await mkdtemp(
+    path.join(path.dirname(root), ".mill-adopt-"),
+  );
+  await chmod(temporary, 0o700);
+  try {
+    await rm(temporary, { recursive: true });
+    await git(
+      root,
+      ["worktree", "add", "-b", branch, temporary, baseCommit],
+      input.signal,
+    );
+    await writeFiles(temporary, planned.files);
+    const commit = await commitIntegration(
+      temporary,
+      input,
+      "chore: adopt Mill delivery contracts",
+      planned.files,
+      input.signal,
+    );
+    await git(root, ["worktree", "remove", "--force", temporary]);
+    return {
+      branch,
+      commit,
+      planDigest: planned.approvalDigest,
+      baseline: "unverified",
+    };
+  } catch (error) {
+    try {
+      await git(root, ["worktree", "remove", "--force", temporary]);
+    } catch {
+      await rm(temporary, { recursive: true, force: true });
+      await git(root, ["worktree", "prune", "--expire", "now"]);
+    }
+    try {
+      await git(root, ["update-ref", "-d", `refs/heads/${branch}`, baseCommit]);
+    } catch {
+      // Preserve the branch when it contains a committed result or no longer
+      // equals the exact disposable base.
+    }
+    throw error;
+  }
+}
+
+export async function applyAdoptionIntegration(
+  input: IntegrationOptions & {
+    repositoryRoot: string;
+    planApprovalDigest: string;
+    attended: boolean;
+    signal?: AbortSignal;
+  },
+): Promise<{
+  branch: string;
+  commit: string;
+  planDigest: string;
+  baseline: "unverified";
+}> {
+  const signals = processCancellationScope(input.signal);
+  try {
+    return await applyAdoptionIntegrationWithSignal({
+      ...input,
+      signal: signals.signal,
+    });
+  } finally {
+    signals.dispose();
+  }
+}
+
+export async function planDetach(root: string): Promise<{
+  mode: "manual";
+  remove: string[];
+  retain: string[];
+  changed: string[];
+  stateAction: string;
+}> {
+  const source = await safeReadText(root, "mill.lock", 2 * 1024 * 1024);
+  let raw: unknown;
+  try {
+    raw = parseYaml(source);
+  } catch (error) {
+    throw new MillError(
+      "INVALID_MILL_LOCK",
+      "mill.lock is invalid YAML.",
+      ExitCode.data,
+      {
+        cause: String(error),
+      },
+    );
+  }
+  const lock = millLockSchema.parse(raw);
+  if (lock.integration === undefined) {
+    throw new MillError(
+      "DETACH_METADATA_UNAVAILABLE",
+      "This integration predates ownership metadata; use documented manual disposition.",
+      ExitCode.configuration,
+    );
+  }
+  const remove: string[] = ["mill.lock"];
+  const retain: string[] = [];
+  const changed: string[] = [];
+  for (const file of lock.integration.files) {
+    const current = await existingFile(root, file.path);
+    if (current?.digest !== file.installedDigest) {
+      changed.push(file.path);
+    }
+    if (file.ownership === "mill_only") remove.push(file.path);
+    else retain.push(file.path);
+  }
+  return {
+    mode: "manual",
+    remove: [...new Set(remove)].sort(),
+    retain: [...new Set(retain)].sort(),
+    changed: [...new Set(changed)].sort(),
+    stateAction:
+      "Run millctl state purge only after every local run is reviewed or terminal.",
+  };
+}
diff --git a/src/repository/scan.ts b/src/repository/scan.ts
index 4b38971..2e10d95 100644
--- a/src/repository/scan.ts
+++ b/src/repository/scan.ts
@@ -29,7 +29,12 @@ const documentationNames = new Set([
   "README.md",
   "WORKFLOW.md",
 ]);
-const secretReferenceNames = [/^\.env(?:\.|$)/u, /secret/iu, /credential/iu];
+const secretReferenceNames = [
+  /^\.env(?:\.|$)/u,
+  /^\.npmrc$/u,
+  /secret/iu,
+  /credential/iu,
+];
 const maximumEntries = 5_000;
 const maximumDepth = 8;
 
diff --git a/src/runtime/dependencies.ts b/src/runtime/dependencies.ts
new file mode 100644
index 0000000..5419051
--- /dev/null
+++ b/src/runtime/dependencies.ts
@@ -0,0 +1,777 @@
+import { constants } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import {
+  chmod,
+  copyFile,
+  lstat,
+  mkdir,
+  mkdtemp,
+  open,
+  opendir,
+  readFile,
+  readlink,
+  realpath,
+  rename,
+  rm,
+  stat,
+  symlink,
+  writeFile,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { findTrustedExecutable } from "../doctor.js";
+import { ExitCode, MillError } from "../errors.js";
+import { isWithin } from "../security/safe-path.js";
+import type { MillConfig } from "./inputs.js";
+import {
+  processCancellationScope,
+  runProcess,
+  type ProcessResult,
+} from "./process.js";
+import { acquireExclusiveLease } from "./lease.js";
+
+interface DependencyIdentity {
+  schemaVersion: "1";
+  image: string;
+  manager: "npm";
+  registry: "https://registry.npmjs.org";
+  targetPath: string;
+  locks: { path: string; digest: string }[];
+}
+
+interface DependencyMarker extends DependencyIdentity {
+  treeDigest: string;
+}
+
+export interface DependencyPreparationResult {
+  directory: string;
+  reused: boolean;
+  network: string;
+}
+
+function digest(value: Buffer): string {
+  return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+
+function validSha512Integrity(value: unknown): boolean {
+  if (typeof value !== "string") return false;
+  const match = /^sha512-([A-Za-z0-9+/]+={0,2})$/u.exec(value);
+  const encoded = match?.[1];
+  if (encoded === undefined) return false;
+  const decoded = Buffer.from(encoded, "base64");
+  return (
+    decoded.byteLength === 64 &&
+    decoded.toString("base64").replace(/=+$/u, "") ===
+      encoded.replace(/=+$/u, "")
+  );
+}
+
+async function dependencyIdentity(
+  root: string,
+  config: MillConfig,
+): Promise<{
+  key: string;
+  marker: DependencyIdentity;
+}> {
+  const dependencies = config.verifier?.dependencies;
+  if (dependencies === undefined || config.verifier === undefined) {
+    throw new MillError(
+      "VERIFIER_DEPENDENCIES_NOT_CONFIGURED",
+      "This repository does not declare a verifier dependency snapshot.",
+      ExitCode.configuration,
+    );
+  }
+  const canonicalRoot = await realpath(root);
+  const locks = await Promise.all(
+    dependencies.lockPaths.map(async (relative) => {
+      let absolute: string;
+      try {
+        absolute = await realpath(path.resolve(canonicalRoot, relative));
+      } catch (error) {
+        throw new MillError(
+          "VERIFIER_DEPENDENCY_LOCK_INVALID",
+          "A dependency lock input is missing or inaccessible.",
+          ExitCode.configuration,
+          { path: relative, cause: String(error) },
+        );
+      }
+      if (
+        !isWithin(canonicalRoot, absolute) ||
+        !(await stat(absolute)).isFile()
+      ) {
+        throw new MillError(
+          "VERIFIER_DEPENDENCY_LOCK_INVALID",
+          "A dependency lock input is not a regular in-repository file.",
+          ExitCode.configuration,
+          { path: relative },
+        );
+      }
+      return { path: relative, digest: digest(await readFile(absolute)) };
+    }),
+  );
+  const marker: DependencyIdentity = {
+    schemaVersion: "1",
+    image: config.verifier.image,
+    manager: dependencies.manager,
+    registry: dependencies.registry,
+    targetPath: dependencies.targetPath,
+    locks,
+  };
+  const key = createHash("sha256")
+    .update(JSON.stringify(marker), "utf8")
+    .digest("hex");
+  return { key, marker };
+}
+
+const maximumDependencyEntries = 250_000;
+
+function sameFileIdentity(
+  left: Awaited<ReturnType<typeof lstat>>,
+  right: Awaited<ReturnType<typeof lstat>>,
+): boolean {
+  return (
+    left.dev === right.dev &&
+    left.ino === right.ino &&
+    left.size === right.size &&
+    left.mtimeMs === right.mtimeMs &&
+    left.ctimeMs === right.ctimeMs
+  );
+}
+
+async function regularFileDigest(file: string): Promise<string> {
+  const before = await lstat(file);
+  if (!before.isFile() || before.isSymbolicLink()) {
+    throw new MillError(
+      "DEPENDENCY_TREE_INVALID",
+      "The dependency tree contains an unsafe file type.",
+      ExitCode.data,
+    );
+  }
+  const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const opened = await handle.stat();
+    if (!sameFileIdentity(before, opened)) {
+      throw new MillError(
+        "DEPENDENCY_TREE_CHANGED",
+        "The dependency tree changed while it was inspected.",
+        ExitCode.temporary,
+      );
+    }
+    const hash = createHash("sha256");
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    let position = 0;
+    for (;;) {
+      const { bytesRead } = await handle.read(
+        buffer,
+        0,
+        buffer.byteLength,
+        position,
+      );
+      if (bytesRead === 0) break;
+      hash.update(buffer.subarray(0, bytesRead));
+      position += bytesRead;
+    }
+    const after = await handle.stat();
+    if (!sameFileIdentity(opened, after)) {
+      throw new MillError(
+        "DEPENDENCY_TREE_CHANGED",
+        "The dependency tree changed while it was inspected.",
+        ExitCode.temporary,
+      );
+    }
+    return `sha256:${hash.digest("hex")}`;
+  } finally {
+    await handle.close();
+  }
+}
+
+async function dependencyTreeDigest(directory: string): Promise<string> {
+  const canonicalRoot = await realpath(directory);
+  const aggregate = createHash("sha256");
+  let entriesVisited = 0;
+  const record = (value: readonly (string | number)[]): void => {
+    aggregate.update(JSON.stringify(value), "utf8");
+    aggregate.update("\n", "utf8");
+  };
+  const walk = async (relative: string): Promise<void> => {
+    const absolute = path.join(canonicalRoot, relative);
+    const before = await lstat(absolute);
+    if (!before.isDirectory() || before.isSymbolicLink()) {
+      throw new MillError(
+        "DEPENDENCY_TREE_INVALID",
+        "The dependency tree contains an unsafe directory type.",
+        ExitCode.data,
+        { path: relative },
+      );
+    }
+    record(["directory", relative, before.mode & 0o111]);
+    const handle = await opendir(absolute);
+    const entries = [];
+    for await (const entry of handle) entries.push(entry);
+    entries.sort((left, right) =>
+      Buffer.compare(Buffer.from(left.name), Buffer.from(right.name)),
+    );
+    for (const entry of entries) {
+      entriesVisited += 1;
+      if (entriesVisited > maximumDependencyEntries) {
+        throw new MillError(
+          "DEPENDENCY_TREE_TOO_LARGE",
+          "The dependency tree exceeds its bounded entry budget.",
+          ExitCode.data,
+          { maximumEntries: maximumDependencyEntries },
+        );
+      }
+      const child =
+        relative === "" ? entry.name : path.join(relative, entry.name);
+      const childAbsolute = path.join(canonicalRoot, child);
+      const information = await lstat(childAbsolute);
+      if (information.isDirectory() && !information.isSymbolicLink()) {
+        await walk(child);
+      } else if (information.isFile() && !information.isSymbolicLink()) {
+        record([
+          "file",
+          child,
+          information.mode & 0o111,
+          information.size,
+          await regularFileDigest(childAbsolute),
+        ]);
+      } else if (information.isSymbolicLink()) {
+        const target = await readlink(childAbsolute);
+        const resolvedTarget = path.resolve(
+          path.dirname(childAbsolute),
+          target,
+        );
+        if (
+          path.isAbsolute(target) ||
+          !isWithin(canonicalRoot, resolvedTarget) ||
+          !isWithin(canonicalRoot, await realpath(childAbsolute))
+        ) {
+          throw new MillError(
+            "DEPENDENCY_TREE_INVALID",
+            "The dependency tree contains a symbolic link outside its root.",
+            ExitCode.data,
+            { path: child },
+          );
+        }
+        record(["symlink", child, target]);
+      } else {
+        throw new MillError(
+          "DEPENDENCY_TREE_INVALID",
+          "The dependency tree contains an unsupported filesystem entry.",
+          ExitCode.data,
+          { path: child },
+        );
+      }
+    }
+    const after = await lstat(absolute);
+    if (!sameFileIdentity(before, after)) {
+      throw new MillError(
+        "DEPENDENCY_TREE_CHANGED",
+        "The dependency tree changed while it was inspected.",
+        ExitCode.temporary,
+        { path: relative },
+      );
+    }
+  };
+  await walk("");
+  return `sha256:${aggregate.digest("hex")}`;
+}
+
+async function markerMatches(
+  directory: string,
+  expected: DependencyIdentity,
+): Promise<boolean> {
+  try {
+    const [source, modules] = await Promise.all([
+      readFile(path.join(directory, "marker.json"), "utf8"),
+      lstat(path.join(directory, "node_modules")),
+    ]);
+    if (!modules.isDirectory() || modules.isSymbolicLink()) return false;
+    const parsed = JSON.parse(source) as Partial<DependencyMarker>;
+    if (
+      parsed.schemaVersion !== "1" ||
+      typeof parsed.image !== "string" ||
+      parsed.manager !== "npm" ||
+      parsed.registry !== "https://registry.npmjs.org" ||
+      typeof parsed.targetPath !== "string" ||
+      !Array.isArray(parsed.locks) ||
+      !/^sha256:[0-9a-f]{64}$/u.test(parsed.treeDigest ?? "")
+    ) {
+      return false;
+    }
+    const claimedIdentity: DependencyIdentity = {
+      schemaVersion: parsed.schemaVersion,
+      image: parsed.image,
+      manager: parsed.manager,
+      registry: parsed.registry,
+      targetPath: parsed.targetPath,
+      locks: parsed.locks,
+    };
+    return (
+      JSON.stringify(claimedIdentity) === JSON.stringify(expected) &&
+      parsed.treeDigest ===
+        (await dependencyTreeDigest(path.join(directory, "node_modules")))
+    );
+  } catch {
+    return false;
+  }
+}
+
+async function validateNpmLock(
+  root: string,
+  lockPaths: readonly string[],
+): Promise<void> {
+  const lockPath = "package-lock.json";
+  if (!lockPaths.includes(lockPath)) {
+    throw new MillError(
+      "NPM_LOCK_REQUIRED",
+      "npm dependency preparation requires the root package-lock.json consumed by npm ci as a bound lock input.",
+      ExitCode.configuration,
+    );
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(await readFile(path.join(root, lockPath), "utf8"));
+  } catch (error) {
+    throw new MillError(
+      "NPM_LOCK_INVALID",
+      "The bound package-lock.json is not valid JSON.",
+      ExitCode.configuration,
+      { path: lockPath, cause: String(error) },
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new MillError(
+      "NPM_LOCK_INVALID",
+      "The bound package-lock.json must be an object.",
+      ExitCode.configuration,
+      { path: lockPath },
+    );
+  }
+  const packages = (parsed as { packages?: unknown }).packages;
+  if (
+    typeof packages !== "object" ||
+    packages === null ||
+    Array.isArray(packages)
+  ) {
+    throw new MillError(
+      "NPM_LOCK_INVALID",
+      "The bound package-lock.json must contain a packages object.",
+      ExitCode.configuration,
+      { path: lockPath },
+    );
+  }
+  for (const [packagePath, value] of Object.entries(packages)) {
+    if (packagePath === "") continue;
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+      throw new MillError(
+        "NPM_LOCK_SOURCE_UNTRUSTED",
+        "Every installable npm lock entry must be a structured integrity-bound source.",
+        ExitCode.configuration,
+        { packagePath },
+      );
+    }
+    const entry = value as {
+      resolved?: unknown;
+      integrity?: unknown;
+      link?: unknown;
+    };
+    if (
+      entry.link === true ||
+      typeof entry.resolved !== "string" ||
+      !validSha512Integrity(entry.integrity)
+    ) {
+      throw new MillError(
+        "NPM_LOCK_SOURCE_UNTRUSTED",
+        "Every installable npm package must include one SHA-512-bound HTTPS registry source; links and workspaces are unsupported.",
+        ExitCode.configuration,
+        { packagePath },
+      );
+    }
+    let resolved: URL;
+    try {
+      resolved = new URL(entry.resolved);
+    } catch {
+      throw new MillError(
+        "NPM_LOCK_SOURCE_UNTRUSTED",
+        "An npm lock entry has an invalid resolved source URL.",
+        ExitCode.configuration,
+        { packagePath },
+      );
+    }
+    if (
+      resolved.protocol !== "https:" ||
+      resolved.origin !== "https://registry.npmjs.org" ||
+      resolved.username !== "" ||
+      resolved.password !== "" ||
+      resolved.search !== "" ||
+      resolved.hash !== ""
+    ) {
+      throw new MillError(
+        "NPM_LOCK_SOURCE_UNTRUSTED",
+        "npm dependency preparation permits only credential-free, query-free, integrity-bound registry.npmjs.org sources.",
+        ExitCode.configuration,
+        { packagePath, origin: resolved.origin },
+      );
+    }
+  }
+}
+
+export async function dependencySnapshotDirectory(input: {
+  root: string;
+  stateDirectory: string;
+  config: MillConfig;
+}): Promise<string | undefined> {
+  if (input.config.verifier?.dependencies === undefined) return undefined;
+  const identity = await dependencyIdentity(input.root, input.config);
+  const directory = path.join(
+    input.stateDirectory,
+    "dependencies",
+    identity.key,
+  );
+  if (!(await markerMatches(directory, identity.marker))) {
+    throw new MillError(
+      "VERIFIER_DEPENDENCIES_UNAVAILABLE",
+      "The exact dependency snapshot is absent. Run millctl dependencies prepare --attended.",
+      ExitCode.unavailable,
+      { snapshot: identity.key },
+    );
+  }
+  return directory;
+}
+
+async function mountSource(root: string): Promise<{
+  source: string;
+  dispose(): Promise<void>;
+}> {
+  if (!root.includes(",")) {
+    return { source: root, dispose: () => Promise.resolve() };
+  }
+  const parent = await mkdtemp(path.join(tmpdir(), "mill-deps-bind-"));
+  await chmod(parent, 0o700);
+  const source = path.join(parent, "workspace");
+  await symlink(root, source, "dir");
+  if ((await realpath(source)) !== root) {
+    await rm(parent, { recursive: true, force: true });
+    throw new MillError(
+      "DEPENDENCY_MOUNT_ALIAS_INVALID",
+      "The dependency preparation bind alias is not exact.",
+      ExitCode.configuration,
+    );
+  }
+  return {
+    source,
+    dispose: () => rm(parent, { recursive: true, force: true }),
+  };
+}
+
+async function removeContainer(
+  docker: string,
+  root: string,
+  containerName: string,
+): Promise<void> {
+  const result = await runProcess({
+    executable: docker,
+    args: ["rm", "--force", "--volumes", containerName],
+    cwd: root,
+    env: { HOME: process.env.HOME, PATH: "/usr/bin:/bin:/usr/sbin:/sbin" },
+    deadlineMs: Date.now() + 15_000,
+    maxOutputBytes: 128 * 1024,
+  });
+  if (
+    result.timedOut ||
+    result.outputExceeded ||
+    result.cancelled ||
+    (result.exitCode !== 0 && !/no such container/iu.test(result.stderr))
+  ) {
+    throw new MillError(
+      "DEPENDENCY_CONTAINER_CLEANUP_FAILED",
+      "Mill could not remove the exact dependency-preparation container.",
+      ExitCode.temporary,
+      { containerName },
+    );
+  }
+}
+
+async function prepareDependencySnapshotWithSignal(input: {
+  root: string;
+  stateDirectory: string;
+  config: MillConfig;
+  attended: boolean;
+  signal: AbortSignal;
+}): Promise<DependencyPreparationResult> {
+  if (!input.attended) {
+    throw new MillError(
+      "ATTENDANCE_REQUIRED",
+      "Dependency preparation requires attended approval for registry network access.",
+      ExitCode.configuration,
+    );
+  }
+  if (input.config.trustCeiling === "inspect") {
+    throw new MillError(
+      "BUILD_NOT_AUTHORIZED",
+      "mill.yaml trust ceiling does not authorize dependency preparation.",
+      ExitCode.configuration,
+    );
+  }
+  const dependencies = input.config.verifier?.dependencies;
+  const image = input.config.verifier?.image;
+  if (dependencies === undefined || image === undefined) {
+    throw new MillError(
+      "VERIFIER_DEPENDENCIES_NOT_CONFIGURED",
+      "This repository does not declare a verifier dependency snapshot.",
+      ExitCode.configuration,
+    );
+  }
+  if (input.signal.aborted) {
+    throw new MillError(
+      "DEPENDENCY_PREPARATION_CANCELLED",
+      "Dependency preparation was cancelled before execution.",
+      ExitCode.temporary,
+    );
+  }
+  const parent = path.join(input.stateDirectory, "dependencies");
+  await mkdir(parent, { recursive: true, mode: 0o700 });
+  await chmod(parent, 0o700);
+  const temporary = await mkdtemp(path.join(parent, ".prepare-"));
+  await chmod(temporary, 0o700);
+  let preparationLease:
+    Awaited<ReturnType<typeof acquireExclusiveLease>> | undefined;
+  try {
+    const canonicalRoot = await realpath(input.root);
+    for (const relative of dependencies.lockPaths) {
+      const sourceFile = await realpath(path.resolve(canonicalRoot, relative));
+      if (
+        !isWithin(canonicalRoot, sourceFile) ||
+        !(await stat(sourceFile)).isFile()
+      ) {
+        throw new MillError(
+          "VERIFIER_DEPENDENCY_LOCK_INVALID",
+          "A dependency lock input is not a regular in-repository file.",
+          ExitCode.configuration,
+          { path: relative },
+        );
+      }
+      const destinationFile = path.join(temporary, relative);
+      await mkdir(path.dirname(destinationFile), {
+        recursive: true,
+        mode: 0o700,
+      });
+      await copyFile(sourceFile, destinationFile);
+    }
+    const identity = await dependencyIdentity(temporary, input.config);
+    await validateNpmLock(temporary, dependencies.lockPaths);
+    const destination = path.join(parent, identity.key);
+    preparationLease = await acquireExclusiveLease({
+      path: `${destination}.lease.sqlite3`,
+      activeCode: "DEPENDENCY_PREPARATION_ACTIVE",
+      activeMessage:
+        "Another process owns preparation of this exact dependency snapshot.",
+      unavailableCode: "DEPENDENCY_PREPARATION_LEASE_UNAVAILABLE",
+      unavailableMessage:
+        "The exact dependency snapshot lease could not be acquired safely.",
+    });
+    if (await markerMatches(destination, identity.marker)) {
+      return {
+        directory: destination,
+        reused: true,
+        network: "none; exact dependency snapshot already present",
+      };
+    }
+    const staleDestination = await lstat(destination).catch(
+      (error: unknown) => {
+        if (
+          error instanceof Error &&
+          "code" in error &&
+          error.code === "ENOENT"
+        ) {
+          return undefined;
+        }
+        throw error;
+      },
+    );
+    if (staleDestination !== undefined) {
+      await rm(destination, { recursive: true, force: true });
+    }
+    const docker = await findTrustedExecutable("docker", input.root);
+    if (docker === undefined) {
+      throw new MillError(
+        "OCI_RUNTIME_UNAVAILABLE",
+        "A trusted Docker executable is required to prepare recipe dependencies.",
+        ExitCode.unavailable,
+      );
+    }
+    const inspection = await runProcess({
+      executable: docker,
+      args: ["image", "inspect", image],
+      cwd: input.root,
+      env: { HOME: process.env.HOME, PATH: "/usr/bin:/bin:/usr/sbin:/sbin" },
+      deadlineMs: Date.now() + 15_000,
+      maxOutputBytes: 256 * 1024,
+      signal: input.signal,
+    });
+    if (inspection.exitCode !== 0) {
+      throw new MillError(
+        "VERIFIER_IMAGE_UNAVAILABLE",
+        "The exact verifier image is not local; Mill will not pull it implicitly.",
+        ExitCode.unavailable,
+        { image },
+      );
+    }
+    const canonicalTemporary = await realpath(temporary);
+    const mount = await mountSource(canonicalTemporary);
+    const containerName = `mill-deps-${randomUUID()}`;
+    const uid = process.getuid?.() ?? 1000;
+    const gid = process.getgid?.() ?? 1000;
+    let result: ProcessResult;
+    try {
+      result = await runProcess({
+        executable: docker,
+        args: [
+          "run",
+          "--pull",
+          "never",
+          "--name",
+          containerName,
+          "--label",
+          "dev.mill.owner=dependency-preparation",
+          "--network",
+          "bridge",
+          "--read-only",
+          "--cap-drop",
+          "ALL",
+          "--security-opt",
+          "no-new-privileges",
+          "--pids-limit",
+          "256",
+          "--memory",
+          "2g",
+          "--cpus",
+          "2",
+          "--tmpfs",
+          "/tmp:rw,nosuid,nodev,size=512m",
+          "--mount",
+          `type=bind,source=${mount.source},target=/workspace`,
+          "--workdir",
+          "/workspace",
+          "--user",
+          `${uid}:${gid}`,
+          "--env",
+          "HOME=/tmp",
+          "--env",
+          `npm_config_registry=${dependencies.registry}`,
+          "--env",
+          "npm_config_ignore_scripts=true",
+          "--env",
+          "npm_config_audit=false",
+          "--env",
+          "npm_config_fund=false",
+          "--entrypoint",
+          "npm",
+          image,
+          "ci",
+          "--ignore-scripts",
+          "--audit=false",
+          "--fund=false",
+        ],
+        cwd: input.root,
+        env: { HOME: process.env.HOME, PATH: "/usr/bin:/bin:/usr/sbin:/sbin" },
+        deadlineMs: Date.now() + 10 * 60_000,
+        maxOutputBytes: 2 * 1024 * 1024,
+        signal: input.signal,
+      });
+    } finally {
+      try {
+        await removeContainer(docker, input.root, containerName);
+      } finally {
+        await mount.dispose();
+      }
+    }
+    if (
+      result.exitCode !== 0 ||
+      result.timedOut ||
+      result.outputExceeded ||
+      result.cancelled
+    ) {
+      throw new MillError(
+        "DEPENDENCY_PREPARATION_FAILED",
+        "The exact dependency snapshot could not be prepared.",
+        ExitCode.unavailable,
+        { exitCode: result.exitCode, stderr: result.stderr.slice(0, 2_000) },
+      );
+    }
+    const modules = await lstat(path.join(temporary, "node_modules")).catch(
+      () => undefined,
+    );
+    if (
+      modules === undefined ||
+      !modules.isDirectory() ||
+      modules.isSymbolicLink()
+    ) {
+      throw new MillError(
+        "DEPENDENCY_OUTPUT_INVALID",
+        "Dependency preparation completed without a regular node_modules directory.",
+        ExitCode.unavailable,
+      );
+    }
+    const completedIdentity = await dependencyIdentity(temporary, input.config);
+    if (
+      completedIdentity.key !== identity.key ||
+      JSON.stringify(completedIdentity.marker) !==
+        JSON.stringify(identity.marker)
+    ) {
+      throw new MillError(
+        "VERIFIER_DEPENDENCY_LOCK_DRIFT",
+        "Frozen dependency lock inputs changed during preparation.",
+        ExitCode.configuration,
+      );
+    }
+    const marker: DependencyMarker = {
+      ...identity.marker,
+      treeDigest: await dependencyTreeDigest(
+        path.join(temporary, "node_modules"),
+      ),
+    };
+    await writeFile(
+      path.join(temporary, "marker.json"),
+      `${JSON.stringify(marker)}\n`,
+      { encoding: "utf8", flag: "wx", mode: 0o600 },
+    );
+    try {
+      await rename(temporary, destination);
+    } catch (error) {
+      if (!(await markerMatches(destination, identity.marker))) throw error;
+    }
+    return {
+      directory: destination,
+      reused: false,
+      network:
+        "HTTPS to https://registry.npmjs.org through the exact verifier image; lifecycle scripts disabled",
+    };
+  } finally {
+    try {
+      await rm(temporary, { recursive: true, force: true });
+    } finally {
+      await preparationLease?.release();
+    }
+  }
+}
+
+export async function prepareDependencySnapshot(input: {
+  root: string;
+  stateDirectory: string;
+  config: MillConfig;
+  attended: boolean;
+  signal?: AbortSignal;
+}): Promise<DependencyPreparationResult> {
+  const signals = processCancellationScope(input.signal);
+  try {
+    return await prepareDependencySnapshotWithSignal({
+      ...input,
+      signal: signals.signal,
+    });
+  } finally {
+    signals.dispose();
+  }
+}
diff --git a/src/runtime/inputs.ts b/src/runtime/inputs.ts
index 5e7c05c..88cfc43 100644
--- a/src/runtime/inputs.ts
+++ b/src/runtime/inputs.ts
@@ -179,12 +179,34 @@ export async function loadRuntimeInputs(
     ...Object.values(config.commands).flatMap(
       (command) => command.controlPaths,
     ),
+    ...(config.verifier?.dependencies?.lockPaths ?? []),
+    ...(config.verifier?.dependencies === undefined
+      ? []
+      : [config.verifier.dependencies.targetPath]),
+    ...Object.values(config.commands).flatMap(
+      (command) => command.writablePaths ?? [],
+    ),
   ]) {
     validateRelative(candidate.replace(/\/\*\*$/u, ""), "Runtime path");
   }
   for (const candidate of [...task.allowedPaths, ...config.sensitivePaths]) {
     validatePathPattern(candidate, "Runtime path pattern");
   }
+  const dependencyTarget = config.verifier?.dependencies?.targetPath;
+  if (dependencyTarget !== undefined) {
+    for (const command of Object.values(config.commands)) {
+      for (const writablePath of command.writablePaths ?? []) {
+        if (patternsOverlap(dependencyTarget, writablePath)) {
+          throw new MillError(
+            "VERIFIER_MOUNT_OVERLAP",
+            "A verifier dependency target cannot overlap a writable scratch mount.",
+            ExitCode.configuration,
+            { dependencyTarget, writablePath },
+          );
+        }
+      }
+    }
+  }
   for (const commandId of task.commandIds) {
     if (!Object.hasOwn(config.commands, commandId)) {
       throw new MillError(
@@ -197,12 +219,14 @@ export async function loadRuntimeInputs(
   const selectedControlPaths = task.commandIds.flatMap(
     (commandId) => config.commands[commandId]?.controlPaths ?? [],
   );
+  const dependencyLockPaths = config.verifier?.dependencies?.lockPaths ?? [];
   const protectedPaths = [
     "mill.yaml",
     taskPath,
     ...Object.values(task.authority).map((reference) => reference.path),
     ...task.contextPaths,
     ...selectedControlPaths,
+    ...dependencyLockPaths,
     ".gitattributes",
     ".gitmodules",
   ].filter((candidate, index, values) => values.indexOf(candidate) === index);
diff --git a/src/runtime/lease.ts b/src/runtime/lease.ts
new file mode 100644
index 0000000..5e64003
--- /dev/null
+++ b/src/runtime/lease.ts
@@ -0,0 +1,70 @@
+import { chmod } from "node:fs/promises";
+import { DatabaseSync } from "node:sqlite";
+
+import { ExitCode, MillError } from "../errors.js";
+
+export interface ExclusiveLease {
+  release(): Promise<void>;
+}
+
+export async function acquireExclusiveLease(input: {
+  path: string;
+  activeCode: string;
+  activeMessage: string;
+  unavailableCode: string;
+  unavailableMessage: string;
+}): Promise<ExclusiveLease> {
+  let database: DatabaseSync | undefined;
+  try {
+    database = new DatabaseSync(input.path, {
+      timeout: 0,
+      allowExtension: false,
+      enableDoubleQuotedStringLiterals: false,
+    });
+    database.exec(`
+      PRAGMA journal_mode = DELETE;
+      PRAGMA synchronous = FULL;
+      CREATE TABLE IF NOT EXISTS lease_anchor (
+        singleton INTEGER PRIMARY KEY CHECK(singleton = 1)
+      ) STRICT;
+      BEGIN EXCLUSIVE;
+    `);
+    await chmod(input.path, 0o600);
+  } catch (error) {
+    try {
+      database?.close();
+    } catch {
+      // Preserve the acquisition error.
+    }
+    if (
+      error instanceof Error &&
+      "errcode" in error &&
+      (error.errcode === 5 || error.errcode === 6)
+    ) {
+      throw new MillError(
+        input.activeCode,
+        input.activeMessage,
+        ExitCode.temporary,
+      );
+    }
+    throw new MillError(
+      input.unavailableCode,
+      input.unavailableMessage,
+      ExitCode.io,
+      { cause: String(error) },
+    );
+  }
+  let released = false;
+  return {
+    release(): Promise<void> {
+      if (released) return Promise.resolve();
+      released = true;
+      try {
+        database.exec("ROLLBACK");
+      } finally {
+        database.close();
+      }
+      return Promise.resolve();
+    },
+  };
+}
diff --git a/src/runtime/lifecycle.ts b/src/runtime/lifecycle.ts
index 11433ac..f4742c0 100644
--- a/src/runtime/lifecycle.ts
+++ b/src/runtime/lifecycle.ts
@@ -51,8 +51,13 @@ import {
   type RunRecord,
 } from "./state.js";
 import { createWorkerInvocation } from "./worker.js";
+import { dependencySnapshotDirectory } from "./dependencies.js";
 import { verifyDeclaredCommands, type ValidationEvidence } from "./verifier.js";
-import { processIdentityStatus, type ActiveProcess } from "./process.js";
+import {
+  processCancellationScope,
+  processIdentityStatus,
+  type ActiveProcess,
+} from "./process.js";
 import { MILL_VERSION } from "../version.js";
 
 interface RunContext {
@@ -108,23 +113,6 @@ function baselineApprovalDigest(input: {
   });
 }
 
-function lifecycleSignals(): {
-  signal: AbortSignal;
-  dispose(): void;
-} {
-  const controller = new AbortController();
-  const abort = (): void => controller.abort();
-  process.once("SIGINT", abort);
-  process.once("SIGTERM", abort);
-  return {
-    signal: controller.signal,
-    dispose(): void {
-      process.removeListener("SIGINT", abort);
-      process.removeListener("SIGTERM", abort);
-    },
-  };
-}
-
 function assertBuildAuthorized(inputs: RuntimeInputs): void {
   if (inputs.config.trustCeiling === "inspect") {
     throw new MillError(
@@ -565,7 +553,7 @@ export async function startLocalRun(input: {
   let lease: Awaited<ReturnType<typeof acquireWriterLease>> | undefined;
   let provisionalWorktree: string | undefined;
   let provisionalBranch: string | undefined;
-  const signals = lifecycleSignals();
+  const signals = processCancellationScope();
   try {
     assertNewRunTaskContract(inputs.task);
     const qualified = await qualifyRepositoryForBuild(
@@ -587,6 +575,23 @@ export async function startLocalRun(input: {
       }
     }
     lease = await acquireWriterLease(store);
+    const activeRuns = store
+      .runs()
+      .filter((candidate) => !isTerminalRun(candidate.status));
+    if (activeRuns.length > 0) {
+      throw new MillError(
+        "ACTIVE_OUTCOME_CONFLICT",
+        "A new run cannot be created while another nonterminal lifecycle exists.",
+        ExitCode.configuration,
+        {
+          activeRuns: activeRuns.map((candidate) => ({
+            runId: candidate.id,
+            taskId: candidate.taskId,
+            status: candidate.status,
+          })),
+        },
+      );
+    }
     if (
       !store.hasBaselineQualification({
         approvalDigest: input.approvalDigest,
@@ -740,7 +745,7 @@ export async function qualifyBaseline(input: {
   const inputs = await loadRuntimeInputs(input.root, input.taskPath);
   assertNewRunTaskContract(inputs.task);
   assertBuildAuthorized(inputs);
-  const signals = lifecycleSignals();
+  const signals = processCancellationScope();
   const signal =
     input.signal === undefined
       ? signals.signal
@@ -767,8 +772,14 @@ export async function qualifyBaseline(input: {
         destination,
         qualified.baseCommit,
       );
+      const dependencyRoot = await dependencySnapshotDirectory({
+        root: input.root,
+        stateDirectory: store.directory,
+        config: inputs.config,
+      });
       const evidence = await verifyDeclaredCommands({
         root: destination,
+        ...(dependencyRoot === undefined ? {} : { dependencyRoot }),
         candidateCommit: qualified.baseCommit,
         config: inputs.config,
         task: inputs.task,
@@ -819,7 +830,7 @@ export async function verifyRun(input: {
   const context = await openRunContext(input.root, input.taskPath);
   const { inputs, store } = context;
   let lease: Awaited<ReturnType<typeof acquireWriterLease>> | undefined;
-  const signals = lifecycleSignals();
+  const signals = processCancellationScope();
   try {
     lease = await acquireWriterLease(store);
     const run = store.getRun(input.runId);
@@ -833,8 +844,14 @@ export async function verifyRun(input: {
     const deadlineMs = persistedRunDeadline(run);
     const candidate = await assertRunBindings(input.root, run, inputs);
     const hooks = lifecycleHooks(store, run.id);
+    const dependencyRoot = await dependencySnapshotDirectory({
+      root: input.root,
+      stateDirectory: store.directory,
+      config: inputs.config,
+    });
     const evidence = await verifyDeclaredCommands({
       root: candidate.worktree,
+      ...(dependencyRoot === undefined ? {} : { dependencyRoot }),
       candidateCommit: candidate.commit,
       config: inputs.config,
       task: inputs.task,
@@ -889,7 +906,7 @@ export async function reviewRun(input: {
   const context = await openRunContext(input.root, input.taskPath);
   const { inputs, store } = context;
   let lease: Awaited<ReturnType<typeof acquireWriterLease>> | undefined;
-  const signals = lifecycleSignals();
+  const signals = processCancellationScope();
   try {
     lease = await acquireWriterLease(store);
     let run = store.getRun(input.runId);
@@ -1018,7 +1035,7 @@ export async function resumeRun(input: {
   const context = await openRunContext(input.root, input.taskPath);
   const { inputs, store } = context;
   let lease: Awaited<ReturnType<typeof acquireWriterLease>> | undefined;
-  const signals = lifecycleSignals();
+  const signals = processCancellationScope();
   try {
     lease = await acquireWriterLease(store);
     let run = store.getRun(input.runId);
@@ -1326,6 +1343,19 @@ export async function runStatus(input: {
   }
 }
 
+export async function runInventory(input: {
+  root: string;
+}): Promise<PublicRunRecord[]> {
+  const config = await loadMillConfig(input.root);
+  const commonDirectory = await commonGitDirectory(input.root);
+  const store = await StateStore.open(config.repositoryId, commonDirectory);
+  try {
+    return store.runs().map(publicRunRecord);
+  } finally {
+    store.close();
+  }
+}
+
 export async function stateBackup(input: { root: string }): Promise<string> {
   const config = await loadMillConfig(input.root);
   const commonDirectory = await commonGitDirectory(input.root);
diff --git a/src/runtime/process.ts b/src/runtime/process.ts
index 37c5fd2..cbd8532 100644
--- a/src/runtime/process.ts
+++ b/src/runtime/process.ts
@@ -37,6 +37,30 @@ export interface ProcessResult {
   cancelled: boolean;
 }
 
+export interface ProcessCancellationScope {
+  signal: AbortSignal;
+  dispose(): void;
+}
+
+export function processCancellationScope(
+  parent?: AbortSignal,
+): ProcessCancellationScope {
+  const controller = new AbortController();
+  const abort = (): void => controller.abort();
+  process.once("SIGINT", abort);
+  process.once("SIGTERM", abort);
+  parent?.addEventListener("abort", abort, { once: true });
+  if (parent?.aborted === true) abort();
+  return {
+    signal: controller.signal,
+    dispose(): void {
+      process.removeListener("SIGINT", abort);
+      process.removeListener("SIGTERM", abort);
+      parent?.removeEventListener("abort", abort);
+    },
+  };
+}
+
 function terminate(pid: number, signal: NodeJS.Signals): void {
   try {
     if (process.platform === "win32") {
diff --git a/src/runtime/repository.ts b/src/runtime/repository.ts
index 57496b5..26c817e 100644
--- a/src/runtime/repository.ts
+++ b/src/runtime/repository.ts
@@ -401,6 +401,7 @@ export async function qualifyRepositoryForBuild(
   baseRef: string,
   sensitivePatterns: readonly string[] = [],
 ): Promise<{ baseCommit: string; commonDirectory: string }> {
+  await assertVisibleIndexState(root);
   const scan = await scanRepository(root);
   if (
     scan.gitConfigHazards.length > 0 ||
@@ -526,7 +527,7 @@ async function candidateStatus(worktree: string): Promise<string> {
   return `${status}${ignored}`;
 }
 
-async function assertVisibleIndexState(worktree: string): Promise<void> {
+export async function assertVisibleIndexState(worktree: string): Promise<void> {
   const entries = (await git(worktree, ["ls-files", "-v", "-z"]))
     .split("\0")
     .filter((entry) => entry.length > 0);
diff --git a/src/runtime/state.ts b/src/runtime/state.ts
index f44e0eb..6ae9ec9 100644
--- a/src/runtime/state.ts
+++ b/src/runtime/state.ts
@@ -17,6 +17,7 @@ import { backup, DatabaseSync } from "node:sqlite";
 
 import { ExitCode, MillError } from "../errors.js";
 import { isWithin } from "../security/safe-path.js";
+import { acquireExclusiveLease, type ExclusiveLease } from "./lease.js";
 
 export type RunStatus =
   | "approved"
@@ -1423,67 +1424,20 @@ export class StateStore {
   }
 }
 
-export interface WriterLease {
-  release(): Promise<void>;
-}
+export type WriterLease = ExclusiveLease;
 
 export async function acquireWriterLease(
   store: StateStore,
 ): Promise<WriterLease> {
   const leasePath = path.join(store.directory, "writer-lease.sqlite3");
-  let database: DatabaseSync | undefined;
-  try {
-    database = new DatabaseSync(leasePath, {
-      timeout: 0,
-      allowExtension: false,
-      enableDoubleQuotedStringLiterals: false,
-    });
-    database.exec(`
-      PRAGMA journal_mode = DELETE;
-      PRAGMA synchronous = FULL;
-      CREATE TABLE IF NOT EXISTS lease_anchor (
-        singleton INTEGER PRIMARY KEY CHECK(singleton = 1)
-      ) STRICT;
-      BEGIN EXCLUSIVE;
-    `);
-    await chmod(leasePath, 0o600);
-  } catch (error) {
-    try {
-      database?.close();
-    } catch {
-      // Preserve the acquisition error.
-    }
-    if (
-      error instanceof Error &&
-      "errcode" in error &&
-      (error.errcode === 5 || error.errcode === 6)
-    ) {
-      throw new MillError(
-        "WRITER_ALREADY_ACTIVE",
-        "Another Mill writer is active for this repository.",
-        ExitCode.temporary,
-      );
-    }
-    throw new MillError(
-      "WRITER_LEASE_UNAVAILABLE",
+  return await acquireExclusiveLease({
+    path: leasePath,
+    activeCode: "WRITER_ALREADY_ACTIVE",
+    activeMessage: "Another Mill writer is active for this repository.",
+    unavailableCode: "WRITER_LEASE_UNAVAILABLE",
+    unavailableMessage:
       "The repository writer lease could not be acquired safely.",
-      ExitCode.io,
-      { cause: String(error) },
-    );
-  }
-  let released = false;
-  return {
-    release(): Promise<void> {
-      if (released) return Promise.resolve();
-      released = true;
-      try {
-        database.exec("ROLLBACK");
-      } finally {
-        database.close();
-      }
-      return Promise.resolve();
-    },
-  };
+  });
 }
 
 export async function restoreStateBackup(
diff --git a/src/runtime/verifier.ts b/src/runtime/verifier.ts
index 9978ff4..ca6dbcd 100644
--- a/src/runtime/verifier.ts
+++ b/src/runtime/verifier.ts
@@ -1,5 +1,17 @@
 import { createHash, randomUUID } from "node:crypto";
-import { chmod, mkdtemp, realpath, rm, stat, symlink } from "node:fs/promises";
+import {
+  chmod,
+  lstat,
+  mkdir,
+  mkdtemp,
+  opendir,
+  readFile,
+  realpath,
+  rm,
+  stat,
+  symlink,
+  writeFile,
+} from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
@@ -245,8 +257,151 @@ async function verifierMountSource(root: string): Promise<{
   }
 }
 
+async function removeWorkspaceSkeleton(skeleton: string): Promise<void> {
+  let lastError: unknown;
+  for (let attempt = 0; attempt < 20; attempt += 1) {
+    try {
+      await rm(skeleton, { recursive: true });
+      return;
+    } catch (error) {
+      lastError = error;
+      const code =
+        error instanceof Error && "code" in error ? error.code : undefined;
+      if (!new Set(["EACCES", "EBUSY", "ENOTEMPTY"]).has(String(code))) {
+        throw error;
+      }
+      await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+  }
+  throw new MillError(
+    "VERIFIER_WORKSPACE_CLEANUP_FAILED",
+    "Mill could not remove its protected verifier workspace skeleton.",
+    ExitCode.temporary,
+    { cause: String(lastError) },
+  );
+}
+
+async function workspaceMountPlan(
+  root: string,
+  declaredMountPaths: readonly string[],
+): Promise<{
+  mounts: string[];
+  dispose(): Promise<void>;
+}> {
+  const mountPaths = [...new Set(declaredMountPaths)].sort();
+  for (const mountPath of mountPaths) {
+    if (
+      mountPath.includes("/") ||
+      mountPath.includes(",") ||
+      mountPath === "."
+    ) {
+      throw new MillError(
+        "VERIFIER_MOUNT_PATH_UNSUPPORTED",
+        "Writable and dependency mount targets must be top-level repository directories.",
+        ExitCode.configuration,
+        { path: mountPath },
+      );
+    }
+    try {
+      await lstat(path.join(root, mountPath));
+      throw new MillError(
+        "VERIFIER_WRITABLE_PATH_OCCUPIED",
+        "A verifier mount would hide candidate content.",
+        ExitCode.configuration,
+        { path: mountPath },
+      );
+    } catch (error) {
+      if (
+        error instanceof MillError ||
+        !(error instanceof Error && "code" in error && error.code === "ENOENT")
+      ) {
+        throw error;
+      }
+    }
+  }
+  const source = await verifierMountSource(root);
+  const skeleton = await mkdtemp(path.join(tmpdir(), "mill-workspace-"));
+  await chmod(skeleton, 0o700);
+  try {
+    for (const mountPath of mountPaths) {
+      await mkdir(path.join(skeleton, mountPath), { mode: 0o700 });
+    }
+    const handle = await opendir(root);
+    const entries = [];
+    for await (const entry of handle) entries.push(entry);
+    if (entries.length > 256) {
+      throw new MillError(
+        "VERIFIER_WORKSPACE_ENTRY_LIMIT_EXCEEDED",
+        "The verifier workspace exceeds its top-level mount-entry limit.",
+        ExitCode.configuration,
+      );
+    }
+    const mounts = [
+      "--mount",
+      `type=bind,source=${skeleton},target=/workspace,readonly`,
+    ];
+    for (const entry of entries.sort((left, right) =>
+      left.name.localeCompare(right.name),
+    )) {
+      if (mountPaths.includes(entry.name)) continue;
+      if (entry.name.includes(",")) {
+        throw new MillError(
+          "VERIFIER_WORKSPACE_ENTRY_UNSUPPORTED",
+          "A top-level candidate entry contains a comma and cannot be bound safely.",
+          ExitCode.configuration,
+          { path: entry.name },
+        );
+      }
+      const information = await lstat(path.join(root, entry.name));
+      if (information.isSymbolicLink()) {
+        throw new MillError(
+          "VERIFIER_WORKSPACE_ENTRY_UNSUPPORTED",
+          "A top-level candidate symbolic link cannot cross the verifier mount boundary.",
+          ExitCode.configuration,
+          { path: entry.name },
+        );
+      }
+      const target = path.join(skeleton, entry.name);
+      if (information.isDirectory()) {
+        await mkdir(target, { mode: 0o700 });
+      } else if (information.isFile()) {
+        await writeFile(target, "", { flag: "wx", mode: 0o600 });
+      } else {
+        throw new MillError(
+          "VERIFIER_WORKSPACE_ENTRY_UNSUPPORTED",
+          "A top-level candidate entry has an unsupported filesystem type.",
+          ExitCode.configuration,
+          { path: entry.name },
+        );
+      }
+      mounts.push(
+        "--mount",
+        `type=bind,source=${path.join(source.source, entry.name)},target=/workspace/${entry.name},readonly`,
+      );
+    }
+    return {
+      mounts,
+      async dispose(): Promise<void> {
+        try {
+          await removeWorkspaceSkeleton(skeleton);
+        } finally {
+          await source.dispose();
+        }
+      },
+    };
+  } catch (error) {
+    try {
+      await removeWorkspaceSkeleton(skeleton);
+    } finally {
+      await source.dispose();
+    }
+    throw error;
+  }
+}
+
 export async function verifyDeclaredCommands(input: {
   root: string;
+  dependencyRoot?: string;
   candidateCommit: string;
   config: MillConfig;
   task: TaskPacket;
@@ -310,8 +465,73 @@ export async function verifyDeclaredCommands(input: {
   const uid = process.getuid?.() ?? 1000;
   const gid = process.getgid?.() ?? 1000;
   const canonicalRoot = await realpath(input.root);
-  const mount = await verifierMountSource(canonicalRoot);
+  const dependencyMounts: string[] = [];
+  let dependencyMount:
+    Awaited<ReturnType<typeof verifierMountSource>> | undefined;
+  if (input.config.verifier.dependencies !== undefined) {
+    if (input.dependencyRoot === undefined) {
+      throw new MillError(
+        "VERIFIER_DEPENDENCIES_UNAVAILABLE",
+        "The verifier requires a qualified local dependency installation.",
+        ExitCode.unavailable,
+      );
+    }
+    const canonicalDependencyRoot = await realpath(input.dependencyRoot);
+    for (const lockPath of input.config.verifier.dependencies.lockPaths) {
+      const [candidateLock, dependencyLock] = await Promise.all([
+        realpath(path.resolve(canonicalRoot, lockPath)),
+        realpath(path.resolve(canonicalDependencyRoot, lockPath)),
+      ]);
+      if (
+        !isWithin(canonicalRoot, candidateLock) ||
+        !isWithin(canonicalDependencyRoot, dependencyLock) ||
+        createHash("sha256")
+          .update(await readFile(candidateLock))
+          .digest("hex") !==
+          createHash("sha256")
+            .update(await readFile(dependencyLock))
+            .digest("hex")
+      ) {
+        throw new MillError(
+          "VERIFIER_DEPENDENCY_LOCK_DRIFT",
+          "The dependency installation is bound to different lock inputs.",
+          ExitCode.configuration,
+          { lockPath },
+        );
+      }
+    }
+    const dependencyPath = await realpath(
+      path.resolve(canonicalDependencyRoot, "node_modules"),
+    );
+    if (
+      !isWithin(canonicalDependencyRoot, dependencyPath) ||
+      !(await stat(dependencyPath)).isDirectory()
+    ) {
+      throw new MillError(
+        "VERIFIER_DEPENDENCIES_UNAVAILABLE",
+        "The configured dependency path is not a qualified local directory.",
+        ExitCode.unavailable,
+      );
+    }
+    dependencyMount = await verifierMountSource(dependencyPath);
+    dependencyMounts.push(
+      "--mount",
+      `type=bind,source=${dependencyMount.source},target=/workspace/${input.config.verifier.dependencies.targetPath},readonly`,
+    );
+  }
+  let workspace: Awaited<ReturnType<typeof workspaceMountPlan>> | undefined;
   try {
+    workspace = await workspaceMountPlan(canonicalRoot, [
+      ...(input.config.verifier.dependencies === undefined
+        ? []
+        : [input.config.verifier.dependencies.targetPath]),
+      ...input.task.commandIds.flatMap(
+        (commandId) =>
+          input.config.commands[commandId]?.writablePaths?.map(
+            (configuredPath) => configuredPath.replace(/\/\*\*$/u, ""),
+          ) ?? [],
+      ),
+    ]);
     for (let index = 0; index < input.task.commandIds.length; index += 1) {
       const commandId = input.task.commandIds[index];
       if (commandId === undefined) continue;
@@ -376,12 +596,31 @@ export async function verifyDeclaredCommands(input: {
         Date.now() + command.timeoutSeconds * 1000,
       );
       const containerName = `mill-${randomUUID()}`;
+      const writableMounts: string[] = [];
+      for (const configuredPath of command.writablePaths ?? []) {
+        const writablePath = configuredPath.replace(/\/\*\*$/u, "");
+        const absoluteWritablePath = path.resolve(canonicalRoot, writablePath);
+        if (!isWithin(canonicalRoot, absoluteWritablePath)) {
+          throw new MillError(
+            "VERIFIER_WRITABLE_PATH_INVALID",
+            "A verifier writable path escaped the candidate workspace.",
+            ExitCode.configuration,
+            { path: configuredPath },
+          );
+        }
+        writableMounts.push(
+          "--mount",
+          `type=tmpfs,target=/workspace/${writablePath},tmpfs-size=268435456,tmpfs-mode=1777`,
+        );
+      }
       let result: ProcessResult;
       try {
         result = await runProcess({
           executable: docker,
           args: [
             "run",
+            "--pull",
+            "never",
             "--name",
             containerName,
             "--label",
@@ -394,21 +633,30 @@ export async function verifyDeclaredCommands(input: {
             "--security-opt",
             "no-new-privileges",
             "--pids-limit",
-            "128",
+            "256",
             "--memory",
             "1g",
             "--cpus",
             "2",
             "--tmpfs",
             "/tmp:rw,noexec,nosuid,nodev,size=256m",
-            "--mount",
-            `type=bind,source=${mount.source},target=/workspace,readonly`,
+            "--tmpfs",
+            "/dev/shm:rw,nosuid,nodev,size=256m",
+            ...workspace.mounts,
+            ...dependencyMounts,
+            ...writableMounts,
             "--workdir",
             containerCwd,
             "--user",
             `${uid}:${gid}`,
             "--env",
             "HOME=/tmp",
+            "--env",
+            "CI=1",
+            "--env",
+            "NEXT_TELEMETRY_DISABLED=1",
+            "--env",
+            "PLAYWRIGHT_BROWSERS_PATH=/ms-playwright",
             "--entrypoint",
             commandExecutable,
             input.config.verifier.image,
@@ -468,6 +716,10 @@ export async function verifyDeclaredCommands(input: {
       ...(input.scenarios === undefined ? {} : { scenarios: input.scenarios }),
     });
   } finally {
-    await mount.dispose();
+    try {
+      await workspace?.dispose();
+    } finally {
+      await dependencyMount?.dispose();
+    }
   }
 }
diff --git a/src/workflows/founder.ts b/src/workflows/founder.ts
new file mode 100644
index 0000000..188ea97
--- /dev/null
+++ b/src/workflows/founder.ts
@@ -0,0 +1,632 @@
+import path from "node:path";
+
+import { parse as parseYaml } from "yaml";
+
+import {
+  outcomePlanSchema,
+  sourceManifestSchema,
+} from "../contracts/schemas.js";
+import { canonicalDigest, type JsonValue } from "../contracts/canonical.js";
+import { doctor, doctorReady } from "../doctor.js";
+import { asMillError, ExitCode, MillError } from "../errors.js";
+import {
+  finalizeDraftPr,
+  observeDraftPr,
+  planDraftPr,
+  reconcileDraftPr,
+} from "../runtime/delivery.js";
+import {
+  qualifyBaseline,
+  resumeRun,
+  reviewRun,
+  runInventory,
+  runStatus,
+  startLocalRun,
+  verifyRun,
+} from "../runtime/lifecycle.js";
+import {
+  loadMillConfig,
+  loadRuntimeInputs,
+  textDigest,
+  type RuntimeInputs,
+} from "../runtime/inputs.js";
+import {
+  commonGitDirectory,
+  qualifyRepositoryForBuild,
+} from "../runtime/repository.js";
+import {
+  prepareDependencySnapshot,
+  type DependencyPreparationResult,
+} from "../runtime/dependencies.js";
+import { isTerminalRun, repositoryStateDirectory } from "../runtime/state.js";
+import { safeReadText } from "../security/safe-path.js";
+
+export interface NextOutcome {
+  outcomeId: string;
+  title: string;
+  taskPath: string;
+  productContractDigest: string;
+  acceptanceIds: readonly string[];
+}
+
+export async function nextReadyOutcome(root: string): Promise<NextOutcome> {
+  const source = await safeReadText(root, "product/plan.yaml", 2 * 1024 * 1024);
+  let raw: unknown;
+  try {
+    raw = parseYaml(source);
+  } catch (error) {
+    throw new MillError(
+      "OUTCOME_PLAN_INVALID",
+      "product/plan.yaml is not valid YAML.",
+      ExitCode.data,
+      { cause: String(error) },
+    );
+  }
+  const plan = outcomePlanSchema.parse(raw);
+  const ready = plan.outcomes.filter((outcome) => outcome.status === "ready");
+  if (ready.length !== 1 || ready[0]?.taskRef === undefined) {
+    throw new MillError(
+      ready.length === 0 ? "NO_READY_OUTCOME" : "AMBIGUOUS_READY_OUTCOME",
+      "Exactly one ready outcome with one approved task reference is required.",
+      ExitCode.configuration,
+      { readyOutcomeIds: ready.map((outcome) => outcome.id) },
+    );
+  }
+  return {
+    outcomeId: ready[0].id,
+    title: ready[0].title,
+    taskPath: ready[0].taskRef,
+    productContractDigest: plan.productContractDigest,
+    acceptanceIds: ready[0].acceptanceIds ?? [],
+  };
+}
+
+export async function prepareRepositoryDependencies(
+  root: string,
+  attended: boolean,
+): Promise<DependencyPreparationResult | undefined> {
+  const config = await loadMillConfig(root);
+  if (config.verifier?.dependencies === undefined) return undefined;
+  const commonDirectory = await commonGitDirectory(root);
+  return prepareDependencySnapshot({
+    root,
+    stateDirectory: repositoryStateDirectory(
+      config.repositoryId,
+      commonDirectory,
+    ),
+    config,
+    attended,
+  });
+}
+
+async function assertApprovedPrd(
+  root: string,
+  prdPath: string,
+  inputs: RuntimeInputs,
+): Promise<void> {
+  const [prd, manifestSource] = await Promise.all([
+    safeReadText(root, prdPath, 2 * 1024 * 1024),
+    safeReadText(root, "product/sources.yaml", 2 * 1024 * 1024),
+  ]);
+  let raw: unknown;
+  try {
+    raw = parseYaml(manifestSource);
+  } catch (error) {
+    throw new MillError(
+      "PRD_SOURCE_MANIFEST_INVALID",
+      "product/sources.yaml is not valid YAML.",
+      ExitCode.data,
+      { cause: String(error) },
+    );
+  }
+  const manifest = sourceManifestSchema.safeParse(raw);
+  if (!manifest.success) {
+    throw new MillError(
+      "PRD_SOURCE_MANIFEST_INVALID",
+      "product/sources.yaml does not satisfy its schema.",
+      ExitCode.data,
+      { issues: manifest.error.issues },
+    );
+  }
+  const normalizedPrd = path.normalize(prdPath).split(path.sep).join("/");
+  const expectedDigest = textDigest(prd);
+  const productSourceIds = new Set(inputs.continuity?.product.sourceRefs ?? []);
+  const matches = manifest.data.sources.filter((source) => {
+    const normalizedSource = path
+      .normalize(source.uri)
+      .split(path.sep)
+      .join("/");
+    return (
+      normalizedSource === normalizedPrd &&
+      (source.revision === expectedDigest ||
+        source.digest === expectedDigest) &&
+      productSourceIds.has(source.id)
+    );
+  });
+  if (matches.length !== 1) {
+    throw new MillError(
+      "PRD_AUTHORITY_MISMATCH",
+      "The selected PRD is not the exact source bound by the approved product contract.",
+      ExitCode.configuration,
+      { prdPath, digest: expectedDigest, matches: matches.length },
+    );
+  }
+}
+
+function sameMembers(
+  left: readonly string[],
+  right: readonly string[],
+): boolean {
+  const sortedLeft = [...left].sort();
+  const sortedRight = [...right].sort();
+  return (
+    sortedLeft.length === sortedRight.length &&
+    sortedLeft.every((value, index) => value === sortedRight[index])
+  );
+}
+
+function assertOutcomeAuthority(
+  outcome: NextOutcome,
+  inputs: RuntimeInputs,
+): void {
+  const continuity = inputs.continuity;
+  const contractDigest =
+    continuity === undefined
+      ? null
+      : canonicalDigest(continuity.product as unknown as JsonValue);
+  const contractOutcome = continuity?.product.outcomes.find(
+    (candidate) => candidate.id === outcome.outcomeId,
+  );
+  const impact = continuity?.impact;
+  const contractAcceptance =
+    contractOutcome?.acceptanceIds ??
+    continuity?.product.acceptance.map((item) => item.id) ??
+    [];
+  const planAcceptance =
+    outcome.acceptanceIds.length > 0
+      ? outcome.acceptanceIds
+      : contractAcceptance;
+  if (
+    continuity === undefined ||
+    contractDigest !== outcome.productContractDigest ||
+    contractOutcome === undefined ||
+    impact?.outcomeId !== outcome.outcomeId ||
+    contractAcceptance.length === 0 ||
+    !sameMembers(planAcceptance, contractAcceptance) ||
+    !sameMembers(contractAcceptance, impact.acceptanceIds)
+  ) {
+    throw new MillError(
+      "OUTCOME_TASK_AUTHORITY_MISMATCH",
+      "The ready outcome, product contract, and referenced task impact do not identify the same approved work.",
+      ExitCode.configuration,
+      {
+        readyOutcomeId: outcome.outcomeId,
+        impactOutcomeId: impact?.outcomeId ?? null,
+        planProductContractDigest: outcome.productContractDigest,
+        taskProductContractDigest: contractDigest,
+      },
+    );
+  }
+}
+
+async function activeOutcomeRun(
+  root: string,
+  taskId: string,
+): Promise<Awaited<ReturnType<typeof runStatus>>> {
+  const active = (await runInventory({ root })).filter(
+    (run) => !isTerminalRun(run.status),
+  );
+  if (active.length === 0) return {};
+  if (active.length !== 1 || active[0]?.taskId !== taskId) {
+    throw new MillError(
+      "ACTIVE_OUTCOME_CONFLICT",
+      "Exactly zero or one nonterminal run for the selected task may exist.",
+      ExitCode.configuration,
+      {
+        activeRuns: active.map((run) => ({
+          runId: run.id,
+          taskId: run.taskId,
+          status: run.status,
+        })),
+      },
+    );
+  }
+  return runStatus({ root, runId: active[0].id });
+}
+
+export async function startNextReadyOutcome(input: {
+  root: string;
+  approvalDigest: string;
+}): Promise<{
+  outcome: NextOutcome;
+  result: Awaited<ReturnType<typeof startLocalRun>>;
+}> {
+  const outcome = await nextReadyOutcome(input.root);
+  const inputs = await loadRuntimeInputs(input.root, outcome.taskPath);
+  assertOutcomeAuthority(outcome, inputs);
+  const active = (await runInventory({ root: input.root })).filter(
+    (run) => !isTerminalRun(run.status),
+  );
+  if (active.length > 0) {
+    throw new MillError(
+      "ACTIVE_OUTCOME_CONFLICT",
+      "run next cannot create a second nonterminal lifecycle.",
+      ExitCode.configuration,
+      { activeRunIds: active.map((run) => run.id) },
+    );
+  }
+  return {
+    outcome,
+    result: await startLocalRun({
+      root: input.root,
+      taskPath: outcome.taskPath,
+      approvalDigest: input.approvalDigest,
+    }),
+  };
+}
+
+function requiresBuildPreflight(
+  run: Awaited<ReturnType<typeof runStatus>>["run"],
+): boolean {
+  return (
+    run === undefined ||
+    run.status === "running" ||
+    run.status === "verified" ||
+    (run.status === "blocked" &&
+      [
+        "REVIEW_FINDINGS",
+        "REMOTE_REVIEW_FINDINGS",
+        "INTERRUPTED_RUN",
+        "CODEX_CANCELLED",
+        "CODEX_DEADLINE_EXCEEDED",
+        "CODEX_OUTPUT_BUDGET_EXCEEDED",
+        "CODEX_EXECUTION_FAILED",
+      ].includes(run.blockCode ?? ""))
+  );
+}
+
+function requiresDependencyPreparation(
+  run: Awaited<ReturnType<typeof runStatus>>["run"],
+): boolean {
+  return (
+    run === undefined ||
+    run.status === "running" ||
+    run.status === "committed" ||
+    (run.status === "blocked" &&
+      [
+        "REVIEW_FINDINGS",
+        "REMOTE_REVIEW_FINDINGS",
+        "INTERRUPTED_RUN",
+        "CODEX_CANCELLED",
+        "CODEX_DEADLINE_EXCEEDED",
+        "CODEX_OUTPUT_BUDGET_EXCEEDED",
+        "CODEX_EXECUTION_FAILED",
+      ].includes(run.blockCode ?? ""))
+  );
+}
+
+async function authorizeExistingBuildSpend(
+  root: string,
+  outcome: NextOutcome,
+  run: NonNullable<Awaited<ReturnType<typeof runStatus>>["run"]>,
+): Promise<void> {
+  const inputs = await loadRuntimeInputs(root, outcome.taskPath);
+  assertOutcomeAuthority(outcome, inputs);
+  if (
+    run.taskDigest !== inputs.taskDigest ||
+    run.configDigest !== inputs.configDigest
+  ) {
+    throw new MillError(
+      "RUN_POLICY_DRIFT",
+      "Task or repository configuration changed after approval.",
+      ExitCode.configuration,
+    );
+  }
+  const deadline = Date.parse(run.deadlineAt);
+  if (!Number.isSafeInteger(deadline) || deadline <= Date.now()) {
+    throw new MillError(
+      "RUN_DEADLINE_EXCEEDED",
+      "The approved run deadline has elapsed; a fresh qualification and run are required.",
+      ExitCode.temporary,
+      { deadlineAt: run.deadlineAt },
+    );
+  }
+  const qualification = await qualifyRepositoryForBuild(
+    root,
+    inputs.task.baseRef,
+    inputs.config.sensitivePaths,
+  );
+  if (qualification.baseCommit !== run.baseCommit) {
+    throw new MillError(
+      "BASE_REF_DRIFT",
+      "The approved base reference moved after the run started.",
+      ExitCode.configuration,
+    );
+  }
+}
+
+export async function startFounderDelivery(input: {
+  root: string;
+  prdPath: string;
+  attended: boolean;
+  draftPr: boolean;
+}): Promise<{
+  outcome: NextOutcome;
+  stage: string;
+  run?: Awaited<ReturnType<typeof runStatus>>["run"];
+  pullRequestUrl?: string;
+  deliveryProposalDigest?: string;
+  nextAction: string;
+  dependencyPreparation?: DependencyPreparationResult;
+}> {
+  if (!input.attended) {
+    throw new MillError(
+      "ATTENDANCE_REQUIRED",
+      "The founder coordinator requires attended model, dependency, and optional forge authority.",
+      ExitCode.configuration,
+    );
+  }
+  const outcome = await nextReadyOutcome(input.root);
+  const outcomeInputs = await loadRuntimeInputs(
+    input.root,
+    outcome.taskPath,
+    "readback",
+  );
+  await assertApprovedPrd(input.root, input.prdPath, outcomeInputs);
+  assertOutcomeAuthority(outcome, outcomeInputs);
+  let status = await activeOutcomeRun(input.root, outcomeInputs.task.id);
+  const preflightMode = requiresBuildPreflight(status.run)
+    ? "build"
+    : status.run?.status === "reviewed" && input.draftPr
+      ? "propose"
+      : "inspect";
+  const preflight = await doctor(input.root, preflightMode);
+  if (!doctorReady(preflight)) {
+    throw new MillError(
+      "START_PREFLIGHT_BLOCKED",
+      "Founder preflight failed before the next required tool or external effect.",
+      ExitCode.unavailable,
+      { preflight },
+    );
+  }
+  if (status.run === undefined && requiresDependencyPreparation(status.run)) {
+    const authorizingInputs = await loadRuntimeInputs(
+      input.root,
+      outcome.taskPath,
+    );
+    assertOutcomeAuthority(outcome, authorizingInputs);
+    await qualifyRepositoryForBuild(
+      input.root,
+      authorizingInputs.task.baseRef,
+      authorizingInputs.config.sensitivePaths,
+    );
+  } else if (
+    status.run !== undefined &&
+    requiresDependencyPreparation(status.run)
+  ) {
+    await authorizeExistingBuildSpend(input.root, outcome, status.run);
+  }
+  const dependencyPreparation = requiresDependencyPreparation(status.run)
+    ? await prepareRepositoryDependencies(input.root, input.attended)
+    : undefined;
+  if (status.run === undefined) {
+    const qualification = await qualifyBaseline({
+      root: input.root,
+      taskPath: outcome.taskPath,
+    });
+    if (
+      !qualification.evidence.passed ||
+      qualification.approvalDigest === null
+    ) {
+      return {
+        outcome,
+        stage: "baseline_blocked",
+        nextAction:
+          "Resolve the reported native baseline failure and rerun the same start command.",
+        ...(dependencyPreparation === undefined
+          ? {}
+          : { dependencyPreparation }),
+      };
+    }
+    const started = await startLocalRun({
+      root: input.root,
+      taskPath: outcome.taskPath,
+      approvalDigest: qualification.approvalDigest,
+    });
+    status = { run: started.run };
+  }
+  for (let step = 0; step < 8; step += 1) {
+    const run = status.run;
+    if (run === undefined) break;
+    if (run.status === "committed") {
+      status = {
+        run: (
+          await verifyRun({
+            root: input.root,
+            taskPath: outcome.taskPath,
+            runId: run.id,
+          })
+        ).run,
+      };
+      continue;
+    }
+    if (run.status === "verified") {
+      status = {
+        run: (
+          await reviewRun({
+            root: input.root,
+            taskPath: outcome.taskPath,
+            runId: run.id,
+          })
+        ).run,
+      };
+      continue;
+    }
+    if (run.status === "reviewed") {
+      if (!input.draftPr) {
+        return {
+          outcome,
+          stage: "reviewed",
+          run,
+          nextAction: `Run millctl ship --draft --task ${outcome.taskPath} --run ${run.id} to approve remote delivery.`,
+          ...(dependencyPreparation === undefined
+            ? {}
+            : { dependencyPreparation }),
+        };
+      }
+      const planned = await planDraftPr({
+        root: input.root,
+        taskPath: outcome.taskPath,
+        runId: run.id,
+      });
+      return {
+        outcome,
+        stage: "delivery_planned",
+        run: planned.run,
+        deliveryProposalDigest: planned.delivery.proposalDigest,
+        nextAction: `Inspect the exact delivery plan, then run millctl ship --draft --task ${outcome.taskPath} --run ${run.id} --approve ${planned.delivery.proposalDigest} --attended.`,
+        ...(dependencyPreparation === undefined
+          ? {}
+          : { dependencyPreparation }),
+      };
+    }
+    if (run.status === "proposing") {
+      return {
+        outcome,
+        stage: "delivery_planned",
+        run,
+        nextAction: `Run millctl ship --draft --task ${outcome.taskPath} --run ${run.id} to inspect a fresh exact delivery plan before attended approval.`,
+        ...(dependencyPreparation === undefined
+          ? {}
+          : { dependencyPreparation }),
+      };
+    }
+    if (run.status === "effect_unknown") {
+      status = {
+        run: (
+          await reconcileDraftPr({
+            root: input.root,
+            taskPath: outcome.taskPath,
+            runId: run.id,
+          })
+        ).run,
+      };
+      continue;
+    }
+    if (
+      run.status === "blocked" &&
+      run.blockCode === "REMOTE_REVIEW_FINDINGS"
+    ) {
+      status = {
+        run: await resumeRun({
+          root: input.root,
+          taskPath: outcome.taskPath,
+          runId: run.id,
+        }),
+      };
+      continue;
+    }
+    if (
+      run.status === "awaiting_ci" ||
+      (run.status === "blocked" && run.blockCode === "REMOTE_CHECKS_FAILED")
+    ) {
+      const observed = await observeDraftPr({
+        root: input.root,
+        taskPath: outcome.taskPath,
+        runId: run.id,
+      });
+      return {
+        outcome,
+        stage: observed.run.status,
+        run: observed.run,
+        ...(observed.delivery.pullRequest?.url === undefined
+          ? {}
+          : { pullRequestUrl: observed.delivery.pullRequest.url }),
+        nextAction:
+          observed.run.status === "awaiting_human"
+            ? "The configured human marks the draft ready and merges it, then reruns start."
+            : "Resolve the exact-head check or review blocker, then rerun start.",
+        ...(dependencyPreparation === undefined
+          ? {}
+          : { dependencyPreparation }),
+      };
+    }
+    if (
+      run.status === "awaiting_human" ||
+      run.status === "merged" ||
+      run.status === "post_merge_verified"
+    ) {
+      let finalized: Awaited<ReturnType<typeof finalizeDraftPr>>;
+      try {
+        finalized = await finalizeDraftPr({
+          root: input.root,
+          taskPath: outcome.taskPath,
+          runId: run.id,
+        });
+      } catch (error) {
+        const failure = asMillError(error);
+        if (failure.code !== "HUMAN_MERGE_PENDING") throw error;
+        return {
+          outcome,
+          stage: run.status,
+          run,
+          nextAction:
+            "The configured human marks the draft ready and merges it, then reruns start.",
+          ...(dependencyPreparation === undefined
+            ? {}
+            : { dependencyPreparation }),
+        };
+      }
+      return {
+        outcome,
+        stage: finalized.run.status,
+        run: finalized.run,
+        ...(finalized.delivery.pullRequest?.url === undefined
+          ? {}
+          : { pullRequestUrl: finalized.delivery.pullRequest.url }),
+        nextAction:
+          finalized.run.status === "closed"
+            ? "Promote the next approved outcome in product/plan.yaml through an ordinary reviewed change."
+            : "Wait for exact resulting-main checks, then rerun start.",
+        ...(dependencyPreparation === undefined
+          ? {}
+          : { dependencyPreparation }),
+      };
+    }
+    if (
+      run.status === "running" ||
+      (run.status === "blocked" &&
+        [
+          "REVIEW_FINDINGS",
+          "REVIEW_NON_CONVERGENCE",
+          "INTERRUPTED_RUN",
+          "CODEX_CANCELLED",
+          "CODEX_DEADLINE_EXCEEDED",
+          "CODEX_OUTPUT_BUDGET_EXCEEDED",
+          "CODEX_EXECUTION_FAILED",
+        ].includes(run.blockCode ?? ""))
+    ) {
+      status = {
+        run: await resumeRun({
+          root: input.root,
+          taskPath: outcome.taskPath,
+          runId: run.id,
+        }),
+      };
+      continue;
+    }
+    return {
+      outcome,
+      stage: run.status,
+      run,
+      nextAction:
+        "Inspect the typed blocker and use the matching expert recovery command.",
+      ...(dependencyPreparation === undefined ? {} : { dependencyPreparation }),
+    };
+  }
+  throw new MillError(
+    "START_ADVANCE_BUDGET_EXHAUSTED",
+    "The coordinator reached its bounded transition budget.",
+    ExitCode.temporary,
+  );
+}
diff --git a/test/cli.test.ts b/test/cli.test.ts
index 17491da..4f3c486 100644
--- a/test/cli.test.ts
+++ b/test/cli.test.ts
@@ -1,5 +1,7 @@
+import { execFile } from "node:child_process";
 import { mkdir, readdir, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { promisify } from "node:util";
 
 import { describe, expect, it } from "vitest";
 
@@ -8,6 +10,8 @@ import { canonicalDigest } from "../src/contracts/canonical.js";
 import { textDigest } from "../src/runtime/inputs.js";
 import { temporaryDirectory } from "./helpers.js";
 
+const execFileAsync = promisify(execFile);
+
 function capture(): {
   io: {
     stdout: { write: (value: string) => void };
@@ -527,7 +531,9 @@ describe("CLI contracts", () => {
   it("emits human output and blocks hazardous adoption", async () => {
     const temporary = await temporaryDirectory("mill-cli-adopt-");
     try {
-      await mkdir(path.join(temporary.path, ".git"));
+      await execFileAsync("/usr/bin/git", ["init", "--initial-branch=main"], {
+        cwd: temporary.path,
+      });
       await writeFile(
         path.join(temporary.path, ".git", "config"),
         "[core]\n  hooksPath = hooks\n",
@@ -541,6 +547,128 @@ describe("CLI contracts", () => {
       ).toBe(78);
       expect(output.stdout.join("")).toContain("BLOCKED: adopt.scan");
       expect(output.stdout.join("")).toContain("UNSAFE_GIT_CONFIGURATION");
+      await execFileAsync(
+        "/usr/bin/git",
+        ["config", "--unset", "core.hooksPath"],
+        { cwd: temporary.path },
+      );
+      await writeFile(path.join(temporary.path, ".npmrc"), "//registry=:x\n");
+      const sensitive = capture();
+      expect(
+        await runCli(
+          ["--cwd", temporary.path, "adopt", "--scan-only"],
+          sensitive.io,
+        ),
+      ).toBe(78);
+      expect(sensitive.stdout.join("")).toContain("SENSITIVE_PATHS_PRESENT");
+    } finally {
+      await temporary.cleanup();
+    }
+  });
+
+  it("keeps integration wrappers explicit and supports read-only local utilities", async () => {
+    const temporary = await temporaryDirectory("mill-cli-integration-");
+    try {
+      const conflictingNew = capture();
+      expect(
+        await runCli(
+          [
+            "--json",
+            "--cwd",
+            temporary.path,
+            "new",
+            "app",
+            "--dry-run",
+            "--apply",
+          ],
+          conflictingNew.io,
+        ),
+      ).toBe(64);
+      expect(JSON.parse(conflictingNew.stdout.join(""))).toMatchObject({
+        reasons: [{ code: "USAGE_ERROR" }],
+      });
+      const incompleteNew = capture();
+      expect(
+        await runCli(
+          ["--json", "--cwd", temporary.path, "new", "app", "--dry-run"],
+          incompleteNew.io,
+        ),
+      ).toBe(64);
+      expect(JSON.parse(incompleteNew.stdout.join(""))).toMatchObject({
+        reasons: [{ code: "USAGE_ERROR" }],
+      });
+
+      const conflictingAdopt = capture();
+      expect(
+        await runCli(
+          ["--json", "--cwd", temporary.path, "adopt", "--plan", "--apply"],
+          conflictingAdopt.io,
+        ),
+      ).toBe(64);
+
+      const safeScan = capture();
+      const safeScanExit = await runCli(
+        ["--json", "--cwd", temporary.path, "adopt", "--scan-only"],
+        safeScan.io,
+      );
+      expect(safeScanExit, safeScan.stdout.join("")).toBe(0);
+      expect(JSON.parse(safeScan.stdout.join(""))).toMatchObject({
+        command: "adopt.scan",
+        ok: true,
+      });
+
+      await mkdir(path.join(temporary.path, ".git"));
+      await writeFile(
+        path.join(temporary.path, "mill.yaml"),
+        'schemaVersion: "1"\nrepositoryId: "123e4567-e89b-42d3-a456-426614174000"\ntrustCeiling: inspect\ncommands: {}\n',
+      );
+      const dependencies = capture();
+      expect(
+        await runCli(
+          [
+            "--json",
+            "--cwd",
+            temporary.path,
+            "dependencies",
+            "prepare",
+            "--attended",
+          ],
+          dependencies.io,
+        ),
+      ).toBe(0);
+      expect(JSON.parse(dependencies.stdout.join(""))).toMatchObject({
+        command: "dependencies.prepare",
+        data: { configured: false },
+      });
+      await writeFile(
+        path.join(temporary.path, "mill.lock"),
+        'schemaVersion: "1"\nmill:\n  package: "@davidahmann/mill"\n  version: "0.0.0-development"\nintegration:\n  mode: greenfield\n  planDigest: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"\n  baseCommit: null\n  files: []\n',
+      );
+      const detach = capture();
+      expect(
+        await runCli(
+          ["--json", "--cwd", temporary.path, "detach", "plan"],
+          detach.io,
+        ),
+      ).toBe(0);
+      expect(JSON.parse(detach.stdout.join(""))).toMatchObject({
+        command: "detach.plan",
+        data: { mode: "manual", remove: ["mill.lock"] },
+      });
+      await writeFile(
+        path.join(temporary.path, "mill.lock"),
+        'schemaVersion: "1"\nmill:\n  package: "@davidahmann/mill"\n  version: "0.0.0-development"\n',
+      );
+      const legacyDetach = capture();
+      expect(
+        await runCli(
+          ["--json", "--cwd", temporary.path, "detach", "plan"],
+          legacyDetach.io,
+        ),
+      ).toBe(78);
+      expect(JSON.parse(legacyDetach.stdout.join(""))).toMatchObject({
+        reasons: [{ code: "DETACH_METADATA_UNAVAILABLE" }],
+      });
     } finally {
       await temporary.cleanup();
     }
diff --git a/test/doctor.test.ts b/test/doctor.test.ts
index cdaeaa0..da9375d 100644
--- a/test/doctor.test.ts
+++ b/test/doctor.test.ts
@@ -42,6 +42,9 @@ describe("doctor", () => {
       expect(propose.tools.find((tool) => tool.name === "gh")?.required).toBe(
         true,
       );
+      expect(
+        propose.tools.find((tool) => tool.name === "codex")?.required,
+      ).toBe(false);
     } finally {
       await temporary.cleanup();
     }
diff --git a/test/founder.test.ts b/test/founder.test.ts
new file mode 100644
index 0000000..1688696
--- /dev/null
+++ b/test/founder.test.ts
@@ -0,0 +1,560 @@
+import { execFile } from "node:child_process";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { afterEach, describe, expect, it } from "vitest";
+
+import { canonicalDigest, type JsonValue } from "../src/contracts/canonical.js";
+import { productContractSchema } from "../src/contracts/schemas.js";
+import {
+  nextReadyOutcome,
+  prepareRepositoryDependencies,
+  startNextReadyOutcome,
+  startFounderDelivery,
+} from "../src/workflows/founder.js";
+import { cancelRun, qualifyBaseline } from "../src/runtime/lifecycle.js";
+import { loadRuntimeInputs } from "../src/runtime/inputs.js";
+import { commonGitDirectory } from "../src/runtime/repository.js";
+import { StateStore } from "../src/runtime/state.js";
+import { temporaryDirectory } from "./helpers.js";
+import { runtimeFixture } from "./runtime-fixture.js";
+
+const originalEnvironment = {
+  codex: process.env.MILL_CODEX_PATH,
+  docker: process.env.MILL_DOCKER_PATH,
+  state: process.env.MILL_STATE_HOME,
+};
+const execFileAsync = promisify(execFile);
+
+afterEach(() => {
+  if (originalEnvironment.codex === undefined)
+    delete process.env.MILL_CODEX_PATH;
+  else process.env.MILL_CODEX_PATH = originalEnvironment.codex;
+  if (originalEnvironment.docker === undefined)
+    delete process.env.MILL_DOCKER_PATH;
+  else process.env.MILL_DOCKER_PATH = originalEnvironment.docker;
+  if (originalEnvironment.state === undefined)
+    delete process.env.MILL_STATE_HOME;
+  else process.env.MILL_STATE_HOME = originalEnvironment.state;
+});
+
+describe("founder workflow", { concurrent: false }, () => {
+  it("requires exactly one ready outcome with an explicit task", async () => {
+    const temporary = await temporaryDirectory("mill-founder-plan-");
+    try {
+      await mkdir(path.join(temporary.path, "product"), { recursive: true });
+      const writePlan = async (outcomes: unknown[]): Promise<void> =>
+        writeFile(
+          path.join(temporary.path, "product", "plan.yaml"),
+          stringifyYaml({
+            schemaVersion: "1",
+            productContractDigest: `sha256:${"a".repeat(64)}`,
+            outcomes,
+          }),
+        );
+      await writePlan([
+        {
+          id: "OUT-FIRST",
+          title: "First outcome",
+          acceptance: ["It works"],
+          acceptanceIds: ["ACC-FIRST"],
+          dependsOn: [],
+          status: "ready",
+          taskRef: "product/tasks/first.yaml",
+        },
+      ]);
+      await expect(nextReadyOutcome(temporary.path)).resolves.toEqual({
+        outcomeId: "OUT-FIRST",
+        title: "First outcome",
+        taskPath: "product/tasks/first.yaml",
+        productContractDigest: `sha256:${"a".repeat(64)}`,
+        acceptanceIds: ["ACC-FIRST"],
+      });
+      await writePlan([
+        {
+          id: "OUT-FIRST",
+          title: "First outcome",
+          acceptance: ["It works"],
+          dependsOn: [],
+          status: "ready",
+          taskRef: "product/tasks/first.yaml",
+        },
+      ]);
+      await expect(nextReadyOutcome(temporary.path)).resolves.toMatchObject({
+        outcomeId: "OUT-FIRST",
+        acceptanceIds: [],
+      });
+
+      await writePlan([
+        {
+          id: "OUT-FIRST",
+          title: "First outcome",
+          acceptance: ["It works"],
+          dependsOn: [],
+          status: "approved",
+        },
+      ]);
+      await expect(nextReadyOutcome(temporary.path)).rejects.toMatchObject({
+        code: "NO_READY_OUTCOME",
+      });
+
+      await writePlan([
+        {
+          id: "OUT-FIRST",
+          title: "First outcome",
+          acceptance: ["It works"],
+          dependsOn: [],
+          status: "ready",
+          taskRef: "product/tasks/first.yaml",
+        },
+        {
+          id: "OUT-SECOND",
+          title: "Second outcome",
+          acceptance: ["It also works"],
+          dependsOn: [],
+          status: "ready",
+          taskRef: "product/tasks/second.yaml",
+        },
+      ]);
+      await expect(nextReadyOutcome(temporary.path)).rejects.toMatchObject({
+        code: "AMBIGUOUS_READY_OUTCOME",
+      });
+
+      await writePlan([
+        {
+          id: "OUT-FIRST",
+          title: "First outcome",
+          acceptance: ["It works"],
+          dependsOn: [],
+          status: "ready",
+        },
+      ]);
+      await expect(nextReadyOutcome(temporary.path)).rejects.toMatchObject({
+        code: "AMBIGUOUS_READY_OUTCOME",
+      });
+      await writeFile(
+        path.join(temporary.path, "product", "plan.yaml"),
+        "not: [valid\n",
+      );
+      await expect(nextReadyOutcome(temporary.path)).rejects.toMatchObject({
+        code: "OUTCOME_PLAN_INVALID",
+      });
+    } finally {
+      await temporary.cleanup();
+    }
+  });
+
+  it("advances one approved outcome through build, verification, and local review", async () => {
+    const fixture = await runtimeFixture();
+    process.env.MILL_CODEX_PATH = fixture.codexPath;
+    process.env.MILL_DOCKER_PATH = fixture.dockerPath;
+    process.env.MILL_STATE_HOME = fixture.stateHome;
+    try {
+      const product = productContractSchema.parse(
+        parseYaml(
+          await readFile(
+            path.join(fixture.root, "product", "contract.yaml"),
+            "utf8",
+          ),
+        ),
+      );
+      await writeFile(
+        path.join(fixture.root, "product", "plan.yaml"),
+        stringifyYaml({
+          schemaVersion: "1",
+          productContractDigest: canonicalDigest(
+            product as unknown as JsonValue,
+          ),
+          outcomes: [
+            {
+              id: "OUT-POSITIVE-VALUE",
+              title: "Keep the exported value positive",
+              acceptance: ["The native test passes"],
+              acceptanceIds: ["ACC-POSITIVE"],
+              dependsOn: [],
+              status: "ready",
+              taskRef: fixture.taskPath,
+            },
+          ],
+        }),
+      );
+      await execFileAsync(
+        "/usr/bin/git",
+        [
+          "-c",
+          "user.name=Mill Test",
+          "-c",
+          "user.email=mill-test@example.invalid",
+          "add",
+          "product/plan.yaml",
+        ],
+        { cwd: fixture.root },
+      );
+      await execFileAsync(
+        "/usr/bin/git",
+        [
+          "-c",
+          "user.name=Mill Test",
+          "-c",
+          "user.email=mill-test@example.invalid",
+          "commit",
+          "--no-gpg-sign",
+          "-m",
+          "test: add outcome plan",
+        ],
+        { cwd: fixture.root },
+      );
+      const approvedPlan = await readFile(
+        path.join(fixture.root, "product", "plan.yaml"),
+        "utf8",
+      );
+      await writeFile(
+        path.join(fixture.root, "product", "plan.yaml"),
+        approvedPlan.replace("OUT-POSITIVE-VALUE", "OUT-OTHER"),
+      );
+      await expect(
+        startFounderDelivery({
+          root: fixture.root,
+          prdPath: "product/PRD.md",
+          attended: true,
+          draftPr: false,
+        }),
+      ).rejects.toMatchObject({ code: "OUTCOME_TASK_AUTHORITY_MISMATCH" });
+      await expect(
+        startNextReadyOutcome({
+          root: fixture.root,
+          approvalDigest: `sha256:${"0".repeat(64)}`,
+        }),
+      ).rejects.toMatchObject({ code: "OUTCOME_TASK_AUTHORITY_MISMATCH" });
+      await writeFile(
+        path.join(fixture.root, "product", "plan.yaml"),
+        approvedPlan.replace("ACC-POSITIVE", "ACC-OTHER"),
+      );
+      await expect(
+        startFounderDelivery({
+          root: fixture.root,
+          prdPath: "product/PRD.md",
+          attended: true,
+          draftPr: false,
+        }),
+      ).rejects.toMatchObject({ code: "OUTCOME_TASK_AUTHORITY_MISMATCH" });
+      await writeFile(
+        path.join(fixture.root, "product", "plan.yaml"),
+        approvedPlan,
+      );
+      await expect(
+        startFounderDelivery({
+          root: fixture.root,
+          prdPath: "product/PRD.md",
+          attended: false,
+          draftPr: false,
+        }),
+      ).rejects.toMatchObject({ code: "ATTENDANCE_REQUIRED" });
+      expect(
+        await prepareRepositoryDependencies(fixture.root, true),
+      ).toBeUndefined();
+
+      const qualification = await qualifyBaseline({
+        root: fixture.root,
+        taskPath: fixture.taskPath,
+      });
+      if (qualification.approvalDigest === null) {
+        throw new Error("expected passing founder baseline qualification");
+      }
+      const next = await startNextReadyOutcome({
+        root: fixture.root,
+        approvalDigest: qualification.approvalDigest,
+      });
+      expect(next).toMatchObject({
+        outcome: { outcomeId: "OUT-POSITIVE-VALUE" },
+        result: { run: { status: "committed" } },
+      });
+      await expect(
+        startNextReadyOutcome({
+          root: fixture.root,
+          approvalDigest: qualification.approvalDigest,
+        }),
+      ).rejects.toMatchObject({ code: "ACTIVE_OUTCOME_CONFLICT" });
+      const configPath = path.join(fixture.root, "mill.yaml");
+      const configSource = await readFile(configPath, "utf8");
+      await writeFile(
+        configPath,
+        configSource.replace("timeoutSeconds: 30", "timeoutSeconds: 31"),
+      );
+      process.env.MILL_DOCKER_PATH = path.join(fixture.root, "missing-docker");
+      await expect(
+        startFounderDelivery({
+          root: fixture.root,
+          prdPath: "product/PRD.md",
+          attended: true,
+          draftPr: false,
+        }),
+      ).rejects.toMatchObject({ code: "RUN_POLICY_DRIFT" });
+      await writeFile(configPath, configSource);
+      process.env.MILL_DOCKER_PATH = fixture.dockerPath;
+      const result = await startFounderDelivery({
+        root: fixture.root,
+        prdPath: "product/PRD.md",
+        attended: true,
+        draftPr: false,
+      });
+      expect(result).toMatchObject({
+        outcome: { outcomeId: "OUT-POSITIVE-VALUE" },
+        stage: "reviewed",
+        run: { status: "reviewed" },
+      });
+      expect(result.nextAction).toContain("millctl ship --draft");
+      process.env.MILL_CODEX_PATH = path.join(fixture.root, "missing-codex");
+      process.env.MILL_DOCKER_PATH = path.join(fixture.root, "missing-docker");
+      await expect(
+        startFounderDelivery({
+          root: fixture.root,
+          prdPath: "product/PRD.md",
+          attended: true,
+          draftPr: false,
+        }),
+      ).resolves.toMatchObject({ stage: "reviewed" });
+      process.env.MILL_CODEX_PATH = fixture.codexPath;
+      process.env.MILL_DOCKER_PATH = fixture.dockerPath;
+      await expect(
+        startFounderDelivery({
+          root: fixture.root,
+          prdPath: "product/contract.yaml",
+          attended: true,
+          draftPr: false,
+        }),
+      ).rejects.toMatchObject({ code: "PRD_AUTHORITY_MISMATCH" });
+      const sourceManifestPath = path.join(
+        fixture.root,
+        "product",
+        "sources.yaml",
+      );
+      const sourceManifest = await readFile(sourceManifestPath, "utf8");
+      await writeFile(sourceManifestPath, "bad: true\n");
+      await expect(
+        startFounderDelivery({
+          root: fixture.root,
+          prdPath: "product/PRD.md",
+          attended: true,
+          draftPr: false,
+        }),
+      ).rejects.toMatchObject({ code: "PRD_SOURCE_MANIFEST_INVALID" });
+      await writeFile(sourceManifestPath, sourceManifest);
+
+      const originalTask = await readFile(
+        path.join(fixture.root, fixture.taskPath),
+        "utf8",
+      );
+      const otherTaskPath = "product/tasks/other.yaml";
+      const runtimeInputs = await loadRuntimeInputs(
+        fixture.root,
+        fixture.taskPath,
+        "readback",
+      );
+      const state = await StateStore.open(
+        runtimeInputs.config.repositoryId,
+        await commonGitDirectory(fixture.root),
+      );
+      const newerTerminal = state.createRun({
+        repositoryId: runtimeInputs.config.repositoryId,
+        taskId: "newer-terminal-marker",
+        taskDigest: runtimeInputs.taskDigest,
+        configDigest: runtimeInputs.configDigest,
+        baseCommit: result.run?.baseCommit ?? "0".repeat(40),
+        deadlineAt: new Date(Date.now() + 60_000).toISOString(),
+      });
+      state.transition(newerTerminal.id, "cancelled", "run.cancelled", {
+        code: "TEST_TERMINAL_MARKER",
+      });
+      state.close();
+      await writeFile(
+        path.join(fixture.root, otherTaskPath),
+        originalTask.replace("id: positive-value", "id: other-value"),
+      );
+      const planSource = await readFile(
+        path.join(fixture.root, "product", "plan.yaml"),
+        "utf8",
+      );
+      await writeFile(
+        path.join(fixture.root, "product", "plan.yaml"),
+        planSource.replace(fixture.taskPath, otherTaskPath),
+      );
+      await execFileAsync(
+        "/usr/bin/git",
+        [
+          "-c",
+          "user.name=Mill Test",
+          "-c",
+          "user.email=mill-test@example.invalid",
+          "add",
+          "product/plan.yaml",
+          otherTaskPath,
+        ],
+        { cwd: fixture.root },
+      );
+      await execFileAsync(
+        "/usr/bin/git",
+        [
+          "-c",
+          "user.name=Mill Test",
+          "-c",
+          "user.email=mill-test@example.invalid",
+          "commit",
+          "--no-gpg-sign",
+          "-m",
+          "test: select another outcome task",
+        ],
+        { cwd: fixture.root },
+      );
+      await expect(
+        startFounderDelivery({
+          root: fixture.root,
+          prdPath: "product/PRD.md",
+          attended: true,
+          draftPr: false,
+        }),
+      ).rejects.toMatchObject({ code: "ACTIVE_OUTCOME_CONFLICT" });
+      const firstRun = result.run;
+      if (firstRun === undefined) throw new Error("expected reviewed run");
+      await cancelRun({ root: fixture.root, runId: firstRun.id });
+      await expect(
+        startFounderDelivery({
+          root: fixture.root,
+          prdPath: "product/PRD.md",
+          attended: true,
+          draftPr: false,
+        }),
+      ).resolves.toMatchObject({
+        outcome: { outcomeId: "OUT-POSITIVE-VALUE" },
+        stage: "reviewed",
+        run: { taskId: "other-value", status: "reviewed" },
+      });
+    } finally {
+      await fixture.cleanup();
+    }
+  }, 15_000);
+
+  it("reports preflight and native-baseline blockers before model execution", async () => {
+    const preflight = await runtimeFixture();
+    process.env.MILL_CODEX_PATH = path.join(preflight.root, "missing-codex");
+    process.env.MILL_DOCKER_PATH = preflight.dockerPath;
+    process.env.MILL_STATE_HOME = preflight.stateHome;
+    try {
+      const product = productContractSchema.parse(
+        parseYaml(
+          await readFile(
+            path.join(preflight.root, "product", "contract.yaml"),
+            "utf8",
+          ),
+        ),
+      );
+      await writeFile(
+        path.join(preflight.root, "product", "plan.yaml"),
+        stringifyYaml({
+          schemaVersion: "1",
+          productContractDigest: canonicalDigest(
+            product as unknown as JsonValue,
+          ),
+          outcomes: [
+            {
+              id: "OUT-POSITIVE-VALUE",
+              title: "Keep the exported value positive",
+              acceptance: ["The native test passes"],
+              acceptanceIds: ["ACC-POSITIVE"],
+              dependsOn: [],
+              status: "ready",
+              taskRef: preflight.taskPath,
+            },
+          ],
+        }),
+      );
+      await expect(
+        startFounderDelivery({
+          root: preflight.root,
+          prdPath: "product/PRD.md",
+          attended: true,
+          draftPr: false,
+        }),
+      ).rejects.toMatchObject({ code: "START_PREFLIGHT_BLOCKED" });
+    } finally {
+      await preflight.cleanup();
+    }
+
+    const baseline = await runtimeFixture();
+    process.env.MILL_CODEX_PATH = baseline.codexPath;
+    process.env.MILL_DOCKER_PATH = baseline.dockerPath;
+    process.env.MILL_STATE_HOME = baseline.stateHome;
+    try {
+      const product = productContractSchema.parse(
+        parseYaml(
+          await readFile(
+            path.join(baseline.root, "product", "contract.yaml"),
+            "utf8",
+          ),
+        ),
+      );
+      await writeFile(
+        path.join(baseline.root, "product", "plan.yaml"),
+        stringifyYaml({
+          schemaVersion: "1",
+          productContractDigest: canonicalDigest(
+            product as unknown as JsonValue,
+          ),
+          outcomes: [
+            {
+              id: "OUT-POSITIVE-VALUE",
+              title: "Keep the exported value positive",
+              acceptance: ["The native test passes"],
+              dependsOn: [],
+              status: "ready",
+              taskRef: baseline.taskPath,
+            },
+          ],
+        }),
+      );
+      await writeFile(
+        path.join(baseline.root, "src", "value.js"),
+        "export const value = 0;\n",
+      );
+      await execFileAsync(
+        "/usr/bin/git",
+        [
+          "-c",
+          "user.name=Mill Test",
+          "-c",
+          "user.email=mill-test@example.invalid",
+          "add",
+          "product/plan.yaml",
+          "src/value.js",
+        ],
+        { cwd: baseline.root },
+      );
+      await execFileAsync(
+        "/usr/bin/git",
+        [
+          "-c",
+          "user.name=Mill Test",
+          "-c",
+          "user.email=mill-test@example.invalid",
+          "commit",
+          "--no-gpg-sign",
+          "-m",
+          "test: seed failing baseline",
+        ],
+        { cwd: baseline.root },
+      );
+      const blocked = await startFounderDelivery({
+        root: baseline.root,
+        prdPath: "product/PRD.md",
+        attended: true,
+        draftPr: false,
+      });
+      expect(blocked.stage).toBe("baseline_blocked");
+      expect(blocked.nextAction).toContain("baseline failure");
+    } finally {
+      await baseline.cleanup();
+    }
+  });
+});
diff --git a/test/planning-continuity.test.ts b/test/planning-continuity.test.ts
index 4426b51..1795dc8 100644
--- a/test/planning-continuity.test.ts
+++ b/test/planning-continuity.test.ts
@@ -53,7 +53,7 @@ function continuityFixture() {
         id: "SRC-PRD",
         class: "user_evidence",
         uri: "product/PRD.md",
-        revision: "sha256:prd",
+        revision: `sha256:${"a".repeat(64)}`,
         observedAt: "2026-09-02T00:00:00.000Z",
         freshness: "current",
         authority: "constraint",
@@ -239,7 +239,7 @@ describe("product continuity planning", () => {
     expect(blueprint).toMatchObject({
       productContractDigest: digest(inputs.product),
       recipe: "node-typescript-next-web",
-      runtime: "node-24-active-lts",
+      runtime: "node-24.18.1-npm-11.16.0",
     });
   });
 
@@ -253,6 +253,24 @@ describe("product continuity planning", () => {
       sourceManifestDigest: fixture.sourceManifestDigest,
     });
     expect(assessment).toMatchObject({ promotable: true, blockers: [] });
+    const prdUnboundProposal = specificationProposalSchema.parse({
+      ...fixture.proposal,
+      productContract: {
+        ...fixture.product,
+        sourceRefs: ["SRC-NODE"],
+      },
+    });
+    expect(
+      assessSpecificationProposal({
+        proposal: prdUnboundProposal,
+        prdPath: "product/PRD.md",
+        prdDigest: fixture.prdDigest,
+        sourceManifest: fixture.sources,
+        sourceManifestDigest: fixture.sourceManifestDigest,
+      }).blockers,
+    ).toContain(
+      "product contract does not bind the inspected PRD source: SRC-PRD",
+    );
     expect(
       promoteSpecificationProposal({
         proposal: fixture.proposal,
diff --git a/test/recipe-integration.test.ts b/test/recipe-integration.test.ts
new file mode 100644
index 0000000..29d6003
--- /dev/null
+++ b/test/recipe-integration.test.ts
@@ -0,0 +1,2055 @@
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  access,
+  chmod,
+  mkdir,
+  readFile,
+  readdir,
+  realpath,
+  rm,
+  symlink,
+  unlink,
+  writeFile,
+} from "node:fs/promises";
+import path from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { promisify } from "node:util";
+
+import { parse as parseYaml } from "yaml";
+import { afterEach, describe, expect, it } from "vitest";
+
+import { runCli } from "../src/cli-program.js";
+import { canonicalDigest, type JsonValue } from "../src/contracts/canonical.js";
+import {
+  millConfigSchema,
+  productContractSchema,
+  scenarioSetSchema,
+  sourceManifestSchema,
+  specificationProposalSchema,
+  taskPacketV1Schema,
+} from "../src/contracts/schemas.js";
+import {
+  loadNodeWebRecipe,
+  renderNodeWebRecipe,
+} from "../src/recipes/node-typescript-next-web.js";
+import {
+  applyAdoptionIntegration,
+  applyGreenfieldIntegration,
+  planAdoptionIntegration,
+  planDetach,
+  planGreenfieldIntegration,
+} from "../src/repository/integration.js";
+import {
+  dependencySnapshotDirectory,
+  prepareDependencySnapshot,
+} from "../src/runtime/dependencies.js";
+import { textDigest } from "../src/runtime/inputs.js";
+import { repositoryStateDirectory } from "../src/runtime/state.js";
+import { verifyDeclaredCommands } from "../src/runtime/verifier.js";
+import { temporaryDirectory } from "./helpers.js";
+
+const execFileAsync = promisify(execFile);
+const originalDocker = process.env.MILL_DOCKER_PATH;
+const originalGit = process.env.MILL_GIT_PATH;
+const originalStateHome = process.env.MILL_STATE_HOME;
+
+function capture() {
+  const stdout: string[] = [];
+  const stderr: string[] = [];
+  return {
+    io: {
+      stdout: { write: (value: string) => void stdout.push(value) },
+      stderr: { write: (value: string) => void stderr.push(value) },
+    },
+    stdout,
+    stderr,
+  };
+}
+
+afterEach(() => {
+  if (originalDocker === undefined) delete process.env.MILL_DOCKER_PATH;
+  else process.env.MILL_DOCKER_PATH = originalDocker;
+  if (originalGit === undefined) delete process.env.MILL_GIT_PATH;
+  else process.env.MILL_GIT_PATH = originalGit;
+  if (originalStateHome === undefined) delete process.env.MILL_STATE_HOME;
+  else process.env.MILL_STATE_HOME = originalStateHome;
+});
+
+async function git(root: string, args: readonly string[]): Promise<string> {
+  const result = await execFileAsync(
+    "/usr/bin/git",
+    [
+      "-c",
+      "user.name=Mill Test",
+      "-c",
+      "user.email=mill-test@example.invalid",
+      ...args,
+    ],
+    { cwd: root, encoding: "utf8" },
+  );
+  return result.stdout;
+}
+
+async function fakeDocker(
+  directory: string,
+  failVerifier = false,
+  createDependencies = true,
+  createTargetBeforeVerifier?: string,
+  blockDependencyPreparation = false,
+): Promise<{ executable: string; log: string }> {
+  const executable = path.join(directory, "docker");
+  const log = path.join(directory, "docker.log");
+  await writeFile(
+    executable,
+    `#!${process.execPath}
+const {appendFileSync,chmodSync,mkdirSync,symlinkSync,writeFileSync}=require("node:fs");
+const path=require("node:path");
+const args=process.argv.slice(2);
+const createTarget=${JSON.stringify(createTargetBeforeVerifier ?? "")};
+const blockDependencyPreparation=${JSON.stringify(blockDependencyPreparation)};
+appendFileSync(path.join(__dirname,"docker.log"),JSON.stringify(args)+"\\n");
+if(args[0]==="image"||args[0]==="rm")process.exit(0);
+if(args[0]!=="run")process.exit(2);
+if(args.includes("dev.mill.owner=dependency-preparation")&&${createDependencies ? "true" : "false"}){
+  const mount=args.find((value)=>value.startsWith("type=bind,")&&value.endsWith("target=/workspace"));
+  const prefix="type=bind,source=";
+  const suffix=",target=/workspace";
+  if(mount===undefined||!mount.startsWith(prefix)||!mount.endsWith(suffix))process.exit(3);
+  const modules=path.join(mount.slice(prefix.length,-suffix.length),"node_modules");
+  const bin=path.join(modules,"example","bin");
+  mkdirSync(bin,{recursive:true});
+  const executable=path.join(bin,"tool.js");
+  writeFileSync(executable,"export default 1;\\n");
+  chmodSync(executable,0o755);
+  symlinkSync("example/bin/tool.js",path.join(modules,"example-tool"));
+  if(blockDependencyPreparation)setInterval(()=>{},1000);
+  else process.exit(0);
+}
+if(args.includes("dev.mill.owner=verifier")){
+  if(createTarget!=="")mkdirSync(createTarget);
+  process.exit(${failVerifier ? 9 : 0});
+}
+if(!blockDependencyPreparation)process.exit(0);
+`,
+    { mode: 0o755 },
+  );
+  await chmod(executable, 0o755);
+  return { executable, log };
+}
+
+async function cancellingGit(directory: string): Promise<string> {
+  const executable = path.join(directory, "git");
+  await writeFile(
+    executable,
+    `#!${process.execPath}
+const {spawnSync}=require("node:child_process");
+const args=process.argv.slice(2);
+const result=spawnSync("/usr/bin/git",args,{env:process.env,stdio:"inherit"});
+if(result.status===0&&args.includes("commit"))process.kill(process.ppid,"SIGINT");
+process.exit(result.status??1);
+`,
+    { mode: 0o755 },
+  );
+  await chmod(executable, 0o755);
+  return executable;
+}
+
+async function authorityFixture(root: string): Promise<{
+  productApprovalDigest: string;
+  options: {
+    sourceRoot: string;
+    prdPath: string;
+    sourceManifestPath: string;
+    proposalPath: string;
+    productApprovalDigest: string;
+    repositoryId: string;
+    approvedBy: string;
+    approvedAt: string;
+    authorName: string;
+    authorEmail: string;
+  };
+}> {
+  const prd = "# Acme Status\n\nShow a healthy product surface.\n";
+  const sources = sourceManifestSchema.parse({
+    schemaVersion: "1",
+    trigger: "bootstrap",
+    providers: [
+      {
+        id: "operator",
+        name: "Operator supplied evidence",
+        queries: [],
+        networkDisclosure: "No planning-time network access",
+      },
+    ],
+    sources: [
+      {
+        id: "SRC-PRD",
+        class: "user_evidence",
+        uri: "PRD.md",
+        revision: textDigest(prd),
+        observedAt: "2026-09-02T14:15:00.000Z",
+        freshness: "current",
+        authority: "constraint",
+        claims: ["The product exposes a healthy web surface."],
+      },
+    ],
+  });
+  const product = productContractSchema.parse({
+    schemaVersion: "1",
+    id: "acme-status",
+    title: "Acme Status",
+    primaryUser: "Founder",
+    jobToBeDone: "Start from a qualified, independently operable product.",
+    outcomes: [
+      {
+        id: "OUT-HEALTHY-WEB",
+        statement: "A healthy web product is ready for iteration.",
+        acceptanceIds: ["ACC-HEALTHY-WEB"],
+      },
+    ],
+    nonGoals: ["Automatic merge"],
+    assumptions: [],
+    unknowns: [],
+    sourceRefs: ["SRC-PRD"],
+    acceptance: [
+      {
+        id: "ACC-HEALTHY-WEB",
+        kind: "functional",
+        statement: "The complete native repository gate passes.",
+        sourceRefs: ["SRC-PRD"],
+      },
+    ],
+    invariants: [
+      {
+        id: "INV-NATIVE-CHECK",
+        statement: "The repository remains independently testable.",
+        owner: "repository",
+        criticality: "low",
+        surfaceRefs: ["package.json"],
+        verification: { mode: "command", ref: "check" },
+        sourceRefs: ["SRC-PRD"],
+        unknowns: [],
+      },
+    ],
+    decisions: [],
+  });
+  const productDigest = canonicalDigest(product as unknown as JsonValue);
+  const scenarios = scenarioSetSchema.parse({
+    schemaVersion: "1",
+    productContractDigest: productDigest,
+    scenarios: [
+      {
+        id: "SCN-NATIVE-CHECK",
+        kind: "normal",
+        given: ["the approved generated or adopted repository"],
+        when: ["the native check command runs"],
+        then: ["all declared product gates pass"],
+        oracleOwner: "repository",
+        acceptanceRefs: ["ACC-HEALTHY-WEB"],
+        invariantRefs: ["INV-NATIVE-CHECK"],
+        coverage: "both",
+        visibility: "builder_visible",
+        executionRef: "test:browser",
+        recipeOracle: "web-title-and-health",
+        forbidden: [],
+      },
+    ],
+  });
+  const proposal = specificationProposalSchema.parse({
+    schemaVersion: "1",
+    prd: { path: "PRD.md", digest: textDigest(prd) },
+    sourceManifestDigest: canonicalDigest(sources as unknown as JsonValue),
+    productContract: product,
+    blueprints: [
+      {
+        schemaVersion: "1",
+        id: "node-typescript-next-web",
+        productContractDigest: productDigest,
+        recipe: "node-typescript-next-web",
+        recipeVersion: "1.0.0",
+        runtime: "node-24.18.1-npm-11.16.0",
+        architecture: ["modular monolith", "Next.js App Router"],
+        risks: [],
+      },
+    ],
+    scenarioSet: scenarios,
+    assumptions: [],
+    contradictions: [],
+    questions: [],
+    status: "proposed",
+  });
+  await Promise.all([
+    writeFile(path.join(root, "PRD.md"), prd),
+    writeFile(path.join(root, "sources.json"), `${JSON.stringify(sources)}\n`),
+    writeFile(
+      path.join(root, "proposal.json"),
+      `${JSON.stringify(proposal)}\n`,
+    ),
+  ]);
+  const productApprovalDigest = canonicalDigest(
+    proposal as unknown as JsonValue,
+  );
+  return {
+    productApprovalDigest,
+    options: {
+      sourceRoot: root,
+      prdPath: "PRD.md",
+      sourceManifestPath: "sources.json",
+      proposalPath: "proposal.json",
+      productApprovalDigest,
+      repositoryId: "123e4567-e89b-42d3-a456-426614174000",
+      approvedBy: "David Ahmann",
+      approvedAt: "2026-09-02T14:15:00.000Z",
+      authorName: "David Ahmann",
+      authorEmail: "david@example.invalid",
+    },
+  };
+}
+
+async function exists(candidate: string): Promise<boolean> {
+  try {
+    await access(candidate);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function seedCompatibleRepository(
+  root: string,
+): Promise<Awaited<ReturnType<typeof authorityFixture>>> {
+  const authority = await authorityFixture(root);
+  const rendered = await renderNodeWebRecipe({
+    projectName: "adopted-app",
+    productTitle: "Acme Status",
+  });
+  for (const file of rendered) {
+    const destination = path.join(root, file.path);
+    await mkdir(path.dirname(destination), { recursive: true });
+    await writeFile(destination, file.content);
+  }
+  await git(root, ["init", "--initial-branch=main"]);
+  await git(root, ["add", "."]);
+  await git(root, ["commit", "-m", "test: seed compatible app"]);
+  return authority;
+}
+
+describe("qualified repository integration", { concurrent: false }, () => {
+  it("binds the supported recipe digest to its exact rendered assets", async () => {
+    const recipe = await loadNodeWebRecipe();
+    const rendered = await renderNodeWebRecipe({
+      projectName: "Acme Web",
+      productTitle: "Acme Status",
+    });
+    expect(recipe).toMatchObject({
+      manifest: {
+        status: "supported",
+        runtime: { node: "24.18.1", npm: "11.16.0" },
+        stack: {
+          next: "16.3.4",
+          react: "19.2.8",
+          typescript: "6.0.3",
+          eslint: "9.39.5",
+        },
+      },
+    });
+    expect(rendered.some((file) => file.path === "recipe.yaml")).toBe(false);
+    expect(rendered.some((file) => file.path.startsWith("node_modules/"))).toBe(
+      false,
+    );
+    const packageSource = rendered.find((file) => file.path === "package.json");
+    const lockSource = rendered.find(
+      (file) => file.path === "package-lock.json",
+    );
+    const page = rendered.find((file) => file.path === "app/page.tsx");
+    expect(JSON.parse(packageSource?.content ?? "{}")).toMatchObject({
+      name: "acme-web",
+      dependencies: { next: "16.3.4", react: "19.2.8" },
+    });
+    expect(JSON.parse(lockSource?.content ?? "{}")).toMatchObject({
+      name: "acme-web",
+      packages: { "": { name: "acme-web" } },
+    });
+    expect(page?.content).toContain("Acme Status");
+    expect(rendered.find((file) => file.path === "README.md")?.content).toMatch(
+      /^# Acme Status\n/u,
+    );
+    const quoted = await renderNodeWebRecipe({
+      projectName: "quoted-title",
+      productTitle: 'Acme "Portal" </h1> ~~Beta~~ &copy;',
+    });
+    expect(
+      quoted.find((file) => file.path === "app/page.tsx")?.content,
+    ).toContain('{"Acme \\"Portal\\" </h1> ~~Beta~~ &copy;"}');
+    expect(
+      quoted.find((file) => file.path === "app/layout.tsx")?.content,
+    ).toContain('title: "Acme \\"Portal\\" </h1> ~~Beta~~ &copy;"');
+    expect(quoted.find((file) => file.path === "README.md")?.content).toContain(
+      String.raw`# Acme \"Portal\" \<\/h1\> \~\~Beta\~\~ \&copy\;` + "\n",
+    );
+    const placeholderTitle = 'MILL_PRODUCT_TITLE_MARKDOWN_TOKEN "exact"';
+    const placeholderRendered = await renderNodeWebRecipe({
+      projectName: "placeholder-title",
+      productTitle: placeholderTitle,
+    });
+    expect(
+      placeholderRendered.find((file) => file.path === "app/page.tsx")?.content,
+    ).toContain(`{${JSON.stringify(placeholderTitle)}}`);
+    expect(
+      quoted.find((file) => file.path === ".gitignore")?.content,
+    ).toContain("node_modules");
+    const fallback = await renderNodeWebRecipe({
+      projectName: "✨",
+      productTitle: "Fallback",
+    });
+    const fallbackPackage = JSON.parse(
+      fallback.find((file) => file.path === "package.json")?.content ?? "{}",
+    ) as { name?: string };
+    expect(fallbackPackage.name).toBe("mill-web-product");
+  });
+
+  it("fails closed on ambiguous identity, approval, and target authority", async () => {
+    const workspace = await temporaryDirectory("mill-greenfield-authority-");
+    try {
+      const authority = await authorityFixture(workspace.path);
+      const targetDirectory = "new-app";
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          repositoryId: "not-a-uuid",
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "INVALID_REPOSITORY_ID" });
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          authorEmail: "invalid",
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "INVALID_AUTHOR_IDENTITY" });
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          authorEmail: `${"!@".repeat(100_000)}invalid`,
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "INVALID_AUTHOR_IDENTITY" });
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          approvedBy: "",
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "INVALID_AUTHOR_IDENTITY" });
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          approvedAt: "not-a-time",
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "INVALID_APPROVAL_TIME" });
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          approvedAt: "2026-09-02",
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "INVALID_APPROVAL_TIME" });
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          approvedAt: new Date(Date.now() + 60_000).toISOString(),
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "INVALID_APPROVAL_TIME" });
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          productApprovalDigest: `sha256:${"f".repeat(64)}`,
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "PLANNING_APPROVAL_MISMATCH" });
+      const proposalPath = path.join(
+        workspace.path,
+        authority.options.proposalPath,
+      );
+      const originalProposal = JSON.parse(
+        await readFile(proposalPath, "utf8"),
+      ) as Record<string, unknown>;
+      const unsupportedProposal = structuredClone(originalProposal) as {
+        blueprints: { recipe: string; recipeVersion: string }[];
+      };
+      if (unsupportedProposal.blueprints[0] === undefined) {
+        throw new Error("expected one blueprint fixture");
+      }
+      unsupportedProposal.blueprints[0].recipe = "another-recipe";
+      await writeFile(proposalPath, `${JSON.stringify(unsupportedProposal)}\n`);
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          productApprovalDigest: canonicalDigest(
+            unsupportedProposal as unknown as JsonValue,
+          ),
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "APPROVED_RECIPE_UNSUPPORTED" });
+      unsupportedProposal.blueprints[0].recipe = "node-typescript-next-web";
+      unsupportedProposal.blueprints[0].recipeVersion = "1.0.1";
+      await writeFile(proposalPath, `${JSON.stringify(unsupportedProposal)}\n`);
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          productApprovalDigest: canonicalDigest(
+            unsupportedProposal as unknown as JsonValue,
+          ),
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "APPROVED_RECIPE_UNSUPPORTED" });
+      const unboundScenario = structuredClone(originalProposal) as {
+        scenarioSet: { scenarios: { recipeOracle?: string }[] };
+      };
+      delete unboundScenario.scenarioSet.scenarios[0]?.recipeOracle;
+      await writeFile(proposalPath, `${JSON.stringify(unboundScenario)}\n`);
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          productApprovalDigest: canonicalDigest(
+            unboundScenario as unknown as JsonValue,
+          ),
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "RECIPE_SCENARIO_UNSUPPORTED" });
+      const humanInvariant = structuredClone(originalProposal) as {
+        productContract: {
+          invariants: { verification: { mode: string; ref: string } }[];
+        };
+        blueprints: { productContractDigest: string }[];
+        scenarioSet: { productContractDigest: string };
+      };
+      if (
+        humanInvariant.productContract.invariants[0] === undefined ||
+        humanInvariant.blueprints[0] === undefined
+      ) {
+        throw new Error("expected one invariant and blueprint");
+      }
+      humanInvariant.productContract.invariants[0].verification = {
+        mode: "human",
+        ref: "operator-attestation",
+      };
+      const humanProductDigest = canonicalDigest(
+        humanInvariant.productContract,
+      );
+      humanInvariant.blueprints[0].productContractDigest = humanProductDigest;
+      humanInvariant.scenarioSet.productContractDigest = humanProductDigest;
+      await writeFile(proposalPath, `${JSON.stringify(humanInvariant)}\n`);
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          productApprovalDigest: canonicalDigest(
+            humanInvariant as unknown as JsonValue,
+          ),
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "RECIPE_INVARIANT_UNSUPPORTED" });
+
+      const crossingScenario = structuredClone(originalProposal) as {
+        productContract: {
+          acceptance: {
+            id: string;
+            kind: "functional";
+            statement: string;
+            sourceRefs: string[];
+          }[];
+        };
+        blueprints: { productContractDigest: string }[];
+        scenarioSet: {
+          productContractDigest: string;
+          scenarios: { acceptanceRefs: string[] }[];
+        };
+      };
+      if (
+        crossingScenario.blueprints[0] === undefined ||
+        crossingScenario.scenarioSet.scenarios[0] === undefined
+      ) {
+        throw new Error("expected one scenario and blueprint");
+      }
+      crossingScenario.productContract.acceptance.push({
+        id: "ACC-OTHER",
+        kind: "functional",
+        statement: "Another outcome remains separate.",
+        sourceRefs: ["SRC-PRD"],
+      });
+      crossingScenario.scenarioSet.scenarios[0].acceptanceRefs.push(
+        "ACC-OTHER",
+      );
+      const crossingProductDigest = canonicalDigest(
+        crossingScenario.productContract,
+      );
+      crossingScenario.blueprints[0].productContractDigest =
+        crossingProductDigest;
+      crossingScenario.scenarioSet.productContractDigest =
+        crossingProductDigest;
+      await writeFile(proposalPath, `${JSON.stringify(crossingScenario)}\n`);
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          productApprovalDigest: canonicalDigest(
+            crossingScenario as unknown as JsonValue,
+          ),
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "OUTCOME_SCENARIO_SCOPE_INVALID" });
+
+      const riskyProposal = structuredClone(originalProposal) as {
+        productContract: { invariants: { criticality: string }[] };
+        blueprints: { productContractDigest: string }[];
+        scenarioSet: { productContractDigest: string };
+      };
+      if (
+        riskyProposal.productContract.invariants[0] === undefined ||
+        riskyProposal.blueprints[0] === undefined
+      ) {
+        throw new Error("expected risk-bound fixture inputs");
+      }
+      riskyProposal.productContract.invariants[0].criticality = "high";
+      const riskyProductDigest = canonicalDigest(riskyProposal.productContract);
+      riskyProposal.blueprints[0].productContractDigest = riskyProductDigest;
+      riskyProposal.scenarioSet.productContractDigest = riskyProductDigest;
+      await writeFile(proposalPath, `${JSON.stringify(riskyProposal)}\n`);
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          productApprovalDigest: canonicalDigest(
+            riskyProposal as unknown as JsonValue,
+          ),
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "OUTCOME_RISK_EVIDENCE_REQUIRED" });
+      await writeFile(proposalPath, `${JSON.stringify(originalProposal)}\n`);
+      await mkdir(path.join(workspace.path, targetDirectory));
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          targetDirectory,
+        }),
+      ).rejects.toMatchObject({ code: "GREENFIELD_TARGET_EXISTS" });
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          targetDirectory: "../escape",
+        }),
+      ).rejects.toMatchObject({ code: "INVALID_INTEGRATION_PATH" });
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          targetDirectory: "new-parent/nested-app",
+        }),
+      ).rejects.toMatchObject({ code: "GREENFIELD_TARGET_ANCESTOR_UNSAFE" });
+      await mkdir(path.join(workspace.path, "real-parent"));
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          targetDirectory: "real-parent/nested-app",
+        }),
+      ).resolves.toMatchObject({
+        plan: { target: { directoryName: "real-parent/nested-app" } },
+      });
+      await writeFile(
+        path.join(workspace.path, "file-parent"),
+        "not a directory\n",
+      );
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          targetDirectory: "file-parent/escape",
+        }),
+      ).rejects.toMatchObject({ code: "GREENFIELD_TARGET_ANCESTOR_UNSAFE" });
+      await symlink("..", path.join(workspace.path, "linked-parent"), "dir");
+      await expect(
+        planGreenfieldIntegration({
+          ...authority.options,
+          targetDirectory: "linked-parent/escape",
+        }),
+      ).rejects.toMatchObject({ code: "GREENFIELD_TARGET_ANCESTOR_UNSAFE" });
+    } finally {
+      await workspace.cleanup();
+    }
+  });
+
+  it("exposes explicit plan and attended-apply CLI boundaries", async () => {
+    const workspace = await temporaryDirectory("mill-integration-cli-");
+    const adoption = await temporaryDirectory("mill-adoption-cli-");
+    try {
+      const authority = await authorityFixture(workspace.path);
+      const common = [
+        "--prd",
+        authority.options.prdPath,
+        "--sources",
+        authority.options.sourceManifestPath,
+        "--proposal",
+        authority.options.proposalPath,
+        "--approve-product",
+        authority.options.productApprovalDigest,
+        "--repository-id",
+        authority.options.repositoryId,
+        "--approved-by",
+        authority.options.approvedBy,
+        "--approved-at",
+        authority.options.approvedAt,
+        "--author-name",
+        authority.options.authorName,
+        "--author-email",
+        authority.options.authorEmail,
+      ];
+      const planned = capture();
+      expect(
+        await runCli(
+          [
+            "--json",
+            "--cwd",
+            workspace.path,
+            "new",
+            "cli-app",
+            "--dry-run",
+            ...common,
+          ],
+          planned.io,
+        ),
+      ).toBe(0);
+      const plannedResult = JSON.parse(planned.stdout.join("")) as {
+        data: { approvalDigest: string };
+      };
+      const unattended = capture();
+      expect(
+        await runCli(
+          [
+            "--json",
+            "--cwd",
+            workspace.path,
+            "new",
+            "cli-app",
+            "--apply",
+            ...common,
+            "--approve-plan",
+            plannedResult.data.approvalDigest,
+          ],
+          unattended.io,
+        ),
+      ).toBe(78);
+      expect(JSON.parse(unattended.stdout.join(""))).toMatchObject({
+        reasons: [{ code: "ATTENDANCE_REQUIRED" }],
+      });
+      const missingPlanApproval = capture();
+      expect(
+        await runCli(
+          [
+            "--json",
+            "--cwd",
+            workspace.path,
+            "new",
+            "cli-app",
+            "--apply",
+            "--attended",
+            ...common,
+          ],
+          missingPlanApproval.io,
+        ),
+      ).toBe(64);
+      expect(JSON.parse(missingPlanApproval.stdout.join(""))).toMatchObject({
+        reasons: [{ code: "USAGE_ERROR" }],
+      });
+
+      const adoptionAuthority = await seedCompatibleRepository(adoption.path);
+      const adoptionCommon = [
+        "--prd",
+        adoptionAuthority.options.prdPath,
+        "--sources",
+        adoptionAuthority.options.sourceManifestPath,
+        "--proposal",
+        adoptionAuthority.options.proposalPath,
+        "--approve-product",
+        adoptionAuthority.options.productApprovalDigest,
+        "--repository-id",
+        adoptionAuthority.options.repositoryId,
+        "--approved-by",
+        adoptionAuthority.options.approvedBy,
+        "--approved-at",
+        adoptionAuthority.options.approvedAt,
+        "--author-name",
+        adoptionAuthority.options.authorName,
+        "--author-email",
+        adoptionAuthority.options.authorEmail,
+      ];
+      const adoptPlan = capture();
+      expect(
+        await runCli(
+          [
+            "--json",
+            "--cwd",
+            adoption.path,
+            "adopt",
+            "--plan",
+            ...adoptionCommon,
+          ],
+          adoptPlan.io,
+        ),
+      ).toBe(0);
+      const adoptResult = JSON.parse(adoptPlan.stdout.join("")) as {
+        data: { approvalDigest: string };
+      };
+      const adoptUnattended = capture();
+      expect(
+        await runCli(
+          [
+            "--json",
+            "--cwd",
+            adoption.path,
+            "adopt",
+            "--apply",
+            ...adoptionCommon,
+            "--approve-plan",
+            adoptResult.data.approvalDigest,
+          ],
+          adoptUnattended.io,
+        ),
+      ).toBe(78);
+      expect(JSON.parse(adoptUnattended.stdout.join(""))).toMatchObject({
+        reasons: [{ code: "ATTENDANCE_REQUIRED" }],
+      });
+      const adoptMissingApproval = capture();
+      expect(
+        await runCli(
+          [
+            "--json",
+            "--cwd",
+            adoption.path,
+            "adopt",
+            "--apply",
+            "--attended",
+            ...adoptionCommon,
+          ],
+          adoptMissingApproval.io,
+        ),
+      ).toBe(64);
+    } finally {
+      await Promise.all([workspace.cleanup(), adoption.cleanup()]);
+    }
+  });
+
+  it("plans deterministically and applies greenfield creation transactionally", async () => {
+    const workspace = await temporaryDirectory("mill-greenfield-");
+    const alternateWorkspace = await temporaryDirectory("mill-greenfield-alt-");
+    const tools = await temporaryDirectory("mill-greenfield-tools-");
+    const state = await temporaryDirectory("mill-greenfield-state-");
+    try {
+      const authority = await authorityFixture(workspace.path);
+      const first = await planGreenfieldIntegration({
+        ...authority.options,
+        targetDirectory: "generated-app",
+      });
+      const second = await planGreenfieldIntegration({
+        ...authority.options,
+        targetDirectory: "generated-app",
+      });
+      expect(second).toEqual(first);
+      const alternateAuthority = await authorityFixture(
+        alternateWorkspace.path,
+      );
+      const alternate = await planGreenfieldIntegration({
+        ...alternateAuthority.options,
+        targetDirectory: "generated-app",
+      });
+      expect(alternate.plan.target.directoryName).toBe(
+        first.plan.target.directoryName,
+      );
+      expect(alternate.plan.target.canonicalPathDigest).not.toBe(
+        first.plan.target.canonicalPathDigest,
+      );
+      expect(alternate.approvalDigest).not.toBe(first.approvalDigest);
+      expect(first.plan).toMatchObject({
+        planDigest: first.approvalDigest,
+        generator: {
+          package: "@davidahmann/mill",
+          version: "0.0.0-development",
+        },
+        mode: "greenfield",
+        baseline: "unverified",
+        commandIds: ["check"],
+        recipe: { status: "supported" },
+      });
+      expect(first.plan.target.canonicalPathDigest).toMatch(
+        /^sha256:[a-f0-9]{64}$/u,
+      );
+      expect(first.plan.files.some((file) => file.path === "mill.lock")).toBe(
+        true,
+      );
+      await expect(
+        applyGreenfieldIntegration({
+          ...authority.options,
+          targetDirectory: "generated-app",
+          planApprovalDigest: first.approvalDigest,
+          attended: false,
+        }),
+      ).rejects.toMatchObject({ code: "ATTENDANCE_REQUIRED" });
+      await expect(
+        applyGreenfieldIntegration({
+          ...authority.options,
+          targetDirectory: "generated-app",
+          planApprovalDigest: `sha256:${"f".repeat(64)}`,
+          attended: true,
+        }),
+      ).rejects.toMatchObject({ code: "INTEGRATION_APPROVAL_MISMATCH" });
+      expect(await exists(path.join(workspace.path, "generated-app"))).toBe(
+        false,
+      );
+
+      const docker = await fakeDocker(tools.path);
+      process.env.MILL_DOCKER_PATH = docker.executable;
+      process.env.MILL_STATE_HOME = state.path;
+      const applied = await applyGreenfieldIntegration({
+        ...authority.options,
+        targetDirectory: "generated-app",
+        planApprovalDigest: first.approvalDigest,
+        attended: true,
+      });
+      const target = path.join(workspace.path, "generated-app");
+      expect(applied).toMatchObject({
+        repository: "generated-app",
+        planDigest: first.approvalDigest,
+        baseline: "unverified",
+      });
+      expect(await git(target, ["rev-parse", "HEAD"])).toBe(
+        `${applied.commit}\n`,
+      );
+      expect(await git(target, ["status", "--porcelain"])).toBe("");
+      expect(
+        await readFile(path.join(target, "product", "sources.yaml"), "utf8"),
+      ).toContain("uri: product/PRD.md");
+      expect(
+        parseYaml(await readFile(path.join(target, "mill.lock"), "utf8")),
+      ).toMatchObject({
+        integration: { planDigest: first.approvalDigest },
+      });
+      expect(await git(target, ["log", "-1", "--format=%B"])).toContain(
+        "Signed-off-by: David Ahmann <david@example.invalid>",
+      );
+      const racedPlan = await planGreenfieldIntegration({
+        ...authority.options,
+        targetDirectory: "raced-app",
+      });
+      const racedTarget = path.join(workspace.path, "raced-app");
+      const racingDocker = await fakeDocker(
+        tools.path,
+        false,
+        true,
+        racedTarget,
+      );
+      process.env.MILL_DOCKER_PATH = racingDocker.executable;
+      await expect(
+        applyGreenfieldIntegration({
+          ...authority.options,
+          targetDirectory: "raced-app",
+          planApprovalDigest: racedPlan.approvalDigest,
+          attended: true,
+        }),
+      ).rejects.toMatchObject({ code: "GREENFIELD_TARGET_EXISTS" });
+      expect(await readdir(racedTarget)).toEqual([]);
+      const detach = await planDetach(target);
+      expect(detach).toMatchObject({
+        mode: "manual",
+        changed: [],
+      });
+      expect(detach.remove).toEqual(
+        expect.arrayContaining(["mill.lock", "mill.yaml"]),
+      );
+      expect(detach.retain).toEqual(
+        expect.arrayContaining(["package.json", "app/page.tsx"]),
+      );
+      await writeFile(path.join(target, "package.json"), "{}\n");
+      await unlink(path.join(target, "app", "page.tsx"));
+      expect((await planDetach(target)).changed).toEqual(
+        expect.arrayContaining(["package.json", "app/page.tsx"]),
+      );
+      expect(
+        (await readdir(workspace.path)).some((entry) =>
+          entry.startsWith(".mill-new-"),
+        ),
+      ).toBe(false);
+    } finally {
+      await Promise.all([
+        workspace.cleanup(),
+        alternateWorkspace.cleanup(),
+        tools.cleanup(),
+        state.cleanup(),
+      ]);
+    }
+  });
+
+  it("does not publish greenfield authority after cancellation during commit", async () => {
+    const workspace = await temporaryDirectory("mill-greenfield-cancel-");
+    const tools = await temporaryDirectory("mill-greenfield-cancel-tools-");
+    const state = await temporaryDirectory("mill-greenfield-cancel-state-");
+    try {
+      const authority = await authorityFixture(workspace.path);
+      const plan = await planGreenfieldIntegration({
+        ...authority.options,
+        targetDirectory: "cancelled-app",
+      });
+      const docker = await fakeDocker(tools.path);
+      process.env.MILL_DOCKER_PATH = docker.executable;
+      process.env.MILL_GIT_PATH = await cancellingGit(tools.path);
+      process.env.MILL_STATE_HOME = state.path;
+      await expect(
+        applyGreenfieldIntegration({
+          ...authority.options,
+          targetDirectory: "cancelled-app",
+          planApprovalDigest: plan.approvalDigest,
+          attended: true,
+        }),
+      ).rejects.toMatchObject({ code: "GREENFIELD_CANCELLED" });
+      expect(await exists(path.join(workspace.path, "cancelled-app"))).toBe(
+        false,
+      );
+    } finally {
+      await Promise.all([
+        workspace.cleanup(),
+        tools.cleanup(),
+        state.cleanup(),
+      ]);
+    }
+  });
+
+  it("rechecks cancellation at the final greenfield publication boundary", async () => {
+    const workspace = await temporaryDirectory(
+      "mill-greenfield-publish-cancel-",
+    );
+    const tools = await temporaryDirectory(
+      "mill-greenfield-publish-cancel-tools-",
+    );
+    const state = await temporaryDirectory(
+      "mill-greenfield-publish-cancel-state-",
+    );
+    let publicationPoll: NodeJS.Timeout | undefined;
+    try {
+      const authority = await authorityFixture(workspace.path);
+      const target = path.join(workspace.path, "cancelled-app");
+      const plan = await planGreenfieldIntegration({
+        ...authority.options,
+        targetDirectory: "cancelled-app",
+      });
+      const docker = await fakeDocker(tools.path);
+      process.env.MILL_DOCKER_PATH = docker.executable;
+      process.env.MILL_STATE_HOME = state.path;
+      const controller = new AbortController();
+      publicationPoll = setInterval(() => {
+        void access(target).then(
+          () => controller.abort(),
+          () => undefined,
+        );
+      }, 1);
+      await expect(
+        applyGreenfieldIntegration({
+          ...authority.options,
+          targetDirectory: "cancelled-app",
+          planApprovalDigest: plan.approvalDigest,
+          attended: true,
+          signal: controller.signal,
+        }),
+      ).rejects.toMatchObject({ code: "GREENFIELD_CANCELLED" });
+      expect(await exists(target)).toBe(false);
+    } finally {
+      if (publicationPoll !== undefined) clearInterval(publicationPoll);
+      await Promise.all([
+        workspace.cleanup(),
+        tools.cleanup(),
+        state.cleanup(),
+      ]);
+    }
+  });
+
+  it("removes staging and state when generated-repository qualification fails", async () => {
+    const workspace = await temporaryDirectory("mill-greenfield-fail-");
+    const tools = await temporaryDirectory("mill-greenfield-fail-tools-");
+    const state = await temporaryDirectory("mill-greenfield-fail-state-");
+    try {
+      const authority = await authorityFixture(workspace.path);
+      const plan = await planGreenfieldIntegration({
+        ...authority.options,
+        targetDirectory: "failed-app",
+      });
+      const docker = await fakeDocker(tools.path, true);
+      process.env.MILL_DOCKER_PATH = docker.executable;
+      process.env.MILL_STATE_HOME = state.path;
+      const target = path.join(await realpath(workspace.path), "failed-app");
+      const applyLock = path.join(
+        workspace.path,
+        `.mill-new-${createHash("sha256").update(target).digest("hex").slice(0, 16)}.lock`,
+      );
+      await mkdir(applyLock);
+      await expect(
+        applyGreenfieldIntegration({
+          ...authority.options,
+          targetDirectory: "failed-app",
+          planApprovalDigest: plan.approvalDigest,
+          attended: true,
+        }),
+      ).rejects.toMatchObject({ code: "GREENFIELD_APPLY_ACTIVE" });
+      await rm(applyLock, { recursive: true });
+      const existingState = repositoryStateDirectory(
+        authority.options.repositoryId,
+        path.join(target, ".git"),
+      );
+      await mkdir(existingState, { recursive: true });
+      await writeFile(path.join(existingState, "sentinel"), "preserve\n");
+      await expect(
+        applyGreenfieldIntegration({
+          ...authority.options,
+          targetDirectory: "failed-app",
+          planApprovalDigest: plan.approvalDigest,
+          attended: true,
+        }),
+      ).rejects.toMatchObject({ code: "RECIPE_QUALIFICATION_FAILED" });
+      expect(await exists(path.join(workspace.path, "failed-app"))).toBe(false);
+      expect(await readFile(path.join(existingState, "sentinel"), "utf8")).toBe(
+        "preserve\n",
+      );
+      expect(
+        (await readdir(workspace.path)).some((entry) =>
+          entry.startsWith(".mill-new-"),
+        ),
+      ).toBe(false);
+      expect(await readdir(existingState)).toContain("sentinel");
+    } finally {
+      await Promise.all([
+        workspace.cleanup(),
+        tools.cleanup(),
+        state.cleanup(),
+      ]);
+    }
+  });
+
+  it("applies compatible adoption on an isolated branch without touching the checkout", async () => {
+    const repository = await temporaryDirectory("mill-adoption-");
+    const tools = await temporaryDirectory("mill-adoption-tools-");
+    try {
+      const authority = await seedCompatibleRepository(repository.path);
+      const ignorePath = path.join(repository.path, ".gitignore");
+      await writeFile(
+        ignorePath,
+        `${await readFile(ignorePath, "utf8")}\nmill.*\n`,
+      );
+      await git(repository.path, ["add", ".gitignore"]);
+      await git(repository.path, [
+        "commit",
+        "--no-gpg-sign",
+        "-m",
+        "test: ignore generated mill control files",
+      ]);
+      const base = (await git(repository.path, ["rev-parse", "HEAD"])).trim();
+      const planned = await planAdoptionIntegration({
+        ...authority.options,
+        repositoryRoot: repository.path,
+      });
+      expect(planned.plan).toMatchObject({
+        planDigest: planned.approvalDigest,
+        mode: "adoption",
+        target: { baseCommit: base },
+        baseline: "unverified",
+      });
+      await expect(
+        applyAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+          planApprovalDigest: planned.approvalDigest,
+          attended: false,
+        }),
+      ).rejects.toMatchObject({ code: "ATTENDANCE_REQUIRED" });
+      const cancelled = new AbortController();
+      cancelled.abort();
+      await expect(
+        applyAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+          planApprovalDigest: planned.approvalDigest,
+          attended: true,
+          signal: cancelled.signal,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_CANCELLED" });
+      await expect(
+        git(repository.path, [
+          "rev-parse",
+          "--verify",
+          `refs/heads/mill/adopt-${planned.approvalDigest.slice(7, 19)}`,
+        ]),
+      ).rejects.toBeDefined();
+      process.env.MILL_GIT_PATH = await cancellingGit(tools.path);
+      const applied = await applyAdoptionIntegration({
+        ...authority.options,
+        repositoryRoot: repository.path,
+        planApprovalDigest: planned.approvalDigest,
+        attended: true,
+      });
+      expect(applied).toMatchObject({
+        planDigest: planned.approvalDigest,
+        baseline: "unverified",
+      });
+      expect(await git(repository.path, ["rev-parse", "HEAD"])).toBe(
+        `${base}\n`,
+      );
+      expect(await git(repository.path, ["status", "--porcelain"])).toBe("");
+      if (originalGit === undefined) delete process.env.MILL_GIT_PATH;
+      else process.env.MILL_GIT_PATH = originalGit;
+      expect(
+        await git(repository.path, ["show", `${applied.branch}:mill.yaml`]),
+      ).toContain("trustCeiling: build");
+      expect(
+        await git(repository.path, ["show", `${applied.branch}:mill.yaml`]),
+      ).toContain("eslint.config.mjs");
+      expect(
+        parseYaml(
+          await git(repository.path, ["show", `${applied.branch}:mill.lock`]),
+        ),
+      ).toMatchObject({
+        integration: { planDigest: planned.approvalDigest },
+      });
+      expect(await git(repository.path, ["rev-parse", applied.branch])).toBe(
+        `${applied.commit}\n`,
+      );
+
+      await writeFile(path.join(repository.path, "local.txt"), "dirty\n");
+      const dirtyPlan = await planAdoptionIntegration({
+        ...authority.options,
+        repositoryRoot: repository.path,
+      });
+      await expect(
+        applyAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+          planApprovalDigest: dirtyPlan.approvalDigest,
+          attended: true,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_CHECKOUT_DIRTY" });
+    } finally {
+      await Promise.all([repository.cleanup(), tools.cleanup()]);
+    }
+  });
+
+  it("binds adoption compatibility to the exact visible base tree", async () => {
+    const ignored = await temporaryDirectory("mill-adoption-ignored-");
+    const hidden = await temporaryDirectory("mill-adoption-hidden-");
+    const canonical = await temporaryDirectory("mill-adoption-canonical-");
+    const malformed = await temporaryDirectory("mill-adoption-malformed-");
+    try {
+      const ignoredAuthority = await seedCompatibleRepository(ignored.path);
+      const ignorePath = path.join(ignored.path, ".gitignore");
+      await writeFile(
+        ignorePath,
+        `${await readFile(ignorePath, "utf8")}\npackage.json\n`,
+      );
+      await git(ignored.path, ["rm", "--cached", "package.json"]);
+      await git(ignored.path, ["add", ".gitignore"]);
+      await git(ignored.path, [
+        "commit",
+        "--no-gpg-sign",
+        "-m",
+        "test: leave ignored manifest outside the base",
+      ]);
+      await expect(
+        planAdoptionIntegration({
+          ...ignoredAuthority.options,
+          repositoryRoot: ignored.path,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_MANIFEST_INVALID" });
+
+      const hiddenAuthority = await seedCompatibleRepository(hidden.path);
+      const packagePath = path.join(hidden.path, "package.json");
+      const packageSource = await readFile(packagePath, "utf8");
+      await git(hidden.path, [
+        "update-index",
+        "--skip-worktree",
+        "package.json",
+      ]);
+      await writeFile(packagePath, `${packageSource} `);
+      await expect(
+        planAdoptionIntegration({
+          ...hiddenAuthority.options,
+          repositoryRoot: hidden.path,
+        }),
+      ).rejects.toMatchObject({ code: "HIDDEN_GIT_INDEX_STATE" });
+      await git(hidden.path, [
+        "update-index",
+        "--no-skip-worktree",
+        "package.json",
+      ]);
+
+      const canonicalAuthority = await seedCompatibleRepository(canonical.path);
+      const sourcesPath = path.join(canonical.path, "sources.json");
+      const proposalPath = path.join(canonical.path, "proposal.json");
+      const sources = JSON.parse(await readFile(sourcesPath, "utf8")) as {
+        sources: { uri: string }[];
+      };
+      if (sources.sources[0] === undefined) throw new Error("source required");
+      sources.sources[0].uri = "./PRD.md";
+      const proposal = JSON.parse(await readFile(proposalPath, "utf8")) as {
+        prd: { path: string };
+        sourceManifestDigest: string;
+      };
+      proposal.prd.path = "./PRD.md";
+      proposal.sourceManifestDigest = canonicalDigest(sources);
+      await Promise.all([
+        writeFile(sourcesPath, `${JSON.stringify(sources)}\n`),
+        writeFile(proposalPath, `${JSON.stringify(proposal)}\n`),
+      ]);
+      await git(canonical.path, ["add", "sources.json", "proposal.json"]);
+      await git(canonical.path, [
+        "commit",
+        "--no-gpg-sign",
+        "-m",
+        "test: use a noncanonical safe PRD spelling",
+      ]);
+      await expect(
+        planAdoptionIntegration({
+          ...canonicalAuthority.options,
+          prdPath: "./PRD.md",
+          productApprovalDigest: canonicalDigest(
+            proposal as unknown as JsonValue,
+          ),
+          repositoryRoot: canonical.path,
+        }),
+      ).resolves.toMatchObject({ plan: { mode: "adoption" } });
+
+      const malformedAuthority = await seedCompatibleRepository(malformed.path);
+      const malformedPackage = path.join(malformed.path, "package.json");
+      const packageBytes = await readFile(malformedPackage);
+      await writeFile(
+        malformedPackage,
+        Buffer.concat([
+          packageBytes.subarray(0, packageBytes.byteLength - 2),
+          Buffer.from(',\n  "description": "', "utf8"),
+          Buffer.from([0xff]),
+          Buffer.from('"\n}\n', "utf8"),
+        ]),
+      );
+      await git(malformed.path, ["add", "package.json"]);
+      await git(malformed.path, [
+        "commit",
+        "--no-gpg-sign",
+        "-m",
+        "test: commit malformed UTF-8",
+      ]);
+      await expect(
+        planAdoptionIntegration({
+          ...malformedAuthority.options,
+          repositoryRoot: malformed.path,
+        }),
+      ).rejects.toMatchObject({ code: "INTEGRATION_BASE_FILE_UNSAFE" });
+    } finally {
+      await Promise.all([
+        ignored.cleanup(),
+        hidden.cleanup(),
+        canonical.cleanup(),
+        malformed.cleanup(),
+      ]);
+    }
+  });
+
+  it("rejects incompatible, hazardous, already-managed, and conflicting adoption", async () => {
+    const repository = await temporaryDirectory("mill-adoption-negative-");
+    try {
+      const authority = await seedCompatibleRepository(repository.path);
+      const packagePath = path.join(repository.path, "package.json");
+      const originalPackage = await readFile(packagePath, "utf8");
+      const packageJson = JSON.parse(originalPackage) as {
+        dependencies: Record<string, string>;
+        scripts: Record<string, string>;
+      };
+
+      const sourcesPath = path.join(repository.path, "sources.json");
+      const proposalPath = path.join(repository.path, "proposal.json");
+      const originalSources = await readFile(sourcesPath, "utf8");
+      const originalProposal = await readFile(proposalPath, "utf8");
+      const prdSource = await readFile(
+        path.join(repository.path, "PRD.md"),
+        "utf8",
+      );
+      const nestedPrdPath = path.join(repository.path, "app", "PRD.md");
+      await writeFile(nestedPrdPath, prdSource);
+      const nestedSources = JSON.parse(originalSources) as {
+        sources: { uri: string }[];
+      };
+      if (nestedSources.sources[0] === undefined) {
+        throw new Error("expected one PRD source");
+      }
+      nestedSources.sources[0].uri = "app/PRD.md";
+      await writeFile(sourcesPath, `${JSON.stringify(nestedSources)}\n`);
+      const nestedProposal = JSON.parse(originalProposal) as {
+        prd: { path: string };
+        sourceManifestDigest: string;
+      };
+      nestedProposal.prd.path = "app/PRD.md";
+      nestedProposal.sourceManifestDigest = canonicalDigest(nestedSources);
+      await writeFile(proposalPath, `${JSON.stringify(nestedProposal)}\n`);
+      await expect(
+        planAdoptionIntegration({
+          ...authority.options,
+          prdPath: "app/PRD.md",
+          productApprovalDigest: canonicalDigest(
+            nestedProposal as unknown as JsonValue,
+          ),
+          repositoryRoot: repository.path,
+        }),
+      ).rejects.toMatchObject({ code: "PRD_BUILDER_SCOPE_OVERLAP" });
+      await Promise.all([
+        writeFile(sourcesPath, originalSources),
+        writeFile(proposalPath, originalProposal),
+        unlink(nestedPrdPath),
+      ]);
+
+      await writeFile(packagePath, "{not-json\n");
+      await expect(
+        planAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_MANIFEST_INVALID" });
+
+      await writeFile(
+        packagePath,
+        `${JSON.stringify({
+          ...packageJson,
+          dependencies: { ...packageJson.dependencies, next: "16.3.3" },
+        })}\n`,
+      );
+      await expect(
+        planAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_ORACLE_INCOMPATIBLE" });
+
+      const withoutCheck = { ...packageJson.scripts };
+      delete withoutCheck.check;
+      await writeFile(
+        packagePath,
+        `${JSON.stringify({ ...packageJson, scripts: withoutCheck })}\n`,
+      );
+      await expect(
+        planAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_ORACLE_INCOMPATIBLE" });
+
+      await writeFile(
+        packagePath,
+        `${JSON.stringify({
+          ...packageJson,
+          scripts: { ...packageJson.scripts, lint: "eslint src" },
+        })}\n`,
+      );
+      await expect(
+        planAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_ORACLE_INCOMPATIBLE" });
+
+      await writeFile(packagePath, originalPackage);
+      const eslintSource = await readFile(
+        path.join(repository.path, "eslint.config.mjs"),
+        "utf8",
+      );
+      await unlink(path.join(repository.path, "eslint.config.mjs"));
+      await expect(
+        planAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_ORACLE_INCOMPATIBLE" });
+      await writeFile(
+        path.join(repository.path, "eslint.config.mjs"),
+        eslintSource,
+      );
+      await writeFile(
+        path.join(repository.path, "eslint.config.mjs"),
+        "export default [];\n",
+      );
+      await expect(
+        planAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_ORACLE_INCOMPATIBLE" });
+      await writeFile(
+        path.join(repository.path, "eslint.config.mjs"),
+        eslintSource,
+      );
+      await git(repository.path, [
+        "config",
+        "--local",
+        "core.hooksPath",
+        "hooks",
+      ]);
+      await expect(
+        planAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_SCAN_BLOCKED" });
+      await git(repository.path, ["config", "--unset", "core.hooksPath"]);
+
+      await symlink("..", path.join(repository.path, "quality-link"), "dir");
+      await expect(
+        planAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_SCAN_BLOCKED" });
+      await unlink(path.join(repository.path, "quality-link"));
+
+      await writeFile(
+        path.join(repository.path, ".env.production"),
+        "TOKEN=x\n",
+      );
+      await expect(
+        planAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_SCAN_BLOCKED" });
+      await unlink(path.join(repository.path, ".env.production"));
+
+      await writeFile(path.join(repository.path, ".npmrc"), "//registry=:x\n");
+      await expect(
+        planAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_SCAN_BLOCKED" });
+      await unlink(path.join(repository.path, ".npmrc"));
+
+      await mkdir(path.join(repository.path, "product"), { recursive: true });
+      await writeFile(
+        path.join(repository.path, "product", "contract.yaml"),
+        "conflicting: true\n",
+      );
+      await expect(
+        planAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+        }),
+      ).rejects.toMatchObject({ code: "ADOPTION_AUTHORITY_CONFLICT" });
+      await unlink(path.join(repository.path, "product", "contract.yaml"));
+
+      await writeFile(
+        path.join(repository.path, "mill.yaml"),
+        'schemaVersion: "1"\n',
+      );
+      await expect(
+        planAdoptionIntegration({
+          ...authority.options,
+          repositoryRoot: repository.path,
+        }),
+      ).rejects.toMatchObject({ code: "REPOSITORY_ALREADY_MANAGED" });
+    } finally {
+      await repository.cleanup();
+    }
+  });
+
+  it("binds dependency snapshots to image and lock bytes and mounts only scratch outputs writable", async () => {
+    const repository = await temporaryDirectory("mill-dependency-repo-");
+    const state = await temporaryDirectory("mill-dependency,state-");
+    const tools = await temporaryDirectory("mill-dependency-tools-");
+    try {
+      await Promise.all([
+        writeFile(
+          path.join(repository.path, "package.json"),
+          '{"name":"fixture"}\n',
+        ),
+        writeFile(
+          path.join(repository.path, "package-lock.json"),
+          '{"lockfileVersion":3,"packages":{}}\n',
+        ),
+      ]);
+      const config = millConfigSchema.parse({
+        schemaVersion: "1",
+        repositoryId: "123e4567-e89b-42d3-a456-426614174001",
+        trustCeiling: "build",
+        sensitivePaths: [],
+        verifier: {
+          image: `node@sha256:${"a".repeat(64)}`,
+          network: "none",
+          dependencies: {
+            manager: "npm",
+            registry: "https://registry.npmjs.org",
+            targetPath: "node_modules",
+            lockPaths: ["package.json", "package-lock.json"],
+          },
+        },
+        commands: {
+          check: {
+            argv: ["node", "--test"],
+            cwd: ".",
+            controlPaths: ["package.json", "package-lock.json"],
+            capability: "test",
+            required: true,
+            timeoutSeconds: 30,
+            execution: "oci",
+            writablePaths: [".mill-output"],
+          },
+        },
+      });
+      process.env.MILL_DOCKER_PATH = path.join(tools.path, "missing-docker");
+      await expect(
+        prepareDependencySnapshot({
+          root: repository.path,
+          stateDirectory: state.path,
+          config,
+          attended: true,
+        }),
+      ).rejects.toMatchObject({ code: "OCI_RUNTIME_UNAVAILABLE" });
+      const unavailableDocker = path.join(tools.path, "docker-unavailable");
+      await writeFile(
+        unavailableDocker,
+        `#!${process.execPath}\nprocess.exit(9);\n`,
+        { mode: 0o755 },
+      );
+      await chmod(unavailableDocker, 0o755);
+      process.env.MILL_DOCKER_PATH = unavailableDocker;
+      await expect(
+        prepareDependencySnapshot({
+          root: repository.path,
+          stateDirectory: state.path,
+          config,
+          attended: true,
+        }),
+      ).rejects.toMatchObject({ code: "VERIFIER_IMAGE_UNAVAILABLE" });
+      const docker = await fakeDocker(tools.path);
+      process.env.MILL_DOCKER_PATH = docker.executable;
+      const completeIntegrity = `sha512-${Buffer.alloc(64).toString("base64")}`;
+      await mkdir(path.join(repository.path, "nested"));
+      await writeFile(
+        path.join(repository.path, "nested", "package-lock.json"),
+        '{"lockfileVersion":3,"packages":{}}\n',
+      );
+      const nestedFirstConfig = millConfigSchema.parse({
+        ...config,
+        verifier: {
+          ...config.verifier,
+          dependencies: {
+            ...config.verifier?.dependencies,
+            manager: "npm",
+            registry: "https://registry.npmjs.org",
+            targetPath: "node_modules",
+            lockPaths: [
+              "package.json",
+              "nested/package-lock.json",
+              "package-lock.json",
+            ],
+          },
+        },
+      });
+      await writeFile(
+        path.join(repository.path, "package-lock.json"),
+        `${JSON.stringify({
+          lockfileVersion: 3,
+          packages: {
+            "node_modules/untrusted": {
+              resolved: "https://example.invalid/untrusted.tgz",
+              integrity: completeIntegrity,
+            },
+          },
+        })}\n`,
+      );
+      await expect(
+        prepareDependencySnapshot({
+          root: repository.path,
+          stateDirectory: state.path,
+          config: nestedFirstConfig,
+          attended: true,
+        }),
+      ).rejects.toMatchObject({ code: "NPM_LOCK_SOURCE_UNTRUSTED" });
+      const nestedOnlyConfig = millConfigSchema.parse({
+        ...nestedFirstConfig,
+        verifier: {
+          ...nestedFirstConfig.verifier,
+          dependencies: {
+            ...nestedFirstConfig.verifier?.dependencies,
+            manager: "npm",
+            registry: "https://registry.npmjs.org",
+            targetPath: "node_modules",
+            lockPaths: ["package.json", "nested/package-lock.json"],
+          },
+        },
+      });
+      await expect(
+        prepareDependencySnapshot({
+          root: repository.path,
+          stateDirectory: state.path,
+          config: nestedOnlyConfig,
+          attended: true,
+        }),
+      ).rejects.toMatchObject({ code: "NPM_LOCK_REQUIRED" });
+      for (const [source, code] of [
+        ["{not-json\n", "NPM_LOCK_INVALID"],
+        ["[]\n", "NPM_LOCK_INVALID"],
+        ['{"lockfileVersion":3}\n', "NPM_LOCK_INVALID"],
+        [
+          '{"lockfileVersion":3,"packages":{"node_modules/example":{"resolved":"https://registry.npmjs.org/example/-/example-1.0.0.tgz"}}}\n',
+          "NPM_LOCK_SOURCE_UNTRUSTED",
+        ],
+        [
+          '{"lockfileVersion":3,"packages":{"node_modules/example":{"resolved":"https://registry.npmjs.org/example/-/example-1.0.0.tgz","integrity":"sha512-deadbeef"}}}\n',
+          "NPM_LOCK_SOURCE_UNTRUSTED",
+        ],
+        [
+          '{"lockfileVersion":3,"packages":{"node_modules/example":{"integrity":"sha512-deadbeef"}}}\n',
+          "NPM_LOCK_SOURCE_UNTRUSTED",
+        ],
+        [
+          '{"lockfileVersion":3,"packages":{"node_modules/example":{"link":true,"resolved":"file:../example","integrity":"sha512-deadbeef"}}}\n',
+          "NPM_LOCK_SOURCE_UNTRUSTED",
+        ],
+        [
+          '{"lockfileVersion":3,"packages":{"node_modules/example":{"resolved":"not-a-url","integrity":"sha512-deadbeef"}}}\n',
+          "NPM_LOCK_SOURCE_UNTRUSTED",
+        ],
+        [
+          `{"lockfileVersion":3,"packages":{"node_modules/example":{"resolved":"https://user:password@registry.npmjs.org/example/-/example-1.0.0.tgz","integrity":"${completeIntegrity}"}}}\n`,
+          "NPM_LOCK_SOURCE_UNTRUSTED",
+        ],
+        [
+          `{"lockfileVersion":3,"packages":{"node_modules/example":{"resolved":"https://registry.npmjs.org/example/-/example-1.0.0.tgz?token=x","integrity":"${completeIntegrity}"}}}\n`,
+          "NPM_LOCK_SOURCE_UNTRUSTED",
+        ],
+      ] as const) {
+        await writeFile(
+          path.join(repository.path, "package-lock.json"),
+          source,
+        );
+        await expect(
+          prepareDependencySnapshot({
+            root: repository.path,
+            stateDirectory: state.path,
+            config,
+            attended: true,
+          }),
+        ).rejects.toMatchObject({ code });
+      }
+      await writeFile(
+        path.join(repository.path, "package-lock.json"),
+        `${JSON.stringify({
+          lockfileVersion: 3,
+          packages: {
+            "node_modules/untrusted": {
+              resolved: "https://example.invalid/untrusted.tgz",
+              integrity: "sha512-deadbeef",
+            },
+          },
+        })}\n`,
+      );
+      await expect(
+        prepareDependencySnapshot({
+          root: repository.path,
+          stateDirectory: state.path,
+          config,
+          attended: true,
+        }),
+      ).rejects.toMatchObject({ code: "NPM_LOCK_SOURCE_UNTRUSTED" });
+      await writeFile(
+        path.join(repository.path, "package-lock.json"),
+        '{"lockfileVersion":3,"packages":{}}\n',
+      );
+      const noModulesDirectory = path.join(tools.path, "no-modules");
+      await mkdir(noModulesDirectory);
+      const emptyDocker = await fakeDocker(noModulesDirectory, false, false);
+      process.env.MILL_DOCKER_PATH = emptyDocker.executable;
+      await expect(
+        prepareDependencySnapshot({
+          root: repository.path,
+          stateDirectory: state.path,
+          config,
+          attended: true,
+        }),
+      ).rejects.toMatchObject({ code: "DEPENDENCY_OUTPUT_INVALID" });
+      const cancellationTools = path.join(tools.path, "cancellation");
+      await mkdir(cancellationTools);
+      const blockingDocker = await fakeDocker(
+        cancellationTools,
+        false,
+        true,
+        undefined,
+        true,
+      );
+      process.env.MILL_DOCKER_PATH = blockingDocker.executable;
+      const controller = new AbortController();
+      const cancellation = prepareDependencySnapshot({
+        root: repository.path,
+        stateDirectory: state.path,
+        config,
+        attended: true,
+        signal: controller.signal,
+      });
+      let installerStarted = false;
+      for (let attempt = 0; attempt < 100; attempt += 1) {
+        const log = await readFile(blockingDocker.log, "utf8").catch(() => "");
+        if (log.includes("dev.mill.owner=dependency-preparation")) {
+          installerStarted = true;
+          break;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 20));
+      }
+      expect(installerStarted).toBe(true);
+      controller.abort();
+      await expect(cancellation).rejects.toMatchObject({
+        code: "DEPENDENCY_PREPARATION_FAILED",
+      });
+      expect(
+        (await readFile(blockingDocker.log, "utf8"))
+          .trim()
+          .split("\n")
+          .map((line) => JSON.parse(line) as string[])
+          .some((args) => args[0] === "rm" && args.includes("--force")),
+      ).toBe(true);
+      process.env.MILL_DOCKER_PATH = docker.executable;
+      await expect(
+        prepareDependencySnapshot({
+          root: repository.path,
+          stateDirectory: state.path,
+          config: millConfigSchema.parse({
+            schemaVersion: "1",
+            repositoryId: "123e4567-e89b-42d3-a456-426614174001",
+            trustCeiling: "inspect",
+            commands: {},
+          }),
+          attended: true,
+        }),
+      ).rejects.toMatchObject({
+        code: "BUILD_NOT_AUTHORIZED",
+      });
+      await expect(
+        prepareDependencySnapshot({
+          root: repository.path,
+          stateDirectory: state.path,
+          config: millConfigSchema.parse({
+            schemaVersion: "1",
+            repositoryId: "123e4567-e89b-42d3-a456-426614174001",
+            trustCeiling: "build",
+            commands: {},
+          }),
+          attended: true,
+        }),
+      ).rejects.toMatchObject({
+        code: "VERIFIER_DEPENDENCIES_NOT_CONFIGURED",
+      });
+      await expect(
+        prepareDependencySnapshot({
+          root: repository.path,
+          stateDirectory: state.path,
+          config,
+          attended: false,
+        }),
+      ).rejects.toMatchObject({ code: "ATTENDANCE_REQUIRED" });
+      expect(
+        await dependencySnapshotDirectory({
+          root: repository.path,
+          stateDirectory: state.path,
+          config: millConfigSchema.parse({
+            schemaVersion: "1",
+            repositoryId: "123e4567-e89b-42d3-a456-426614174001",
+            trustCeiling: "inspect",
+            commands: {},
+          }),
+        }),
+      ).toBeUndefined();
+      const prepared = await prepareDependencySnapshot({
+        root: repository.path,
+        stateDirectory: state.path,
+        config,
+        attended: true,
+      });
+      expect(prepared.reused).toBe(false);
+      const markerPath = path.join(prepared.directory, "marker.json");
+      const markerSource = await readFile(markerPath, "utf8");
+      await writeFile(markerPath, "{}\n");
+      const preparationLease = new DatabaseSync(
+        `${prepared.directory}.lease.sqlite3`,
+        { timeout: 0 },
+      );
+      preparationLease.exec("BEGIN EXCLUSIVE");
+      try {
+        await expect(
+          prepareDependencySnapshot({
+            root: repository.path,
+            stateDirectory: state.path,
+            config,
+            attended: true,
+          }),
+        ).rejects.toMatchObject({ code: "DEPENDENCY_PREPARATION_ACTIVE" });
+      } finally {
+        preparationLease.exec("ROLLBACK");
+        preparationLease.close();
+      }
+      await writeFile(markerPath, markerSource);
+      expect(
+        (
+          await prepareDependencySnapshot({
+            root: repository.path,
+            stateDirectory: state.path,
+            config,
+            attended: true,
+          })
+        ).reused,
+      ).toBe(true);
+      for (const invalidMarker of ["{not-json\n", "{}\n"]) {
+        await writeFile(markerPath, invalidMarker);
+        await expect(
+          dependencySnapshotDirectory({
+            root: repository.path,
+            stateDirectory: state.path,
+            config,
+          }),
+        ).rejects.toMatchObject({ code: "VERIFIER_DEPENDENCIES_UNAVAILABLE" });
+      }
+      await writeFile(markerPath, markerSource);
+      expect(
+        (
+          await prepareDependencySnapshot({
+            root: repository.path,
+            stateDirectory: state.path,
+            config,
+            attended: true,
+          })
+        ).reused,
+      ).toBe(true);
+      await writeFile(
+        path.join(prepared.directory, "node_modules", "tampered.js"),
+        "export default 'tampered';\n",
+      );
+      await expect(
+        dependencySnapshotDirectory({
+          root: repository.path,
+          stateDirectory: state.path,
+          config,
+        }),
+      ).rejects.toMatchObject({ code: "VERIFIER_DEPENDENCIES_UNAVAILABLE" });
+      const repairedSnapshot = await prepareDependencySnapshot({
+        root: repository.path,
+        stateDirectory: state.path,
+        config,
+        attended: true,
+      });
+      expect(repairedSnapshot).toMatchObject({
+        directory: prepared.directory,
+        reused: false,
+      });
+      await expect(
+        access(
+          path.join(repairedSnapshot.directory, "node_modules", "tampered.js"),
+        ),
+      ).rejects.toMatchObject({ code: "ENOENT" });
+      expect(
+        await dependencySnapshotDirectory({
+          root: repository.path,
+          stateDirectory: state.path,
+          config,
+        }),
+      ).toBe(prepared.directory);
+      const task = taskPacketV1Schema.parse({
+        schemaVersion: "1",
+        id: "dependency-fixture",
+        title: "Dependency fixture",
+        objective: "Verify exact dependency mounting.",
+        riskClass: "low",
+        baseRef: "HEAD",
+        authority: {
+          productContract: {
+            path: "product.yaml",
+            digest: `sha256:${"b".repeat(64)}`,
+          },
+          scenarioSet: {
+            path: "scenarios.yaml",
+            digest: `sha256:${"c".repeat(64)}`,
+          },
+          policy: { path: "WORKFLOW.md", digest: `sha256:${"d".repeat(64)}` },
+        },
+        contextPaths: ["package.json"],
+        allowedPaths: ["src/**"],
+        commandIds: ["check"],
+        acceptance: [{ id: "ACC-CHECK", statement: "The check passes." }],
+        commit: {
+          message: "test: dependency fixture",
+          authorName: "Mill Test",
+          authorEmail: "mill-test@example.invalid",
+        },
+        budget: { deadlineSeconds: 60, maxOutputBytes: 1048576, retryCount: 0 },
+      });
+      const evidence = await verifyDeclaredCommands({
+        root: repository.path,
+        dependencyRoot: prepared.directory,
+        candidateCommit: "a".repeat(40),
+        config,
+        task,
+        deadlineMs: Date.now() + 30_000,
+        maxOutputBytes: 1024 * 1024,
+      });
+      expect(evidence.passed).toBe(true);
+      const calls = (await readFile(docker.log, "utf8"))
+        .trim()
+        .split("\n")
+        .map((line) => JSON.parse(line) as string[]);
+      const verifier = calls.find(
+        (args) => args[0] === "run" && args.includes("dev.mill.owner=verifier"),
+      );
+      const installer = calls.find(
+        (args) =>
+          args[0] === "run" &&
+          args.includes("dev.mill.owner=dependency-preparation"),
+      );
+      expect(installer).toEqual(expect.arrayContaining(["--pull", "never"]));
+      expect(verifier).toEqual(
+        expect.arrayContaining([
+          "--pull",
+          "never",
+          expect.stringContaining("target=/workspace/node_modules,readonly"),
+          "type=tmpfs,target=/workspace/.mill-output,tmpfs-size=268435456,tmpfs-mode=1777",
+        ]),
+      );
+      expect(
+        verifier?.find((value) =>
+          value.includes("target=/workspace/node_modules"),
+        ),
+      ).not.toContain(",state-");
+
+      await writeFile(
+        path.join(repository.path, "package-lock.json"),
+        '{"lockfileVersion":2}\n',
+      );
+      await expect(
+        dependencySnapshotDirectory({
+          root: repository.path,
+          stateDirectory: state.path,
+          config,
+        }),
+      ).rejects.toMatchObject({ code: "VERIFIER_DEPENDENCIES_UNAVAILABLE" });
+      await expect(
+        verifyDeclaredCommands({
+          root: repository.path,
+          dependencyRoot: prepared.directory,
+          candidateCommit: "a".repeat(40),
+          config,
+          task,
+          deadlineMs: Date.now() + 30_000,
+          maxOutputBytes: 1024 * 1024,
+        }),
+      ).rejects.toMatchObject({ code: "VERIFIER_DEPENDENCY_LOCK_DRIFT" });
+    } finally {
+      await Promise.all([
+        repository.cleanup(),
+        state.cleanup(),
+        tools.cleanup(),
+      ]);
+    }
+  });
+});
diff --git a/test/runtime-boundaries.test.ts b/test/runtime-boundaries.test.ts
index e63a24c..8b914b9 100644
--- a/test/runtime-boundaries.test.ts
+++ b/test/runtime-boundaries.test.ts
@@ -1,5 +1,12 @@
 import { execFile } from "node:child_process";
-import { chmod, mkdir, readFile, symlink, writeFile } from "node:fs/promises";
+import {
+  chmod,
+  mkdir,
+  readFile,
+  symlink,
+  unlink,
+  writeFile,
+} from "node:fs/promises";
 import path from "node:path";
 import { promisify } from "node:util";
 
@@ -632,6 +639,60 @@ describe("runtime authority and repository boundaries", () => {
     }
   });
 
+  it("rejects verifier mounts that hide content or cannot be represented exactly", async () => {
+    const fixture = await runtimeFixture();
+    process.env.MILL_DOCKER_PATH = fixture.dockerPath;
+    try {
+      const inputs = await loadRuntimeInputs(fixture.root, fixture.taskPath);
+      const command = inputs.config.commands.test;
+      if (command === undefined) throw new Error("fixture command missing");
+      const call = (writablePaths: string[]) =>
+        verifyDeclaredCommands({
+          root: fixture.root,
+          candidateCommit: "a".repeat(40),
+          config: {
+            ...inputs.config,
+            commands: {
+              ...inputs.config.commands,
+              test: { ...command, writablePaths },
+            },
+          },
+          task: inputs.task,
+          deadlineMs: Date.now() + 30_000,
+          maxOutputBytes: 1024 * 1024,
+        });
+
+      await expect(call(["nested/output"])).rejects.toMatchObject({
+        code: "VERIFIER_MOUNT_PATH_UNSUPPORTED",
+      });
+      await expect(call(["scratch,output"])).rejects.toMatchObject({
+        code: "VERIFIER_MOUNT_PATH_UNSUPPORTED",
+      });
+      await expect(call(["."])).rejects.toMatchObject({
+        code: "VERIFIER_MOUNT_PATH_UNSUPPORTED",
+      });
+      await expect(call(["src"])).rejects.toMatchObject({
+        code: "VERIFIER_WRITABLE_PATH_OCCUPIED",
+      });
+
+      const commaEntry = path.join(fixture.root, "hostile,name");
+      await writeFile(commaEntry, "candidate\n");
+      await expect(call([])).rejects.toMatchObject({
+        code: "VERIFIER_WORKSPACE_ENTRY_UNSUPPORTED",
+      });
+      await unlink(commaEntry);
+
+      const symbolicEntry = path.join(fixture.root, "hostile-link");
+      await symlink("src", symbolicEntry);
+      await expect(call([])).rejects.toMatchObject({
+        code: "VERIFIER_WORKSPACE_ENTRY_UNSUPPORTED",
+      });
+      await unlink(symbolicEntry);
+    } finally {
+      await fixture.cleanup();
+    }
+  });
+
   it("fails closed when the OCI verifier contract or image is unavailable", async () => {
     const fixture = await runtimeFixture();
     const tools = await temporaryDirectory("mill-verifier-unavailable-");
diff --git a/test/runtime-cli.test.ts b/test/runtime-cli.test.ts
index 3db64cd..c984cb1 100644
--- a/test/runtime-cli.test.ts
+++ b/test/runtime-cli.test.ts
@@ -166,6 +166,13 @@ describe("runtime CLI contracts", () => {
         ]),
       ).toMatchObject({ exitCode: 0, value: { ok: true } });
 
+      expect(
+        await jsonCommand(["--cwd", fixture.root, "cancel", "--run", runId]),
+      ).toMatchObject({
+        exitCode: 0,
+        value: { data: { run: { status: "cancelled" } } },
+      });
+
       const second = await jsonCommand([
         "--cwd",
         fixture.root,
diff --git a/test/runtime-fixture.ts b/test/runtime-fixture.ts
index afa4137..b0feb3f 100644
--- a/test/runtime-fixture.ts
+++ b/test/runtime-fixture.ts
@@ -48,6 +48,7 @@ export async function runtimeFixture(
   const state = await temporaryDirectory("mill-runtime-state-");
   const tools = await temporaryDirectory("mill-runtime-tools-");
   const root = repository.path;
+  const prd = "# Fixture PRD\n\nKeep the exported value positive.\n";
   await Promise.all([
     writeFile(path.join(root, ".gitignore"), "ignored-output\n"),
     mkdir(path.join(root, "product", "tasks"), { recursive: true }),
@@ -132,6 +133,35 @@ scenarios:
   });
   const policy = "# Fixture policy\n\nOnly src/value.js may change.\n";
   await Promise.all([
+    writeFile(path.join(root, "product", "PRD.md"), prd),
+    writeFile(
+      path.join(root, "product", "sources.yaml"),
+      stringifyYaml({
+        schemaVersion: "1",
+        trigger: "bootstrap",
+        providers: [
+          {
+            id: "operator",
+            name: "Test operator",
+            queries: [],
+            networkDisclosure: "No network access",
+          },
+        ],
+        sources: [
+          {
+            id: "SRC-PRD",
+            class: "user_evidence",
+            uri: "product/PRD.md",
+            revision: textDigest(prd),
+            digest: textDigest(prd),
+            observedAt: "2026-09-02T00:00:00.000Z",
+            freshness: "current",
+            authority: "constraint",
+            claims: ["The exported value remains positive."],
+          },
+        ],
+      }),
+    ),
     writeFile(path.join(root, "product", "contract.yaml"), product),
     writeFile(path.join(root, "product", "impact.yaml"), impact),
     writeFile(path.join(root, "quality", "scenarios.yaml"), scenarios),
@@ -306,10 +336,11 @@ const args=process.argv.slice(2);
 if(args[0]==="--version"){console.log("Docker version 29.7.2");process.exit(0)}
 if(args[0]==="image"&&args[1]==="inspect"){console.log("[]");process.exit(0)}
 if(args[0]==="rm"){process.exit(0)}
-const mount=args[args.indexOf("--mount")+1]??"";
-const source=/source=([^,]+)/u.exec(mount)?.[1];
-if(!source||!mount.includes("readonly"))process.exit(2);
-const value=await readFile(path.join(source,"src/value.js"),"utf8");
+const mounts=args.filter((value)=>value.startsWith("type="));
+const sourceMount=mounts.find((value)=>value.includes("target=/workspace/src,readonly"))??"";
+const source=/source=([^,]+)/u.exec(sourceMount)?.[1];
+if(!source)process.exit(2);
+const value=await readFile(path.join(source,"value.js"),"utf8");
 process.exit(/value = [1-9]/u.test(value)?0:1);
 `,
     { mode: 0o755 },
diff --git a/test/runtime-lifecycle.test.ts b/test/runtime-lifecycle.test.ts
index 1618a74..965d809 100644
--- a/test/runtime-lifecycle.test.ts
+++ b/test/runtime-lifecycle.test.ts
@@ -200,6 +200,38 @@ describe("local delivery lifecycle", () => {
     }
   });
 
+  it("serializes active-run admission with run creation under the writer lease", async () => {
+    const fixture = await runtimeFixture();
+    activate(fixture);
+    try {
+      const approvalDigest = await qualifiedApproval(fixture);
+      const inputs = await loadRuntimeInputs(fixture.root, fixture.taskPath);
+      const store = await StateStore.open(
+        inputs.config.repositoryId,
+        await commonGitDirectory(fixture.root),
+      );
+      store.createRun({
+        repositoryId: inputs.config.repositoryId,
+        taskId: "already-active",
+        taskDigest: inputs.taskDigest,
+        configDigest: inputs.configDigest,
+        baseCommit: (await git(fixture.root, ["rev-parse", "HEAD"])).trim(),
+        deadlineAt: new Date(Date.now() + 60_000).toISOString(),
+      });
+      store.close();
+
+      await expect(
+        startLocalRun({
+          root: fixture.root,
+          taskPath: fixture.taskPath,
+          approvalDigest,
+        }),
+      ).rejects.toMatchObject({ code: "ACTIVE_OUTCOME_CONFLICT" });
+    } finally {
+      await fixture.cleanup();
+    }
+  });
+
   it("rejects ignored-file contamination before exact-candidate verification", async () => {
     const fixture = await runtimeFixture();
     activate(fixture);
diff --git a/test/runtime-process.test.ts b/test/runtime-process.test.ts
index 819b9bf..b4a7d63 100644
--- a/test/runtime-process.test.ts
+++ b/test/runtime-process.test.ts
@@ -4,6 +4,7 @@ import path from "node:path";
 import { describe, expect, it } from "vitest";
 
 import {
+  processCancellationScope,
   processIdentityStatus,
   runProcess,
   type ActiveProcess,
@@ -11,6 +12,29 @@ import {
 import { temporaryDirectory } from "./helpers.js";
 
 describe("controlled process runner", () => {
+  it("propagates and disposes an optional operation cancellation scope", () => {
+    const sigintListeners = process.listenerCount("SIGINT");
+    const sigtermListeners = process.listenerCount("SIGTERM");
+    const parent = new AbortController();
+    const scope = processCancellationScope(parent.signal);
+    expect(scope.signal.aborted).toBe(false);
+    parent.abort();
+    expect(scope.signal.aborted).toBe(true);
+    scope.dispose();
+    expect(process.listenerCount("SIGINT")).toBe(sigintListeners);
+    expect(process.listenerCount("SIGTERM")).toBe(sigtermListeners);
+
+    const alreadyAborted = new AbortController();
+    alreadyAborted.abort();
+    const inherited = processCancellationScope(alreadyAborted.signal);
+    expect(inherited.signal.aborted).toBe(true);
+    inherited.dispose();
+
+    const standalone = processCancellationScope();
+    expect(standalone.signal.aborted).toBe(false);
+    standalone.dispose();
+  });
+
   it("enforces absolute deadlines and output budgets", async () => {
     const timed = await runProcess({
       executable: process.execPath,
@@ -233,5 +257,13 @@ describe("controlled process runner", () => {
     expect(active).toBeDefined();
     if (active === undefined) throw new Error("active process missing");
     expect(processIdentityStatus(active)).toBe("mismatch");
+    expect(
+      processIdentityStatus({
+        id: "malformed",
+        pid: 0,
+        processGroup: 0,
+        identity: `sha256:${"0".repeat(64)}`,
+      }),
+    ).toBe("unknown");
   });
 });
diff --git a/test/schemas.test.ts b/test/schemas.test.ts
index b40948f..52f9ab1 100644
--- a/test/schemas.test.ts
+++ b/test/schemas.test.ts
@@ -326,12 +326,86 @@ const samples = {
     ],
     passed: true,
   },
+  recipeManifest: {
+    schemaVersion: "1",
+    id: "node-typescript-next-web",
+    version: "1.0.0",
+    status: "supported",
+    observedAt: "2026-09-02T14:15:00.000Z",
+    runtime: { node: "24.18.1", npm: "11.16.0" },
+    stack: {
+      next: "16.3.4",
+      react: "19.2.8",
+      reactDom: "19.2.8",
+      typescript: "6.0.3",
+      eslint: "9.39.5",
+      prettier: "3.9.6",
+      vitest: "4.1.11",
+      playwright: "1.62.1",
+    },
+    verifierImage: `playwright@${digest}`,
+    registry: "https://registry.npmjs.org",
+    licensePolicy: {
+      allowed: ["MIT"],
+      reviewedPackages: [{ name: "next", license: "MIT" }],
+    },
+    commands: { required: ["check"], native: ["check"] },
+    oracles: [
+      {
+        id: "web-title-and-health",
+        commandId: "check",
+        evidencePaths: ["test/browser/home.spec.ts"],
+        proves: ["the delivered web surface is healthy"],
+      },
+    ],
+    writablePaths: [".mill-output", ".next"],
+    sources: ["https://nextjs.org/docs"],
+  },
+  repositoryIntegrationPlan: {
+    schemaVersion: "1",
+    planDigest: digest,
+    generator: { package: "@davidahmann/mill", version: "1.0.0" },
+    mode: "greenfield",
+    target: {
+      directoryName: "product",
+      canonicalPathDigest: digest,
+      baseCommit: null,
+      scanDigest: null,
+    },
+    productProposalDigest: digest,
+    productContractDigest: digest,
+    recipe: {
+      id: "node-typescript-next-web",
+      version: "1.0.0",
+      digest,
+      status: "supported",
+      verifierImage: `playwright@${digest}`,
+    },
+    approval: {
+      approvedBy: "David Ahmann",
+      approvedAt: "2026-09-02T14:15:00.000Z",
+    },
+    files: [
+      {
+        path: "package.json",
+        ownership: "generated_once",
+        action: "create",
+        contentDigest: digest,
+        preexistingDigest: null,
+      },
+    ],
+    commandIds: ["check"],
+    networkDisclosure: ["HTTPS package installation"],
+    baseline: "unverified",
+  },
 } as const;
 
 const schemaFiles = {
   sourceManifest: "source-manifest.schema.json",
   managedRepository: "managed-repository.schema.json",
   productContract: "product-contract.schema.json",
+  recipeManifest: "recipe-manifest.schema.json",
+  repositoryIntegrationPlan: "repository-integration-plan.schema.json",
   specificationProposal: "specification-proposal.schema.json",
   blueprint: "blueprint.schema.json",
   scenarioSet: "scenario-set.schema.json",
@@ -409,6 +483,32 @@ describe("compact schemas", () => {
     }
   });
 
+  it("rejects duplicate outcome acceptance references in both validators", async () => {
+    const ajv = new Ajv2020({ allErrors: true, strict: true });
+    const validate = ajv.compile(
+      JSON.parse(
+        await readFile(
+          path.join("schemas", "product-contract.schema.json"),
+          "utf8",
+        ),
+      ),
+    );
+    const duplicate = {
+      ...samples.productContract,
+      outcomes: [
+        {
+          id: "OUT-REVIEWED-PR",
+          statement: "Reviewed PR",
+          acceptanceIds: ["ACC-ONE", "ACC-ONE"],
+        },
+      ],
+    };
+    expect(validate(duplicate)).toBe(false);
+    expect(contractSchemas.productContract.safeParse(duplicate).success).toBe(
+      false,
+    );
+  });
+
   it("rejects mutable or local Mill lock selectors in both validators", async () => {
     const ajv = new Ajv2020({ allErrors: true, strict: true });
     const validate = ajv.compile(
@@ -440,6 +540,10 @@ describe("compact schemas", () => {
         await readFile(path.join("schemas", "mill-config.schema.json"), "utf8"),
       ),
     );
+    const legacyConfig = contractSchemas.millConfig.parse(samples.millConfig);
+    expect(
+      Object.hasOwn(legacyConfig.commands.test ?? {}, "writablePaths"),
+    ).toBe(false);
     const configWithEmptyKey = {
       ...samples.millConfig,
       commands: {
@@ -485,6 +589,43 @@ describe("compact schemas", () => {
       contractSchemas.millConfig.safeParse(configWithUnsafeControlPath).success,
     ).toBe(false);
 
+    for (const writablePath of ["nested/output", "scratch,output", "."]) {
+      const configWithUnsupportedWritablePath = {
+        ...samples.millConfig,
+        commands: {
+          test: {
+            ...samples.millConfig.commands.test,
+            writablePaths: [writablePath],
+          },
+        },
+      };
+      expect(millConfig(configWithUnsupportedWritablePath)).toBe(false);
+      expect(
+        contractSchemas.millConfig.safeParse(configWithUnsupportedWritablePath)
+          .success,
+      ).toBe(false);
+    }
+
+    const configWithUnsupportedDependencyTarget = {
+      ...samples.millConfig,
+      verifier: {
+        image: `node@${digest}`,
+        network: "none",
+        dependencies: {
+          manager: "npm",
+          registry: "https://registry.npmjs.org",
+          targetPath: "deps",
+          lockPaths: ["package-lock.json"],
+        },
+      },
+    };
+    expect(millConfig(configWithUnsupportedDependencyTarget)).toBe(false);
+    expect(
+      contractSchemas.millConfig.safeParse(
+        configWithUnsupportedDependencyTarget,
+      ).success,
+    ).toBe(false);
+
     const millLock = ajv.compile(
       JSON.parse(
         await readFile(path.join("schemas", "mill-lock.schema.json"), "utf8"),
diff --git a/vitest.config.ts b/vitest.config.ts
index 85c6292..6eed4d4 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -3,6 +3,7 @@ import { defineConfig } from "vitest/config";
 export default defineConfig({
   test: {
     clearMocks: true,
+    exclude: ["recipes/**", "node_modules/**", "dist/**"],
     coverage: {
       provider: "v8",
       reporter: ["text", "json-summary"],